Documentation
¶
Overview ¶
Package webhook contains PodMutator. It's a controller-runtime webhook that intercepts Pod Creation events and mutates them. The SecretsMutator injects secret references into pods that have the inject-flyte-secrets label.
Index ¶
- Constants
- func InitCerts(ctx context.Context, kubeClient kubernetes.Interface, ...) error
- func StartCacheInvalidationServer(ctx context.Context, port int, mutator *secret.SecretsPodMutator) error
- type InvalidateRequest
- type PodMutator
- func (pm PodMutator) CreateMutationWebhookConfiguration(namespace string) (*admissionregistrationv1.MutatingWebhookConfiguration, error)
- func (pm PodMutator) GetMutatePath() string
- func (pm PodMutator) Handle(ctx context.Context, request admission.Request) admission.Response
- func (pm PodMutator) Register(ctx context.Context, mgr manager.Manager) error
- func (pm PodMutator) SecretsMutator() *secret.SecretsPodMutator
Constants ¶
const ( PodNameEnvVar = "POD_NAME" PodNamespaceEnvVar = "POD_NAMESPACE" )
const ( CaCertKey = "ca.crt" ServerCertKey = "tls.crt" ServerCertPrivateKey = "tls.key" )
const InvalidateSecretPath = "/invalidate-secret"
InvalidateSecretPath is the HTTP path for the cache invalidation endpoint.
Variables ¶
This section is empty.
Functions ¶
func InitCerts ¶
func InitCerts(ctx context.Context, kubeClient kubernetes.Interface, cfg *webhookConfig.Config, podNamespace string) error
InitCerts generates a self-signed TLS certificate for the webhook and stores it in a k8s Secret. podNamespace must be the namespace the webhook service runs in — the cert's DNS names are derived from it.
func StartCacheInvalidationServer ¶ added in v2.0.32
func StartCacheInvalidationServer(ctx context.Context, port int, mutator *secret.SecretsPodMutator) error
StartCacheInvalidationServer starts a plain HTTP server that listens for cache invalidation requests. It exposes POST /invalidate-secret so other services (the secret service) can drop secret values cached in the webhook process instead of waiting out the cache TTL.
The server is plain HTTP and unauthenticated, so it must stay cluster-internal: it is bound to its own port and never routed through an ingress. Blocks until ctx is cancelled.
Types ¶
type InvalidateRequest ¶ added in v2.0.32
type InvalidateRequest struct {
Org string `json:"org"`
Domain string `json:"domain"`
Project string `json:"project"`
Name string `json:"name"`
}
InvalidateRequest is the body of a POST to InvalidateSecretPath.
type PodMutator ¶
type PodMutator struct {
// contains filtered or unexported fields
}
PodMutator implements controller-runtime WebHook interface.
func NewPodMutator ¶
func Setup ¶
func Setup(ctx context.Context, kubeClient kubernetes.Interface, cfg *webhookConfig.Config, defaultNamespace string, scope promutils.Scope, mgr manager.Manager) (*PodMutator, error)
Setup initializes the webhook: generates certs, registers MutatingWebhookConfiguration, and registers the HTTP handler. It is called before mgr.Start() so that the webhook server is ready to receive requests. The returned PodMutator owns the secret cache and can be used to invalidate it.
func (PodMutator) CreateMutationWebhookConfiguration ¶
func (pm PodMutator) CreateMutationWebhookConfiguration(namespace string) (*admissionregistrationv1.MutatingWebhookConfiguration, error)
func (PodMutator) GetMutatePath ¶
func (pm PodMutator) GetMutatePath() string
func (PodMutator) SecretsMutator ¶ added in v2.0.32
func (pm PodMutator) SecretsMutator() *secret.SecretsPodMutator
SecretsMutator returns the mutator that owns the secret caches, so the cache invalidation server can clear them.
Source Files