sia

README

SIA for GCP GCE

Configuration

SIA GCE requires a configuration file to be present in the /etc/sia/sia_config with the following required attributes:

{
    "version": "1.0.0",
    "domain": "application-domain-name",
    "service": "application-service-name"
}

The Google Project administrator must create a Google Service Account with the name <application-service-name>.

SIA Configuration file provides a way to change the default user/group settings that the private key is owned by. By default, the private key is owned by user root and readable by group athenz. If the admin wants to provide access to their service identity private key to another user, it can be accomplished by adding the user to the group athenz. If the user wants to change the user and group values, a config file must contain following optional fields:

{
    "version": "1.0.0",
    "domain": "application-domain-name",
    "service": "application-service-name",
    "user": "unix-username",
    "group": "unix-groupname"
}

SIA-GCE can be built with following parameters - e.g.

GOOS=linux go install -ldflags "-X main.Version=1.0.0 -X main.ZtsEndPoint=zts.athenz.io -X main.DnsDomain=gcp.athenz.cloud -X main.ProviderPrefix=athenz.gcp" ./...

alternatively, those parameters can be passed during runtime and runtime parameters will take precedence over build time parameters.

Documentation

Index

• func GetGCEAccessProfile(configFile, metaEndpoint string, provider provider.Provider) (*options.AccessProfileConfig, error)
• func GetGCEConfig(configFile, profileConfigFile, metaEndpoint, region string, ...) (*options.Config, *options.AccessProfileConfig, error)
• type GCEProvider
  • func (gke GCEProvider) AttestationData(svc string, key crypto.PrivateKey, sigInfo *signature.SignatureInfo) (string, error)
  • func (gke GCEProvider) CloudAttestationData(base, svc, ztsServerName string) (string, error)
  • func (tp GCEProvider) GetAccessManagementProfileFromMeta(base string) (string, error)
  • func (gke GCEProvider) GetAccountDomainServiceFromMeta(base string) (string, string, string, error)
  • func (tp GCEProvider) GetAdditionalSshHostPrincipals(base string) (string, error)
  • func (gke GCEProvider) GetCsrDn() pkix.Name
  • func (gke GCEProvider) GetEmail(service string) []string
  • func (gke GCEProvider) GetHostname(fqdn bool) string
  • func (gke GCEProvider) GetName() string
  • func (gke GCEProvider) GetRoleDnsNames(cert *x509.Certificate, service string) []string
  • func (gke GCEProvider) GetSanDns(service string, includeHost bool, wildcard bool, cnames []string) []string
  • func (gke GCEProvider) GetSanIp(docIp map[string]bool, ips []net.IP, opts ip.Opts) []net.IP
  • func (gke GCEProvider) GetSanUri(svc string, opts ip.Opts, spiffeTrustDomain, spiffeNamespace string) []*url.URL
  • func (gke GCEProvider) GetSuffix() string
  • func (gke GCEProvider) PrepareKey(file string) (crypto.PrivateKey, error)

Functions

func GetGCEAccessProfile

func GetGCEAccessProfile(configFile, metaEndpoint string, provider provider.Provider) (*options.AccessProfileConfig, error)

func GetGCEConfig

func GetGCEConfig(configFile, profileConfigFile, metaEndpoint, region string, provider provider.Provider) (*options.Config, *options.AccessProfileConfig, error)

Types

type GCEProvider

type GCEProvider struct {
	Name string
}

func (GCEProvider) AttestationData

func (gke GCEProvider) AttestationData(svc string, key crypto.PrivateKey, sigInfo *signature.SignatureInfo) (string, error)

func (GCEProvider) CloudAttestationData

func (gke GCEProvider) CloudAttestationData(base, svc, ztsServerName string) (string, error)

func (GCEProvider) GetAccessManagementProfileFromMeta

func (tp GCEProvider) GetAccessManagementProfileFromMeta(base string) (string, error)

func (GCEProvider) GetAccountDomainServiceFromMeta

func (gke GCEProvider) GetAccountDomainServiceFromMeta(base string) (string, string, string, error)

func (GCEProvider) GetAdditionalSshHostPrincipals

func (tp GCEProvider) GetAdditionalSshHostPrincipals(base string) (string, error)

func (GCEProvider) GetCsrDn

func (gke GCEProvider) GetCsrDn() pkix.Name

func (GCEProvider) GetEmail

func (gke GCEProvider) GetEmail(service string) []string

func (GCEProvider) GetHostname

func (gke GCEProvider) GetHostname(fqdn bool) string

GetHostname returns the hostname as per the provider

func (GCEProvider) GetName

func (gke GCEProvider) GetName() string

GetName returns the name of the current provider

func (GCEProvider) GetRoleDnsNames

func (gke GCEProvider) GetRoleDnsNames(cert *x509.Certificate, service string) []string

func (GCEProvider) GetSanDns

func (gke GCEProvider) GetSanDns(service string, includeHost bool, wildcard bool, cnames []string) []string

func (GCEProvider) GetSanIp

func (gke GCEProvider) GetSanIp(docIp map[string]bool, ips []net.IP, opts ip.Opts) []net.IP

func (GCEProvider) GetSanUri

func (gke GCEProvider) GetSanUri(svc string, opts ip.Opts, spiffeTrustDomain, spiffeNamespace string) []*url.URL

func (GCEProvider) GetSuffix

func (gke GCEProvider) GetSuffix() string

func (GCEProvider) PrepareKey

func (gke GCEProvider) PrepareKey(file string) (crypto.PrivateKey, error)