hooks

package
v1.77.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 17, 2026 License: Apache-2.0 Imports: 58 Imported by: 0

Documentation

Overview

Code generated by "tools/audit_policy.go" DO NOT EDIT.

reconcile_kubeadm_cluster_admins_binding is the SINGLE SOURCE OF TRUTH for ClusterRoleBinding kubeadm:cluster-admins reconciliation. It evaluates three independent signals:

  1. user-authz module is enabled (module.IsEnabled / global.enabledModules);
  2. the cluster has finished its first bootstrap (global.clusterIsBootstrapped);
  3. ClusterRole user-authz:cluster-admin is observed in the API right now.

Only when all three are true the binding flips to user-authz:cluster-admin; otherwise it stays on cluster-admin (kubeadm-default wildcard). The supplement (extra ClusterRole bound to the same kubeadm:cluster-admins group) is enabled while user-authz is on (single gate).

The hook publishes its decision into Helm values so templates/rbac-for-us.yaml renders verbatim and does NOT re-evaluate the gates: 

controlPlaneManager.internal.kubeadmClusterAdminsTargetRoleName  string
controlPlaneManager.internal.kubeadmClusterAdminsSupplementEnabled bool

Why a hook is needed at all: ClusterRoleBinding.roleRef is immutable in Kubernetes RBAC, Helm SSA cannot mutate it. We Delete+Create via PatchCollector on OnBeforeHelm, before Helm runs. On a failed Create after Delete the next reconcile (CRB delete-event or OnBeforeHelm tick) hits the create-only path and self-heals.

Index

Constants

View Source 
const (
	AuditPolicySectionBasic           = "basic"
	AuditPolicySectionVirtualization  = "virtualization"
	AuditPolicySectionUnauthenticated = "unauthenticated"
)
View Source 
const (
	UpToDateVersion uint = iota
	// DeprecatedVersion marks deprecated resources that will be removed in the next delta releases
	DeprecatedVersion
	UnsupportedVersion
	// FutureDeprecatedVersion resource that is deprecated in any future version
	FutureDeprecatedVersion
)
View Source 
const (
	K8sVersionsWithDeprecations = "monitoringKubernetes:k8sVersionsWithDeprecations"
)

Variables

View Source 
var DefaultKubernetesVersion = "<autogenerated on the build stage>"

This value is set on the controller build in the deckhouse-controller/go-build.sh script. Do not touch it !!!

View Source 
var FeatureGatesMap = map[string]ComponentFeatures{
	"1.31": {
		Deprecated: []string{
			"AllowDNSOnlyNodeCSR",
			"AllowInsecureKubeletCertificateSigningRequests",
			"DisableNodeKubeProxyVersion",
		},
		Kubelet: []string{
			"ConcurrentWatchObjectDecode",
			"ImageVolume",
			"InPlacePodVerticalScaling",
			"KubeletPodResourcesGet",
			"MemoryQoS",
			"MutatingAdmissionPolicy",
			"ResourceHealthStatus",
			"SELinuxMount",
			"RecoverVolumeExpansionFailure",
		},
		APIServer: []string{
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"HPAScaleToZero",
			"ImageVolume",
			"InPlacePodVerticalScaling",
			"JobManagedBy",
			"MaxUnavailableStatefulSet",
			"MutatingAdmissionPolicy",
			"ProcMountType",
			"ResourceHealthStatus",
			"SELinuxMount",
			"AuthorizeNodeWithSelectors",
			"AuthorizeWithSelectors",
			"DisableAllocatorDualWrite",
			"OrderedNamespaceDeletion",
			"RecoverVolumeExpansionFailure",
			"RelaxedEnvironmentVariableValidation",
			"StrictCostEnforcementForVAP",
			"StrictCostEnforcementForWebhooks",
		},
		KubeControllerManager: []string{
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"InPlacePodVerticalScaling",
			"JobManagedBy",
			"MaxUnavailableStatefulSet",
			"SELinuxMount",
			"RecoverVolumeExpansionFailure",
		},
		KubeScheduler: []string{
			"ConcurrentWatchObjectDecode",
			"InPlacePodVerticalScaling",
			"SchedulerQueueingHints",
		},
	},
	"1.32": {
		Deprecated: []string{
			"DisableNodeKubeProxyVersion",
		},
		Kubelet: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ImageVolume",
			"InPlacePodVerticalScaling",
			"KubeletPodResourcesGet",
			"MemoryQoS",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"ResourceHealthStatus",
			"SELinuxMount",
			"InPlacePodVerticalScalingAllocatedStatus",
		},
		APIServer: []string{
			"AllowUnsafeMalformedObjectDeletion",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"HPAScaleToZero",
			"ImageVolume",
			"InPlacePodVerticalScaling",
			"MaxUnavailableStatefulSet",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"ProcMountType",
			"ResourceHealthStatus",
			"SELinuxChangePolicy",
			"SELinuxMount",
			"DisableAllocatorDualWrite",
			"InPlacePodVerticalScalingAllocatedStatus",
			"OrderedNamespaceDeletion",
			"PodLifecycleSleepActionAllowZero",
			"RelaxedDNSSearchValidation",
		},
		KubeControllerManager: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"InPlacePodVerticalScaling",
			"MaxUnavailableStatefulSet",
			"SELinuxChangePolicy",
			"SELinuxMount",
		},
		KubeScheduler: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"InPlacePodVerticalScaling",
			"SchedulerAsyncPreemption",
		},
	},
	"1.33": {
		Deprecated: []string{
			"DisableNodeKubeProxyVersion",
			"GitRepoVolumeDriver",
			"InPlacePodVerticalScalingAllocatedStatus",
			"SeparateCacheWatchRPC",
			"StorageNamespaceIndex",
			"WatchFromStorageWithoutResourceVersion",
			"WindowsHostNetwork",
		},
		Kubelet: []string{
			"AllowParsingUserUIDFromCertAuth",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerStopSignals",
			"ImageVolume",
			"KubeletPodResourcesGet",
			"KubeletPSI",
			"MemoryQoS",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"PodObservedGenerationTracking",
			"ResourceHealthStatus",
			"SELinuxMount",
		},
		APIServer: []string{
			"AllowParsingUserUIDFromCertAuth",
			"AllowUnsafeMalformedObjectDeletion",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerStopSignals",
			"CrossNamespaceVolumeDataSource",
			"DeploymentReplicaSetTerminatingReplicas",
			"HPAConfigurableTolerance",
			"HPAScaleToZero",
			"ImageVolume",
			"ListFromCacheSnapshot",
			"MaxUnavailableStatefulSet",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"PreferSameTrafficDistribution",
			"ResourceHealthStatus",
			"SELinuxMount",
			"StrictIPCIDRValidation",
			"DisableAllocatorDualWrite",
		},
		KubeControllerManager: []string{
			"AllowParsingUserUIDFromCertAuth",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"DeploymentReplicaSetTerminatingReplicas",
			"HPAConfigurableTolerance",
			"MaxUnavailableStatefulSet",
			"PodObservedGenerationTracking",
			"PreferSameTrafficDistribution",
			"SELinuxMount",
		},
		KubeScheduler: []string{
			"AllowParsingUserUIDFromCertAuth",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"PodObservedGenerationTracking",
		},
	},
	"1.34": {
		Kubelet: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerRestartRules",
			"ContainerStopSignals",
			"EnvFiles",
			"HostnameOverride",
			"ImageVolume",
			"MemoryQoS",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"ResourceHealthStatus",
			"SELinuxMount",
		},
		APIServer: []string{
			"AllowUnsafeMalformedObjectDeletion",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerRestartRules",
			"ContainerStopSignals",
			"CrossNamespaceVolumeDataSource",
			"DeploymentReplicaSetTerminatingReplicas",
			"EnvFiles",
			"HPAConfigurableTolerance",
			"HPAScaleToZero",
			"ImageVolume",
			"MaxUnavailableStatefulSet",
			"MutatingAdmissionPolicy",
			"PodLogsQuerySplitStreams",
			"ResourceHealthStatus",
			"SELinuxMount",
			"StrictIPCIDRValidation",
		},
		KubeControllerManager: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerRestartRules",
			"CrossNamespaceVolumeDataSource",
			"DeploymentReplicaSetTerminatingReplicas",
			"HPAConfigurableTolerance",
			"MaxUnavailableStatefulSet",
			"SELinuxMount",
		},
		KubeScheduler: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerRestartRules",
		},
	},
	"1.35": {
		Deprecated: []string{
			"ChangeContainerStatusOnKubeletRestart",
		},
		Kubelet: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ContainerStopSignals",
			"MemoryQoS",
			"MutablePVNodeAffinity",
			"MutatingAdmissionPolicy",
			"NodeDeclaredFeatures",
			"PodLogsQuerySplitStreams",
			"ResourceHealthStatus",
			"RestartAllContainersOnContainerExits",
			"SELinuxMount",
		},
		APIServer: []string{
			"AllowUnsafeMalformedObjectDeletion",
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"ConstrainedImpersonation",
			"ContainerStopSignals",
			"CRDObservedGenerationTracking",
			"CrossNamespaceVolumeDataSource",
			"HPAScaleToZero",
			"MutablePodResourcesForSuspendedJobs",
			"MutablePVNodeAffinity",
			"MutableSchedulingDirectivesForSuspendedJobs",
			"MutatingAdmissionPolicy",
			"NodeDeclaredFeatures",
			"PodLogsQuerySplitStreams",
			"ResourceHealthStatus",
			"RestartAllContainersOnContainerExits",
			"SELinuxMount",
			"StrictIPCIDRValidation",
			"TaintTolerationComparisonOperators",
		},
		KubeControllerManager: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"CrossNamespaceVolumeDataSource",
			"SELinuxMount",
		},
		KubeScheduler: []string{
			"ComponentFlagz",
			"ComponentStatusz",
			"ConcurrentWatchObjectDecode",
			"NodeDeclaredFeatures",
			"TaintTolerationComparisonOperators",
		},
	},
	"1.36": {
		Deprecated: []string{
			"DeclarativeValidationTakeover",
		},
		Kubelet: []string{
			"ConcurrentWatchObjectDecode",
			"ContainerStopSignals",
			"CRIListStreaming",
			"MemoryQoS",
			"MutablePVNodeAffinity",
			"NativeHistograms",
			"PodLogsQuerySplitStreams",
			"SELinuxMount",
		},
		APIServer: []string{
			"AllowUnsafeMalformedObjectDeletion",
			"ConcurrentWatchObjectDecode",
			"ContainerStopSignals",
			"CRDObservedGenerationTracking",
			"CrossNamespaceVolumeDataSource",
			"HPAScaleToZero",
			"MutablePVNodeAffinity",
			"NativeHistograms",
			"PersistentVolumeClaimUnusedSinceTime",
			"PodLogsQuerySplitStreams",
			"SELinuxMount",
			"ShardedListAndWatch",
			"TaintTolerationComparisonOperators",
		},
		KubeControllerManager: []string{
			"ConcurrentWatchObjectDecode",
			"ControllerManagerReleaseLeaderElectionLockOnExit",
			"CrossNamespaceVolumeDataSource",
			"NativeHistograms",
			"PersistentVolumeClaimUnusedSinceTime",
			"SELinuxMount",
		},
		KubeScheduler: []string{
			"ConcurrentWatchObjectDecode",
			"NativeHistograms",
			"TaintTolerationComparisonOperators",
		},
	},
}

