Affected by 
Documentation
¶
Index ¶
Constants ¶
const ( // The SPDY subprotocol "v4.channel.k8s.io" is used for remote command // attachment/execution. It is the 4th version of the subprotocol and // adds support for exit codes. StreamProtocolV4Name = "v4.channel.k8s.io" // DefaultStreamCreationTimeout DefaultStreamCreationTimeout = 30 * time.Second IdleTimeout = 15 * time.Minute )
const ( // Enable stdin for remote command execution ExecStdinParam = "input" // Enable stdout for remote command execution ExecStdoutParam = "output" // Enable stderr for remote command execution ExecStderrParam = "error" // Enable TTY for remote command execution ExecTTYParam = "tty" // Command to run for remote command execution ExecCommandParam = "command" // Name of header that specifies stream type StreamType = "streamType" // Value for streamType header for stdin stream StreamTypeStdin = "stdin" // Value for streamType header for stdout stream StreamTypeStdout = "stdout" // Value for streamType header for stderr stream StreamTypeStderr = "stderr" // Value for streamType header for data stream StreamTypeData = "data" // Value for streamType header for error stream StreamTypeError = "error" // Value for streamType header for terminal resize stream StreamTypeResize = "resize" // Name of header that specifies the port being forwarded PortHeader = "port" // Name of header that specifies a request ID used to associate the error // and data streams for a single forwarded connection PortForwardRequestIDHeader = "requestID" // PortForwardProtocolV1Name is the subprotocol "portforward.k8s.io" is used for port forwarding PortForwardProtocolV1Name = "portforward.k8s.io" )
These constants are for remote command execution and port forwarding and are used by both the client side and server side components.
This is probably not the ideal place for them, but it didn't seem worth it to create pkg/exec and pkg/portforward just to contain a single file with constants in it. Suggestions for more appropriate alternatives are definitely welcome!
const ( // ImpersonateHeaderPrefix is K8s impersonation prefix for impersonation feature: // https://kubernetes.io/docs/reference/access-authn-authz/authentication/#user-impersonation ImpersonateHeaderPrefix = "Impersonate-" // ImpersonateUserHeader is impersonation header for users ImpersonateUserHeader = "Impersonate-User" // ImpersonateGroupHeader is K8s impersonation header for user ImpersonateGroupHeader = "Impersonate-Group" // ImpersonationRequestDeniedMessage is access denied message for impersonation ImpersonationRequestDeniedMessage = "impersonation request has been denied" )
const PresenceMaxDifference = time.Minute
const PresenceVerifyInterval = time.Second * 15
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type DialWithContext ¶
DialWithContext is the function used to dial to remote endpoints
type Forwarder ¶
type Forwarder struct {
// contains filtered or unexported fields
}
Forwarder intercepts kubernetes requests, acting as Kubernetes API proxy. it blindly forwards most of the requests on HTTPS protocol layer, however some requests like exec sessions it intercepts and records.
func NewForwarder ¶
func NewForwarder(cfg ForwarderConfig) (*Forwarder, error)
NewForwarder returns new instance of Kubernetes request forwarding proxy.
type ForwarderConfig ¶
type ForwarderConfig struct {
// ReverseTunnelSrv is the teleport reverse tunnel server
ReverseTunnelSrv reversetunnel.Server
// ClusterName is a local cluster name
ClusterName string
// Keygen points to a key generator implementation
Keygen sshca.Authority
// Authz authenticates user
Authz auth.Authorizer
// AuthClient is a auth server client.
AuthClient auth.ClientI
// CachingAuthClient is a caching auth server client for read-only access.
CachingAuthClient auth.ReadKubernetesAccessPoint
// StreamEmitter is used to create audit streams
// and emit audit events
StreamEmitter events.StreamEmitter
// DataDir is a data dir to store logs
DataDir string
// Namespace is a namespace of the proxy server (not a K8s namespace)
Namespace string
// HostID is a unique ID of a proxy server
HostID string
// ClusterOverride if set, routes all requests
// to the cluster name, used in tests
ClusterOverride string
// Context passes the optional external context
// passing global close to all forwarder operations
Context context.Context
// KubeconfigPath is a path to kubernetes configuration
KubeconfigPath string
// KubeServiceType specifies which Teleport service type this forwarder is for
KubeServiceType KubeServiceType
// KubeClusterName is the name of the kubernetes cluster that this
// forwarder handles.
KubeClusterName string
// Clock is a server clock, could be overridden in tests
Clock clockwork.Clock
// ConnPingPeriod is a period for sending ping messages on the incoming
// connection.
ConnPingPeriod time.Duration
// Component name to include in log output.
Component string
// LockWatcher is a lock watcher.
