Documentation
¶
Index ¶
- Constants
- func CreateTLSSecret(cheCtx *chetypes.CheContext, name string) (err error)
- func GetAdditionalCACertsConfigMapVersion(cheCtx *chetypes.CheContext) string
- func GetCheCABundles(client k8sclient.Client, namespace string) ([]corev1.ConfigMap, error)
- func GetTLSCrtBytes(cheCtx *chetypes.CheContext) (certificates []byte, err error)
- func GetTLSCrtChain(cheCtx *chetypes.CheContext) ([]*x509.Certificate, error)
- func IsSelfSignedCASecretExists(cheCtx *chetypes.CheContext) (bool, error)
- func IsSelfSignedCertificateUsed(cheCtx *chetypes.CheContext) (bool, error)
- func K8sHandleCheTLSSecrets(cheCtx *chetypes.CheContext) (reconcile.Result, error)
- func RegisterSecurityProfileWatcher(mgr manager.Manager, serverTLS ServerTLS, onCancel context.CancelFunc, ...) error
- func SyncTLSRoleToCluster(cheCtx *chetypes.CheContext) error
- type CertificatesReconciler
- type ServerTLS
- type TlsSecretReconciler
Constants ¶
const ( // The ConfigMap name for merged CA bundle certificates CheMergedCABundleCertsCMName = "ca-certs-merged" OIDCIssuerCACMName = "oidc-issuer-ca" )
const ( CheTLSJobServiceAccountName = "che-tls-job-service-account" CheTLSJobRoleName = "che-tls-job-role" CheTLSJobRoleBindingName = "che-tls-job-role-binding" CheTLSJobName = "che-tls-job" CheTLSJobComponentName = "che-create-tls-secret-job" )
TLS related constants
Variables ¶
This section is empty.
Functions ¶
func CreateTLSSecret ¶
func CreateTLSSecret(cheCtx *chetypes.CheContext, name string) (err error)
CreateTLSSecret creates TLS secret with given name. Does nothing if secret with given name already exists.
func GetAdditionalCACertsConfigMapVersion ¶
func GetAdditionalCACertsConfigMapVersion(cheCtx *chetypes.CheContext) string
GetAdditionalCACertsConfigMapVersion returns revision of merged additional CA certs config map
func GetCheCABundles ¶
GetCheCABundles returns list of config maps with additional CA certificates that should be trusted by Che The selection is based on the specific label
func GetTLSCrtBytes ¶
func GetTLSCrtBytes(cheCtx *chetypes.CheContext) (certificates []byte, err error)
GetTLSCrtBytes extracts certificate chain of trust from the test route/ingress.
func GetTLSCrtChain ¶
func GetTLSCrtChain(cheCtx *chetypes.CheContext) ([]*x509.Certificate, error)
GetTLSCrtChain retrieves TLS certificates chain from a test route/ingress.
func IsSelfSignedCASecretExists ¶
func IsSelfSignedCASecretExists(cheCtx *chetypes.CheContext) (bool, error)
IsSelfSignedCASecretExists checks if CheTLSSelfSignedCertificateSecretName exists so depending components can mount it
func IsSelfSignedCertificateUsed ¶
func IsSelfSignedCertificateUsed(cheCtx *chetypes.CheContext) (bool, error)
IsSelfSignedCertificateUsed detects whether endpoints are/should be secured by self-signed certificate.
func K8sHandleCheTLSSecrets ¶
func K8sHandleCheTLSSecrets(cheCtx *chetypes.CheContext) (reconcile.Result, error)
K8sHandleCheTLSSecrets handles TLS secrets required for Che deployment on Kubernetes infrastructure.
func RegisterSecurityProfileWatcher ¶
func RegisterSecurityProfileWatcher(mgr manager.Manager, serverTLS ServerTLS, onCancel context.CancelFunc, log logr.Logger) error
RegisterSecurityProfileWatcher sets up watcher to restart operator when profile/policy changes. Always registers on OpenShift so that changes (or late availability) trigger a restart.
func SyncTLSRoleToCluster ¶
func SyncTLSRoleToCluster(cheCtx *chetypes.CheContext) error
Types ¶
type CertificatesReconciler ¶
type CertificatesReconciler struct {
reconciler.Reconcilable
// contains filtered or unexported fields
}
func NewCertificatesReconciler ¶
func NewCertificatesReconciler() *CertificatesReconciler
func (*CertificatesReconciler) Finalize ¶
func (c *CertificatesReconciler) Finalize(cheCtx *chetypes.CheContext) bool
func (*CertificatesReconciler) Reconcile ¶
func (c *CertificatesReconciler) Reconcile(cheCtx *chetypes.CheContext) (reconcile.Result, bool, error)
type ServerTLS ¶
type ServerTLS struct {
TLSOpts []func(*cryptotls.Config)
InitialTLSProfileSpec configv1.TLSProfileSpec
InitialTLSAdherencePolicy configv1.TLSAdherencePolicy
}
ServerTLS holds TLS options and initial profile/policy for watcher
func BuildServerTLSOptions ¶
func BuildServerTLSOptions(ctx context.Context, cfg *rest.Config, scheme *k8sruntime.Scheme, log logr.Logger) (ServerTLS, error)
BuildServerTLSOptions fetches TLS profile and adherence policy from cluster. Returns TLS config functions when adherence policy requires strict compliance. Falls back to the library-go default TLS profile on transient API server errors or when adherence policy does not require strict compliance. Returns empty ServerTLS on non-OpenShift clusters.
type TlsSecretReconciler ¶
type TlsSecretReconciler struct {
reconciler.Reconcilable
}
func NewTlsSecretReconciler ¶
func NewTlsSecretReconciler() *TlsSecretReconciler
func (*TlsSecretReconciler) Finalize ¶
func (t *TlsSecretReconciler) Finalize(cheCtx *chetypes.CheContext) bool
func (*TlsSecretReconciler) Reconcile ¶
func (t *TlsSecretReconciler) Reconcile(cheCtx *chetypes.CheContext) (reconcile.Result, bool, error)
Source Files