podbouncer

Documentation

Index

• type PodBouncer
  • func NewPodBouncer(podClient corev1client.PodClient, rootCertMatcher RootCertMatcher) PodBouncer
• type RootCertMatcher
  • func NewSecretRootCertMatcher() RootCertMatcher

Types

type PodBouncer

type PodBouncer interface {
	BouncePods(
		ctx context.Context,
		podBounceDirective *certificatesv1.PodBounceDirective,
		pods corev1sets.PodSet,
		configMaps corev1sets.ConfigMapSet,
		secrets corev1sets.SecretSet,
	) (bool, error)
}

bounce (delete) the listed pods returns true if we need to wait before proceeding to process the podBounceDirective. we must wait for the following conditions: 1. istiod control plane has come back online after it has been restarted 2. istio's root cert has been propagated to all istio-controlled namespaces for consumption by the data plane. this should cause the reconcile to end early and persist the IssuedCertificate in the Issued state

func NewPodBouncer

func NewPodBouncer(
	podClient corev1client.PodClient,
	rootCertMatcher RootCertMatcher,
) PodBouncer

type RootCertMatcher

type RootCertMatcher interface {
	MatchesRootCert(
		ctx context.Context,
		rootCert []byte,
		selector *certificatesv1.PodBounceDirectiveSpec_PodSelector,
		allSecrets corev1sets.SecretSet,
	) (matches bool, err error)
}

func NewSecretRootCertMatcher

func NewSecretRootCertMatcher() RootCertMatcher