mirror of
https://github.com/ceph/ceph-csi.git
synced 2025-06-13 10:33:35 +00:00
rebase: bump k8s.io/kubernetes from 1.26.2 to 1.27.2
Bumps [k8s.io/kubernetes](https://github.com/kubernetes/kubernetes) from 1.26.2 to 1.27.2. - [Release notes](https://github.com/kubernetes/kubernetes/releases) - [Commits](https://github.com/kubernetes/kubernetes/compare/v1.26.2...v1.27.2) --- updated-dependencies: - dependency-name: k8s.io/kubernetes dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
This commit is contained in:
dependabot[bot]
committed by
mergify[bot]
mergify[bot]
parent
0e79135419
commit
07b05616a0
33
vendor/k8s.io/apiserver/pkg/apis/audit/install/install.go
generated
vendored
Normal file
33
vendor/k8s.io/apiserver/pkg/apis/audit/install/install.go
generated
vendored
Normal file
@ -0,0 +1,33 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Package install installs the experimental API group, making it available as
|
||||
// an option to all of the API encoding/decoding machinery.
|
||||
package install
|
||||
|
||||
import (
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
utilruntime "k8s.io/apimachinery/pkg/util/runtime"
|
||||
"k8s.io/apiserver/pkg/apis/audit"
|
||||
"k8s.io/apiserver/pkg/apis/audit/v1"
|
||||
)
|
||||
|
||||
// Install registers the API group and adds types to a scheme
|
||||
func Install(scheme *runtime.Scheme) {
|
||||
utilruntime.Must(audit.AddToScheme(scheme))
|
||||
utilruntime.Must(v1.AddToScheme(scheme))
|
||||
utilruntime.Must(scheme.SetVersionPriority(v1.SchemeGroupVersion))
|
||||
}
|
||||
133
vendor/k8s.io/apiserver/pkg/apis/audit/validation/validation.go
generated
vendored
Normal file
133
vendor/k8s.io/apiserver/pkg/apis/audit/validation/validation.go
generated
vendored
Normal file
@ -0,0 +1,133 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package validation
|
||||
|
||||
import (
|
||||
"strings"
|
||||
|
||||
"k8s.io/apimachinery/pkg/api/validation"
|
||||
"k8s.io/apimachinery/pkg/util/validation/field"
|
||||
"k8s.io/apiserver/pkg/apis/audit"
|
||||
)
|
||||
|
||||
// ValidatePolicy validates the audit policy
|
||||
func ValidatePolicy(policy *audit.Policy) field.ErrorList {
|
||||
var allErrs field.ErrorList
|
||||
allErrs = append(allErrs, validateOmitStages(policy.OmitStages, field.NewPath("omitStages"))...)
|
||||
rulePath := field.NewPath("rules")
|
||||
for i, rule := range policy.Rules {
|
||||
allErrs = append(allErrs, validatePolicyRule(rule, rulePath.Index(i))...)
|
||||
}
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validatePolicyRule(rule audit.PolicyRule, fldPath *field.Path) field.ErrorList {
|
||||
var allErrs field.ErrorList
|
||||
allErrs = append(allErrs, validateLevel(rule.Level, fldPath.Child("level"))...)
|
||||
allErrs = append(allErrs, validateNonResourceURLs(rule.NonResourceURLs, fldPath.Child("nonResourceURLs"))...)
|
||||
allErrs = append(allErrs, validateResources(rule.Resources, fldPath.Child("resources"))...)
|
||||
allErrs = append(allErrs, validateOmitStages(rule.OmitStages, fldPath.Child("omitStages"))...)
|
||||
|
||||
if len(rule.NonResourceURLs) > 0 {
|
||||
if len(rule.Resources) > 0 || len(rule.Namespaces) > 0 {
|
||||
allErrs = append(allErrs, field.Invalid(fldPath.Child("nonResourceURLs"), rule.NonResourceURLs, "rules cannot apply to both regular resources and non-resource URLs"))
|
||||
}
|
||||
}
|
||||
|
||||
return allErrs
|
||||
}
|
||||
|
||||
var validLevels = []string{
|
||||
string(audit.LevelNone),
|
||||
string(audit.LevelMetadata),
|
||||
string(audit.LevelRequest),
|
||||
string(audit.LevelRequestResponse),
|
||||
}
|
||||
|
||||
var validOmitStages = []string{
|
||||
string(audit.StageRequestReceived),
|
||||
string(audit.StageResponseStarted),
|
||||
string(audit.StageResponseComplete),
|
||||
string(audit.StagePanic),
|
||||
}
|
||||
|
||||
func validateLevel(level audit.Level, fldPath *field.Path) field.ErrorList {
|
||||
switch level {
|
||||
case audit.LevelNone, audit.LevelMetadata, audit.LevelRequest, audit.LevelRequestResponse:
|
||||
return nil
|
||||
case "":
|
||||
return field.ErrorList{field.Required(fldPath, "")}
|
||||
default:
|
||||
return field.ErrorList{field.NotSupported(fldPath, level, validLevels)}
|
||||
}
|
||||
}
|
||||
|
||||
func validateNonResourceURLs(urls []string, fldPath *field.Path) field.ErrorList {
|
||||
var allErrs field.ErrorList
|
||||
for i, url := range urls {
|
||||
if url == "*" {
|
||||
continue
|
||||
}
|
||||
|
||||
if !strings.HasPrefix(url, "/") {
|
||||
allErrs = append(allErrs, field.Invalid(fldPath.Index(i), url, "non-resource URL rules must begin with a '/' character"))
|
||||
}
|
||||
|
||||
if url != "" && strings.ContainsRune(url[:len(url)-1], '*') {
|
||||
allErrs = append(allErrs, field.Invalid(fldPath.Index(i), url, "non-resource URL wildcards '*' must be the final character of the rule"))
|
||||
}
|
||||
}
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateResources(groupResources []audit.GroupResources, fldPath *field.Path) field.ErrorList {
|
||||
var allErrs field.ErrorList
|
||||
for _, groupResource := range groupResources {
|
||||
// The empty string represents the core API group.
|
||||
if len(groupResource.Group) != 0 {
|
||||
// Group names must be lower case and be valid DNS subdomains.
|
||||
// reference: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md
|
||||
// an error is returned for group name like rbac.authorization.k8s.io/v1beta1
|
||||
// rbac.authorization.k8s.io is the valid one
|
||||
if msgs := validation.NameIsDNSSubdomain(groupResource.Group, false); len(msgs) != 0 {
|
||||
allErrs = append(allErrs, field.Invalid(fldPath.Child("group"), groupResource.Group, strings.Join(msgs, ",")))
|
||||
}
|
||||
}
|
||||
|
||||
if len(groupResource.ResourceNames) > 0 && len(groupResource.Resources) == 0 {
|
||||
allErrs = append(allErrs, field.Invalid(fldPath.Child("resourceNames"), groupResource.ResourceNames, "using resourceNames requires at least one resource"))
|
||||
}
|
||||
}
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateOmitStages(omitStages []audit.Stage, fldPath *field.Path) field.ErrorList {
|
||||
var allErrs field.ErrorList
|
||||
for i, stage := range omitStages {
|
||||
valid := false
|
||||
for _, validOmitStage := range validOmitStages {
|
||||
if string(stage) == validOmitStage {
|
||||
valid = true
|
||||
break
|
||||
}
|
||||
}
|
||||
if !valid {
|
||||
allErrs = append(allErrs, field.Invalid(fldPath.Index(i), string(stage), "allowed stages are "+strings.Join(validOmitStages, ",")))
|
||||
}
|
||||
}
|
||||
return allErrs
|
||||
}
|
||||
19
vendor/k8s.io/apiserver/pkg/apis/config/doc.go
generated
vendored
Normal file
19
vendor/k8s.io/apiserver/pkg/apis/config/doc.go
generated
vendored
Normal file
@ -0,0 +1,19 @@
|
||||
/*
|
||||
Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:deepcopy-gen=package
|
||||
|
||||
package config // import "k8s.io/apiserver/pkg/apis/config"
|
||||
53
vendor/k8s.io/apiserver/pkg/apis/config/register.go
generated
vendored
Normal file
53
vendor/k8s.io/apiserver/pkg/apis/config/register.go
generated
vendored
Normal file
@ -0,0 +1,53 @@
|
||||
/*
|
||||
Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
var (
|
||||
// SchemeBuilder points to a list of functions added to Scheme.
|
||||
SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
|
||||
// AddToScheme adds this group to a scheme.
|
||||
AddToScheme = SchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
// GroupName is the group name use in this package.
|
||||
const GroupName = "apiserver.config.k8s.io"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects.
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
|
||||
|
||||
// Kind takes an unqualified kind and returns a Group qualified GroupKind.
|
||||
func Kind(kind string) schema.GroupKind {
|
||||
return SchemeGroupVersion.WithKind(kind).GroupKind()
|
||||
}
|
||||
|
||||
// Resource takes an unqualified resource and returns a Group qualified GroupResource.
|
||||
func Resource(resource string) schema.GroupResource {
|
||||
return SchemeGroupVersion.WithResource(resource).GroupResource()
|
||||
}
|
||||
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
// TODO this will get cleaned up with the scheme types are fixed
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&EncryptionConfiguration{},
|
||||
)
|
||||
return nil
|
||||
}
|
||||
103
vendor/k8s.io/apiserver/pkg/apis/config/types.go
generated
vendored
Normal file
103
vendor/k8s.io/apiserver/pkg/apis/config/types.go
generated
vendored
Normal file
@ -0,0 +1,103 @@
|
||||
/*
|
||||
Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
|
||||
// EncryptionConfiguration stores the complete configuration for encryption providers.
|
||||
type EncryptionConfiguration struct {
|
||||
metav1.TypeMeta
|
||||
// resources is a list containing resources, and their corresponding encryption providers.
|
||||
Resources []ResourceConfiguration
|
||||
}
|
||||
|
||||
// ResourceConfiguration stores per resource configuration.
|
||||
type ResourceConfiguration struct {
|
||||
// resources is a list of kubernetes resources which have to be encrypted.
|
||||
Resources []string
|
||||
// providers is a list of transformers to be used for reading and writing the resources to disk.
|
||||
// eg: aesgcm, aescbc, secretbox, identity.
|
||||
Providers []ProviderConfiguration
|
||||
}
|
||||
|
||||
// ProviderConfiguration stores the provided configuration for an encryption provider.
|
||||
type ProviderConfiguration struct {
|
||||
// aesgcm is the configuration for the AES-GCM transformer.
|
||||
AESGCM *AESConfiguration
|
||||
// aescbc is the configuration for the AES-CBC transformer.
|
||||
AESCBC *AESConfiguration
|
||||
// secretbox is the configuration for the Secretbox based transformer.
|
||||
Secretbox *SecretboxConfiguration
|
||||
// identity is the (empty) configuration for the identity transformer.
|
||||
Identity *IdentityConfiguration
|
||||
// kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.
|
||||
KMS *KMSConfiguration
|
||||
}
|
||||
|
||||
// AESConfiguration contains the API configuration for an AES transformer.
|
||||
type AESConfiguration struct {
|
||||
// keys is a list of keys to be used for creating the AES transformer.
|
||||
// Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.
|
||||
Keys []Key
|
||||
}
|
||||
|
||||
// SecretboxConfiguration contains the API configuration for an Secretbox transformer.
|
||||
type SecretboxConfiguration struct {
|
||||
// keys is a list of keys to be used for creating the Secretbox transformer.
|
||||
// Each key has to be 32 bytes long.
|
||||
Keys []Key
|
||||
}
|
||||
|
||||
// Key contains name and secret of the provided key for a transformer.
|
||||
type Key struct {
|
||||
// name is the name of the key to be used while storing data to disk.
|
||||
Name string
|
||||
// secret is the actual key, encoded in base64.
|
||||
Secret string
|
||||
}
|
||||
|
||||
// String implements Stringer interface in a log safe way.
|
||||
func (k Key) String() string {
|
||||
return fmt.Sprintf("Name: %s, Secret: [REDACTED]", k.Name)
|
||||
}
|
||||
|
||||
// IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.
|
||||
type IdentityConfiguration struct{}
|
||||
|
||||
// KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.
|
||||
type KMSConfiguration struct {
|
||||
// apiVersion of KeyManagementService
|
||||
// +optional
|
||||
APIVersion string
|
||||
// name is the name of the KMS plugin to be used.
|
||||
Name string
|
||||
// cachesize is the maximum number of secrets which are cached in memory. The default value is 1000.
|
||||
// Set to a negative value to disable caching.
|
||||
// +optional
|
||||
CacheSize *int32
|
||||
// endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".
|
||||
Endpoint string
|
||||
// timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.
|
||||
// +optional
|
||||
Timeout *metav1.Duration
|
||||
}
|
||||
49
vendor/k8s.io/apiserver/pkg/apis/config/v1/defaults.go
generated
vendored
Normal file
49
vendor/k8s.io/apiserver/pkg/apis/config/v1/defaults.go
generated
vendored
Normal file
@ -0,0 +1,49 @@
|
||||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
"time"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
var (
|
||||
defaultTimeout = &metav1.Duration{Duration: 3 * time.Second}
|
||||
defaultCacheSize int32 = 1000
|
||||
defaultAPIVersion = "v1"
|
||||
)
|
||||
|
||||
func addDefaultingFuncs(scheme *runtime.Scheme) error {
|
||||
return RegisterDefaults(scheme)
|
||||
}
|
||||
|
||||
// SetDefaults_KMSConfiguration applies defaults to KMSConfiguration.
|
||||
func SetDefaults_KMSConfiguration(obj *KMSConfiguration) {
|
||||
if obj.Timeout == nil {
|
||||
obj.Timeout = defaultTimeout
|
||||
}
|
||||
|
||||
if obj.CacheSize == nil {
|
||||
obj.CacheSize = &defaultCacheSize
|
||||
}
|
||||
|
||||
if obj.APIVersion == "" {
|
||||
obj.APIVersion = defaultAPIVersion
|
||||
}
|
||||
}
|
||||
23
vendor/k8s.io/apiserver/pkg/apis/config/v1/doc.go
generated
vendored
Normal file
23
vendor/k8s.io/apiserver/pkg/apis/config/v1/doc.go
generated
vendored
Normal file
@ -0,0 +1,23 @@
|
||||
/*
|
||||
Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// +k8s:conversion-gen=k8s.io/apiserver/pkg/apis/config
|
||||
// +k8s:deepcopy-gen=package
|
||||
// +k8s:defaulter-gen=TypeMeta
|
||||
// +groupName=apiserver.config.k8s.io
|
||||
|
||||
// Package v1 is the v1 version of the API.
|
||||
package v1
|
||||
53
vendor/k8s.io/apiserver/pkg/apis/config/v1/register.go
generated
vendored
Normal file
53
vendor/k8s.io/apiserver/pkg/apis/config/v1/register.go
generated
vendored
Normal file
@ -0,0 +1,53 @@
|
||||
/*
|
||||
Copyright 2018 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
// GroupName is the group name use in this package.
|
||||
const GroupName = "apiserver.config.k8s.io"
|
||||
|
||||
// SchemeGroupVersion is group version used to register these objects.
|
||||
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: "v1"}
|
||||
|
||||
var (
|
||||
// SchemeBuilder points to a list of functions added to Scheme.
|
||||
SchemeBuilder runtime.SchemeBuilder
|
||||
localSchemeBuilder = &SchemeBuilder
|
||||
// AddToScheme adds this group to a scheme.
|
||||
AddToScheme = localSchemeBuilder.AddToScheme
|
||||
)
|
||||
|
||||
func init() {
|
||||
// We only register manually written functions here. The registration of the
|
||||
// generated functions takes place in the generated files. The separation
|
||||
// makes the code compile even when the generated files are missing.
|
||||
localSchemeBuilder.Register(addKnownTypes)
|
||||
localSchemeBuilder.Register(addDefaultingFuncs)
|
||||
}
|
||||
|
||||
func addKnownTypes(scheme *runtime.Scheme) error {
|
||||
scheme.AddKnownTypes(SchemeGroupVersion,
|
||||
&EncryptionConfiguration{},
|
||||
)
|
||||
// also register into the v1 group as EncryptionConfig (due to a docs bug)
|
||||
scheme.AddKnownTypeWithName(schema.GroupVersionKind{Group: "", Version: "v1", Kind: "EncryptionConfig"}, &EncryptionConfiguration{})
|
||||
return nil
|
||||
}
|
||||
103
vendor/k8s.io/apiserver/pkg/apis/config/v1/types.go
generated
vendored
Normal file
103
vendor/k8s.io/apiserver/pkg/apis/config/v1/types.go
generated
vendored
Normal file
@ -0,0 +1,103 @@
|
||||
/*
|
||||
Copyright 2017 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
)
|
||||
|
||||
// +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object
|
||||
|
||||
// EncryptionConfiguration stores the complete configuration for encryption providers.
|
||||
type EncryptionConfiguration struct {
|
||||
metav1.TypeMeta
|
||||
// resources is a list containing resources, and their corresponding encryption providers.
|
||||
Resources []ResourceConfiguration `json:"resources"`
|
||||
}
|
||||
|
||||
// ResourceConfiguration stores per resource configuration.
