bootstrap

Documentation

Index

• Variables
• func BuildChallengeServerCertificate(clusterName string) (*tls.Certificate, error)
• type Authenticator
• type ChainVerifier
  • func (v *ChainVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*VerifyResult, error)
• type Challenge
• type ChallengeClient
  • func NewChallengeClient(keystore pki.Keystore) (*ChallengeClient, error)
  • func (c *ChallengeClient) DoCallbackChallenge(ctx context.Context, clusterName string, targetEndpoint string, ...) error
• type ChallengeListener
  • func (s *ChallengeListener) CreateChallenge() *nodeup.ChallengeRequest
  • func (s *ChallengeListener) Endpoint() string
  • func (s *ChallengeListener) Stop()
• type ChallengeServer
  • func NewChallengeServer(clusterName string, caBundle []byte) (*ChallengeServer, error)
  • func (s *ChallengeServer) Challenge(ctx context.Context, req *pb.ChallengeRequest) (*pb.ChallengeResponse, error)
  • func (s *ChallengeServer) NewListener(ctx context.Context, listen string) (*ChallengeListener, error)
• type Verifier
  • func NewChainVerifier(chain ...Verifier) Verifier
• type VerifyResult

Variables

var ErrAlreadyExists = errors.New("node already exists")

var ErrNotThisVerifier = errors.New("token not valid for this verifier")

ErrNotThisVerifier is returned when a verifier receives a token that is not intended for it.

Functions

func BuildChallengeServerCertificate

func BuildChallengeServerCertificate(clusterName string) (*tls.Certificate, error)

Types

type Authenticator

type Authenticator interface {
	CreateToken(body []byte) (string, error)
}

Authenticator generates authentication credentials for requests.

type ChainVerifier

type ChainVerifier struct {
	// contains filtered or unexported fields
}

ChainVerifier wraps multiple Verifiers; the first positive verification from any Verifier will be returned.

func (*ChainVerifier) VerifyToken

func (v *ChainVerifier) VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*VerifyResult, error)

VerifyToken will return the first positive verification from any Verifier in the chain.

type Challenge

type Challenge struct {
	ChallengeID     string
	ChallengeSecret []byte
}

type ChallengeClient

type ChallengeClient struct {
	// contains filtered or unexported fields
}

func NewChallengeClient

func NewChallengeClient(keystore pki.Keystore) (*ChallengeClient, error)

func (*ChallengeClient) DoCallbackChallenge

func (c *ChallengeClient) DoCallbackChallenge(ctx context.Context, clusterName string, targetEndpoint string, bootstrapRequest *nodeup.BootstrapRequest) error

type ChallengeListener

type ChallengeListener struct {
	// contains filtered or unexported fields
}

func (*ChallengeListener) CreateChallenge

func (s *ChallengeListener) CreateChallenge() *nodeup.ChallengeRequest

func (*ChallengeListener) Endpoint

func (s *ChallengeListener) Endpoint() string

func (*ChallengeListener) Stop

func (s *ChallengeListener) Stop()

type ChallengeServer

type ChallengeServer struct {
	RequiredSubject pkix.Name

	pb.UnimplementedCallbackServiceServer
	// contains filtered or unexported fields
}

func NewChallengeServer

func NewChallengeServer(clusterName string, caBundle []byte) (*ChallengeServer, error)

func (*ChallengeServer) Challenge

func (s *ChallengeServer) Challenge(ctx context.Context, req *pb.ChallengeRequest) (*pb.ChallengeResponse, error)

Answers challenges to cross-check bootstrap requests.

func (*ChallengeServer) NewListener

func (s *ChallengeServer) NewListener(ctx context.Context, listen string) (*ChallengeListener, error)

type Verifier

type Verifier interface {
	// VerifyToken performs full validation of the provided token, often making cloud API calls to verify the caller.
	// It should return either an error or a validated VerifyResult.
	// If the token looks like it is intended for a different verifier
	// (for example it has the wrong prefix), we should return ErrNotThisVerifier
	VerifyToken(ctx context.Context, rawRequest *http.Request, token string, body []byte) (*VerifyResult, error)
}

Verifier verifies authentication credentials for requests.

func NewChainVerifier

func NewChainVerifier(chain ...Verifier) Verifier

NewChainVerifier creates a new Verifier that will return the first positive verification from the provided Verifiers.

type VerifyResult

type VerifyResult struct {
	// Nodename is the name that this node is authorized to use.
	NodeName string

	// InstanceGroupName is the name of the kops InstanceGroup this node is a member of.
	InstanceGroupName string

	// CertificateNames is the alternate names the node is authorized to use for certificates.
	CertificateNames []string

	// ChallengeEndpoint is a valid endpoints to which we should issue a challenge request,
	// corresponding to the node the request identified as.
	// This should be sourced from e.g. the cloud, and acts as a cross-check
	// that this is the correct instance.
	ChallengeEndpoint string
}

VerifyResult is the result of a successfully verified request.