v1

package
v0.10.1 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Mar 4, 2024 License: Apache-2.0 Imports: 12 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source
var CertificateSigningRequestBlank = (&CertificateSigningRequestDie{}).DieFeed(certificatesv1.CertificateSigningRequest{})
View Source
var CertificateSigningRequestSpecBlank = (&CertificateSigningRequestSpecDie{}).DieFeed(certificatesv1.CertificateSigningRequestSpec{})
View Source
var CertificateSigningRequestStatusBlank = (&CertificateSigningRequestStatusDie{}).DieFeed(certificatesv1.CertificateSigningRequestStatus{})

Functions

This section is empty.

Types

type CertificateSigningRequestDie

type CertificateSigningRequestDie struct {
	metav1.FrozenObjectMeta
	// contains filtered or unexported fields
}

func (*CertificateSigningRequestDie) APIVersion added in v0.5.0

APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources

func (*CertificateSigningRequestDie) DeepCopy

DeepCopy returns a new die with equivalent state. Useful for snapshotting a mutable die.

func (*CertificateSigningRequestDie) DeepCopyObject

func (d *CertificateSigningRequestDie) DeepCopyObject() runtime.Object

func (*CertificateSigningRequestDie) DieFeed

DieFeed returns a new die with the provided resource.

func (*CertificateSigningRequestDie) DieFeedJSON added in v0.8.0

DieFeedJSON returns a new die with the provided JSON. Panics on error.

func (*CertificateSigningRequestDie) DieFeedPtr

DieFeedPtr returns a new die with the provided resource pointer. If the resource is nil, the empty value is used instead.

func (*CertificateSigningRequestDie) DieFeedRawExtension added in v0.5.0

DieFeedRawExtension returns the resource managed by the die as an raw extension. Panics on error.

func (*CertificateSigningRequestDie) DieFeedYAML added in v0.8.0

DieFeedYAML returns a new die with the provided YAML. Panics on error.

func (*CertificateSigningRequestDie) DieFeedYAMLFile added in v0.8.0

DieFeedYAMLFile returns a new die loading YAML from a file path. Panics on error.

func (*CertificateSigningRequestDie) DieImmutable

DieImmutable returns a new die for the current die's state that is either mutable (`false`) or immutable (`true`).

func (*CertificateSigningRequestDie) DieRelease

DieRelease returns the resource managed by the die.

func (*CertificateSigningRequestDie) DieReleaseJSON added in v0.8.0

func (d *CertificateSigningRequestDie) DieReleaseJSON() []byte

DieReleaseJSON returns the resource managed by the die as JSON. Panics on error.

func (*CertificateSigningRequestDie) DieReleasePtr

DieReleasePtr returns a pointer to the resource managed by the die.

func (*CertificateSigningRequestDie) DieReleaseRawExtension added in v0.5.0

func (d *CertificateSigningRequestDie) DieReleaseRawExtension() runtime.RawExtension

DieReleaseRawExtension returns the resource managed by the die as an raw extension. Panics on error.

func (*CertificateSigningRequestDie) DieReleaseUnstructured

func (d *CertificateSigningRequestDie) DieReleaseUnstructured() *unstructured.Unstructured

DieReleaseUnstructured returns the resource managed by the die as an unstructured object. Panics on error.

func (*CertificateSigningRequestDie) DieReleaseYAML added in v0.8.0

func (d *CertificateSigningRequestDie) DieReleaseYAML() []byte

DieReleaseYAML returns the resource managed by the die as YAML. Panics on error.

func (*CertificateSigningRequestDie) DieStamp

DieStamp returns a new die with the resource passed to the callback function. The resource is mutable.

func (*CertificateSigningRequestDie) DieStampAt added in v0.8.0

func (d *CertificateSigningRequestDie) DieStampAt(jp string, fn interface{}) *CertificateSigningRequestDie

Experimental: DieStampAt uses a JSON path (http://goessner.net/articles/JsonPath/) expression to stamp portions of the resource. The callback is invoked with each JSON path match. Panics if the callback function does not accept a single argument of the same type or a pointer to that type as found on the resource at the target location.

