awsiamauth

Documentation

Index

• Constants
• func CASecretName(clusterName string) string
• func KubeconfigSecretName(clusterName string) string
• type Client
• type HookRegistrar
  • func NewHookRegistrar(installer *Installer, spec *cluster.Spec) HookRegistrar
  • func (r HookRegistrar) RegisterCreateManagementClusterHooks(binder workflow.HookBinder)
• type Installer
  • func NewInstaller(certgen crypto.CertificateGenerator, clusterID uuid.UUID, k8s KubernetesClient, ...) *Installer
  • func (i *Installer) CreateAndInstallAWSIAMAuthCASecret(ctx context.Context, managementCluster *types.Cluster, clusterName string) error
  • func (i *Installer) InstallAWSIAMAuth(ctx context.Context, management, workload *types.Cluster, spec *cluster.Spec) error
  • func (i *Installer) UpgradeAWSIAMAuth(ctx context.Context, cluster *types.Cluster, spec *cluster.Spec) error
• type KubernetesClient
• type RetrierClient
  • func NewRetrierClient(client Client, opts ...RetrierClientOpt) RetrierClient
  • func (c RetrierClient) Apply(ctx context.Context, cluster *types.Cluster, data []byte) error
  • func (c RetrierClient) GetAPIServerURL(ctx context.Context, cluster *types.Cluster) (string, error)
  • func (c RetrierClient) GetClusterCACert(ctx context.Context, cluster *types.Cluster, clusterName string) ([]byte, error)
• type RetrierClientOpt
  • func RetrierClientRetrier(retrier retrier.Retrier) RetrierClientOpt
• type TemplateBuilder
  • func (t *TemplateBuilder) GenerateCertKeyPairSecret(certgen crypto.CertificateGenerator, managementClusterName string) ([]byte, error)
  • func (t *TemplateBuilder) GenerateKubeconfig(clusterSpec *cluster.Spec, clusterID uuid.UUID, serverURL, tlsCert string) ([]byte, error)
  • func (t *TemplateBuilder) GenerateManifest(clusterSpec *cluster.Spec, clusterID uuid.UUID) ([]byte, error)

Constants

const (

	// AwsIamAuthConfigMapName is the name of AWS IAM Authenticator configuration.
	AwsIamAuthConfigMapName = "aws-iam-authenticator"

	// AwsAuthConfigMapName is the name of IAM roles and users mapping for AWS IAM Authenticator.
	AwsAuthConfigMapName = "aws-auth"
)

Functions

func CASecretName

func CASecretName(clusterName string) string

CASecretName returns the name of AWS IAM Authenticator secret containing the CA for the cluster.

func KubeconfigSecretName

func KubeconfigSecretName(clusterName string) string

KubeconfigSecretName returns the name of the AWS IAM Authenticator kubeconfig secret for the cluster.

Types

type Client

type Client interface {
	ApplyKubeSpecFromBytes(ctx context.Context, cluster *types.Cluster, data []byte) error
	GetApiServerUrl(ctx context.Context, cluster *types.Cluster) (string, error)
	GetObject(ctx context.Context, resourceType string, name string, namespace string, kubeconfig string, obj runtime.Object) error
}

Client is a Kubernetes client.

type HookRegistrar

type HookRegistrar struct {
	*Installer
	// contains filtered or unexported fields
}

HookRegistrar is responsible for binding AWS IAM Auth hooks to workflows so it can be installed.

func NewHookRegistrar

func NewHookRegistrar(installer *Installer, spec *cluster.Spec) HookRegistrar

NewHookRegistrar creates a HookRegistrar instance.

func (HookRegistrar) RegisterCreateManagementClusterHooks

func (r HookRegistrar) RegisterCreateManagementClusterHooks(binder workflow.HookBinder)

type Installer

type Installer struct {
	// contains filtered or unexported fields
}

Installer provides the necessary behavior for installing the AWS IAM Authenticator.

