Herman Slatman
d8776d8f7f
Add K8sSA SSH user policy back
...
According to the docs, the K8sSA provisioner can be configured
to issue SSH user certs.
2022-04-01 15:37:48 +02:00
Herman Slatman
571b21abbc
Fix (most) PR comments
2022-03-31 16:12:29 +02:00
Herman Slatman
dc23fd23bf
Merge branch 'master' into herman/allow-deny-next
2022-03-24 12:36:12 +01:00
Mariano Cano
259e95947c
Add support for the provisioner controller
...
The claimer, audiences and custom callback methods are now managed
by the provisioner controller in an uniform way.
2022-03-09 18:43:45 -08:00
Herman Slatman
7c541888ad
Refactor configuration of allow/deny on authority level
2022-03-08 13:26:07 +01:00
Herman Slatman
88c7b63c9d
Split SSH user and cert policy configuration and execution
2022-02-01 15:18:39 +01:00
Herman Slatman
512b8d6730
Refactor instantiation of policy engines
...
Instead of using the `base` struct, the x509 and SSH policy
engines are now added to each provisioner directly.
2022-01-25 16:45:25 +01:00
Herman Slatman
9539729bd9
Add initial implementation of x509 and SSH allow/deny policy engine
2022-01-03 12:25:24 +01:00
max furman
9fdef64709
Admin level API for provisioner mgmt v1
2021-07-02 19:05:17 -07:00
max furman
638766c615
wip
2021-05-19 18:23:20 -07:00
Mariano Cano
4c8bf87dc1
Use new admin template for K8ssa and admin-OIDC provisioners.
...
This change replaces the .Insecure.CR template to one that sets
all the SANs, but uses key usages and extended key usages for
regular TLS certificates.
2020-09-21 12:49:16 -07:00
Mariano Cano
ba918100d0
Use go.step.sm/crypto/jose
...
Replace use of github.com/smallstep/cli/crypto with the new package
go.step.sm/crypto/jose.
2020-08-24 14:44:11 -07:00
Mariano Cano
d30a95236d
Use always go.step.sm/crypto
2020-08-14 15:33:50 -07:00
Mariano Cano
e83e47a91e
Use sshutil and randutil from go.step.sm/crypto.
2020-08-10 11:26:51 -07:00
Mariano Cano
f437b86a7b
Merge branch 'cert-templates' into ssh-cert-templates
2020-08-05 18:43:07 -07:00
Mariano Cano
c8d225a763
Use x509util from go.step.sm/crypto/x509util
2020-08-05 16:02:46 -07:00
Mariano Cano
aa657cdb4b
Use SSHOptions inside provisioner options.
2020-07-30 18:44:52 -07:00
Mariano Cano
a78f7e8913
Add template support on k8ssa provisioner.
2020-07-30 17:45:03 -07:00
Mariano Cano
6c64fb3ed2
Rename provisioner options structs:
...
* provisioner.ProvisionerOptions => provisioner.Options
* provisioner.Options => provisioner.SignOptions
* provisioner.SSHOptions => provisioner.SingSSHOptions
2020-07-22 18:24:45 -07:00
Mariano Cano
02c4f9817d
Set full token payload instead of only the known properties.
2020-07-21 14:21:54 -07:00
Mariano Cano
cf2989a848
Add token and subject to K8sSA provisioner to be used in custom
...
templates.
2020-07-21 14:18:06 -07:00
Mariano Cano
00fd41a3d0
Add template support to K8sSA provisioners.
2020-07-21 14:18:06 -07:00
max furman
1cb8bb3ae1
Simplify statuscoder error generators.
2020-01-28 13:29:40 -08:00
max furman
dccbdf3a90
Introduce generalized statusCoder errors and loads of ssh unit tests.
...
* StatusCoder api errors that have friendly user messages.
* Unit tests for SSH sign/renew/rekey/revoke across all provisioners.
2020-01-28 13:29:40 -08:00
Mariano Cano
84ff172093
Add support for backdate to SSH certificates.
2020-01-28 13:29:39 -08:00
Mariano Cano
cf592fa0e1
Remove global check for number of k8sSA provisioners.
...
This was causing a bug in the reload of the ca.
2020-01-28 13:28:16 -08:00
max furman
54e3cf7322
Add multiuse capability to k8ssa provisioners
2020-01-28 13:28:16 -08:00
max furman
29853ae016
sshpop provisioner + ssh renew | revoke | rekey first pass
2020-01-28 13:28:16 -08:00
max furman
8f07ff6a39
Add kubernetes service account provisioner
2019-10-29 17:42:50 -07:00
