secrets

Documentation

Index

• Constants
• func GenerateCertificateAuthorities(k8sClusterClient kubernetes.Interface, ...) (map[string]*corev1.Secret, map[string]*Certificate, error)
• func GenerateClusterSecrets(k8sClusterClient kubernetes.Interface, ...) (map[string]*corev1.Secret, error)
• type BasicAuth
  • func LoadBasicAuthFromCSV(name string, data []byte) (*BasicAuth, error)
  • func (b *BasicAuth) SecretData() map[string][]byte
• type BasicAuthSecretConfig
  • func (s *BasicAuthSecretConfig) Generate() (Interface, error)
  • func (s *BasicAuthSecretConfig) GetName() string
• type Certificate
  • func (c *Certificate) SecretData() map[string][]byte
• type CertificateSecretConfig
  • func (s *CertificateSecretConfig) Generate() (Interface, error)
  • func (s *CertificateSecretConfig) GetName() string
• type ConfigInterface
• type ControlPlane
  • func (c *ControlPlane) SecretData() map[string][]byte
• type ControlPlaneSecretConfig
  • func (s *ControlPlaneSecretConfig) Generate() (Interface, error)
  • func (s *ControlPlaneSecretConfig) GetName() string
• type Interface
  • func LoadCertificate(name string, privateKeyPEM, certificatePEM []byte) (Interface, error)
• type KubeConfigRequest
• type RSAKeys
  • func (r *RSAKeys) SecretData() map[string][]byte
• type RSASecretConfig
  • func (s *RSASecretConfig) Generate() (Interface, error)
  • func (s *RSASecretConfig) GetName() string

Constants

const (
	// BasicAuthFormatNormal indicates that the data map should be rendered the normal way (dedicated keys for
	// username and password.
	BasicAuthFormatNormal formatType = "normal"
	// BasicAuthFormatCSV indicates that the data map should be rendered in the CSV-format.
	BasicAuthFormatCSV formatType = "csv"

	// DataKeyCSV is the key in a secret data holding the CSV format of a secret.
	DataKeyCSV = "basic_auth.csv"
)

const (
	// CACert indicates that the certificate should be a certificate authority.
	CACert certType = "ca"
	// ServerCert indicates that the certificate should have the ExtKeyUsageServerAuth usage.
	ServerCert certType = "server"
	// ClientCert indicates that the certificate should have the ExtKeyUsageClientAuth usage.
	ClientCert certType = "client"
	// ServerClientCert indicates that the certificate should have both the ExtKeyUsageServerAuth and ExtKeyUsageClientAuth usage.
	ServerClientCert certType = "both"

	// DataKeyCertificate is the key in a secret data holding the certificate.
	DataKeyCertificate = "tls.crt"
	// DataKeyPrivateKey is the key in a secret data holding the private key.
	DataKeyPrivateKey = "tls.key"
	// DataKeyCertificateCA is the key in a secret data holding the CA certificate.
	DataKeyCertificateCA = "ca.crt"
	// DataKeyPrivateKeyCA is the key in a secret data holding the CA private key.
	DataKeyPrivateKeyCA = "ca.key"
)

Functions

func GenerateCertificateAuthorities

func GenerateCertificateAuthorities(k8sClusterClient kubernetes.Interface, existingSecretsMap map[string]*corev1.Secret, wantedCertificateAuthorities map[string]*CertificateSecretConfig, namespace string) (map[string]*corev1.Secret, map[string]*Certificate, error)

GenerateCertificateAuthorities get a map of wanted cerificated and check If they exist in the existingSecretsMap based on the keys in the map. If they exist it get only the certificate from the corresponding existing secret and makes a certificate Interface from the existing secret. If there is no existing secret contaning the wanted certificate, we make one certificate and with it we deploy in K8s cluster a secret with that certificate and then return the newly existing secret. The function returns a map of secrets contaning the wanted CA, a map with the wanted CA certificate and an error.

func GenerateClusterSecrets

func GenerateClusterSecrets(k8sClusterClient kubernetes.Interface, existingSecretsMap map[string]*corev1.Secret, wantedSecretsList []ConfigInterface, namespace string) (map[string]*corev1.Secret, error)

GenerateClusterSecrets try to deploy in the k8s cluster each secret in the wantedSecretsList. If the secret already exist it jumps to the next one. The function returns a map with all of the successfully deployed wanted secrets plus those already deployed (only from the wantedSecretsList).

