root

Documentation

Index

• Variables
• func BuildAuthn(client authenticationclient.TokenReviewInterface, authn opts.Authentication, ...) (authenticator.Request, func(<-chan struct{}), error)
• func BuildAuthz(client authorizationclient.SubjectAccessReviewInterface, ...) (authorizer.Authorizer, error)
• func NewCommand(name string, s *provider.Store, o *opts.Opts) *cobra.Command
• func NewNodeAuthorizerAttributesGetter(nodeName types.NodeName) authorizer.RequestAttributesGetter
• func NodeFromProvider(ctx context.Context, name string, taint *v1.Taint, p provider.Provider, ...) *v1.Node
• type AuthInterface
  • func BuildAuth(nodeName types.NodeName, client clientset.Interface, config opts.Opts) (AuthInterface, func(<-chan struct{}), error)
  • func NewVirtualKubeletAuth(authenticator authenticator.Request, ...) AuthInterface
• type ServeMuxWithAuth
  • func NewServeMuxWithAuth(ctx context.Context, auth AuthInterface) *ServeMuxWithAuth
  • func (s *ServeMuxWithAuth) Handle(path string, h http.Handler)
  • func (s *ServeMuxWithAuth) ServeHTTP(w http.ResponseWriter, r *http.Request)
• type VirtualKubeletAuth

Variables

var AcceptedCiphers = []uint16{
	tls.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
	tls.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
	tls.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
	tls.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,

	tls.TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
	tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
	tls.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
	tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
}

AcceptedCiphers is the list of accepted TLS ciphers, with known weak ciphers elided Note this list should be a moving target.

Functions

func BuildAuthn

func BuildAuthn(client authenticationclient.TokenReviewInterface, authn opts.Authentication, clientCACert string) (authenticator.Request, func(<-chan struct{}), error)

BuildAuthn creates an authenticator compatible with the virtual-kubelet's needs

func BuildAuthz

func BuildAuthz(client authorizationclient.SubjectAccessReviewInterface, authz opts.Authorization) (authorizer.Authorizer, error)

BuildAuthz creates an authorizer compatible with the virtual-kubelet's needs

func NewCommand

func NewCommand(name string, s *provider.Store, o *opts.Opts) *cobra.Command

NewCommand creates a new top-level command. This command is used to start the virtual-kubelet daemon

func NewNodeAuthorizerAttributesGetter

func NewNodeAuthorizerAttributesGetter(nodeName types.NodeName) authorizer.RequestAttributesGetter

NewNodeAuthorizerAttributesGetter creates a new authorizer.RequestAttributesGetter for the node.

func NodeFromProvider

func NodeFromProvider(ctx context.Context, name string, taint *v1.Taint, p provider.Provider, version string) *v1.Node

NodeFromProvider builds a kubernetes node object from a provider This is a temporary solution until node stuff actually split off from the provider interface itself.

Types

type AuthInterface

type AuthInterface interface {
	authenticator.Request
	authorizer.RequestAttributesGetter
	authorizer.Authorizer
}

AuthInterface contains all methods required by the auth filters

func BuildAuth

func BuildAuth(nodeName types.NodeName, client clientset.Interface, config opts.Opts) (AuthInterface, func(<-chan struct{}), error)

BuildAuth creates an authenticator, an authorizer, and a matching authorizer attributes getter compatible with the virtual-kubelet's needs

func NewVirtualKubeletAuth

func NewVirtualKubeletAuth(authenticator authenticator.Request, authorizerAttributeGetter authorizer.RequestAttributesGetter, authorizer authorizer.Authorizer) AuthInterface

NewVirtualKubeletAuth returns a AuthInterface composed of the given authenticator, attribute getter, and authorizer

type ServeMuxWithAuth

type ServeMuxWithAuth struct {
	// contains filtered or unexported fields
}

ServeMuxWithAuth implements api.ServerMux

func NewServeMuxWithAuth

func NewServeMuxWithAuth(ctx context.Context, auth AuthInterface) *ServeMuxWithAuth

NewServeMuxWithAuth initiate an instance for ServeMuxWithAuth

func (*ServeMuxWithAuth) Handle

func (s *ServeMuxWithAuth) Handle(path string, h http.Handler)

Handle enables auth filter for mux Handle

func (*ServeMuxWithAuth) ServeHTTP

func (s *ServeMuxWithAuth) ServeHTTP(w http.ResponseWriter, r *http.Request)

type VirtualKubeletAuth

type VirtualKubeletAuth struct {
	// authenticator identifies the user for requests to the Kubelet API
	authenticator.Request
	// authorizerAttributeGetter builds authorization.Attributes for a request to the Kubelet API
	authorizer.RequestAttributesGetter
	// authorizer determines whether a given authorization.Attributes is allowed
	authorizer.Authorizer
}

VirtualKubeletAuth implements AuthInterface