Project · Go · MIT
keyload active
Go library that reloads TLS certificates, keys and CA bundles at runtime, and keeps the last good material when a reload is bad.
go get github.com/rossedman/keyloadkeyload reloads your TLS certificate, key and CA bundles from disk while a Go server or client keeps running. When cert-manager rotates a Secret, the next handshake uses the new files. No restart and no reloader sidecar.
- Both directions. Your certificate and key, and the CA bundles used to verify servers and clients, so mTLS follows a rotation on both sides.
- Never applies bad material. An expired certificate, a mismatched key or a half-written file is rejected, and the last good one keeps serving.
- Kubernetes Secret volumes work out of the box, including the
..datasymlink swap. - CA rotation without an outage, with an overlap window that keeps removed CAs trusted for a while.
- Prometheus metrics and reload events, standard library only, with a separate
grpccredsmodule for grpc-go.
The docs site has an interactive simulator for pushing good and bad files at a reloader.