apiserver

package
v4.3.3+incompatible Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Aug 17, 2020 License: Apache-2.0 Imports: 22 Imported by: 0

Documentation

Index

Constants

View Source
const (
	// ErrMessageLimitInvalid indicates that a limit is lower than the request
	ErrMessageLimitInvalid = `limit %q is lower than the request %q`
	// ErrMessagePVCSize provides a standard error message when a PVCSize is not
	// specified to the Kubernetes stnadard
	ErrMessagePVCSize = `could not parse PVC size "%s": %s (hint: try a value like "1Gi")`
	// ErrMessageReplicas provides a standard error message when the count of
	// replicas is incorrect
	ErrMessageReplicas = `must have at least %d replica(s)`
)
View Source
const (
	// MISC
	APPLY_POLICY_PERM = "ApplyPolicy"
	CAT_PERM          = "Cat"
	CLONE_PERM        = "Clone"
	DF_CLUSTER_PERM   = "DfCluster"
	LABEL_PERM        = "Label"
	LOAD_PERM         = "Load"
	RELOAD_PERM       = "Reload"
	RESTART_PERM      = "Restart"
	RESTORE_PERM      = "Restore"
	STATUS_PERM       = "Status"
	TEST_CLUSTER_PERM = "TestCluster"
	VERSION_PERM      = "Version"

	// CREATE
	CREATE_BACKUP_PERM    = "CreateBackup"
	CREATE_CLUSTER_PERM   = "CreateCluster"
	CREATE_DUMP_PERM      = "CreateDump"
	CREATE_FAILOVER_PERM  = "CreateFailover"
	CREATE_INGEST_PERM    = "CreateIngest"
	CREATE_NAMESPACE_PERM = "CreateNamespace"
	CREATE_PGADMIN_PERM   = "CreatePgAdmin"
	CREATE_PGBOUNCER_PERM = "CreatePgbouncer"
	CREATE_PGOUSER_PERM   = "CreatePgouser"
	CREATE_PGOROLE_PERM   = "CreatePgorole"
	CREATE_POLICY_PERM    = "CreatePolicy"
	CREATE_SCHEDULE_PERM  = "CreateSchedule"
	CREATE_UPGRADE_PERM   = "CreateUpgrade"
	CREATE_USER_PERM      = "CreateUser"

	// RESTORE
	RESTORE_DUMP_PERM = "RestoreDump"

	// DELETE
	DELETE_BACKUP_PERM    = "DeleteBackup"
	DELETE_CLUSTER_PERM   = "DeleteCluster"
	DELETE_INGEST_PERM    = "DeleteIngest"
	DELETE_NAMESPACE_PERM = "DeleteNamespace"
	DELETE_PGADMIN_PERM   = "DeletePgAdmin"
	DELETE_PGBOUNCER_PERM = "DeletePgbouncer"
	DELETE_PGOROLE_PERM   = "DeletePgorole"
	DELETE_PGOUSER_PERM   = "DeletePgouser"
	DELETE_POLICY_PERM    = "DeletePolicy"
	DELETE_SCHEDULE_PERM  = "DeleteSchedule"
	DELETE_USER_PERM      = "DeleteUser"

	// SHOW
	SHOW_BACKUP_PERM          = "ShowBackup"
	SHOW_CLUSTER_PERM         = "ShowCluster"
	SHOW_CONFIG_PERM          = "ShowConfig"
	SHOW_INGEST_PERM          = "ShowIngest"
	SHOW_NAMESPACE_PERM       = "ShowNamespace"
	SHOW_PGADMIN_PERM         = "ShowPgAdmin"
	SHOW_PGBOUNCER_PERM       = "ShowPgBouncer"
	SHOW_PGOROLE_PERM         = "ShowPgorole"
	SHOW_PGOUSER_PERM         = "ShowPgouser"
	SHOW_POLICY_PERM          = "ShowPolicy"
	SHOW_PVC_PERM             = "ShowPVC"
	SHOW_SCHEDULE_PERM        = "ShowSchedule"
	SHOW_SECRETS_PERM         = "ShowSecrets"
	SHOW_SYSTEM_ACCOUNTS_PERM = "ShowSystemAccounts"
	SHOW_USER_PERM            = "ShowUser"
	SHOW_WORKFLOW_PERM        = "ShowWorkflow"

	// SCALE
	SCALE_CLUSTER_PERM = "ScaleCluster"

	// UPDATE
	UPDATE_CLUSTER_PERM   = "UpdateCluster"
	UPDATE_NAMESPACE_PERM = "UpdateNamespace"
	UPDATE_PGBOUNCER_PERM = "UpdatePgBouncer"
	UPDATE_PGOROLE_PERM   = "UpdatePgorole"
	UPDATE_PGOUSER_PERM   = "UpdatePgouser"
	UPDATE_USER_PERM      = "UpdateUser"
)

The below constants contains the "apiserver RBAC permissions" -- this was reorganized to make it...slightly more organized as we continue to evole the system

View Source
const PGOSecretName = "pgo.tls"
View Source
const TreeBranch = "├── "

TreeBranch is for debugging only in this context

View Source
const TreeTrunk = "└── "

TreeTrunk is for debugging only in this context

View Source
const VERSION_MISMATCH_ERROR = "pgo client and server version mismatch"

Variables

View Source
var (

	// ErrDBContainerNotFound is an error that indicates that a "database" container
	// could not be found in a specific pod
	ErrDBContainerNotFound = errors.New("\"database\" container not found in pod")
	// ErrStandbyNotAllowed contains the error message returned when an API call is not
	// permitted because it involves a cluster that is in standby mode
	ErrStandbyNotAllowed = errors.New("Action not permitted because standby mode is enabled")

