mirror of
https://github.com/siderolabs/talos.git
synced 2025-11-03 01:41:26 +01:00
b914398154
Fixes #3062 There's no user-visible change in this PR. It carefully separates generated secrets (e.g. certs) from source secrets from the config (e.g. CAs), so that certs are generated on config changes which actually affect cert input. And same way separates etcd and Kubernetes PKI, so if etcd CA got changed, only etcd certs will be regenerated. This should have noticeable impact with RSA-based PKI as it reduces number of times PKI gets generated. Signed-off-by: Andrey Smirnov <smirnov.andrey@gmail.com>
113 lines
2.8 KiB
Go
113 lines
2.8 KiB
Go
// This Source Code Form is subject to the terms of the Mozilla Public
|
|
// License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
// file, You can obtain one at http://mozilla.org/MPL/2.0/.
|
|
|
|
package secrets
|
|
|
|
import (
|
|
"fmt"
|
|
"net"
|
|
"net/url"
|
|
|
|
"github.com/talos-systems/crypto/x509"
|
|
"github.com/talos-systems/os-runtime/pkg/resource"
|
|
"github.com/talos-systems/os-runtime/pkg/resource/core"
|
|
)
|
|
|
|
// RootType is type of Root secret resource.
|
|
const RootType = resource.Type("secrets/root")
|
|
|
|
// IDs of various resources of RootType.
|
|
const (
|
|
RootEtcdID = resource.ID("etcd-root")
|
|
RootKubernetesID = resource.ID("k8s-root")
|
|
)
|
|
|
|
// Root contains root (not generated) secrets.
|
|
type Root struct {
|
|
md resource.Metadata
|
|
spec interface{}
|
|
}
|
|
|
|
// RootEtcdSpec describes etcd CA secrets.
|
|
type RootEtcdSpec struct {
|
|
EtcdCA *x509.PEMEncodedCertificateAndKey `yaml:"etcdCA"`
|
|
}
|
|
|
|
// RootKubernetesSpec describes root Kubernetes secrets.
|
|
type RootKubernetesSpec struct {
|
|
Name string `yaml:"name"`
|
|
Endpoint *url.URL `yaml:"endpoint"`
|
|
CertSANs []string `yaml:"certSANs"`
|
|
APIServerIPs []net.IP `yaml:"apiServerIPs"`
|
|
DNSDomain string `yaml:"dnsDomain"`
|
|
|
|
CA *x509.PEMEncodedCertificateAndKey `yaml:"ca"`
|
|
ServiceAccount *x509.PEMEncodedKey `yaml:"serviceAccount"`
|
|
AggregatorCA *x509.PEMEncodedCertificateAndKey `yaml:"aggregatorCA"`
|
|
|
|
AESCBCEncryptionSecret string `yaml:"aesCBCEncryptionSecret"`
|
|
|
|
BootstrapTokenID string `yaml:"bootstrapTokenID"`
|
|
BootstrapTokenSecret string `yaml:"bootstrapTokenSecret"`
|
|
}
|
|
|
|
// NewRoot initializes a Root resource.
|
|
func NewRoot(id resource.ID) *Root {
|
|
r := &Root{
|
|
md: resource.NewMetadata(NamespaceName, RootType, id, resource.VersionUndefined),
|
|
}
|
|
|
|
switch id {
|
|
case RootEtcdID:
|
|
r.spec = &RootEtcdSpec{}
|
|
case RootKubernetesID:
|
|
r.spec = &RootKubernetesSpec{}
|
|
}
|
|
|
|
r.md.BumpVersion()
|
|
|
|
return r
|
|
}
|
|
|
|
// Metadata implements resource.Resource.
|
|
func (r *Root) Metadata() *resource.Metadata {
|
|
return &r.md
|
|
}
|
|
|
|
// Spec implements resource.Resource.
|
|
func (r *Root) Spec() interface{} {
|
|
return r.spec
|
|
}
|
|
|
|
func (r *Root) String() string {
|
|
return fmt.Sprintf("secrets.Root(%q)", r.md.ID())
|
|
}
|
|
|
|
// DeepCopy implements resource.Resource.
|
|
func (r *Root) DeepCopy() resource.Resource {
|
|
return &Root{
|
|
md: r.md,
|
|
spec: r.spec,
|
|
}
|
|
}
|
|
|
|
// ResourceDefinition implements core.ResourceDefinitionProvider interface.
|
|
func (r *Root) ResourceDefinition() core.ResourceDefinitionSpec {
|
|
return core.ResourceDefinitionSpec{
|
|
Type: RootType,
|
|
Aliases: []resource.Type{"rootSecret", "rootSecrets"},
|
|
DefaultNamespace: NamespaceName,
|
|
}
|
|
}
|
|
|
|
// EtcdSpec returns .spec.
|
|
func (r *Root) EtcdSpec() *RootEtcdSpec {
|
|
return r.spec.(*RootEtcdSpec)
|
|
}
|
|
|
|
// KubernetesSpec returns .spec.
|
|
func (r *Root) KubernetesSpec() *RootKubernetesSpec {
|
|
return r.spec.(*RootKubernetesSpec)
|
|
}
|