Documentation
¶
Overview ¶
Package podmutate contains the controller's pod-mutating admission webhook. It does two things on pod CREATE, mirroring Istio's sidecar injector:
- Namespace auto-injection: a pod created in a namespace labeled aether.io/managed=true is given the aether.io/managed=true POD label so the CNI meshes it — no per-pod label needed. A pod that explicitly sets aether.io/managed=false opts OUT (left unmanaged), so individual workloads (Jobs, the prober, infra) can be excluded from an otherwise-managed namespace.
- dnsConfig ndots: injects a low ndots into managed pods so a mesh FQDN (<svc>.<meshDomain>, e.g. 2 dots) is tried as an absolute name BEFORE the cluster.local search list. Without it the k8s default ndots:5 makes the resolver apply the search domains first; glibc tolerates the fall-through to the bare name, but musl (Alpine) trips on the churn and fails to resolve mesh names. ndots is opt-in (default off) alongside mesh DNS.
The webhook is wired with two rules: an objectSelector (aether.io/managed=true pods, in any namespace) and a namespaceSelector (pods in aether.io/managed=true namespaces). Both dispatch here; Handle is idempotent for either entry point.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Mutator ¶
Mutator injects dnsConfig ndots=NDots into a pod on CREATE. NDots is the dot count of <svc>.<meshDomain> (= the label count of meshDomain; 2 for aether.internal), so mesh FQDNs are resolved absolute-first while shorter k8s names keep their search behavior.
func NewMutator ¶
NewMutator builds the pod-ndots mutator.
func (*Mutator) Handle ¶
Handle reaches here for a pod matched either by the managed-pod objectSelector or the managed-namespace namespaceSelector. It (1) ensures the aether.io/managed label so the CNI meshes the pod — unless the pod explicitly opts out with aether.io/managed=false — and (2) injects ndots into managed pods. A pod that opts out is left entirely untouched. Idempotent: re-admission (or a pod that already carries the label / ndots) produces no spurious patch.
Source Files