Documentation
¶
Index ¶
- func GenerateClientAuthCertificateForTest(commonName string) ([]byte, []byte, []byte, error)
- type NodeSiteResolver
- type Server
- func (s *Server) GetClientCAs() *x509.CertPool
- func (s *Server) IsTrustedAggregatedRequest(r *http.Request) bool
- func (s *Server) Mux() *http.ServeMux
- func (s *Server) RefreshAggregatedClientCAs(ctx context.Context)
- func (s *Server) RegisterHandlers(ctx context.Context)
- func (s *Server) SetNodeSiteResolver(resolver NodeSiteResolver)
- type Validator
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type NodeSiteResolver ¶ added in v0.9.0
NodeSiteResolver provides site matching without allocating pod CIDRs.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server is a handler registrar for validating and mutating admission webhooks plus aggregated API discovery endpoints. It does not own an HTTP server or manage TLS certificates -- callers register its handlers on an externally-managed mux and serve it with their own TLS configuration.
func NewServer ¶
func NewServer(clientset kubernetes.Interface, restConfig *rest.Config, namespace string) (*Server, error)
NewServer creates a webhook handler registrar. It does not start any HTTP server; call RegisterHandlers to wire routes onto the internal mux and then serve the mux externally.
func NewTestServer ¶
func NewTestServer(clientset kubernetes.Interface, namespace string) *Server
NewTestServer creates a minimal Server for use in tests outside the webhook package. It does not require a rest.Config and wires no validator.
func (*Server) GetClientCAs ¶
GetClientCAs returns the front-proxy client CA pool so callers can set it on the unified TLS server's ClientCAs. The returned pool may be nil if the extension-apiserver-authentication ConfigMap has not been loaded yet.
func (*Server) IsTrustedAggregatedRequest ¶
IsTrustedAggregatedRequest validates that aggregated API requests arrive with a verified client certificate signed by the cluster front-proxy CA.
func (*Server) Mux ¶
Mux returns the HTTP mux so external code can register handlers on the webhook TLS server before it starts.
func (*Server) RefreshAggregatedClientCAs ¶
RefreshAggregatedClientCAs reloads the front-proxy client CA bundle from the extension-apiserver-authentication ConfigMap in kube-system.
func (*Server) RegisterHandlers ¶
RegisterHandlers registers the webhook and aggregated discovery handlers on the internal mux and starts a background goroutine that periodically refreshes the front-proxy client CA bundle. It does not start an HTTP server.
func (*Server) SetNodeSiteResolver ¶ added in v0.9.0
func (s *Server) SetNodeSiteResolver(resolver NodeSiteResolver)
SetNodeSiteResolver sets the site resolver used by the mutating webhook.
Source Files