utils

package
v1.45.0-0.dev Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 17, 2026 License: Apache-2.0 Imports: 57 Imported by: 0

Documentation

Index

Constants

View Source 
const DefaultPolicySyncPrefix = "/var/run/nodeagent"

DefaultPolicySyncPrefix is the operator-managed value for FelixConfiguration.policySyncPathPrefix. The applicationlayer and istio controllers both write this value when their respective features need a running policy-sync gRPC server on the host (Dikastes sidecar, Istio ambient waypoint l7-collector, EGW).

View Source 
const TLS_CIPHERS_ENV_VAR_NAME = "TLS_CIPHER_SUITES"

Variables

View Source 
var (
	DefaultInstanceKey           = client.ObjectKey{Name: "default"}
	DefaultEnterpriseInstanceKey = client.ObjectKey{Name: "tigera-secure"}
	OverlayInstanceKey           = client.ObjectKey{Name: "overlay"}
	KubeProxyInstanceKey         = client.ObjectKey{Name: "kube-proxy", Namespace: "kube-system"}

	PeriodicReconcileTime = 5 * time.Minute

	// StandardRetry is the amount of time to wait beofre retrying a request in
	// most scenarios. Retries should be used sparingly, and only in extraordinary
	// circumstances. Use this as a default when retries are needed.
	StandardRetry = 30 * time.Second
	// FinalizerRemovalRetry is the amount of time to wait before retrying a request
	// when waiting for the removal of a finalizer from the Installation by a non-core controller.
	FinalizerRemovalRetry = 10 * time.Second

	// AllowedSysctlKeys controls the allowed Sysctl keys can be set in Tuning plugin
	AllowedSysctlKeys = map[string]bool{
		"net.ipv4.tcp_keepalive_intvl":  true,
		"net.ipv4.tcp_keepalive_probes": true,
		"net.ipv4.tcp_keepalive_time":   true,
	}
)

Functions

func AddAPIServerWatch 

func AddAPIServerWatch(c ctrlruntime.Controller) error

func AddCRDWatches 

func AddCRDWatches(c ctrlruntime.Controller, defs []*apiextenv1.CustomResourceDefinition) error

AddCRDWatches watches the given CRDs, so the operator notices a managed CRD being changed out from under it. A variant extension calls it for the CRDs it adds.

func AddCSRWatchWithRelevancyFn added in v1.33.0 

func AddCSRWatchWithRelevancyFn(c ctrlruntime.Controller, isRelevantFn func(*certificatesv1.CertificateSigningRequest) bool) error

AddCSRWatchWithRelevancyFn adds a watch for CSRs with the given label. isRelevantFn is a function that returns true for items that are relevant to the caller.

func AddClusterWatch added in v1.40.0 

func AddClusterWatch(c ctrlruntime.Controller, obj client.Object, h handler.EventHandler) error

AddClusterWatch creates a watch on the given Cluster scoped object. If a name is provided, then it will use predicates to only return matching objects. If it is not, then all events of the provided kind will be generated. Updates that do not modify the object's generation (e.g., status and metadata) will be ignored. If a namespace is set on the obj passed in, the namespace will be set to the empty string.

func AddConfigMapWatch added in v1.0.0 

func AddConfigMapWatch(c ctrlruntime.Controller, name, namespace string, h handler.EventHandler) error

func AddDaemonsetWatch 

func AddDaemonsetWatch(c ctrlruntime.Controller, name, namespace string) error

func AddDeploymentWatch added in v1.32.0 

func AddDeploymentWatch(c ctrlruntime.Controller, name, namespace string) error

func AddInstallationWatch added in v1.32.0 

func AddInstallationWatch(c ctrlruntime.Controller) error

func AddKubeProxyWatch added in v1.40.0 

func AddKubeProxyWatch(c ctrlruntime.Controller) error

AddKubeProxyWatch creates a watch on the kube-proxy DaemonSet.

