admit

Documentation

Index

• type AdmissionController
  • func NewController(client kubernetes.Interface, options ControllerOptions) (*AdmissionController, error)
  • func (ac *AdmissionController) Run(stop <-chan struct{})
  • func (ac *AdmissionController) ServeHTTP(w http.ResponseWriter, r *http.Request)
• type ControllerOptions

Types

type AdmissionController

type AdmissionController struct {
	// contains filtered or unexported fields
}

AdmissionController implements the external admission webhook for validation of pilot configuration.

func NewController

func NewController(client kubernetes.Interface, options ControllerOptions) (*AdmissionController, error)

NewController creates a new instance of the admission webhook controller.

func (*AdmissionController) Run

func (ac *AdmissionController) Run(stop <-chan struct{})

Run implements the admission controller run loop.

func (*AdmissionController) ServeHTTP

func (ac *AdmissionController) ServeHTTP(w http.ResponseWriter, r *http.Request)

ServeHTTP implements the external admission webhook for validating pilot configuration.

type ControllerOptions

type ControllerOptions struct {
	// Descriptor defines the list of supported configuration model
	// types for Pilot.
	Descriptor model.ConfigDescriptor

	// ExternalAdmissionWebhookName is the name of the
	// ExternalAdmissionHook which describes he external admission
	// webhook and resources and operations it applies to.
	ExternalAdmissionWebhookName string

	// ServiceName is the service name of the webhook.
	ServiceName string

	// ServiceNamespace is the namespace of the webhook service.
	ServiceNamespace string

	// ValidateNamespaces is a list of names to validate. Any
	// namespace not in this list is unconditionally validated as
	// good. This is useful when multiple validators are running in
	// the same cluster managing different sets of namespaces
	// (e.g. shared test clusters).
	ValidateNamespaces []string

	// DomainSuffix is the DNS domain suffix for Istio CRD resources,
	// e.g. cluster.local.
	DomainSuffix string

	// SecretName is the name of k8s secret that contains the webhook
	// server key/cert and corresponding CA cert that signed them. The
	// server key/cert are used to serve the webhook and the CA cert
	// is provided to k8s apiserver during admission controller
	// registration.
	SecretName string

	// Port where the webhook is served. Per k8s admission
	// registration requirements this should be 443 unless there is
	// only a single port for the service.
	Port int

	// RegistrationDelay controls how long admission registration
	// occurs after the webhook is started. This is used to avoid
	// potential races where registration completes and k8s apiserver
	// invokes the webhook before the HTTP server is started.
	RegistrationDelay time.Duration
}

ControllerOptions contains the configuration for the Istio Pilot validation admission controller.