feat: support dynamic downstream TLS certificate minting

.golangci.yml

@@ -48,6 +48,8 @@ linters:
         - Recorder
         - ca
         - caProvider
+        - CertProvider
+        - certIssuer
         # golang.org/x/crypto/ssh
         - Signer
         - PublicKey

go.mod

@@ -9,6 +9,7 @@ require (
 	github.com/golang-jwt/jwt/v5 v5.3.1
 	github.com/google/uuid v1.6.0
 	github.com/hashicorp/go-retryablehttp v0.7.8
+	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/hashicorp/vault/api v1.23.0
 	github.com/hashicorp/vault/api/auth/approle v0.12.0
 	github.com/hashicorp/vault/api/auth/aws v0.12.0

go.sum

@@ -122,6 +122,8 @@ github.com/hashicorp/go-sockaddr v1.0.7 h1:G+pTkSO01HpR5qCxg7lxfsFEZaG+C0VssTy/9
 github.com/hashicorp/go-sockaddr v1.0.7/go.mod h1:FZQbEYa1pxkQ7WLpyXJ6cbjpT8q0YgQaK/JakXqGyWw=
 github.com/hashicorp/go-uuid v1.0.2 h1:cfejS+Tpcp13yd5nYHWDI6qVCny6wyX2Mt5SGur2IGE=
 github.com/hashicorp/go-uuid v1.0.2/go.mod h1:6SBZvOh/SIDV7/2o3Jml5SYk/TvGqwFJ/bN7x4byOro=
+github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k=
+github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM=
 github.com/hashicorp/hcl v1.0.1-vault-7 h1:ag5OxFVy3QYTFTJODRzTKVZ6xvdfLLCA1cy/Y6xGI0I=
 github.com/hashicorp/hcl v1.0.1-vault-7/go.mod h1:XYhtn6ijBSAj6n4YqAaf7RBPS4I06AItNorpy+MoQNM=
 github.com/hashicorp/vault/api v1.23.0 h1:gXgluBsSECfRWTSW9niY2jwg2e9mMJc4WoHNv4g3h6A=

internal/config/config.go

@@ -49,6 +49,8 @@ const (
 	defaultMetricsPort                = 9090
 	defaultAuditLogFlushInterval      = time.Minute * 10
 	defaultAuditLogFlushSizeThreshold = 1_000_000 // 1MB in bytes
+	defaultTLSCertDuration            = 24 * time.Hour
+	defaultTLSCertRenewBefore         = 8 * time.Hour
 )
 
 type Config struct {
@@ -87,9 +89,11 @@ type AuditLogConfig struct {
 	FlushSizeThreshold int           `yaml:"flushSizeThreshold"` // bytes
 }
 
-// TLSConfig represents the downstream TLS configuration. Static must be set.
+// TLSConfig represents the downstream TLS configuration. Exactly one of
+// Static or Dynamic must be set.
 type TLSConfig struct {
-	Static *TLSStaticConfig `yaml:"static,omitempty"`
+	Static  *TLSStaticConfig  `yaml:"static,omitempty"`
+	Dynamic *TLSDynamicConfig `yaml:"dynamic,omitempty"`
 }
 
 type TLSStaticConfig struct {
@@ -103,6 +107,31 @@ type CA struct {
 	CertFile string `yaml:"certFile"`
 }
 
+// TLSDynamicConfig configures on-demand issuing of downstream leaf certificates.
+type TLSDynamicConfig struct {
+	CA   TLSDynamicCAConfig   `yaml:"ca"`
+	Cert TLSDynamicCertConfig `yaml:"cert"`
+}
+
+// TLSDynamicCAConfig represents the signing CA configuration. SelfSign must be set.
+type TLSDynamicCAConfig struct {
+	SelfSign *TLSSelfSignCAConfig `yaml:"selfSign,omitempty"`
+}
+
+// TLSSelfSignCAConfig configures a signing CA loaded from certificate and key files.
+type TLSSelfSignCAConfig struct {
+	CertificateFile string `yaml:"certificateFile"`
+	PrivateKeyFile  string `yaml:"privateKeyFile"`
+}
+
+// TLSDynamicCertConfig controls the leaf certificates issued by the dynamic CA.
+type TLSDynamicCertConfig struct {
+	Duration    time.Duration `yaml:"duration"`    // Leaf certificate lifetime. Defaults to 24h.
+	RenewBefore time.Duration `yaml:"renewBefore"` // Window before expiry in which a fresh leaf is issued. Defaults to 8h.
+	KeyType     string        `yaml:"keyType"`     // ecdsa or rsa. Defaults to ecdsa.
+	KeyBits     int           `yaml:"keyBits"`     // ECDSA: 256/384/521, RSA: 2048/3072/4096. Defaults to 256 for ECDSA, 2048 for RSA.
+}
+
 type KubernetesConfig struct {
 	Upstreams []KubernetesUpstream `yaml:"upstreams"`
 }
@@ -353,19 +382,29 @@ func (c *Config) Validate() error {
 }
 
 func (t *TLSConfig) Validate() error {
-	if t.Static == nil {
+	if t.Static == nil && t.Dynamic == nil {
 		return ErrMissingTLSConfig
 	}
 
