injector

Documentation

Index

• Variables
• func AllowedControllersServiceAccountUID(ctx context.Context, cfg Config, kubeClient kubernetes.Interface) ([]string, error)
• type Config
  • func GetConfig() (Config, error)
  • func NewConfigWithDefaults() Config
  • func (c *Config) GetIgnoreEntrypointTolerations() []corev1.Toleration
  • func (c Config) GetPullPolicy() corev1.PullPolicy
  • func (c *Config) GetReadOnlyRootFilesystem() bool
  • func (c *Config) GetRunAsNonRoot() bool
• type Injector
  • func NewInjector(authUIDs []string, config Config, daprClient scheme.Interface, ...) Injector

Variables

var AllowedServiceAccountInfos = []string{
	"kube-system:replicaset-controller",
	"kube-system:deployment-controller",
	"kube-system:cronjob-controller",
	"kube-system:job-controller",
	"kube-system:statefulset-controller",
	"kube-system:daemon-set-controller",
	"tekton-pipelines:tekton-pipelines-controller",
}

Functions

func AllowedControllersServiceAccountUID

func AllowedControllersServiceAccountUID(ctx context.Context, cfg Config, kubeClient kubernetes.Interface) ([]string, error)

AllowedControllersServiceAccountUID returns an array of UID, list of allowed service account on the webhook handler.

Types

type Config

type Config struct {
	TLSCertFile                 string `envconfig:"TLS_CERT_FILE" required:"true"`
	TLSKeyFile                  string `envconfig:"TLS_KEY_FILE" required:"true"`
	SidecarImage                string `envconfig:"SIDECAR_IMAGE" required:"true"`
	SidecarImagePullPolicy      string `envconfig:"SIDECAR_IMAGE_PULL_POLICY"`
	Namespace                   string `envconfig:"NAMESPACE" required:"true"`
	KubeClusterDomain           string `envconfig:"KUBE_CLUSTER_DOMAIN"`
	AllowedServiceAccounts      string `envconfig:"ALLOWED_SERVICE_ACCOUNTS"`
	IgnoreEntrypointTolerations string `envconfig:"IGNORE_ENTRYPOINT_TOLERATIONS"`
	RunAsNonRoot                string `envconfig:"SIDECAR_RUN_AS_NON_ROOT"`
	ReadOnlyRootFilesystem      string `envconfig:"SIDECAR_READ_ONLY_ROOT_FILESYSTEM"`
	// contains filtered or unexported fields
}

Config represents configuration options for the Dapr Sidecar Injector webhook server.

func GetConfig

func GetConfig() (Config, error)

GetConfig returns configuration derived from environment variables.

func NewConfigWithDefaults

func NewConfigWithDefaults() Config

NewConfigWithDefaults returns a Config object with default values already applied. Callers are then free to set custom values for the remaining fields and/or override default values.

func (*Config) GetIgnoreEntrypointTolerations

func (c *Config) GetIgnoreEntrypointTolerations() []corev1.Toleration

func (Config) GetPullPolicy

func (c Config) GetPullPolicy() corev1.PullPolicy

func (*Config) GetReadOnlyRootFilesystem

func (c *Config) GetReadOnlyRootFilesystem() bool

func (*Config) GetRunAsNonRoot

func (c *Config) GetRunAsNonRoot() bool

type Injector

type Injector interface {
	Run(ctx context.Context, onReady func())
}

Injector is the interface for the Dapr runtime sidecar injection component.

func NewInjector

func NewInjector(authUIDs []string, config Config, daprClient scheme.Interface, kubeClient kubernetes.Interface) Injector

NewInjector returns a new Injector instance with the given config.