Class DefaultX509Source

java.lang.Object

io.spiffe.workloadapi.DefaultX509Source

All Implemented Interfaces:

BundleSource<X509Bundle>, X509SvidSource, X509Source, Closeable, AutoCloseable

public final class DefaultX509Source
extends Object
implements X509Source

Represents a source of X.509 SVIDs and X.509 bundles maintained via the Workload API.

It handles a X509Svid and a X509BundleSet that are updated automatically whenever there is an update from the Workload API.

Implements X509SvidSource and BundleSource.

Implements the Closeable interface. The close() method closes the source, dropping the connection to the Workload API. Other source methods will return an error after close has been called.

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	DefaultX509Source.X509SourceOptions	Options for creating a new DefaultX509Source

Method Summary

Modifier and Type	Method	Description
void	close()	Closes this source, dropping the connection to the Workload API.
X509Bundle	getBundleForTrustDomain(@NonNull TrustDomain trustDomain)	Returns the X.509 bundle for a given trust domain.
X509Svid	getX509Svid()	Returns the X.509 SVID handled by this source.
static DefaultX509Source	newSource()	Creates a new X.509 source.
static DefaultX509Source	newSource(@NonNull DefaultX509Source.X509SourceOptions options)	Creates a new X.509 source.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Details

newSource

public static DefaultX509Source newSource()
                                   throws SocketEndpointAddressException,
X509SourceException

Creates a new X.509 source. It blocks until the initial update with the X.509 materials has been received from the Workload API or until the timeout configured through the system property `spiffe.newX509Source.timeout` expires. If no timeout is configured, it blocks until it gets an X.509 update from the Workload API.

It uses the default address socket endpoint from the environment variable to get the Workload API address.

It uses the default X.509 SVID (picks the first SVID that comes in the Workload API response).

Returns:

an instance of DefaultX509Source, with the SVID and bundles initialized

Throws:

SocketEndpointAddressException - if the address to the Workload API is not valid

X509SourceException - if the source could not be initialized

newSource

public static DefaultX509Source newSource(@NonNull
 @NonNull DefaultX509Source.X509SourceOptions options)
                                   throws SocketEndpointAddressException,
X509SourceException

Creates a new X.509 source. It blocks until the initial update with the X.509 materials has been received from the Workload API, doing retries with a backoff exponential policy, or until the timeout has expired.

If the timeout is not provided in the options, the default timeout is read from the system property `spiffe.newX509Source.timeout`. If none is configured, this method will block until the X.509 materials can be retrieved from the Workload API.

The WorkloadApiClient can be provided in the options, if it is not, a new client is created.

If no SVID Picker is provided in the options, it uses the default X.509 SVID (picks the first SVID that comes in the Workload API response).

Parameters:

options - DefaultX509Source.X509SourceOptions

Returns:

an instance of DefaultX509Source, with the SVID and bundles initialized

Throws:

SocketEndpointAddressException - if the address to the Workload API is not valid

X509SourceException - if the source could not be initialized

getX509Svid

public X509Svid getX509Svid()

Returns the X.509 SVID handled by this source.

Specified by:

getX509Svid in interface X509SvidSource

Returns:

a X509Svid

Throws:

IllegalStateException - if the source is closed

getBundleForTrustDomain

public X509Bundle getBundleForTrustDomain(@NonNull
 @NonNull TrustDomain trustDomain)
                                   throws BundleNotFoundException

Returns the X.509 bundle for a given trust domain.

Specified by:

getBundleForTrustDomain in interface BundleSource<X509Bundle>

Parameters:

trustDomain - an instance of a TrustDomain

Returns:

an instance of a X509Bundle

Throws:

BundleNotFoundException - is there is no bundle for the trust domain provided

IllegalStateException - if the source is closed

close

public void close()

Closes this source, dropping the connection to the Workload API. Other source methods will return an error after close has been called.

It is marked with SneakyThrows because it is not expected to throw the checked exception defined on the Closeable interface.

Specified by:

close in interface AutoCloseable

Specified by:

close in interface Closeable