origin

package
v3.6.0-alpha.0+incompa... Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Mar 21, 2017 License: Apache-2.0 Imports: 280 Imported by: 0

Documentation

Overview

Package origin provides objects for creating an OpenShift Origin server

Index

Constants

View Source 
const (
	OpenShiftOAuthAPIPrefix = "/oauth"

	OpenShiftApprovePrefix       = "/oauth/approve"
	OpenShiftOAuthCallbackPrefix = "/oauth2callback"
	OpenShiftWebConsoleClientID  = "openshift-web-console"
	OpenShiftBrowserClientID     = "openshift-browser-client"
	OpenShiftCLIClientID         = "openshift-challenging-client"
)

Variables

View Source 
var (

	// KubeAdmissionPlugins gives the in-order default admission chain for kube resources.
	KubeAdmissionPlugins = []string{
		lifecycle.PluginName,
		"RunOnceDuration",
		"PodNodeConstraints",
		"OriginPodNodeEnvironment",
		"PodNodeSelector",
		overrideapi.PluginName,
		serviceadmit.ExternalIPPluginName,
		serviceadmit.RestrictedEndpointsPluginName,
		imagepolicy.PluginName,
		"ImagePolicyWebhook",
		"LimitRanger",
		"ServiceAccount",
		"SecurityContextConstraint",
		storageclassdefaultadmission.PluginName,
		"AlwaysPullImages",
		"LimitPodHardAntiAffinityTopology",
		"SCCExecRestrictions",
		"PersistentVolumeLabel",
		"OwnerReferencesPermissionEnforcement",
		ingressadmission.IngressAdmission,

		quotaadmission.PluginName,
		"openshift.io/ClusterResourceQuota",
	}

	// CombinedAdmissionControlPlugins gives the in-order default admission chain for all resources resources.
	// When possible, this list is used.  The set of openshift+kube chains must exactly match this set.  In addition,
	// the order specified in the openshift and kube chains must match the order here.
	CombinedAdmissionControlPlugins = []string{
		lifecycle.PluginName,
		"ProjectRequestLimit",
		"OriginNamespaceLifecycle",
		"openshift.io/RestrictSubjectBindings",
		"PodNodeConstraints",
		"openshift.io/JenkinsBootstrapper",
		"openshift.io/BuildConfigSecretInjector",
		"BuildByStrategy",
		imageadmission.PluginName,
		"RunOnceDuration",
		"PodNodeConstraints",
		"OriginPodNodeEnvironment",
		"PodNodeSelector",
		overrideapi.PluginName,
		serviceadmit.ExternalIPPluginName,
		serviceadmit.RestrictedEndpointsPluginName,
		imagepolicy.PluginName,
		"ImagePolicyWebhook",
		"LimitRanger",
		"ServiceAccount",
		"SecurityContextConstraint",
		storageclassdefaultadmission.PluginName,
		"AlwaysPullImages",
		"LimitPodHardAntiAffinityTopology",
		"SCCExecRestrictions",
		"PersistentVolumeLabel",
		"OwnerReferencesPermissionEnforcement",
		ingressadmission.IngressAdmission,

		quotaadmission.PluginName,
		"openshift.io/ClusterResourceQuota",
	}
)

Functions

func CreateOrUpdateDefaultOAuthClients added in v0.2.1 

func CreateOrUpdateDefaultOAuthClients(masterPublicAddr string, assetPublicAddresses []string, clientRegistry clientregistry.Registry) error

func OpenShiftOAuthAuthorizeURL added in v0.2.2 

func OpenShiftOAuthAuthorizeURL(masterAddr string) string

func OpenShiftOAuthTokenRequestURL added in v0.4.4 

func OpenShiftOAuthTokenRequestURL(masterAddr string) string

func OpenShiftOAuthTokenURL added in v0.2.2 

func OpenShiftOAuthTokenURL(masterAddr string) string

func WithAssetServerRedirect 

func WithAssetServerRedirect(handler http.Handler, assetPublicURL string) http.Handler

