Documentation
¶
Overview ¶
Package meshconfig hosts the MeshConfig CRD machinery that runs in the aether-controller: a validating admission webhook (protovalidate) and a reconciler that projects the singleton MeshConfig custom resource into the ConfigMap the agent consumes. It works against the typed MeshConfig object (api/aether/config/v1), not unstructured. See docs/proposals/015_mesh-config.md.
Index ¶
Constants ¶
const ( // SingletonName is the only MeshConfig name the controller acts on; the CRD // is a cluster-scoped singleton. SingletonName = "default" // ConfigMapKey is the key under which the projected config is written. ConfigMapKey = "mesh-config.yaml" // DefaultMeshConfigMapName is the ConfigMap the reconciler projects into and // that the agent mounts. DefaultMeshConfigMapName = "aether-mesh-config" )
Variables ¶
This section is empty.
Functions ¶
func RenderConfigMapData ¶
func RenderConfigMapData(spec *configv1.MeshConfigSpec) (map[string]string, error)
RenderConfigMapData serializes a MeshConfig spec to the YAML document the agent loads, returning the ConfigMap `data` map. A nil spec renders an empty document (the agent then inherits everything from the aether config).
func Validate ¶
func Validate(spec *configv1.MeshConfigSpec) error
Validate runs protovalidate on a MeshConfig spec. A nil spec (the proxy inherits everything from the aether config) is valid.
Types ¶
type CABundleInjector ¶
type CABundleInjector struct {
Client client.Client
Source *spire.Source
WebhookConfigName string
// MutatingWebhookConfigName is the pod-ndots MutatingWebhookConfiguration to
// keep in sync too; empty skips it.
MutatingWebhookConfigName string
Log *slog.Logger
}
CABundleInjector keeps the validating webhook's caBundle in sync with the SPIRE trust bundle. The webhook is served with a SPIRE X.509 SVID, so the kube-apiserver must trust the SPIRE CA — this runnable writes the current bundle into the ValidatingWebhookConfiguration on startup and on every SVID rotation. It runs on the leader only (a cluster-wide single writer).
func (*CABundleInjector) NeedLeaderElection ¶
func (i *CABundleInjector) NeedLeaderElection() bool
NeedLeaderElection keeps caBundle writes to a single replica.
type Reconciler ¶
type Reconciler struct {
client.Client
ConfigMapName string
FallbackNamespace string
Log *slog.Logger
}
Reconciler projects each namespace's MeshConfig CR into a ConfigMap in that SAME namespace (co-located), which the agent/edge in that namespace mount. MeshConfig is namespaced: a namespace's `default` CR overrides the FallbackNamespace (aether-system) MeshConfig field-by-field, so a namespace inherits the mesh-wide config unless it sets its own. It re-validates with protovalidate before writing, so an invalid CR that slipped past the (best-effort) webhook never overwrites the last-good ConfigMap — the failure surfaces on the CR's status instead.
func (*Reconciler) Reconcile ¶
func (r *Reconciler) Reconcile(ctx context.Context, req reconcile.Request) (reconcile.Result, error)
Reconcile validates a namespace's effective MeshConfig and upserts the co-located ConfigMap. A validation failure is recorded on the CR status and does not return an error (retrying wouldn't help an invalid spec).
func (*Reconciler) SetupWithManager ¶
func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error
SetupWithManager registers the reconciler. A change to a namespace's MeshConfig re-projects that namespace (For); a change to the FallbackNamespace MeshConfig re-projects every inheriting namespace (the fan-out map func).
type Validator ¶
Validator is an admission webhook that rejects MeshConfig resources whose spec fails protovalidate — the same check the agent's file loader and the reconciler run, so a CR can never describe a config the binaries would refuse to load. It is served by the controller's shared /validate dispatcher (see controller/internal/webhook), keyed by the MeshConfig Kind.
Source Files