apiserver

package
v0.21.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 30, 2026 License: AGPL-3.0 Imports: 89 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func NewClientConfig 

func NewClientConfig(opts ...ClientOption) *rest.Config

NewClientConfig returns a new local client configuration.

func NewKineStorage 

func NewKineStorage(ctx context.Context, dbPath string, connArgs map[string]string, logFormat string) (serverbuilder.StoreFn, endpoint.ETCDConfig, error)

NewKineStorage creates a new kine storage. dbPath is the SQLite database file path (or "file::memory:" for in-memory). connArgs are SQLite connection parameters (e.g. {"cache": "shared", "_journal_mode": "WAL"}). logFormat should be "json" for production or "plain" for development.

Types

type ClientOption 

type ClientOption func(*clientOptions)

ClientOption is a set of options for the client.

func WithBearerToken 

func WithBearerToken(token string) ClientOption

WithBearerToken sets the token for the client.

func WithClientHost 

func WithClientHost(host string) ClientOption

WithClientHost sets the host for the client. The default host is "localhost:8443".

func WithClientTLSConfig 

func WithClientTLSConfig(tlsConfig rest.TLSClientConfig) ClientOption

WithClientTLSConfig sets the TLS configuration for the client. If not set, the client will use an insecure configuration.

func WithTransportWrapper 

func WithTransportWrapper(fn transport.WrapperFunc) ClientOption

WithTransportWrapper sets the transport wrapper for the client.

type Controller 

type Controller interface {
	SetupWithManager(ctx context.Context, mgr ctrl.Manager) error
	Reconcile(ctx context.Context, request reconcile.Request) (ctrl.Result, error)
}

type CreateController 

type CreateController func(client.Client) Controller

type Manager 

type Manager struct {
	ReadyCh chan error
	// contains filtered or unexported fields
}

Manager manages APIServer instance as well as built-in controllers.

func New 

func New() *Manager

New creates a new API server manager.

func (*Manager) Start 

func (m *Manager) Start(
	ctx context.Context,
	gwResources *message.ProviderResources,
	tc tclient.Client,
	opts ...Option,
) error

Start starts the API server manager with the given options and blocks forever or until the context is canceled (whichever comes first). It returns an error if the manager fails to start. The manager is ready to serve when the ReadyCh channel is closed.

type Option 

type Option func(*options)

Option is an API server option.

func WithAddToScheme 

func WithAddToScheme(fn func(*runtime.Scheme) error) Option

WithAddToScheme registers additional types with the controller-runtime scheme. This must be called before Start() to ensure types are available to controllers.

func WithAdditionalController 

func WithAdditionalController(c CreateController) Option

WithAdditionalController adds an additional controller.

func WithAdmissionPlugin 

func WithAdmissionPlugin(name string, factory admission.Factory) Option

WithAdmissionPlugin registers an in-process admission plugin with the apiserver. The plugin factory is called during server startup and the resulting plugin is injected with the Apoxy SharedInformerFactory if it implements admission.WantsApoxyInformerFactory.

Plugins run inside the apiserver request chain and can perform cross-resource validation or mutation that the per-resource resourcestrategy interfaces cannot.

func WithAgentIPAM 

func WithAgentIPAM(ipam tunnet.IPAM) Option

WithAgentIPAM sets the IPAM for agent.

func WithAuditLogPath 

func WithAuditLogPath(path string) Option

WithAuditLogPath sets the file path for audit log output.

func WithAuditLogRotation 

func WithAuditLogRotation(maxAgeDays, maxBackups, maxSizeMB int) Option

WithAuditLogRotation configures lumberjack-based rotation for the audit log.

func WithAuditPolicyFile 

func WithAuditPolicyFile(path string) Option

WithAuditPolicyFile sets the path to an audit policy YAML file. When set, the apiserver will emit audit events filtered by the policy.

func WithBindAddress 

func WithBindAddress(address string) Option

WithBindAddress sets the secure serving bind address.

func WithBindPort 

func WithBindPort(port int) Option

WithBindPort sets the secure serving bind port.

func WithCerts 

func WithCerts(certPairName, certDir string) Option

WithCerts sets the certificate pair name and directory.

func WithClientConfig 

func WithClientConfig(cfg *rest.Config) Option

WithClientConfig sets the client configuration.

func WithControllerNames 

func WithControllerNames(names ...string) Option

WithControllerNames sets the GatewayClass controller names to watch for. If not set, defaults to both StandaloneControllerName and LegacyControllerName.

func WithGCInterval 

func WithGCInterval(interval time.Duration) Option

WithGCInterval sets the garbage collection interval.

func WithInClusterAuth 

func WithInClusterAuth() Option

WithInClusterAuth enables in-cluster authentication.

func WithInMemorySQLite 

func WithInMemorySQLite() Option

WithInMemorySQLite configures the server to use an in-memory SQLite database.

