apiserver

package
v4.3.1-rc.1+incompatible Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 18, 2020 License: Apache-2.0 Imports: 22 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// ErrMessageCPURequest provides a standard error message when a CPURequest
	// is not specified to the Kubernetes sstandard
	ErrMessageCPURequest = `could not parse CPU request "%s":%s (hint: try a value like "1" or "100m")`
	// ErrMessageMemoryRequest provides a standard error message when a MemoryRequest
	// is not specified to the Kubernetes sstandard
	ErrMessageMemoryRequest = `could not parse memory request "%s":%s (hint: try a value like "1Gi")`
	// ErrMessagePVCSize provides a standard error message when a PVCSize is not
	// specified to the Kubernetes stnadard
	ErrMessagePVCSize = `could not parse PVC size "%s": %s (hint: try a value like "1Gi")`
	// ErrMessageReplicas provides a standard error message when the count of
	// replicas is incorrect
	ErrMessageReplicas = `must have at least %d replica(s)`
)
View Source 
const (
	// MISC
	APPLY_POLICY_PERM = "ApplyPolicy"
	CAT_PERM          = "Cat"
	CLONE_PERM        = "Clone"
	DF_CLUSTER_PERM   = "DfCluster"
	LABEL_PERM        = "Label"
	LOAD_PERM         = "Load"
	RELOAD_PERM       = "Reload"
	RESTART_PERM      = "Restart"
	RESTORE_PERM      = "Restore"
	STATUS_PERM       = "Status"
	TEST_CLUSTER_PERM = "TestCluster"
	VERSION_PERM      = "Version"

	// CREATE
	CREATE_BACKUP_PERM    = "CreateBackup"
	CREATE_CLUSTER_PERM   = "CreateCluster"
	CREATE_DUMP_PERM      = "CreateDump"
	CREATE_FAILOVER_PERM  = "CreateFailover"
	CREATE_INGEST_PERM    = "CreateIngest"
	CREATE_NAMESPACE_PERM = "CreateNamespace"
	CREATE_PGADMIN_PERM   = "CreatePgAdmin"
	CREATE_PGBOUNCER_PERM = "CreatePgbouncer"
	CREATE_PGOUSER_PERM   = "CreatePgouser"
	CREATE_PGOROLE_PERM   = "CreatePgorole"
	CREATE_POLICY_PERM    = "CreatePolicy"
	CREATE_SCHEDULE_PERM  = "CreateSchedule"
	CREATE_UPGRADE_PERM   = "CreateUpgrade"
	CREATE_USER_PERM      = "CreateUser"

	// RESTORE
	RESTORE_DUMP_PERM = "RestoreDump"

	// DELETE
	DELETE_BACKUP_PERM    = "DeleteBackup"
	DELETE_CLUSTER_PERM   = "DeleteCluster"
	DELETE_INGEST_PERM    = "DeleteIngest"
	DELETE_NAMESPACE_PERM = "DeleteNamespace"
	DELETE_PGADMIN_PERM   = "DeletePgAdmin"
	DELETE_PGBOUNCER_PERM = "DeletePgbouncer"
	DELETE_PGOROLE_PERM   = "DeletePgorole"
	DELETE_PGOUSER_PERM   = "DeletePgouser"
	DELETE_POLICY_PERM    = "DeletePolicy"
	DELETE_SCHEDULE_PERM  = "DeleteSchedule"
	DELETE_USER_PERM      = "DeleteUser"

	// SHOW
	SHOW_BACKUP_PERM          = "ShowBackup"
	SHOW_CLUSTER_PERM         = "ShowCluster"
	SHOW_CONFIG_PERM          = "ShowConfig"
	SHOW_INGEST_PERM          = "ShowIngest"
	SHOW_NAMESPACE_PERM       = "ShowNamespace"
	SHOW_PGADMIN_PERM         = "ShowPgAdmin"
	SHOW_PGBOUNCER_PERM       = "ShowPgBouncer"
	SHOW_PGOROLE_PERM         = "ShowPgorole"
	SHOW_PGOUSER_PERM         = "ShowPgouser"
	SHOW_POLICY_PERM          = "ShowPolicy"
	SHOW_PVC_PERM             = "ShowPVC"
	SHOW_SCHEDULE_PERM        = "ShowSchedule"
	SHOW_SECRETS_PERM         = "ShowSecrets"
	SHOW_SYSTEM_ACCOUNTS_PERM = "ShowSystemAccounts"
	SHOW_USER_PERM            = "ShowUser"
	SHOW_WORKFLOW_PERM        = "ShowWorkflow"

	// SCALE
	SCALE_CLUSTER_PERM = "ScaleCluster"

	// UPDATE
	UPDATE_CLUSTER_PERM   = "UpdateCluster"
	UPDATE_NAMESPACE_PERM = "UpdateNamespace"
	UPDATE_PGBOUNCER_PERM = "UpdatePgBouncer"
	UPDATE_PGOROLE_PERM   = "UpdatePgorole"
	UPDATE_PGOUSER_PERM   = "UpdatePgouser"
	UPDATE_USER_PERM      = "UpdateUser"
)

The below constants contains the "apiserver RBAC permissions" -- this was reorganized to make it...slightly more organized as we continue to evole the system

View Source 
const PGOSecretName = "pgo.tls"
View Source 
const TreeBranch = "├── "

TreeBranch is for debugging only in this context

View Source 
const TreeTrunk = "└── "

TreeTrunk is for debugging only in this context

View Source 
const VERSION_MISMATCH_ERROR = "pgo client and server version mismatch"

