GO-2024-2811: piraeus-operator allows attacker to impersonate service account in github.com/piraeusdatastore/piraeus-operator

controllers

package

v2.1.1 Latest Latest Go to latest Published: May 24, 2023 License: Apache-2.0 Imports: 56 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/piraeusdatastore/piraeus-operator

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func CSINodeMatchesLINSTOR(csiNodeDriver *storagev1.CSINodeDriver, linstorNode *lapi.Node) bool
func ClusterApiEndpointPatch(url string) ([]kusttypes.Patch, error)
func ClusterApiTLSCertManagerPatch(secretName string, issuer *cmmetav1.ObjectReference, dnsNames []string) ([]kusttypes.Patch, error)
func ClusterApiTLSClientCertManagerPatch(certName, secretName string, issuer *cmmetav1.ObjectReference) ([]kusttypes.Patch, error)
func ClusterApiTLSPatch(apiSecretName, clientSecretName string) ([]kusttypes.Patch, error)
func ClusterCSIApiTLSPatch(controllerSecret, nodeSecret string) ([]kusttypes.Patch, error)
func ClusterCSINodeSelectorPatch(selector map[string]string) ([]kusttypes.Patch, error)
func ClusterHAControllerNodeSelectorPatch(selector map[string]string) ([]kusttypes.Patch, error)
func ClusterLinstorInternalTLSCertManagerPatch(secretName string, issuer *cmmetav1.ObjectReference) ([]kusttypes.Patch, error)
func ClusterLinstorInternalTLSPatch(secretName string) ([]kusttypes.Patch, error)
func ClusterLinstorPassphrasePatch(secretName string) ([]kusttypes.Patch, error)
func DefaultRateLimiter() workqueue.RateLimiter
func GetCSINodeDriverFromNode(csiNode *storagev1.CSINode) *storagev1.CSINodeDriver
func LinstorControllerUrl(cluster *piraeusiov1.LinstorCluster) string
func PodReady(pod *corev1.Pod) bool
func PullSecretPatch(secretName string) ([]kusttypes.Patch, error)
func SatelliteCommonNodePatch(nodeName string) ([]kusttypes.Patch, error)
func SatelliteHostPathVolumeEnvPatch(hostPaths []string) ([]kusttypes.Patch, error)
func SatelliteHostPathVolumePatch(volumeName, hostPath string) ([]kusttypes.Patch, error)
func SatelliteLinstorInternalTLSCertManagerPatch(secretName string, issuer *cmmetav1.ObjectReference) ([]kusttypes.Patch, error)
func SatelliteLinstorInternalTLSPatch(secretName string) ([]kusttypes.Patch, error)
func SatellitePrecompiledModulePatch() ([]kusttypes.Patch, error)
type LinstorClusterReconciler
- func (r *LinstorClusterReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
- func (r *LinstorClusterReconciler) SetupWithManager(mgr ctrl.Manager, opts controller.Options) error
type LinstorSatelliteReconciler
- func (r *LinstorSatelliteReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
- func (r *LinstorSatelliteReconciler) SetupWithManager(mgr ctrl.Manager, opts controller.Options) error

Constants ¶

This section is empty.

Variables ¶

View Source

var SatelliteNameReplacements = []kusttypes.ReplacementField{
	{Replacement: kusttypes.Replacement{
		Source: &kusttypes.SourceSelector{
			ResId: resid.NewResId(resid.NewGvk("", "v1", "Pod"), "satellite"),

			FieldPath: "spec.affinity.nodeAffinity.requiredDuringSchedulingIgnoredDuringExecution.nodeSelectorTerms.0.matchFields.0.values.0",
		},
		Targets: []*kusttypes.TargetSelector{
			{

				Select:     &kusttypes.Selector{ResId: resid.NewResId(resid.NewGvk("", "v1", "Pod"), "satellite")},
				FieldPaths: []string{"metadata.name"},
			},
			{

				Select:     &kusttypes.Selector{ResId: resid.NewResIdKindOnly("ConfigMap", "")},
				FieldPaths: []string{"metadata.name"},
				Options:    &kusttypes.FieldOptions{Delimiter: "-", Index: -1},
			},
			{

				Select:     &kusttypes.Selector{ResId: resid.NewResId(resid.NewGvk("cert-manager.io", "v1", "Certificate"), "tls")},
				FieldPaths: []string{"metadata.name"},
				Options:    &kusttypes.FieldOptions{Delimiter: "-", Index: -1},
			},
			{

				Select:     &kusttypes.Selector{ResId: resid.NewResId(resid.NewGvk("cert-manager.io", "v1", "Certificate"), "tls")},
				FieldPaths: []string{"spec.dnsNames.0"},
			},
		},
	}},
}

SatelliteNameReplacements are the kustomize replacements for renaming resources for a single satellite.

Functions ¶

func CSINodeMatchesLINSTOR ¶

func CSINodeMatchesLINSTOR(csiNodeDriver *storagev1.CSINodeDriver, linstorNode *lapi.Node) bool

func ClusterApiEndpointPatch ¶ added in v2.1.0

func ClusterApiEndpointPatch(url string) ([]kusttypes.Patch, error)

func ClusterApiTLSCertManagerPatch ¶

func ClusterApiTLSCertManagerPatch(secretName string, issuer *cmmetav1.ObjectReference, dnsNames []string) ([]kusttypes.Patch, error)

func ClusterApiTLSClientCertManagerPatch ¶

func ClusterApiTLSClientCertManagerPatch(certName, secretName string, issuer *cmmetav1.ObjectReference) ([]kusttypes.Patch, error)

func ClusterApiTLSPatch ¶

func ClusterApiTLSPatch(apiSecretName, clientSecretName string) ([]kusttypes.Patch, error)

func ClusterCSIApiTLSPatch ¶

func ClusterCSIApiTLSPatch(controllerSecret, nodeSecret string) ([]kusttypes.Patch, error)

func ClusterCSINodeSelectorPatch ¶

func ClusterCSINodeSelectorPatch(selector map[string]string) ([]kusttypes.Patch, error)

func ClusterHAControllerNodeSelectorPatch ¶

func ClusterHAControllerNodeSelectorPatch(selector map[string]string) ([]kusttypes.Patch, error)

func ClusterLinstorInternalTLSCertManagerPatch ¶

func ClusterLinstorInternalTLSCertManagerPatch(secretName string, issuer *cmmetav1.ObjectReference) ([]kusttypes.Patch, error)

func ClusterLinstorInternalTLSPatch ¶

func ClusterLinstorInternalTLSPatch(secretName string) ([]kusttypes.Patch, error)

func ClusterLinstorPassphrasePatch ¶

func ClusterLinstorPassphrasePatch(secretName string) ([]kusttypes.Patch, error)

func DefaultRateLimiter ¶ added in v2.0.1

func DefaultRateLimiter() workqueue.RateLimiter

DefaultRateLimiter is a modified workqueue.DefaultControllerRateLimiter.

It reduced the maximum delay between reconcile attempts from 1000 seconds to 30 seconds.

func GetCSINodeDriverFromNode ¶

func GetCSINodeDriverFromNode(csiNode *storagev1.CSINode) *storagev1.CSINodeDriver

func LinstorControllerUrl ¶ added in v2.1.0

func LinstorControllerUrl(cluster *piraeusiov1.LinstorCluster) string

func PodReady ¶

func PodReady(pod *corev1.Pod) bool

func PullSecretPatch ¶

func PullSecretPatch(secretName string) ([]kusttypes.Patch, error)

func SatelliteCommonNodePatch ¶

func SatelliteCommonNodePatch(nodeName string) ([]kusttypes.Patch, error)

func SatelliteHostPathVolumeEnvPatch ¶

func SatelliteHostPathVolumeEnvPatch(hostPaths []string) ([]kusttypes.Patch, error)

func SatelliteHostPathVolumePatch ¶

func SatelliteHostPathVolumePatch(volumeName, hostPath string) ([]kusttypes.Patch, error)

func SatelliteLinstorInternalTLSCertManagerPatch ¶

func SatelliteLinstorInternalTLSCertManagerPatch(secretName string, issuer *cmmetav1.ObjectReference) ([]kusttypes.Patch, error)

func SatelliteLinstorInternalTLSPatch ¶

func SatelliteLinstorInternalTLSPatch(secretName string) ([]kusttypes.Patch, error)

func SatellitePrecompiledModulePatch ¶ added in v2.0.1

func SatellitePrecompiledModulePatch() ([]kusttypes.Patch, error)

Types ¶

type LinstorClusterReconciler ¶

type LinstorClusterReconciler struct {
	client.Client
	Scheme             *runtime.Scheme
	Namespace          string
	PullSecret         string
	ImageConfigMapName string
	LinstorApiLimiter  *rate.Limiter
	Kustomizer         *resources.Kustomizer
}

LinstorClusterReconciler reconciles a LinstorCluster object

func (*LinstorClusterReconciler) Reconcile ¶

func (r *LinstorClusterReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)

Reconcile is part of the main kubernetes reconciliation loop which aims to move the current state of the cluster closer to the desired state.

func (*LinstorClusterReconciler) SetupWithManager ¶

func (r *LinstorClusterReconciler) SetupWithManager(mgr ctrl.Manager, opts controller.Options) error

SetupWithManager sets up the controller with the Manager.

type LinstorSatelliteReconciler ¶

type LinstorSatelliteReconciler struct {
	client.Client
	Scheme             *runtime.Scheme
	Namespace          string
	ImageConfigMapName string
	LinstorApiLimiter  *rate.Limiter
	Kustomizer         *resources.Kustomizer
	// contains filtered or unexported fields
}

LinstorSatelliteReconciler reconciles a LinstorSatellite object

func (*LinstorSatelliteReconciler) Reconcile ¶

func (r *LinstorSatelliteReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)

Reconcile is part of the main kubernetes reconciliation loop which aims to move the current state of the cluster closer to the desired state.

func (*LinstorSatelliteReconciler) SetupWithManager ¶

func (r *LinstorSatelliteReconciler) SetupWithManager(mgr ctrl.Manager, opts controller.Options) error

SetupWithManager sets up the controller with the Manager.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL