Documentation
¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ( CertificateAuthorityResources = []struct { Name string Dir string }{ {Name: "kube-control-plane-signer", Dir: cryptomaterial.KubeControlPlaneSignerCertDir(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "kube-apiserver-to-kubelet-signer", Dir: cryptomaterial.KubeAPIServerToKubeletSignerCertDir(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "admin-kubeconfig-signer", Dir: cryptomaterial.AdminKubeconfigSignerDir(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "kubelet-signer", Dir: cryptomaterial.KubeletCSRSignerSignerCertDir(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "kube-csr-signer", Dir: cryptomaterial.CSRSignerCertDir(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "aggregator-signer", Dir: cryptomaterial.AggregatorSignerDir(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "service-ca", Dir: cryptomaterial.ServiceCADir(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "ingress-ca", Dir: cryptomaterial.IngressCADir(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "kube-apiserver-external-signer", Dir: cryptomaterial.KubeAPIServerExternalSigner(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "kube-apiserver-localhost-signer", Dir: cryptomaterial.KubeAPIServerLocalhostSigner(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "kube-apiserver-service-network-signer", Dir: cryptomaterial.KubeAPIServerServiceNetworkSigner(cryptomaterial.CertsDirectory(config.DataDir))}, {Name: "etcd-signer", Dir: cryptomaterial.EtcdSignerDir(cryptomaterial.CertsDirectory(config.DataDir))}, } ServiceAccountKeyResources = []struct { Name string Dir string }{ {Name: "service-account-key", Dir: filepath.Join(config.DataDir, "/resources/kube-apiserver/secrets/service-account-key")}, } )
Functions ¶
func ProvisionMetricsClientCA ¶
ProvisionMetricsClientCA provisions the admin-kubeconfig-signer CA that kube-rbac-proxy sidecars in kube-state-metrics and node-exporter use to verify client certificates on incoming scrape requests. The CA cannot be included in static manifests because it is generated at MicroShift startup and may be rotated; this function ensures the ConfigMap reflects the current CA.
func ProvisionMetricsServerCerts ¶
ProvisionMetricsServerCerts provisions the TLS client certificate and kubelet serving CA that metrics-server needs to authenticate to kubelet and verify its serving certificate when scraping /metrics/resource. These are provisioned at runtime rather than baked into manifests because the certificates are generated by MicroShift's certificate lifecycle and must be refreshed from the live PKI.
Types ¶
This section is empty.
Source Files