Documentation

Index

Constants

View Source
const (
	// Signs certificates that will be honored as client-certs by the
	// kube-apiserver. Never auto-approved by kube-controller-manager.
	KubeAPIServerClientSignerName = "kubernetes.io/kube-apiserver-client"

	// Signs client certificates that will be honored as client-certs by the
	// kube-apiserver for a kubelet.
	// May be auto-approved by kube-controller-manager.
	KubeAPIServerClientKubeletSignerName = "kubernetes.io/kube-apiserver-client-kubelet"

	// Signs serving certificates that are honored as a valid kubelet serving
	// certificate by the kube-apiserver, but has no other guarantees.
	KubeletServingSignerName = "kubernetes.io/kubelet-serving"

	// Has no guarantees for trust at all. Some distributions may honor these
	// as client certs, but that behavior is not standard kubernetes behavior.
	LegacyUnknownSignerName = "kubernetes.io/legacy-unknown"
)

    Built in signerName values that are honoured by kube-controller-manager. None of these usages are related to ServiceAccount token secrets `.data[ca.crt]` in any way.

    View Source
    const GroupName = "certificates.k8s.io"

      GroupName is the group name use in this package

      Variables

      View Source
      var (
      	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
      	AddToScheme   = SchemeBuilder.AddToScheme
      )
      View Source
      var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}

        SchemeGroupVersion is group version used to register these objects

        Functions

        func IsKubeletClientCSR

        func IsKubeletClientCSR(req *x509.CertificateRequest, usages sets.String) bool

        func IsKubeletServingCSR

        func IsKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) bool

        func Kind

        func Kind(kind string) schema.GroupKind

          Kind takes an unqualified kind and returns a Group qualified GroupKind

          func ParseCSR

          func ParseCSR(pemBytes []byte) (*x509.CertificateRequest, error)

            ParseCSR extracts the CSR from the bytes and decodes it.

            func Resource

            func Resource(resource string) schema.GroupResource

              Resource takes an unqualified resource and returns a Group qualified GroupResource

              func ValidateKubeletClientCSR

              func ValidateKubeletClientCSR(req *x509.CertificateRequest, usages sets.String) error

              func ValidateKubeletServingCSR

              func ValidateKubeletServingCSR(req *x509.CertificateRequest, usages sets.String) error

              Types

              type CertificateSigningRequest

              type CertificateSigningRequest struct {
              	metav1.TypeMeta
              	// +optional
              	metav1.ObjectMeta
              
              	// The certificate request itself and any additional information.
              	// +optional
              	Spec CertificateSigningRequestSpec
              
              	// Derived information about the request.
              	// +optional
              	Status CertificateSigningRequestStatus
              }

                Describes a certificate signing request

                func (*CertificateSigningRequest) DeepCopy

                  DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequest.

                  func (*CertificateSigningRequest) DeepCopyInto

                    DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

                    func (*CertificateSigningRequest) DeepCopyObject

                    func (in *CertificateSigningRequest) DeepCopyObject() runtime.Object

                      DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

                      type CertificateSigningRequestCondition

                      type CertificateSigningRequestCondition struct {
                      	// type of the condition. Known conditions include "Approved", "Denied", and "Failed".
                      	Type RequestConditionType
                      	// Status of the condition, one of True, False, Unknown.
                      	// Approved, Denied, and Failed conditions may not be "False" or "Unknown".
                      	// If unset, should be treated as "True".
                      	// +optional
                      	Status api.ConditionStatus
                      	// brief reason for the request state
                      	// +optional
                      	Reason string
                      	// human readable message with details about the request state
                      	// +optional
                      	Message string
                      	// timestamp for the last update to this condition
                      	// +optional
                      	LastUpdateTime metav1.Time
                      	// lastTransitionTime is the time the condition last transitioned from one status to another.
                      	// +optional
                      	LastTransitionTime metav1.Time
                      }

                      func (*CertificateSigningRequestCondition) DeepCopy

                        DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequestCondition.

                        func (*CertificateSigningRequestCondition) DeepCopyInto

                          DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

                          type CertificateSigningRequestList

                          type CertificateSigningRequestList struct {
                          	metav1.TypeMeta
                          	// +optional
                          	metav1.ListMeta
                          
                          	// +optional
                          	Items []CertificateSigningRequest
                          }

                          func (*CertificateSigningRequestList) DeepCopy

                            DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequestList.

                            func (*CertificateSigningRequestList) DeepCopyInto

                              DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

                              func (*CertificateSigningRequestList) DeepCopyObject

                              func (in *CertificateSigningRequestList) DeepCopyObject() runtime.Object

                                DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.

                                type CertificateSigningRequestSpec

                                type CertificateSigningRequestSpec struct {
                                	// Base64-encoded PKCS#10 CSR data
                                	Request []byte
                                