LockWatcher *services.LockWatcher
// CheckImpersonationPermissions is an optional override of the default
// impersonation permissions check, for use in testing
CheckImpersonationPermissions ImpersonationPermissionsChecker
// PublicAddr is the address that can be used to reach the kube cluster
PublicAddr string
// contains filtered or unexported fields
}
ForwarderConfig specifies configuration for proxy forwarder
func (*ForwarderConfig) CheckAndSetDefaults ¶
func (f *ForwarderConfig) CheckAndSetDefaults() error
CheckAndSetDefaults checks and sets default values
type ImpersonationPermissionsChecker ¶
type ImpersonationPermissionsChecker func(ctx context.Context, clusterName string, sarClient authztypes.SelfSubjectAccessReviewInterface) error
ImpersonationPermissionsChecker describes a function that can be used to check for the required impersonation permissions on a Kubernetes cluster. Return nil to indicate success.
type KubeServiceType ¶
type KubeServiceType int
KubeServiceType specifies a Teleport service type which can forward Kubernetes requests
const ( // KubeService is a Teleport kubernetes_service. A KubeService always forwards // requests directly to a Kubernetes endpoint. KubeService KubeServiceType = iota // ProxyService is a Teleport proxy_service with kube_listen_addr/ // kube_public_addr enabled. A ProxyService always forwards requests to a // Teleport KubeService or LegacyProxyService. ProxyService // LegacyProxyService is a Teleport proxy_service with the kubernetes section // enabled. A LegacyProxyService can forward requests directly to a Kubernetes // endpoint, or to another Teleport LegacyProxyService or KubeService. LegacyProxyService )
type SpdyRoundTripper ¶
type SpdyRoundTripper struct {
// contains filtered or unexported fields
}
SpdyRoundTripper knows how to upgrade an HTTP request to one that supports multiplexed streams. After RoundTrip() is invoked, Conn will be set and usable. SpdyRoundTripper implements the UpgradeRoundTripper interface.
func NewSpdyRoundTripperWithDialer ¶
func NewSpdyRoundTripperWithDialer(cfg roundTripperConfig) *SpdyRoundTripper
NewSpdyRoundTripperWithDialer creates a new SpdyRoundTripper that will use the specified tlsConfig. This function is mostly meant for unit tests.
func (*SpdyRoundTripper) NewConnection ¶
func (s *SpdyRoundTripper) NewConnection(resp *http.Response) (httpstream.Connection, error)
NewConnection validates the upgrade response, creating and returning a new httpstream.Connection if there were no errors.
func (*SpdyRoundTripper) RoundTrip ¶
RoundTrip executes the Request and upgrades it. After a successful upgrade, clients may call SpdyRoundTripper.Connection() to retrieve the upgraded connection.
func (*SpdyRoundTripper) TLSClientConfig ¶
func (s *SpdyRoundTripper) TLSClientConfig() *tls.Config
TLSClientConfig implements pkg/util/net.TLSClientConfigHolder for proper TLS checking during proxying with a spdy roundtripper.
type TLSServer ¶
type TLSServer struct {
*http.Server
// TLSServerConfig is TLS server configuration used for auth server
TLSServerConfig
// contains filtered or unexported fields
}
TLSServer is TLS auth server
func NewTLSServer ¶
func NewTLSServer(cfg TLSServerConfig) (*TLSServer, error)
NewTLSServer returns new unstarted TLS server
func (*TLSServer) GetConfigForClient ¶
GetConfigForClient is getting called on every connection and server's GetConfigForClient reloads the list of trusted local and remote certificate authorities
type TLSServerConfig ¶
type TLSServerConfig struct {
// ForwarderConfig is a config of a forwarder
ForwarderConfig
// TLS is a base TLS configuration
TLS *tls.Config
// LimiterConfig is limiter config
LimiterConfig limiter.Config
// AccessPoint is caching access point
AccessPoint auth.ReadKubernetesAccessPoint
// OnHeartbeat is a callback for kubernetes_service heartbeats.
OnHeartbeat func(error)
// GetRotation returns the certificate rotation state.
GetRotation services.RotationGetter
// ConnectedProxyGetter gets the proxies teleport is connected to.
ConnectedProxyGetter *reversetunnel.ConnectedProxyGetter
// Log is the logger.
Log logrus.FieldLogger
// Selectors is a list of resource monitor selectors.
ResourceMatchers []services.ResourceMatcher
// OnReconcile is called after each kube_cluster resource reconciliation.
OnReconcile func(types.KubeClusters)
// CloudClients is a set of cloud clients that Teleport supports.
CloudClients cloud.Clients
//StaticLabels is a map of static labels associated with this service.
// Each cluster advertised by this kubernetes_service will include these static labels.
// If the service and a cluster define labels with the same key,
// service labels take precedence over cluster labels.
// Used for RBAC.
StaticLabels map[string]string
// DynamicLabels define the dynamic labels associated with this service.
// Each cluster advertised by this kubernetes_service will include these dynamic labels.
// If the service and a cluster define labels with the same key,
// service labels take precedence over cluster labels.
// Used for RBAC.
DynamicLabels *labels.Dynamic
// CloudLabels is a map of static labels imported from a cloud provider associated with this
// service. Used for RBAC.
// If StaticLabels and CloudLabels define labels with the same key,
// StaticLabels take precedence over CloudLabels.
CloudLabels labels.Importer
}
TLSServerConfig is a configuration for TLS server
func (*TLSServerConfig) CheckAndSetDefaults ¶
func (c *TLSServerConfig) CheckAndSetDefaults() error
CheckAndSetDefaults checks and sets default values
Source Files
Directories