func NewInstaller

func NewInstaller(
	certgen crypto.CertificateGenerator,
	clusterID uuid.UUID,
	k8s KubernetesClient,
	writer filewriter.FileWriter,
) *Installer

NewInstaller creates a new installer instance.

func (*Installer) CreateAndInstallAWSIAMAuthCASecret

func (i *Installer) CreateAndInstallAWSIAMAuthCASecret(ctx context.Context, managementCluster *types.Cluster, clusterName string) error

CreateAndInstallAWSIAMAuthCASecret creates a Kubernetes Secret in cluster containing a self-signed certificate and key for a cluster identified by clusterName.

func (*Installer) InstallAWSIAMAuth

func (i *Installer) InstallAWSIAMAuth(
	ctx context.Context,
	management, workload *types.Cluster,
	spec *cluster.Spec,
) error

InstallAWSIAMAuth installs AWS IAM Authenticator deployment manifests into the workload cluster. It writes a Kubeconfig to disk for kubectl access using AWS IAM Authentication.

func (*Installer) UpgradeAWSIAMAuth

func (i *Installer) UpgradeAWSIAMAuth(ctx context.Context, cluster *types.Cluster, spec *cluster.Spec) error

UpgradeAWSIAMAuth upgrades an AWS IAM Authenticator deployment in cluster.

type KubernetesClient

type KubernetesClient interface {
	Apply(ctx context.Context, cluster *types.Cluster, data []byte) error
	GetAPIServerURL(ctx context.Context, cluster *types.Cluster) (string, error)
	GetClusterCACert(ctx context.Context, cluster *types.Cluster, clusterName string) ([]byte, error)
}

KubernetesClient provides Kubernetes API access.

type RetrierClient

type RetrierClient struct {
	// contains filtered or unexported fields
}

RetrierClient wraps basic kubernetes API operations around a retrier.

func NewRetrierClient

func NewRetrierClient(client Client, opts ...RetrierClientOpt) RetrierClient

NewRetrierClient constructs a new RetrierClient.

func (RetrierClient) Apply

func (c RetrierClient) Apply(ctx context.Context, cluster *types.Cluster, data []byte) error

Apply creates/updates the data objects for a cluster.

func (RetrierClient) GetAPIServerURL

func (c RetrierClient) GetAPIServerURL(ctx context.Context, cluster *types.Cluster) (string, error)

GetAPIServerURL gets the api server url from K8s config.

func (RetrierClient) GetClusterCACert

func (c RetrierClient) GetClusterCACert(ctx context.Context, cluster *types.Cluster, clusterName string) ([]byte, error)

GetClusterCACert gets the ca cert for a cluster from a secret.

type RetrierClientOpt

type RetrierClientOpt func(*RetrierClient)

RetrierClientOpt allows to customize a RetrierClient on construction.

func RetrierClientRetrier

func RetrierClientRetrier(retrier retrier.Retrier) RetrierClientOpt

RetrierClientRetrier allows to use a custom retrier.

type TemplateBuilder

type TemplateBuilder struct{}

TemplateBuilder generates manifest files from templates.

func (*TemplateBuilder) GenerateCertKeyPairSecret

func (t *TemplateBuilder) GenerateCertKeyPairSecret(certgen crypto.CertificateGenerator, managementClusterName string) ([]byte, error)

GenerateCertKeyPairSecret generates a YAML Kubernetes Secret for deploying the AWS IAM Authenticator.

func (*TemplateBuilder) GenerateKubeconfig

func (t *TemplateBuilder) GenerateKubeconfig(clusterSpec *cluster.Spec, clusterID uuid.UUID, serverURL, tlsCert string) ([]byte, error)

GenerateKubeconfig generates a Kubeconfig in yaml format to authenticate with AWS IAM Authenticator.

func (*TemplateBuilder) GenerateManifest

func (t *TemplateBuilder) GenerateManifest(clusterSpec *cluster.Spec, clusterID uuid.UUID) ([]byte, error)

GenerateManifest generates a YAML Kubernetes manifest for deploying the AWS IAM Authenticator.