Functions

This section is empty.

Types

type AuditPolicyRuleWithDescription added in v1.77.0 

type AuditPolicyRuleWithDescription struct {
	Rule        audit.PolicyRule
	Section     string
	Description AuditRuleDescription
}

func BuiltInAuditPolicyRulesForDocumentation added in v1.77.0 

func BuiltInAuditPolicyRulesForDocumentation() ([]AuditPolicyRuleWithDescription, error)

type AuditRuleDescription added in v1.77.0 

type AuditRuleDescription struct {
	EN string
	RU string
}

type ComponentFeatures added in v1.74.0 

type ComponentFeatures struct {
	Deprecated            []string
	Forbidden             []string
	Kubelet               []string
	APIServer             []string
	KubeControllerManager []string
	KubeScheduler         []string
}

func (*ComponentFeatures) GetFeatureGateInfo added in v1.74.0 

func (cf *ComponentFeatures) GetFeatureGateInfo(component, featureName string) FeatureGateInfo

func (*ComponentFeatures) IsDeprecated added in v1.74.0 

func (cf *ComponentFeatures) IsDeprecated(feature string) bool

func (*ComponentFeatures) IsForbidden added in v1.74.0 

func (cf *ComponentFeatures) IsForbidden(feature string) bool

func (*ComponentFeatures) ValidateFeature added in v1.74.0 

func (cf *ComponentFeatures) ValidateFeature(feature string) error

type Config added in v1.77.0 

type Config struct {
	Enabled                     *bool        `json:"enabled,omitempty"`
	IngressClass                *string      `json:"ingressClass,omitempty"`
	WhitelistSourceRanges       []string     `json:"whitelistSourceRanges,omitempty"`
	HTTPS                       *HTTPSConfig `json:"https,omitempty"`
	AddKubeconfigGeneratorEntry *bool        `json:"addKubeconfigGeneratorEntry,omitempty"`
}

func (*Config) UnmarshalJSON added in v1.77.0 

func (c *Config) UnmarshalJSON(data []byte) error

type ConfigMapInfo added in v1.64.0 

type ConfigMapInfo struct {
	ServiceAccounts []string
}

type FeatureGateInfo added in v1.74.0 

type FeatureGateInfo struct {
	Exists       bool
	IsDeprecated bool
	IsForbidden  bool
}

