Help us shape the future of Go! Take the 2026 Go Developer Survey

common

package
v0.81.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 9, 2026 License: Apache-2.0 Imports: 32 Imported by: 1

Documentation

Overview

Copyright 2026 The Tekton Authors

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at 

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

Index

Constants

View Source 
const (
	// MetricsClientCAConfigMap is the name of the ConfigMap synced into each
	// component namespace so that the Prometheus metrics server can verify
	// the client certificate presented by Prometheus during mTLS scraping.
	MetricsClientCAConfigMap = "metrics-client-ca"

	// MetricsClientCAKey is the data key within MetricsClientCAConfigMap that
	// holds the PEM-encoded CA bundle.
	MetricsClientCAKey = "client-ca-file"

	// SourceConfigMapName is the authoritative ConfigMap in kube-system that
	// contains the Prometheus client CA bundle on OpenShift.
	//
	// When scrapeClass: tls-client-certificate-auth is set on a ServiceMonitor,
	// CMO configures Prometheus to present metrics-client-certs as the scraping
	// client certificate. That cert is signed by the kubernetes.io/kube-apiserver-client
	// signer (kubelet-signer), which is included in extension-apiserver-authentication.
	SourceConfigMapName = "extension-apiserver-authentication"
	SystemNamespace     = "kube-system"
)
View Source 
const (
	// MetricsHTTPPort is the upstream port name for plain-HTTP metrics.
	MetricsHTTPPort = "http-metrics"
	// MetricsHTTPSPort is the renamed port name after mTLS is enabled.
	MetricsHTTPSPort = "https-metrics"

	// MetricsTLSMountPath is where the serving-cert Secret is mounted.
	MetricsTLSMountPath = "/etc/metrics-tls"
	// MetricsClientCAMountPath is where the client-CA ConfigMap is mounted.
	MetricsClientCAMountPath = "/etc/metrics-client-ca"
)
View Source 
const (
	// TLS_MIN_VERSION: Go crypto/tls version string, e.g. "1.0", "1.1", "1.2", "1.3"
	TLSMinVersionEnvVar = "TLS_MIN_VERSION"
	// TLS_CIPHER_SUITES: comma-separated IANA cipher suite names,
	// e.g. "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_AES_128_GCM_SHA256"
	TLSCipherSuitesEnvVar = "TLS_CIPHER_SUITES"
	// TLS_CURVE_PREFERENCES: comma-separated elliptic curve names (not yet populated;
	// defaults to Go standard library values until openshift/api#2583 is merged)
	TLSCurvePreferencesEnvVar = "TLS_CURVE_PREFERENCES"

	// WebhookEnvVarPrefix is prepended to the TLS env var names when injecting into
	// deployments that use the Knative webhook framework. The Knative webhook binary calls
	// knativetls.DefaultConfigFromEnv("WEBHOOK_"), so it reads WEBHOOK_TLS_MIN_VERSION,
	// WEBHOOK_TLS_CIPHER_SUITES, and WEBHOOK_TLS_CURVE_PREFERENCES.
	// Components that read the env vars directly (e.g. Results API) use no prefix.
	WebhookEnvVarPrefix = "WEBHOOK_"
)
View Source 
const SkipAPIServerTLSWatch = "SKIP_APISERVER_TLS_WATCH"

SkipAPIServerTLSWatch is the env var name used as an escape hatch to suppress a fatal error when the APIServer resource is unreachable (e.g. in tests). Both the operator controller and the webhook check this variable.

Variables

This section is empty.

Functions

func APIServerTLSProfileChanged added in v0.80.0 

func APIServerTLSProfileChanged(old, new *configv1.APIServer) bool

APIServerTLSProfileChanged reports whether the TLS security profile has changed between two APIServer resources.

func AnnotateMetricsServingCert added in v0.81.2 

func AnnotateMetricsServingCert(serviceName string) mf.Transformer

AnnotateMetricsServingCert adds the OpenShift serving-cert annotation to the named Service so that OpenShift automatically provisions a TLS Secret named "<serviceName>-metrics-tls". Call this once per Service that needs its own metrics serving certificate. If another transformer already sets this annotation on the Service, do not call this — use the existing secret instead.

func ApplyCABundlesForStatefulSet added in v0.76.1 

func ApplyCABundlesForStatefulSet(name string) func(u *unstructured.Unstructured) error

ApplyCABundlesForStatefulSet is a transformer that adds CA bundle configurations to a StatefulSet. It configures both trusted CA bundle and service CA bundle by: - Adding volumes for the CA bundle ConfigMaps - Adding volume mounts to containers - Setting up necessary annotations for OpenShift service CA injection The function modifies the StatefulSet in place and returns any error encountered.

func ApplyCABundlesToDeployment added in v0.76.1 

func ApplyCABundlesToDeployment(u *unstructured.Unstructured) error

ApplyCABundlesToDeployment is a transformer that add the trustedCA volume, mount and environment variables so that the deployment uses it.

func ApplyMetricsTLS added in v0.81.2 

func ApplyMetricsTLS(kind, name, secretName string) mf.Transformer

ApplyMetricsTLS is a manifest transformer that injects the serving-cert Secret and the metrics-client-ca ConfigMap as volumes into the named Deployment or StatefulSet, and sets the METRICS_PROMETHEUS_TLS_* env vars on all containers so that the knative prometheus.Server enables mTLS.

  • kind: "Deployment" or "StatefulSet"
  • name: metadata.name of the resource to patch
  • secretName: name of the TLS Secret to mount (use MetricsServingCertSecretName)

func EnsureMetricsClientCA added in v0.81.2 

func EnsureMetricsClientCA(ctx context.Context, kubeClient kubernetes.Interface, targetNamespace string) error

EnsureMetricsClientCA reads the Prometheus client CA from kube-system/extension-apiserver-authentication and creates-or-updates the metrics-client-ca ConfigMap in targetNamespace.

The ConfigMap is mounted by Tekton component containers so that the knative prometheus.Server can verify the Prometheus client certificate during mTLS scraping (METRICS_PROMETHEUS_TLS_CLIENT_CA_FILE).

func GetOCPVersion added in v0.78.2 

func GetOCPVersion(ctx context.Context) (*semver.Version, error)

func InjectTLSEnvVars added in v0.80.0 

func InjectTLSEnvVars(tlsEnvVars *TLSEnvVars, kind string, resourceName string, containerNames []string, envVarPrefix string) mf.Transformer

InjectTLSEnvVars returns a transformer that injects TLS environment variables into the specified containers of a Deployment or StatefulSet matched by name. envVarPrefix is prepended to each env var name. Use WebhookEnvVarPrefix ("WEBHOOK_") for deployments that run the Knative webhook binary, and "" for all other components.

func IsMetricsMTLSEnabled added in v0.81.2 

func IsMetricsMTLSEnabled(lister TektonConfigLister) bool

IsMetricsMTLSEnabled reports whether spec.platforms.openshift.enableMetricsMTLS is explicitly set to true in the TektonConfig CR. Returns false when the CR cannot be read or the field is nil (default = disabled).

func MetricsServingCertSecretName added in v0.81.2 

func MetricsServingCertSecretName(serviceName string) string

MetricsServingCertSecretName returns the conventional TLS Secret name for the given Service (i.e. "<serviceName>-metrics-tls").

func RemoveFsGroupForDeployment added in v0.63.0 

func RemoveFsGroupForDeployment() mf.Transformer

RemoveFsGroupForDeployment will remove FsGroup in a deployment

func RemoveFsGroupForJob added in v0.63.0 

func RemoveFsGroupForJob() mf.Transformer

RemoveFsGroupForJob will remove FsGroup in a job

func RemoveFsGroupForStatefulSet added in v0.76.1 

func RemoveFsGroupForStatefulSet(name string) mf.Transformer

RemoveFsGroupForStatefulSet will remove FsGroup in a statefulset

func RemoveRunAsGroup 

func RemoveRunAsGroup() mf.Transformer

RemoveRunAsGroup will remove runAsGroup from all container in a deployment

func RemoveRunAsGroupForStatefulSet added in v0.76.1 

func RemoveRunAsGroupForStatefulSet(name string) mf.Transformer

RemoveRunAsGroupForStatefulSet will remove runAsGroup from all container in a statefulset

func RemoveRunAsUser added in v0.50.0 

func RemoveRunAsUser() mf.Transformer

RemoveRunAsUser will remove RunAsUser from all container in a deployment

func RemoveRunAsUserForJob added in v0.63.0 

func RemoveRunAsUserForJob() mf.Transformer

RemoveRunAsUserForJob will remove RunAsUser from all container in a job

func RemoveRunAsUserForStatefulSet added in v0.76.1 

func RemoveRunAsUserForStatefulSet(name string) mf.Transformer

RemoveRunAsUserForStatefulset will remove RunAsUser from all container in a statefulset

func RenameServicePort added in v0.81.2 

func RenameServicePort(serviceName, fromPort, toPort string) mf.Transformer

RenameServicePort renames fromPort to toPort on the named Service. Use this to align the Service port name with what the ServiceMonitor expects (e.g. "http-metrics" → "https-metrics", "prometheus" → "https-prometheus").

func ResolveMetricsMTLS added in v0.81.2 

func ResolveMetricsMTLS(ctx context.Context, operatorClient versioned.Interface, kubeClient kubernetes.Interface, targetNamespace string) (bool, error)

ResolveMetricsMTLS is the single call components make in PreReconcile to determine whether mTLS transformers should be applied this cycle.

It reads TektonConfig directly via a live API call (not the lister) to avoid a race condition where the component reconciler fires between the TektonConfig platform-data-hash annotation being updated and the TektonConfig informer cache being refreshed. Using a stale lister in that window would cause the component to stamp the new hash with stale mTLS state, making subsequent reconciles see a matching hash and never correcting the resources.

func SetSharedAPIServerLister added in v0.80.0 

func SetSharedAPIServerLister(lister configv1listers.APIServerLister, client openshiftconfigclient.Interface)

SetSharedAPIServerLister sets the shared APIServer lister and client. This should be called once during TektonConfig controller initialization.

func SetupAPIServerTLSWatch added in v0.80.0 

func SetupAPIServerTLSWatch(ctx context.Context, cfg *rest.Config, onTLSChange func()) error

SetupAPIServerTLSWatch creates an OpenShift APIServer informer, registers onTLSChange to be called whenever the TLS security profile changes, waits for the informer cache to sync, and then sets the shared APIServer lister so that GetTLSProfileFromAPIServer works in the calling process.

This function is intentionally generic so it can be used by any process:

  • The operator controller passes impl.EnqueueKey(...) as onTLSChange.
  • The webhook binary passes os.Exit(1) as onTLSChange (restarts to pick up new TLS config).

func UpdateServiceMonitorForMetricsMTLS added in v0.81.2 

func UpdateServiceMonitorForMetricsMTLS(smName, fromPort, toPort, serviceName, targetNamespace string) mf.Transformer

UpdateServiceMonitorForMetricsMTLS transforms a ServiceMonitor (matched by name) that was previously scraping over plain HTTP into one that uses mTLS:

  • Renames the endpoint port from fromPort to toPort
  • Sets scheme to "https"
  • Injects the standard Prometheus-pod tlsConfig (cert/key/ca file paths + serverName derived from serviceName and targetNamespace)

fromPort and toPort must be consistent with the corresponding RenameServicePort call on the backing Service (e.g. MetricsHTTPPort → MetricsHTTPSPort).

func UpdateServiceMonitorTargetNamespace added in v0.64.0 

func UpdateServiceMonitorTargetNamespace(targetNamespace string) mf.Transformer

Types

type APIServerListers added in v0.80.0 

type APIServerListers struct {
	// contains filtered or unexported fields
}

APIServerListers implements the configobserver.Listers interface for accessing APIServer resources. This adapter enables using library-go's ObserveTLSSecurityProfile function with our informer setup.

func (*APIServerListers) APIServerLister added in v0.80.0 

func (a *APIServerListers) APIServerLister() configv1listers.APIServerLister

APIServerLister returns the APIServer lister

func (*APIServerListers) PreRunHasSynced added in v0.80.0 

func (a *APIServerListers) PreRunHasSynced() []cache.InformerSynced

PreRunHasSynced returns nil (no pre-run sync needed)

func (*APIServerListers) ResourceSyncer added in v0.80.0 

func (a *APIServerListers) ResourceSyncer() resourcesynccontroller.ResourceSyncer

ResourceSyncer is not used but required by the Listers interface

type TLSEnvVars added in v0.80.0 

type TLSEnvVars struct {
	MinVersion       string
	CipherSuites     string
	CurvePreferences string
}

TLSEnvVars holds TLS configuration as environment variable values

func ResolveCentralTLSToEnvVars added in v0.80.0 

func ResolveCentralTLSToEnvVars(ctx context.Context, lister TektonConfigLister) (*TLSEnvVars, error)

ResolveCentralTLSToEnvVars checks whether central TLS config is enabled in TektonConfig, fetches the raw profile from the shared APIServer lister, and converts it to env vars. Returns (nil, nil) if central TLS is disabled or no TLS config is available.

func TLSEnvVarsFromProfile added in v0.80.0 

func TLSEnvVarsFromProfile(cfg *TLSProfileConfig) (*TLSEnvVars, error)

TLSEnvVarsFromProfile validates and converts a raw TLSProfileConfig to TLSEnvVars suitable for injection into component deployments.

type TLSProfileConfig added in v0.80.0 

type TLSProfileConfig struct {
	MinTLSVersion    string
	CipherSuites     []string
	CurvePreferences []string // Not yet populated; will be set once openshift/api#2583 is merged
}

TLSProfileConfig holds the raw TLS profile data as extracted from the APIServer resource. Values are in library-go / OpenShift API format (e.g. "VersionTLS12", IANA cipher names).

func GetTLSProfileFromAPIServer added in v0.80.0 

func GetTLSProfileFromAPIServer(ctx context.Context) (*TLSProfileConfig, error)

GetTLSProfileFromAPIServer fetches the raw TLS security profile from the OpenShift APIServer resource. Returns (nil, nil) if no TLS profile is configured or the shared lister is not initialized.

type TektonConfigLister added in v0.80.0 

type TektonConfigLister interface {
	Get(name string) (*v1alpha1.TektonConfig, error)
}

TektonConfigLister abstracts access to TektonConfig resources.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.