func AddNamespaceWatch added in v1.6.0 

func AddNamespaceWatch(c ctrlruntime.Controller, name string) error

func AddNamespacedWatch added in v1.19.0 

func AddNamespacedWatch(c ctrlruntime.Controller, obj client.Object, h handler.EventHandler) error

AddNamespacedWatch creates a watch on the given object. If a name and namespace are provided, then it will use predicates to only return matching objects. If they are not, then all events of the provided kind will be generated. Updates that do not modify the object's generation (e.g., status and metadata) will be ignored.

func AddNodeLocalDNSWatch added in v1.30.0 

func AddNodeLocalDNSWatch(c ctrlruntime.Controller) error

AddNodeLocalDNSWatch creates a watch on the node-local-dns pods.

func AddPeriodicReconcile added in v1.28.12 

func AddPeriodicReconcile(c ctrlruntime.Controller, period time.Duration, handler handler.EventHandler) error

func AddSecretProviderClassWatch added in v1.40.0 

func AddSecretProviderClassWatch(c ctrlruntime.Controller, name, namespace string) error

func AddSecretProviderClassWatchWithHandler added in v1.40.0 

func AddSecretProviderClassWatchWithHandler(c ctrlruntime.Controller, name, namespace string, h handler.EventHandler) error

func AddSecretWatchWithLabel added in v1.32.0 

func AddSecretWatchWithLabel(c ctrlruntime.Controller, ns, label string) error

AddSecretWatchWithLabel adds a secret watch for secrets with the given label in the given namespace. If no namespace is provided, it watches cluster-wide.

func AddSecretsWatch added in v1.0.0 

func AddSecretsWatch(c ctrlruntime.Controller, name, namespace string) error

func AddSecretsWatchWithHandler added in v1.32.0 

func AddSecretsWatchWithHandler(c ctrlruntime.Controller, name, namespace string, h handler.EventHandler) error

func AddServiceWatch added in v1.2.0 

func AddServiceWatch(c ctrlruntime.Controller, name, namespace string) error

func AddServiceWatchWithHandler added in v1.32.0 

func AddServiceWatchWithHandler(c ctrlruntime.Controller, name, namespace string, h handler.EventHandler) error

func AddTigeraStatusWatch added in v1.29.0 

func AddTigeraStatusWatch(c ctrlruntime.Controller, name string) error

AddTigeraStatusWatch creates a watch on the given object. It uses predicates to only return matching objects.

func AllPodsTerminated added in v1.38.14 

func AllPodsTerminated(ctx context.Context, c client.Client, obj client.Object) (bool, error)

func ApplicationLayerRequiresPolicySync added in v1.43.0 

func ApplicationLayerRequiresPolicySync(al *operatorv1.ApplicationLayer) bool

ApplicationLayerRequiresPolicySync reports whether the given ApplicationLayer CR has any feature enabled that requires policySyncPathPrefix to be set on FelixConfiguration. A nil receiver returns false (the AL CR is absent or being deleted).

func ContextLoggerForResource 

func ContextLoggerForResource(log logr.Logger, obj client.Object) logr.Logger

ContextLoggerForResource provides a logger instance with context set for the provided object.

func DesiredPolicySyncPathPrefix added in v1.43.0 

func DesiredPolicySyncPathPrefix(existing string, alNeeds, istioNeeds bool) string

DesiredPolicySyncPathPrefix returns the value FelixConfiguration's policySyncPathPrefix should hold given the currently set value and whether either the applicationlayer or istio controllers need it.

  • Any non-empty existing value is preserved. This covers both a customer override and the operator-managed default claimed by another controller that shares this field (egressgateway, Gateway API) and never clears it. Those controllers only ever set the default or leave it; clearing it here would break them, so the applicationlayer and istio controllers likewise never clear a value they may not own.
  • When the field is empty and either controller needs it, the operator-managed default is returned.
  • Otherwise the field stays empty.