If we know the location of the asset server, redirect to it when / is requested and the Accept header supports text/html

func WithPatternsHandler 

func WithPatternsHandler(handler http.Handler, patternHandler http.Handler, patterns ...string) http.Handler

Types

type AssetConfig added in v0.4.2 

type AssetConfig struct {
	Options               oapi.AssetConfig
	LimitRequestOverrides *api.ClusterResourceOverrideConfig
}

AssetConfig defines the required parameters for starting the OpenShift master

func NewAssetConfig added in v1.1.3 

func NewAssetConfig(options oapi.AssetConfig, limitRequestOverrides *api.ClusterResourceOverrideConfig) (*AssetConfig, error)

NewAssetConfig returns a new AssetConfig

func (*AssetConfig) Run added in v0.4.2 

func (c *AssetConfig) Run()

Run starts an http server for the static assets listening on the configured bind address

func (*AssetConfig) WithAssets 

func (c *AssetConfig) WithAssets(handler http.Handler) (http.Handler, error)

WithAssets decorates a handler by serving static assets for the subpath of the public URL and passing through all other requests to the given handler.

type AuthConfig 

type AuthConfig struct {
	Options configapi.OAuthConfig

	// AssetPublicAddresses contains valid redirectURI prefixes to direct browsers to the web console
	AssetPublicAddresses []string

	// KubeClient is kubeclient with enough permission for the auth API
	KubeClient kclientset.Interface

	// OpenShiftClient is osclient with enough permission for the auth API
	OpenShiftClient osclient.Interface

	// RESTOptionsGetter provides storage and RESTOption lookup
	RESTOptionsGetter restoptions.Getter

	// EtcdBackends is a list of storage interfaces, each of which talks to a single etcd backend.
	// These are only used to ensure newly created tokens are distributed to all backends before returning them for use.
	// EtcdHelper should normally be used for storage functions.
	EtcdBackends []storage.Interface

	UserRegistry     userregistry.Registry
	IdentityRegistry identityregistry.Registry

	SessionAuth *session.Authenticator

	HandlerWrapper handlerWrapper
}

func BuildAuthConfig added in v0.4.2 

func BuildAuthConfig(masterConfig *MasterConfig) (*AuthConfig, error)

func (*AuthConfig) NewOpenShiftOAuthClientConfig added in v0.2.1 

func (c *AuthConfig) NewOpenShiftOAuthClientConfig(client *oauthapi.OAuthClient) *osincli.ClientConfig

NewOpenShiftOAuthClientConfig provides config for OpenShift OAuth client

func (*AuthConfig) WithOAuth 

func (c *AuthConfig) WithOAuth(handler http.Handler) (http.Handler, error)

WithOAuth decorates the given handler by serving the OAuth2 endpoints while passing through all other requests to the given handler.

type MasterConfig 

type MasterConfig struct {
	Options configapi.MasterConfig

	// RESTOptionsGetter provides access to storage and RESTOptions for a particular resource
	RESTOptionsGetter restoptions.Getter

	RuleResolver   rulevalidation.AuthorizationRuleResolver
	Authenticator  authenticator.Request
	Authorizer     kauthorizer.Authorizer
	SubjectLocator authorizer.SubjectLocator

	// TODO(sttts): replace AuthorizationAttributeBuilder with kapiserverfilters.NewRequestAttributeGetter
	AuthorizationAttributeBuilder authorizer.AuthorizationAttributeBuilder

	GroupCache                    *usercache.GroupCache
	ProjectAuthorizationCache     *projectauth.AuthorizationCache
	ProjectCache                  *projectcache.ProjectCache
	ClusterQuotaMappingController *clusterquotamapping.ClusterQuotaMappingController
	LimitVerifier                 imageadmission.LimitVerifier

	// RequestContextMapper maps requests to contexts
	RequestContextMapper kapi.RequestContextMapper

	AdmissionControl admission.Interface

	// KubeAdmissionControl holds the kube admission chain.  Because of the way the plugin initializer is built
	// you'll be passing information in this direction either way.  Knowing how to build this chain requires knowledge
	// of both the origin config AND the kube config, so this spot makes more sense.
	KubeAdmissionControl admission.Interface

