shoot

Documentation

Index

• Constants
• func EnsureNetworkPolicy(ctx context.Context, c client.Client, namespace, extensionName string, ...) error
• func GetNetworkPolicyMeta(namespace, extensionName string) *networkingv1.NetworkPolicy
• func New(mgr manager.Manager, args Args) (*extensionswebhook.Webhook, error)
• func ReconcileWebhookConfig(ctx context.Context, c client.Client, namespace string, extensionName string, ...) error
• func ReconcileWebhooksForAllNamespaces(ctx context.Context, c client.Client, extensionName string, ...) error
• type Args

Constants

const (
	// WebhookName is the name of the shoot webhook.
	WebhookName = "shoot"
	// KindSystem is used for webhooks which should only apply to the to the kube-system namespace.
	KindSystem = "system"
)

Functions

func EnsureNetworkPolicy

func EnsureNetworkPolicy(ctx context.Context, c client.Client, namespace, extensionName string, port int) error

EnsureNetworkPolicy ensures that the required network policy that allows the kube-apiserver running in the given namespace to talk to the extension webhook is installed.

func GetNetworkPolicyMeta

func GetNetworkPolicyMeta(namespace, extensionName string) *networkingv1.NetworkPolicy

GetNetworkPolicyMeta returns the network policy object with filled meta data.

func New

func New(mgr manager.Manager, args Args) (*extensionswebhook.Webhook, error)

New creates a new webhook with the shoot as target cluster.

func ReconcileWebhookConfig

func ReconcileWebhookConfig(
	ctx context.Context,
	c client.Client,
	namespace string,
	extensionName string,
	managedResourceName string,
	serverPort int,
	shootWebhookConfig *admissionregistrationv1.MutatingWebhookConfiguration,
	cluster *controller.Cluster,
) error

ReconcileWebhookConfig deploys the shoot webhook configuration, i.e., a network policy to allow the kube-apiserver to talk to the extension, and a managed resource that contains the MutatingWebhookConfiguration.

func ReconcileWebhooksForAllNamespaces

func ReconcileWebhooksForAllNamespaces(
	ctx context.Context,
	c client.Client,
	extensionName string,
	managedResourceName string,
	shootNamespaceSelector map[string]string,
	port int,
	shootWebhookConfig *admissionregistrationv1.MutatingWebhookConfiguration,
) error

ReconcileWebhooksForAllNamespaces reconciles the shoot webhooks in all shoot namespaces of the given provider type. This is necessary in case the webhook port is changed (otherwise, the network policy would only be updated again as part of the ControlPlane reconciliation which might only happen in the next 24h).

Types

type Args

type Args struct {
	// Types is a list of resource types.
	Types []extensionswebhook.Type
	// Mutator is a mutator to be used by the admission handler. It doesn't need the shoot client.
	Mutator extensionswebhook.Mutator
	// MutatorWithShootClient is a mutator to be used by the admission handler. It needs the shoot client.
	MutatorWithShootClient extensionswebhook.MutatorWithShootClient
	// FailurePolicy is the failure policy for the webhook (defaults to Ignore).
	FailurePolicy *admissionregistrationv1.FailurePolicyType
}

Args are arguments for creating a webhook targeting a shoot.