Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EgressMITMCAPoolRef ¶
func EgressMITMCAPoolRef(systemNamespace string) types.NamespacedName
EgressMITMCAPoolRef names the Secret holding the CA pool the egress gateway signs per-SNI leaves with.
Types ¶
type EgressMITMTrustReconciler ¶
type EgressMITMTrustReconciler struct {
client.Client
// SystemNamespace is the namespace holding the egress MITM CA pool Secret.
SystemNamespace string
// contains filtered or unexported fields
}
EgressMITMTrustReconciler derives a ClusterTrustBundle from the egress MITM CA pool.
func (*EgressMITMTrustReconciler) SetupWithManager ¶
func (r *EgressMITMTrustReconciler) SetupWithManager(mgr ctrl.Manager) error
type NetworkPolicyReconciler ¶
type NetworkPolicyReconciler struct {
client.Client
Scheme *runtime.Scheme
// SystemNamespace is the namespace atenet-router runs in. The generated
// ingress policy admits only that namespace, so a value that does not
// match the running router blocks every request to the worker pool.
SystemNamespace string
}
func (*NetworkPolicyReconciler) SetupWithManager ¶
func (r *NetworkPolicyReconciler) SetupWithManager(mgr ctrl.Manager) error
type SandboxConfigProtectionReconciler ¶ added in v0.5.0
type SandboxConfigProtectionReconciler struct {
client.Client
// APIReader lists WorkerPools straight from the API server. The cache
// can lag behind a pool that just started using a config, so a finalizer
// is only removed after a live list finds no user.
APIReader client.Reader
}
SandboxConfigProtectionReconciler removes the protection finalizer from a SandboxConfig that is being deleted, once no WorkerPool uses it.
func (*SandboxConfigProtectionReconciler) Reconcile ¶ added in v0.5.0
func (r *SandboxConfigProtectionReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
Reconcile decides whether one SandboxConfig can be released.
- A config that is not being deleted needs nothing.
- A config that is being deleted and still used by a WorkerPool keeps the finalizer, so it stays Terminating.
- A config that is being deleted and used by no WorkerPool loses the finalizer. The API server then finishes the delete.
A config that is still in use is not requeued. It is reconciled again when a WorkerPool that uses it changes. Every SandboxConfig is also reconciled when atecontroller starts, which releases a config whose last user went away while atecontroller was down.
func (*SandboxConfigProtectionReconciler) SetupWithManager ¶ added in v0.5.0
func (r *SandboxConfigProtectionReconciler) SetupWithManager(mgr ctrl.Manager) error
SetupWithManager registers this reconciler with mgr. The manager is the controller-runtime object that runs every controller in atecontroller. It keeps one shared cache of the Kubernetes objects the controllers watch, and it calls a controller's Reconcile when one of those objects changes.
This reconciler asks the manager for two things:
- A cache index from a SandboxConfig's name to the WorkerPools whose status uses it. usedByWorkerPool looks up users through the index instead of listing every WorkerPool.
- Reconcile calls for a SandboxConfig when it changes, which includes being marked for deletion, and for every SandboxConfig a WorkerPool's status names when that WorkerPool changes.
type WorkerPoolReconciler ¶
type WorkerPoolReconciler struct {
client.Client
Scheme *runtime.Scheme
OTelEndpoint string
// OTelMetricExportInterval is the OTEL_METRIC_EXPORT_INTERVAL propagated to
// ateom pods. Empty keeps the SDK's default.
OTelMetricExportInterval string
// OTelMetricExportTimeout is the OTEL_METRIC_EXPORT_TIMEOUT propagated to
// ateom pods. Empty keeps the SDK's default.
OTelMetricExportTimeout string
// OTelTracesSampler is the OTEL_TRACES_SAMPLER propagated to ateom pods.
// Empty keeps the ateom binary's default.
OTelTracesSampler string
// OTelTracesSamplerArg is the OTEL_TRACES_SAMPLER_ARG propagated to ateom
// pods. Ignored unless OTelTracesSampler is set.
OTelTracesSamplerArg string
// OTelLogsExporter is the OTEL_LOGS_EXPORTER propagated to ateom pods.
// Empty keeps the ateom binary's default.
OTelLogsExporter string
// SystemNamespace is the namespace substrate's control plane runs in, and
// AteletServiceAccount / RouterServiceAccount are the ServiceAccounts those
// components run as. Together they name the SPIFFE identities that atunnel
// authenticates inside each worker, which is why the ServiceAccount names
// are configuration and not constants: a deployment that prefixes
// resource names changes them.
SystemNamespace string
AteletServiceAccount string
RouterServiceAccount string
// DNSEgressPolicy is the --dns-egress-policy mode propagated to ateom pods.
DNSEgressPolicy string
// Recorder emits a Normal event each time a pool's SandboxConfig
// changes, and a Warning event when a class stops resolving.
Recorder events.EventRecorder
// APIReader reads a SandboxConfig straight from the API server, not from
// the cache. It confirms a config the pool switches to, once status has
// claimed it.
APIReader client.Reader
// contains filtered or unexported fields
}
func (*WorkerPoolReconciler) InitMetrics ¶
func (r *WorkerPoolReconciler) InitMetrics(meter metric.Meter) error
InitMetrics initializes the OpenTelemetry instruments for ate.workerpool.desired_workers and ate.workerpool.ready_workers and registers the asynchronous callback.
func (*WorkerPoolReconciler) Reconcile ¶
func (r *WorkerPoolReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
Reconcile is part of the main kubernetes reconciliation loop which aims to move the current state of the cluster closer to the desired state.
func (*WorkerPoolReconciler) SetupWithManager ¶
func (r *WorkerPoolReconciler) SetupWithManager(mgr ctrl.Manager) error
SetupWithManager registers this reconciler with mgr. The manager is the controller-runtime object that runs every controller in atecontroller. It keeps one shared cache of the Kubernetes objects the controllers watch, and it calls a controller's Reconcile when one of those objects changes. A WorkerPool is reconciled when it changes, when its Deployment changes, and when a SandboxConfig that can change its resolution changes.
Source Files