Struct WebhookCertificate 

pub struct WebhookCertificate {
    pub ca_pem: String,
    pub cert_pem: String,
    pub key_pem: String,
}

Available on crate feature k8s only.

A CA and a serving certificate for <service>.<namespace>.svc (and the short names): the API server checks the webhook’s certificate against the CA in the webhook configuration’s caBundle.

Fields

ca_pem: String

cert_pem: String

key_pem: String

Implementations

impl WebhookCertificate

pub fn generate( service: &str, namespace: &str, ) -> Result<WebhookCertificate, String>

A new CA and a certificate signed by it for the Service service in namespace, valid for ten years.

pub fn generate_for( common_name: &str, names: Vec<String>, ) -> Result<WebhookCertificate, String>

The same for other DNS names (a webhook the API server reaches by URL rather than through a Service).

pub async fn shared( client: &Client, namespace: &str, secret: &str, service: &str, ) -> Result<WebhookCertificate, Error>

The certificate every replica of an operator uses: read from the TLS Secret secret in namespace, or made and stored there by the first replica to ask (a create race is settled by the API server: the loser reads the winner’s). Replicas that each made their own would overwrite each other’s caBundle. The pod needs get and create on secrets in the namespace.

pub fn to_secret(&self, name: &str, namespace: &str) -> Secret

A kubernetes.io/tls Secret holding it (tls.crt, tls.key, ca.crt).

pub fn from_secret(secret: &Secret) -> Option<WebhookCertificate>

Read one from a Secret written by to_secret (or cert-manager, whose Secrets have the same keys).

pub fn install(&self, dir: &str) -> Result<(), String>

Write tls.crt, tls.key and ca.crt into dir and point rws’s TLS settings at them (RWS_CONFIG_TLS_CERT_FILE/KEY_FILE), so Server::run_tls serves them.

pub async fn patch_ca_bundle( &self, client: &Client, validating: Option<&str>, mutating: Option<&str>, crd: Option<&str>, ) -> Result<(), Error>

Put the CA into the caBundle of every webhook in the Validating/MutatingWebhookConfiguration name (and a CRD’s conversion webhook, when crd is given) — for an operator that makes its own certificate at startup.

Trait Implementations

impl Clone for WebhookCertificate

fn clone(&self) -> WebhookCertificate

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.