apiserver

Documentation

Index

• Constants
• Variables
• func Authn(perm string, w http.ResponseWriter, r *http.Request) (string, error)
• func BasicAuthCheck(username, password string) bool
• func BasicAuthzCheck(username, perm string) bool
• func ConnectToKube()
• func CreateRMDataTask(clusterName, replicaName, taskName string, ...) error
• func FindStandbyClusters(clusterList crv1.PgclusterList) (standbyClusters []string)
• func GetBackrestStorageTypes() []string
• func GetNamespace(clientset kubernetes.Interface, username, requestedNS string) (string, error)
• func Initialize()
• func InitializePerms()
• func IsValidPVC(pvcName, ns string) bool
• func IsValidStorageName(name string) bool
• func NamespaceOperatingMode() ns.NamespaceOperatingMode
• func NewCertEnforcer(reqRoutes []string) (*certEnforcer, error)
• func PGClusterListHasStandby(clusterList crv1.PgclusterList) (bool, []string)
• func UserIsPermittedInNamespace(username, requestedNS string) (bool, bool, error)
• func ValidateLabel(labelStr string) (map[string]string, error)
• func ValidateNodeLabel(nodeLabel string) error
• func ValidateQuantity(quantity string) error
• func ValidateResourceRequestLimit(request, limit string, defaultQuantity resource.Quantity) error
• func WriteTLSCert(certPath, keyPath string) error
• type CredentialDetail

Constants

const (
	// ErrMessageLimitInvalid indicates that a limit is lower than the request
	ErrMessageLimitInvalid = `limit %q is lower than the request %q`
	// ErrMessagePVCSize provides a standard error message when a PVCSize is not
	// specified to the Kubernetes stnadard
	ErrMessagePVCSize = `could not parse PVC size "%s": %s (hint: try a value like "1Gi")`
	// ErrMessageReplicas provides a standard error message when the count of
	// replicas is incorrect
	ErrMessageReplicas = `must have at least %d replica(s)`
)

const (
	// MISC
	APPLY_POLICY_PERM = "ApplyPolicy"
	CAT_PERM          = "Cat"
	CLONE_PERM        = "Clone"
	DF_CLUSTER_PERM   = "DfCluster"
	LABEL_PERM        = "Label"
	LOAD_PERM         = "Load"
	RELOAD_PERM       = "Reload"
	RESTART_PERM      = "Restart"
	RESTORE_PERM      = "Restore"
	STATUS_PERM       = "Status"
	TEST_CLUSTER_PERM = "TestCluster"
	VERSION_PERM      = "Version"

	// CREATE
	CREATE_BACKUP_PERM    = "CreateBackup"
	CREATE_CLUSTER_PERM   = "CreateCluster"
	CREATE_DUMP_PERM      = "CreateDump"
	CREATE_FAILOVER_PERM  = "CreateFailover"
	CREATE_NAMESPACE_PERM = "CreateNamespace"
	CREATE_PGADMIN_PERM   = "CreatePgAdmin"
	CREATE_PGBOUNCER_PERM = "CreatePgbouncer"
	CREATE_PGOUSER_PERM   = "CreatePgouser"
	CREATE_PGOROLE_PERM   = "CreatePgorole"
	CREATE_POLICY_PERM    = "CreatePolicy"
	CREATE_SCHEDULE_PERM  = "CreateSchedule"
	CREATE_UPGRADE_PERM   = "CreateUpgrade"
	CREATE_USER_PERM      = "CreateUser"

	// RESTORE
	RESTORE_DUMP_PERM = "RestoreDump"

	// DELETE
	DELETE_BACKUP_PERM    = "DeleteBackup"
	DELETE_CLUSTER_PERM   = "DeleteCluster"
	DELETE_NAMESPACE_PERM = "DeleteNamespace"
	DELETE_PGADMIN_PERM   = "DeletePgAdmin"
	DELETE_PGBOUNCER_PERM = "DeletePgbouncer"
	DELETE_PGOROLE_PERM   = "DeletePgorole"
	DELETE_PGOUSER_PERM   = "DeletePgouser"
	DELETE_POLICY_PERM    = "DeletePolicy"
	DELETE_SCHEDULE_PERM  = "DeleteSchedule"
	DELETE_USER_PERM      = "DeleteUser"

