Documentation
¶
Index ¶
- func AddKMSPluginSidecarToPodSpec(ctx context.Context, podSpec *corev1.PodSpec, containerName string, ...) error
- func AddKMSPluginSidecarToStaticPodSpec(ctx context.Context, podSpec *corev1.PodSpec, containerName string, ...) error
- type KMSPluginBuilder
- func (b *KMSPluginBuilder) Apply(ctx context.Context, podSpec *corev1.PodSpec, containerName string) error
- func (b *KMSPluginBuilder) AsStaticPod() *KMSPluginBuilder
- func (b *KMSPluginBuilder) FromEncryptionConfigSecret(namespace, secretName string, secretClient corev1client.SecretsGetter) *KMSPluginBuilder
- func (b *KMSPluginBuilder) WithHealthReporter(operatorBinary, operatorImage string) *KMSPluginBuilder
- func (b *KMSPluginBuilder) WithSecretRequired() *KMSPluginBuilder
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AddKMSPluginSidecarToPodSpec ¶
func AddKMSPluginSidecarToPodSpec(ctx context.Context, podSpec *corev1.PodSpec, containerName string, encryptionConfigNamespace string, encryptionConfigSecretName string, operatorBinary string, operatorImage string, secretClient corev1client.SecretsGetter, featureGateAccessor featuregates.FeatureGateAccess) error
AddKMSPluginSidecarToPodSpec injects KMS plugin sidecar containers into an aggregated API server pod spec (e.g., openshift-apiserver, oauth-apiserver).
It is a no-op when the KMSEncryption feature gate is not enabled or the encryption-config secret does not exist. The secretClient should be uncached to avoid injecting sidecars based on a stale encryption configuration.
func AddKMSPluginSidecarToStaticPodSpec ¶
func AddKMSPluginSidecarToStaticPodSpec(ctx context.Context, podSpec *corev1.PodSpec, containerName string, encryptionConfigNamespace string, encryptionConfigSecretName string, operatorBinary string, operatorImage string, secretClient corev1client.SecretsGetter, featureGateAccessor featuregates.FeatureGateAccess) error
AddKMSPluginSidecarToStaticPodSpec injects KMS plugin sidecar containers into a kube-apiserver static pod spec.
Static pods access KMS plugin data through the resource-dir volume, which the static pod revision controller populates on disk from the encryption-config Secret. Because those files are owned by root, each sidecar is configured to run as UID 0.
It is a no-op when the KMSEncryption feature gate is not enabled or the encryption-config secret does not exist. The secretClient should be uncached to avoid injecting sidecars based on a stale encryption configuration.
Types ¶
type KMSPluginBuilder ¶
type KMSPluginBuilder struct {
// contains filtered or unexported fields
}
KMSPluginBuilder constructs KMS plugin pod spec contributions for injection into API server pods.
func NewKMSPluginBuilder ¶
func NewKMSPluginBuilder() *KMSPluginBuilder
NewKMSPluginBuilder creates a builder that defaults to deployment mode.
func (*KMSPluginBuilder) Apply ¶
func (b *KMSPluginBuilder) Apply(ctx context.Context, podSpec *corev1.PodSpec, containerName string) error
Apply mutates the given pod spec by injecting KMS plugin sidecars, volumes, and volume mounts. containerName identifies the API server container that needs the socket volume mount.
It is a no-op (returns nil error) when no KMS plugins are found. It is idempotent.
func (*KMSPluginBuilder) AsStaticPod ¶
func (b *KMSPluginBuilder) AsStaticPod() *KMSPluginBuilder
AsStaticPod switches the builder to static pod mode. Sidecars will reference data from the resource-dir volume and run as root (UID 0).
func (*KMSPluginBuilder) FromEncryptionConfigSecret ¶
func (b *KMSPluginBuilder) FromEncryptionConfigSecret(namespace, secretName string, secretClient corev1client.SecretsGetter) *KMSPluginBuilder
FromEncryptionConfigSecret configures the builder to load KMS plugins from the named encryption-config Secret. The Secret is fetched at Apply time.
func (*KMSPluginBuilder) WithHealthReporter ¶
func (b *KMSPluginBuilder) WithHealthReporter(operatorBinary, operatorImage string) *KMSPluginBuilder
WithHealthReporter enables injection of a health-reporter sidecar. operatorBinary is the parent binary (e.g. "cluster-kube-apiserver-operator"); when empty, the subcommand is invoked directly via the image ENTRYPOINT.
func (*KMSPluginBuilder) WithSecretRequired ¶
func (b *KMSPluginBuilder) WithSecretRequired() *KMSPluginBuilder
WithSecretRequired makes Apply return an error when the encryption-config Secret does not exist, instead of silently treating it as a no-op. This is useful for callers like the preflight checker that expect the Secret to be present.
Source Files