Skip to content

Commit 57e6d60

Browse files
jetstack-botjetstack-bot
authored
Merge pull request #31 from cert-manager/add_CA_support
Add Status.CA support
2 parents bf9deb8 + 0d76d65 commit 57e6d60

9 files changed

+97
-59
lines changed

‎controllers/certificaterequest_controller.go‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,13 @@ type CertificateRequestReconciler struct {
6969
// Clock is used to mock condition transition times in tests.
7070
Clock clock.PassiveClock
7171

72+
// SetCAOnCertificateRequest is used to enable setting the CA status field on
73+
// the CertificateRequest resource. This is disabled by default.
74+
// Deprecated: this option is for backwards compatibility only. The use of
75+
// ca.crt is discouraged. Instead, the CA certificate should be provided
76+
// separately using a tool such as trust-manager.
77+
SetCAOnCertificateRequest bool
78+
7279
PostSetupWithManager func(context.Context, schema.GroupVersionKind, ctrl.Manager, controller.Controller) error
7380
}
7481

@@ -343,7 +350,10 @@ func (r *CertificateRequestReconciler) reconcileStatusPatch(
343350
}
344351
}
345352

346-
crStatusPatch.Certificate = signedCertificate
353+
crStatusPatch.Certificate = signedCertificate.ChainPEM
354+
if r.SetCAOnCertificateRequest {
355+
crStatusPatch.CA = signedCertificate.CAPEM
356+
}
347357
conditions.SetCertificateRequestStatusCondition(
348358
r.Clock,
349359
cr.Status.Conditions,

‎controllers/certificaterequest_controller_integration_test.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -90,9 +90,11 @@ func TestCertificateRequestControllerIntegrationIssuerInitiallyNotFoundAndNotRea
9090
MaxRetryDuration: time.Minute,
9191
EventSource: kubeutil.NewEventStore(),
9292
Client: mgr.GetClient(),
93-
Sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
93+
Sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
9494
atomic.AddUint64(&counters[extractIdFromNamespace(t, cr.GetNamespace())], 1)
95-
return []byte("ok"), nil
95+
return signer.PEMBundle{
96+
ChainPEM: []byte("cert"),
97+
}, nil
9698
},
9799
EventRecorder: record.NewFakeRecorder(100),
98100
Clock: clock.RealClock{},
@@ -227,13 +229,13 @@ func TestCertificateRequestControllerIntegrationSetCondition(t *testing.T) {
227229
MaxRetryDuration: time.Minute,
228230
EventSource: kubeutil.NewEventStore(),
229231
Client: mgr.GetClient(),
230-
Sign: func(ctx context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
232+
Sign: func(ctx context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
231233
atomic.AddUint64(&counter, 1)
232234
select {
233235
case err := <-signResult:
234-
return nil, err
236+
return signer.PEMBundle{}, err
235237
case <-ctx.Done():
236-
return nil, ctx.Err()
238+
return signer.PEMBundle{}, ctx.Err()
237239
}
238240
},
239241
EventRecorder: record.NewFakeRecorder(100),

‎controllers/certificaterequest_controller_test.go‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -127,8 +127,10 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
127127
)
128128

129129
successSigner := func(cert string) signer.Sign {
130-
return func(_ context.Context, _ signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
131-
return []byte(cert), nil
130+
return func(_ context.Context, _ signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
131+
return signer.PEMBundle{
132+
ChainPEM: []byte(cert),
133+
}, nil
132134
}
133135
}
134136

