Documentation
¶
Overview ¶
Package kubeconfig resolves and safety-checks a source-cluster kubeconfig held in a Secret, shared by the watch data plane's SourceClusterResolver and the GitTarget controller's Validated gate so both apply exactly one contract: Flux's value→value.yaml key order, and a REJECT — not Flux's silent strip — of exec auth providers and insecure-skip-tls-verify.
It depends only on client-go's clientcmd (which this repo already has) and never dials: the safety check is a few lines over the parsed kubeconfig, deliberately not a Flux import.
Index ¶
Constants ¶
const ( // ReasonSecretNotFound: spec.kubeConfig.secretRef names a Secret that does not exist. ReasonSecretNotFound = "KubeConfigSecretNotFound" // ReasonKeyNotFound: the Secret exists but has no kubeconfig under the resolved key. ReasonKeyNotFound = "KubeConfigKeyNotFound" // ReasonInvalid: the bytes are not a parseable kubeconfig. ReasonInvalid = "KubeConfigInvalid" // ReasonExecNotAllowed: the kubeconfig carries an exec auth provider (runs a binary in // the operator Pod) and --insecure-kubeconfig-exec is not set. ReasonExecNotAllowed = "KubeConfigExecNotAllowed" // ReasonInsecureTLSNotAllowed: the kubeconfig sets insecure-skip-tls-verify and // --insecure-kubeconfig-tls is not set. ReasonInsecureTLSNotAllowed = "KubeConfigInsecureTLSNotAllowed" // ReasonFileReferenceNotAllowed: the kubeconfig names a credential or CA by file PATH // (tokenFile, client-certificate, client-key, or certificate-authority) instead of embedding // it. client-go reads those paths from the operator Pod's OWN filesystem when it builds the // REST config, so an operator-supplied (attacker-adjacent) kubeconfig could point at in-Pod // Secrets and ship them to a remote API server it names. Always rejected — there is no safe // opt-in, unlike exec/insecure-TLS: require the embedded *-data (or inline token) forms. ReasonFileReferenceNotAllowed = "KubeConfigFileReferenceNotAllowed" )
Reason strings map one-to-one onto the GitTarget Validated=False reasons the controller reports and the e2e plan asserts. They live here so the resolver's errors and the controller's condition reasons can never drift.
Variables ¶
This section is empty.
Functions ¶
func BuildRESTConfig ¶
func BuildRESTConfig(raw []byte, policy SafetyPolicy) (*rest.Config, error)
BuildRESTConfig parses raw kubeconfig bytes, applies the safety policy, and returns the rest.Config to reach the cluster. It is the resolver's one call: parse → reject-unsafe → build. A *RejectionError is returned (as error) when the bytes are unusable, so the caller can surface the same typed reason the controller's Validated gate does. It never dials.
func ResolveKey ¶
ResolveKey selects the kubeconfig bytes from a Secret's data, following Flux's order: an explicit spec key wins; otherwise "value" then "value.yaml". ok is false when no candidate key holds a non-empty value — the caller reports ReasonKeyNotFound. usedKey is the key the bytes came from, for legible messages.
Types ¶
type RejectionError ¶
RejectionError is a typed, legible reason a kubeconfig was not accepted. It carries both the stable Reason (for a condition) and a human Message (for its text).
func AsRejection ¶
func AsRejection(err error) (*RejectionError, bool)
AsRejection extracts the *RejectionError from an error chain, so a caller can read the typed Reason. It returns false for any other error.
func Check ¶
func Check(raw []byte, policy SafetyPolicy) *RejectionError
Check parses raw kubeconfig bytes and applies the safety policy WITHOUT dialing. A nil return means the kubeconfig is well-formed and permitted; a non-nil *RejectionError names exactly which input was wrong (Invalid / ExecNotAllowed / InsecureTLSNotAllowed).
func (*RejectionError) Error ¶
func (r *RejectionError) Error() string
Error implements error so a RejectionError can flow through the resolver's error return.
type SafetyPolicy ¶
type SafetyPolicy struct {
// AllowExec permits exec auth providers (--insecure-kubeconfig-exec).
AllowExec bool
// AllowInsecureTLS permits insecure-skip-tls-verify (--insecure-kubeconfig-tls).
AllowInsecureTLS bool
}
SafetyPolicy is the operator's opt-in to the two footguns this package rejects by default. Both default to false — the safe posture, diverging from Flux's silent strip.
Source Files