Future iterations will improve type coercion from the resource to the callback argument.

func (*CertificateSigningRequestDie) DieWith added in v0.9.0

DieWith returns a new die after passing the current die to the callback function. The passed die is mutable.

func (*CertificateSigningRequestDie) GetObjectKind

func (d *CertificateSigningRequestDie) GetObjectKind() schema.ObjectKind

func (*CertificateSigningRequestDie) Kind added in v0.5.0

Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds

func (*CertificateSigningRequestDie) MarshalJSON

func (d *CertificateSigningRequestDie) MarshalJSON() ([]byte, error)

func (*CertificateSigningRequestDie) MetadataDie

MetadataDie stamps the resource's ObjectMeta field with a mutable die.

func (*CertificateSigningRequestDie) Spec

spec contains the certificate request, and is immutable after creation.

Only the request, signerName, expirationSeconds, and usages fields can be set on creation.

Other fields are derived by Kubernetes and cannot be modified by users.

func (*CertificateSigningRequestDie) SpecDie

SpecDie stamps the resource's spec field with a mutable die.

func (*CertificateSigningRequestDie) Status

status contains information about whether the request is approved or denied,

and the certificate issued by the signer, or the failure condition indicating signer failure.

func (*CertificateSigningRequestDie) StatusDie

StatusDie stamps the resource's status field with a mutable die.

func (*CertificateSigningRequestDie) UnmarshalJSON

func (d *CertificateSigningRequestDie) UnmarshalJSON(b []byte) error

type CertificateSigningRequestSpecDie

type CertificateSigningRequestSpecDie struct {
	// contains filtered or unexported fields
}

func (*CertificateSigningRequestSpecDie) AddExtra

func (*CertificateSigningRequestSpecDie) DeepCopy

DeepCopy returns a new die with equivalent state. Useful for snapshotting a mutable die.

func (*CertificateSigningRequestSpecDie) DieFeed

DieFeed returns a new die with the provided resource.

func (*CertificateSigningRequestSpecDie) DieFeedJSON added in v0.8.0

DieFeedJSON returns a new die with the provided JSON. Panics on error.

func (*CertificateSigningRequestSpecDie) DieFeedPtr

DieFeedPtr returns a new die with the provided resource pointer. If the resource is nil, the empty value is used instead.

func (*CertificateSigningRequestSpecDie) DieFeedRawExtension added in v0.5.0

DieFeedRawExtension returns the resource managed by the die as an raw extension. Panics on error.

func (*CertificateSigningRequestSpecDie) DieFeedYAML added in v0.8.0

DieFeedYAML returns a new die with the provided YAML. Panics on error.

func (*CertificateSigningRequestSpecDie) DieFeedYAMLFile added in v0.8.0

DieFeedYAMLFile returns a new die loading YAML from a file path. Panics on error.

func (*CertificateSigningRequestSpecDie) DieImmutable

DieImmutable returns a new die for the current die's state that is either mutable (`false`) or immutable (`true`).

func (*CertificateSigningRequestSpecDie) DieRelease

DieRelease returns the resource managed by the die.

func (*CertificateSigningRequestSpecDie) DieReleaseJSON added in v0.8.0

func (d *CertificateSigningRequestSpecDie) DieReleaseJSON() []byte

DieReleaseJSON returns the resource managed by the die as JSON. Panics on error.

func (*CertificateSigningRequestSpecDie) DieReleasePtr

DieReleasePtr returns a pointer to the resource managed by the die.

func (*CertificateSigningRequestSpecDie) DieReleaseRawExtension added in v0.5.0

func (d *CertificateSigningRequestSpecDie) DieReleaseRawExtension() runtime.RawExtension

DieReleaseRawExtension returns the resource managed by the die as an raw extension. Panics on error.

func (*CertificateSigningRequestSpecDie) DieReleaseYAML added in v0.8.0

func (d *CertificateSigningRequestSpecDie) DieReleaseYAML() []byte

DieReleaseYAML returns the resource managed by the die as YAML. Panics on error.

func (*CertificateSigningRequestSpecDie) DieStamp

DieStamp returns a new die with the resource passed to the callback function. The resource is mutable.

func (*CertificateSigningRequestSpecDie) DieStampAt added in v0.8.0

Experimental: DieStampAt uses a JSON path (http://goessner.net/articles/JsonPath/) expression to stamp portions of the resource. The callback is invoked with each JSON path match. Panics if the callback function does not accept a single argument of the same type or a pointer to that type as found on the resource at the target location.

