package certwatcher

import "sigs.k8s.io/controller-runtime/pkg/certwatcher"

Package certwatcher is a helper for reloading Certificates from disk to be used with tls servers. It provides a helper func `GetCertificate` which can be called from `tls.Config` and passed into your tls.Listener. For a detailed example server view pkg/webhook/server.go.

package main

import (
	"context"
	"crypto/tls"
	"net/http"
	"time"

	ctrl "sigs.k8s.io/controller-runtime"
	"sigs.k8s.io/controller-runtime/pkg/certwatcher"
)

type sampleServer struct {
}

func main() {
	// Setup Context
	ctx := ctrl.SetupSignalHandler()

	// Initialize a new cert watcher with cert/key pair
	watcher, err := certwatcher.New("ssl/tls.crt", "ssl/tls.key")
	if err != nil {
		panic(err)
	}

	// Start goroutine with certwatcher running against supplied cert
	go func() {
		if err := watcher.Start(ctx); err != nil {
			panic(err)
		}
	}()

	// Setup TLS listener using GetCertficate for fetching the cert when changes
	listener, err := tls.Listen("tcp", "localhost:9443", &tls.Config{
		GetCertificate: watcher.GetCertificate,
		MinVersion:     tls.VersionTLS12,
	})
	if err != nil {
		panic(err)
	}

	// Initialize your tls server
	srv := &http.Server{
		Handler:           &sampleServer{},
		ReadHeaderTimeout: 5 * time.Second,
	}

	// Start goroutine for handling server shutdown.
	go func() {
		<-ctx.Done()
		ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
		defer cancel()
		if err := srv.Shutdown(ctx); err != nil {
			panic(err)
		}
	}()

	// Serve t
	if err := srv.Serve(listener); err != nil && err != http.ErrServerClosed {
		panic(err)
	}
}

func (s *sampleServer) ServeHTTP(http.ResponseWriter, *http.Request) {
}

Index ¶

• type CertWatcher
• func New(certPath, keyPath string) (*CertWatcher, error)
• func (cw *CertWatcher) GetCertificate(_ *tls.ClientHelloInfo) (*tls.Certificate, error)
• func (cw *CertWatcher) ReadCertificate() error
• func (cw *CertWatcher) RegisterCallback(callback func(tls.Certificate))
• func (cw *CertWatcher) Start(ctx context.Context) error
• func (cw *CertWatcher) Watch()
• func (cw *CertWatcher) WithWatchInterval(interval time.Duration) *CertWatcher

Examples ¶

• package

Types ¶

type CertWatcher ¶

type CertWatcher struct {
	sync.RWMutex
	// contains filtered or unexported fields
}

CertWatcher watches certificate and key files for changes. It always returns the cached version, but periodically reads and parses certificate and key for changes and calls an optional callback with the new certificate.

func New ¶

func New(certPath, keyPath string) (*CertWatcher, error)

New returns a new CertWatcher watching the given certificate and key.

func (*CertWatcher) GetCertificate ¶

func (cw *CertWatcher) GetCertificate(_ *tls.ClientHelloInfo) (*tls.Certificate, error)

GetCertificate fetches the currently loaded certificate, which may be nil.

func (*CertWatcher) ReadCertificate ¶

func (cw *CertWatcher) ReadCertificate() error

ReadCertificate reads the certificate and key files from disk, parses them, and updates the current certificate on the watcher if updated. If a callback is set, it is invoked with the new certificate.

func (*CertWatcher) RegisterCallback ¶

func (cw *CertWatcher) RegisterCallback(callback func(tls.Certificate))

RegisterCallback registers a callback to be invoked when the certificate changes.

func (*CertWatcher) Start ¶

func (cw *CertWatcher) Start(ctx context.Context) error

Start starts the watch on the certificate and key files.

func (*CertWatcher) Watch ¶

func (cw *CertWatcher) Watch()

Watch reads events from the watcher's channel and reacts to changes.

func (*CertWatcher) WithWatchInterval ¶

func (cw *CertWatcher) WithWatchInterval(interval time.Duration) *CertWatcher

WithWatchInterval sets the watch interval and returns the CertWatcher pointer

Source Files ¶

certwatcher.go doc.go

Directories ¶