|
||||
type ResourceConfiguration struct {
|
||||
// resources is a list of kubernetes resources which have to be encrypted.
|
||||
Resources []string `json:"resources"`
|
||||
// providers is a list of transformers to be used for reading and writing the resources to disk.
|
||||
// eg: aesgcm, aescbc, secretbox, identity.
|
||||
Providers []ProviderConfiguration `json:"providers"`
|
||||
}
|
||||
|
||||
// ProviderConfiguration stores the provided configuration for an encryption provider.
|
||||
type ProviderConfiguration struct {
|
||||
// aesgcm is the configuration for the AES-GCM transformer.
|
||||
AESGCM *AESConfiguration `json:"aesgcm,omitempty"`
|
||||
// aescbc is the configuration for the AES-CBC transformer.
|
||||
AESCBC *AESConfiguration `json:"aescbc,omitempty"`
|
||||
// secretbox is the configuration for the Secretbox based transformer.
|
||||
Secretbox *SecretboxConfiguration `json:"secretbox,omitempty"`
|
||||
// identity is the (empty) configuration for the identity transformer.
|
||||
Identity *IdentityConfiguration `json:"identity,omitempty"`
|
||||
// kms contains the name, cache size and path to configuration file for a KMS based envelope transformer.
|
||||
KMS *KMSConfiguration `json:"kms,omitempty"`
|
||||
}
|
||||
|
||||
// AESConfiguration contains the API configuration for an AES transformer.
|
||||
type AESConfiguration struct {
|
||||
// keys is a list of keys to be used for creating the AES transformer.
|
||||
// Each key has to be 32 bytes long for AES-CBC and 16, 24 or 32 bytes for AES-GCM.
|
||||
Keys []Key `json:"keys"`
|
||||
}
|
||||
|
||||
// SecretboxConfiguration contains the API configuration for an Secretbox transformer.
|
||||
type SecretboxConfiguration struct {
|
||||
// keys is a list of keys to be used for creating the Secretbox transformer.
|
||||
// Each key has to be 32 bytes long.
|
||||
Keys []Key `json:"keys"`
|
||||
}
|
||||
|
||||
// Key contains name and secret of the provided key for a transformer.
|
||||
type Key struct {
|
||||
// name is the name of the key to be used while storing data to disk.
|
||||
Name string `json:"name"`
|
||||
// secret is the actual key, encoded in base64.
|
||||
Secret string `json:"secret"`
|
||||
}
|
||||
|
||||
// String implements Stringer interface in a log safe way.
|
||||
func (k Key) String() string {
|
||||
return fmt.Sprintf("Name: %s, Secret: [REDACTED]", k.Name)
|
||||
}
|
||||
|
||||
// IdentityConfiguration is an empty struct to allow identity transformer in provider configuration.
|
||||
type IdentityConfiguration struct{}
|
||||
|
||||
// KMSConfiguration contains the name, cache size and path to configuration file for a KMS based envelope transformer.
|
||||
type KMSConfiguration struct {
|
||||
// apiVersion of KeyManagementService
|
||||
// +optional
|
||||
APIVersion string `json:"apiVersion"`
|
||||
// name is the name of the KMS plugin to be used.
|
||||
Name string `json:"name"`
|
||||
// cachesize is the maximum number of secrets which are cached in memory. The default value is 1000.
|
||||
// Set to a negative value to disable caching.
|
||||
// +optional
|
||||
CacheSize *int32 `json:"cachesize,omitempty"`
|
||||
// endpoint is the gRPC server listening address, for example "unix:///var/run/kms-provider.sock".
|
||||
Endpoint string `json:"endpoint"`
|
||||
// timeout for gRPC calls to kms-plugin (ex. 5s). The default is 3 seconds.
|
||||
// +optional
|
||||
Timeout *metav1.Duration `json:"timeout,omitempty"`
|
||||
}
|
||||
299
vendor/k8s.io/apiserver/pkg/apis/config/v1/zz_generated.conversion.go
generated
vendored
Normal file
299
vendor/k8s.io/apiserver/pkg/apis/config/v1/zz_generated.conversion.go
generated
vendored
Normal file
@ -0,0 +1,299 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by conversion-gen. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
unsafe "unsafe"
|
||||
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
conversion "k8s.io/apimachinery/pkg/conversion"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
config "k8s.io/apiserver/pkg/apis/config"
|
||||
)
|
||||
|
||||
func init() {
|
||||
localSchemeBuilder.Register(RegisterConversions)
|
||||
}
|
||||
|
||||
// RegisterConversions adds conversion functions to the given scheme.
|
||||
// Public to allow building arbitrary schemes.
|
||||
func RegisterConversions(s *runtime.Scheme) error {
|
||||
if err := s.AddGeneratedConversionFunc((*AESConfiguration)(nil), (*config.AESConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1_AESConfiguration_To_config_AESConfiguration(a.(*AESConfiguration), b.(*config.AESConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*config.AESConfiguration)(nil), (*AESConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_config_AESConfiguration_To_v1_AESConfiguration(a.(*config.AESConfiguration), b.(*AESConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*EncryptionConfiguration)(nil), (*config.EncryptionConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1_EncryptionConfiguration_To_config_EncryptionConfiguration(a.(*EncryptionConfiguration), b.(*config.EncryptionConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*config.EncryptionConfiguration)(nil), (*EncryptionConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_config_EncryptionConfiguration_To_v1_EncryptionConfiguration(a.(*config.EncryptionConfiguration), b.(*EncryptionConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*IdentityConfiguration)(nil), (*config.IdentityConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1_IdentityConfiguration_To_config_IdentityConfiguration(a.(*IdentityConfiguration), b.(*config.IdentityConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*config.IdentityConfiguration)(nil), (*IdentityConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_config_IdentityConfiguration_To_v1_IdentityConfiguration(a.(*config.IdentityConfiguration), b.(*IdentityConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*KMSConfiguration)(nil), (*config.KMSConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1_KMSConfiguration_To_config_KMSConfiguration(a.(*KMSConfiguration), b.(*config.KMSConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*config.KMSConfiguration)(nil), (*KMSConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_config_KMSConfiguration_To_v1_KMSConfiguration(a.(*config.KMSConfiguration), b.(*KMSConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*Key)(nil), (*config.Key)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1_Key_To_config_Key(a.(*Key), b.(*config.Key), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*config.Key)(nil), (*Key)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_config_Key_To_v1_Key(a.(*config.Key), b.(*Key), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*ProviderConfiguration)(nil), (*config.ProviderConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1_ProviderConfiguration_To_config_ProviderConfiguration(a.(*ProviderConfiguration), b.(*config.ProviderConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*config.ProviderConfiguration)(nil), (*ProviderConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_config_ProviderConfiguration_To_v1_ProviderConfiguration(a.(*config.ProviderConfiguration), b.(*ProviderConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*ResourceConfiguration)(nil), (*config.ResourceConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1_ResourceConfiguration_To_config_ResourceConfiguration(a.(*ResourceConfiguration), b.(*config.ResourceConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*config.ResourceConfiguration)(nil), (*ResourceConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_config_ResourceConfiguration_To_v1_ResourceConfiguration(a.(*config.ResourceConfiguration), b.(*ResourceConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*SecretboxConfiguration)(nil), (*config.SecretboxConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_v1_SecretboxConfiguration_To_config_SecretboxConfiguration(a.(*SecretboxConfiguration), b.(*config.SecretboxConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
if err := s.AddGeneratedConversionFunc((*config.SecretboxConfiguration)(nil), (*SecretboxConfiguration)(nil), func(a, b interface{}, scope conversion.Scope) error {
|
||||
return Convert_config_SecretboxConfiguration_To_v1_SecretboxConfiguration(a.(*config.SecretboxConfiguration), b.(*SecretboxConfiguration), scope)
|
||||
}); err != nil {
|
||||
return err
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
func autoConvert_v1_AESConfiguration_To_config_AESConfiguration(in *AESConfiguration, out *config.AESConfiguration, s conversion.Scope) error {
|
||||
out.Keys = *(*[]config.Key)(unsafe.Pointer(&in.Keys))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1_AESConfiguration_To_config_AESConfiguration is an autogenerated conversion function.
|
||||
func Convert_v1_AESConfiguration_To_config_AESConfiguration(in *AESConfiguration, out *config.AESConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_v1_AESConfiguration_To_config_AESConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_config_AESConfiguration_To_v1_AESConfiguration(in *config.AESConfiguration, out *AESConfiguration, s conversion.Scope) error {
|
||||
out.Keys = *(*[]Key)(unsafe.Pointer(&in.Keys))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_config_AESConfiguration_To_v1_AESConfiguration is an autogenerated conversion function.
|
||||
func Convert_config_AESConfiguration_To_v1_AESConfiguration(in *config.AESConfiguration, out *AESConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_config_AESConfiguration_To_v1_AESConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1_EncryptionConfiguration_To_config_EncryptionConfiguration(in *EncryptionConfiguration, out *config.EncryptionConfiguration, s conversion.Scope) error {
|
||||
out.Resources = *(*[]config.ResourceConfiguration)(unsafe.Pointer(&in.Resources))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1_EncryptionConfiguration_To_config_EncryptionConfiguration is an autogenerated conversion function.
|
||||
func Convert_v1_EncryptionConfiguration_To_config_EncryptionConfiguration(in *EncryptionConfiguration, out *config.EncryptionConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_v1_EncryptionConfiguration_To_config_EncryptionConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_config_EncryptionConfiguration_To_v1_EncryptionConfiguration(in *config.EncryptionConfiguration, out *EncryptionConfiguration, s conversion.Scope) error {
|
||||
out.Resources = *(*[]ResourceConfiguration)(unsafe.Pointer(&in.Resources))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_config_EncryptionConfiguration_To_v1_EncryptionConfiguration is an autogenerated conversion function.
|
||||
func Convert_config_EncryptionConfiguration_To_v1_EncryptionConfiguration(in *config.EncryptionConfiguration, out *EncryptionConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_config_EncryptionConfiguration_To_v1_EncryptionConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1_IdentityConfiguration_To_config_IdentityConfiguration(in *IdentityConfiguration, out *config.IdentityConfiguration, s conversion.Scope) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1_IdentityConfiguration_To_config_IdentityConfiguration is an autogenerated conversion function.
|
||||
func Convert_v1_IdentityConfiguration_To_config_IdentityConfiguration(in *IdentityConfiguration, out *config.IdentityConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_v1_IdentityConfiguration_To_config_IdentityConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_config_IdentityConfiguration_To_v1_IdentityConfiguration(in *config.IdentityConfiguration, out *IdentityConfiguration, s conversion.Scope) error {
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_config_IdentityConfiguration_To_v1_IdentityConfiguration is an autogenerated conversion function.
|
||||
func Convert_config_IdentityConfiguration_To_v1_IdentityConfiguration(in *config.IdentityConfiguration, out *IdentityConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_config_IdentityConfiguration_To_v1_IdentityConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1_KMSConfiguration_To_config_KMSConfiguration(in *KMSConfiguration, out *config.KMSConfiguration, s conversion.Scope) error {
|
||||
out.APIVersion = in.APIVersion
|
||||
out.Name = in.Name
|
||||
out.CacheSize = (*int32)(unsafe.Pointer(in.CacheSize))
|
||||
out.Endpoint = in.Endpoint
|
||||
out.Timeout = (*metav1.Duration)(unsafe.Pointer(in.Timeout))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1_KMSConfiguration_To_config_KMSConfiguration is an autogenerated conversion function.
