certs

package
v1.30.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 17, 2024 License: Apache-2.0 Imports: 15 Imported by: 90

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func CheckCertificatePeriodValidity added in v1.20.0 

func CheckCertificatePeriodValidity(baseName string, cert *x509.Certificate)

CheckCertificatePeriodValidity takes a certificate and prints a warning if its period is not valid related to the current time. It does so only if the certificate was not validated already by keeping track with a cache.

func CreateCACertAndKeyFiles added in v1.10.0 

func CreateCACertAndKeyFiles(certSpec *KubeadmCert, cfg *kubeadmapi.InitConfiguration) error

CreateCACertAndKeyFiles generates and writes out a given certificate authority. The certSpec should be one of the variables from this package.

func CreateCertAndKeyFilesWithCA added in v1.12.0 

func CreateCertAndKeyFilesWithCA(certSpec *KubeadmCert, caCertSpec *KubeadmCert, cfg *kubeadmapi.InitConfiguration) error

CreateCertAndKeyFilesWithCA loads the given certificate authority from disk, then generates and writes out the given certificate and key. The certSpec and caCertSpec should both be one of the variables from this package.

func CreateDefaultKeysAndCSRFiles added in v1.19.0 

func CreateDefaultKeysAndCSRFiles(out io.Writer, config *kubeadmapi.InitConfiguration) error

CreateDefaultKeysAndCSRFiles is used in ExternalCA mode to create key files and adjacent CSR files.

func CreatePKIAssets 

func CreatePKIAssets(cfg *kubeadmapi.InitConfiguration) error

CreatePKIAssets will create and write to disk all PKI assets necessary to establish the control plane. If the PKI assets already exists in the target folder, they are used only if evaluated equal; otherwise an error is returned.

func CreateServiceAccountKeyAndPublicKeyFiles added in v1.8.0 

func CreateServiceAccountKeyAndPublicKeyFiles(certsDir string, keyType kubeadmapi.EncryptionAlgorithmType) error

CreateServiceAccountKeyAndPublicKeyFiles creates new public/private key files for signing service account users. If the sa public/private key files already exist in the target folder, they are used only if evaluated equals; otherwise an error is returned.

func LoadCertificateAuthority added in v1.12.0 

func LoadCertificateAuthority(pkiDir string, baseName string) (*x509.Certificate, crypto.Signer, error)

LoadCertificateAuthority tries to load a CA in the given directory with the given name.

func NewCSR added in v1.13.0 

func NewCSR(certSpec *KubeadmCert, cfg *kubeadmapi.InitConfiguration) (*x509.CertificateRequest, crypto.Signer, error)

NewCSR will generate a new CSR and accompanying key

func SharedCertificateExists added in v1.12.0 

func SharedCertificateExists(cfg *kubeadmapi.ClusterConfiguration) (bool, error)

SharedCertificateExists verifies if the shared certificates exist and are still valid - the certificates must be equal across control-plane nodes: ca.key, ca.crt, sa.key, sa.pub, front-proxy-ca.key, front-proxy-ca.crt and etcd/ca.key, etcd/ca.crt if local/stacked etcd Missing private keys of CA are non-fatal and produce warnings.

func UsingExternalCA added in v1.8.0 

func UsingExternalCA(cfg *kubeadmapi.ClusterConfiguration) (bool, error)

UsingExternalCA determines whether the user is relying on an external CA. We currently implicitly determine this is the case when the CA Cert is present but the CA Key is not. This allows us to, e.g., skip generating certs or not start the csr signing controller. In case we are using an external front-proxy CA, the function validates the certificates signed by front-proxy CA that should be provided by the user.

func UsingExternalEtcdCA added in v1.20.14 

func UsingExternalEtcdCA(cfg *kubeadmapi.ClusterConfiguration) (bool, error)

UsingExternalEtcdCA determines whether the user is relying on an external etcd CA. We currently implicitly determine this is the case when the etcd CA Cert is present but the etcd CA Key is not. In case we are using an external etcd CA, the function validates the certificates signed by etcd CA that should be provided by the user.

func UsingExternalFrontProxyCA added in v1.14.0 

func UsingExternalFrontProxyCA(cfg *kubeadmapi.ClusterConfiguration) (bool, error)

UsingExternalFrontProxyCA determines whether the user is relying on an external front-proxy CA. We currently implicitly determine this is the case when the front proxy CA Cert is present but the front proxy CA Key is not. In case we are using an external front-proxy CA, the function validates the certificates signed by front-proxy CA that should be provided by the user.

