Documentation
¶
Overview ¶
Package controller implements the CertificateSigningRequest signing controller of the kubeca command: CertificateSigningRequestSigningReconciler signs every CSR whose signerName maps to a loaded issuer and profile, after the in-process approver has approved it when -approve is enforce (KUBECA-001). A CSR the issuer rejects on its content gets the Failed condition instead of endless retries (KUBECA-013).
LoadAuthority loads the crypto provider and the xpki authority.Authority from the configured files; cmd/kubeca builds the manager, registers the reconciler and, with -enable-operator, the operator controllers (internal/operator).
ca, err := controller.LoadAuthority(caCfgPath, hsmCfgPath)
...
err = (&controller.CertificateSigningRequestSigningReconciler{
Client: mgr.GetClient(),
APIReader: mgr.GetAPIReader(),
Scheme: mgr.GetScheme(),
Authority: ca,
EventRecorder: mgr.GetEventRecorderFor("kubeca-csr-signer"),
ApproveMode: controller.ApproveEnforce,
AllowedNames: []string{"localhost", "127.0.0.1"},
ClusterDomain: "cluster.local",
}).SetupWithManager(mgr)
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type ApproveMode ¶ added in v0.9.63
type ApproveMode string
ApproveMode selects what the in-process approver does with a CSR that has neither an Approved nor a Denied condition (KUBECA-001).
const ( // ApproveOff signs every CSR of a known signer that is not Denied, // without an Approved condition: the behaviour before v0.9. ApproveOff ApproveMode = "off" // ApproveAudit evaluates the names, logs and emits an ApprovalAudit // event for a CSR that enforce would deny, and signs it anyway. ApproveAudit ApproveMode = "audit" // ApproveEnforce sets Approved when every name of the CSR is one the // requesting ServiceAccount's Pods and Services may carry, Denied // otherwise, and signs only approved CSRs. ApproveEnforce ApproveMode = "enforce" )
func ParseApproveMode ¶ added in v0.9.63
func ParseApproveMode(s string) (ApproveMode, error)
ParseApproveMode validates the value of the -approve flag.
type CertificateSigningRequestSigningReconciler ¶
type CertificateSigningRequestSigningReconciler struct {
client.Client
// APIReader lists the Pods of a requesting ServiceAccount without
// caching every Pod of the cluster.
APIReader client.Reader
Scheme *runtime.Scheme
Authority *authority.Authority
EventRecorder record.EventRecorder
// ApproveMode of the approver; ApproveOff when empty.
ApproveMode ApproveMode
// AllowedNames every requester may use (localhost, 127.0.0.1).
AllowedNames []string
// ClusterDomain is the suffix of the derived DNS names.
ClusterDomain string
}
CertificateSigningRequestSigningReconciler reconciles CertificateSigningRequests.
func (*CertificateSigningRequestSigningReconciler) Reconcile ¶
func (r *CertificateSigningRequestSigningReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
Reconcile signs one CSR: it skips deleted, signer-less, signed and denied requests and unknown signers, runs the approver, and signs an approved request. A request the issuer rejects on its content gets the Failed condition; API server and KMS errors are returned for the retry.
func (*CertificateSigningRequestSigningReconciler) SetupWithManager ¶
func (r *CertificateSigningRequestSigningReconciler) SetupWithManager(mgr ctrl.Manager) error
SetupWithManager registers the controller for CertificateSigningRequests.
Source Files