Integrate builder and validator

cmd/spire-server/cli/federation/common_test.go

@@ -246,7 +246,7 @@ func createBundle(t *testing.T, trustDomain string) (*types.Bundle, string) {
 	return &types.Bundle{
 		TrustDomain: td.String(),
 		X509Authorities: []*types.X509Certificate{
-			{Asn1: ca.X509CA().Certificate.Raw},
+			{Asn1: ca.Bundle()[0].Raw},
 		},
 	}, bundlePath
 }

cmd/spire-server/cli/run/run.go

@@ -35,6 +35,7 @@ import (
 	"github.com/spiffe/spire/pkg/server/authpolicy"
 	bundleClient "github.com/spiffe/spire/pkg/server/bundle/client"
 	"github.com/spiffe/spire/pkg/server/ca"
+	"github.com/spiffe/spire/pkg/server/credtemplate"
 	"github.com/spiffe/spire/pkg/server/endpoints/bundle"
 	"github.com/spiffe/spire/pkg/server/plugin/keymanager"
 )
@@ -47,11 +48,6 @@ const (
 )
 
 var (
-	defaultCASubject = pkix.Name{
-		Country:      []string{"US"},
-		Organization: []string{"SPIFFE"},
-	}
-
 	defaultRateLimit = true
 )
 
@@ -479,7 +475,7 @@ func NewServerConfig(c *Config, logOptions []log.Option, allowUnknownConfig bool
 	default:
 		// If neither new nor deprecated config value is set, then use hard-coded default TTL
 		// Note, due to back-compat issues we cannot set this default inside defaultConfig() function
-		sc.X509SVIDTTL = ca.DefaultX509SVIDTTL
+		sc.X509SVIDTTL = credtemplate.DefaultX509SVIDTTL
 	}
 
 	if c.Server.DefaultJWTSVIDTTL != "" {
@@ -491,7 +487,7 @@ func NewServerConfig(c *Config, logOptions []log.Option, allowUnknownConfig bool
 	} else {
 		// If not set using new field then use hard-coded default TTL
 		// Note, due to back-compat issues we cannot set this default inside defaultConfig() function
-		sc.JWTSVIDTTL = ca.DefaultJWTSVIDTTL
+		sc.JWTSVIDTTL = credtemplate.DefaultJWTSVIDTTL
 	}
 
 	if c.Server.CATTL != "" {
@@ -591,7 +587,7 @@ func NewServerConfig(c *Config, logOptions []log.Option, allowUnknownConfig bool
 	}
 	// RFC3280(4.1.2.4) requires the issuer DN be set.
 	if isPKIXNameEmpty(sc.CASubject) {
-		sc.CASubject = defaultCASubject
+		sc.CASubject = credtemplate.DefaultX509CASubject()
 	}
 
 	sc.PluginConfigs, err = catalog.PluginConfigsFromHCLNode(c.Plugins)
@@ -824,7 +820,7 @@ func defaultConfig() *Config {
 		Server: &serverConfig{
 			BindAddress:  "0.0.0.0",
 			BindPort:     8081,
-			CATTL:        ca.DefaultCATTL.String(),
+			CATTL:        credtemplate.DefaultX509CATTL.String(),
 			LogLevel:     defaultLogLevel,
 			LogFormat:    log.DefaultFormat,
 			Experimental: experimentalConfig{},

cmd/spire-server/cli/run/run_test.go

@@ -18,7 +18,7 @@ import (
 	"github.com/spiffe/spire/pkg/common/log"
 	"github.com/spiffe/spire/pkg/server"
 	bundleClient "github.com/spiffe/spire/pkg/server/bundle/client"
-	"github.com/spiffe/spire/pkg/server/ca"
+	"github.com/spiffe/spire/pkg/server/credtemplate"
 	"github.com/spiffe/spire/pkg/server/plugin/keymanager"
 	"github.com/spiffe/spire/test/spiretest"
 	"github.com/stretchr/testify/assert"
@@ -806,7 +806,7 @@ func TestNewServerConfig(t *testing.T) {
 				c.Server.CASubject = nil
 			},
 			test: func(t *testing.T, c *server.Config) {
-				require.Equal(t, defaultCASubject, c.CASubject)
+				require.Equal(t, credtemplate.DefaultX509CASubject(), c.CASubject)
 			},
 		},
 		{
@@ -815,7 +815,7 @@ func TestNewServerConfig(t *testing.T) {
 				c.Server.CASubject = &caSubjectConfig{}
 			},
 			test: func(t *testing.T, c *server.Config) {
-				require.Equal(t, defaultCASubject, c.CASubject)
+				require.Equal(t, credtemplate.DefaultX509CASubject(), c.CASubject)
 			},
 		},
 		{
@@ -1526,13 +1526,13 @@ func TestHasCompatibleTTLs(t *testing.T) {
 	for _, testCase := range cases {
 		testCase := testCase
 		if testCase.caTTL == 0 {
-			testCase.caTTL = ca.DefaultCATTL
+			testCase.caTTL = credtemplate.DefaultX509CATTL
 		}
 		if testCase.x509SvidTTL == 0 {
-			testCase.x509SvidTTL = ca.DefaultX509SVIDTTL
+			testCase.x509SvidTTL = credtemplate.DefaultX509SVIDTTL
 		}
 		if testCase.jwtSvidTTL == 0 {
-			testCase.jwtSvidTTL = ca.DefaultJWTSVIDTTL
+			testCase.jwtSvidTTL = credtemplate.DefaultJWTSVIDTTL
 		}
 
 		t.Run(testCase.msg, func(t *testing.T) {
@@ -1573,7 +1573,7 @@ func TestMaxSVIDTTL(t *testing.T) {
 		},
 	} {
 		if v.caTTL == 0 {
-			v.caTTL = ca.DefaultCATTL
+			v.caTTL = credtemplate.DefaultX509CATTL
 		}
 
 		assert.Equal(t, v.expect, printMaxSVIDTTL(v.caTTL))
@@ -1649,10 +1649,10 @@ func TestMinCATTL(t *testing.T) {
 		},
 	} {
 		if v.x509SVIDTTL == 0 {
-			v.x509SVIDTTL = ca.DefaultX509SVIDTTL
+			v.x509SVIDTTL = credtemplate.DefaultX509SVIDTTL
 		}
 		if v.jwtSVIDTTL == 0 {
-			v.jwtSVIDTTL = ca.DefaultJWTSVIDTTL
+			v.jwtSVIDTTL = credtemplate.DefaultJWTSVIDTTL
 		}
 
 		// The expected value is the MinCATTL calculated from the largest of the available TTLs