ca_service.proto

// Copyright 2017 Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";
import "google/rpc/status.proto";

package istio.v1.auth;

import "gogoproto/gogo.proto";

option go_package="istio_v1_auth";
option (gogoproto.goproto_getters_all) = false;
option (gogoproto.equal_all) = false;
option (gogoproto.gostring_all) = false;

// Service definition of IstioCAService that can dynamically verify the CSR for
// service identities for Istio services running on various platforms and
// approve or disapprove the request after verifying the Node Agent credentials
// provided as a part of the Request.
service IstioCAService {

  // A request object includes a PEM-encoded certificate signing request that
  // is generated on the Node Agent. Additionally credential can be attached
  // within the request object for a server to authenticate the originating
  // node agent.
  rpc HandleCSR(CsrRequest) returns (CsrResponse);
}

message CsrRequest {
  // PEM-encoded certificate signing request
  bytes csr_pem = 1;
  // opaque credential for node agent
  bytes node_agent_credential = 2;
  // type of the node_agent_credential (aws/gcp/onprem/custom...)
  string credential_type = 3;
  // the requested ttl of the certificate in minutes
  int32 requested_ttl_minutes = 4;
}

message CsrResponse {
  // Whether the CSR is approved.
  bool is_approved = 1;
  google.rpc.Status status = 2;
  // The signed target cert.
  bytes signed_cert = 3;
  // The cert chain up to the trusted root cert. It includes all the certs between the
  // newly signed cert and the root cert.
  bytes cert_chain = 4;
}