Documentation
¶
Index ¶
- func NewClientConfig(opts ...ClientOption) *rest.Config
- func NewKineStorage(ctx context.Context, dbPath string, connArgs map[string]string, ...) (serverbuilder.StoreFn, endpoint.ETCDConfig, error)
- type ClientOption
- type Controller
- type CreateController
- type Manager
- type Option
- func WithAddToScheme(fn func(*runtime.Scheme) error) Option
- func WithAdditionalController(c CreateController) Option
- func WithAdmissionPlugin(name string, factory admission.Factory) Option
- func WithAgentIPAM(ipam tunnet.IPAM) Option
- func WithAuditLogPath(path string) Option
- func WithAuditLogRotation(maxAgeDays, maxBackups, maxSizeMB int) Option
- func WithAuditPolicyFile(path string) Option
- func WithBindAddress(address string) Option
- func WithBindPort(port int) Option
- func WithCerts(certPairName, certDir string) Option
- func WithClientConfig(cfg *rest.Config) Option
- func WithControllerNames(names ...string) Option
- func WithGCInterval(interval time.Duration) Option
- func WithInClusterAuth() Option
- func WithInMemorySQLite() Option
- func WithJWKSHost(host string) Option
- func WithJWKSPort(port int) Option
- func WithJWTKeys(publicKey, privateKey []byte) Option
- func WithJWTRefreshThreshold(threshold time.Duration) Option
- func WithKubeAPI() Option
- func WithMaxRequestsInFlight(nonMutating, mutating int) Option
- func WithOpenAPIDefinitions(getter common.GetOpenAPIDefinitions) Option
- func WithProxyIPAM(ipam tunnet.IPAM) Option
- func WithResource(obj resource.Object) Option
- func WithSQLiteConnArgs(args map[string]string) Option
- func WithSQLitePath(path string) Option
- func WithSecretStoreStorage(main, values serverapiserver.StorageProvider) Option
- func WithSecretValuesAuthz(allow secretstore.ReadAuthz) Option
- func WithSimpleAuth() Option
- func WithSkipBuiltinControllers() Option
- func WithSkipTunnelNodeIPAM() Option
- func WithSkipVPCNetworkProvisioner() Option
- func WithTokenIssuer(i token.TokenIssuer) Option
- func WithTokenValidator(v token.Validator) Option
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func NewClientConfig ¶
func NewClientConfig(opts ...ClientOption) *rest.Config
NewClientConfig returns a new local client configuration.
func NewKineStorage ¶
func NewKineStorage(ctx context.Context, dbPath string, connArgs map[string]string, logFormat string) (serverbuilder.StoreFn, endpoint.ETCDConfig, error)
NewKineStorage creates a new kine storage. dbPath is the SQLite database file path (or "file::memory:" for in-memory). connArgs are SQLite connection parameters (e.g. {"cache": "shared", "_journal_mode": "WAL"}). logFormat should be "json" for production or "plain" for development.
Types ¶
type ClientOption ¶
type ClientOption func(*clientOptions)
ClientOption is a set of options for the client.
func WithBearerToken ¶
func WithBearerToken(token string) ClientOption
WithBearerToken sets the token for the client.
func WithClientHost ¶
func WithClientHost(host string) ClientOption
WithClientHost sets the host for the client. The default host is "localhost:8443".
func WithClientTLSConfig ¶
func WithClientTLSConfig(tlsConfig rest.TLSClientConfig) ClientOption
WithClientTLSConfig sets the TLS configuration for the client. If not set, the client will use an insecure configuration.
func WithTransportWrapper ¶
func WithTransportWrapper(fn transport.WrapperFunc) ClientOption
WithTransportWrapper sets the transport wrapper for the client.
type Controller ¶
type CreateController ¶
type CreateController func(client.Client) Controller
type Manager ¶
type Manager struct {
ReadyCh chan error
// contains filtered or unexported fields
}
Manager manages APIServer instance as well as built-in controllers.
func (*Manager) Start ¶
func (m *Manager) Start( ctx context.Context, gwResources *message.ProviderResources, tc tclient.Client, opts ...Option, ) error
Start starts the API server manager with the given options and blocks forever or until the context is canceled (whichever comes first). It returns an error if the manager fails to start. The manager is ready to serve when the ReadyCh channel is closed.
type Option ¶
type Option func(*options)
Option is an API server option.
func WithAddToScheme ¶
WithAddToScheme registers additional types with the controller-runtime scheme. This must be called before Start() to ensure types are available to controllers.
func WithAdditionalController ¶
func WithAdditionalController(c CreateController) Option
WithAdditionalController adds an additional controller.
func WithAdmissionPlugin ¶
WithAdmissionPlugin registers an in-process admission plugin with the apiserver. The plugin factory is called during server startup and the resulting plugin is injected with the Apoxy SharedInformerFactory if it implements admission.WantsApoxyInformerFactory.