Both the applicationlayer and istio controllers call this from their set and cleanup paths to keep coordination explicit and symmetric.

func FetchClusterInformation added in v1.39.0 

func FetchClusterInformation(ctx context.Context, cli client.Client) (v3.ClusterInformation, error)

FetchClusterInformation fetches and returns the clusterinformation.

func FetchLicenseKey added in v1.16.0 

func FetchLicenseKey(ctx context.Context, cli client.Client) (v3.LicenseKey, error)

FetchLicenseKey returns the license if it has been installed. It's useful to prevent rollout of enterprise components that might require it. It will return an error if the license is not installed/cannot be read

func GetAPIServer added in v1.19.0 

func GetAPIServer(ctx context.Context, client client.Client) (*operatorv1.APIServer, string, error)

GetAPIServer finds the correct API server instance and returns a message and error in the case of an error.

func GetBGPConfiguration added in v1.42.0 

func GetBGPConfiguration(
	ctx context.Context,
	c client.Client,
) (*v3.BGPConfiguration, error)

func GetDNSServiceIPs added in v1.30.6 

func GetDNSServiceIPs(ctx context.Context, client client.Client, provider operatorv1.Provider) ([]string, error)

func GetDNSServiceName added in v1.32.0 

func GetDNSServiceName(provider operatorv1.Provider) types.NamespacedName

GetDNSServiceName returns the name and namespace for the DNS service based on the given provider. This is "kube-dns" for most providers, but varies on OpenShift and RKE2.

func GetFelixConfiguration added in v1.37.0 

func GetFelixConfiguration(ctx context.Context, c client.Client) (*v3.FelixConfiguration, error)

func GetIfExists added in v1.38.0 

func GetIfExists[E any, ClientObj ClientObjType[E]](ctx context.Context, key client.ObjectKey, c client.Client) (*E, error)

func GetInstallationPullSecrets added in v1.43.0 

func GetInstallationPullSecrets(i *operatorv1.InstallationSpec, c client.Client) ([]*corev1.Secret, error)

func GetInstallationSpec added in v1.43.0 

func GetInstallationSpec(ctx context.Context, client client.Client) (*operatorv1.InstallationSpec, error)

GetInstallationSpec returns the current installation, accounting for overlays. Controllers take the variant from their ControllerOptions instead, so that the whole process agrees on one value.

func GetInstallationStatus added in v1.29.0 

func GetInstallationStatus(ctx context.Context, client client.Client) (*operatorv1.InstallationStatus, error)

GetInstallationStatus returns the current installation status, for use by other controllers.

func GetIstio added in v1.43.0 

func GetIstio(ctx context.Context, c client.Client) (*operatorv1.Istio, error)

Return the Istio CR if present. No error is returned if it was not found.

func GetK8sServiceEndPoint added in v1.17.0 

func GetK8sServiceEndPoint(client client.Client) (*corev1.ConfigMap, error)

GetK8sServiceEndPoint returns the kubernetes-service-endpoint configmap

func GetKubeControllerMetricsPort added in v1.30.0 

func GetKubeControllerMetricsPort(ctx context.Context, client client.Client) (int, error)

GetKubeControllerMetricsPort fetches kube controller metrics port.

func GetManagementClusterConnection added in v1.9.0 

func GetManagementClusterConnection(ctx context.Context, c client.Client) (*operatorv1.ManagementClusterConnection, error)

Return the ManagementClusterConnection CR if present. No error is returned if it was not found.

func GetPodEnvVar added in v1.34.0 

func GetPodEnvVar(spec corev1.PodSpec, name, key string) *string

func GetSecret added in v1.14.0 

func GetSecret(ctx context.Context, client client.Client, name string, ns string) (*corev1.Secret, error)

func IgnoreObject 

func IgnoreObject(obj runtime.Object) bool

IgnoreObject returns true if the object has been marked as ignored by the user, and returns false otherwise.

