Documentation
¶
Index ¶
- Constants
- func MergeWAFPullSecret(pullSecrets []*corev1.Secret) (*corev1.Secret, []string)
- func NodeReporterPort(fc *v3.FelixConfiguration) int
- func ValidateReporterPort(fc *v3.FelixConfiguration) error
- type Extension
- func (e *Extension) DefaultFelixConfiguration(install *operatorv1.InstallationSpec, fc *v3.FelixConfiguration) (bool, error)
- func (e *Extension) ExtendInputs(ctx context.Context, ci controller.Inputs) (controller.Inputs, []certificatemanagement.KeyPairInterface, error)
- func (e *Extension) Images() *imageoverride.Overrides
- func (e *Extension) Modify(c render.Component, ri render.Inputs) render.Component
- func (e *Extension) ProductVersion() string
- func (e *Extension) Watches(c ctrlruntime.Controller) error
Constants ¶
const ( // WASMPullSecretName is the dedicated image-pull Secret (a merged copy of the // install pull secrets) the WAF reconciler replicates into tenant namespaces for // the Coraza wasm OCI pull. A dedicated name avoids clashing with the // operator-managed tigera-pull-secret the GatewayAPI render also copies there (EV-6386). WASMPullSecretName = "tigera-waf-pull-secret" // WASMCACertName is the dedicated CA-bundle ConfigMap the WAF reconciler // replicates into tenant namespaces for the Coraza wasm OCI registry TLS check - // a dedicated name avoids clashing with the operator-managed tigera-ca-bundle the // GatewayAPI render also copies there (EV-6386). It is a renamed copy of the trusted bundle. WASMCACertName = "tigera-waf-ca-bundle" )
Variables ¶
This section is empty.
Functions ¶
func MergeWAFPullSecret ¶
MergeWAFPullSecret synthesizes the dedicated WAF wasm pull secret (tigera-waf-pull-secret) by merging the registry auths of every Installation pull secret. The EnvoyExtensionPolicy image source takes a single pullSecretRef, so a merged secret is the only way to honor multiple Installation pull secrets for the Coraza wasm OCI pull (e.g. the Tigera pull secret plus a private registry mirror).
If the same registry appears in more than one secret, the first secret in Installation order wins. Secrets that cannot be parsed are skipped and their names returned, so the caller can log them without failing the reconcile. Returns a nil Secret when no registry auths could be collected.
func NodeReporterPort ¶
func NodeReporterPort(fc *v3.FelixConfiguration) int
NodeReporterPort returns the reporter metrics port from the FelixConfiguration, falling back to the default. The node-metrics Service and the FELIX_PROMETHEUSREPORTERPORT env var both derive from here so they can't drift.
func ValidateReporterPort ¶
func ValidateReporterPort(fc *v3.FelixConfiguration) error
ValidateReporterPort rejects the unsupported zero prometheus reporter port. The node and windows controller extensions share it.
Types ¶
type Extension ¶
type Extension struct {
// contains filtered or unexported fields
}
Extension is the Calico Enterprise behavior for the installation controller and the components it renders.
func New ¶
func New(variant operatorv1.ProductVariant, opts eoptions.Options) *Extension
New returns the installation extension for the variant the operator resolved.
func (*Extension) DefaultFelixConfiguration ¶
func (e *Extension) DefaultFelixConfiguration(install *operatorv1.InstallationSpec, fc *v3.FelixConfiguration) (bool, error)
DefaultFelixConfiguration sets the Enterprise-only FelixConfiguration defaults. Some platforms run a DNS service that isn't named "kube-dns", so dnsTrustedServers needs a provider-specific default for Enterprise DNS logging to work. Returns whether it changed fc.
func (*Extension) ExtendInputs ¶
func (e *Extension) ExtendInputs(ctx context.Context, ci controller.Inputs) (controller.Inputs, []certificatemanagement.KeyPairInterface, error)
ExtendInputs does the controller-side work the modifiers can't: creating and fetching the certificates that feed the trusted bundle. It returns the render inputs carrying the produced node prometheus keypair, and that keypair as one the controller should manage.
func (*Extension) Images ¶
func (e *Extension) Images() *imageoverride.Overrides
func (*Extension) Modify ¶
Modify dispatches over the components the installation controller renders.
func (*Extension) ProductVersion ¶
Validate rejects installation config Calico Enterprise does not support. ProductVersion is the Calico Enterprise release the operator reports in status.
func (*Extension) Watches ¶
func (e *Extension) Watches(c ctrlruntime.Controller) error
Watches registers the enterprise resources the installation controller reconciles on.
Source Files