type GlobalHTTPS added in v1.77.0 

type GlobalHTTPS struct {
	KubeconfigGeneratorMasterCA *string `json:"kubeconfigGeneratorMasterCA,omitempty"`
}

type HTTPSConfig added in v1.77.0 

type HTTPSConfig struct {
	Mode   *string      `json:"mode,omitempty"`
	Global *GlobalHTTPS `json:"global,omitempty"`
}

type KubeSchedulerWebhook added in v1.64.0 

type KubeSchedulerWebhook struct {
	Weight         int                              `json:"weight" yaml:"weight"`
	FailurePolicy  string                           `json:"failurePolicy" yaml:"failurePolicy"`
	ClientConfig   KubeSchedulerWebhookClientConfig `json:"clientConfig" yaml:"clientConfig"`
	TimeoutSeconds int                              `json:"timeoutSeconds" yaml:"timeoutSeconds"`
	FilterVerb     *string                          `yaml:"filterVerb,omitempty" json:"filterVerb,omitempty"`
	PrioritizeVerb *string                          `yaml:"prioritizeVerb,omitempty" json:"prioritizeVerb,omitempty"`
	PreemptVerb    string                           `yaml:"preemptVerb" json:"preemptVerb"`
}

type KubeSchedulerWebhookClientConfig added in v1.64.0 

type KubeSchedulerWebhookClientConfig struct {
	Service  KubeSchedulerWebhookService `json:"service" yaml:"service"`
	CABundle string                      `json:"caBundle" yaml:"caBundle"`
}

type KubeSchedulerWebhookConfiguration added in v1.64.0 

type KubeSchedulerWebhookConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Webhooks          []KubeSchedulerWebhook `json:"webhooks" yaml:"webhooks"`
}

type KubeSchedulerWebhookService added in v1.64.0 

type KubeSchedulerWebhookService struct {
	Name      string `json:"name" yaml:"name"`
	Namespace string `json:"namespace" yaml:"namespace"`
	Port      int    `json:"port" yaml:"port"`
	Path      string `json:"path" yaml:"path"`
}

type KubernetesServicePort added in v1.77.0 

type KubernetesServicePort intstr.IntOrString

type KubernetesVersion added in v1.74.0 

type KubernetesVersion string

func (KubernetesVersion) IsGreaterThan added in v1.74.0 

func (v KubernetesVersion) IsGreaterThan(other KubernetesVersion) bool

func (KubernetesVersion) Normalize added in v1.74.0 

func (v KubernetesVersion) Normalize() KubernetesVersion

type ModuleConfig added in v1.77.0 

type ModuleConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ModuleConfigSpec   `json:"spec"`
	Status ModuleConfigStatus `json:"status,omitempty"`
}

type ModuleConfigSpec added in v1.77.0 

type ModuleConfigSpec struct {
	Version  int            `json:"version,omitempty"`
	Settings SettingsValues `json:"settings,omitempty"`
	Enabled  bool           `json:"enabled,omitempty"`
}

type ModuleConfigStatus added in v1.77.0 

type ModuleConfigStatus struct {
	Version string `json:"version"`
	Message string `json:"message"`
}

type Node added in v1.77.0 

type Node struct {
	CapacityMilliCPU    int64
	CapacityMemory      int64
	AllocatableMilliCPU int64
	AllocatableMemory   int64
}

type PublishAPICert added in v1.77.0 

type PublishAPICert struct {
	Name string `json:"name"`
	Data []byte `json:"data"`
}

type Release added in v1.77.0 

type Release struct {
	Name      string `json:"name,omitempty" protobuf:"bytes,1,opt,name=name,proto3"`
	Namespace string `json:"namespace,omitempty" protobuf:"bytes,8,opt,name=namespace,proto3"`
	Manifest  string `json:"manifest,omitempty" protobuf:"bytes,5,opt,name=manifest,proto3"`

	// set helm version manually
	HelmVersion string `json:"-"`
}

protobuf methods for helm2

func (*Release) ProtoMessage added in v1.77.0 

func (*Release) ProtoMessage()

func (*Release) Reset added in v1.77.0 

func (m *Release) Reset()

func (*Release) String added in v1.77.0 

func (m *Release) String() string

type SecretEncryptionKey 

type SecretEncryptionKey []byte

type SettingsValues added in v1.77.0 

type SettingsValues struct {
	PublishAPI *struct{} `json:"publishAPI" yaml:"publishAPI"`
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.