Types

type BasicAuth

type BasicAuth struct {
	Name   string
	Format formatType

	Username string
	Password string
}

BasicAuth contains the username, the password and the format for serializing the basic authentication secret.

func LoadBasicAuthFromCSV

func LoadBasicAuthFromCSV(name string, data []byte) (*BasicAuth, error)

LoadBasicAuthFromCSV loads the basic auth. username and the password from the given CSV-formatted <data>.

func (*BasicAuth) SecretData

func (b *BasicAuth) SecretData() map[string][]byte

SecretData computes the data map which can be used in a Kubernetes secret.

type BasicAuthSecretConfig

type BasicAuthSecretConfig struct {
	Name   string
	Format formatType

	Username       string
	PasswordLength int
}

BasicAuthSecretConfig contains the specification a to-be-generated basic authentication secret.

func (*BasicAuthSecretConfig) Generate

func (s *BasicAuthSecretConfig) Generate() (Interface, error)

Generate computes a username/password keypair. It uses "admin" as username and generates a random password of length 32.

func (*BasicAuthSecretConfig) GetName

func (s *BasicAuthSecretConfig) GetName() string

GetName returns the name of the secret.

type Certificate

type Certificate struct {
	Name string

	CA *Certificate

	PrivateKey    *rsa.PrivateKey
	PrivateKeyPEM []byte

	Certificate    *x509.Certificate
	CertificatePEM []byte
}

Certificate contains the private key, and the certificate. It does also contain the CA certificate in case it is no CA. Otherwise, the <CA> field is nil.

func (*Certificate) SecretData

func (c *Certificate) SecretData() map[string][]byte

SecretData computes the data map which can be used in a Kubernetes secret.

type CertificateSecretConfig

type CertificateSecretConfig struct {
	Name string

	CommonName   string
	Organization []string
	DNSNames     []string
	IPAddresses  []net.IP

	CertType  certType
	SigningCA *Certificate
}

CertificateSecretConfig contains the specification a to-be-generated CA, server, or client certificate. It always contains a 2048-bit RSA private key.

func (*CertificateSecretConfig) Generate

func (s *CertificateSecretConfig) Generate() (Interface, error)

Generate computes a CA, server, or client certificate based on the configuration.

func (*CertificateSecretConfig) GetName

func (s *CertificateSecretConfig) GetName() string

GetName returns the name of the secret.

type ConfigInterface

type ConfigInterface interface {
	GetName() string
	Generate() (Interface, error)
}

ConfigInterface define functions needed for generating a specific secret.

type ControlPlane

type ControlPlane struct {
	Name string

	Certificate *Certificate
	BasicAuth   *BasicAuth
	Kubeconfig  []byte
}

ControlPlane contains the certificate, and optionally the basic auth. information as well as a Kubeconfig.

func (*ControlPlane) SecretData

func (c *ControlPlane) SecretData() map[string][]byte

SecretData computes the data map which can be used in a Kubernetes secret.

type ControlPlaneSecretConfig

type ControlPlaneSecretConfig struct {
	*CertificateSecretConfig

	BasicAuth *BasicAuth

	KubeConfigRequest *KubeConfigRequest
}

ControlPlaneSecretConfig is a struct which inherits from CertificateSecretConfig and is extended with a couple of additional properties. A control plane secret will always contain a server/client certificate and optionally a kubeconfig.

func (*ControlPlaneSecretConfig) Generate

func (s *ControlPlaneSecretConfig) Generate() (Interface, error)

Generate computes a secret for a control plane component of the clusters managed by Gardener. It may include a Kubeconfig.

func (*ControlPlaneSecretConfig) GetName

func (s *ControlPlaneSecretConfig) GetName() string

GetName returns the name of the secret.

type Interface

type Interface interface {
	SecretData() map[string][]byte
}

Interface defines functions needed for defining the data map of a Kubernetes secret.

func LoadCertificate

func LoadCertificate(name string, privateKeyPEM, certificatePEM []byte) (Interface, error)

LoadCertificate takes a byte slice representation of a certificate and the corresponding private key, and returns its de-serialized private key, certificate template and PEM certificate which can be used to sign other x509 certificates.

type KubeConfigRequest

type KubeConfigRequest struct {
	ClusterName  string
	APIServerURL string
}

KubeConfigRequest is a struct which holds information about a Kubeconfig to be generated.

type RSAKeys

type RSAKeys struct {
	Name string

	PrivateKey *rsa.PrivateKey
	PublicKey  *rsa.PublicKey

	OpenSSHAuthorizedKey []byte
}

RSAKeys contains the private key, the public key, and optionally the OpenSSH-formatted authorized keys file data.

func (*RSAKeys) SecretData

func (r *RSAKeys) SecretData() map[string][]byte

SecretData computes the data map which can be used in a Kubernetes secret.

type RSASecretConfig

type RSASecretConfig struct {
	Name string

	Bits       int
	UsedForSSH bool
}

RSASecretConfig containing information about the number of bits which should be used for the to-be-created RSA private key.

func (*RSASecretConfig) Generate

func (s *RSASecretConfig) Generate() (Interface, error)

Generate computes a RSA private key based on the configured number of bits.

func (*RSASecretConfig) GetName

func (s *RSASecretConfig) GetName() string

GetName returns the name of the secret.