service

Documentation

Index

• Variables
• func AllowedControllersServiceAccountUID(ctx context.Context, cfg Config, kubeClient kubernetes.Interface) ([]string, error)
• func InitMetrics() error
• func RecordFailedSidecarInjectionCount(appID, reason string)
• func RecordSidecarInjectionRequestsCount()
• func RecordSuccessfulSidecarInjectionCount(appID string)
• type Config
  • func GetConfig() (Config, error)
  • func NewConfigWithDefaults() Config
  • func (c *Config) GetDropCapabilities() bool
  • func (c *Config) GetIgnoreEntrypointTolerations() []corev1.Toleration
  • func (c Config) GetPullPolicy() corev1.PullPolicy
  • func (c *Config) GetReadOnlyRootFilesystem() bool
  • func (c *Config) GetRunAsNonRoot() bool
  • func (c *Config) GetSkipPlacement() bool
• type Injector
  • func NewInjector(opts Options) (Injector, error)
• type Options

Variables

var AllowedServiceAccountInfos = []string{
	"kube-system:replicaset-controller",
	"kube-system:deployment-controller",
	"kube-system:cronjob-controller",
	"kube-system:job-controller",
	"kube-system:statefulset-controller",
	"kube-system:daemon-set-controller",
	"tekton-pipelines:tekton-pipelines-controller",
}

Functions

func AllowedControllersServiceAccountUID

func AllowedControllersServiceAccountUID(ctx context.Context, cfg Config, kubeClient kubernetes.Interface) ([]string, error)

AllowedControllersServiceAccountUID returns an array of UID, list of allowed service account on the webhook handler.

func InitMetrics

func InitMetrics() error

InitMetrics initialize the injector service metrics.

func RecordFailedSidecarInjectionCount

func RecordFailedSidecarInjectionCount(appID, reason string)

RecordFailedSidecarInjectionCount records the number of failed sidecar injections.

func RecordSidecarInjectionRequestsCount

func RecordSidecarInjectionRequestsCount()

RecordSidecarInjectionRequestsCount records the total number of sidecar injection requests.

func RecordSuccessfulSidecarInjectionCount

func RecordSuccessfulSidecarInjectionCount(appID string)

RecordSuccessfulSidecarInjectionCount records the number of successful sidecar injections.

Types

type Config

type Config struct {
	SidecarImage                      string `envconfig:"SIDECAR_IMAGE" required:"true"`
	SidecarImagePullPolicy            string `envconfig:"SIDECAR_IMAGE_PULL_POLICY"`
	Namespace                         string `envconfig:"NAMESPACE" required:"true"`
	KubeClusterDomain                 string `envconfig:"KUBE_CLUSTER_DOMAIN"`
	AllowedServiceAccounts            string `envconfig:"ALLOWED_SERVICE_ACCOUNTS"`
	AllowedServiceAccountsPrefixNames string `envconfig:"ALLOWED_SERVICE_ACCOUNTS_PREFIX_NAMES"`
	IgnoreEntrypointTolerations       string `envconfig:"IGNORE_ENTRYPOINT_TOLERATIONS"`
	SkipPlacement                     string `envconfig:"SKIP_PLACEMENT"`
	RunAsNonRoot                      string `envconfig:"SIDECAR_RUN_AS_NON_ROOT"`
	ReadOnlyRootFilesystem            string `envconfig:"SIDECAR_READ_ONLY_ROOT_FILESYSTEM"`
	SidecarDropALLCapabilities        string `envconfig:"SIDECAR_DROP_ALL_CAPABILITIES"`

	TrustAnchorsFile        string `envconfig:"DAPR_TRUST_ANCHORS_FILE"`
	ControlPlaneTrustDomain string `envconfig:"DAPR_CONTROL_PLANE_TRUST_DOMAIN"`
	SentryAddress           string `envconfig:"DAPR_SENTRY_ADDRESS"`
	// contains filtered or unexported fields
}

Config represents configuration options for the Dapr Sidecar Injector webhook server.

func GetConfig

func GetConfig() (Config, error)

GetConfig returns configuration derived from environment variables.

func NewConfigWithDefaults

func NewConfigWithDefaults() Config

NewConfigWithDefaults returns a Config object with default values already applied. Callers are then free to set custom values for the remaining fields and/or override default values.

func (*Config) GetDropCapabilities

func (c *Config) GetDropCapabilities() bool

func (*Config) GetIgnoreEntrypointTolerations

func (c *Config) GetIgnoreEntrypointTolerations() []corev1.Toleration

func (Config) GetPullPolicy

func (c Config) GetPullPolicy() corev1.PullPolicy

func (*Config) GetReadOnlyRootFilesystem

func (c *Config) GetReadOnlyRootFilesystem() bool

func (*Config) GetRunAsNonRoot

func (c *Config) GetRunAsNonRoot() bool

func (*Config) GetSkipPlacement

func (c *Config) GetSkipPlacement() bool

type Injector

type Injector interface {
	Run(context.Context, *tls.Config, signDaprdCertificateFn, currentTrustAnchorsFn) error
	Ready(context.Context) error
}

Injector is the interface for the Dapr runtime sidecar injection component.

func NewInjector

func NewInjector(opts Options) (Injector, error)

NewInjector returns a new Injector instance with the given config.

type Options

type Options struct {
	AuthUIDs   []string
	Config     Config
	DaprClient scheme.Interface
	KubeClient kubernetes.Interface

	ControlPlaneNamespace   string
	ControlPlaneTrustDomain string
}