filters

Documentation

Overview

Package filters contains all the http handler chain filters which _are_ api related, i.e. which are prerequisite for the API services to work (in contrast to the filters in the server package which are not part of the API contract).

Index

• func GetAuthorizerAttributes(ctx context.Context) (authorizer.Attributes, error)
• func Unauthorized(s runtime.NegotiatedSerializer) http.Handler
• func WithAudit(handler http.Handler, sink audit.Sink, policy policy.Checker, ...) http.Handler
• func WithAuditAnnotations(handler http.Handler, sink audit.Sink, policy policy.Checker) http.Handler
• func WithAuditID(handler http.Handler) http.Handler
• func WithAuthentication(handler http.Handler, auth authenticator.Request, failed http.Handler, ...) http.Handler
• func WithAuthorization(handler http.Handler, a authorizer.Authorizer, s runtime.NegotiatedSerializer) http.Handler
• func WithCacheControl(handler http.Handler) http.Handler
• func WithFailedAuthenticationAudit(failedHandler http.Handler, sink audit.Sink, policy policy.Checker) http.Handler
• func WithImpersonation(handler http.Handler, a authorizer.Authorizer, s runtime.NegotiatedSerializer) http.Handler
• func WithRequestDeadline(handler http.Handler, sink audit.Sink, policy policy.Checker, ...) http.Handler
• func WithRequestInfo(handler http.Handler, resolver request.RequestInfoResolver) http.Handler
• func WithRequestReceivedTimestamp(handler http.Handler) http.Handler
• func WithStorageVersionPrecondition(handler http.Handler, svm storageversion.Manager, ...) http.Handler
• func WithTracing(handler http.Handler, tp *trace.TracerProvider) http.Handler
• func WithWarningRecorder(handler http.Handler) http.Handler

Functions

func GetAuthorizerAttributes

func GetAuthorizerAttributes(ctx context.Context) (authorizer.Attributes, error)

func Unauthorized

func Unauthorized(s runtime.NegotiatedSerializer) http.Handler

func WithAudit

func WithAudit(handler http.Handler, sink audit.Sink, policy policy.Checker, longRunningCheck request.LongRunningRequestCheck) http.Handler

WithAudit decorates a http.Handler with audit logging information for all the requests coming to the server. Audit level is decided according to requests' attributes and audit policy. Logs are emitted to the audit sink to process events. If sink or audit policy is nil, no decoration takes place.

func WithAuditAnnotations

func WithAuditAnnotations(handler http.Handler, sink audit.Sink, policy policy.Checker) http.Handler

WithAuditAnnotations decorates a http.Handler with a []{key, value} that is merged with the audit.Event.Annotations map. This allows layers that run before WithAudit (such as authentication) to assert annotations. If sink or audit policy is nil, no decoration takes place.

func WithAuditID

func WithAuditID(handler http.Handler) http.Handler

WithAuditID attaches the Audit-ID associated with a request to the context.

a. If the caller does not specify a value for Audit-ID in the request header, we generate a new audit ID b. We echo the Audit-ID value to the caller via the response Header 'Audit-ID'.

func WithAuthentication

func WithAuthentication(handler http.Handler, auth authenticator.Request, failed http.Handler, apiAuds authenticator.Audiences) http.Handler

WithAuthentication creates an http handler that tries to authenticate the given request as a user, and then stores any such user found onto the provided context for the request. If authentication fails or returns an error the failed handler is used. On success, "Authorization" header is removed from the request and handler is invoked to serve the request.

func WithAuthorization

func WithAuthorization(handler http.Handler, a authorizer.Authorizer, s runtime.NegotiatedSerializer) http.Handler

WithAuthorizationCheck passes all authorized requests on to handler, and returns a forbidden error otherwise.

func WithCacheControl

func WithCacheControl(handler http.Handler) http.Handler

WithCacheControl sets the Cache-Control header to "no-cache, private" because all servers are protected by authn/authz. see https://developers.google.com/web/fundamentals/performance/optimizing-content-efficiency/http-caching#defining_optimal_cache-control_policy

func WithFailedAuthenticationAudit

func WithFailedAuthenticationAudit(failedHandler http.Handler, sink audit.Sink, policy policy.Checker) http.Handler

WithFailedAuthenticationAudit decorates a failed http.Handler used in WithAuthentication handler. It is meant to log only failed authentication requests.

func WithImpersonation

func WithImpersonation(handler http.Handler, a authorizer.Authorizer, s runtime.NegotiatedSerializer) http.Handler

WithImpersonation is a filter that will inspect and check requests that attempt to change the user.Info for their requests

func WithRequestDeadline

func WithRequestDeadline(handler http.Handler, sink audit.Sink, policy policy.Checker, longRunning request.LongRunningRequestCheck,
	negotiatedSerializer runtime.NegotiatedSerializer, requestTimeoutMaximum time.Duration) http.Handler

WithRequestDeadline determines the timeout duration applicable to the given request and sets a new context with the appropriate deadline. auditWrapper provides an http.Handler that audits a failed request. longRunning returns true if he given request is a long running request. requestTimeoutMaximum specifies the default request timeout value.

func WithRequestInfo

func WithRequestInfo(handler http.Handler, resolver request.RequestInfoResolver) http.Handler

WithRequestInfo attaches a RequestInfo to the context.

func WithRequestReceivedTimestamp

func WithRequestReceivedTimestamp(handler http.Handler) http.Handler

WithRequestReceivedTimestamp attaches the ReceivedTimestamp (the time the request reached the apiserver) to the context.

func WithStorageVersionPrecondition

func WithStorageVersionPrecondition(handler http.Handler, svm storageversion.Manager, s runtime.NegotiatedSerializer) http.Handler

WithStorageVersionPrecondition checks if the storage version barrier has completed, if not, it only passes the following API requests: 1. non-resource requests, 2. read requests, 3. write requests to the storageversion API, 4. create requests to the namespace API sent by apiserver itself, 5. write requests to the lease API in kube-system namespace, 6. resources whose StorageVersion is not pending update, including non-persisted resources.

func WithTracing

func WithTracing(handler http.Handler, tp *trace.TracerProvider) http.Handler

WithTracing adds tracing to requests if the incoming request is sampled

func WithWarningRecorder

func WithWarningRecorder(handler http.Handler) http.Handler

WithWarningRecorder attaches a deduplicating k8s.io/apiserver/pkg/warning#WarningRecorder to the request context.