Documentation
¶
Index ¶
- func EnsureKMSPluginSidecarInPodSpec(ctx context.Context, podSpec *corev1.PodSpec, containerName string, ...) error
- func EnsureKMSPluginSidecarInStaticPodSpec(ctx context.Context, podSpec *corev1.PodSpec, containerName string, ...) error
- type KMSPluginBuilder
- func (b *KMSPluginBuilder) Apply(ctx context.Context, podSpec *corev1.PodSpec, containerName string) error
- func (b *KMSPluginBuilder) AsStaticPod() *KMSPluginBuilder
- func (b *KMSPluginBuilder) FromEncryptionConfigSecret(namespace, secretName string, secretClient corev1client.SecretsGetter) *KMSPluginBuilder
- func (b *KMSPluginBuilder) WithDiskSecretName(name string) *KMSPluginBuilder
- func (b *KMSPluginBuilder) WithHealthReporter(operatorBinary, operatorImage string) *KMSPluginBuilder
- func (b *KMSPluginBuilder) WithPreflightChecker() *KMSPluginBuilder
- func (b *KMSPluginBuilder) WithSecretRequired() *KMSPluginBuilder
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EnsureKMSPluginSidecarInPodSpec ¶
func EnsureKMSPluginSidecarInPodSpec(ctx context.Context, podSpec *corev1.PodSpec, containerName string, encryptionConfigNamespace string, encryptionConfigSecretName string, operatorBinary string, operatorImage string, secretClient corev1client.SecretsGetter, featureGateAccessor featuregates.FeatureGateAccess) error
EnsureKMSPluginSidecarInPodSpec reconciles KMS plugin sidecar containers in an aggregated API server pod spec (e.g., openshift-apiserver, oauth-apiserver). It removes all KMS-managed resources (sidecars, volumes, volume mounts) and then re-adds exactly what the current encryption config requires, ensuring stale resources from a previous configuration are pruned.
It is a no-op when the KMSEncryption feature gate is not enabled or the encryption-config secret does not exist. The secretClient should be uncached to avoid injecting sidecars based on a stale encryption configuration.
func EnsureKMSPluginSidecarInStaticPodSpec ¶
func EnsureKMSPluginSidecarInStaticPodSpec(ctx context.Context, podSpec *corev1.PodSpec, containerName string, encryptionConfigNamespace string, encryptionConfigSecretName string, diskSecretName string, operatorBinary string, operatorImage string, secretClient corev1client.SecretsGetter, featureGateAccessor featuregates.FeatureGateAccess) error
EnsureKMSPluginSidecarInStaticPodSpec reconciles KMS plugin sidecar containers in a kube-apiserver static pod spec. It removes all KMS-managed resources (sidecars, volumes, volume mounts) and then re-adds exactly what the current encryption config requires, ensuring stale resources from a previous configuration are pruned.
Static pods access KMS plugin data through the resource-dir volume, which the static pod revision controller populates on disk from the encryption-config Secret. Because those files are owned by root, each sidecar is configured to run as UID 0.
It is a no-op when the KMSEncryption feature gate is not enabled or the encryption-config secret does not exist. The secretClient should be uncached to avoid injecting sidecars based on a stale encryption configuration.
Types ¶
type KMSPluginBuilder ¶
type KMSPluginBuilder struct {
// contains filtered or unexported fields
}
KMSPluginBuilder constructs KMS plugin pod spec contributions for injection into API server pods.
func NewKMSPluginBuilder ¶
func NewKMSPluginBuilder() *KMSPluginBuilder
NewKMSPluginBuilder creates a builder that defaults to deployment mode.
func (*KMSPluginBuilder) Apply ¶
func (b *KMSPluginBuilder) Apply(ctx context.Context, podSpec *corev1.PodSpec, containerName string) error
Apply mutates the given pod spec by injecting KMS plugin sidecars, volumes, and volume mounts. containerName identifies the API server container that needs the socket volume mount.
It is a no-op (returns nil error) when no KMS plugins are found. It is idempotent.
func (*KMSPluginBuilder) AsStaticPod ¶
func (b *KMSPluginBuilder) AsStaticPod() *KMSPluginBuilder
AsStaticPod switches the builder to static pod mode. Sidecars will reference data from the resource-dir volume and run as root (UID 0).
func (*KMSPluginBuilder) FromEncryptionConfigSecret ¶
func (b *KMSPluginBuilder) FromEncryptionConfigSecret(namespace, secretName string, secretClient corev1client.SecretsGetter) *KMSPluginBuilder
FromEncryptionConfigSecret configures the builder to load KMS plugins from the named encryption-config Secret. The Secret is fetched at Apply time.
func (*KMSPluginBuilder) WithDiskSecretName ¶
func (b *KMSPluginBuilder) WithDiskSecretName(name string) *KMSPluginBuilder
WithDiskSecretName overrides the name used to compute the on-disk referenceDataDir path in static pod mode. If not called, encryptionConfigSecretName is used as the path name.
func (*KMSPluginBuilder) WithHealthReporter ¶
func (b *KMSPluginBuilder) WithHealthReporter(operatorBinary, operatorImage string) *KMSPluginBuilder
WithHealthReporter enables injection of a health-reporter sidecar. operatorBinary is the parent binary (e.g. "cluster-kube-apiserver-operator"); when empty, the subcommand is invoked directly via the image ENTRYPOINT.
func (*KMSPluginBuilder) WithPreflightChecker ¶
func (b *KMSPluginBuilder) WithPreflightChecker() *KMSPluginBuilder
WithPreflightChecker enables running the preflight binary that validates KMS plugin readiness before encryption keys are created.
func (*KMSPluginBuilder) WithSecretRequired ¶
func (b *KMSPluginBuilder) WithSecretRequired() *KMSPluginBuilder
WithSecretRequired makes Apply return an error when the encryption-config Secret does not exist, instead of silently treating it as a no-op. This is useful for callers like the preflight checker that expect the Secret to be present.
Source Files