* Define and implement PendingCSRRequestService
* Add cache/events support
* Wire to server init
* Use the proto Opaque API
* Move marshal/unmarshal funcs to lib/services/local, unexpose
* Remove extraneous "(" from error message
Co-authored-by: Tyler Richardson <[email protected]>
* s/ListPendingCSRRequest/ListPendingCSRRequests/
---------
Co-authored-by: Tyler Richardson <[email protected]>
* Document CRL changes, fix typos
* Add the PendingCSRRequest proto
* Add PendingCSRRequest to client/proto.Event
* make grpc
* Document that a successful CreateCSRResponse always has a CSR
* make grpc
* Fold db_client and windows section using <details>
* Fix incorrect heading reference
* Update the CA override guide with new features and commands
* s/Auth instances/Auth Service instances/
Co-authored-by: Paul Gottschling <[email protected]>
* Revert "Fold db_client and windows section using <details>"
This reverts commit 427e05fbf4.
* Move "disabled overrides" to their own section
* Use "multi-Auth clusters with per-instance HSM keys"
* Adjust multi-Auth language
* Split commands into blocks
* Mention "each certificate" in step 4
---------
Co-authored-by: Paul Gottschling <[email protected]>
* chore: Bump /x/image and go-pkcs12
* chore: Bump github.com/sigstore/cosign/v3 to v3.0.6
* make go-mod-tidy-all
* make grpc
* Keep k8s.io/ modules in lockstep
* make go-mod-tidy-all
* Add public docs for the CA override feature
* Use `code` blocks instead of `shell`
* Number steps as n/d. Move alternatives to H3.
* Move intro paragraphs to "How it works"
* Remove "Supported CAs" section, move its contents to other sections
* Mention specific commands in the info box
* Emphasize future growth
Co-authored-by: rosstimothy <[email protected]>
---------
Co-authored-by: rosstimothy <[email protected]>
* Update cache behavior
* Document create-override-csr behavioral changes (outputs to stdout)
* Favor "O=" over the custom OID
* Document "start session" event changes
* Drop --subject use in a multi-key scenario
* Appease cspell
* Drop types.X509Certificate, update TrustChain comments
* Update example public keys to match implementation
* Refactor duplicated CA override logic into lib/subca
* Make getClientCert resilient to trailing PEM whitespace
* Drop a.subCAEnabled from lib/auth/ca_override.go
* lib/subca includes override CA in chain
* Calculate CA overrides on GenerateDatabaseCert
* Propagate CA override details to DatabaseSessionStart events
* Fix breakage on ./lib/srv/db
* Include only known CAs on CACerts
* Tweak getDatabaseCACerts error wrapping message
* Add godoc to dbAuth.WithSession
* Review: Deterministic PEM ordering
* Review: Fix session.caOverrideDetails assertion
* Review: Fix comment typo
* Review: Explain lack of TrustChain/CAOverride on generateDatabaseServerCert
* Remove unused func
* Fix build and tests after rebase
* Make the cache resilient CA override NotImplemented
* Don't apply overrides on OSS builds
* Use modulestest.EnterpriseModules()
* Revert "Make the cache resilient CA override NotImplemented"
This reverts commit d07c9db8e0.
* Deny watchers for cert_authority_override in OSS Auth
* Tweak watcher debug message
* Re-create watcher on events other than OpPut or OpDelete
* Fix verifyOpInitKindsForCAEvents return when `e.Resource==nil`
* Mention older control plane in comments
* Add SubKind to Windows CA override watchers
* Restore ForWindows watcher
* Revert "Add SubKind to Windows CA override watchers"
This reverts commit 458f93f5fd.
* Apply overrides to Windows certificates
* Add lib/subca.CalculateOverrideResult.ToClientOverrideDetailsProto
* Propagate CA override details to audit
* Add lib/subca.SupportedCATypes()
* Add the "tctl auth create-override-csr" command
* Rephrase comment on InitFunc
* Find min hash length before writing files
* Use slices.Clone
* Harden against unexpectedly small/uneven sized hashes
* Avoid using labels
* Output to stdout by default
* Add the api/client.Client.SubCAClient() method
* Implement tctl resource support for cert_authority_override
* Remove `false` booleans
* Change "tctl create" message according to action
* Add support for all 3 forms of "tctl get"
* Add the "tctl auth pub-key-hash" command
* Rename test so it's clearly specific to the pub-key-hash command
* Rename prepareFlags to prepareCommand
* Fix typo on commandState.Stderr
* Add KindCertAuthorityOverride
* Add lib/subca.ParseCertificateOverrideCertificate
* Add a minimal local.SubCAService creation API
* Add the Sub CA storage testenv
* Implement local.SubCAService create and get
* Refactor caOverridesPrefix to a func
* Replace inline comment with const
* Fix after generic.Service merge
* Change key prefix to "/cluster"
* Drop lateral validation
* Simplify validation
* Validate chain cryptographically
* chore: Bump otel packages to v1.40.0
* Bump otel contrib packages
* Tidy modules
* Bump otel in examples
* fix: Use a local copy of otelhttp.DefaultClient
* Move otelhttp to lib/observability/
* Add proto definitions for the Sub CA feature
* make grpc
* Add license
* Document print format of PublicKeyHash
* Simplify comment on ATV.value
* Document CreateCSR behavior on HSMs
* make grpc
* Use an optional value for ATV
* make grpc
* List doesn't take an ID
* Print public key hashes in hex
* Mention that each Auth signs all its keys in CreateCSR
* make grpc
* Add Create and Update RPCs
* make grpc
* Fix typos and Get/List responses
* make grpc
Alan Parra