Documentation
¶
Overview ¶
Package webhook implements the operator's mutating admission webhook for Pods and the bootstrap of its own serving certificate.
PodMutator handles Pod CREATE for Pods labeled kubeca.effectivesecurity/inject=true: it fixes the Secret name (the secret-name annotation; a generated kubeca-<8 chars> for generateName Pods, <name>-tls otherwise), adds the Secret volume and mounts it into the containers of the containers annotation (default all) at the mount-path annotation (default /etc/tls). The Pod controller then creates the Certificate. Mutate is the pure function the handler applies, so the tests check the patch without an admission server.
ServingCertificate issues the webhook's TLS certificate from the Authority (D-6: self-issued, in process, no Secret to mount before the Pod runs), writes it to the directory the controller-runtime webhook server watches, renews it at two thirds of its lifetime, and patches the caBundle of the MutatingWebhookConfiguration with the root bundle.
Index ¶
Constants ¶
const ( // CertFileName and KeyFileName are what the controller-runtime webhook // server reads from its CertDir. CertFileName = "tls.crt" KeyFileName = "tls.key" )
const (
// Path is the URL path the webhook is served at.
Path = "/mutate-pod"
)
Variables ¶
This section is empty.
Functions ¶
func GenerateSecretName ¶
GenerateSecretName returns kubeca-<8 random lower-case alphanumerics> from crypto/rand.
func Mutate ¶
Mutate injects the Secret into the Pod: it records secretName in the secret-name annotation, adds a Secret volume unless one already references the Secret, and mounts it at the mount-path annotation into the containers of the containers annotation (all when absent) that have no mount at that path. It reports whether the Pod changed.
Types ¶
type PodMutator ¶
type PodMutator struct {
// contains filtered or unexported fields
}
PodMutator is the admission handler.
func NewPodMutator ¶
func NewPodMutator(scheme *runtime.Scheme) *PodMutator
NewPodMutator returns the handler; register it with admission.Webhook{Handler: ...} at Path.
type ServingCertificate ¶
type ServingCertificate struct {
Authority *authority.Authority
// Client patches the MutatingWebhookConfiguration; it reads it with
// an uncached Get when Reader is set.
Client client.Client
Reader client.Reader
// IssuerLabel and Profile select the signer; DNSNames are the
// webhook Service names.
IssuerLabel string
Profile string
DNSNames []string
// CertDir receives tls.crt and tls.key.
CertDir string
// ConfigName is the MutatingWebhookConfiguration to patch; "" skips
// the patch.
ConfigName string
// Clock is the time source; tests inject a fake.
Clock clock.WithTicker
// contains filtered or unexported fields
}
ServingCertificate issues, stores and renews the webhook's TLS certificate and keeps the MutatingWebhookConfiguration's caBundle in step. It is a manager Runnable that runs on every replica.
func (*ServingCertificate) EnsureCABundle ¶
func (s *ServingCertificate) EnsureCABundle(ctx context.Context) error
EnsureCABundle patches the configuration's caBundle when it differs from the root bundle of the last issuance; a no-op without ConfigName.
func (*ServingCertificate) Issue ¶
func (s *ServingCertificate) Issue(ctx context.Context) error
Issue signs a new certificate, writes the files and patches the caBundle. Call it before the manager starts so the webhook server finds its files.
func (*ServingCertificate) NeedLeaderElection ¶
func (s *ServingCertificate) NeedLeaderElection() bool
NeedLeaderElection is false: every replica serves the webhook.
func (*ServingCertificate) Start ¶
func (s *ServingCertificate) Start(ctx context.Context) error
Start renews the certificate at two thirds of its lifetime and checks the caBundle every minute until ctx ends; a failed renewal is retried every minute. Whether a renewal is due is decided by the clock on every wake-up, not by which channel fired.
Source Files