	// SHOW
	SHOW_BACKUP_PERM          = "ShowBackup"
	SHOW_CLUSTER_PERM         = "ShowCluster"
	SHOW_CONFIG_PERM          = "ShowConfig"
	SHOW_NAMESPACE_PERM       = "ShowNamespace"
	SHOW_PGADMIN_PERM         = "ShowPgAdmin"
	SHOW_PGBOUNCER_PERM       = "ShowPgBouncer"
	SHOW_PGOROLE_PERM         = "ShowPgorole"
	SHOW_PGOUSER_PERM         = "ShowPgouser"
	SHOW_POLICY_PERM          = "ShowPolicy"
	SHOW_PVC_PERM             = "ShowPVC"
	SHOW_SCHEDULE_PERM        = "ShowSchedule"
	SHOW_SECRETS_PERM         = "ShowSecrets"
	SHOW_SYSTEM_ACCOUNTS_PERM = "ShowSystemAccounts"
	SHOW_USER_PERM            = "ShowUser"
	SHOW_WORKFLOW_PERM        = "ShowWorkflow"

	// SCALE
	SCALE_CLUSTER_PERM = "ScaleCluster"

	// UPDATE
	UPDATE_CLUSTER_PERM   = "UpdateCluster"
	UPDATE_NAMESPACE_PERM = "UpdateNamespace"
	UPDATE_PGBOUNCER_PERM = "UpdatePgBouncer"
	UPDATE_PGOROLE_PERM   = "UpdatePgorole"
	UPDATE_PGOUSER_PERM   = "UpdatePgouser"
	UPDATE_USER_PERM      = "UpdateUser"
)

The below constants contains the "apiserver RBAC permissions" -- this was reorganized to make it...slightly more organized as we continue to evole the system

const PGOSecretName = "pgo.tls"

const TreeBranch = "├── "

TreeBranch is for debugging only in this context

const TreeTrunk = "└── "

TreeTrunk is for debugging only in this context

const VERSION_MISMATCH_ERROR = "pgo client and server version mismatch"

Variables

var (

	// ErrDBContainerNotFound is an error that indicates that a "database" container
	// could not be found in a specific pod
	ErrDBContainerNotFound = errors.New("\"database\" container not found in pod")
	// ErrLabelInvalid indicates that a label is invalid
	ErrLabelInvalid = errors.New("invalid label")
	// ErrStandbyNotAllowed contains the error message returned when an API call is not
	// permitted because it involves a cluster that is in standby mode
	ErrStandbyNotAllowed = errors.New("Action not permitted because standby mode is enabled")

	// ErrMethodNotAllowed represents the error that is thrown when a feature is disabled within the
	// current Operator install
	ErrMethodNotAllowed = errors.New("This method has is not allowed in the current PostgreSQL " +
		"Operator installation")
)

var (
	// PGOClientset is a client for PostgreSQL Operator resources
	PGOClientset pgov1.Interface
	// Clientset is a client for native Kubernetes resources
	Clientset kubernetes.Interface
	// RESTConfig holds the REST configuration for a Kube client
	RESTConfig *rest.Config
	// RESTClient is a REST client for the Kubernetes API
	RESTClient *rest.RESTClient
)

var AuditFlag bool

AuditFlag if set to true will cause auditing to occur in the logs

var BasicAuth bool

BasicAuth comes from the apiserver config

var CRUNCHY_DEBUG bool

var DebugFlag bool

DebugFlag is the debug flag value

var InstallationName string

var MetricsFlag, BadgerFlag bool

MetricsFlag if set to true will cause crunchy-collect to be added into new clusters

var PermMap map[string]string

var Pgo config.PgoConfig

var PgoNamespace string

Namespace comes from the apiserver config in this version

var RoleMap map[string]map[string]string

Functions

func Authn

func Authn(perm string, w http.ResponseWriter, r *http.Request) (string, error)

Authn performs HTTP Basic Authentication against a user if "BasicAuth" is set to "true" (which it is by default).

