Kibotos
API 参考kibotos.enrollment.v1

EnrollmentService

本页列出 kibotos.enrollment.v1 中 EnrollmentService 的方法及每个方法用到的消息与枚举，由 enrollment.proto 及其注释生成，注释保持英文。

Operator API 与 node API连接所用的主体决定能调用哪个方法。

EnrollmentService is mounted on both the Operator API and the node API. The transport principal decides what a caller may do: a bootstrap principal (spiffe://<trust-domain>/enrollment/<grant-id>) may only call Enroll, and a formal Operator or node principal may only call Renew. The router enforces that rule before it deserializes any request body, and Enroll additionally requires the grant kind to match the endpoint it arrived on.

Enroll

POST/kibotos.enrollment.v1.EnrollmentService/Enroll一元调用
请求EnrollRequest

EnrollRequest proves possession of a client-generated key. The CSR must be a DER PKCS#10 request of at most 8 KiB without requested extensions or names; ctrl ignores its subject and builds the identity from the grant.

响应EnrollResponse

Renew

POST/kibotos.enrollment.v1.EnrollmentService/Renew一元调用
请求RenewRequest

RenewRequest carries a CSR for a fresh client-generated key. ctrl issues only for the same active principal that authenticated the call.

响应RenewResponse

消息与枚举

EnrollmentService 的多个方法用到以下消息与枚举。

IssuedIdentity

IssuedIdentity is the authoritative result of one enrollment or renewal. It never carries a private key.

  • identity_uristring= 1
  • certificatebytes= 2

    certificate is the DER leaf signed by the control-client CA.

  • ca_certificatebytes= 3

    ca_certificate is the DER control-client CA so the client can verify the chain before persisting anything.

  • serialstring= 4
  • not_beforegoogle.protobuf.Timestamp= 5
  • not_aftergoogle.protobuf.Timestamp= 6

kibotos.operator.v1 类型

本页列出 kibotos.operator.v1 中不专属于某个服务的消息与枚举，由 operator.proto 及其注释生成，注释保持英文。只有一个服务用到的消息与枚举在那个服务的页面上。

/v1/files

本页说明 node 数据面的 /v1/files。参数名与限制由 Kibotos 实现它所用的常量生成，说明保持英文。

本页内容

EnrollRenew消息与枚举IssuedIdentity