Future iterations will improve type coercion from the resource to the callback argument.

func (*CertificateSigningRequestSpecDie) DieWith added in v0.9.0

DieWith returns a new die after passing the current die to the callback function. The passed die is mutable.

func (*CertificateSigningRequestSpecDie) ExpirationSeconds

expirationSeconds is the requested duration of validity of the issued

certificate. The certificate signer may issue a certificate with a different

validity duration so a client must check the delta between the notBefore and

and notAfter fields in the issued certificate to determine the actual duration.

The v1.22+ in-tree implementations of the well-known Kubernetes signers will

honor this field as long as the requested duration is not greater than the

maximum duration they will honor per the --cluster-signing-duration CLI

flag to the Kubernetes controller manager.

Certificate signers may not honor this field for various reasons:

1. Old signer that is unaware of the field (such as the in-tree

implementations prior to v1.22)

2. Signer whose configured maximum is shorter than the requested duration

3. Signer whose configured minimum is longer than the requested duration

The minimum valid value for expirationSeconds is 600, i.e. 10 minutes.

func (*CertificateSigningRequestSpecDie) Extra

Extra corresponds to the user.Info.GetExtra() method from the authenticator. Since that is input to the authorizer it needs a reflection here.

func (*CertificateSigningRequestSpecDie) Groups

groups contains group membership of the user that created the CertificateSigningRequest.

Populated by the API server on creation and immutable.

func (*CertificateSigningRequestSpecDie) Request

request contains an x509 certificate signing request encoded in a "CERTIFICATE REQUEST" PEM block.

When serialized as JSON or YAML, the data is additionally base64-encoded.

func (*CertificateSigningRequestSpecDie) SignerName

signerName indicates the requested signer, and is a qualified name.

List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.

Well-known Kubernetes signers are:

1. "kubernetes.io/kube-apiserver-client": issues client certificates that can be used to authenticate to kube-apiserver.

Requests for this signer are never auto-approved by kube-controller-manager, can be issued by the "csrsigning" controller in kube-controller-manager.

2. "kubernetes.io/kube-apiserver-client-kubelet": issues client certificates that kubelets use to authenticate to kube-apiserver.

Requests for this signer can be auto-approved by the "csrapproving" controller in kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.

3. "kubernetes.io/kubelet-serving" issues serving certificates that kubelets use to serve TLS endpoints, which kube-apiserver can connect to securely.

Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.

More details are available at https://k8s.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers

Custom signerNames can also be specified. The signer defines:

1. Trust distribution: how trust (CA bundles) are distributed.

2. Permitted subjects: and behavior when a disallowed subject is requested.

3. Required, permitted, or forbidden x509 extensions in the request (including whether subjectAltNames are allowed, which types, restrictions on allowed values) and behavior when a disallowed extension is requested.

4. Required, permitted, or forbidden key usages / extended key usages.

5. Expiration/certificate lifetime: whether it is fixed by the signer, configurable by the admin.

6. Whether or not requests for CA certificates are allowed.

func (*CertificateSigningRequestSpecDie) UID

uid contains the uid of the user that created the CertificateSigningRequest.

Populated by the API server on creation and immutable.

func (*CertificateSigningRequestSpecDie) Usages

usages specifies a set of key usages requested in the issued certificate.

Requests for TLS client certificates typically request: "digital signature", "key encipherment", "client auth".

Requests for TLS serving certificates typically request: "key encipherment", "digital signature", "server auth".

Valid values are:

"signing", "digital signature", "content commitment",

"key encipherment", "key agreement", "data encipherment",

"cert sign", "crl sign", "encipher only", "decipher only", "any",

"server auth", "client auth",

"code signing", "email protection", "s/mime",

"ipsec end system", "ipsec tunnel", "ipsec user",

"timestamping", "ocsp signing", "microsoft sgc", "netscape sgc"

func (*CertificateSigningRequestSpecDie) Username

username contains the name of the user that created the CertificateSigningRequest.

Populated by the API server on creation and immutable.

type CertificateSigningRequestStatusDie

type CertificateSigningRequestStatusDie struct {
	// contains filtered or unexported fields
}

func (*CertificateSigningRequestStatusDie) Certificate

certificate is populated with an issued certificate by the signer after an Approved condition is present.

