// Copyright 2017 Istio Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";
import "google/rpc/status.proto";

package istio.v1.auth;

import "gogoproto/gogo.proto";

option go_package="istio_v1_auth";
option (gogoproto.goproto_getters_all) = false;
option (gogoproto.equal_all) = false;
option (gogoproto.gostring_all) = false;

// Service definition of IstioCAService that can dynamically verify the CSR for
// service identities for Istio services running on various platforms and
// approve or disapprove the request after verifying the Node Agent credentials
// provided as a part of the Request.
service IstioCAService {

  // A request object includes a PEM-encoded certificate signing request that
  // is generated on the Node Agent. Additionaly credential can be attached
  // within the request object for a server to authenticate the originating
  // node agent.
  rpc HandleCSR(Request) returns (Response);
}

message Request {
  // PEM-encoded certificate signing request
  bytes csr_pem = 1;
  // opaque credential for node agent
  bytes node_agent_credential = 2;
  // type of the node_agent_credential (aws/gcp/onprem/custom...)
  string credential_type = 3;
}

message Response {
  bool is_approved = 1;
  google.rpc.Status status = 2;
  bytes signed_cert_chain = 3;
}
