systemadmincredential

Documentation

Index

• func BuildCSR(owner *azcorearm.ResourceID, credName, hcpNamespace string, csrPEM []byte) *certificatesv1.CertificateSigningRequest
• func BuildCSRApproval(owner *azcorearm.ResourceID, credName, hcpNamespace string) *certificatesv1alpha1.CertificateSigningRequestApproval
• func BuildKubeconfig(signedCertificateBase64, apiURL, caBundlePEM string) ([]byte, error)
• func BuildRevocationRequest(owner *azcorearm.ResourceID, revokeOpSuffix, hcpNamespace string) *certificatesv1alpha1.CertificateRevocationRequest
• func GenerateKeypair() ([]byte, []byte, error)
• type KubeObject

Functions

func BuildCSR

func BuildCSR(owner *azcorearm.ResourceID, credName, hcpNamespace string, csrPEM []byte) *certificatesv1.CertificateSigningRequest

BuildCSR builds a CertificateSigningRequest for a system admin credential. The hcpNamespace is the HyperShift HCP namespace on the management cluster (e.g. "ocm-<env>-<csClusterID>"). csrPEM is the PEM-encoded PKCS#10 certificate request provided by the caller.

func BuildCSRApproval

func BuildCSRApproval(owner *azcorearm.ResourceID, credName, hcpNamespace string) *certificatesv1alpha1.CertificateSigningRequestApproval

BuildCSRApproval builds a CertificateSigningRequestApproval for a system admin credential.

func BuildKubeconfig

func BuildKubeconfig(signedCertificateBase64, apiURL, caBundlePEM string) ([]byte, error)

BuildKubeconfig assembles a kubeconfig from the signed certificate, the API URL, and an optional CA bundle. The private key is NOT included — the caller holds it and must inject it into the kubeconfig before use.

signedCertificateBase64 is the base64 encoding of the CSR's Status.Certificate, which the Kubernetes API guarantees to be PEM-encoded. client-go's clientcmd expects ClientCertificateData in PEM, so the decoded bytes are used directly (no DER→PEM wrapping is required).

caBundlePEM is the PEM-encoded serving CA certificate for the API server. When non-empty it is set as CertificateAuthorityData so kubectl can verify the TLS connection. When empty, callers fall back to their system trust bundle.

func BuildRevocationRequest

func BuildRevocationRequest(owner *azcorearm.ResourceID, revokeOpSuffix, hcpNamespace string) *certificatesv1alpha1.CertificateRevocationRequest

BuildRevocationRequest builds a CertificateRevocationRequest that revokes all customer-break-glass certificates for the cluster.

func GenerateKeypair

func GenerateKeypair() ([]byte, []byte, error)

GenerateKeypair generates an RSA keypair and returns the PEM-encoded public key and the PEM-encoded private key.

Types

type KubeObject

type KubeObject interface {
	metav1.Object
	runtime.Object
}

KubeObject is the subset of a typed Kubernetes object that our builders produce and our controllers serialize. It combines object metadata access (metav1.Object) with runtime.Object so callers can read name/namespace/GVK and JSON-marshal the object without depending on sigs.k8s.io/controller-runtime.