Documentation
¶
Index ¶
- type AdmissionValidator
- func (av *AdmissionValidator) DropCount() int64
- func (av *AdmissionValidator) GetClientset() kubernetes.Interface
- func (av *AdmissionValidator) Handles(operation admission.Operation) bool
- func (av *AdmissionValidator) SetKindAcceptor(a KindAcceptor)
- func (av *AdmissionValidator) SetSelfSubject(subject string)
- func (av *AdmissionValidator) SetWorkerPool(workers, queueSize int)
- func (av *AdmissionValidator) Start(ctx context.Context)
- func (av *AdmissionValidator) Validate(_ context.Context, attrs admission.Attributes, _ admission.ObjectInterfaces) error
- func (av *AdmissionValidator) Wait()
- type AdmissionWebhookInterface
- type KindAcceptor
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AdmissionValidator ¶
type AdmissionValidator struct {
// contains filtered or unexported fields
}
func NewAdmissionValidator ¶
func NewAdmissionValidator(kubernetesClient *k8sinterface.KubernetesApi, objectCache objectcache.ObjectCache, exporter exporters.Exporter, ruleBindingCache rulebinding.RuleBindingCache) *AdmissionValidator
func (*AdmissionValidator) DropCount ¶ added in v0.2.149
func (av *AdmissionValidator) DropCount() int64
DropCount returns the cumulative number of admission events the validator has dropped because the evaluation queue was full. Suitable for export as a Prometheus counter.
func (*AdmissionValidator) GetClientset ¶
func (av *AdmissionValidator) GetClientset() kubernetes.Interface
func (*AdmissionValidator) Handles ¶
func (av *AdmissionValidator) Handles(operation admission.Operation) bool
We are implementing the Handles method from the ValidationInterface interface. This method returns true if this admission controller can handle the given operation, we accept all operations.
func (*AdmissionValidator) SetKindAcceptor ¶ added in v0.2.149
func (av *AdmissionValidator) SetKindAcceptor(a KindAcceptor)
SetKindAcceptor installs the Kind pre-filter used to skip evaluation for admission events no loaded rule could match. Passing nil disables the pre-filter and accepts every Kind.
func (*AdmissionValidator) SetSelfSubject ¶ added in v0.2.149
func (av *AdmissionValidator) SetSelfSubject(subject string)
SetSelfSubject overrides the operator's self subject. Exposed for tests.
func (*AdmissionValidator) SetWorkerPool ¶ added in v0.2.149
func (av *AdmissionValidator) SetWorkerPool(workers, queueSize int)
SetWorkerPool reconfigures the async evaluation pipeline. Must be called before Start. Exposed for tests; in production, defaults are used.
func (*AdmissionValidator) Start ¶ added in v0.2.149
func (av *AdmissionValidator) Start(ctx context.Context)
Start spawns the worker pool that drains the evaluation queue. Idempotent — subsequent calls are no-ops. Workers exit when ctx is canceled.
func (*AdmissionValidator) Validate ¶
func (av *AdmissionValidator) Validate(_ context.Context, attrs admission.Attributes, _ admission.ObjectInterfaces) error
Validate implements admission.ValidationInterface. The API server is synchronous from the framework's perspective, but our rule evaluation is not: matching requests are enqueued onto a bounded worker pool and the validator returns nil immediately. The API server never waits on CEL.
Requests dropped here include:
- Requests from the operator's own ServiceAccount (feedback-loop guard).
- Requests whose Kind no loaded rule could match (Kind pre-filter).
- Requests that cannot be enqueued because the queue is full (drop with warning + counter, never block the API server).
func (*AdmissionValidator) Wait ¶ added in v0.2.149
func (av *AdmissionValidator) Wait()
Wait blocks until all worker goroutines have exited. Exposed for tests and graceful shutdown.
type AdmissionWebhookInterface ¶
type AdmissionWebhookInterface interface {
// Runs the webhook server until the passed context is cancelled, or it
// experiences an internal error.
//
// Error is always non-nil and will always be one of:
// deadline exceeded
// context cancelled
// or http listen error
Run(ctx context.Context) error
}
type KindAcceptor ¶ added in v0.2.149
KindAcceptor decides whether an admission Kind should be evaluated by the rule pipeline. Implementations should return true for any Kind that at least one currently-loaded rule could match (and true for all Kinds when no static set can be determined). The validator uses this to skip work for events no rule targets.
Source Files