server

package
v0.6.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 18, 2026 License: Apache-2.0 Imports: 28 Imported by: 0

Documentation

Index

Constants

View Source 
const MaxStreamLogsPods = 5

MaxStreamLogsPods is the maximum number of pod log streams per StreamLogs request.

Variables

This section is empty.

Functions

func AuthorizeAction added in v0.6.0 

func AuthorizeAction(ctx context.Context, k8sClient kubernetes.Interface, auditLogger *AuditLogger, verb, namespace, resource string) error

AuthorizeAction performs a Kubernetes SubjectAccessReview for the authenticated user against a Diverge resource. The user's identity is extracted from the request context (set by the auth middleware).

func AuthorizePodLogs added in v0.6.0 

func AuthorizePodLogs(ctx context.Context, k8sClient kubernetes.Interface, auditLogger *AuditLogger, namespace string) error

AuthorizePodLogs performs a SubjectAccessReview for pods/log access. StreamLogs requires both environment read AND pod log read permissions.

func CRDEnvToDomain 

func CRDEnvToDomain(crd *v1alpha1.Environment) (*domain.Environment, error)

CRDEnvToDomain maps a CRD Environment to the protobuf domain type.

func CRDPgToDomain 

func CRDPgToDomain(crd *v1alpha1.PreviewGroup) (*domain.PreviewGroup, error)

CRDPgToDomain maps a CRD PreviewGroup to the protobuf domain type.

func DomainEnvToCRD 

func DomainEnvToCRD(dom *domain.Environment) (*v1alpha1.Environment, error)

DomainEnvToCRD maps a protobuf domain Environment to the CRD type.

func DomainPgToCRD 

func DomainPgToCRD(dom *domain.PreviewGroup) (*v1alpha1.PreviewGroup, error)

DomainPgToCRD maps a protobuf domain PreviewGroup to the CRD type.

func GetBroadcasterMetrics added in v0.5.0 

func GetBroadcasterMetrics() streaming.BroadcasterMetrics

func NewAuthInterceptor 

func NewAuthInterceptor(authAttempts *prometheus.CounterVec) connect.Interceptor

func NewAuthMetrics added in v0.6.0 

func NewAuthMetrics() *auth.AuthMetrics

NewAuthMetrics returns the auth metrics wired to the auth middleware's expected types.

func NewAuthService 

func NewAuthService(k8s kubernetes.Interface, logger *slog.Logger, auditLogger *AuditLogger) divergev1alpha1connect.AuthServiceHandler

func NewClusterService 

func NewClusterService(c client.Client, k8s kubernetes.Interface, logger *slog.Logger, auditLogger *AuditLogger, version string) divergev1alpha1connect.ClusterServiceHandler

NewClusterService creates a ClusterService with the given version string. Pass the build-injected version (e.g. from ldflags) for accurate reporting.

func NewEnvironmentService 

func NewEnvironmentService(c client.Client, k8s kubernetes.Interface, informerMgr *streaming.InformerManager, logStreamer *streaming.LogStreamer, sem chan struct{}, logger *slog.Logger, audit *AuditLogger) divergev1alpha1connect.EnvironmentServiceHandler

func NewMetricsInterceptor added in v0.5.0 

func NewMetricsInterceptor() connect.Interceptor

func NewPreviewGroupService 

func NewPreviewGroupService(c client.Client, k8s kubernetes.Interface, informerMgr *streaming.InformerManager, sem chan struct{}, logger *slog.Logger, audit *AuditLogger) divergev1alpha1connect.PreviewGroupServiceHandler

func NewServeMux 

func NewServeMux(cfg ServeMuxConfig) *http.ServeMux

NewServeMux creates the ConnectRPC service mux with all handlers registered. Auth is NOT applied here — it is applied at the net/http middleware layer.

func SanitizeK8sError added in v0.6.0 

func SanitizeK8sError(logger *slog.Logger, err error) error

SanitizeK8sError maps Kubernetes API errors to safe Connect error codes. The raw K8s error is logged server-side but never returned to the client. Returns nil when err is nil.

func ValidateDNS1123Label added in v0.6.0 

func ValidateDNS1123Label(value, field string) error

ValidateDNS1123Label checks that a string is a valid DNS-1123 label.

func ValidateNamespaceMatch added in v0.6.0 

func ValidateNamespaceMatch(requestNS, resourceNS string) error

ValidateNamespaceMatch ensures that the namespace in the request wrapper matches the namespace in the resource, preventing RBAC bypass where a user authorized for namespace "foo" creates a resource in namespace "bar". Both requestNS and resourceNS must be non-empty for comparison. Callers must ensure requestNS is defaulted before calling this function.

Types

type AuditLogger added in v0.6.0 

type AuditLogger struct {
	// contains filtered or unexported fields
}

AuditLogger emits structured audit events for authentication, authorization, and resource mutations. All events are JSON-formatted via slog for compatibility with standard log aggregators.

func NewAuditLogger added in v0.6.0 

func NewAuditLogger(logger *slog.Logger) *AuditLogger

NewAuditLogger creates an audit logger wrapping the given structured logger.

func (*AuditLogger) LogAuth added in v0.6.0 

func (a *AuditLogger) LogAuth(ctx context.Context, event string, user *auth.UserInfo, r *http.Request, attrs ...slog.Attr)

LogAuth logs authentication events (success, failure, cache hit).

func (*AuditLogger) LogAuthz added in v0.6.0 

func (a *AuditLogger) LogAuthz(ctx context.Context, event string, user *auth.UserInfo, verb, resource, namespace string)