Plugins run inside the apiserver request chain and can perform cross-resource validation or mutation that the per-resource resourcestrategy interfaces cannot.
func WithAgentIPAM ¶
WithAgentIPAM sets the IPAM for agent.
func WithAuditLogPath ¶
WithAuditLogPath sets the file path for audit log output.
func WithAuditLogRotation ¶
WithAuditLogRotation configures lumberjack-based rotation for the audit log.
func WithAuditPolicyFile ¶
WithAuditPolicyFile sets the path to an audit policy YAML file. When set, the apiserver will emit audit events filtered by the policy.
func WithBindAddress ¶
WithBindAddress sets the secure serving bind address.
func WithBindPort ¶
WithBindPort sets the secure serving bind port.
func WithClientConfig ¶
WithClientConfig sets the client configuration.
func WithControllerNames ¶
WithControllerNames sets the GatewayClass controller names to watch for. If not set, defaults to both StandaloneControllerName and LegacyControllerName.
func WithGCInterval ¶
WithGCInterval sets the garbage collection interval.
func WithInClusterAuth ¶
func WithInClusterAuth() Option
WithInClusterAuth enables in-cluster authentication.
func WithInMemorySQLite ¶
func WithInMemorySQLite() Option
WithInMemorySQLite configures the server to use an in-memory SQLite database.
func WithJWTKeys ¶
WithJWTKeys sets the JWT key pair.
func WithJWTRefreshThreshold ¶
WithJWTRefreshThreshold sets the JWT refresh threshold.
func WithMaxRequestsInFlight ¶ added in v0.22.0
WithMaxRequestsInFlight caps the number of non-mutating and mutating requests served concurrently. Requests over the cap are rejected immediately with 429 + Retry-After instead of queueing into the backend; long-running requests (watches) are exempt. Zero leaves the corresponding generic-apiserver default (400 non-mutating / 200 mutating) in place.
This is the load-shedding backstop for kine/SQLite backends: SQLite has a single writer, so admitting more concurrent mutations than the backend can serialize just queues work into request timeouts. A fast 429 is cheaper for the server and tells well-behaved clients to back off.
func WithOpenAPIDefinitions ¶
func WithOpenAPIDefinitions(getter common.GetOpenAPIDefinitions) Option
WithOpenAPIDefinitions sets a custom OpenAPI definitions function. If not provided, the default apoxy OpenAPI definitions will be used. This is useful when registering custom resources that need their own OpenAPI schema definitions.
func WithProxyIPAM ¶
WithProxyIPAM sets the IPAM for proxy.
func WithResource ¶
WithResource registers a resource obj with APIServer. If not provided, default resource set will be used, otherwise only the provided resource will be registered.
func WithSQLiteConnArgs ¶
WithSQLiteConnArgs sets the SQLite connection arguments. The default values are:
cache=shared _journal_mode=WAL _busy_timeout=30000
func WithSQLitePath ¶
WithSQLitePath sets the path to the SQLite database. If empty, in-memory database will be used.
func WithSecretStoreStorage ¶
func WithSecretStoreStorage(main, values serverapiserver.StorageProvider) Option
WithSecretStoreStorage overrides the storage backing the SecretStore main resource and its values subresource (e.g. Kubernetes-Secret-backed storage in hosted deployments). By default both are served from the kine store with value redaction on the main resource.
func WithSecretValuesAuthz ¶
func WithSecretValuesAuthz(allow secretstore.ReadAuthz) Option
WithSecretValuesAuthz restricts reads of the secretstores/values subresource to identities accepted by allow. The default permits all reads (single-node deployments are a single-user trust domain).
func WithSkipBuiltinControllers ¶
func WithSkipBuiltinControllers() Option
WithSkipBuiltinControllers skips the built-in controllers (Proxy, TunnelNode, Gateway, etc.) and the APIService wait. Use this when you only need the apiserver functionality without the full controller set, e.g., for custom apiservers that register their own resource types.
func WithSkipTunnelNodeIPAM ¶
func WithSkipTunnelNodeIPAM() Option
WithSkipTunnelNodeIPAM disables local IPAM allocation in the TunnelNodeReconciler. Use this when agent addresses are managed externally (e.g., by an infra-apiserver Endpoint watcher that writes addresses to TunnelNode.Status.Agents).
func WithSkipVPCNetworkProvisioner ¶ added in v0.22.0
func WithSkipVPCNetworkProvisioner() Option
WithSkipVPCNetworkProvisioner disables the built-in (OSS/single-tenant) VPCNetwork provisioner. Use this when a VPCNetwork's identity and credential are assigned externally — in cloud the overlay /72 comes from an infra-tier Network object so that NetworkIDs are unique across projects, which a project-local assigner cannot guarantee. Exactly one provisioner must run: both would race to write Status.OverlayCIDR.
func WithTokenIssuer ¶
func WithTokenIssuer(i token.TokenIssuer) Option
WithTokenIssuer sets a custom token issuer for the TunnelNodeReconciler. If not set, a default Issuer will be created from the JWT private key.
func WithTokenValidator ¶
WithTokenValidator sets a custom token validator for the TunnelNodeReconciler. If not set, a default InMemoryValidator will be created from the JWT public key.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package auth contains APIServer authentication helpers.
|
Package auth contains APIServer authentication helpers. |
|
Package controllers implements Apoxy Control Plane-side controllers.
|
Package controllers implements Apoxy Control Plane-side controllers. |
|
Package extensions implements extensions controllers.
|
Package extensions implements extensions controllers. |
|
Package gateway implements Gateway API controllers.
|
Package gateway implements Gateway API controllers. |
|
Package migration holds one-shot storage migrations run at apiserver startup.
|
Package migration holds one-shot storage migrations run at apiserver startup. |
|
Package policy implements API Server policy controllers.
|
Package policy implements API Server policy controllers. |
|
Package secretstore implements the REST plumbing that makes SecretStore values write-only: a redacting wrapper that strips stored values from every main-resource response, a "values" subresource that is the single path through which values are written and (by internal identities only) read, and the authorizer gate that enforces the read restriction.
|
Package secretstore implements the REST plumbing that makes SecretStore values write-only: a redacting wrapper that strips stored values from every main-resource response, a "values" subresource that is the single path through which values are written and (by internal identities only) read, and the authorizer gate that enforces the read restriction. |
|
server
|
|