hooks

package
v1.76.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 1, 2026 License: Apache-2.0 Imports: 44 Imported by: 0

Documentation

Overview

Code generated by "tools/audit_policy.go" DO NOT EDIT.

reconcile_kubeadm_cluster_admins_binding is the SINGLE SOURCE OF TRUTH for ClusterRoleBinding kubeadm:cluster-admins reconciliation. It evaluates three independent signals:

  1. user-authz module is enabled (module.IsEnabled / global.enabledModules);
  2. the cluster has finished its first bootstrap (global.clusterIsBootstrapped);
  3. ClusterRole user-authz:cluster-admin is observed in the API right now.

Only when all three are true the binding flips to user-authz:cluster-admin; otherwise it stays on cluster-admin (kubeadm-default wildcard). The supplement (extra ClusterRole bound to the same kubeadm:cluster-admins group) is enabled while user-authz is on (single gate).

The hook publishes its decision into Helm values so templates/rbac-for-us.yaml renders verbatim and does NOT re-evaluate the gates: 

controlPlaneManager.internal.kubeadmClusterAdminsTargetRoleName  string
controlPlaneManager.internal.kubeadmClusterAdminsSupplementEnabled bool

Why a hook is needed at all: ClusterRoleBinding.roleRef is immutable in Kubernetes RBAC, Helm SSA cannot mutate it. We Delete+Create via PatchCollector on OnBeforeHelm, before Helm runs. On a failed Create after Delete the next reconcile (CRB delete-event or OnBeforeHelm tick) hits the create-only path and self-heals.

Index

Constants

This section is empty.

Variables

View Source 
var DefaultKubernetesVersion = "<autogenerated on the build stage>"

This value is set on the controller build in the deckhouse-controller/go-build.sh script. Do not touch it !!!

