[mint] support `CertificateNotifyOnReload`

and clean up deprecated identity driver interface

diff --git a/mint/client.go b/mint/client.go
index 7508e46fbde4dd4ab11c6107bbd81d02023b4372..5b6938df7287f2717d66b7bd23fd893fc723f5fd 100644 (file)
--- a/mint/client.go
+++ b/mint/client.go
@@ -33,8 +33,11 @@ type MintCertificate struct {
        leaf    *x509.Certificate
        chain   []*x509.Certificate
        root    *x509.Certificate
+       subs    map[mtls.SubscriptionHandle]mtls.ReloadNotifyFunc
 }
 
+var _ mtls.CertificateProvider = &MintCertificate{}
+
 type clientImpl struct {
        log            log.Logger
        defaultCtx     context.Context
@@ -300,6 +303,7 @@ func (m *MintCertificate) renew() error {
        m.chain = newCert.chain
        m.private = newCert.private
        m.scheduleRenew()
+       m.notifyWatchers()
 
        return nil
 }

diff --git a/mint/mtls_driver.go b/mint/mtls_driver.go
index d47a8092f38994e9f8520198d9c821e6dc607adb..f0f0c360a7f3a99075f74e84c7d83dbddfead058 100644 (file)
--- a/mint/mtls_driver.go
+++ b/mint/mtls_driver.go
@@ -4,15 +4,59 @@ import (
        "errors"
        "sync/atomic"
 
+       "gopkg.in/yaml.v3"
+
        "go.fuhry.dev/runtime/mtls"
        "go.fuhry.dev/runtime/utils/log"
-       "gopkg.in/yaml.v3"
 )
 
 type mintIdentityProviderFactory struct{}
 
 var depth atomic.Int32
 
+func (c *MintCertificate) Subscribe(f mtls.ReloadNotifyFunc) mtls.SubscriptionHandle {
+       c.mu.Lock()
+       defer c.mu.Unlock()
+
+       if c.subs == nil {
+               c.subs = make(map[mtls.SubscriptionHandle]mtls.ReloadNotifyFunc)
+       }
+
+       h := mtls.NewSubscriptionHandle()
+       c.subs[h] = f
+       return h
+}
+
+func (c *MintCertificate) Unsubscribe(h mtls.SubscriptionHandle) {
+       c.mu.Lock()
+       defer c.mu.Unlock()
+
+       if c.subs == nil {
+               return
+       }
+
+       delete(c.subs, h)
+}
+
+func (c *MintCertificate) notifyWatchers() {
+       // copy the notify handlers
+       c.mu.Lock()
+       if c.subs == nil {
+               c.mu.Unlock()
+               return
+       }
+
+       var watchers []mtls.ReloadNotifyFunc
+       for _, f := range c.subs {
+               watchers = append(watchers, f)
+       }
+       c.mu.Unlock()
+
+       for _, f := range watchers {
+               f(c.leaf, c.private, c.chain, c.root)
+       }
+}
+
 func tryGetMintIdentity(cls mtls.PrincipalClass, name string) (mtls.CertificateProvider, error) {
        if cls != mtls.ServicePrincipal {
                return nil, mtls.ErrUnsupportedClass
@@ -43,6 +87,5 @@ func (f *mintIdentityProviderFactory) New(node *yaml.Node) (mtls.IdentityLoaderF
 }
 
 func init() {
-       mtls.RegisterIdentityDriver("mint", tryGetMintIdentity)
        mtls.RegisterProviderFactory("mint", &mintIdentityProviderFactory{})
 }