@@ -392,8 +394,8 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
392394
// condition to Failed.
393395
{
394396
name: "timeout-permanent-error",
395-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
396-
return nil, fmt.Errorf("a specific error")
397+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
398+
return signer.PEMBundle{}, fmt.Errorf("a specific error")
397399
},
398400
objects: []client.Object{
399401
cmgen.CertificateRequestFrom(cr1,
@@ -428,8 +430,8 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
428430
// the MaxRetryDuration has been exceeded).
429431
{
430432
name: "retry-on-pending-error",
431-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
432-
return nil, signer.PendingError{Err: fmt.Errorf("pending error")}
433+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
434+
return signer.PEMBundle{}, signer.PendingError{Err: fmt.Errorf("pending error")}
433435
},
434436
objects: []client.Object{
435437
cmgen.CertificateRequestFrom(cr1,
@@ -472,8 +474,8 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
472474
// condition to *Pending*.
473475
{
474476
name: "error-set-certificate-request-condition-should-add-new-condition-and-retry",
475-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
476-
return nil, signer.SetCertificateRequestConditionError{
477+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
478+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
477479
Err: fmt.Errorf("test error"),
478480
ConditionType: "[condition type]",
479481
Status: cmmeta.ConditionTrue,
@@ -526,8 +528,8 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
526528
// condition to *Pending*.
527529
{
528530
name: "error-set-certificate-request-condition-should-update-existing-condition-and-retry",
529-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
530-
return nil, signer.SetCertificateRequestConditionError{
531+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
532+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
531533
Err: fmt.Errorf("test error2"),
532534
ConditionType: "[condition type]",
533535
Status: cmmeta.ConditionTrue,
@@ -589,8 +591,8 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
589591
// to *Failed*.
590592
{
591593
name: "error-set-certificate-request-condition-should-add-new-condition-and-timeout",
592-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
593-
return nil, signer.SetCertificateRequestConditionError{
594+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
595+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
594596
Err: fmt.Errorf("test error"),
595597
ConditionType: "[condition type]",
596598
Status: cmmeta.ConditionTrue,
@@ -644,8 +646,8 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
644646
// to *Failed*.
645647
{
646648
name: "error-set-certificate-request-condition-should-update-existing-condition-and-timeout",
647-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
648-
return nil, signer.SetCertificateRequestConditionError{
649+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
650+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
649651
Err: fmt.Errorf("test error2"),
650652
ConditionType: "[condition type]",
651653
Status: cmmeta.ConditionTrue,
@@ -704,8 +706,8 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
704706
// exceeded).
705707
{
706708
name: "error-set-certificate-request-condition-should-not-timeout-if-pending",
707-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
708-
return nil, signer.SetCertificateRequestConditionError{
709+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
710+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
709711
Err: signer.PendingError{Err: fmt.Errorf("test error")},
710712
ConditionType: "[condition type]",
711713
Status: cmmeta.ConditionTrue,
@@ -757,8 +759,8 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
757759
// exceeded).
758760
{
759761
name: "error-set-certificate-request-condition-should-not-retry-on-permanent-error",
760-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
761-
return nil, signer.SetCertificateRequestConditionError{
762+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
763+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
762764
Err: signer.PermanentError{Err: fmt.Errorf("test error")},
763765
ConditionType: "[condition type]",
764766
Status: cmmeta.ConditionTrue,
@@ -804,8 +806,8 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
804806
// Set the Ready condition to Failed if the sign function returns a permanent error.
805807
{
806808
name: "fail-on-permanent-error",
807-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
808-
return nil, signer.PermanentError{Err: fmt.Errorf("a specific error")}
809+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
810+
return signer.PEMBundle{}, signer.PermanentError{Err: fmt.Errorf("a specific error")}
809811
},
810812
objects: []client.Object{
811813
cmgen.CertificateRequestFrom(cr1,
@@ -837,8 +839,8 @@ func TestCertificateRequestReconcilerReconcile(t *testing.T) {
837839
// to retry.
838840
{
839841
name: "retry-on-error",
840-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
841-
return nil, errors.New("waiting for approval")
842+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
843+
return signer.PEMBundle{}, errors.New("waiting for approval")
842844
},
843845
objects: []client.Object{
844846
cmgen.CertificateRequestFrom(cr1,

‎controllers/certificatesigningrequest_controller.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -255,7 +255,7 @@ func (r *CertificateSigningRequestReconciler) reconcileStatusPatch(
255255
}
256256
}
257257

258-
csrStatusPatch.Certificate = signedCertificate
258+
csrStatusPatch.Certificate = signedCertificate.ChainPEM
259259

260260
logger.V(1).Info("Successfully finished the reconciliation.")
261261
r.EventRecorder.Eventf(&csr, corev1.EventTypeNormal, "Issued", "Succeeded signing the CertificateRequest")

‎controllers/certificatesigningrequest_controller_test.go‎

Lines changed: 24 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -117,8 +117,10 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
117117
)
118118

