tree 10a6bf03472e9c14da2515ea7755d74bb3f660e6
parent 99f477412a2e701f89f7698be1dd432adcfff17c
author Serge Bazanski <serge@monogon.tech> 1628691761 +0200
committer Sergiusz Bazanski <serge@monogon.tech> 1629368455 +0000

m/pkg/pki: refactor, allow for external certificates

The pki library supported managing certificates in two modes:

 - default, when name != ""
 - volatile/ephemeral, when name == ""

The difference between the two being that default certificates were
fully stored in etcd (key and x509 certificate), while volatile
certificates weren't stored at all. However, both kinds needed private
keys passed to the pki library.

We want to be able to emit certificates without having private keys for
that certificate, so we end up a third mode of operation: 'external
certificates'. These are still stored in etcd, but without any
corresponding private key.

In the future we might actually get rid of ephemeral certificates by
expanding the logic of external certificates to provide a full audit log
and revocation system, instead of matching by Certificate Name. But this
will do for now.

We also use this opportunity to write some simple tests for this
package.

Change-Id: I193f4b147273b0a3981c38d749b43362d3c1b69a
Reviewed-on: https://review.monogon.dev/c/monogon/+/263
Reviewed-by: Mateusz Zalega <mateusz@monogon.tech>