Affected by GO-2024-3325 and 2 other vulnerabilities

GO-2024-3325: kcp's impersonation allows access to global administrative groups in github.com/kcp-dev/kcp

GO-2025-3538: kcp allows unauthorized creation and deletion of objects in arbitrary workspaces through APIExport Virtual Workspace in github.com/kcp-dev/kcp

GO-2025-3985: kcp is missing update validation allows arbitrary LogicalCluster status patches through initializingworkspaces Virtual Workspace in github.com/kcp-dev/kcp

shared

package

v0.6.2 Latest Latest Go to latest Published: Jul 21, 2022 License: Apache-2.0 Imports: 14 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/kcp-dev/kcp

Links

Open Source Insights

Documentation ¶

Index ¶

Constants
func DeprecatedGetAssignedSyncTarget(labels map[string]string) stringdeprecated
func EnsureUpstreamFinalizerRemoved(ctx context.Context, gvr schema.GroupVersionResource, ...) error
func PhysicalClusterNamespaceName(l NamespaceLocator) (string, error)
type NamespaceLocator
type SyncTargetLocator

Constants ¶

View Source

const (
	NamespaceLocatorAnnotation = "kcp.dev/namespace-locator"
)

View Source

const (
	// SyncerFinalizerNamePrefix is the finalizer put onto resources by the syncer to claim ownership,
	// *before* a downstream object is created. It is only removed when the downstream object is deleted.
	SyncerFinalizerNamePrefix = "workload.kcp.dev/syncer-"
)

Variables ¶

This section is empty.

Functions ¶

func DeprecatedGetAssignedSyncTarget deprecated

func DeprecatedGetAssignedSyncTarget(labels map[string]string) string

DeprecatedGetAssignedSyncTarget returns one assigned sync target in Sync state. It will likely lead to broken behaviour when there is one of those labels on a resource.

Deprecated: use GetResourceState per cluster instead.

func EnsureUpstreamFinalizerRemoved ¶

func EnsureUpstreamFinalizerRemoved(ctx context.Context, gvr schema.GroupVersionResource, upstreamClient dynamic.ClusterInterface, upstreamNamespace, syncTargetName string, logicalClusterName logicalcluster.Name, resourceName string) error

func PhysicalClusterNamespaceName ¶

func PhysicalClusterNamespaceName(l NamespaceLocator) (string, error)

PhysicalClusterNamespaceName encodes the NamespaceLocator into a new namespace name for use on a physical cluster. The encoding is repeatable.

Types ¶

type NamespaceLocator ¶

type NamespaceLocator struct {
	SyncTarget SyncTargetLocator   `json:"syncTarget"`
	Workspace  logicalcluster.Name `json:"workspace,omitempty"`
	Namespace  string              `json:"namespace"`
}

NamespaceLocator stores a logical cluster and namespace and is used as the source for the mapped namespace name in a physical cluster.

func LocatorFromAnnotations ¶

func LocatorFromAnnotations(annotations map[string]string) (*NamespaceLocator, bool, error)

func NewNamespaceLocator ¶

func NewNamespaceLocator(workspace, syncTargetWorkspace logicalcluster.Name, syncTargetUID types.UID, workloadLogicalClusterName, upstreamNamespace string) NamespaceLocator

func NewNamespaceLocatorV060 ¶ added in v0.6.1

func NewNamespaceLocatorV060(workspace, syncTargetWorkspace logicalcluster.Name, syncTargetUID types.UID, workloadLogicalClusterName, upstreamNamespace string) NamespaceLocator

type SyncTargetLocator ¶

type SyncTargetLocator struct {
	Workspace      string    `json:"workspace,omitempty"`
	DeprecatedPath string    `json:"path,omitempty"`
	Name           string    `json:"name"`
	UID            types.UID `json:"uid"`
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL