Documentation
¶
Index ¶
- func FetchAPIServerTLSProfile(ctx context.Context, c client.Client) (configv1.TLSProfileSpec, error)
- func GetTLSConfigFromProfile(profileSpec configv1.TLSProfileSpec) (func(*tls.Config), []string)
- func GetTLSProfileValues(ctx context.Context, c client.Client, ...) (minVersion, cipherSuites string, observedConfig map[string]interface{}, ...)
- func NewSecurityProfileWatcher(initialProfile configv1.TLSProfileSpec, ...) *crcommon.SecurityProfileWatcher
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FetchAPIServerTLSProfile ¶
func FetchAPIServerTLSProfile(ctx context.Context, c client.Client) (configv1.TLSProfileSpec, error)
FetchAPIServerTLSProfile fetches the TLS profile spec from the cluster APIServer CR. This is a convenience wrapper around controller-runtime-common's function.
func GetTLSConfigFromProfile ¶
func GetTLSConfigFromProfile(profileSpec configv1.TLSProfileSpec) (func(*tls.Config), []string)
GetTLSConfigFromProfile returns a function that configures a tls.Config based on the provided TLS profile spec. The returned function is suitable for use with controller-runtime's metricsserver.Options TLSOpts field.
func GetTLSProfileValues ¶
func GetTLSProfileValues(ctx context.Context, c client.Client, previousObservedConfig map[string]interface{}) (minVersion, cipherSuites string, observedConfig map[string]interface{}, err error)
GetTLSProfileValues fetches the cluster API Server TLS profile via library-go's ObserveTLSSecurityProfile and returns TLS_MIN_VERSION, TLS_CIPHER_SUITES, observedConfig for future comparisons and avoid unnecessary updates Returns empty strings on error so callers fall back to kube-rbac-proxy defaults.
func NewSecurityProfileWatcher ¶
func NewSecurityProfileWatcher( initialProfile configv1.TLSProfileSpec, initialAdherence configv1.TLSAdherencePolicy, cancel context.CancelFunc, ) *crcommon.SecurityProfileWatcher
NewSecurityProfileWatcher creates a SecurityProfileWatcher that triggers graceful shutdown when TLS profile or adherence policy changes. The initial TLS profile spec and adherence policy are passed in so the watcher knows the baseline configuration from operator startup.
Types ¶
This section is empty.
Source Files