Variables

View Source 
var (

	// ErrDBContainerNotFound is an error that indicates that a "database" container
	// could not be found in a specific pod
	ErrDBContainerNotFound = errors.New("\"database\" container not found in pod")
	// ErrStandbyNotAllowed contains the error message returned when an API call is not
	// permitted because it involves a cluster that is in standby mode
	ErrStandbyNotAllowed = errors.New("Action not permitted because standby mode is enabled")

	// ErrMethodNotAllowed represents the error that is thrown when a feature is disabled within the
	// current Operator install
	ErrMethodNotAllowed = errors.New("This method has is not allowed in the current PostgreSQL " +
		"Operator installation")
)
View Source 
var (
	// PGOClientset is a client for PostgreSQL Operator resources
	PGOClientset pgov1.Interface
	// Clientset is a client for native Kubernetes resources
	Clientset *kubernetes.Clientset
	// RESTConfig holds the REST configuration for a Kube client
	RESTConfig *rest.Config
	// RESTClient is a REST client for the Kubernetes API
	RESTClient *rest.RESTClient
)
View Source 
var AuditFlag bool

AuditFlag if set to true will cause auditing to occur in the logs

View Source 
var BasicAuth bool

BasicAuth comes from the apiserver config

View Source 
var CRUNCHY_DEBUG bool
View Source 
var DebugFlag bool

DebugFlag is the debug flag value

View Source 
var InstallationName string
View Source 
var MetricsFlag, BadgerFlag bool

MetricsFlag if set to true will cause crunchy-collect to be added into new clusters

View Source 
var PermMap map[string]string
View Source 
var Pgo config.PgoConfig
View Source 
var PgoNamespace string

Namespace comes from the apiserver config in this version

View Source 
var RoleMap map[string]map[string]string

Functions

func Authn 

func Authn(perm string, w http.ResponseWriter, r *http.Request) (string, error)

Authn performs HTTP Basic Authentication against a user if "BasicAuth" is set to "true" (which it is by default).

...it also performs Authorization (Authz) against the user that is attempting to authenticate, and as such, to truly "authenticate/authorize," one needs at least a valid Operator User account.

func BasicAuthCheck 

func BasicAuthCheck(username, password string) bool

func BasicAuthzCheck 

func BasicAuthzCheck(username, perm string) bool

func ConnectToKube 

func ConnectToKube()

ConnectToKube ...

func CreateRMDataTask 

func CreateRMDataTask(clusterName, replicaName, taskName string, deleteBackups, deleteData, isReplica, isBackup bool, ns, clusterPGHAScope string) error

func FindStandbyClusters 

func FindStandbyClusters(clusterList crv1.PgclusterList) (standbyClusters []string)

FindStandbyClusters takes a list of pgcluster structs and returns a slice containing the names of those clusters that are in standby mode as indicated by whether or not the standby prameter in the pgcluster spec is true.

func GetBackrestStorageTypes 

func GetBackrestStorageTypes() []string

func GetNamespace 

func GetNamespace(clientset *kubernetes.Clientset, username, requestedNS string) (string, error)

GetNamespace determines if a user has permission for a namespace they are requesting a valid requested namespace is required

func GetPVCName 

func GetPVCName(pod *v1.Pod) map[string]string

func Initialize 

func Initialize()

func InitializePerms 

func InitializePerms()

func IsValidPVC 

func IsValidPVC(pvcName, ns string) bool

IsValidPVC determines if a PVC with the name provided exits

func IsValidStorageName 

func IsValidStorageName(name string) bool

func NamespaceOperatingMode 

func NamespaceOperatingMode() ns.NamespaceOperatingMode

NamespaceOperatingMode returns the namespace operating mode for the current Operator installation, which is stored in the "namespaceOperatingMode" variable

func NewCertEnforcer 

func NewCertEnforcer(reqRoutes []string) (*certEnforcer, error)

NewCertEnforcer ensures a certEnforcer is created with skipped routes and validates that the configured routes are allowed

func PGClusterListHasStandby 

func PGClusterListHasStandby(clusterList crv1.PgclusterList) (bool, []string)

PGClusterListHasStandby determines if a PgclusterList has any standby clusters, specifically returning "true" if one or more standby clusters exist, along with a slice of strings containing the names of the clusters in standby mode

func UserIsPermittedInNamespace 

func UserIsPermittedInNamespace(username, requestedNS string) (iAccess, uAccess bool, err error)

UserIsPermittedInNamespace returns installation access and user access. Installation access means a namespace belongs to this Operator installation. User access means this user has access to a namespace.

func ValidateNodeLabel 

func ValidateNodeLabel(nodeLabel string) error

ValidateNodeLabel returns error if node label is invalid based on format

func ValidateQuantity 

func ValidateQuantity(quantity string) error

ValidateQuantity runs the Kubernetes "ParseQuantity" function on a string and determine whether or not it is a valid quantity object. Returns an error if it is invalid, along with the error message.

If it is empty, it returns no error

See: https://github.com/kubernetes/apimachinery/blob/master/pkg/api/resource/quantity.go

func WriteTLSCert 

func WriteTLSCert(certPath, keyPath string) error

WriteTLSCert is a legacy method that writes the server certificate and key to files from the PGOSecretName secret or generates a new key (writing to both the secret and the expected files

Types

type CredentialDetail 

type CredentialDetail struct {
	Username   string
	Password   string
	Role       string
	Namespaces []string
}

Source Files

View all Source files

Directories

Path Synopsis
Package routing temporarily breaks circular dependencies within the structure of the apiserver package The apiserver package contains a mix of package content (used by external code) and refactored functionality from the *service folders.
 Package routing temporarily breaks circular dependencies within the structure of the apiserver package The apiserver package contains a mix of package content (used by external code) and refactored functionality from the *service folders.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.