func WithJWKSHost 

func WithJWKSHost(host string) Option

WithJWKSHost sets the JWKS host.

func WithJWKSPort 

func WithJWKSPort(port int) Option

WithJWKSPort sets the JWKS port.

func WithJWTKeys 

func WithJWTKeys(publicKey, privateKey []byte) Option

WithJWTKeys sets the JWT key pair.

func WithJWTRefreshThreshold 

func WithJWTRefreshThreshold(threshold time.Duration) Option

WithJWTRefreshThreshold sets the JWT refresh threshold.

func WithKubeAPI 

func WithKubeAPI() Option

WithKubeAPI enables the Kubernetes API.

func WithOpenAPIDefinitions 

func WithOpenAPIDefinitions(getter common.GetOpenAPIDefinitions) Option

WithOpenAPIDefinitions sets a custom OpenAPI definitions function. If not provided, the default apoxy OpenAPI definitions will be used. This is useful when registering custom resources that need their own OpenAPI schema definitions.

func WithProxyIPAM 

func WithProxyIPAM(ipam tunnet.IPAM) Option

WithProxyIPAM sets the IPAM for proxy.

func WithResource 

func WithResource(obj resource.Object) Option

WithResource registers a resource obj with APIServer. If not provided, default resource set will be used, otherwise only the provided resource will be registered.

func WithSQLiteConnArgs 

func WithSQLiteConnArgs(args map[string]string) Option

WithSQLiteConnArgs sets the SQLite connection arguments. The default values are: 

cache=shared
_journal_mode=WAL
_busy_timeout=30000

func WithSQLitePath 

func WithSQLitePath(path string) Option

WithSQLitePath sets the path to the SQLite database. If empty, in-memory database will be used.

func WithSecretStoreStorage 

func WithSecretStoreStorage(main, values serverapiserver.StorageProvider) Option

WithSecretStoreStorage overrides the storage backing the SecretStore main resource and its values subresource (e.g. Kubernetes-Secret-backed storage in hosted deployments). By default both are served from the kine store with value redaction on the main resource.

func WithSecretValuesAuthz 

func WithSecretValuesAuthz(allow secretstore.ReadAuthz) Option

WithSecretValuesAuthz restricts reads of the secretstores/values subresource to identities accepted by allow. The default permits all reads (single-node deployments are a single-user trust domain).

func WithSimpleAuth 

func WithSimpleAuth() Option

WithSimpleAuth enables authentication.

func WithSkipBuiltinControllers 

func WithSkipBuiltinControllers() Option

WithSkipBuiltinControllers skips the built-in controllers (Proxy, TunnelNode, Gateway, etc.) and the APIService wait. Use this when you only need the apiserver functionality without the full controller set, e.g., for custom apiservers that register their own resource types.

func WithSkipTunnelNodeIPAM 

func WithSkipTunnelNodeIPAM() Option

WithSkipTunnelNodeIPAM disables local IPAM allocation in the TunnelNodeReconciler. Use this when agent addresses are managed externally (e.g., by an infra-apiserver Endpoint watcher that writes addresses to TunnelNode.Status.Agents).

func WithTokenIssuer 

func WithTokenIssuer(i token.TokenIssuer) Option

WithTokenIssuer sets a custom token issuer for the TunnelNodeReconciler. If not set, a default Issuer will be created from the JWT private key.

func WithTokenValidator 

func WithTokenValidator(v token.Validator) Option

WithTokenValidator sets a custom token validator for the TunnelNodeReconciler. If not set, a default InMemoryValidator will be created from the JWT public key.

Source Files

View all Source files

Directories

Path Synopsis
Package auth contains APIServer authentication helpers.
 Package auth contains APIServer authentication helpers.
Package controllers implements Apoxy Control Plane-side controllers.
 Package controllers implements Apoxy Control Plane-side controllers.
Package extensions implements extensions controllers.
 Package extensions implements extensions controllers.
Package gateway implements Gateway API controllers.
 Package gateway implements Gateway API controllers.
Package migration holds one-shot storage migrations run at apiserver startup.
 Package migration holds one-shot storage migrations run at apiserver startup.
Package policy implements API Server policy controllers.
 Package policy implements API Server policy controllers.
Package secretstore implements the REST plumbing that makes SecretStore values write-only: a redacting wrapper that strips stored values from every main-resource response, a "values" subresource that is the single path through which values are written and (by internal identities only) read, and the authorizer gate that enforces the read restriction.
 Package secretstore implements the REST plumbing that makes SecretStore values write-only: a redacting wrapper that strips stored values from every main-resource response, a "values" subresource that is the single path through which values are written and (by internal identities only) read, and the authorizer gate that enforces the read restriction.
server
apiserver
builder
start

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.