...it also performs Authorization (Authz) against the user that is attempting to authenticate, and as such, to truly "authenticate/authorize," one needs at least a valid Operator User account.

func BasicAuthCheck

func BasicAuthCheck(username, password string) bool

func BasicAuthzCheck

func BasicAuthzCheck(username, perm string) bool

func ConnectToKube

func ConnectToKube()

ConnectToKube ...

func CreateRMDataTask

func CreateRMDataTask(clusterName, replicaName, taskName string, deleteBackups, deleteData, isReplica, isBackup bool, ns, clusterPGHAScope string) error

func FindStandbyClusters

func FindStandbyClusters(clusterList crv1.PgclusterList) (standbyClusters []string)

FindStandbyClusters takes a list of pgcluster structs and returns a slice containing the names of those clusters that are in standby mode as indicated by whether or not the standby prameter in the pgcluster spec is true.

func GetBackrestStorageTypes

func GetBackrestStorageTypes() []string

func GetNamespace

func GetNamespace(clientset kubernetes.Interface, username, requestedNS string) (string, error)

GetNamespace determines if a user has permission for a namespace they are requesting a valid requested namespace is required

func Initialize

func Initialize()

func InitializePerms

func InitializePerms()

func IsValidPVC

func IsValidPVC(pvcName, ns string) bool

IsValidPVC determines if a PVC with the name provided exits

func IsValidStorageName

func IsValidStorageName(name string) bool

func NamespaceOperatingMode

func NamespaceOperatingMode() ns.NamespaceOperatingMode

NamespaceOperatingMode returns the namespace operating mode for the current Operator installation, which is stored in the "namespaceOperatingMode" variable

func NewCertEnforcer

func NewCertEnforcer(reqRoutes []string) (*certEnforcer, error)

NewCertEnforcer ensures a certEnforcer is created with skipped routes and validates that the configured routes are allowed

func PGClusterListHasStandby

func PGClusterListHasStandby(clusterList crv1.PgclusterList) (bool, []string)

PGClusterListHasStandby determines if a PgclusterList has any standby clusters, specifically returning "true" if one or more standby clusters exist, along with a slice of strings containing the names of the clusters in standby mode

func UserIsPermittedInNamespace

func UserIsPermittedInNamespace(username, requestedNS string) (bool, bool, error)

UserIsPermittedInNamespace returns installation access and user access. Installation access means a namespace belongs to this Operator installation. User access means this user has access to a namespace.

func ValidateLabel

func ValidateLabel(labelStr string) (map[string]string, error)

ValidateLabel is derived from a legacy method and validates if the input is a valid Kubernetes label.

A label is composed of a key and value.

The key can either be a name or have an optional prefix that i terminated by a "/", e.g. "prefix/name"

The name must be a valid DNS 1123 value THe prefix must be a valid DNS 1123 subdomain

The value can be validated by machinery provided by Kubenretes

Ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/

func ValidateNodeLabel

func ValidateNodeLabel(nodeLabel string) error

ValidateNodeLabel returns error if node label is invalid based on format

func ValidateQuantity

func ValidateQuantity(quantity string) error

ValidateQuantity runs the Kubernetes "ParseQuantity" function on a string and determine whether or not it is a valid quantity object. Returns an error if it is invalid, along with the error message.

If it is empty, it returns no error

See: https://github.com/kubernetes/apimachinery/blob/master/pkg/api/resource/quantity.go

func ValidateResourceRequestLimit

func ValidateResourceRequestLimit(request, limit string, defaultQuantity resource.Quantity) error

ValidateResourceRequestLimit validates that a Kubernetes Requests/Limit pair is valid, both by validating the values are valid quantity values, and then by checking that the limit >= request. This also needs to check against the configured values for a request, which must be provided as a value

func WriteTLSCert

func WriteTLSCert(certPath, keyPath string) error

WriteTLSCert is a legacy method that writes the server certificate and key to files from the PGOSecretName secret or generates a new key (writing to both the secret and the expected files

Types

type CredentialDetail

type CredentialDetail struct {
	Username   string
	Password   string
	Role       string
	Namespaces []string
}