	// ErrMethodNotAllowed represents the error that is thrown when a feature is disabled within the
	// current Operator install
	ErrMethodNotAllowed = errors.New("This method has is not allowed in the current PostgreSQL " +
		"Operator installation")
)
View Source
var (
	// PGOClientset is a client for PostgreSQL Operator resources
	PGOClientset pgov1.Interface
	// Clientset is a client for native Kubernetes resources
	Clientset *kubernetes.Clientset
	// RESTConfig holds the REST configuration for a Kube client
	RESTConfig *rest.Config
	// RESTClient is a REST client for the Kubernetes API
	RESTClient *rest.RESTClient
)
View Source
var AuditFlag bool

AuditFlag if set to true will cause auditing to occur in the logs

View Source
var BasicAuth bool

BasicAuth comes from the apiserver config

View Source
var CRUNCHY_DEBUG bool
View Source
var DebugFlag bool

DebugFlag is the debug flag value

View Source
var InstallationName string
View Source
var MetricsFlag, BadgerFlag bool

MetricsFlag if set to true will cause crunchy-collect to be added into new clusters

View Source
var PermMap map[string]string
View Source
var PgoNamespace string

Namespace comes from the apiserver config in this version

View Source
var RoleMap map[string]map[string]string

Functions

func Authn

func Authn(perm string, w http.ResponseWriter, r *http.Request) (string, error)

Authn performs HTTP Basic Authentication against a user if "BasicAuth" is set to "true" (which it is by default).

...it also performs Authorization (Authz) against the user that is attempting to authenticate, and as such, to truly "authenticate/authorize," one needs at least a valid Operator User account.

func BasicAuthCheck

func BasicAuthCheck(username, password string) bool

func BasicAuthzCheck

func BasicAuthzCheck(username, perm string) bool

func ConnectToKube

func ConnectToKube()

ConnectToKube ...

func CreateRMDataTask

func CreateRMDataTask(clusterName, replicaName, taskName string, deleteBackups, deleteData, isReplica, isBackup bool, ns, clusterPGHAScope string) error

func FindStandbyClusters

func FindStandbyClusters(clusterList crv1.PgclusterList) (standbyClusters []string)

FindStandbyClusters takes a list of pgcluster structs and returns a slice containing the names of those clusters that are in standby mode as indicated by whether or not the standby prameter in the pgcluster spec is true.

func GetBackrestStorageTypes

func GetBackrestStorageTypes() []string

func GetNamespace

func GetNamespace(clientset *kubernetes.Clientset, username, requestedNS string) (string, error)

GetNamespace determines if a user has permission for a namespace they are requesting a valid requested namespace is required

func GetPVCName

func GetPVCName(pod *v1.Pod) map[string]string

func Initialize

func Initialize()

func InitializePerms

func InitializePerms()

func IsValidPVC

func IsValidPVC(pvcName, ns string) bool

IsValidPVC determines if a PVC with the name provided exits

func IsValidStorageName

func IsValidStorageName(name string) bool

func NamespaceOperatingMode

func NamespaceOperatingMode() ns.NamespaceOperatingMode

NamespaceOperatingMode returns the namespace operating mode for the current Operator installation, which is stored in the "namespaceOperatingMode" variable

func NewCertEnforcer

func NewCertEnforcer(reqRoutes []string) (*certEnforcer, error)

NewCertEnforcer ensures a certEnforcer is created with skipped routes and validates that the configured routes are allowed

func PGClusterListHasStandby

func PGClusterListHasStandby(clusterList crv1.PgclusterList) (bool, []string)

PGClusterListHasStandby determines if a PgclusterList has any standby clusters, specifically returning "true" if one or more standby clusters exist, along with a slice of strings containing the names of the clusters in standby mode

func UserIsPermittedInNamespace

func UserIsPermittedInNamespace(username, requestedNS string) (bool, bool, error)

UserIsPermittedInNamespace returns installation access and user access. Installation access means a namespace belongs to this Operator installation. User access means this user has access to a namespace.

func ValidateNodeLabel

func ValidateNodeLabel(nodeLabel string) error

ValidateNodeLabel returns error if node label is invalid based on format

func ValidateQuantity

func ValidateQuantity(quantity string) error

ValidateQuantity runs the Kubernetes "ParseQuantity" function on a string and determine whether or not it is a valid quantity object. Returns an error if it is invalid, along with the error message.

If it is empty, it returns no error

See: https://github.com/kubernetes/apimachinery/blob/master/pkg/api/resource/quantity.go

func ValidateResourceRequestLimit

func ValidateResourceRequestLimit(request, limit string, defaultQuantity resource.Quantity) error

ValidateResourceRequestLimit validates that a Kubernetes Requests/Limit pair is valid, both by validating the values are valid quantity values, and then by checking that the limit >= request. This also needs to check against the configured values for a request, which must be provided as a value

func WriteTLSCert

func WriteTLSCert(certPath, keyPath string) error

WriteTLSCert is a legacy method that writes the server certificate and key to files from the PGOSecretName secret or generates a new key (writing to both the secret and the expected files

Types

type CredentialDetail

type CredentialDetail struct {
	Username   string
	Password   string
	Role       string
	Namespaces []string
}

Directories

Path Synopsis
Package routing temporarily breaks circular dependencies within the structure of the apiserver package The apiserver package contains a mix of package content (used by external code) and refactored functionality from the *service folders.
Package routing temporarily breaks circular dependencies within the structure of the apiserver package The apiserver package contains a mix of package content (used by external code) and refactored functionality from the *service folders.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL