Documentation
¶
Index ¶
- Constants
- Variables
- func EnsureSshCertificateAuthority(flow *configuration.Flow) (crypto.PrivateKey, string, error)
- func EnsureSshCertificateIdentity(flow *configuration.Flow) (crypto.PrivateKey, string, error)
- func ValidateSshCertificateAuthority(authority crypto.PrivateKey, hostKeys []crypto.PrivateKey) error
- type CleanupOpts
- type CloseableRepository
- type Context
- type ContextualSessionCompatibilityChecker
- type DockerRepository
- func (this *DockerRepository) Cleanup(ctx context.Context, opts *CleanupOpts) error
- func (this *DockerRepository) Close() error
- func (this *DockerRepository) DoesSupportPty(Context, essh.Pty) (bool, error)
- func (this *DockerRepository) Ensure(req Request) (Environment, error)
- func (this *DockerRepository) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error)
- func (this *DockerRepository) ImpProtocolCompatibility(ctx context.Context, sess session.Session) (compatible bool, found bool, revision uint32, identity ResourceIdentity, ...)
- func (this *DockerRepository) WillBeAccepted(ctx Context) (ok bool, err error)
- type DummyRepository
- func (this *DummyRepository) Cleanup(context.Context, *CleanupOpts) error
- func (this *DummyRepository) Close() error
- func (this *DummyRepository) DoesSupportPty(_ Context, _ essh.Pty) (bool, error)
- func (this *DummyRepository) Ensure(req Request) (Environment, error)
- func (this *DummyRepository) FindBySession(_ context.Context, sess session.Session, _ *FindOpts) (Environment, error)
- func (this *DummyRepository) WillBeAccepted(_ Context) (bool, error)
- type Environment
- type FindOpts
- type ImpProtocolCompatibilityChecker
- type KubernetesRepository
- func (this *KubernetesRepository) Cleanup(ctx context.Context, opts *CleanupOpts) error
- func (this *KubernetesRepository) Close() error
- func (this *KubernetesRepository) DoesSupportPty(Context, essh.Pty) (bool, error)
- func (this *KubernetesRepository) Ensure(req Request) (result Environment, err error)
- func (this *KubernetesRepository) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error)
- func (this *KubernetesRepository) ImpProtocolCompatibility(ctx context.Context, sess session.Session) (compatible bool, found bool, revision uint32, identity ResourceIdentity, ...)
- func (this *KubernetesRepository) WillBeAccepted(ctx Context) (ok bool, err error)
- type LocalRepository
- func (this *LocalRepository) Cleanup(context.Context, *CleanupOpts) error
- func (this *LocalRepository) Close() error
- func (this *LocalRepository) DoesSupportPty(Context, essh.Pty) (bool, error)
- func (this *LocalRepository) Ensure(req Request) (Environment, error)
- func (this *LocalRepository) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error)
- func (this *LocalRepository) WillBeAccepted(ctx Context) (ok bool, err error)
- type PreparationProgress
- type PreparationProgressAttributes
- type PreparationProgressEnabled
- type Repository
- type RepositoryFacade
- func (this *RepositoryFacade) Cleanup(ctx context.Context, opts *CleanupOpts) error
- func (this *RepositoryFacade) Close() (rErr error)
- func (this *RepositoryFacade) DisposeSession(ctx context.Context, sess session.Session) (bool, error)
- func (this *RepositoryFacade) DoesSupportPty(ctx Context, pty essh.Pty) (bool, error)
- func (this *RepositoryFacade) Ensure(req Request) (Environment, error)
- func (this *RepositoryFacade) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error)
- func (this *RepositoryFacade) ImpProtocolCompatibility(ctx context.Context, sess session.Session) (compatible bool, found bool, revision uint32, identity ResourceIdentity, ...)
- func (this *RepositoryFacade) IsSessionCompatible(ctx context.Context, sess session.Session) (bool, error)
- func (this *RepositoryFacade) IsSessionCompatibleWith(ctx Context, sess session.Session) (bool, error)
- func (this *RepositoryFacade) SessionEnvironmentMatches(ctx context.Context, sess session.Session) (bool, error)
- func (this *RepositoryFacade) WillBeAccepted(ctx Context) (bool, error)
- type RepositoryFactory
- type Request
- type ResourceIdentity
- type ReversePortForwardingPolicy
- type ReverseTCPListener
- type SessionCompatibilityChecker
- type SshRepository
- func (this *SshRepository) Cleanup(context.Context, *CleanupOpts) error
- func (this *SshRepository) Close() error
- func (this *SshRepository) DoesSupportPty(Context, essh.Pty) (bool, error)
- func (this *SshRepository) Ensure(req Request) (Environment, error)
- func (this *SshRepository) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error)
- func (this *SshRepository) IsSessionCompatible(ctx context.Context, sess session.Session) (bool, error)
- func (this *SshRepository) IsSessionCompatibleWith(ctx Context, sess session.Session) (bool, error)
- func (this *SshRepository) WillBeAccepted(ctx Context) (bool, error)
- type SubsystemRunner
- type Task
- type TaskType
Constants ¶
const ( DockerLabelPrefix = "org.engity.bifroest/" DockerLabelFlow = DockerLabelPrefix + "flow" DockerLabelSessionId = DockerLabelPrefix + "session-id" DockerLabelCreatedRemoteUser = DockerLabelPrefix + "created-remote-user" DockerLabelCreatedRemoteHost = DockerLabelPrefix + "created-remote-host" DockerLabelExecutionLifecycle = DockerLabelPrefix + "execution-lifecycle" DockerLabelImpProtocolRevision = DockerLabelPrefix + "imp-protocol-revision" DockerLabelShellCommand = DockerLabelPrefix + "shellCommand" DockerLabelExecCommand = DockerLabelPrefix + "execCommand" DockerLabelSftpCommand = DockerLabelPrefix + "sftpCommand" DockerLabelUser = DockerLabelPrefix + "user" DockerLabelDirectory = DockerLabelPrefix + "directory" DockerLabelPortForwardingAllowed = DockerLabelPrefix + "portForwardingAllowed" )
const ( KubernetesLabelPrefix = "org.engity.bifroest/" KubernetesLabelFlow = KubernetesLabelPrefix + "flow" KubernetesLabelSessionId = KubernetesLabelPrefix + "session-id" KubernetesAnnotationPrefix = KubernetesLabelPrefix KubernetesAnnotationCreatedRemoteUser = KubernetesAnnotationPrefix + "created-remote-user" KubernetesAnnotationCreatedRemoteHost = KubernetesAnnotationPrefix + "created-remote-host" KubernetesAnnotationExecutionLifecycle = KubernetesAnnotationPrefix + "execution-lifecycle" KubernetesAnnotationImpProtocolRevision = KubernetesAnnotationPrefix + "imp-protocol-revision" KubernetesAnnotationShellCommand = KubernetesAnnotationPrefix + "shellCommand" KubernetesAnnotationExecCommand = KubernetesAnnotationPrefix + "execCommand" KubernetesAnnotationSftpCommand = KubernetesAnnotationPrefix + "sftpCommand" KubernetesAnnotationUser = KubernetesAnnotationPrefix + "user" KubernetesAnnotationGroup = KubernetesAnnotationPrefix + "group" KubernetesAnnotationDirectory = KubernetesAnnotationPrefix + "directory" KubernetesAnnotationPortForwardingAllowed = KubernetesAnnotationPrefix + "portForwardingAllowed" )
Variables ¶
var ( ErrNoSuchEnvironment = errors.New("no such environment") ErrNotAcceptable = errors.New("not acceptable") )
var ErrSubsystemNotAllowed = errors.New("SSH subsystem is not allowed by the environment")
Functions ¶
func EnsureSshCertificateAuthority ¶
func EnsureSshCertificateAuthority(flow *configuration.Flow) (crypto.PrivateKey, string, error)
func EnsureSshCertificateIdentity ¶
func EnsureSshCertificateIdentity(flow *configuration.Flow) (crypto.PrivateKey, string, error)
func ValidateSshCertificateAuthority ¶
func ValidateSshCertificateAuthority(authority crypto.PrivateKey, hostKeys []crypto.PrivateKey) error
Types ¶
type CleanupOpts ¶ added in v0.4.0
type CleanupOpts struct {
// FlowOfNamePredicate returns true if in the context of Bifröst
// there exists another flow with this name.
FlowOfNamePredicate func(configuration.FlowName) (bool, error)
// SessionExists returns true if the given session (by its [session.Id]) does
// exist within the whole Bifröst context.
SessionExists func(context.Context, configuration.FlowName, session.Id) (bool, error)
// Logger will be used (if any log is required) instead of the standard logger.
Logger log.Logger
}
CleanupOpts adds some more hints what should happen when Repository.Cleanup is executed.
func (*CleanupOpts) GetLogger ¶ added in v0.4.0
func (this *CleanupOpts) GetLogger(or func() log.Logger) log.Logger
func (*CleanupOpts) HasFlowOfName ¶ added in v0.4.0
func (this *CleanupOpts) HasFlowOfName(name configuration.FlowName) (bool, error)
func (*CleanupOpts) HasSession ¶ added in v0.5.0
func (this *CleanupOpts) HasSession(ctx context.Context, flow configuration.FlowName, id session.Id) (*bool, error)
HasSession calls SessionExists and returns its values. If SessionExists or in case of errors the actual result will be nil.
type CloseableRepository ¶
type CloseableRepository interface {
Repository
io.Closer
}
type Context ¶ added in v0.4.0
type Context interface {
Connection() connection.Connection
Context() essh.Context
Authorization() authorization.Authorization
}
type DockerRepository ¶ added in v0.4.0
type DockerRepository struct {
Logger log.Logger
// contains filtered or unexported fields
}
func NewDockerRepository ¶ added in v0.4.0
func NewDockerRepository(ctx context.Context, flow configuration.FlowName, conf *configuration.EnvironmentDocker, ap alternatives.Provider, i imp.Imp) (*DockerRepository, error)
func (*DockerRepository) Cleanup ¶ added in v0.4.0
func (this *DockerRepository) Cleanup(ctx context.Context, opts *CleanupOpts) error
func (*DockerRepository) Close ¶ added in v0.4.0
func (this *DockerRepository) Close() error
func (*DockerRepository) DoesSupportPty ¶ added in v0.4.0
func (*DockerRepository) Ensure ¶ added in v0.4.0
func (this *DockerRepository) Ensure(req Request) (Environment, error)
func (*DockerRepository) FindBySession ¶ added in v0.4.0
func (this *DockerRepository) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error)
func (*DockerRepository) ImpProtocolCompatibility ¶
func (this *DockerRepository) ImpProtocolCompatibility(ctx context.Context, sess session.Session) (compatible bool, found bool, revision uint32, identity ResourceIdentity, err error)
ImpProtocolCompatibility inspects only Docker metadata; it does not open or remove the environment.
func (*DockerRepository) WillBeAccepted ¶ added in v0.4.0
func (this *DockerRepository) WillBeAccepted(ctx Context) (ok bool, err error)
type DummyRepository ¶ added in v0.4.0
type DummyRepository struct {
// contains filtered or unexported fields
}
func NewDummyRepository ¶ added in v0.4.0
func NewDummyRepository(_ context.Context, flow configuration.FlowName, conf *configuration.EnvironmentDummy, _ alternatives.Provider, _ imp.Imp) (*DummyRepository, error)
func (*DummyRepository) Cleanup ¶ added in v0.4.0
func (this *DummyRepository) Cleanup(context.Context, *CleanupOpts) error
func (*DummyRepository) Close ¶ added in v0.4.0
func (this *DummyRepository) Close() error
func (*DummyRepository) DoesSupportPty ¶ added in v0.4.0
func (*DummyRepository) Ensure ¶ added in v0.4.0
func (this *DummyRepository) Ensure(req Request) (Environment, error)
func (*DummyRepository) FindBySession ¶ added in v0.4.0
func (this *DummyRepository) FindBySession(_ context.Context, sess session.Session, _ *FindOpts) (Environment, error)
func (*DummyRepository) WillBeAccepted ¶ added in v0.4.0
func (this *DummyRepository) WillBeAccepted(_ Context) (bool, error)
type Environment ¶
type Environment interface {
Banner(Request) (io.ReadCloser, error)
Run(Task) (int, error)
IsPortForwardingAllowed(net.HostPort) (bool, error)
NewDestinationConnection(context.Context, net.HostPort) (io.ReadWriteCloser, error)
// Dispose will fully dispose this instance.
// It does also implicitly call Close() to ensure everything happens
// in the correct synchronized context.
Dispose(context.Context) (bool, error)
// Close can be safely called more than once.
Close() error
}
type FindOpts ¶
type FindOpts struct {
// ExpectedResource prevents cleanup or reuse if the inspected resource was replaced.
ExpectedResource *ResourceIdentity
// AutoCleanUpAllowed tells the repository to clean up everything
// automatically while executing the search. The requester will never
// see the requested result. This is false by default because it could
// lead to quite performance impacts or other unwanted side effects.
//
// Therefore: Use with caution.
AutoCleanUpAllowed *bool
// Logger will be used (if any log is required) instead of the standard logger.
Logger log.Logger
}
FindOpts adds some more hints what should happen when find methods of Repository are executed.
func (*FindOpts) IsAutoCleanUpAllowed ¶
type ImpProtocolCompatibilityChecker ¶
type ImpProtocolCompatibilityChecker interface {
ImpProtocolCompatibility(context.Context, session.Session) (compatible bool, found bool, revision uint32, identity ResourceIdentity, err error)
}
ImpProtocolCompatibilityChecker reads an existing resource's master-assigned IMP revision without opening IMP or changing the resource. found=false means no resource; a malformed revision returns found=true and an error.
type KubernetesRepository ¶ added in v0.5.0
type KubernetesRepository struct {
Logger log.Logger
// contains filtered or unexported fields
}
func NewKubernetesRepository ¶ added in v0.5.0
func NewKubernetesRepository(_ context.Context, flow configuration.FlowName, conf *configuration.EnvironmentKubernetes, ap alternatives.Provider, i imp.Imp) (*KubernetesRepository, error)
func (*KubernetesRepository) Cleanup ¶ added in v0.5.0
func (this *KubernetesRepository) Cleanup(ctx context.Context, opts *CleanupOpts) error
func (*KubernetesRepository) Close ¶ added in v0.5.0
func (this *KubernetesRepository) Close() error
func (*KubernetesRepository) DoesSupportPty ¶ added in v0.5.0
func (*KubernetesRepository) Ensure ¶ added in v0.5.0
func (this *KubernetesRepository) Ensure(req Request) (result Environment, err error)
func (*KubernetesRepository) FindBySession ¶ added in v0.5.0
func (this *KubernetesRepository) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error)
func (*KubernetesRepository) ImpProtocolCompatibility ¶
func (this *KubernetesRepository) ImpProtocolCompatibility(ctx context.Context, sess session.Session) (compatible bool, found bool, revision uint32, identity ResourceIdentity, err error)
ImpProtocolCompatibility inspects only Pod metadata; it does not open or remove the environment.
func (*KubernetesRepository) WillBeAccepted ¶ added in v0.5.0
func (this *KubernetesRepository) WillBeAccepted(ctx Context) (ok bool, err error)
type LocalRepository ¶
func NewLocalRepository ¶
func NewLocalRepository(ctx context.Context, flow configuration.FlowName, conf *configuration.EnvironmentLocal, _ alternatives.Provider, _ imp.Imp) (*LocalRepository, error)
func (*LocalRepository) Cleanup ¶ added in v0.4.0
func (this *LocalRepository) Cleanup(context.Context, *CleanupOpts) error
func (*LocalRepository) Close ¶
func (this *LocalRepository) Close() error
func (*LocalRepository) DoesSupportPty ¶ added in v0.2.0
func (*LocalRepository) Ensure ¶
func (this *LocalRepository) Ensure(req Request) (Environment, error)
func (*LocalRepository) FindBySession ¶
func (this *LocalRepository) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error)
func (*LocalRepository) WillBeAccepted ¶
func (this *LocalRepository) WillBeAccepted(ctx Context) (ok bool, err error)
type PreparationProgress ¶ added in v0.4.0
type PreparationProgressAttributes ¶ added in v0.4.0
type PreparationProgressEnabled ¶ added in v0.5.0
type PreparationProgressEnabled interface {
StartPreparation(id, title string, attrs PreparationProgressAttributes) (PreparationProgress, error)
}
type Repository ¶
type Repository interface {
// WillBeAccepted returns true if it is possible to get an Environment for the
// provided Request.
WillBeAccepted(Context) (bool, error)
// DoesSupportPty will return true if the resulting Environment will support
// an PTY.
DoesSupportPty(Context, essh.Pty) (bool, error)
// Ensure will create or return an environment that matches the given Request.
// If it is not acceptable to do this action with the provided Request
// ErrNotAcceptable is returned; you can call WillBeAccepted to prevent such
// errors.
Ensure(Request) (Environment, error)
// FindBySession will find an existing environment for a given session.Session.
// If there is no matching one ErrNoSuchEnvironment will be returned.
FindBySession(context.Context, session.Session, *FindOpts) (Environment, error)
// Cleanup can be called while housekeeping iteration. It will also forward
// all otherFlows that are configured within Bifröst. This gives the Repository
// to potentially cleanup orphan resources that where initially owned by another
// flow.
Cleanup(context.Context, *CleanupOpts) error
}
type RepositoryFacade ¶
type RepositoryFacade struct {
// contains filtered or unexported fields
}
func NewRepositoryFacade ¶
func NewRepositoryFacade(ctx context.Context, flows *configuration.Flows, ap alternatives.Provider, i imp.Imp) (*RepositoryFacade, error)
func NewRepositoryFacadeWithHostKeys ¶
func NewRepositoryFacadeWithHostKeys(ctx context.Context, flows *configuration.Flows, ap alternatives.Provider, i imp.Imp, hostKeys []crypto.PrivateKey, sessions ...session.Repository) (*RepositoryFacade, error)
func (*RepositoryFacade) Cleanup ¶ added in v0.4.0
func (this *RepositoryFacade) Cleanup(ctx context.Context, opts *CleanupOpts) error
func (*RepositoryFacade) Close ¶
func (this *RepositoryFacade) Close() (rErr error)
func (*RepositoryFacade) DisposeSession ¶
func (this *RepositoryFacade) DisposeSession(ctx context.Context, sess session.Session) (bool, error)
DisposeSession serializes local session disposal with account provisioning.
func (*RepositoryFacade) DoesSupportPty ¶ added in v0.2.0
func (*RepositoryFacade) Ensure ¶
func (this *RepositoryFacade) Ensure(req Request) (Environment, error)
func (*RepositoryFacade) FindBySession ¶
func (this *RepositoryFacade) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error)
func (*RepositoryFacade) ImpProtocolCompatibility ¶
func (this *RepositoryFacade) ImpProtocolCompatibility(ctx context.Context, sess session.Session) (compatible bool, found bool, revision uint32, identity ResourceIdentity, err error)
ImpProtocolCompatibility inspects the session's resource without opening IMP or disposing the resource or session. Non-IMP flows have no IMP resource.
func (*RepositoryFacade) IsSessionCompatible ¶
func (*RepositoryFacade) IsSessionCompatibleWith ¶
func (*RepositoryFacade) SessionEnvironmentMatches ¶
func (this *RepositoryFacade) SessionEnvironmentMatches(ctx context.Context, sess session.Session) (bool, error)
SessionEnvironmentMatches leaves unknown persisted tokens for operator review.