|
||||
func Convert_v1_KMSConfiguration_To_config_KMSConfiguration(in *KMSConfiguration, out *config.KMSConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_v1_KMSConfiguration_To_config_KMSConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_config_KMSConfiguration_To_v1_KMSConfiguration(in *config.KMSConfiguration, out *KMSConfiguration, s conversion.Scope) error {
|
||||
out.APIVersion = in.APIVersion
|
||||
out.Name = in.Name
|
||||
out.CacheSize = (*int32)(unsafe.Pointer(in.CacheSize))
|
||||
out.Endpoint = in.Endpoint
|
||||
out.Timeout = (*metav1.Duration)(unsafe.Pointer(in.Timeout))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_config_KMSConfiguration_To_v1_KMSConfiguration is an autogenerated conversion function.
|
||||
func Convert_config_KMSConfiguration_To_v1_KMSConfiguration(in *config.KMSConfiguration, out *KMSConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_config_KMSConfiguration_To_v1_KMSConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1_Key_To_config_Key(in *Key, out *config.Key, s conversion.Scope) error {
|
||||
out.Name = in.Name
|
||||
out.Secret = in.Secret
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1_Key_To_config_Key is an autogenerated conversion function.
|
||||
func Convert_v1_Key_To_config_Key(in *Key, out *config.Key, s conversion.Scope) error {
|
||||
return autoConvert_v1_Key_To_config_Key(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_config_Key_To_v1_Key(in *config.Key, out *Key, s conversion.Scope) error {
|
||||
out.Name = in.Name
|
||||
out.Secret = in.Secret
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_config_Key_To_v1_Key is an autogenerated conversion function.
|
||||
func Convert_config_Key_To_v1_Key(in *config.Key, out *Key, s conversion.Scope) error {
|
||||
return autoConvert_config_Key_To_v1_Key(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1_ProviderConfiguration_To_config_ProviderConfiguration(in *ProviderConfiguration, out *config.ProviderConfiguration, s conversion.Scope) error {
|
||||
out.AESGCM = (*config.AESConfiguration)(unsafe.Pointer(in.AESGCM))
|
||||
out.AESCBC = (*config.AESConfiguration)(unsafe.Pointer(in.AESCBC))
|
||||
out.Secretbox = (*config.SecretboxConfiguration)(unsafe.Pointer(in.Secretbox))
|
||||
out.Identity = (*config.IdentityConfiguration)(unsafe.Pointer(in.Identity))
|
||||
out.KMS = (*config.KMSConfiguration)(unsafe.Pointer(in.KMS))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1_ProviderConfiguration_To_config_ProviderConfiguration is an autogenerated conversion function.
|
||||
func Convert_v1_ProviderConfiguration_To_config_ProviderConfiguration(in *ProviderConfiguration, out *config.ProviderConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_v1_ProviderConfiguration_To_config_ProviderConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_config_ProviderConfiguration_To_v1_ProviderConfiguration(in *config.ProviderConfiguration, out *ProviderConfiguration, s conversion.Scope) error {
|
||||
out.AESGCM = (*AESConfiguration)(unsafe.Pointer(in.AESGCM))
|
||||
out.AESCBC = (*AESConfiguration)(unsafe.Pointer(in.AESCBC))
|
||||
out.Secretbox = (*SecretboxConfiguration)(unsafe.Pointer(in.Secretbox))
|
||||
out.Identity = (*IdentityConfiguration)(unsafe.Pointer(in.Identity))
|
||||
out.KMS = (*KMSConfiguration)(unsafe.Pointer(in.KMS))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_config_ProviderConfiguration_To_v1_ProviderConfiguration is an autogenerated conversion function.
|
||||
func Convert_config_ProviderConfiguration_To_v1_ProviderConfiguration(in *config.ProviderConfiguration, out *ProviderConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_config_ProviderConfiguration_To_v1_ProviderConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1_ResourceConfiguration_To_config_ResourceConfiguration(in *ResourceConfiguration, out *config.ResourceConfiguration, s conversion.Scope) error {
|
||||
out.Resources = *(*[]string)(unsafe.Pointer(&in.Resources))
|
||||
out.Providers = *(*[]config.ProviderConfiguration)(unsafe.Pointer(&in.Providers))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1_ResourceConfiguration_To_config_ResourceConfiguration is an autogenerated conversion function.
|
||||
func Convert_v1_ResourceConfiguration_To_config_ResourceConfiguration(in *ResourceConfiguration, out *config.ResourceConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_v1_ResourceConfiguration_To_config_ResourceConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_config_ResourceConfiguration_To_v1_ResourceConfiguration(in *config.ResourceConfiguration, out *ResourceConfiguration, s conversion.Scope) error {
|
||||
out.Resources = *(*[]string)(unsafe.Pointer(&in.Resources))
|
||||
out.Providers = *(*[]ProviderConfiguration)(unsafe.Pointer(&in.Providers))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_config_ResourceConfiguration_To_v1_ResourceConfiguration is an autogenerated conversion function.
|
||||
func Convert_config_ResourceConfiguration_To_v1_ResourceConfiguration(in *config.ResourceConfiguration, out *ResourceConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_config_ResourceConfiguration_To_v1_ResourceConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_v1_SecretboxConfiguration_To_config_SecretboxConfiguration(in *SecretboxConfiguration, out *config.SecretboxConfiguration, s conversion.Scope) error {
|
||||
out.Keys = *(*[]config.Key)(unsafe.Pointer(&in.Keys))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_v1_SecretboxConfiguration_To_config_SecretboxConfiguration is an autogenerated conversion function.
|
||||
func Convert_v1_SecretboxConfiguration_To_config_SecretboxConfiguration(in *SecretboxConfiguration, out *config.SecretboxConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_v1_SecretboxConfiguration_To_config_SecretboxConfiguration(in, out, s)
|
||||
}
|
||||
|
||||
func autoConvert_config_SecretboxConfiguration_To_v1_SecretboxConfiguration(in *config.SecretboxConfiguration, out *SecretboxConfiguration, s conversion.Scope) error {
|
||||
out.Keys = *(*[]Key)(unsafe.Pointer(&in.Keys))
|
||||
return nil
|
||||
}
|
||||
|
||||
// Convert_config_SecretboxConfiguration_To_v1_SecretboxConfiguration is an autogenerated conversion function.
|
||||
func Convert_config_SecretboxConfiguration_To_v1_SecretboxConfiguration(in *config.SecretboxConfiguration, out *SecretboxConfiguration, s conversion.Scope) error {
|
||||
return autoConvert_config_SecretboxConfiguration_To_v1_SecretboxConfiguration(in, out, s)
|
||||
}
|
||||
228
vendor/k8s.io/apiserver/pkg/apis/config/v1/zz_generated.deepcopy.go
generated
vendored
Normal file
228
vendor/k8s.io/apiserver/pkg/apis/config/v1/zz_generated.deepcopy.go
generated
vendored
Normal file
@ -0,0 +1,228 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AESConfiguration) DeepCopyInto(out *AESConfiguration) {
|
||||
*out = *in
|
||||
if in.Keys != nil {
|
||||
in, out := &in.Keys, &out.Keys
|
||||
*out = make([]Key, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AESConfiguration.
|
||||
func (in *AESConfiguration) DeepCopy() *AESConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AESConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *EncryptionConfiguration) DeepCopyInto(out *EncryptionConfiguration) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
if in.Resources != nil {
|
||||
in, out := &in.Resources, &out.Resources
|
||||
*out = make([]ResourceConfiguration, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EncryptionConfiguration.
|
||||
func (in *EncryptionConfiguration) DeepCopy() *EncryptionConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(EncryptionConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *EncryptionConfiguration) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *IdentityConfiguration) DeepCopyInto(out *IdentityConfiguration) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IdentityConfiguration.
|
||||
func (in *IdentityConfiguration) DeepCopy() *IdentityConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(IdentityConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *KMSConfiguration) DeepCopyInto(out *KMSConfiguration) {
|
||||
*out = *in
|
||||
if in.CacheSize != nil {
|
||||
in, out := &in.CacheSize, &out.CacheSize
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
if in.Timeout != nil {
|
||||
in, out := &in.Timeout, &out.Timeout
|
||||
*out = new(metav1.Duration)
|
||||
**out = **in
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSConfiguration.
|
||||
func (in *KMSConfiguration) DeepCopy() *KMSConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(KMSConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *Key) DeepCopyInto(out *Key) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Key.
|
||||
func (in *Key) DeepCopy() *Key {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(Key)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ProviderConfiguration) DeepCopyInto(out *ProviderConfiguration) {
|
||||
*out = *in
|
||||
if in.AESGCM != nil {
|
||||
in, out := &in.AESGCM, &out.AESGCM
|
||||
*out = new(AESConfiguration)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.AESCBC != nil {
|
||||
in, out := &in.AESCBC, &out.AESCBC
|
||||
*out = new(AESConfiguration)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Secretbox != nil {
|
||||
in, out := &in.Secretbox, &out.Secretbox
|
||||
*out = new(SecretboxConfiguration)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Identity != nil {
|
||||
in, out := &in.Identity, &out.Identity
|
||||
*out = new(IdentityConfiguration)
|
||||
**out = **in
|
||||
}
|
||||
if in.KMS != nil {
|
||||
in, out := &in.KMS, &out.KMS
|
||||
*out = new(KMSConfiguration)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderConfiguration.
|
||||
func (in *ProviderConfiguration) DeepCopy() *ProviderConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ProviderConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ResourceConfiguration) DeepCopyInto(out *ResourceConfiguration) {
|
||||
*out = *in
|
||||
if in.Resources != nil {
|
||||
in, out := &in.Resources, &out.Resources
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.Providers != nil {
|
||||
in, out := &in.Providers, &out.Providers
|
||||
*out = make([]ProviderConfiguration, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceConfiguration.
|
||||
func (in *ResourceConfiguration) DeepCopy() *ResourceConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ResourceConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *SecretboxConfiguration) DeepCopyInto(out *SecretboxConfiguration) {
|
||||
*out = *in
|
||||
if in.Keys != nil {
|
||||
in, out := &in.Keys, &out.Keys
|
||||
*out = make([]Key, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretboxConfiguration.
|
||||
func (in *SecretboxConfiguration) DeepCopy() *SecretboxConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(SecretboxConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
46
vendor/k8s.io/apiserver/pkg/apis/config/v1/zz_generated.defaults.go
generated
vendored
Normal file
46
vendor/k8s.io/apiserver/pkg/apis/config/v1/zz_generated.defaults.go
generated
vendored
Normal file
@ -0,0 +1,46 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by defaulter-gen. DO NOT EDIT.
|
||||
|
||||
package v1
|
||||
|
||||
import (
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// RegisterDefaults adds defaulters functions to the given scheme.
|
||||
// Public to allow building arbitrary schemes.
|
||||
// All generated defaulters are covering - they call all nested defaulters.
