common

package
v0.80.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jun 8, 2026 License: Apache-2.0 Imports: 29 Imported by: 1

Documentation

Overview

Copyright 2026 The Tekton Authors

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Index

Constants

View Source 
const (
	// TLS_MIN_VERSION: Go crypto/tls version string, e.g. "1.0", "1.1", "1.2", "1.3"
	TLSMinVersionEnvVar = "TLS_MIN_VERSION"
	// TLS_CIPHER_SUITES: comma-separated IANA cipher suite names,
	// e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_AES_128_GCM_SHA256"
	TLSCipherSuitesEnvVar = "TLS_CIPHER_SUITES"
	// TLS_CURVE_PREFERENCES: comma-separated elliptic curve names (not yet populated;
	// defaults to Go standard library values until openshift/api#2583 is merged)
	TLSCurvePreferencesEnvVar = "TLS_CURVE_PREFERENCES"

	// WebhookEnvVarPrefix is prepended to the TLS env var names when injecting into
	// deployments that use the Knative webhook framework. The Knative webhook binary calls
	// knativetls.DefaultConfigFromEnv("WEBHOOK_"), so it reads WEBHOOK_TLS_MIN_VERSION,
	// WEBHOOK_TLS_CIPHER_SUITES, and WEBHOOK_TLS_CURVE_PREFERENCES.
	// Components that read the env vars directly (e.g. Results API) use no prefix.
	WebhookEnvVarPrefix = "WEBHOOK_"
)
View Source 
const SkipAPIServerTLSWatch = "SKIP_APISERVER_TLS_WATCH"

SkipAPIServerTLSWatch is the env var name used as an escape hatch to suppress a fatal error when the APIServer resource is unreachable (e.g. in tests). Both the operator controller and the webhook check this variable.

Variables

This section is empty.

Functions

func APIServerTLSProfileChanged added in v0.80.0 

func APIServerTLSProfileChanged(old, new *configv1.APIServer) bool

APIServerTLSProfileChanged reports whether the TLS security profile has changed between two APIServer resources.

func ApplyCABundlesForStatefulSet added in v0.76.1 

func ApplyCABundlesForStatefulSet(name string) func(u *unstructured.Unstructured) error

ApplyCABundlesForStatefulSet is a transformer that adds CA bundle configurations to a StatefulSet. It configures both trusted CA bundle and service CA bundle by: - Adding volumes for the CA bundle ConfigMaps - Adding volume mounts to containers - Setting up necessary annotations for OpenShift service CA injection The function modifies the StatefulSet in place and returns any error encountered.

func ApplyCABundlesToDeployment added in v0.76.1 

func ApplyCABundlesToDeployment(u *unstructured.Unstructured) error

ApplyCABundlesToDeployment is a transformer that add the trustedCA volume, mount and environment variables so that the deployment uses it.

func GetOCPVersion added in v0.78.2 

func GetOCPVersion(ctx context.Context) (*semver.Version, error)

func InjectTLSEnvVars added in v0.80.0 

func InjectTLSEnvVars(tlsEnvVars *TLSEnvVars, kind string, resourceName string, containerNames []string, envVarPrefix string) mf.Transformer

InjectTLSEnvVars returns a transformer that injects TLS environment variables into the specified containers of a Deployment or StatefulSet matched by name. envVarPrefix is prepended to each env var name. Use WebhookEnvVarPrefix ("WEBHOOK_") for deployments that run the Knative webhook binary, and "" for all other components.

func RemoveFsGroupForDeployment added in v0.63.0 

func RemoveFsGroupForDeployment() mf.Transformer

RemoveFsGroupForDeployment will remove FsGroup in a deployment

func RemoveFsGroupForJob added in v0.63.0 

func RemoveFsGroupForJob() mf.Transformer

RemoveFsGroupForJob will remove FsGroup in a job

func RemoveFsGroupForStatefulSet added in v0.76.1 

func RemoveFsGroupForStatefulSet(name string) mf.Transformer

RemoveFsGroupForStatefulSet will remove FsGroup in a statefulset

func RemoveRunAsGroup 

func RemoveRunAsGroup() mf.Transformer

RemoveRunAsGroup will remove runAsGroup from all container in a deployment

func RemoveRunAsGroupForStatefulSet added in v0.76.1 

func RemoveRunAsGroupForStatefulSet(name string) mf.Transformer

RemoveRunAsGroupForStatefulSet will remove runAsGroup from all container in a statefulset

func RemoveRunAsUser added in v0.50.0 

func RemoveRunAsUser() mf.Transformer

RemoveRunAsUser will remove RunAsUser from all container in a deployment

func RemoveRunAsUserForJob added in v0.63.0 

func RemoveRunAsUserForJob() mf.Transformer

RemoveRunAsUserForJob will remove RunAsUser from all container in a job

func RemoveRunAsUserForStatefulSet added in v0.76.1 

func RemoveRunAsUserForStatefulSet(name string) mf.Transformer

RemoveRunAsUserForStatefulset will remove RunAsUser from all container in a statefulset

func SetSharedAPIServerLister added in v0.80.0 

func SetSharedAPIServerLister(lister configv1listers.APIServerLister, client openshiftconfigclient.Interface)

SetSharedAPIServerLister sets the shared APIServer lister and client. This should be called once during TektonConfig controller initialization.

func SetupAPIServerTLSWatch added in v0.80.0 

func SetupAPIServerTLSWatch(ctx context.Context, cfg *rest.Config, onTLSChange func()) error

SetupAPIServerTLSWatch creates an OpenShift APIServer informer, registers onTLSChange to be called whenever the TLS security profile changes, waits for the informer cache to sync, and then sets the shared APIServer lister so that GetTLSProfileFromAPIServer works in the calling process.

This function is intentionally generic so it can be used by any process:

  • The operator controller passes impl.EnqueueKey(...) as onTLSChange.
  • The webhook binary passes os.Exit(1) as onTLSChange (restarts to pick up new TLS config).

func UpdateServiceMonitorTargetNamespace added in v0.64.0 

func UpdateServiceMonitorTargetNamespace(targetNamespace string) mf.Transformer

Types

type APIServerListers added in v0.80.0 

type APIServerListers struct {
	// contains filtered or unexported fields
}

APIServerListers implements the configobserver.Listers interface for accessing APIServer resources. This adapter enables using library-go's ObserveTLSSecurityProfile function with our informer setup.

func (*APIServerListers) APIServerLister added in v0.80.0 

func (a *APIServerListers) APIServerLister() configv1listers.APIServerLister

APIServerLister returns the APIServer lister

func (*APIServerListers) PreRunHasSynced added in v0.80.0 

func (a *APIServerListers) PreRunHasSynced() []cache.InformerSynced

PreRunHasSynced returns nil (no pre-run sync needed)

func (*APIServerListers) ResourceSyncer added in v0.80.0 

func (a *APIServerListers) ResourceSyncer() resourcesynccontroller.ResourceSyncer

ResourceSyncer is not used but required by the Listers interface

type TLSEnvVars added in v0.80.0 

type TLSEnvVars struct {
	MinVersion       string
	CipherSuites     string
	CurvePreferences string
}

TLSEnvVars holds TLS configuration as environment variable values

func ResolveCentralTLSToEnvVars added in v0.80.0 

func ResolveCentralTLSToEnvVars(ctx context.Context, lister TektonConfigLister) (*TLSEnvVars, error)

ResolveCentralTLSToEnvVars checks whether central TLS config is enabled in TektonConfig, fetches the raw profile from the shared APIServer lister, and converts it to env vars. Returns (nil, nil) if central TLS is disabled or no TLS config is available.

func TLSEnvVarsFromProfile added in v0.80.0 

func TLSEnvVarsFromProfile(cfg *TLSProfileConfig) (*TLSEnvVars, error)

TLSEnvVarsFromProfile validates and converts a raw TLSProfileConfig to TLSEnvVars suitable for injection into component deployments.

type TLSProfileConfig added in v0.80.0 

type TLSProfileConfig struct {
	MinTLSVersion    string
	CipherSuites     []string
	CurvePreferences []string // Not yet populated; will be set once openshift/api#2583 is merged
}

TLSProfileConfig holds the raw TLS profile data as extracted from the APIServer resource. Values are in library-go / OpenShift API format (e.g. "VersionTLS12", IANA cipher names).

func GetTLSProfileFromAPIServer added in v0.80.0 

func GetTLSProfileFromAPIServer(ctx context.Context) (*TLSProfileConfig, error)

GetTLSProfileFromAPIServer fetches the raw TLS security profile from the OpenShift APIServer resource. Returns (nil, nil) if no TLS profile is configured or the shared lister is not initialized.

type TektonConfigLister added in v0.80.0 

type TektonConfigLister interface {
	Get(name string) (*v1alpha1.TektonConfig, error)
}

TektonConfigLister abstracts access to TektonConfig resources.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.