119119
successSigner := func(cert string) signer.Sign {
120-
return func(_ context.Context, _ signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
121-
return []byte(cert), nil
120+
return func(_ context.Context, _ signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
121+
return signer.PEMBundle{
122+
ChainPEM: []byte(cert),
123+
}, nil
122124
}
123125
}
124126

@@ -287,8 +289,8 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
287289
// condition to Failed.
288290
{
289291
name: "timeout-permanent-error",
290-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
291-
return nil, fmt.Errorf("a specific error")
292+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
293+
return signer.PEMBundle{}, fmt.Errorf("a specific error")
292294
},
293295
objects: []client.Object{
294296
cmgen.CertificateSigningRequestFrom(cr1,
@@ -322,8 +324,8 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
322324
// the MaxRetryDuration has been exceeded).
323325
{
324326
name: "retry-on-pending-error",
325-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
326-
return nil, signer.PendingError{Err: fmt.Errorf("pending error")}
327+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
328+
return signer.PEMBundle{}, signer.PendingError{Err: fmt.Errorf("pending error")}
327329
},
328330
objects: []client.Object{
329331
cmgen.CertificateSigningRequestFrom(cr1,
@@ -357,8 +359,8 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
357359
// condition to *Pending*.
358360
{
359361
name: "error-set-certificate-request-condition-should-add-new-condition-and-retry",
360-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
361-
return nil, signer.SetCertificateRequestConditionError{
362+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
363+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
362364
Err: fmt.Errorf("test error"),
363365
ConditionType: "[condition type]",
364366
Status: cmmeta.ConditionTrue,
@@ -404,8 +406,8 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
404406
// condition to *Pending*.
405407
{
406408
name: "error-set-certificate-request-condition-should-update-existing-condition-and-retry",
407-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
408-
return nil, signer.SetCertificateRequestConditionError{
409+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
410+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
409411
Err: fmt.Errorf("test error2"),
410412
ConditionType: "[condition type]",
411413
Status: cmmeta.ConditionTrue,
@@ -461,8 +463,8 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
461463
// to *Failed*.
462464
{
463465
name: "error-set-certificate-request-condition-should-add-new-condition-and-timeout",
464-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
465-
return nil, signer.SetCertificateRequestConditionError{
466+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
467+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
466468
Err: fmt.Errorf("test error"),
467469
ConditionType: "[condition type]",
468470
Status: cmmeta.ConditionTrue,
@@ -516,8 +518,8 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
516518
// to *Failed*.
517519
{
518520
name: "error-set-certificate-request-condition-should-update-existing-condition-and-timeout",
519-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
520-
return nil, signer.SetCertificateRequestConditionError{
521+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
522+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
521523
Err: fmt.Errorf("test error2"),
522524
ConditionType: "[condition type]",
523525
Status: cmmeta.ConditionTrue,
@@ -577,8 +579,8 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
577579
// exceeded).
578580
{
579581
name: "error-set-certificate-request-condition-should-not-timeout-if-pending",
580-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
581-
return nil, signer.SetCertificateRequestConditionError{
582+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
583+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
582584
Err: signer.PendingError{Err: fmt.Errorf("test error")},
583585
ConditionType: "[condition type]",
584586
Status: cmmeta.ConditionTrue,
@@ -623,8 +625,8 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
623625
// exceeded).
624626
{
625627
name: "error-set-certificate-request-condition-should-not-retry-on-permanent-error",
626-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
627-
return nil, signer.SetCertificateRequestConditionError{
628+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
629+
return signer.PEMBundle{}, signer.SetCertificateRequestConditionError{
628630
Err: signer.PermanentError{Err: fmt.Errorf("test error")},
629631
ConditionType: "[condition type]",
630632
Status: cmmeta.ConditionTrue,
@@ -670,8 +672,8 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
670672
// Set the Ready condition to Failed if the sign function returns a permanent error.
671673
{
672674
name: "fail-on-permanent-error",
673-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
674-
return nil, signer.PermanentError{Err: fmt.Errorf("a specific error")}
675+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
676+
return signer.PEMBundle{}, signer.PermanentError{Err: fmt.Errorf("a specific error")}
675677
},
676678
objects: []client.Object{
677679
cmgen.CertificateSigningRequestFrom(cr1,
@@ -702,8 +704,8 @@ func TestCertificateSigningRequestReconcilerReconcile(t *testing.T) {
702704
// to retry.
703705
{
704706
name: "retry-on-error",
705-
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
706-
return nil, errors.New("waiting for approval")
707+
sign: func(_ context.Context, cr signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
708+
return signer.PEMBundle{}, errors.New("waiting for approval")
707709
},
708710
objects: []client.Object{
709711
cmgen.CertificateSigningRequestFrom(cr1,