This field is set via the /status subresource. Once populated, this field is immutable.

If the certificate signing request is denied, a condition of type "Denied" is added and this field remains empty.

If the signer cannot issue the certificate, a condition of type "Failed" is added and this field remains empty.

Validation requirements:

1. certificate must contain one or more PEM blocks.

2. All PEM blocks must have the "CERTIFICATE" label, contain no headers, and the encoded data

must be a BER-encoded ASN.1 Certificate structure as described in section 4 of RFC5280.

3. Non-PEM content may appear before or after the "CERTIFICATE" PEM blocks and is unvalidated,

to allow for explanatory text as described in section 5.2 of RFC7468.

If more than one PEM block is present, and the definition of the requested spec.signerName

does not indicate otherwise, the first block is the issued certificate,

and subsequent blocks should be treated as intermediate certificates and presented in TLS handshakes.

The certificate is encoded in PEM format.

When serialized as JSON or YAML, the data is additionally base64-encoded, so it consists of:

base64(

-----BEGIN CERTIFICATE-----

...

-----END CERTIFICATE-----

)

func (*CertificateSigningRequestStatusDie) Conditions

conditions applied to the request. Known conditions are "Approved", "Denied", and "Failed".

func (*CertificateSigningRequestStatusDie) ConditionsDie

func (*CertificateSigningRequestStatusDie) DeepCopy

DeepCopy returns a new die with equivalent state. Useful for snapshotting a mutable die.

func (*CertificateSigningRequestStatusDie) DieFeed

DieFeed returns a new die with the provided resource.

func (*CertificateSigningRequestStatusDie) DieFeedJSON added in v0.8.0

DieFeedJSON returns a new die with the provided JSON. Panics on error.

func (*CertificateSigningRequestStatusDie) DieFeedPtr

DieFeedPtr returns a new die with the provided resource pointer. If the resource is nil, the empty value is used instead.

func (*CertificateSigningRequestStatusDie) DieFeedRawExtension added in v0.5.0

DieFeedRawExtension returns the resource managed by the die as an raw extension. Panics on error.

func (*CertificateSigningRequestStatusDie) DieFeedYAML added in v0.8.0

DieFeedYAML returns a new die with the provided YAML. Panics on error.

func (*CertificateSigningRequestStatusDie) DieFeedYAMLFile added in v0.8.0

DieFeedYAMLFile returns a new die loading YAML from a file path. Panics on error.

func (*CertificateSigningRequestStatusDie) DieImmutable

DieImmutable returns a new die for the current die's state that is either mutable (`false`) or immutable (`true`).

func (*CertificateSigningRequestStatusDie) DieRelease

DieRelease returns the resource managed by the die.

func (*CertificateSigningRequestStatusDie) DieReleaseJSON added in v0.8.0

func (d *CertificateSigningRequestStatusDie) DieReleaseJSON() []byte

DieReleaseJSON returns the resource managed by the die as JSON. Panics on error.

func (*CertificateSigningRequestStatusDie) DieReleasePtr

DieReleasePtr returns a pointer to the resource managed by the die.

func (*CertificateSigningRequestStatusDie) DieReleaseRawExtension added in v0.5.0

func (d *CertificateSigningRequestStatusDie) DieReleaseRawExtension() runtime.RawExtension

DieReleaseRawExtension returns the resource managed by the die as an raw extension. Panics on error.

func (*CertificateSigningRequestStatusDie) DieReleaseYAML added in v0.8.0

func (d *CertificateSigningRequestStatusDie) DieReleaseYAML() []byte

DieReleaseYAML returns the resource managed by the die as YAML. Panics on error.

func (*CertificateSigningRequestStatusDie) DieStamp

DieStamp returns a new die with the resource passed to the callback function. The resource is mutable.

func (*CertificateSigningRequestStatusDie) DieStampAt added in v0.8.0

Experimental: DieStampAt uses a JSON path (http://goessner.net/articles/JsonPath/) expression to stamp portions of the resource. The callback is invoked with each JSON path match. Panics if the callback function does not accept a single argument of the same type or a pointer to that type as found on the resource at the target location.

Future iterations will improve type coercion from the resource to the callback argument.

func (*CertificateSigningRequestStatusDie) DieWith added in v0.9.0

DieWith returns a new die after passing the current die to the callback function. The passed die is mutable.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL