Documentation
¶
Overview ¶
Package certs sets up the serving cert of the vela-core admission webhooks. It replaces the admission-create and admission-patch Jobs (kube-webhook-certgen) that the chart ran as Helm hooks.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Ensure ¶
Ensure makes sure that the serving cert Secret is valid. It also makes sure that every webhook in the configurations trusts its CA. It returns the serving cert and the CA bundle. You can call it periodically. It renews the cert when necessary and repairs a caBundle or failurePolicy that something changed.
func WriteFiles ¶
func WriteFiles(dir string, res *servingcert.Result) (bool, error)
WriteFiles writes the serving cert and key to dir, where the webhook server reads them. It reports whether a file changed. It does not write a file that already holds the same data, so the webhook server reloads only after a renewal.
Types ¶
type Options ¶
type Options struct {
// SecretNamespace and SecretName locate the Secret holding the serving cert.
SecretNamespace string
SecretName string
// ConfigurationName is the name of both the MutatingWebhookConfiguration and
// the ValidatingWebhookConfiguration to patch.
ConfigurationName string
// FailurePolicy, if not empty, goes to every webhook. The chart renders
// Ignore until vela-core sets the caBundle, so admission does not fail
// before then.
FailurePolicy admissionregistrationv1.FailurePolicyType
// ConversionCRDs are CRDs whose conversion webhook should point at the
// webhook Service, at path /convert.
ConversionCRDs []string
}
Options configures Ensure.
Source Files