func (*RepositoryFacade) WillBeAccepted ¶
func (this *RepositoryFacade) WillBeAccepted(ctx Context) (bool, error)
type RepositoryFactory ¶ added in v0.2.0
type RepositoryFactory[C any, R CloseableRepository] func(context.Context, configuration.FlowName, C, alternatives.Provider, imp.Imp) (R, error)
func RegisterRepository ¶ added in v0.2.0
func RegisterRepository[C any, R CloseableRepository](factory RepositoryFactory[C, R]) RepositoryFactory[C, R]
type Request ¶
type Request interface {
Context
PreparationProgressEnabled
}
type ResourceIdentity ¶
type ResourceIdentity struct {
DockerID string
KubernetesNamespace string
KubernetesName string
KubernetesUID string
}
ResourceIdentity identifies the exact container or pod inspected for IMP compatibility.
type ReversePortForwardingPolicy ¶
type ReversePortForwardingPolicy interface {
IsReversePortForwardingAllowed(net.HostPort) (bool, error)
}
ReversePortForwardingPolicy allows an environment to specialize reverse forwarding independently from local and dynamic forwarding.
type ReverseTCPListener ¶
type ReverseTCPListener interface {
ListenReverseTCP(context.Context, string, uint16) (gonet.Listener, error)
}
ReverseTCPListener binds reverse forwards inside the environment.
type SessionCompatibilityChecker ¶
type SessionCompatibilityChecker interface {
IsSessionCompatible(context.Context, session.Session) (bool, error)
}
SessionCompatibilityChecker can prevent an existing session from being selected when persisted environment credentials no longer match its flow.
type SshRepository ¶
func NewSshRepository ¶
func NewSshRepository(ctx context.Context, flow configuration.FlowName, conf *configuration.EnvironmentSsh, _ alternatives.Provider, _ imp.Imp) (*SshRepository, error)
func NewSshRepositoryWithHostKeys ¶
func NewSshRepositoryWithHostKeys(ctx context.Context, flow configuration.FlowName, conf *configuration.EnvironmentSsh, hostKeys []crypto.PrivateKey) (*SshRepository, error)
func (*SshRepository) Cleanup ¶
func (this *SshRepository) Cleanup(context.Context, *CleanupOpts) error
func (*SshRepository) Close ¶
func (this *SshRepository) Close() error
func (*SshRepository) DoesSupportPty ¶
func (*SshRepository) Ensure ¶
func (this *SshRepository) Ensure(req Request) (Environment, error)
func (*SshRepository) FindBySession ¶
func (this *SshRepository) FindBySession(ctx context.Context, sess session.Session, opts *FindOpts) (Environment, error)
func (*SshRepository) IsSessionCompatible ¶
func (*SshRepository) IsSessionCompatibleWith ¶
func (*SshRepository) WillBeAccepted ¶
func (this *SshRepository) WillBeAccepted(ctx Context) (bool, error)
type SubsystemRunner ¶
SubsystemRunner confirms an upstream subsystem request before streaming its data.
Source Files
¶
- container-lease.go
- context.go
- docker-api-client.go
- docker-image-pull-progress.go
- docker-repository.go
- docker-usage-specific.go
- docker.go
- dummy-repository.go
- dummy.go
- environment.go
- facade-repository.go
- imp-protocol.go
- kubernetes-repository.go
- kubernetes-usage-specific.go
- kubernetes.go
- local-account-coordinator.go
- local-cleanup-token.go
- local-pty_nondarwin_unix.go
- local-repository.go
- local-repository_unix.go
- local-target-os_linux.go
- local-template-context.go
- local-token_unix.go
- local.go
- local_unix.go
- repository.go
- request.go
- ssh-certificate-keys.go
- ssh-certificate.go
- ssh-repository.go
- ssh.go
- task.go