‎controllers/combined_controller.go‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,13 @@ type CombinedController struct {
5151
// Clock is used to mock condition transition times in tests.
5252
Clock clock.PassiveClock
5353

54+
// SetCAOnCertificateRequest is used to enable setting the CA status field on
55+
// the CertificateRequest resource. This is disabled by default.
56+
// Deprecated: this option is for backwards compatibility only. The use of
57+
// ca.crt is discouraged. Instead, the CA certificate should be provided
58+
// separately using a tool such as trust-manager.
59+
SetCAOnCertificateRequest bool
60+
5461
PostSetupWithManager func(context.Context, schema.GroupVersionKind, ctrl.Manager, controller.Controller) error
5562
}
5663

@@ -94,6 +101,8 @@ func (r *CombinedController) SetupWithManager(ctx context.Context, mgr ctrl.Mana
94101
EventRecorder: r.EventRecorder,
95102
Clock: r.Clock,
96103

104+
SetCAOnCertificateRequest: r.SetCAOnCertificateRequest,
105+
97106
PostSetupWithManager: r.PostSetupWithManager,
98107
}).SetupWithManager(ctx, mgr); err != nil {
99108
return fmt.Errorf("CertificateRequestReconciler: %w", err)

‎controllers/combined_controller_integration_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -75,12 +75,12 @@ func TestCombinedControllerTemporaryFailedCertificateRequestRetrigger(t *testing
7575
return ctx.Err()
7676
}
7777
},
78-
Sign: func(_ context.Context, _ signer.CertificateRequestObject, _ v1alpha1.Issuer) ([]byte, error) {
78+
Sign: func(_ context.Context, _ signer.CertificateRequestObject, _ v1alpha1.Issuer) (signer.PEMBundle, error) {
7979
select {
8080
case err := <-signResult:
81-
return nil, err
81+
return signer.PEMBundle{}, err
8282
case <-ctx.Done():
83-
return nil, ctx.Err()
83+
return signer.PEMBundle{}, ctx.Err()
8484
}
8585
},
8686
EventRecorder: record.NewFakeRecorder(100),

‎controllers/signer/interface.go‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,23 @@ import (
2222
"time"
2323

2424
cmapi "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
25+
"github.com/cert-manager/cert-manager/pkg/util/pki"
2526
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
2627

2728
"github.com/cert-manager/issuer-lib/api/v1alpha1"
2829
)
2930

30-
type Sign func(ctx context.Context, cr CertificateRequestObject, issuerObject v1alpha1.Issuer) ([]byte, error)
31+
// PEMBundle includes the PEM encoded X.509 certificate chain and CA.
32+
// The first certificate in the ChainPEM chain is the leaf certificate, and the
33+
// last certificate in the chain is the highest level non-self-signed certificate.
34+
// The CAPEM certificate is our best guess at the CA that issued the leaf.
35+
// IMORTANT: the CAPEM certificate is only used when the SetCAOnCertificateRequest
36+
// option is enabled in the controller. This option is for backwards compatibility
37+
// only. The use of the CA field and the ca.crt field in the resulting Secret is
38+
// discouraged, instead the CA should be provisioned separately (e.g. using trust-manager).
39+
type PEMBundle pki.PEMBundle
40+
41+
type Sign func(ctx context.Context, cr CertificateRequestObject, issuerObject v1alpha1.Issuer) (PEMBundle, error)
3142
type Check func(ctx context.Context, issuerObject v1alpha1.Issuer) error
3243

3344
// CertificateRequestObject is an interface that represents either a

0 commit comments

Comments
 (0)