class FileWatcherCertificateProvider

Defined at line 110 of file ../../third_party/grpc/src/include/grpcpp/security/tls_certificate_provider.h

A CertificateProviderInterface implementation that will watch the credential

changes on the file system. This provider will always return the up-to-date

cert data for all the cert names callers set through |TlsCredentialsOptions|.

Several things to note:

1. This API only supports one key-cert file and hence one set of identity

key-cert pair, so SNI(Server Name Indication) is not supported.

2. The private key and identity certificate should always match. This API

guarantees atomic read, and it is the callers' responsibility to do atomic

updates. There are many ways to atomically update the key and certs in the

file system. To name a few:

1) creating a new directory, renaming the old directory to a new name, and

then renaming the new directory to the original name of the old directory.

2) using a symlink for the directory. When need to change, put new

credential data in a new directory, and change symlink.

Public Methods

void FileWatcherCertificateProvider (const std::string & private_key_path, const std::string & identity_certificate_path, const std::string & root_cert_path, const std::string & spiffe_bundle_map_path, unsigned int refresh_interval_sec)

Constructor to get credential updates from root and identity file paths.

Parameters

private_key_path is the file path of the private key.

identity_certificate_path is the file path of the identitycertificate chain.

root_cert_path is the file path to the root certificate bundle.

refresh_interval_sec is the refreshing interval that we will checkthe files for updates.

void FileWatcherCertificateProvider (const std::string & private_key_path, const std::string & identity_certificate_path, unsigned int refresh_interval_sec)

Constructor to get credential updates from identity file paths only.

Defined at line 127 of file ../../third_party/grpc/src/include/grpcpp/security/tls_certificate_provider.h

void FileWatcherCertificateProvider (const std::string & root_cert_path, unsigned int refresh_interval_sec)

Constructor to get credential updates from root file path only.

Defined at line 134 of file ../../third_party/grpc/src/include/grpcpp/security/tls_certificate_provider.h

void FileWatcherCertificateProvider (const std::string & private_key_path, const std::string & identity_certificate_path, const std::string & root_cert_path, unsigned int refresh_interval_sec)

Defined at line 138 of file ../../third_party/grpc/src/include/grpcpp/security/tls_certificate_provider.h

void ~FileWatcherCertificateProvider ()

absl::Status ValidateCredentials ()

Returns an OK status if the following conditions hold:

- the currently-loaded root certificates, if any, consist of one or more

valid PEM blocks, and

- every currently-loaded identity key-cert pair, if any, has a certificate

chain that consists of valid PEM blocks and has a private key that is

either a valid PEM block or a non-null PrivateKeySigner instance.

grpc_tls_certificate_provider * c_provider ()

Defined at line 148 of file ../../third_party/grpc/src/include/grpcpp/security/tls_certificate_provider.h