acme

type ARIReplacesAllower ¶ added in v1.104.1

type ARIReplacesAllower interface {
	// ShouldUseARIReplacesForRenewal reports whether the renewal order
	// for domain should carry the ARI "replaces" hint. It is advisory:
	// a non-nil error means eligibility could not be determined, not
	// that the hint should be skipped, and callers fail open (use the
	// hint) in that case.
	ShouldUseARIReplacesForRenewal(domain string) (bool, error)
}

ARIReplacesAllower is optionally implemented by state stores to opt out of the ARI "replaces" hint on a per-domain basis at renewal time. When implemented and returning false, the renewal path submits a plain newOrder instead of claiming renewal exemption via "replaces".

Used by the k8s cert-share store to prevent submitting a "replaces" claim that Let's Encrypt would reject because the current ACME account did not issue the previous cert (which can happen when a shared per-tailnet account key is adopted after a cert was already issued by a per-pod account). See #18251.

type TLSCertKeyReader ¶

type TLSCertKeyReader interface {
	ReadTLSCertAndKey(domain string) ([]byte, []byte, error)
}

TLSCertKeyReader is an interface implemented by state stores where it makes sense to read the TLS cert and key in a single operation that can be distinguished from generic state value reads. Currently this is only implemented by the kubestore.Store, which, in some cases, needs to read cert and key from a non-cached TLS Secret.

type TLSCertKeyWriter ¶

type TLSCertKeyWriter interface {
	WriteTLSCertAndKey(domain string, cert, key []byte) error
}

TLSCertKeyWriter is an interface implemented by state stores that can write the TLS cert and key in a single atomic operation. Currently this is only implemented by the kubestore.StoreKube.