	TLS bool

	ControllerPlug      plug.Plug
	ControllerPlugStart func()

	// ImageFor is a function that returns the appropriate image to use for a named component
	ImageFor func(component string) string
	// RegistryNameFn retrieves the name of the integrated registry, or false if no such registry
	// is available.
	RegistryNameFn imageapi.DefaultRegistryFunc

	// ExternalVersionCodec is the codec used when serializing annotations, which cannot be changed
	// without all clients being aware of the new version.
	ExternalVersionCodec runtime.Codec

	KubeletClientConfig *kubeletclient.KubeletClientConfig

	// ClientCAs will be used to request client certificates in connections to the API.
	// This CertPool should contain all the CAs that will be used for client certificate verification.
	ClientCAs *x509.CertPool
	// APIClientCAs is used to verify client certificates presented for API auth
	APIClientCAs *x509.CertPool

	// PrivilegedLoopbackClientConfig is the client configuration used to call OpenShift APIs from system components
	// To apply different access control to a system component, create a client config specifically for that component.
	PrivilegedLoopbackClientConfig restclient.Config

	// PrivilegedLoopbackKubernetesClientset is the client used to call Kubernetes APIs from system components,
	// built from KubeClientConfig. It should only be accessed via the *Client() helper methods. To apply
	// different access control to a system component, create a separate client/config specifically for
	// that component.
	PrivilegedLoopbackKubernetesClientset *kclientset.Clientset
	// PrivilegedLoopbackOpenShiftClient is the client used to call OpenShift APIs from system components,
	// built from PrivilegedLoopbackClientConfig. It should only be accessed via the *Client() helper methods.
	// To apply different access control to a system component, create a separate client/config specifically
	// for that component.
	PrivilegedLoopbackOpenShiftClient *osclient.Client

	// Informers is a shared factory for getting SharedInformers. It is important to get your informers, indexers, and listers
	// from here so that we only end up with a single cache of objects
	Informers shared.InformerFactory
}

MasterConfig defines the required parameters for starting the OpenShift master

func BuildMasterConfig added in v0.3.3 

func BuildMasterConfig(options configapi.MasterConfig) (*MasterConfig, error)

BuildMasterConfig builds and returns the OpenShift master configuration based on the provided options

func (*MasterConfig) BuildConfigChangeControllerClients added in v1.0.5 

func (c *MasterConfig) BuildConfigChangeControllerClients() (*osclient.Client, *kclientset.Clientset)

BuildConfigChangeControllerClients returns the build config change controller client objects

func (*MasterConfig) BuildConfigWebHookClient added in v0.6.1 

func (c *MasterConfig) BuildConfigWebHookClient() *osclient.Client

BuildConfigWebHookClient returns the webhook client object

func (*MasterConfig) BuildControllerClients added in v0.2.1 

func (c *MasterConfig) BuildControllerClients() (*osclient.Client, *kclientset.Clientset)

BuildControllerClients returns the build controller client objects

func (*MasterConfig) BuildImageChangeTriggerControllerClients added in v0.6.1 

func (c *MasterConfig) BuildImageChangeTriggerControllerClients() (*osclient.Client, *kclientset.Clientset)

BuildImageChangeTriggerControllerClients returns the build image change trigger controller client objects

func (*MasterConfig) BuildLogClient added in v0.2.1 

func (c *MasterConfig) BuildLogClient() *kclientset.Clientset

BuildLogClient returns the build log client object

func (*MasterConfig) BuildPodControllerClients added in v0.6.1 

func (c *MasterConfig) BuildPodControllerClients() (*osclient.Client, *kclientset.Clientset)

BuildPodControllerClients returns the build pod controller client objects

func (*MasterConfig) ClientCARegistrationHook 

func (c *MasterConfig) ClientCARegistrationHook() (*master.ClientCARegistrationHook, error)

func (*MasterConfig) DNSServerClient added in v0.4.2 

func (c *MasterConfig) DNSServerClient() *kclientset.Clientset

DNSServerClient returns the DNS server client object It must have the following capabilities: 

list, watch all services in all namespaces

func (*MasterConfig) DeploymentClient added in v0.2.1 

func (c *MasterConfig) DeploymentClient() *kclientset.Clientset

DeploymentClient returns the deployment client object

func (*MasterConfig) DeploymentConfigClients added in v1.0.7 

func (c *MasterConfig) DeploymentConfigClients() (*osclient.Client, *kclientset.Clientset)

