k8s

Documentation

Overview

Package k8s resolves TLS material (CA and client certificates) from Kubernetes Secrets into tlsconfig.CertificateOptions. It imports controller-runtime's client.Client and is kept separate from the controller-runtime-free tlsconfig package.

Index

• type Options
  • func (o Options) Validate() error
• type Resolver
  • func New(c client.Client) *Resolver
  • func (r *Resolver) BuildHTTPTransport(ctx context.Context, namespace string, opts Options, ...) (*http.Transport, error)
  • func (r *Resolver) Resolve(ctx context.Context, namespace string, opts Options) (*tlsconfig.CertificateOptions, error)

Types

type Options

type Options struct {
	// CASecretName is the Secret holding the CA certificate (key CACertKey,
	// default "ca.crt"). It is required unless ClientCertSecretName is set:
	// Validate fails closed and requires at least one of the two. Note that a
	// skip-verify-only config (InsecureSkipVerify=true with neither secret)
	// is rejected by Validate.
	CASecretName string
	// CACertKey is the data key for the CA certificate (default "ca.crt").
	CACertKey string
	// ClientCertSecretName is the Secret holding the client certificate + key
	// (keys ClientCertKey/ClientKeyKey, default "tls.crt"/"tls.key").
	ClientCertSecretName string
	// ClientCertKey is the data key for the client certificate (default "tls.crt").
	ClientCertKey string
	// ClientKeyKey is the data key for the client private key (default "tls.key").
	ClientKeyKey string
	// InsecureSkipVerify disables server certificate verification.
	InsecureSkipVerify bool
	// ServerName is the expected server name for certificate verification.
	ServerName string
	// MinVersion is the minimum TLS version (tls.VersionTLS*).
	MinVersion uint16
	// MaxVersion is the maximum TLS version (tls.VersionTLS*).
	MaxVersion uint16
}

Options selects the Secrets that hold the CA and client certificates.

func (Options) Validate

func (o Options) Validate() error

Validate checks the option combination. It fails closed: at least one of CASecretName or ClientCertSecretName must be set. A skip-verify-only config (InsecureSkipVerify=true with neither secret) is therefore rejected.

type Resolver

type Resolver struct {
	// contains filtered or unexported fields
}

Resolver resolves TLS material from Kubernetes Secrets via a client.Client.

func New

func New(c client.Client) *Resolver

New creates a Resolver backed by c.

func (*Resolver) BuildHTTPTransport

func (r *Resolver) BuildHTTPTransport(ctx context.Context, namespace string, opts Options, options ...tlsconfig.Option) (*http.Transport, error)

BuildHTTPTransport resolves the Secrets and builds an *http.Transport in one step, applying any tlsconfig.Option (e.g. WithBaseTLSConfig/WithBaseTransport) before building.

func (*Resolver) Resolve

func (r *Resolver) Resolve(ctx context.Context, namespace string, opts Options) (*tlsconfig.CertificateOptions, error)

Resolve reads the referenced Secrets and returns the equivalent tlsconfig.CertificateOptions.