1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
|
package federation_test
import (
"context"
"net/http"
"time"
"github.com/spiffe/go-spiffe/v2/bundle/spiffebundle"
"github.com/spiffe/go-spiffe/v2/federation"
"github.com/spiffe/go-spiffe/v2/spiffeid"
"github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig"
"github.com/spiffe/go-spiffe/v2/workloadapi"
)
func ExampleFetchBundle_webPKI() {
endpointURL := "https://example.org:8443/bundle"
trustDomain, err := spiffeid.TrustDomainFromString("example.org")
if err != nil {
// TODO: handle error
}
bundle, err := federation.FetchBundle(context.TODO(), trustDomain, endpointURL)
if err != nil {
// TODO: handle error
}
// TODO: use bundle
bundle = bundle
}
func ExampleFetchBundle_sPIFFEAuth() {
// Obtain a bundle from the example.org trust domain from a server hosted
// at https://example.org/bundle with the
// spiffe://example.org/bundle-server SPIFFE ID.
endpointURL := "https://example.org:8443/bundle"
trustDomain, err := spiffeid.TrustDomainFromString("example.org")
if err != nil {
// TODO: handle error
}
serverID := spiffeid.RequireFromPath(trustDomain, "/bundle-server")
bundle, err := spiffebundle.Load(trustDomain, "bundle.json")
if err != nil {
// TODO: handle error
}
bundleSet := spiffebundle.NewSet(bundle)
bundleSet.Add(bundle)
updatedBundle, err := federation.FetchBundle(context.TODO(), trustDomain, endpointURL,
federation.WithSPIFFEAuth(bundleSet, serverID))
if err != nil {
// TODO: handle error
}
// TODO: use bundle, e.g. replace the bundle in the bundle set so it can
// be used to fetch the next bundle.
bundleSet.Add(updatedBundle)
}
func ExampleWatchBundle_webPKI() {
endpointURL := "https://example.org:8443/bundle"
trustDomain, err := spiffeid.TrustDomainFromString("example.org")
if err != nil {
// TODO: handle error
}
var watcher federation.BundleWatcher
err = federation.WatchBundle(context.TODO(), trustDomain, endpointURL, watcher)
if err != nil {
// TODO: handle error
}
}
func ExampleWatchBundle_sPIFFEAuth() {
// Watch for bundle updates from the example.org trust domain from a server
// hosted at https://example.org/bundle with the
// spiffe://example.org/bundle-server SPIFFE ID.
endpointURL := "https://example.org:8443/bundle"
trustDomain, err := spiffeid.TrustDomainFromString("example.org")
if err != nil {
// TODO: handle error
}
serverID := spiffeid.RequireFromPath(trustDomain, "/bundle-server")
bundle, err := spiffebundle.Load(trustDomain, "bundle.json")
if err != nil {
// TODO: handle error
}
bundleSet := spiffebundle.NewSet(bundle)
bundleSet.Add(bundle)
// TODO: When implementing the watcher's OnUpdate, replace the bundle for
// the trust domain in the bundle set so the next connection uses the
// updated bundle.
var watcher federation.BundleWatcher
err = federation.WatchBundle(context.TODO(), trustDomain, endpointURL,
watcher, federation.WithSPIFFEAuth(bundleSet, serverID))
if err != nil {
// TODO: handle error
}
}
func ExampleHandler_webPKI() {
trustDomain, err := spiffeid.TrustDomainFromString("example.org")
if err != nil {
// TODO: handle error
}
bundleSource, err := workloadapi.NewBundleSource(context.TODO())
if err != nil {
// TODO: handle error
}
defer bundleSource.Close()
handler, err := federation.NewHandler(trustDomain, bundleSource)
if err != nil {
// TODO: handle error
}
server := http.Server{
Addr: ":8443",
Handler: handler,
ReadHeaderTimeout: time.Second * 10, // TODO: set this appropriately
}
if err := server.ListenAndServeTLS("", ""); err != nil {
// TODO: handle error
}
}
func ExampleHandler_sPIFFEAuth() {
trustDomain, err := spiffeid.TrustDomainFromString("example.org")
if err != nil {
// TODO: handle error
}
// Create an X.509 source for obtaining the server X509-SVID
x509Source, err := workloadapi.NewX509Source(context.TODO())
if err != nil {
// TODO: handle error
}
defer x509Source.Close()
// Create a bundle source for obtaining the bundle for the trust domain
bundleSource, err := workloadapi.NewBundleSource(context.TODO())
if err != nil {
// TODO: handle error
}
defer bundleSource.Close()
handler, err := federation.NewHandler(trustDomain, bundleSource)
if err != nil {
// TODO: handle error
}
server := http.Server{
Addr: ":8443",
Handler: handler,
ReadHeaderTimeout: time.Second * 10, // TODO: set this appropriately
TLSConfig: tlsconfig.TLSServerConfig(x509Source),
}
if err := server.ListenAndServeTLS("", ""); err != nil {
// TODO: handle error
}
}
|