DeploymentConfigClients returns deploymentConfig and deployment client objects

func (*MasterConfig) DeploymentConfigControllerClients added in v0.2.1 

func (c *MasterConfig) DeploymentConfigControllerClients() (*osclient.Client, *kclientset.Clientset)

DeploymentConfigControllerClients returns the deploymentConfig controller client objects

func (*MasterConfig) DeploymentConfigInstantiateClients added in v1.4.0 

func (c *MasterConfig) DeploymentConfigInstantiateClients() (*osclient.Client, *kclientset.Clientset)

DeploymentConfigInstantiateClients returns the clients used by the instantiate endpoint.

func (*MasterConfig) DeploymentControllerClients added in v0.2.1 

func (c *MasterConfig) DeploymentControllerClients() (*osclient.Client, *kclientset.Clientset)

DeploymentControllerClients returns the deployment controller client objects

func (*MasterConfig) DeploymentLogClient added in v1.0.7 

func (c *MasterConfig) DeploymentLogClient() *kclientset.Clientset

DeploymentLogClient returns the deployment log client object

func (*MasterConfig) DeploymentTriggerControllerClient added in v1.4.0 

func (c *MasterConfig) DeploymentTriggerControllerClient() *osclient.Client

DeploymentTriggerControllerClient returns the deploymentConfig trigger controller client object

func (*MasterConfig) GetRestStorage added in v0.6.1 

func (c *MasterConfig) GetRestStorage() map[unversioned.GroupVersion]map[string]rest.Storage

func (*MasterConfig) GetServiceAccountClients added in v0.6.1 

func (c *MasterConfig) GetServiceAccountClients(name string) (*restclient.Config, *osclient.Client, *kclientset.Clientset, error)

GetServiceAccountClients returns an OpenShift and Kubernetes client with the credentials of the named service account in the infra namespace

func (*MasterConfig) GetServiceAccountClientsWithConfig 

func (c *MasterConfig) GetServiceAccountClientsWithConfig(name string, config restclient.Config) (*restclient.Config, *osclient.Client, *kclientset.Clientset, error)

func (*MasterConfig) ImageChangeControllerClient added in v0.2.1 

func (c *MasterConfig) ImageChangeControllerClient() *osclient.Client

ImageChangeControllerClient returns the openshift client object

func (*MasterConfig) ImageImportControllerClient added in v0.4.2 

func (c *MasterConfig) ImageImportControllerClient() *osclient.Client

ImageImportControllerClient returns the deployment client object

func (*MasterConfig) ImageStreamImportSecretClient added in v1.1.2 

func (c *MasterConfig) ImageStreamImportSecretClient() *osclient.Client

ImageStreamImportSecretClient returns the client capable of retrieving image secrets for a namespace

func (*MasterConfig) ImageStreamSecretClient added in v1.1.2 

func (c *MasterConfig) ImageStreamSecretClient() *kclientset.Clientset

ImageStreamSecretClient returns the client capable of retrieving secrets for an image secret wrapper

func (*MasterConfig) InitializeObjects added in v1.0.5 

func (c *MasterConfig) InitializeObjects()

InitializeObjects ensures objects in Kubernetes and etcd are properly populated. Requires a Kube client to be established and that etcd be started.

func (*MasterConfig) InstallProtectedAPI added in v0.2.2 

func (c *MasterConfig) InstallProtectedAPI(apiserver *genericapiserver.GenericAPIServer) ([]string, error)

func (*MasterConfig) KubeClientset 

func (c *MasterConfig) KubeClientset() *kclientset.Clientset

KubeClientset returns the kubernetes client object

func (*MasterConfig) OAuthServerClients added in v1.4.0 

func (c *MasterConfig) OAuthServerClients() (*osclient.Client, *kclientset.Clientset)

