core

Documentation

Index

• Constants
• Variables
• type AnnotationValidator
  • func (a *AnnotationValidator) Handle(_ context.Context, req admission.Request) admission.Response
  • func (a *AnnotationValidator) InjectDecoder(d *admission.Decoder) error
• type NodeUpdateWebhook
  • func (a *NodeUpdateWebhook) Handle(_ context.Context, req admission.Request) admission.Response
  • func (a *NodeUpdateWebhook) InjectDecoder(d *admission.Decoder) error
• type PodMutationWebHook
  • func (i *PodMutationWebHook) GetPatchResponse(req admission.Request, pod *corev1.Pod, log logr.Logger) admission.Response
  • func (i *PodMutationWebHook) Handle(_ context.Context, req admission.Request) admission.Response
  • func (i *PodMutationWebHook) HandleFargatePod(req admission.Request, pod *corev1.Pod, log logr.Logger) (response admission.Response)
  • func (i *PodMutationWebHook) HandleLinuxPod(req admission.Request, pod *corev1.Pod, log logr.Logger) (response admission.Response)
  • func (i *PodMutationWebHook) HandleWindowsPod(req admission.Request, pod *corev1.Pod, log logr.Logger) (response admission.Response)
  • func (i *PodMutationWebHook) InitializeEmptyFields(req admission.Request, pod *corev1.Pod)
  • func (i *PodMutationWebHook) InjectDecoder(d *admission.Decoder) error
• type PodType
  • func WhichPod(pod *corev1.Pod) PodType

Constants

const (
	DefaultResourceLimit         = "1"
	FargatePodSGAnnotationKey    = "fargate.amazonaws.com/pod-sg"
	FargatePodIdentifierLabelKey = "eks.amazonaws.com/fargate-profile"
)

Variables

var (
	Fargate        = PodType("Fargate")
	Windows        = PodType("Windows")
	Linux          = PodType("Linux")
	HostNetworking = PodType("HostNetworking")
)

Types

type AnnotationValidator

type AnnotationValidator struct {
	Condition condition.Conditions
	Log       logr.Logger
	// contains filtered or unexported fields
}

AnnotationValidator validates the resource allocated to the Pod via annotations. The WebHook prevents unauthorized user from modifying/removing these Annotations.

func (*AnnotationValidator) Handle

func (a *AnnotationValidator) Handle(_ context.Context, req admission.Request) admission.Response

func (*AnnotationValidator) InjectDecoder

func (a *AnnotationValidator) InjectDecoder(d *admission.Decoder) error

InjectDecoder injects the decoder.

type NodeUpdateWebhook

type NodeUpdateWebhook struct {
	Condition condition.Conditions
	Log       logr.Logger
	// contains filtered or unexported fields
}

func (*NodeUpdateWebhook) Handle

func (a *NodeUpdateWebhook) Handle(_ context.Context, req admission.Request) admission.Response

Handle allows update request on Node on the expected fields when the request is coming from the aws-node Service Account. It also ensures the updates are allowed only when the Security Group for Pod feature is enabled.

func (*NodeUpdateWebhook) InjectDecoder

func (a *NodeUpdateWebhook) InjectDecoder(d *admission.Decoder) error

InjectDecoder injects the decoder.

type PodMutationWebHook

type PodMutationWebHook struct {
	SGPAPI    utils.SecurityGroupForPodsAPI
	Log       logr.Logger
	Condition condition.Conditions
	// contains filtered or unexported fields
}

PodResourceInjector injects resources into Pods

func (*PodMutationWebHook) GetPatchResponse

func (i *PodMutationWebHook) GetPatchResponse(req admission.Request, pod *corev1.Pod, log logr.Logger) admission.Response

Returns the Response by patching the updated object with raw object from request

func (*PodMutationWebHook) Handle

func (i *PodMutationWebHook) Handle(_ context.Context, req admission.Request) admission.Response

func (*PodMutationWebHook) HandleFargatePod

func (i *PodMutationWebHook) HandleFargatePod(req admission.Request, pod *corev1.Pod,
	log logr.Logger) (response admission.Response)

HandleFargatePod mutates the Fargate Pod if the Pod Matches a SGP. This also acts like a validation WebHook by removing any existing Annotation on the Pod on Create Event.

func (*PodMutationWebHook) HandleLinuxPod

func (i *PodMutationWebHook) HandleLinuxPod(req admission.Request, pod *corev1.Pod,
	log logr.Logger) (response admission.Response)

HandleLinuxPod mutates the Linux Pod by injecting pod-eni limit if the Linux Pod matches any SGP

func (*PodMutationWebHook) HandleWindowsPod

func (i *PodMutationWebHook) HandleWindowsPod(req admission.Request, pod *corev1.Pod,
	log logr.Logger) (response admission.Response)

HandleWindowsPod mutates the Windows Pod by injecting a secondary IPv4 Address Limit to the Pod when the Windows IPAM feature is enabled via ConfigMap

func (*PodMutationWebHook) InitializeEmptyFields

func (i *PodMutationWebHook) InitializeEmptyFields(req admission.Request, pod *corev1.Pod)

InitializeEmptyFields inits the empty fields in the request

func (*PodMutationWebHook) InjectDecoder

func (i *PodMutationWebHook) InjectDecoder(d *admission.Decoder) error

InjectDecoder injects the decoder.

type PodType

type PodType string

func WhichPod

func WhichPod(pod *corev1.Pod) PodType

WhichPod returns the PodType, each PodType will be handled differently