injector

Documentation

Index

• Variables
• func AllowedControllersServiceAccountUID(ctx context.Context, cfg Config, kubeClient kubernetes.Interface) ([]string, error)
• type Config
  • func GetConfig() (Config, error)
  • func NewConfigWithDefaults() Config
  • func (c *Config) GetDropCapabilities() bool
  • func (c *Config) GetIgnoreEntrypointTolerations() []corev1.Toleration
  • func (c Config) GetPullPolicy() corev1.PullPolicy
  • func (c *Config) GetReadOnlyRootFilesystem() bool
  • func (c *Config) GetRunAsNonRoot() bool
  • func (c *Config) GetSkipPlacement() bool
• type Injector
  • func NewInjector(authUIDs []string, config Config, daprClient scheme.Interface, ...) (Injector, error)

Variables

var AllowedServiceAccountInfos = []string{
	"kube-system:replicaset-controller",
	"kube-system:deployment-controller",
	"kube-system:cronjob-controller",
	"kube-system:job-controller",
	"kube-system:statefulset-controller",
	"kube-system:daemon-set-controller",
	"tekton-pipelines:tekton-pipelines-controller",
}

Functions

func AllowedControllersServiceAccountUID

func AllowedControllersServiceAccountUID(ctx context.Context, cfg Config, kubeClient kubernetes.Interface) ([]string, error)

AllowedControllersServiceAccountUID returns an array of UID, list of allowed service account on the webhook handler.

Types

type Config

type Config struct {
	TLSCertFile                       string `envconfig:"TLS_CERT_FILE" required:"true"`
	TLSKeyFile                        string `envconfig:"TLS_KEY_FILE" required:"true"`
	SidecarImage                      string `envconfig:"SIDECAR_IMAGE" required:"true"`
	SidecarImagePullPolicy            string `envconfig:"SIDECAR_IMAGE_PULL_POLICY"`
	Namespace                         string `envconfig:"NAMESPACE" required:"true"`
	KubeClusterDomain                 string `envconfig:"KUBE_CLUSTER_DOMAIN"`
	AllowedServiceAccounts            string `envconfig:"ALLOWED_SERVICE_ACCOUNTS"`
	AllowedServiceAccountsPrefixNames string `envconfig:"ALLOWED_SERVICE_ACCOUNTS_PREFIX_NAMES"`
	IgnoreEntrypointTolerations       string `envconfig:"IGNORE_ENTRYPOINT_TOLERATIONS"`
	SkipPlacement                     string `envconfig:"SKIP_PLACEMENT"`
	RunAsNonRoot                      string `envconfig:"SIDECAR_RUN_AS_NON_ROOT"`
	ReadOnlyRootFilesystem            string `envconfig:"SIDECAR_READ_ONLY_ROOT_FILESYSTEM"`
	SidecarDropALLCapabilities        string `envconfig:"SIDECAR_DROP_ALL_CAPABILITIES"`
	// contains filtered or unexported fields
}

Config represents configuration options for the Dapr Sidecar Injector webhook server.

func GetConfig

func GetConfig() (Config, error)

GetConfig returns configuration derived from environment variables.

func NewConfigWithDefaults

func NewConfigWithDefaults() Config

NewConfigWithDefaults returns a Config object with default values already applied. Callers are then free to set custom values for the remaining fields and/or override default values.

func (*Config) GetDropCapabilities

func (c *Config) GetDropCapabilities() bool

func (*Config) GetIgnoreEntrypointTolerations

func (c *Config) GetIgnoreEntrypointTolerations() []corev1.Toleration

func (Config) GetPullPolicy

func (c Config) GetPullPolicy() corev1.PullPolicy

func (*Config) GetReadOnlyRootFilesystem

func (c *Config) GetReadOnlyRootFilesystem() bool

func (*Config) GetRunAsNonRoot

func (c *Config) GetRunAsNonRoot() bool

func (*Config) GetSkipPlacement

func (c *Config) GetSkipPlacement() bool

type Injector

type Injector interface {
	Run(context.Context) error
	Ready(context.Context) error
}

Injector is the interface for the Dapr runtime sidecar injection component.

func NewInjector

func NewInjector(authUIDs []string, config Config, daprClient scheme.Interface, kubeClient kubernetes.Interface) (Injector, error)

NewInjector returns a new Injector instance with the given config.