spire

Documentation

Overview

Package spire provides utilities for building mutual-TLS configurations backed by the SPIRE Workload API. The X.509 SVID and trust bundle are fetched in memory over the Workload API socket (mounted by the csi.spiffe.io driver) and kept up to date automatically — no certificate files are read from disk.

Index

• Constants
• func ClientTLSConfig(src *Source, trustDomain string) (*tls.Config, error)
• func ServerTLSConfig(src *Source, trustDomain string) (*tls.Config, error)
• func TrustBundlePEM(src *Source) ([]byte, error)
• func TrustDomainFromSource(src *Source) (string, error)
• func WebhookServerCert(src *Source) func(*tls.Config)
• type Source
  • func NewSource(ctx context.Context, socketPath string) (*Source, error)

Constants

const RootCATrustDomain = "ROOTCA"

RootCATrustDomain is the sentinel trust-domain value meaning "authorize any peer presenting an SVID that chains to the SPIRE root CA bundle", without restricting the SPIFFE ID's trust domain. An empty trust domain is treated the same way.

Functions

func ClientTLSConfig

func ClientTLSConfig(src *Source, trustDomain string) (*tls.Config, error)

ClientTLSConfig returns a mutual-TLS client config that presents the workload SVID from src and authorizes peers belonging to trustDomain (or any valid peer when trustDomain is empty / RootCATrustDomain).

func ServerTLSConfig

func ServerTLSConfig(src *Source, trustDomain string) (*tls.Config, error)

ServerTLSConfig returns a mutual-TLS server config that presents the workload SVID from src and authorizes peers belonging to trustDomain (or any valid peer when trustDomain is empty / RootCATrustDomain).

func TrustBundlePEM

func TrustBundlePEM(src *Source) ([]byte, error)

TrustBundlePEM returns the PEM-encoded X.509 trust bundle for the SVID's own trust domain, suitable for use as a webhook/CRD caBundle. It reflects the current bundle in src and should be re-read after each rotation (src.Updated()).

func TrustDomainFromSource

func TrustDomainFromSource(src *Source) (string, error)

TrustDomainFromSource returns the SPIFFE trust domain name of the workload SVID served by src (e.g. "example.org"). Use it to construct SPIFFE IDs and SDS resource names from the real trust domain SPIRE issues into, rather than from a configured value (which may be the RootCATrustDomain authorization sentinel). The source has already fetched its first SVID by the time NewSource returns.

func WebhookServerCert

func WebhookServerCert(src *Source) func(*tls.Config)

WebhookServerCert returns a tls.Config mutator (suitable for controller-runtime's webhook.Options.TLSOpts) that makes the server present the workload SVID from src via GetCertificate, with no client-certificate requirement. The caller of a webhook is the kube-apiserver — not a SPIFFE peer — so this is one-way TLS: the apiserver verifies the SVID against the SPIRE trust bundle (injected as the webhook caBundle) and the Service DNS name, which the SVID must carry as a DNS SAN (set dnsNames on the SPIRE registration entry). Setting GetCertificate here makes controller-runtime skip its CertDir file watcher entirely.

Types

type Source

type Source = workloadapi.X509Source

Source is an auto-rotating X.509 SVID source backed by the Workload API. Callers own the returned source and must Close it on shutdown.

func NewSource

func NewSource(ctx context.Context, socketPath string) (*Source, error)

NewSource connects to the SPIRE Workload API at socketPath and returns an X.509 SVID source that watches for rotations. socketPath may be a filesystem path to the agent UDS (e.g. /run/secrets/workload-spiffe-uds/socket) or a full endpoint address (unix://… / tcp://…).