OAuthServerClients returns the openshift and kubernetes OAuth server client objects The returned clients are privileged

func (*MasterConfig) OriginNamespaceControllerClients added in v0.4.2 

func (c *MasterConfig) OriginNamespaceControllerClients() (*osclient.Client, *kclientset.Clientset)

OriginNamespaceControllerClients returns a client for openshift and kubernetes. The openshift client object must have authority to delete openshift content in any namespace The kubernetes client object must have authority to execute a finalize request on a namespace

func (*MasterConfig) PolicyClient added in v0.3.2 

func (c *MasterConfig) PolicyClient() *osclient.Client

PolicyClient returns the policy client object It must have the following capabilities: 

list, watch all policyBindings in all namespaces
list, watch all policies in all namespaces
create resourceAccessReviews in all namespaces

func (*MasterConfig) ResourceQuotaManagerClients added in v1.1.4 

func (c *MasterConfig) ResourceQuotaManagerClients() (*osclient.Client, *kclientset.Clientset)

ResourceQuotaManagerClients returns the client capable of retrieving resources needed for resource quota evaluation

func (*MasterConfig) RouteAllocator added in v0.4.2 

func (c *MasterConfig) RouteAllocator() *routeallocationcontroller.RouteAllocationController

RouteAllocator returns a route allocation controller.

func (*MasterConfig) RouteAllocatorClients added in v0.6.1 

func (c *MasterConfig) RouteAllocatorClients() (*osclient.Client, *kclientset.Clientset)

RouteAllocatorClients returns the route allocator client objects

func (*MasterConfig) Run added in v0.2.1 

func (c *MasterConfig) Run(kc *kubernetes.MasterConfig, assetConfig *AssetConfig)

Run launches the OpenShift master by creating a kubernetes master, installing OpenShift APIs into it and then running it.

func (*MasterConfig) RunAssetServer 

func (c *MasterConfig) RunAssetServer()

RunAssetServer starts the asset server for the OpenShift UI.

func (*MasterConfig) RunBuildConfigChangeController added in v1.0.5 

func (c *MasterConfig) RunBuildConfigChangeController()

RunBuildConfigChangeController starts the build config change trigger controller process.

func (*MasterConfig) RunBuildController 

func (c *MasterConfig) RunBuildController(informers shared.InformerFactory) error

RunBuildController starts the build sync loop for builds and buildConfig processing.

func (*MasterConfig) RunBuildImageChangeTriggerController added in v0.2.1 

func (c *MasterConfig) RunBuildImageChangeTriggerController()

RunBuildImageChangeTriggerController starts the build image change trigger controller process.

func (*MasterConfig) RunBuildPodController added in v0.4.1 

func (c *MasterConfig) RunBuildPodController()

RunBuildPodController starts the build/pod status sync loop for build status

func (*MasterConfig) RunClusterQuotaMappingController added in v1.3.0 

func (c *MasterConfig) RunClusterQuotaMappingController()

func (*MasterConfig) RunClusterQuotaReconciliationController added in v1.3.0 

func (c *MasterConfig) RunClusterQuotaReconciliationController()

func (*MasterConfig) RunDNSServer added in v0.4.2 

func (c *MasterConfig) RunDNSServer()

RunDNSServer starts the DNS server

func (*MasterConfig) RunDeploymentConfigController 

func (c *MasterConfig) RunDeploymentConfigController()

RunDeploymentConfigController starts the deployment config controller process.

func (*MasterConfig) RunDeploymentController added in v0.2.1 

func (c *MasterConfig) RunDeploymentController()

RunDeploymentController starts the deployment controller process.

func (*MasterConfig) RunDeploymentTriggerController added in v1.3.0 

func (c *MasterConfig) RunDeploymentTriggerController()

RunDeploymentTriggerController starts the deployment trigger controller process.

func (*MasterConfig) RunGroupCache added in v1.0.5 

func (c *MasterConfig) RunGroupCache()

RunGroupCache starts the group cache

func (*MasterConfig) RunHealth added in v1.0.5 

func (c *MasterConfig) RunHealth() error

func (*MasterConfig) RunImageImportController added in v0.4.2 

func (c *MasterConfig) RunImageImportController()