                                	// signerName indicates the requested signer, and is a qualified name.
                                	//
                                	// List/watch requests for CertificateSigningRequests can filter on this field using a "spec.signerName=NAME" fieldSelector.
                                	//
                                	// Well-known Kubernetes signers are:
                                	//  1. "kubernetes.io/kube-apiserver-client": issues client certificates that can be used to authenticate to kube-apiserver.
                                	//   Requests for this signer are never auto-approved by kube-controller-manager, can be issued by the "csrsigning" controller in kube-controller-manager.
                                	//  2. "kubernetes.io/kube-apiserver-client-kubelet": issues client certificates that kubelets use to authenticate to kube-apiserver.
                                	//   Requests for this signer can be auto-approved by the "csrapproving" controller in kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.
                                	//  3. "kubernetes.io/kubelet-serving" issues serving certificates that kubelets use to serve TLS endpoints, which kube-apiserver can connect to securely.
                                	//   Requests for this signer are never auto-approved by kube-controller-manager, and can be issued by the "csrsigning" controller in kube-controller-manager.
                                	//
                                	// More details are available at https://k8s.io/docs/reference/access-authn-authz/certificate-signing-requests/#kubernetes-signers
                                	//
                                	// Custom signerNames can also be specified. The signer defines:
                                	//  1. Trust distribution: how trust (CA bundles) are distributed.
                                	//  2. Permitted subjects: and behavior when a disallowed subject is requested.
                                	//  3. Required, permitted, or forbidden x509 extensions in the request (including whether subjectAltNames are allowed, which types, restrictions on allowed values) and behavior when a disallowed extension is requested.
                                	//  4. Required, permitted, or forbidden key usages / extended key usages.
                                	//  5. Expiration/certificate lifetime: whether it is fixed by the signer, configurable by the admin.
                                	//  6. Whether or not requests for CA certificates are allowed.
                                	SignerName string
                                
                                	// usages specifies a set of usage contexts the key will be
                                	// valid for.
                                	// See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3
                                	//      https://tools.ietf.org/html/rfc5280#section-4.2.1.12
                                	Usages []KeyUsage
                                
                                	// Information about the requesting user.
                                	// See user.Info interface for details.
                                	// +optional
                                	Username string
                                	// UID information about the requesting user.
                                	// See user.Info interface for details.
                                	// +optional
                                	UID string
                                	// Group information about the requesting user.
                                	// See user.Info interface for details.
                                	// +optional
                                	Groups []string
                                	// Extra information about the requesting user.
                                	// See user.Info interface for details.
                                	// +optional
                                	Extra map[string]ExtraValue
                                }

                                  This information is immutable after the request is created. Only the Request and Usages fields can be set on creation, other fields are derived by Kubernetes and cannot be modified by users.

                                  func (*CertificateSigningRequestSpec) DeepCopy

                                    DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequestSpec.

                                    func (*CertificateSigningRequestSpec) DeepCopyInto

                                      DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

                                      type CertificateSigningRequestStatus

                                      type CertificateSigningRequestStatus struct {
                                      	// Conditions applied to the request, such as approval or denial.
                                      	// +optional
                                      	Conditions []CertificateSigningRequestCondition
                                      
                                      	// If request was approved, the controller will place the issued certificate here.
                                      	// +optional
                                      	Certificate []byte
                                      }

                                      func (*CertificateSigningRequestStatus) DeepCopy

                                        DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new CertificateSigningRequestStatus.

                                        func (*CertificateSigningRequestStatus) DeepCopyInto

                                          DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

                                          type ExtraValue

                                          type ExtraValue []string

                                            ExtraValue masks the value so protobuf can generate

                                            func (ExtraValue) DeepCopy

                                            func (in ExtraValue) DeepCopy() ExtraValue

                                              DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ExtraValue.

                                              func (ExtraValue) DeepCopyInto

                                              func (in ExtraValue) DeepCopyInto(out *ExtraValue)

                                                DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.

                                                type KeyUsage

                                                type KeyUsage string

                                                  KeyUsages specifies valid usage contexts for keys. See: https://tools.ietf.org/html/rfc5280#section-4.2.1.3

                                                  https://tools.ietf.org/html/rfc5280#section-4.2.1.12
                                                  
                                                  const (
                                                  	UsageSigning           KeyUsage = "signing"
                                                  	UsageDigitalSignature  KeyUsage = "digital signature"
                                                  	UsageContentCommitment KeyUsage = "content commitment"
                                                  	UsageKeyEncipherment   KeyUsage = "key encipherment"
                                                  	UsageKeyAgreement      KeyUsage = "key agreement"
                                                  	UsageDataEncipherment  KeyUsage = "data encipherment"
                                                  	UsageCertSign          KeyUsage = "cert sign"
                                                  	UsageCRLSign           KeyUsage = "crl sign"
                                                  	UsageEncipherOnly      KeyUsage = "encipher only"
                                                  	UsageDecipherOnly      KeyUsage = "decipher only"
                                                  	UsageAny               KeyUsage = "any"
                                                  	UsageServerAuth        KeyUsage = "server auth"
                                                  	UsageClientAuth        KeyUsage = "client auth"
                                                  	UsageCodeSigning       KeyUsage = "code signing"
                                                  	UsageEmailProtection   KeyUsage = "email protection"
                                                  	UsageSMIME             KeyUsage = "s/mime"
                                                  	UsageIPsecEndSystem    KeyUsage = "ipsec end system"
                                                  	UsageIPsecTunnel       KeyUsage = "ipsec tunnel"
                                                  	UsageIPsecUser         KeyUsage = "ipsec user"
                                                  	UsageTimestamping      KeyUsage = "timestamping"
                                                  	UsageOCSPSigning       KeyUsage = "ocsp signing"
                                                  	UsageMicrosoftSGC      KeyUsage = "microsoft sgc"
                                                  	UsageNetscapeSGC       KeyUsage = "netscape sgc"
                                                  )

                                                  type RequestConditionType

                                                  type RequestConditionType string
                                                  const (
                                                  	CertificateApproved RequestConditionType = "Approved"
                                                  	CertificateDenied   RequestConditionType = "Denied"
                                                  	CertificateFailed   RequestConditionType = "Failed"
                                                  )

                                                    These are the possible conditions for a certificate request.

                                                    Directories

                                                    Path Synopsis
                                                    Package install installs the certificates API group, making it available as an option to all of the API encoding/decoding machinery.
                                                    Package install installs the certificates API group, making it available as an option to all of the API encoding/decoding machinery.