View Source 
var FeatureGatesMap = map[string]ComponentFeatures{
	"1.31": {
		Deprecated: []string{
			"AllowDNSOnlyNodeCSR",
			"AllowInsecureKubeletCertificateSigningRequests",
			"DisableNodeKubeProxyVersion",
		},
		Kubelet: []string{
			"ConcurrentWatchObjectDecode",
			"ImageVolume",
			"InPlacePodVerticalScaling",
			"KubeletPodResourcesGet",
			"MemoryQoS",
			"MutatingAdmissionPolicy",
			"ResourceHealthStatus",
			"SELinuxMount",
			"RecoverVolumeExpansionFailure",
		},
		APIServer: []string{
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"HPAScaleToZero",
			"ImageVolume",
			"InPlacePodVerticalScaling",
			"JobManagedBy",
			"MaxUnavailableStatefulSet",
			"MutatingAdmissionPolicy",
			"ProcMountType",
			"ResourceHealthStatus",
			"SELinuxMount",
			"AuthorizeNodeWithSelectors",
			"AuthorizeWithSelectors",
			"DisableAllocatorDualWrite",
			"OrderedNamespaceDeletion",
			"RecoverVolumeExpansionFailure",
			"RelaxedEnvironmentVariableValidation",
			"StrictCostEnforcementForVAP",
			"StrictCostEnforcementForWebhooks",
		},
		KubeControllerManager: []string{
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"InPlacePodVerticalScaling",
			"JobManagedBy",
			"MaxUnavailableStatefulSet",
			"SELinuxMount",
			"RecoverVolumeExpansionFailure",
		},
		KubeScheduler: []string{
			"ConcurrentWatchObjectDecode",
			"InPlacePodVerticalScaling",
			"SchedulerQueueingHints",
		},
	},
	"1.32": {
		Deprecated: []string{
			"DisableNodeKubeProxyVersion",
		},
		Kubelet: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ImageVolume",
			"InPlacePodVerticalScaling",
			"KubeletPodResourcesGet",
			"MemoryQoS",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"ResourceHealthStatus",
			"SELinuxMount",
			"InPlacePodVerticalScalingAllocatedStatus",
		},
		APIServer: []string{
			"AllowUnsafeMalformedObjectDeletion",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"HPAScaleToZero",
			"ImageVolume",
			"InPlacePodVerticalScaling",
			"MaxUnavailableStatefulSet",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"ProcMountType",
			"ResourceHealthStatus",
			"SELinuxChangePolicy",
			"SELinuxMount",
			"DisableAllocatorDualWrite",
			"InPlacePodVerticalScalingAllocatedStatus",
			"OrderedNamespaceDeletion",
			"PodLifecycleSleepActionAllowZero",
			"RelaxedDNSSearchValidation",
		},
		KubeControllerManager: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"InPlacePodVerticalScaling",
			"MaxUnavailableStatefulSet",
			"SELinuxChangePolicy",
			"SELinuxMount",
		},
		KubeScheduler: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"InPlacePodVerticalScaling",
			"SchedulerAsyncPreemption",
		},
	},
	"1.33": {
		Deprecated: []string{
			"DisableNodeKubeProxyVersion",
			"GitRepoVolumeDriver",
			"InPlacePodVerticalScalingAllocatedStatus",
			"SeparateCacheWatchRPC",
			"StorageNamespaceIndex",
			"WatchFromStorageWithoutResourceVersion",
			"WindowsHostNetwork",
		},
		Kubelet: []string{
			"AllowParsingUserUIDFromCertAuth",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerStopSignals",
			"ImageVolume",
			"KubeletEnsureSecretPulledImages",
			"KubeletPodResourcesGet",
			"KubeletPSI",
			"MemoryQoS",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"PodObservedGenerationTracking",
			"ResourceHealthStatus",
			"SELinuxMount",
		},
		APIServer: []string{
			"AllowParsingUserUIDFromCertAuth",
			"AllowUnsafeMalformedObjectDeletion",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerStopSignals",
			"CrossNamespaceVolumeDataSource",
			"DeploymentReplicaSetTerminatingReplicas",
			"HPAConfigurableTolerance",
			"HPAScaleToZero",
			"ImageVolume",
			"ListFromCacheSnapshot",
			"MaxUnavailableStatefulSet",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"PreferSameTrafficDistribution",
			"ResourceHealthStatus",
			"SELinuxMount",
			"StrictIPCIDRValidation",
			"DisableAllocatorDualWrite",
		},
		KubeControllerManager: []string{
			"AllowParsingUserUIDFromCertAuth",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"DeploymentReplicaSetTerminatingReplicas",
			"HPAConfigurableTolerance",
			"MaxUnavailableStatefulSet",
			"PodObservedGenerationTracking",
			"PreferSameTrafficDistribution",
			"SELinuxMount",
		},
		KubeScheduler: []string{
			"AllowParsingUserUIDFromCertAuth",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"PodObservedGenerationTracking",
		},
	},
	"1.34": {
		Kubelet: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerRestartRules",
			"ContainerStopSignals",
			"EnvFiles",
			"HostnameOverride",
			"ImageVolume",
			"KubeletEnsureSecretPulledImages",
			"MemoryQoS",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"ResourceHealthStatus",
			"SELinuxMount",
		},
		APIServer: []string{
			"AllowUnsafeMalformedObjectDeletion",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerRestartRules",
			"ContainerStopSignals",
			"CrossNamespaceVolumeDataSource",
			"DeploymentReplicaSetTerminatingReplicas",
			"EnvFiles",
			"HPAConfigurableTolerance",
			"HPAScaleToZero",
			"ImageVolume",
			"MaxUnavailableStatefulSet",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"ResourceHealthStatus",
			"SELinuxMount",
			"StrictIPCIDRValidation",
		},
		KubeControllerManager: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerRestartRules",
			"CrossNamespaceVolumeDataSource",
			"DeploymentReplicaSetTerminatingReplicas",
			"HPAConfigurableTolerance",
			"MaxUnavailableStatefulSet",
			"SELinuxMount",
		},
		KubeScheduler: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerRestartRules",
		},
	},
	"1.35": {
		Deprecated: []string{
			"ChangeContainerStatusOnKubeletRestart",
		},
		Kubelet: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerStopSignals",
			"MemoryQoS",
			"MutablePVNodeAffinity",
			"MutatingAdmissionPolicy",
			"NodeDeclaredFeatures",
			"PodLogsQuerySplitStreams",
			"ResourceHealthStatus",
			"RestartAllContainersOnContainerExits",
			"SELinuxMount",
		},
		APIServer: []string{
			"AllowUnsafeMalformedObjectDeletion",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ConstrainedImpersonation",
			"ContainerStopSignals",
			"CRDObservedGenerationTracking",
			"CrossNamespaceVolumeDataSource",
			"HPAScaleToZero",
			"MutablePodResourcesForSuspendedJobs",
			"MutablePVNodeAffinity",
			"MutableSchedulingDirectivesForSuspendedJobs",
			"MutatingAdmissionPolicy",
			"NodeDeclaredFeatures",
			"PodLogsQuerySplitStreams",
			"ResourceHealthStatus",
			"RestartAllContainersOnContainerExits",
			"SELinuxMount",
			"StrictIPCIDRValidation",
			"TaintTolerationComparisonOperators",
		},
		KubeControllerManager: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"SELinuxMount",
		},
		KubeScheduler: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"NodeDeclaredFeatures",
			"TaintTolerationComparisonOperators",
		},
	},
}

