k8ssat

Documentation

Index

• func BuiltIn() catalog.BuiltIn
• type AttestorConfig
• type AttestorPlugin
  • func New() *AttestorPlugin
  • func (p *AttestorPlugin) Attest(stream nodeattestorv1.NodeAttestor_AttestServer) error
  • func (p *AttestorPlugin) Configure(ctx context.Context, req *configv1.ConfigureRequest) (*configv1.ConfigureResponse, error)
  • func (p *AttestorPlugin) SetLogger(log hclog.Logger)
• type ClusterConfig

Functions

func BuiltIn

func BuiltIn() catalog.BuiltIn

Types

type AttestorConfig

type AttestorConfig struct {
	Clusters map[string]*ClusterConfig `hcl:"clusters"`
}

type AttestorPlugin

type AttestorPlugin struct {
	nodeattestorbase.Base
	nodeattestorv1.UnsafeNodeAttestorServer
	configv1.UnsafeConfigServer
	// contains filtered or unexported fields
}

func New

func New() *AttestorPlugin

func (*AttestorPlugin) Attest

func (p *AttestorPlugin) Attest(stream nodeattestorv1.NodeAttestor_AttestServer) error

func (*AttestorPlugin) Configure

func (p *AttestorPlugin) Configure(ctx context.Context, req *configv1.ConfigureRequest) (*configv1.ConfigureResponse, error)

func (*AttestorPlugin) SetLogger

func (p *AttestorPlugin) SetLogger(log hclog.Logger)

SetLogger sets up plugin logging

type ClusterConfig

type ClusterConfig struct {
	// Path on disk to a PEM encoded file containing public keys used in validating tokens for that cluster
	// If use_token_review_api_validation is true, then this path is ignored and TokenReview API is used for validation
	ServiceAccountKeyFile string `hcl:"service_account_key_file"`

	// ServiceAccountAllowList is a list of service account names, qualified by
	// namespace (for example, "default:blog" or "production:web") to allow for node attestation
	ServiceAccountAllowList []string `hcl:"service_account_allow_list"`

	// UseTokenReviewAPI
	//   If true token review API will be used for token validation
	//   If false ServiceAccountKeyFile will be used for token validation
	UseTokenReviewAPI bool `hcl:"use_token_review_api_validation"`

	// Kubernetes configuration file path
	// Used to create a client to query the Kubernetes API server. If string is empty, in-cluster configuration is used
	KubeConfigFile string `hcl:"kube_config_file"`
}