Documentation
¶
Overview ¶
Package operator wires the KubeCA operator into a controller-runtime manager: the scheme, the informer cache restrictions, the field indexes, the ClusterIssuer, Certificate and Pod controllers and the Pod mutating webhook with its self-issued serving certificate. The command cmd/kubeca calls it when -enable-operator is set:
scheme, err := operator.Scheme()
if err != nil {
return err
}
opts := operator.Options{ClusterDomain: "cluster.local"}
mgr, err := ctrl.NewManager(cfg, ctrl.Options{
Scheme: scheme,
Cache: operator.CacheOptions(),
WebhookServer: operator.WebhookServer(opts.Webhook),
})
if err != nil {
return err
}
if err := operator.Setup(ctx, mgr, authority, opts); err != nil {
return err
}
The sub-packages do not import each other: shared helpers live in policy, index, metrics and internal/k8snames.
Index ¶
- Constants
- func AddToScheme(s *runtime.Scheme) error
- func CacheOptions() cache.Options
- func Scheme() (*runtime.Scheme, error)
- func Setup(ctx context.Context, mgr ctrl.Manager, ca *authority.Authority, opts Options) error
- func WebhookServer(opts *WebhookOptions) ctrlwebhook.Server
- type Options
- type WebhookOptions
Constants ¶
View Source
const ( // DefaultWebhookPort is the port the webhook server listens on. DefaultWebhookPort = 9443 // DefaultWebhookProfile is the profile of the serving certificate. DefaultWebhookProfile = "webhook" // DefaultWebhookConfigName is the MutatingWebhookConfiguration whose // caBundle the operator maintains. DefaultWebhookConfigName = "kubeca-pod-injector" )
Variables ¶
This section is empty.
Functions ¶
func AddToScheme ¶
AddToScheme adds the operator's kinds to an existing scheme.
func CacheOptions ¶
CacheOptions restricts the informer caches: Secrets and ConfigMaps to those labeled managed=true, Pods to those labeled inject=true; every object is stored without managedFields. Certificates, ClusterIssuers, Namespaces and Services are cached fully.
func Setup ¶
Setup registers the indexes, the controllers and the webhook with the manager. With a webhook, the serving certificate is issued before Setup returns so that the server finds its files at start.
func WebhookServer ¶
func WebhookServer(opts *WebhookOptions) ctrlwebhook.Server
WebhookServer returns the webhook server for the manager options, or nil when the webhook is disabled.
Types ¶
type Options ¶
type Options struct {
// ClusterDomain is the cluster DNS suffix of the derived names.
ClusterDomain string
// MaxConcurrentReconciles of the Certificate controller; 0 is the
// package default (4).
MaxConcurrentReconciles int
// Webhook enables the Pod mutating webhook when set.
Webhook *WebhookOptions
}
Options of the operator.
type WebhookOptions ¶
type WebhookOptions struct {
// Port of the HTTPS server; DefaultWebhookPort when 0.
Port int
// CertDir receives the serving certificate; the controller-runtime
// default when empty.
CertDir string
// ServiceName and ServiceNamespace of the webhook Service: the DNS
// names of the serving certificate.
ServiceName string
ServiceNamespace string
// IssuerLabel and Profile sign the serving certificate.
IssuerLabel string
Profile string
// ConfigName is the MutatingWebhookConfiguration to patch; "" skips
// the patch.
ConfigName string
}
WebhookOptions of the Pod mutating webhook.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package certificate implements the Certificate controller: for every Certificate it resolves the ClusterIssuer and the xpki profile, evaluates the policy, decides whether an issuance is needed (needsIssuance in renewal.go), generates the key and the CSR, signs with the Authority, writes the kubernetes.io/tls Secret (secret.go), records the status and requeues itself for the renewal time.
|
Package certificate implements the Certificate controller: for every Certificate it resolves the ClusterIssuer and the xpki profile, evaluates the policy, decides whether an issuance is needed (needsIssuance in renewal.go), generates the key and the CSR, signs with the Authority, writes the kubernetes.io/tls Secret (secret.go), records the status and requeues itself for the renewal time. |
|
Package index registers the field indexes the operator controllers list Certificates by, so that a ClusterIssuer or a Service change maps to the Certificates it affects.
|
Package index registers the field indexes the operator controllers list Certificates by, so that a ClusterIssuer or a Service change maps to the Certificates it affects. |
|
Package issuer implements the ClusterIssuer controller: it resolves spec.issuerLabel in the running xpki Authority, checks the exposed profiles and the policy, publishes the CA certificate, the root bundle, the subject key id and the profiles in the status, flags an expiring or expired CA, and writes the root bundle into the ConfigMap named by spec.caBundle in every namespace that holds a Certificate of the issuer.
|
Package issuer implements the ClusterIssuer controller: it resolves spec.issuerLabel in the running xpki Authority, checks the exposed profiles and the policy, publishes the CA certificate, the root bundle, the subject key id and the profiles in the status, flags an expiring or expired CA, and writes the root bundle into the ConfigMap named by spec.caBundle in every namespace that holds a Certificate of the issuer. |
|
Package metrics defines the Prometheus metrics of the operator and registers them with controller-runtime's registry, so the manager's /metrics endpoint serves them next to the controller_runtime_* and xpki metrics.
|
Package metrics defines the Prometheus metrics of the operator and registers them with controller-runtime's registry, so the manager's /metrics endpoint serves them next to the controller_runtime_* and xpki metrics. |
|
Package pod implements the Pod controller of the operator: for every Pod labeled kubeca.effectivesecurity/inject=true it derives the names the Pod may carry (internal/k8snames), the SPIFFE ID of its ServiceAccount when the ClusterIssuer has a trust domain, and the names of the san annotation, and creates or updates a Certificate owned by the Pod.
|
Package pod implements the Pod controller of the operator: for every Pod labeled kubeca.effectivesecurity/inject=true it derives the names the Pod may carry (internal/k8snames), the SPIFFE ID of its ServiceAccount when the ClusterIssuer has a trust domain, and the names of the san annotation, and creates or updates a Certificate owned by the Pod. |
|
Package policy evaluates a ClusterIssuer's policy against a Certificate request: the namespace selector, the duration bound and the allowed DNS, URI, email and IP names; the subject common name is checked against the DNS expressions.
|
Package policy evaluates a ClusterIssuer's policy against a Certificate request: the namespace selector, the duration bound and the allowed DNS, URI, email and IP names; the subject common name is checked against the DNS expressions. |
|
Package webhook implements the operator's mutating admission webhook for Pods and the bootstrap of its own serving certificate.
|
Package webhook implements the operator's mutating admission webhook for Pods and the bootstrap of its own serving certificate. |
Click to show internal directories.
Click to hide internal directories.