@@ -46,40 +46,37 @@ type CertificateSpec struct {
4646 // +optional
4747 SecretName string `json:"secretName,omitempty" protobuf:"bytes,2,opt,name=secretName"`
4848
49- // KeyEncoding is the private key cryptography standards (PKCS)
50- // for this certificate's private key to be encoded in.
51- // If provided, allowed values are "pkcs1" and "pkcs8".
52- // If KeyEncoding is not specified, then PKCS#1 will be used by default.
53- // +optional
54- KeyEncoding string `json:"keyEncoding,omitempty" protobuf:"bytes,3,opt,name=keyEncoding"`
55-
5649 // Full X509 name specification (https://golang.org/pkg/crypto/x509/pkix/#Name).
5750 // +optional
58- Subject * X509Subject `json:"subject,omitempty" protobuf:"bytes,4 ,opt,name=subject"`
51+ Subject * X509Subject `json:"subject,omitempty" protobuf:"bytes,3 ,opt,name=subject"`
5952
6053 // Certificate default Duration
6154 // +optional
62- Duration * metav1.Duration `json:"duration,omitempty" protobuf:"bytes,5 ,opt,name=duration"`
55+ Duration * metav1.Duration `json:"duration,omitempty" protobuf:"bytes,4 ,opt,name=duration"`
6356
6457 // Certificate renew before expiration duration
6558 // +optional
66- RenewBefore * metav1.Duration `json:"renewBefore,omitempty" protobuf:"bytes,6 ,opt,name=renewBefore"`
59+ RenewBefore * metav1.Duration `json:"renewBefore,omitempty" protobuf:"bytes,5 ,opt,name=renewBefore"`
6760
6861 // DNSNames is a list of subject alt names to be used on the Certificate.
6962 // +optional
70- DNSNames []string `json:"dnsNames,omitempty" protobuf:"bytes,7 ,rep,name=dnsNames"`
63+ DNSNames []string `json:"dnsNames,omitempty" protobuf:"bytes,6 ,rep,name=dnsNames"`
7164
7265 // IPAddresses is a list of IP addresses to be used on the Certificate
7366 // +optional
74- IPAddresses []string `json:"ipAddresses,omitempty" protobuf:"bytes,8 ,rep,name=ipAddresses"`
67+ IPAddresses []string `json:"ipAddresses,omitempty" protobuf:"bytes,7 ,rep,name=ipAddresses"`
7568
7669 // URIs is a list of URI subjectAltNames to be set on the Certificate.
7770 // +optional
78- URIs []string `json:"uris,omitempty" protobuf:"bytes,9 ,rep,name=uris"`
71+ URIs []string `json:"uris,omitempty" protobuf:"bytes,8 ,rep,name=uris"`
7972
8073 // EmailAddresses is a list of email subjectAltNames to be set on the Certificate.
8174 // +optional
82- EmailAddresses []string `json:"emailAddresses,omitempty" protobuf:"bytes,10,rep,name=emailAddresses"`
75+ EmailAddresses []string `json:"emailAddresses,omitempty" protobuf:"bytes,9,rep,name=emailAddresses"`
76+
77+ // Options to control private keys used for the Certificate.
78+ // +optional
79+ PrivateKey * CertificatePrivateKey `json:"privateKey,omitempty" protobuf:"bytes,10,opt,name=privateKey"`
8380}
8481
8582// X509Subject Full X509 name specification
@@ -110,6 +107,35 @@ type X509Subject struct {
110107 SerialNumber string `json:"serialNumber,omitempty" protobuf:"bytes,8,opt,name=serialNumber"`
111108}
112109
110+ // +kubebuilder:validation:Enum=PKCS1;PKCS8
111+ type PrivateKeyEncoding string
112+
113+ const (
114+ // PKCS1 key encoding will produce PEM files that include the type of
115+ // private key as part of the PEM header, e.g. "BEGIN RSA PRIVATE KEY".
116+ // If the keyAlgorithm is set to 'ECDSA', this will produce private keys
117+ // that use the "BEGIN EC PRIVATE KEY" header.
118+ PKCS1 PrivateKeyEncoding = "PKCS1"
119+
120+ // PKCS8 key encoding will produce PEM files with the "BEGIN PRIVATE KEY"
121+ // header. It encodes the keyAlgorithm of the private key as part of the
122+ // DER encoded PEM block.
123+ PKCS8 PrivateKeyEncoding = "PKCS8"
124+ )
125+
126+ // CertificatePrivateKey contains configuration options for private keys
127+ // used by the Certificate controller.
128+ // This allows control of how private keys are rotated.
129+ type CertificatePrivateKey struct {
130+ // The private key cryptography standards (PKCS) encoding for this
131+ // certificate's private key to be encoded in.
132+ // If provided, allowed values are "pkcs1" and "pkcs8" standing for PKCS#1
133+ // and PKCS#8, respectively.
134+ // Defaults to PKCS#1 if not specified.
135+ // +optional
136+ Encoding PrivateKeyEncoding `json:"encoding,omitempty" protobuf:"bytes,1,opt,name=encoding,casttype=PrivateKeyEncoding"`
137+ }
138+
113139// HasCertificate returns "true" if the desired certificate provided in "aliaS" is present in the certificate list.
114140// Otherwise, it returns "false".
115141func HasCertificate (certificates []CertificateSpec , alias string ) bool {
0 commit comments