Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func CreateCerts ¶
func CreateCerts(ctx context.Context, name, namespace string) (serverKey, serverCert, caCert []byte, err error)
CreateCerts creates and returns a CA certificate and certificate and key for the server. serverKey and serverCert are used by the server to establish trust for clients, CA certificate is used by the client to verify the server authentication chain.
Types ¶
type AdmissionController ¶
type AdmissionController struct {
Client kubernetes.Interface
Options ControllerOptions
Handlers map[schema.GroupVersionKind]GenericCRD
Logger *zap.SugaredLogger
}
AdmissionController implements the external admission webhook for validation of pilot configuration.
func (*AdmissionController) Run ¶
func (ac *AdmissionController) Run(stop <-chan struct{}) error
Run implements the admission controller run loop.
func (*AdmissionController) ServeHTTP ¶
func (ac *AdmissionController) ServeHTTP(w http.ResponseWriter, r *http.Request)
ServeHTTP implements the external admission webhook for mutating serving resources.
type ControllerOptions ¶
type ControllerOptions struct {
// WebhookName is the name of the webhook we create to handle
// mutations before they get stored in the storage.
WebhookName string
// ServiceName is the service name of the webhook.
ServiceName string
// DeploymentName is the service name of the webhook.
DeploymentName string
// SecretName is the name of k8s secret that contains the webhook
// server key/cert and corresponding CA cert that signed them. The
// server key/cert are used to serve the webhook and the CA cert
// is provided to k8s apiserver during admission controller
// registration.
SecretName string
// Namespace is the namespace in which everything above lives
Namespace string
// Port where the webhook is served. Per k8s admission
// registration requirements this should be 443 unless there is
// only a single port for the service.
Port int
// RegistrationDelay controls how long admission registration
// occurs after the webhook is started. This is used to avoid
// potential races where registration completes and k8s apiserver
// invokes the webhook before the HTTP server is started.
RegistrationDelay time.Duration
// ClientAuthType declares the policy the webhook server will follow for
// TLS Client Authentication.
// The default value is tls.NoClientCert.
ClientAuth tls.ClientAuthType
}
ControllerOptions contains the configuration for the webhook
type GenericCRD ¶
type GenericCRD interface {
apis.Defaultable
apis.Validatable
runtime.Object
}
GenericCRD is the interface definition that allows us to perform the generic CRD actions like deciding whether to increment generation and so forth.
type ResourceCallback ¶
type ResourceCallback func(patches *[]jsonpatch.JsonPatchOperation, old GenericCRD, new GenericCRD) error
ResourceCallback defines a signature for resource specific (Route, Configuration, etc.) handlers that can validate and mutate an object. If non-nil error is returned, object creation is denied. Mutations should be appended to the patches operations.
func Validate ¶
func Validate(ctx context.Context) ResourceCallback
Validate checks whether "new" and "old" implement HasImmutableFields and checks them, it then delegates validation to apis.Validatable on "new".
type ResourceDefaulter ¶
type ResourceDefaulter func(patches *[]jsonpatch.JsonPatchOperation, crd GenericCRD) error
ResourceDefaulter defines a signature for resource specific (Route, Configuration, etc.) handlers that can set defaults on an object. If non-nil error is returned, object creation is denied. Mutations should be appended to the patches operations.
func SetDefaults ¶
func SetDefaults(ctx context.Context) ResourceDefaulter
SetDefaults simply leverages apis.Defaultable to set defaults.
Source Files