cache

Documentation

Overview

Package cache implements a ManifestWork Executor Validator with caching capabilities. It stores the result of whether the executor has operation permission(SubjectAccessReview) on a specific resource in a 2-level cache data structure, the first-level cache is the executor key, and the second-level cache is the description (dimension) of the operated resource. At the same time, it also contains a controller, which watches the RBAC resources(role, roleBinding, clusterRole, clusterRoleBinding) related to the executors used by the ManifestWorks in the cluster, and refresh the cache results of the corresponding executor when these RBAC resources have any changes.

Index

• Variables
• func NewExecutorCacheController(ctx context.Context, recorder events.Recorder, ...) factory.Controller
• func NewExecutorCacheValidator(ctx context.Context, recorder events.Recorder, ...) *sarCacheValidator
• type CacheController
• type SubjectAccessReviewCheckFn

Variables

var (
	ResyncInterval = 10 * time.Minute
)

Functions

func NewExecutorCacheController

func NewExecutorCacheController(
	ctx context.Context,
	recorder events.Recorder,
	crbInformer rbacv1.ClusterRoleBindingInformer,
	rbInformer rbacv1.RoleBindingInformer,
	crInformer rbacv1.ClusterRoleInformer,
	rInformer rbacv1.RoleInformer,
	manifestWorkExecutorCachesLoader manifestWorkExecutorCachesLoader,
	executorCaches *store.ExecutorCaches,
	sarCheckerFn SubjectAccessReviewCheckFn,
) factory.Controller

NewExecutorCacheController returns an ExecutorCacheController, the controller will watch all the RBAC resources(role, rolebinding, clusterrole, clusterrolebinding) related to the executors used by the manifestworks, and update the caches of the corresponding executor when the RBAC resources change

func NewExecutorCacheValidator

func NewExecutorCacheValidator(
	ctx context.Context,
	recorder events.Recorder,
	spokeKubeClient kubernetes.Interface,
	manifestWorkLister worklister.ManifestWorkNamespaceLister,
	restMapper meta.RESTMapper,
	validator *basic.SarValidator,
) *sarCacheValidator

NewExecutorCacheValidator creates a sarCacheValidator

Types

type CacheController

type CacheController struct {
	// contains filtered or unexported fields
}

CacheController is to refresh the executor auth result for manfiestwork workloads on the spoke cluster.

type SubjectAccessReviewCheckFn

type SubjectAccessReviewCheckFn func(ctx context.Context, executor *workapiv1.ManifestWorkSubjectServiceAccount,
	gvr schema.GroupVersionResource, namespace, name string, ownedByTheWork bool) error

SubjectAccessReviewCheckFn is a function to checks if the executor has permission to operate the gvr resource by subjectaccessreview