1- use k8s_openapi:: api:: core:: v1:: { Volume , VolumeMount } ;
21use schemars:: JsonSchema ;
32use serde:: { Deserialize , Serialize } ;
4- use snafu:: { ResultExt , Snafu } ;
5-
6- use crate :: {
7- builder:: pod:: { container:: ContainerBuilder , volume:: VolumeMountBuilder , PodBuilder } ,
8- commons:: {
9- authentication:: SECRET_BASE_PATH ,
10- secret_class:: { SecretClassVolume , SecretClassVolumeError } ,
11- } ,
12- } ;
133
144#[ derive(
155 Clone , Debug , Deserialize , Eq , Hash , JsonSchema , Ord , PartialEq , PartialOrd , Serialize ,
@@ -22,148 +12,3 @@ pub struct AuthenticationProvider {
2212/// will be used to provision client certificates.
2313pub client_cert_secret_class : Option < String > ,
2414}
25-
26- #[ derive( Debug , PartialEq , Snafu ) ]
27- pub enum TlsClientDetailsError {
28- #[ snafu( display( "failed to convert secret class volume into named Kubernetes volume" ) ) ]
29- SecretClassVolume { source : SecretClassVolumeError } ,
30- }
31-
32- #[ derive(
33- Clone , Debug , Deserialize , Eq , Hash , JsonSchema , Ord , PartialEq , PartialOrd , Serialize ,
34- ) ]
35- #[ serde( rename_all = "camelCase" ) ]
36- pub struct TlsClientDetails {
37- /// Use a TLS connection. If not specified no TLS will be used.
38- pub tls : Option < Tls > ,
39- }
40-
41- impl TlsClientDetails {
42- /// This functions adds
43- ///
44- /// * The needed volumes to the PodBuilder
45- /// * The needed volume_mounts to all the ContainerBuilder in the list (e.g. init + main container)
46- ///
47- /// This function will handle
48- ///
49- /// * Tls secret class used to verify the cert of the LDAP server
50- pub fn add_volumes_and_mounts (
51- & self ,
52- pod_builder : & mut PodBuilder ,
53- container_builders : Vec < & mut ContainerBuilder > ,
54- ) -> Result < ( ) , TlsClientDetailsError > {
55- let ( volumes, mounts) = self . volumes_and_mounts ( ) ?;
56- pod_builder. add_volumes ( volumes) ;
57-
58- for cb in container_builders {
59- cb. add_volume_mounts ( mounts. clone ( ) ) ;
60- }
61-
62- Ok ( ( ) )
63- }
64-
65- /// It is recommended to use [`Self::add_volumes_and_mounts`], this function returns you the
66- /// volumes and mounts in case you need to add them by yourself.
67- pub fn volumes_and_mounts (
68- & self ,
69- ) -> Result < ( Vec < Volume > , Vec < VolumeMount > ) , TlsClientDetailsError > {
70- let mut volumes = Vec :: new ( ) ;
71- let mut mounts = Vec :: new ( ) ;
72-
73- if let Some ( secret_class) = self . tls_ca_cert_secret_class ( ) {
74- let volume_name = format ! ( "{secret_class}-ca-cert" ) ;
75- let secret_class_volume = SecretClassVolume :: new ( secret_class. clone ( ) , None ) ;
76- let volume = secret_class_volume
77- . to_volume ( & volume_name)
78- . context ( SecretClassVolumeSnafu ) ?;
79-
80- volumes. push ( volume) ;
81- mounts. push (
82- VolumeMountBuilder :: new ( volume_name, format ! ( "{SECRET_BASE_PATH}/{secret_class}" ) )
83- . build ( ) ,
84- ) ;
85- }
86-
87- Ok ( ( volumes, mounts) )
88- }
89-
90- /// Whether TLS is configured
91- pub const fn uses_tls ( & self ) -> bool {
92- self . tls . is_some ( )
93- }
94-
95- /// Whether TLS verification is configured. Returns `false` if TLS itself isn't configured
96- pub fn uses_tls_verification ( & self ) -> bool {
97- self . tls
98- . as_ref ( )
99- . map ( |tls| tls. verification != TlsVerification :: None { } )
100- . unwrap_or_default ( )
101- }
102-
103- /// Returns the path of the ca.crt that should be used to verify the LDAP server certificate
104- /// if TLS verification with a CA cert from a SecretClass is configured.
105- pub fn tls_ca_cert_mount_path ( & self ) -> Option < String > {
106- self . tls_ca_cert_secret_class ( )
107- . map ( |secret_class| format ! ( "{SECRET_BASE_PATH}/{secret_class}/ca.crt" ) )
108- }
109-
110- /// Extracts the SecretClass that provides the CA cert used to verify the server certificate.
111- pub ( crate ) fn tls_ca_cert_secret_class ( & self ) -> Option < String > {
112- if let Some ( Tls {
113- verification :
114- TlsVerification :: Server ( TlsServerVerification {
115- ca_cert : CaCert :: SecretClass ( secret_class) ,
116- } ) ,
117- } ) = & self . tls
118- {
119- Some ( secret_class. to_owned ( ) )
120- } else {
121- None
122- }
123- }
124- }
125-
126- #[ derive(
127- Clone , Debug , Deserialize , Eq , Hash , JsonSchema , Ord , PartialEq , PartialOrd , Serialize ,
128- ) ]
129- #[ serde( rename_all = "camelCase" ) ]
130- pub struct Tls {
131- /// The verification method used to verify the certificates of the server and/or the client.
132- pub verification : TlsVerification ,
133- }
134-
135- #[ derive(
136- Clone , Debug , Deserialize , Eq , Hash , JsonSchema , Ord , PartialEq , PartialOrd , Serialize ,
137- ) ]
138- #[ serde( rename_all = "camelCase" ) ]
139- pub enum TlsVerification {
140- /// Use TLS but don't verify certificates.
141- None { } ,
142-
143- /// Use TLS and a CA certificate to verify the server.
144- Server ( TlsServerVerification ) ,
145- }
146-
147- #[ derive(
148- Clone , Debug , Deserialize , Eq , Hash , JsonSchema , Ord , PartialEq , PartialOrd , Serialize ,
149- ) ]
150- #[ serde( rename_all = "camelCase" ) ]
151- pub struct TlsServerVerification {
152- /// CA cert to verify the server.
153- pub ca_cert : CaCert ,
154- }
155-
156- #[ derive(
157- Clone , Debug , Deserialize , Eq , Hash , JsonSchema , Ord , PartialEq , PartialOrd , Serialize ,
158- ) ]
159- #[ serde( rename_all = "camelCase" ) ]
160- pub enum CaCert {
161- /// Use TLS and the CA certificates trusted by the common web browsers to verify the server.
162- /// This can be useful when you e.g. use public AWS S3 or other public available services.
163- WebPki { } ,
164-
165- /// Name of the [SecretClass](DOCS_BASE_URL_PLACEHOLDER/secret-operator/secretclass) which will provide the CA certificate.
166- /// Note that a SecretClass does not need to have a key but can also work with just a CA certificate,
167- /// so if you got provided with a CA cert but don't have access to the key you can still use this method.
168- SecretClass ( String ) ,
169- }
0 commit comments