Documentation
¶
Overview ¶
Package pod implements the Pod controller of the operator: for every Pod labeled kubeca.effectivesecurity/inject=true it derives the names the Pod may carry (internal/k8snames), the SPIFFE ID of its ServiceAccount when the ClusterIssuer has a trust domain, and the names of the san annotation, and creates or updates a Certificate owned by the Pod. The Certificate controller issues it into the Secret the Pod mounts; the kubelet starts the containers once the Secret exists, and the Certificate and the Secret are garbage-collected with the Pod.
The informer cache of the manager only holds labeled Pods (operator.CacheOptions), so the controller never reads other Pods.
Index ¶
Constants ¶
const (
// ControllerName is the name of the controller in metrics and logs.
ControllerName = "pod"
)
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Reconciler ¶
type Reconciler struct {
client.Client
Scheme *runtime.Scheme
Recorder record.EventRecorder
// ClusterDomain is the suffix of the derived DNS names.
ClusterDomain string
}
Reconciler reconciles labeled Pods into Certificates.
func (*Reconciler) Reconcile ¶
Reconcile creates or updates the Certificate of a labeled Pod. A Pod whose annotations are unusable gets an InvalidPod event and no retry.
func (*Reconciler) SetupWithManager ¶
func (r *Reconciler) SetupWithManager(mgr ctrl.Manager) error
SetupWithManager registers the controller: it watches labeled Pods, the Certificates they own, Services (mapped to the Pods they select) and ClusterIssuers (mapped to the Pods that name them).
Source Files