From: Dan Fuhry <dan@fuhry.com>
Date: Tue, 13 Oct 2026 13:33:00 +0000 (-0400)
Subject: [mint] support `CertificateNotifyOnReload`
X-Git-Url: https://go.fuhry.dev/?a=commitdiff_plain;h=400ae47744b66678e090b6b735294d1f432ea6df;p=runtime.git

[mint] support `CertificateNotifyOnReload`

and clean up deprecated identity driver interface
---

diff --git a/mint/client.go b/mint/client.go
index 7508e46..5b6938d 100644
--- a/mint/client.go
+++ b/mint/client.go
@@ -33,8 +33,11 @@ type MintCertificate struct {
 	leaf    *x509.Certificate
 	chain   []*x509.Certificate
 	root    *x509.Certificate
+	subs    map[mtls.SubscriptionHandle]mtls.ReloadNotifyFunc
 }
 
+var _ mtls.CertificateProvider = &MintCertificate{}
+
 type clientImpl struct {
 	log            log.Logger
 	defaultCtx     context.Context
@@ -300,6 +303,7 @@ func (m *MintCertificate) renew() error {
 	m.chain = newCert.chain
 	m.private = newCert.private
 	m.scheduleRenew()
+	m.notifyWatchers()
 
 	return nil
 }
diff --git a/mint/mtls_driver.go b/mint/mtls_driver.go
index d47a809..f0f0c36 100644
--- a/mint/mtls_driver.go
+++ b/mint/mtls_driver.go
@@ -4,15 +4,59 @@ import (
 	"errors"
 	"sync/atomic"
 
+	"gopkg.in/yaml.v3"
+
 	"go.fuhry.dev/runtime/mtls"
 	"go.fuhry.dev/runtime/utils/log"
-	"gopkg.in/yaml.v3"
 )
 
 type mintIdentityProviderFactory struct{}
 
 var depth atomic.Int32
 
+func (c *MintCertificate) Subscribe(f mtls.ReloadNotifyFunc) mtls.SubscriptionHandle {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.subs == nil {
+		c.subs = make(map[mtls.SubscriptionHandle]mtls.ReloadNotifyFunc)
+	}
+
+	h := mtls.NewSubscriptionHandle()
+	c.subs[h] = f
+	return h
+}
+
+func (c *MintCertificate) Unsubscribe(h mtls.SubscriptionHandle) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+
+	if c.subs == nil {
+		return
+	}
+
+	delete(c.subs, h)
+}
+
+func (c *MintCertificate) notifyWatchers() {
+	// copy the notify handlers
+	c.mu.Lock()
+	if c.subs == nil {
+		c.mu.Unlock()
+		return
+	}
+
+	var watchers []mtls.ReloadNotifyFunc
+	for _, f := range c.subs {
+		watchers = append(watchers, f)
+	}
+	c.mu.Unlock()
+
+	for _, f := range watchers {
+		f(c.leaf, c.private, c.chain, c.root)
+	}
+}
+
 func tryGetMintIdentity(cls mtls.PrincipalClass, name string) (mtls.CertificateProvider, error) {
 	if cls != mtls.ServicePrincipal {
 		return nil, mtls.ErrUnsupportedClass
@@ -43,6 +87,5 @@ func (f *mintIdentityProviderFactory) New(node *yaml.Node) (mtls.IdentityLoaderF
 }
 
 func init() {
-	mtls.RegisterIdentityDriver("mint", tryGetMintIdentity)
 	mtls.RegisterProviderFactory("mint", &mintIdentityProviderFactory{})
 }