RunImageImportController starts the image import trigger controller process.

func (*MasterConfig) RunIngressIPController added in v1.3.0 

func (c *MasterConfig) RunIngressIPController(client *kclientset.Clientset)

RunIngressIPController starts the ingress ip controller if IngressIPNetworkCIDR is configured.

func (*MasterConfig) RunOriginNamespaceController added in v0.4.2 

func (c *MasterConfig) RunOriginNamespaceController()

RunOriginNamespaceController starts the controller that takes part in namespace termination of openshift content

func (*MasterConfig) RunProjectAuthorizationCache added in v0.3.2 

func (c *MasterConfig) RunProjectAuthorizationCache()

RunProjectAuthorizationCache starts the project authorization cache

func (*MasterConfig) RunProjectCache added in v0.5.1 

func (c *MasterConfig) RunProjectCache()

RunProjectCache populates project cache, used by scheduler and project admission controller.

func (*MasterConfig) RunResourceQuotaManager added in v1.1.4 

func (c *MasterConfig) RunResourceQuotaManager(cm *cmapp.CMServer)

RunResourceQuotaManager starts resource quota controller for OpenShift resources

func (*MasterConfig) RunSDNController added in v0.5.2 

func (c *MasterConfig) RunSDNController()

RunSDNController runs openshift-sdn if the said network plugin is provided

func (*MasterConfig) RunSecurityAllocationController added in v0.5.4 

func (c *MasterConfig) RunSecurityAllocationController()

RunSecurityAllocationController starts the security allocation controller process.

func (*MasterConfig) RunServiceAccountPullSecretsControllers added in v0.5.4 

func (c *MasterConfig) RunServiceAccountPullSecretsControllers()

RunServiceAccountPullSecretsControllers starts the service account pull secret controllers

func (*MasterConfig) RunServiceAccountTokensController added in v0.5.3 

func (c *MasterConfig) RunServiceAccountTokensController(cm *cmapp.CMServer)

RunServiceAccountTokensController starts the service account token controller

func (*MasterConfig) RunServiceAccountsController added in v0.5.3 

func (c *MasterConfig) RunServiceAccountsController()

RunServiceAccountsController starts the service account controller

func (*MasterConfig) RunServiceServingCertController added in v1.3.0 

func (c *MasterConfig) RunServiceServingCertController(client *kclientset.Clientset)

func (*MasterConfig) RunUnidlingController added in v1.3.0 

func (c *MasterConfig) RunUnidlingController()

RunUnidlingController starts the unidling controller

func (*MasterConfig) SDNControllerClients added in v0.6.1 

func (c *MasterConfig) SDNControllerClients() (*osclient.Client, *kclientset.Clientset)

SDNControllerClients returns the SDN controller client objects

func (*MasterConfig) SdnClient added in v0.5.2 

func (c *MasterConfig) SdnClient() *osclient.Client

SdnClient returns the sdn client object It must have the capability to get/list/watch/create/delete HostSubnets. And have the capability to get ClusterNetwork.

func (*MasterConfig) SecurityAllocationControllerClient added in v0.6.1 

func (c *MasterConfig) SecurityAllocationControllerClient() *kclientset.Clientset

SecurityAllocationControllerClient returns the security allocation controller client object

func (*MasterConfig) ServiceAccountRoleBindingClient added in v0.5.4 

func (c *MasterConfig) ServiceAccountRoleBindingClient() *osclient.Client

ServiceAccountRoleBindingClient returns the client object used to bind roles to service accounts It must have the following capabilities: 

get, list, update, create policyBindings and clusterPolicyBindings in all namespaces

func (*MasterConfig) UnidlingControllerClients added in v1.3.0 

func (c *MasterConfig) UnidlingControllerClients() (*osclient.Client, *kclientset.Clientset)

UnidlingControllerClients returns the unidling controller clients

func (*MasterConfig) WebConsoleEnabled added in v1.0.5 

func (c *MasterConfig) WebConsoleEnabled() bool

WebConsoleEnabled says whether web ui is not a disabled feature and asset service is configured.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.