Expand description
TLS transport for the HTTP API.
bindcar’s REST API carries a privileged bearer credential on every request —
a Kubernetes ServiceAccount token under TokenReview auth, or the shared
BIND_API_TOKEN. Authentication proves who the caller is; it does nothing
for confidentiality. Without TLS that credential crosses the pod network in
the clear, readable by anything able to observe the link.
This module resolves the TLS configuration and builds the [rustls] server
config. TLS is opt-in: with no certificate configured bindcar serves
plaintext exactly as before, so existing deployments are unaffected.
§Configuration
| CLI flag | Environment variable | Meaning |
|---|---|---|
--tls-cert | BIND_TLS_CERT | PEM certificate chain, leaf first |
--tls-key | BIND_TLS_KEY | PEM private key (PKCS#8, PKCS#1 or SEC1) |
--tls-client-ca | BIND_TLS_CLIENT_CA | PEM CA bundle; presence turns on mTLS |
§Fail-closed rules
Misconfiguration is a startup error, never a silent downgrade:
- Exactly one of cert/key set →
TlsError::IncompleteKeyPair. Falling back to plaintext here would serve the API in the clear on a deployment whose operator believes TLS is on. - A client CA with no key pair →
TlsError::ClientCaWithoutTls, rather than accepting the flag and ignoring it. - Unreadable or unparseable PEM → an error before the listener binds.
Structs§
- TlsReloader
- Holds the live [
rustls::ServerConfig] and swaps it when the files change. - TlsSettings
- A resolved, syntactically valid TLS configuration.
Enums§
- TlsError
- Errors raised while resolving or loading the TLS transport configuration.
Constants§
- DEFAULT_
RELOAD_ INTERVAL_ SECS - How often the certificate files are re-examined, in seconds.
Functions§
- build_
server_ config - Build the [
rustls::ServerConfig] for the API listener. - ensure_
crypto_ provider - Install the process-wide rustls crypto provider (aws-lc-rs).
- fingerprint
- Fingerprint the TLS material currently on disk.
- resolve_
tls_ settings - Resolve TLS settings from the certificate, key and client-CA options.
- scheme_
for - The URL scheme bindcar serves under, for log lines and the advertised docs URL.