func IsFeatureActive added in v1.16.0 

func IsFeatureActive(license v3.LicenseKey, featureName string) bool

IsFeatureActive return true if the feature is listed in LicenseStatusKey

func IsFelixPrometheusMetricsEnabled added in v1.37.0 

func IsFelixPrometheusMetricsEnabled(felixConfiguration *v3.FelixConfiguration) bool

func IsNodeLocalDNSAvailable added in v1.30.0 

func IsNodeLocalDNSAvailable(ctx context.Context, cli client.Client) (bool, error)

func IsProjectCalicoV3Available added in v1.42.0 

func IsProjectCalicoV3Available(client client.Client, opts options.ControllerOptions, l logr.Logger) bool

IsProjectCalicoV3Available checks if projectcalico.org/v3 APIs are available. If the v3 parameter is true, it will skip the check and return true.

func IstioRequiresPolicySync added in v1.43.0 

func IstioRequiresPolicySync(istio *operatorv1.Istio, variant operatorv1.ProductVariant) bool

IstioRequiresPolicySync reports whether an Istio CR is active in a way that requires policySyncPathPrefix to be set. The L7 ambient waypoint resources (l7-collector sidecar + EnvoyFilter) are rendered when the installation variant is Enterprise and waypoint logging is enabled; this predicate mirrors that gate (via the shared WaypointLoggingEnabled helper) so the FelixConfiguration field tracks the renderer — including when waypoint logging is explicitly Disabled.

func MaintainInstallationFinalizer added in v1.38.1 

func MaintainInstallationFinalizer(
	ctx context.Context,
	c client.Client,
	mainResource client.Object,
	finalizer string,
	secondaryResources ...client.Object,
) (bool, error)

MaintainInstallationFinalizer manages a controller's finalizer on the Installation resource. We add a finalizer to the Installation when the mainResource has been installed, and only remove that finalizer when the resource has been deleted and its secondary resources have stopped running. This allows for a graceful cleanup of any resources prior to the CNI plugin being removed. The bool return value indicates if the finalizer is Set

func MonitorConfigMap added in v1.33.0 

func MonitorConfigMap(ctx context.Context, ca ctrlcache.Cache, name string, data map[string]string) error

MonitorConfigMap exits the operator if the given ConfigMap's data is changed.

func OverrideInstallationSpec added in v1.19.0 

func OverrideInstallationSpec(cfg, override operatorv1.InstallationSpec) operatorv1.InstallationSpec

func ParseGracePeriod added in v1.42.0 

func ParseGracePeriod(gracePeriod string) time.Duration

ParseGracePeriod parses a grace period string in the format "Nd" (e.g. "90d") where N is a non-negative number of days. This is the format produced by the license controller. Returns 0 if the string is empty, cannot be parsed, or represents a negative duration.

func PatchBGPConfiguration added in v1.42.0 

func PatchBGPConfiguration(
	ctx context.Context,
	c client.Client,
	patchFn func(bgpc *v3.BGPConfiguration) (bool, error),
) (*v3.BGPConfiguration, error)

func PatchFelixConfiguration added in v1.31.0 

func PatchFelixConfiguration(ctx context.Context, c client.Client, patchFn func(fc *v3.FelixConfiguration) (bool, error)) (*v3.FelixConfiguration, error)

func PopulateK8sServiceEndPoint added in v1.32.0 

func PopulateK8sServiceEndPoint(client client.Client) error

PopulateK8sServiceEndPoint reads the kubernetes-service-endpoint configmap and pushes KUBERNETES_SERVICE_HOST, KUBERNETES_SERVICE_PORT to calico-node daemonset, typha apiserver deployments

func RBACManagementEnabled 

func RBACManagementEnabled(ctx context.Context, c client.Client, variant operatorv1.ProductVariant, multiTenant bool) (bool, error)

RBACManagementEnabled reports whether the RBAC management UI should be rendered. The feature is Enterprise-only, and multi-tenant force-disables it on the ui-apis side. Otherwise the admin's switch decides; an absent ConfigMap reads as disabled.

func RemoveInstallationFinalizer added in v1.34.0 

func RemoveInstallationFinalizer(i *operatorv1.Installation, finalizer string)

func ResolveClusterIP added in v1.40.0 

func ResolveClusterIP(ctx context.Context, c client.Client, name, namespace string) (string, error)

ResolveClusterIP uses the Kubernetes API to resolve a Service to its ClusterIP.

func RestoreV3Metadata added in v1.40.3 

func RestoreV3Metadata(obj client.Object) error

func SetInstallationFinalizer added in v1.34.0 

func SetInstallationFinalizer(i *operatorv1.Installation, finalizer string)

func V3Client added in v1.42.0 

func V3Client(config *rest.Config) (client.Client, error)

V3Client creates a new controller-runtime client that can be used to interact with projectcalico.org/v3 resources. In some cases it is necessary to use a separate client from the default provisioned by the manager, as we interact with two different API groups (crd.projectcalico.org and projectcalico.org/v3) that may use the same underlying Go types.

func ValidateCertPair 

func ValidateCertPair(client client.Client, namespace, certPairSecretName, keyName, certName string) (*corev1.Secret, error)

ValidateCertPair checks if the given secret exists in the given namespace and if so that it contains key and cert fields. If an empty string is passed for the keyName argument it is skipped. If a secret exists then it is returned. If there is an error accessing the secret (except NotFound) or the cert does not have both a key and cert field then an appropriate error is returned. If no secret exists then nil, nil is returned to represent that no cert is valid.

func ValidateResourceNameIsQualified added in v1.28.1 

func ValidateResourceNameIsQualified(name string) error

ValidateResourceNameIsQualified returns a compiled list of errors which states which rule the name did not respect. Returns nil if it's a valid name.

func VerifySysctl added in v1.33.0 

func VerifySysctl(pluginData []operatorv1.Sysctl) error

func WaitToAddClusterInformationWatch added in v1.39.0 

func WaitToAddClusterInformationWatch(controller ctrlruntime.Controller, c kubernetes.Interface, log logr.Logger, flag *ReadyFlag)

func WaitToAddLicenseKeyWatch added in v1.16.0 

func WaitToAddLicenseKeyWatch(controller ctrlruntime.Controller, c kubernetes.Interface, log logr.Logger, flag *ReadyFlag)

WaitToAddLicenseKeyWatch starts a goroutine that waits for the LicenseKey CRD to be available and then adds a watch for it on the given controller.

func WaitToAddNetworkPolicyWatches added in v1.28.0 

func WaitToAddNetworkPolicyWatches(controller ctrlruntime.Controller, c kubernetes.Interface, log logr.Logger, policies []types.NamespacedName)

func WaitToAddPolicyRecommendationScopeWatch added in v1.30.5 

func WaitToAddPolicyRecommendationScopeWatch(controller ctrlruntime.Controller, c kubernetes.Interface, log logr.Logger, flag *ReadyFlag)

func WaitToAddResourceWatch added in v1.22.0 

func WaitToAddResourceWatch(controller ctrlruntime.Controller, c kubernetes.Interface, log logr.Logger, flag *ReadyFlag, objs []client.Object, predicates ...predicate.Predicate)

WaitToAddResourceWatch will check if the required CRD APIs are available and if so, it will add a watch for the resource. The completion of this operation will be signaled on a ready channel. An optional predicate can be provided to override the default generation-based predicate for all watched objects. This is useful for resources whose meaningful changes are status-only updates that don't bump generation (e.g., DatastoreMigration phase transitions).

func WaitToAddTierWatch added in v1.28.0 

func WaitToAddTierWatch(tierName string, controller ctrlruntime.Controller, c kubernetes.Interface, log logr.Logger, flag *ReadyFlag)

Types

type BPFBootstrap added in v1.40.0 

type BPFBootstrap struct {
	K8sService          *corev1.Service
	K8sServiceEndpoints *discoveryv1.EndpointSliceList
}

func BPFBootstrapRequirements added in v1.40.0 

func BPFBootstrapRequirements(ctx context.Context, c client.Client, install *operator.InstallationSpec) (*BPFBootstrap, error)

BPFBootstrapRequirements checks whether the BPF auto-bootstrap requirements are met. If so, it retrieves the kube-proxy DaemonSet, the Kubernetes service, and its EndpointSlices, returning them in a BPFBootstrap struct. If it's not possible to retrieve any of these resources, it returns an error.

type ClientObjType added in v1.38.0 

type ClientObjType[E any] interface {
	*E
	client.Object
}

type CompareResult added in v1.19.0 

type CompareResult int
const (
	Same CompareResult = iota
	AOnlySet
	BOnlySet
	Different
)

type ComponentHandler 

type ComponentHandler interface {
	CreateOrUpdateOrDelete(context.Context, render.Component, status.StatusManager) error

	// Set this component handler to "create only" operation - i.e. it only creates resources if
	// they do not already exist, and never tries to correct existing resources.
	//
	// When a component handler is "create only", and some of the objects that it is asked to
	// create already exist, but no other error occurs, the CreateOrUpdateOrDelete() method will
	// return an error that satisfies `errors.IsAlreadyExists`.  If a more serious error occurs,
	// the method will return that more serious error instead.  If none of the objects already
	// exist, and no other errors occur, the method will return nil.
	SetCreateOnly()
}

func NewComponentHandler 

func NewComponentHandler(log logr.Logger, cli client.Client, scheme *runtime.Scheme, cr metav1.Object, opts ...ComponentHandlerOption) ComponentHandler

cr is allowed to be nil in the case we don't want to put ownership on a resource, this is useful for CRD management so that they are not removed automatically.

type ComponentHandlerOption 

type ComponentHandlerOption func(*componentHandler)

ComponentHandlerOption configures a componentHandler.

func WithModifier 

func WithModifier(m ComponentModifier) ComponentHandlerOption

WithModifier supplies the modifier the handler runs each component through.

type ComponentModifier 

type ComponentModifier func(render.Component) render.Component

ComponentModifier post-processes a component before the handler renders it. The handler applies it to every component, and never learns what it does.

type LicenseStatus added in v1.42.0 

type LicenseStatus int

LicenseStatus represents the current state of the license with respect to expiry and grace period. 

const (
	// LicenseStatusValid means the license has not expired.
	LicenseStatusValid LicenseStatus = iota
	// LicenseStatusInGracePeriod means the license expiry has passed but the grace period has not elapsed.
	LicenseStatusInGracePeriod
	// LicenseStatusExpired means the license expiry plus the grace period has passed.
	LicenseStatusExpired
)

func GetLicenseStatus added in v1.42.0 

func GetLicenseStatus(license v3.LicenseKey, gracePeriod time.Duration) LicenseStatus

GetLicenseStatus returns the current license status using a single point-in-time check. It uses a single time.Now() call to avoid inconsistencies at state boundaries.

type MetaMatch added in v1.2.0 

type MetaMatch func(metav1.ObjectMeta) bool

type OnceFlag added in v1.40.0 

type OnceFlag struct {
	// contains filtered or unexported fields
}

func (*OnceFlag) Reset added in v1.40.0 

func (o *OnceFlag) Reset()

Reset clears the flag back to false.

func (*OnceFlag) TrySet added in v1.40.0 

func (o *OnceFlag) TrySet() bool

TrySet returns true if the flag was false and sets it to true. Subsequent calls return false.

type ReadyFlag added in v1.16.0 

type ReadyFlag struct {
	// contains filtered or unexported fields
}

ReadyFlag is used to synchronize access to a boolean flag flag that can be shared between go routines. The flag can be marked as ready once,as part of a initialization procedure and read multiple times afterwards

func (*ReadyFlag) IsReady added in v1.16.0 

func (r *ReadyFlag) IsReady() bool

IsReady returns true if was marked as ready

func (*ReadyFlag) MarkAsReady added in v1.16.0 

func (r *ReadyFlag) MarkAsReady()

MarkAsReady sets the flag as true

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.