LogAuthz logs authorization events (denied, error).

func (*AuditLogger) LogMutation added in v0.6.0 

func (a *AuditLogger) LogMutation(ctx context.Context, event string, resourceType, name, namespace string)

LogMutation logs resource mutation events (create, update, delete).

type AuthService 

type AuthService struct {
	// contains filtered or unexported fields
}

func (*AuthService) GetCurrentUser 

func (s *AuthService) GetCurrentUser(ctx context.Context, req *connect.Request[pb.GetCurrentUserRequest]) (*connect.Response[pb.GetCurrentUserResponse], error)

func (*AuthService) ListPermissions 

func (s *AuthService) ListPermissions(ctx context.Context, req *connect.Request[pb.ListPermissionsRequest]) (*connect.Response[pb.ListPermissionsResponse], error)

type ClusterService 

type ClusterService struct {
	// contains filtered or unexported fields
}

func (*ClusterService) GetClusterInfo 

func (s *ClusterService) GetClusterInfo(ctx context.Context, req *connect.Request[pb.GetClusterInfoRequest]) (*connect.Response[pb.GetClusterInfoResponse], error)

type EnvironmentService 

type EnvironmentService struct {
	// contains filtered or unexported fields
}

func (*EnvironmentService) CreateEnvironment 

func (s *EnvironmentService) CreateEnvironment(ctx context.Context, req *connect.Request[pb.CreateEnvironmentRequest]) (*connect.Response[pb.CreateEnvironmentResponse], error)

func (*EnvironmentService) DeleteEnvironment 

func (s *EnvironmentService) DeleteEnvironment(ctx context.Context, req *connect.Request[pb.DeleteEnvironmentRequest]) (*connect.Response[pb.DeleteEnvironmentResponse], error)

func (*EnvironmentService) ExtendTTL 

func (s *EnvironmentService) ExtendTTL(ctx context.Context, req *connect.Request[pb.ExtendTTLRequest]) (*connect.Response[pb.ExtendTTLResponse], error)

func (*EnvironmentService) GetEnvironment 

func (s *EnvironmentService) GetEnvironment(ctx context.Context, req *connect.Request[pb.GetEnvironmentRequest]) (*connect.Response[pb.GetEnvironmentResponse], error)

func (*EnvironmentService) ListEnvironments 

func (s *EnvironmentService) ListEnvironments(ctx context.Context, req *connect.Request[pb.ListEnvironmentsRequest]) (*connect.Response[pb.ListEnvironmentsResponse], error)

func (*EnvironmentService) StreamLogs 

func (s *EnvironmentService) StreamLogs(ctx context.Context, req *connect.Request[pb.StreamLogsRequest], stream *connect.ServerStream[pb.StreamLogsResponse]) error

func (*EnvironmentService) UpdateEnvironment 

func (s *EnvironmentService) UpdateEnvironment(ctx context.Context, req *connect.Request[pb.UpdateEnvironmentRequest]) (*connect.Response[pb.UpdateEnvironmentResponse], error)

func (*EnvironmentService) WatchEnvironments 

func (s *EnvironmentService) WatchEnvironments(ctx context.Context, req *connect.Request[pb.WatchEnvironmentsRequest], stream *connect.ServerStream[pb.WatchEnvironmentsResponse]) error

type PreviewGroupService 

type PreviewGroupService struct {
	// contains filtered or unexported fields
}

func (*PreviewGroupService) CreatePreviewGroup 

func (s *PreviewGroupService) CreatePreviewGroup(ctx context.Context, req *connect.Request[pb.CreatePreviewGroupRequest]) (*connect.Response[pb.CreatePreviewGroupResponse], error)

func (*PreviewGroupService) DeletePreviewGroup 

func (s *PreviewGroupService) DeletePreviewGroup(ctx context.Context, req *connect.Request[pb.DeletePreviewGroupRequest]) (*connect.Response[pb.DeletePreviewGroupResponse], error)

func (*PreviewGroupService) GetPreviewGroup 

func (s *PreviewGroupService) GetPreviewGroup(ctx context.Context, req *connect.Request[pb.GetPreviewGroupRequest]) (*connect.Response[pb.GetPreviewGroupResponse], error)

func (*PreviewGroupService) ListPreviewGroups 

func (s *PreviewGroupService) ListPreviewGroups(ctx context.Context, req *connect.Request[pb.ListPreviewGroupsRequest]) (*connect.Response[pb.ListPreviewGroupsResponse], error)

func (*PreviewGroupService) UpdatePreviewGroup added in v0.6.0 

func (s *PreviewGroupService) UpdatePreviewGroup(ctx context.Context, req *connect.Request[pb.UpdatePreviewGroupRequest]) (*connect.Response[pb.UpdatePreviewGroupResponse], error)

func (*PreviewGroupService) WatchPreviewGroups 

func (s *PreviewGroupService) WatchPreviewGroups(ctx context.Context, req *connect.Request[pb.WatchPreviewGroupsRequest], stream *connect.ServerStream[pb.WatchPreviewGroupsResponse]) error

type ServeMuxConfig added in v0.6.0 

type ServeMuxConfig struct {
	Client          client.Client
	K8sClient       kubernetes.Interface
	InformerMgr     *streaming.InformerManager
	LogStreamer     *streaming.LogStreamer
	StreamSemaphore chan struct{}
	Logger          *slog.Logger
	AuditLogger     *AuditLogger
	Version         string
}

ServeMuxConfig holds all dependencies for the ConnectRPC server mux.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.