Functions

This section is empty.

Types

type ComponentFeatures added in v1.74.0 

type ComponentFeatures struct {
	Deprecated            []string
	Forbidden             []string
	Kubelet               []string
	APIServer             []string
	KubeControllerManager []string
	KubeScheduler         []string
}

func (*ComponentFeatures) GetFeatureGateInfo added in v1.74.0 

func (cf *ComponentFeatures) GetFeatureGateInfo(component, featureName string) FeatureGateInfo

func (*ComponentFeatures) IsDeprecated added in v1.74.0 

func (cf *ComponentFeatures) IsDeprecated(feature string) bool

func (*ComponentFeatures) IsForbidden added in v1.74.0 

func (cf *ComponentFeatures) IsForbidden(feature string) bool

func (*ComponentFeatures) ValidateFeature added in v1.74.0 

func (cf *ComponentFeatures) ValidateFeature(feature string) error

type ConfigMapInfo added in v1.64.0 

type ConfigMapInfo struct {
	ServiceAccounts []string
}

type FeatureGateInfo added in v1.74.0 

type FeatureGateInfo struct {
	Exists       bool
	IsDeprecated bool
	IsForbidden  bool
}

type KubeSchedulerWebhook added in v1.64.0 

type KubeSchedulerWebhook struct {
	Weight         int                              `json:"weight" yaml:"weight"`
	FailurePolicy  string                           `json:"failurePolicy" yaml:"failurePolicy"`
	ClientConfig   KubeSchedulerWebhookClientConfig `json:"clientConfig" yaml:"clientConfig"`
	TimeoutSeconds int                              `json:"timeoutSeconds" yaml:"timeoutSeconds"`
	FilterVerb     *string                          `yaml:"filterVerb,omitempty" json:"filterVerb,omitempty"`
	PrioritizeVerb *string                          `yaml:"prioritizeVerb,omitempty" json:"prioritizeVerb,omitempty"`
	PreemptVerb    string                           `yaml:"preemptVerb" json:"preemptVerb"`
}

type KubeSchedulerWebhookClientConfig added in v1.64.0 

type KubeSchedulerWebhookClientConfig struct {
	Service  KubeSchedulerWebhookService `json:"service" yaml:"service"`
	CABundle string                      `json:"caBundle" yaml:"caBundle"`
}

type KubeSchedulerWebhookConfiguration added in v1.64.0 

type KubeSchedulerWebhookConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Webhooks          []KubeSchedulerWebhook `json:"webhooks" yaml:"webhooks"`
}

type KubeSchedulerWebhookService added in v1.64.0 

type KubeSchedulerWebhookService struct {
	Name      string `json:"name" yaml:"name"`
	Namespace string `json:"namespace" yaml:"namespace"`
	Port      int    `json:"port" yaml:"port"`
	Path      string `json:"path" yaml:"path"`
}

type KubernetesVersion added in v1.74.0 

type KubernetesVersion string

func (KubernetesVersion) IsGreaterThan added in v1.74.0 

func (v KubernetesVersion) IsGreaterThan(other KubernetesVersion) bool

func (KubernetesVersion) Normalize added in v1.74.0 

func (v KubernetesVersion) Normalize() KubernetesVersion

type SecretEncryptionKey 

type SecretEncryptionKey []byte

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.