Affected by GO-2024-3325 and 2 other vulnerabilities

GO-2024-3325: kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

GO-2025-3538: kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp

GO-2025-3985: kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp

apireconciler

package

v0.11.0-alpha.0 Latest Latest Go to latest Published: Feb 10, 2023 License: Apache-2.0 Imports: 31 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kcp-dev/kcp

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func IndexAPIExportsByAPIResourceSchemas(obj interface{}) ([]string, error)
func IndexSyncTargetsByExports(obj interface{}) ([]string, error)
type APIReconciler
- func NewAPIReconciler(virtualWorkspaceName string, kcpClusterClient kcpclientset.ClusterInterface, ...) (*APIReconciler, error)
type AllowedAPIfilterFunc
type CreateAPIDefinitionFunc

Constants ¶

View Source

const (
	ControllerName                     = "kcp-virtual-syncer-api-reconciler-"
	IndexSyncTargetsByExport           = ControllerName + "ByExport"
	IndexAPIExportsByAPIResourceSchema = ControllerName + "ByAPIResourceSchema"
)

Variables ¶

This section is empty.

Functions ¶

func IndexAPIExportsByAPIResourceSchemas ¶ added in v0.10.0

func IndexAPIExportsByAPIResourceSchemas(obj interface{}) ([]string, error)

IndexAPIExportsByAPIResourceSchemas is an index function that maps an APIExport to its spec.latestResourceSchemas.

func IndexSyncTargetsByExports ¶ added in v0.10.0

func IndexSyncTargetsByExports(obj interface{}) ([]string, error)

Types ¶

type APIReconciler ¶

type APIReconciler struct {
	// contains filtered or unexported fields
}

APIReconciler is a controller watching APIExports, APIResourceSchemas and SyncTargets, and updates the API definitions driving the virtual workspace.

func NewAPIReconciler ¶

func NewAPIReconciler(
	virtualWorkspaceName string,
	kcpClusterClient kcpclientset.ClusterInterface,
	syncTargetInformer workloadv1alpha1informers.SyncTargetClusterInformer,
	apiResourceSchemaInformer apisv1alpha1informers.APIResourceSchemaClusterInformer,
	apiExportInformer apisv1alpha1informers.APIExportClusterInformer,
	createAPIDefinition CreateAPIDefinitionFunc,
	allowedAPIfilter AllowedAPIfilterFunc,
) (*APIReconciler, error)

func (*APIReconciler) GetAPIDefinitionSet ¶

func (c *APIReconciler) GetAPIDefinitionSet(_ context.Context, key dynamiccontext.APIDomainKey) (apidefinition.APIDefinitionSet, bool, error)

func (*APIReconciler) ShutDown ¶

func (c *APIReconciler) ShutDown()

func (*APIReconciler) Start ¶

func (c *APIReconciler) Start(ctx context.Context)

type AllowedAPIfilterFunc ¶ added in v0.10.0

type AllowedAPIfilterFunc func(apiGroupResource schema.GroupResource) bool

type CreateAPIDefinitionFunc ¶

type CreateAPIDefinitionFunc func(syncTargetWorkspace logicalcluster.Name, syncTargetName string, apiResourceSchema *apisv1alpha1.APIResourceSchema, version string, identityHash string) (apidefinition.APIDefinition, error)

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL