Documentation
¶
Index ¶
- func BuildSidecarPatch(pod *corev1.Pod, sidecarImage string, extraEnv []corev1.EnvVar) ([]byte, error)
- func DeregisterWebhookConfiguration(ctx context.Context, kc kubernetes.Interface, log log.Logger)
- func RegisterWebhookConfiguration(ctx context.Context, kc kubernetes.Interface, log log.Logger, ...) error
- func ShouldInject(pod *corev1.Pod) bool
- type Config
- type Server
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func BuildSidecarPatch ¶
func BuildSidecarPatch(pod *corev1.Pod, sidecarImage string, extraEnv []corev1.EnvVar) ([]byte, error)
BuildSidecarPatch generates a JSON Patch (RFC 6902) that injects the attestation sidecar container, required volumes, and volume mounts into the pod spec.
The sidecar runs INSIDE the Kata VM (same pod, same VM as the tenant workload). It requires CAP_SYS_ADMIN for configfs mount operations within the guest kernel.
func DeregisterWebhookConfiguration ¶
DeregisterWebhookConfiguration removes the MutatingWebhookConfiguration from the cluster. Call this on shutdown to avoid dangling webhooks that block pod creation when the provider is not running.
func RegisterWebhookConfiguration ¶
func RegisterWebhookConfiguration(ctx context.Context, kc kubernetes.Interface, log log.Logger, serviceName, serviceNamespace string, caBundle []byte, webhookPort int32, webhookURL string) error
RegisterWebhookConfiguration creates or updates the MutatingWebhookConfiguration in the cluster. This tells the K8s API server to send pod CREATE requests (in Akash-managed namespaces) to our webhook for sidecar injection.
The caBundle must be PEM-encoded. When webhookURL is non-empty, it registers with a URL endpoint (for local dev). Otherwise it uses a K8s Service reference.
func ShouldInject ¶
ShouldInject returns true if the pod should have the attestation sidecar injected. Trigger conditions:
- Pod has the akash.network managed label
- Pod has a Kata CC RuntimeClassName
- Tenant has not opted out via attestation-disabled annotation
- Sidecar is not already present (idempotency)
Types ¶
type Config ¶
type Config struct {
SidecarImage string
SidecarEnv []corev1.EnvVar // additional env vars injected into the sidecar container
ListenAddr string
TLSCert tls.Certificate
Log log.Logger
}
Config holds configuration for the attestation webhook server.
type Server ¶
type Server struct {
// contains filtered or unexported fields
}
Server handles mutating admission webhook requests for attestation sidecar injection into confidential compute pods.
func NewServer ¶
NewServer creates a new attestation webhook server. Failure mode: fail-closed. A CC workload without an attestation sidecar is silently unverifiable — the tenant cannot confirm TEE execution.
func (*Server) ListenAndServeTLS ¶
ListenAndServeTLS starts the webhook HTTPS server.
Source Files