podcertificate

type IssuingManager ¶

type IssuingManager struct {
	// contains filtered or unexported fields
}

IssuingManager is the main implementation of Manager.

The core construct is a workqueue that contains one entry for each PodCertificateProjection (tracked with a podname/volumename/sourceindex tuple) in each non-mirror Pod scheduled to the node. Everytime anything interesting happens to a PodCertificateRequest or Pod, we redrive all of the potentially-affected PodCertificateProjections into the workqueue.

State is not preserved across restarts --- if Kubelet or the node restarts, then all PodCertificateProjections will be queued for immediate refresh.

Refresh is handled by periodicially redriving all PodCertificateProjections into the queue.

func NewIssuingManager(kc kubernetes.Interface, podManager PodManager, recorder record.EventRecorder, pcrInformer certinformersv1beta1.PodCertificateRequestInformer, nodeInformer coreinformersv1.NodeInformer, nodeName types.NodeName, clock clock.WithTicker) *IssuingManager

func (m *IssuingManager) ForgetPod(ctx context.Context, pod *corev1.Pod)

func (m *IssuingManager) GetPodCertificateCredentialBundle(ctx context.Context, namespace, podName, podUID, volumeName string, sourceIndex int) ([]byte, []byte, error)

func (m *IssuingManager) MetricReport() *MetricReport

func (m *IssuingManager) Run(ctx context.Context)

func (m *IssuingManager) TrackPod(ctx context.Context, pod *corev1.Pod)

type Manager ¶

type Manager interface {
	// TrackPod is called by Kubelet every time a new pod is assigned to the node.
	TrackPod(ctx context.Context, pod *corev1.Pod)
	// ForgetPod is called by Kubelet every time a pod is dropped from the node.
	ForgetPod(ctx context.Context, pod *corev1.Pod)

	// GetPodCertificateCredentialBundle is called by the volume host to
	// retrieve the credential bundle for a given pod certificate volume.
	GetPodCertificateCredentialBundle(ctx context.Context, namespace, podName, podUID, volumeName string, sourceIndex int) (privKey []byte, certChain []byte, err error)

	// MetricReport returns a snapshot of current pod certificate states for this manager.
	MetricReport() *MetricReport
}

Manager abstracts the functionality needed by Kubelet and the volume host in order to provide pod certificate functionality.

type MetricReport ¶

type MetricReport struct {
	PodCertificateStates map[SignerAndState]int
}

MetricReport contains metrics about the current state of pod certificate projected volume sources.

type NoOpManager ¶

type NoOpManager struct{}

NoOpManager is an implementation of Manager that just returns errors, meant for use in static/detached Kubelet mode.

func (m *NoOpManager) ForgetPod(ctx context.Context, pod *corev1.Pod)

func (m *NoOpManager) GetPodCertificateCredentialBundle(ctx context.Context, namespace, podName, podUID, volumeName string, sourceIndex int) ([]byte, []byte, error)

func (m *NoOpManager) MetricReport() *MetricReport

func (m *NoOpManager) TrackPod(ctx context.Context, pod *corev1.Pod)

type PodManager ¶

type PodManager interface {
	GetPodByUID(uid types.UID) (*corev1.Pod, bool)
	GetPods() []*corev1.Pod
}

PodManager is a local wrapper interface for pod.Manager.

type SignerAndState ¶

type SignerAndState struct {
	SignerName string
	State      string
}

SignerAndState represents a combination of a signer name and the state of a pod certificate.