Documentation
¶
Index ¶
- func IsRequestFromClusterAdmin(req admission.Request) bool
- func IsRequestFromKubernetesGarbageCollector(req admission.Request) bool
- func NewDefaultingWebhook[T runtime.Object](scheme *runtime.Scheme, obj T, defaulter admission.Defaulter[T]) (*admission.Webhook, error)
- func RegisterDefaultingWebhook[T runtime.Object](mgr ctrl.Manager, obj T, defaulter admission.Defaulter[T]) error
- func SetupValidatingAndDefaultingWebhook[T runtime.Object](mgr ctrl.Manager, obj T, h interface{ ... }) error
- func ValidateProject(ctx context.Context, kubeClient client.Client, obj client.Object) error
- func ValidatePromotionSteps(f *field.Path, steps []kargoapi.PromotionStep) field.ErrorList
- type Config
- type IsRequestFromKargoControlplaneFn
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func IsRequestFromClusterAdmin ¶ added in v1.10.7
IsRequestFromClusterAdmin returns true when the admission request originates from a member of the system:masters group, which maps to cluster-admin privileges and is used for break-glass operations.
func IsRequestFromKubernetesGarbageCollector ¶ added in v1.10.7
IsRequestFromKubernetesGarbageCollector returns true when the admission request originates from one of the well-known Kubernetes system controllers responsible for garbage collection and namespace teardown.
func NewDefaultingWebhook ¶ added in v1.12.0
func NewDefaultingWebhook[T runtime.Object]( scheme *runtime.Scheme, obj T, defaulter admission.Defaulter[T], ) (*admission.Webhook, error)
NewDefaultingWebhook is like admission.WithDefaulter, except its patch diffs obj as marshaled before and after Default() runs, rather than the raw request against the marshaled object. This avoids spurious patches for fields that don't round-trip byte-for-byte through JSON, such as metav1.Duration ("1h" remarshals as "1h0m0s"), when Default() never touched them. See https://github.com/akuityio/akuity-platform/issues/12384.
func RegisterDefaultingWebhook ¶ added in v1.12.0
func RegisterDefaultingWebhook[T runtime.Object]( mgr ctrl.Manager, obj T, defaulter admission.Defaulter[T], ) error
RegisterDefaultingWebhook registers a mutating admission webhook for obj's type on mgr's webhook server, running defaulter's Default() method the way ctrl.NewWebhookManagedBy(mgr, obj).WithDefaulter(defaulter) would, except for how the resulting JSON patch is computed. See NewDefaultingWebhook.
Like controller-runtime's own webhook registration, this panics if called twice for the same path against the same manager, so a given obj type must only be registered once per manager.
func SetupValidatingAndDefaultingWebhook ¶ added in v1.12.0
func SetupValidatingAndDefaultingWebhook[T runtime.Object]( mgr ctrl.Manager, obj T, h interface { admission.Validator[T] admission.Defaulter[T] }, ) error
SetupValidatingAndDefaultingWebhook registers both a validating webhook and a defaulting webhook (see RegisterDefaultingWebhook) for obj's type on mgr, using h for both.
func ValidateProject ¶
func ValidatePromotionSteps ¶
Types ¶
type Config ¶
type Config struct {
// KargoNamespace is the namespace in which Kargo is installed.
KargoNamespace string `envconfig:"KARGO_NAMESPACE" required:"true"`
// RawControlplaneUserRegex is a regular expression to match the username in
// admission request to distinguish if the request is coming from controlplane.
RawControlplaneUserRegex string `envconfig:"CONTROLPLANE_USER_REGEX"`
ControlplaneUserRegex *regexp.Regexp `ignored:"true"`
// ManagementControllerUsername is the exact username (typically a service
// account name) of the management controller. This is used where only the
// management controller (not the API server or other controlplane
// components) should be permitted to act.
ManagementControllerUsername string `envconfig:"MANAGEMENT_CONTROLLER_USERNAME"`
// ExternalWebhooksServerUsername is the exact username (typically a service
// account name) of the external webhooks server. When an admission request
// originates from this subject, the "promote" verb authorization check is
// bypassed, as the external webhooks server is permitted to refresh running
// Promotions on behalf of webhook callers without holding that permission
// itself.
ExternalWebhooksServerUsername string `envconfig:"EXTERNAL_WEBHOOKS_SERVER_USERNAME"`
}
func ConfigFromEnv ¶
func ConfigFromEnv() Config
type IsRequestFromKargoControlplaneFn ¶
func IsRequestFromKargoControlplane ¶
func IsRequestFromKargoControlplane(regex *regexp.Regexp) IsRequestFromKargoControlplaneFn
Source Files
Directories