Method certmagicConfig

admin.go:612–645

(logger *zap.Logger, makeCache bool)

}

func (ident *IdentityConfig) certmagicConfig(logger *zap.Logger, makeCache bool) *certmagic.Config {
	var cmCfg *certmagic.Config
	if ident == nil {
		// user might not have configured identity; that's OK, we can still make a
		// certmagic config, although it'll be mostly useless for remote management
		ident = new(IdentityConfig)
	}
	// Choose storage: prefer the package-level test override when present,
	// otherwise use the configured DefaultStorage. Tests may set an override
	// to divert storage into a temporary location. Otherwise, in production
	// we use the DefaultStorage since we don't want to act as part of a
	// cluster; this storage is for the server's local identity only.
	var storage certmagic.Storage
	if testCertMagicStorageOverride != nil {
		storage = testCertMagicStorageOverride
	} else {
		storage = DefaultStorage
	}
	template := certmagic.Config{
		Storage: storage,
		Logger:  logger,
		Issuers: ident.issuers,
	}
	if makeCache {
		identityCertCache = certmagic.NewCache(certmagic.CacheOptions{
			GetConfigForCert: func(certmagic.Certificate) (*certmagic.Config, error) {
				return cmCfg, nil
			},
			Logger: logger.Named("cache"),
		})
	}
	cmCfg = certmagic.New(identityCertCache, template)
	return cmCfg
}

// IdentityCredentials returns this instance's configured, managed identity credentials
// that can be used in TLS client authentication.