dynamiclistener

README

dynamiclistener

DynamicListener allows you to setup a server with automatically generated (and re-generated) TLS certs with kubernetes secrets integration.

This README is a work in progress; aimed towards providing information for navigating the contents of this repository.

Changing the Expiration Days for Newly Signed Certificates

By default, a newly signed certificate is set to expire 365 days (1 year) after its creation time and date. You can use the CATTLE_NEW_SIGNED_CERT_EXPIRATION_DAYS environment variable to change this value.

Please note: the value for the aforementioned variable must be a string representing an unsigned integer corresponding to the number of days until expiration (i.e. X509 "NotAfter" value).

Versioning

See VERSION.md.

Documentation

Index

• func HTTPRedirect(next http.Handler) http.Handler
• func NewListener(l net.Listener, storage TLSStorage, caCert *x509.Certificate, ...) (net.Listener, http.Handler, error)
• func NewListenerWithChain(l net.Listener, storage TLSStorage, caCert []*x509.Certificate, ...) (net.Listener, http.Handler, error)
• func NewTCPListener(ip string, port int) (net.Listener, error)
• func OnlyAllow(str string) func(...string) []string
• type Config
• type SetFactory
• type TLSFactory
• type TLSStorage

Functions

func HTTPRedirect

func HTTPRedirect(next http.Handler) http.Handler

Approach taken from letsencrypt, except manglePort is specific to us

func NewListener

func NewListener(l net.Listener, storage TLSStorage, caCert *x509.Certificate, caKey crypto.Signer, config Config) (net.Listener, http.Handler, error)

Deprecated: Use NewListenerWithChain instead as it supports intermediate CAs

func NewListenerWithChain

func NewListenerWithChain(l net.Listener, storage TLSStorage, caCert []*x509.Certificate, caKey crypto.Signer, config Config) (net.Listener, http.Handler, error)

func NewTCPListener

func NewTCPListener(ip string, port int) (net.Listener, error)

func OnlyAllow

func OnlyAllow(str string) func(...string) []string

Types

type Config

type Config struct {
	CN                    string
	Organization          []string
	TLSConfig             *tls.Config
	SANs                  []string
	MaxSANs               int
	ExpirationDaysCheck   int
	CloseConnOnCertChange bool
	RegenerateCerts       func() bool
	FilterCN              func(...string) []string
	// FilterExisting controls whether FilterCN is also applied to the set of
	// CNs already recorded on the secret (via listener.cattle.io/cn-*
	// annotations) during every cert operation (AddCN, Merge, Renew,
	// Regenerate, cert generation). When true, any existing CN that FilterCN
	// would reject is pruned from the certificate on the next write — useful
	// for automatically removing stale dynamically-added CNs (e.g. dead pod
	// IPs after a rolling restart) without an explicit delete-and-regenerate.
	// false (the default) preserves all existing CNs as before.
	FilterExisting bool
}

type SetFactory

type SetFactory interface {
	SetFactory(tls TLSFactory)
}

type TLSFactory

type TLSFactory interface {
	Renew(secret *v1.Secret) (*v1.Secret, error)
	AddCN(secret *v1.Secret, cn ...string) (*v1.Secret, bool, error)
	Merge(target *v1.Secret, additional *v1.Secret) (*v1.Secret, bool, error)
	Filter(cn ...string) []string
	NeedsUpdate(maxSANs int, secret *v1.Secret, cn ...string) bool
	Regenerate(secret *v1.Secret) (*v1.Secret, error)
}

type TLSStorage

type TLSStorage interface {
	Get() (*v1.Secret, error)
	Update(secret *v1.Secret) error
}