-	if err := t.Static.Validate(); err != nil {
-		return fmt.Errorf("static: %w", err)
+	if t.Static != nil && t.Dynamic != nil {
+		return ErrConflictingTLSConfig
+	}
+
+	if t.Static != nil {
+		if err := t.Static.Validate(); err != nil {
+			return fmt.Errorf("static: %w", err)
+		}
+	}
+
+	if t.Dynamic != nil {
+		if err := t.Dynamic.Validate(); err != nil {
+			return fmt.Errorf("dynamic: %w", err)
+		}
 	}
 
 	return nil
 }
 
-var ErrMissingTLSConfig = errors.New("'static' must be specified for TLS config")
-
 func (s *TLSStaticConfig) Validate() error {
 	if s.CertificateFile == "" {
 		return fmt.Errorf("%w: certificateFile", ErrRequired)
@@ -378,6 +417,125 @@ func (s *TLSStaticConfig) Validate() error {
 	return nil
 }
 
+var (
+	ErrMissingTLSConfig     = errors.New("either 'static' or 'dynamic' must be specified for TLS config")
+	ErrConflictingTLSConfig = errors.New("only one of 'static' or 'dynamic' can be specified for TLS config")
+	ErrMissingTLSCAConfig   = errors.New("'selfSign' must be specified for dynamic CA config")
+	ErrInvalidTLSKeyType    = errors.New("invalid TLS key type")
+	ErrInvalidTLSKeyBits    = errors.New("invalid TLS key bits")
+	ErrNegativeDuration     = errors.New("duration must be non-negative")
+	ErrRenewBeforeTooLong   = errors.New("'renewBefore' must be shorter than 'duration'")
+)
+
+func (d *TLSDynamicConfig) Validate() error {
+	if err := d.CA.Validate(); err != nil {
+		return fmt.Errorf("ca: %w", err)
+	}
+
+	if err := d.Cert.Validate(); err != nil {
+		return fmt.Errorf("cert: %w", err)
+	}
+
+	return nil
+}
+
+func (c *TLSDynamicCAConfig) Validate() error {
+	if c.SelfSign == nil {
+		return ErrMissingTLSCAConfig
+	}
+
+	if err := c.SelfSign.Validate(); err != nil {
+		return fmt.Errorf("selfSign: %w", err)
+	}
+
+	return nil
+}
+
+func (s *TLSSelfSignCAConfig) Validate() error {
+	if s.CertificateFile == "" {
+		return fmt.Errorf("%w: certificateFile", ErrRequired)
+	}
+
+	if s.PrivateKeyFile == "" {
+		return fmt.Errorf("%w: privateKeyFile", ErrRequired)
+	}
+
+	return nil
+}
+
+func (c *TLSDynamicCertConfig) Validate() error {
+	if c.Duration < 0 {
+		return fmt.Errorf("%w: duration", ErrNegativeDuration)
+	}
+
+	if c.RenewBefore < 0 {
+		return fmt.Errorf("%w: renewBefore", ErrNegativeDuration)
+	}
+
+	if c.GetRenewBefore() >= c.GetDuration() {
+		return ErrRenewBeforeTooLong
+	}
+
+	switch c.GetKeyType() {
+	case "ecdsa":
+		switch c.GetKeyBits() {
+		case 256, 384, 521:
+		default:
+			return fmt.Errorf("%w: ECDSA %d", ErrInvalidTLSKeyBits, c.GetKeyBits())
+		}
+	case "rsa":
+		switch c.GetKeyBits() {
+		case 2048, 3072, 4096:
+		default:
+			return fmt.Errorf("%w: RSA %d", ErrInvalidTLSKeyBits, c.GetKeyBits())
+		}
+	default:
+		return fmt.Errorf("%w: %q", ErrInvalidTLSKeyType, c.KeyType)
+	}
+
+	return nil
+}
+
+// GetDuration returns the leaf certificate lifetime, defaulting to 24h.
+func (c *TLSDynamicCertConfig) GetDuration() time.Duration {
+	if c.Duration == 0 {
+		return defaultTLSCertDuration
+	}
+
+	return c.Duration
+}
+
+// GetRenewBefore returns the re-issue window before expiry, defaulting to 8h.
+func (c *TLSDynamicCertConfig) GetRenewBefore() time.Duration {
+	if c.RenewBefore == 0 {
+		return defaultTLSCertRenewBefore
+	}
+
+	return c.RenewBefore
+}
+
+// GetKeyType returns the leaf key type, defaulting to ecdsa.
+func (c *TLSDynamicCertConfig) GetKeyType() string {
+	if c.KeyType == "" {
+		return "ecdsa"
+	}
+
+	return c.KeyType
+}
+
+// GetKeyBits returns the leaf key size, defaulting to 256 for ECDSA and 2048 for RSA.
+func (c *TLSDynamicCertConfig) GetKeyBits() int {
+	if c.KeyBits == 0 {
+		if c.GetKeyType() == "rsa" {
+			return 2048
+		}
+
+		return 256
+	}
+
+	return c.KeyBits
+}
+
 func (k *KubernetesConfig) Validate() error {
 	upstreamNames := make(map[string]struct{})