Documentation
¶
Overview ¶
Package kubecontrollers holds the enterprise es-calico-kube-controllers assembly (a distinct deployment the logstorage controller reconciles) and the enterprise kube-controllers cluster role rules shared with the calico-kube-controllers modifier in pkg/enterprise/installation.
Index ¶
Constants ¶
const ( EsKubeController = "es-calico-kube-controllers" EsKubeControllerRole = "es-calico-kube-controllers" EsKubeControllerRoleBinding = "es-calico-kube-controllers" EsKubeControllerMetrics = "es-calico-kube-controllers-metrics" EsKubeControllerNetworkPolicyName = networkpolicy.CalicoComponentPolicyPrefix + "es-kube-controller-access" ElasticsearchKubeControllersUserSecret = "tigera-ee-kube-controllers-elasticsearch-access" ElasticsearchKubeControllersUserName = "tigera-ee-kube-controllers" ElasticsearchKubeControllersSecureUserSecret = "tigera-ee-kube-controllers-elasticsearch-access-gateway" ElasticsearchKubeControllersVerificationUserSecret = "tigera-ee-kube-controllers-gateway-verification-credentials" )
Variables ¶
This section is empty.
Functions ¶
func KubeControllersEnterpriseCommonRules ¶
func KubeControllersEnterpriseCommonRules(gatewayAPIPresent, managedCluster bool) []rbacv1.PolicyRule
KubeControllersEnterpriseCommonRules are the Calico Enterprise cluster role rules shared by calico-kube-controllers and es-calico-kube-controllers. gatewayAPIPresent adds the WAF v3 (Gateway API add-on) rules - gated on the GatewayAPI CR existing, not on waf.state == Enabled, so the applicationlayer controller keeps the RBAC it needs to delete the EnvoyExtensionPolicies it generated while WAF is disabled (EV-6751); the rule set is identical enabled vs disabled, so toggling waf.state causes no ClusterRole churn. managedCluster adds the license-push rule a managed cluster's kube-controllers needs.
func NewElasticsearchKubeControllers ¶
func NewElasticsearchKubeControllers(cfg *rkc.KubeControllersConfiguration) render.Component
NewElasticsearchKubeControllers fills the generic kube-controllers configuration for the enterprise es-calico-kube-controllers deployment and returns the rendered component. es-kube-controllers is a distinct deployment (talks to Elasticsearch via es-gateway) reconciled by the logstorage kube-controllers controller, so it's assembled here rather than through the render-time modifier mechanism.
Types ¶
This section is empty.
Source Files