Types

type CertificateMap added in v1.12.0 

type CertificateMap map[string]*KubeadmCert

CertificateMap is a flat map of certificates, keyed by Name.

func (CertificateMap) CertTree added in v1.12.0 

func (m CertificateMap) CertTree() (CertificateTree, error)

CertTree returns a one-level-deep tree, mapping a CA cert to an array of certificates that should be signed by it.

type CertificateTree added in v1.12.0 

type CertificateTree map[*KubeadmCert]Certificates

CertificateTree is represents a one-level-deep tree, mapping a CA to the certs that depend on it.

func (CertificateTree) CreateTree added in v1.12.0 

func (t CertificateTree) CreateTree(ic *kubeadmapi.InitConfiguration) error

CreateTree creates the CAs, certs signed by the CAs, and writes them all to disk.

type Certificates added in v1.12.0 

type Certificates []*KubeadmCert

Certificates is a list of Certificates that Kubeadm should create.

func GetCertsWithoutEtcd added in v1.12.0 

func GetCertsWithoutEtcd() Certificates

GetCertsWithoutEtcd returns all of the certificates kubeadm needs when etcd is hosted externally.

func GetDefaultCertList added in v1.12.0 

func GetDefaultCertList() Certificates

GetDefaultCertList returns all of the certificates kubeadm requires to function.

func (Certificates) AsMap added in v1.12.0 

func (c Certificates) AsMap() CertificateMap

AsMap returns the list of certificates as a map, keyed by name.

type KubeadmCert added in v1.12.0 

type KubeadmCert struct {
	Name     string
	LongName string
	BaseName string
	CAName   string
	// contains filtered or unexported fields
}

KubeadmCert represents a certificate that Kubeadm will create to function properly.

func KubeadmCertAPIServer added in v1.12.0 

func KubeadmCertAPIServer() *KubeadmCert

KubeadmCertAPIServer is the definition of the cert used to serve the Kubernetes API.

func KubeadmCertEtcdAPIClient added in v1.12.0 

func KubeadmCertEtcdAPIClient() *KubeadmCert

KubeadmCertEtcdAPIClient is the definition of the cert used by the API server to access etcd.

func KubeadmCertEtcdCA added in v1.12.0 

func KubeadmCertEtcdCA() *KubeadmCert

KubeadmCertEtcdCA is the definition of the root CA used by the hosted etcd server.

func KubeadmCertEtcdHealthcheck added in v1.12.0 

func KubeadmCertEtcdHealthcheck() *KubeadmCert

KubeadmCertEtcdHealthcheck is the definition of the cert used by Kubernetes to check the health of the etcd server.

func KubeadmCertEtcdPeer added in v1.12.0 

func KubeadmCertEtcdPeer() *KubeadmCert

KubeadmCertEtcdPeer is the definition of the cert used by etcd peers to access each other.

func KubeadmCertEtcdServer added in v1.12.0 

func KubeadmCertEtcdServer() *KubeadmCert

KubeadmCertEtcdServer is the definition of the cert used to serve etcd to clients.

func KubeadmCertFrontProxyCA added in v1.12.0 

func KubeadmCertFrontProxyCA() *KubeadmCert

KubeadmCertFrontProxyCA is the definition of the CA used for the front end proxy.

func KubeadmCertFrontProxyClient added in v1.12.0 

func KubeadmCertFrontProxyClient() *KubeadmCert

KubeadmCertFrontProxyClient is the definition of the cert used by the API server to access the front proxy.

func KubeadmCertKubeletClient added in v1.12.0 

func KubeadmCertKubeletClient() *KubeadmCert

KubeadmCertKubeletClient is the definition of the cert used by the API server to access the kubelet.

func KubeadmCertRootCA added in v1.12.0 

func KubeadmCertRootCA() *KubeadmCert

KubeadmCertRootCA is the definition of the Kubernetes Root CA for the API Server and kubelet.

func (*KubeadmCert) CreateAsCA added in v1.12.0 

func (k *KubeadmCert) CreateAsCA(ic *kubeadmapi.InitConfiguration) (*x509.Certificate, crypto.Signer, error)

CreateAsCA creates a certificate authority, writing the files to disk and also returning the created CA so it can be used to sign child certs.

func (*KubeadmCert) CreateFromCA added in v1.12.0 

func (k *KubeadmCert) CreateFromCA(ic *kubeadmapi.InitConfiguration, caCert *x509.Certificate, caKey crypto.Signer) error

CreateFromCA makes and writes a certificate using the given CA cert and key.

func (*KubeadmCert) GetConfig added in v1.12.0 

func (k *KubeadmCert) GetConfig(ic *kubeadmapi.InitConfiguration) (*pkiutil.CertConfig, error)

GetConfig returns the definition for the given cert given the provided InitConfiguration

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.