|
||||
func RegisterDefaults(scheme *runtime.Scheme) error {
|
||||
scheme.AddTypeDefaultingFunc(&EncryptionConfiguration{}, func(obj interface{}) { SetObjectDefaults_EncryptionConfiguration(obj.(*EncryptionConfiguration)) })
|
||||
return nil
|
||||
}
|
||||
|
||||
func SetObjectDefaults_EncryptionConfiguration(in *EncryptionConfiguration) {
|
||||
for i := range in.Resources {
|
||||
a := &in.Resources[i]
|
||||
for j := range a.Providers {
|
||||
b := &a.Providers[j]
|
||||
if b.KMS != nil {
|
||||
SetDefaults_KMSConfiguration(b.KMS)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
261
vendor/k8s.io/apiserver/pkg/apis/config/validation/validation.go
generated
vendored
Normal file
261
vendor/k8s.io/apiserver/pkg/apis/config/validation/validation.go
generated
vendored
Normal file
@ -0,0 +1,261 @@
|
||||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Package validation validates EncryptionConfiguration.
|
||||
package validation
|
||||
|
||||
import (
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
"net/url"
|
||||
"strings"
|
||||
|
||||
"k8s.io/apimachinery/pkg/util/sets"
|
||||
"k8s.io/apimachinery/pkg/util/validation/field"
|
||||
"k8s.io/apiserver/pkg/apis/config"
|
||||
)
|
||||
|
||||
const (
|
||||
moreThanOneElementErr = "more than one provider specified in a single element, should split into different list elements"
|
||||
keyLenErrFmt = "secret is not of the expected length, got %d, expected one of %v"
|
||||
unsupportedSchemeErrFmt = "unsupported scheme %q for KMS provider, only unix is supported"
|
||||
unsupportedKMSAPIVersionErrFmt = "unsupported apiVersion %s for KMS provider, only v1 and v2 are supported"
|
||||
atLeastOneRequiredErrFmt = "at least one %s is required"
|
||||
invalidURLErrFmt = "invalid endpoint for kms provider, error: parse %s: net/url: invalid control character in URL"
|
||||
mandatoryFieldErrFmt = "%s is a mandatory field for a %s"
|
||||
base64EncodingErr = "secrets must be base64 encoded"
|
||||
zeroOrNegativeErrFmt = "%s should be a positive value"
|
||||
nonZeroErrFmt = "%s should be a positive value, or negative to disable"
|
||||
encryptionConfigNilErr = "EncryptionConfiguration can't be nil"
|
||||
invalidKMSConfigNameErrFmt = "invalid KMS provider name %s, must not contain ':'"
|
||||
duplicateKMSConfigNameErrFmt = "duplicate KMS provider name %s, names must be unique"
|
||||
)
|
||||
|
||||
var (
|
||||
// See https://golang.org/pkg/crypto/aes/#NewCipher for details on supported key sizes for AES.
|
||||
aesKeySizes = []int{16, 24, 32}
|
||||
|
||||
// See https://godoc.org/golang.org/x/crypto/nacl/secretbox#Open for details on the supported key sizes for Secretbox.
|
||||
secretBoxKeySizes = []int{32}
|
||||
|
||||
root = field.NewPath("resources")
|
||||
)
|
||||
|
||||
// ValidateEncryptionConfiguration validates a v1.EncryptionConfiguration.
|
||||
func ValidateEncryptionConfiguration(c *config.EncryptionConfiguration, reload bool) field.ErrorList {
|
||||
allErrs := field.ErrorList{}
|
||||
|
||||
if c == nil {
|
||||
allErrs = append(allErrs, field.Required(root, "EncryptionConfiguration can't be nil"))
|
||||
return allErrs
|
||||
}
|
||||
|
||||
if len(c.Resources) == 0 {
|
||||
allErrs = append(allErrs, field.Required(root, fmt.Sprintf(atLeastOneRequiredErrFmt, root)))
|
||||
return allErrs
|
||||
}
|
||||
|
||||
// kmsProviderNames is used to track config names to ensure they are unique.
|
||||
kmsProviderNames := sets.NewString()
|
||||
for i, conf := range c.Resources {
|
||||
r := root.Index(i).Child("resources")
|
||||
p := root.Index(i).Child("providers")
|
||||
|
||||
if len(conf.Resources) == 0 {
|
||||
allErrs = append(allErrs, field.Required(r, fmt.Sprintf(atLeastOneRequiredErrFmt, r)))
|
||||
}
|
||||
|
||||
if len(conf.Providers) == 0 {
|
||||
allErrs = append(allErrs, field.Required(p, fmt.Sprintf(atLeastOneRequiredErrFmt, p)))
|
||||
}
|
||||
|
||||
for j, provider := range conf.Providers {
|
||||
path := p.Index(j)
|
||||
allErrs = append(allErrs, validateSingleProvider(provider, path)...)
|
||||
|
||||
switch {
|
||||
case provider.KMS != nil:
|
||||
allErrs = append(allErrs, validateKMSConfiguration(provider.KMS, path.Child("kms"), kmsProviderNames, reload)...)
|
||||
kmsProviderNames.Insert(provider.KMS.Name)
|
||||
case provider.AESGCM != nil:
|
||||
allErrs = append(allErrs, validateKeys(provider.AESGCM.Keys, path.Child("aesgcm").Child("keys"), aesKeySizes)...)
|
||||
case provider.AESCBC != nil:
|
||||
allErrs = append(allErrs, validateKeys(provider.AESCBC.Keys, path.Child("aescbc").Child("keys"), aesKeySizes)...)
|
||||
case provider.Secretbox != nil:
|
||||
allErrs = append(allErrs, validateKeys(provider.Secretbox.Keys, path.Child("secretbox").Child("keys"), secretBoxKeySizes)...)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateSingleProvider(provider config.ProviderConfiguration, fieldPath *field.Path) field.ErrorList {
|
||||
allErrs := field.ErrorList{}
|
||||
found := 0
|
||||
|
||||
if provider.KMS != nil {
|
||||
found++
|
||||
}
|
||||
if provider.AESGCM != nil {
|
||||
found++
|
||||
}
|
||||
if provider.AESCBC != nil {
|
||||
found++
|
||||
}
|
||||
if provider.Secretbox != nil {
|
||||
found++
|
||||
}
|
||||
if provider.Identity != nil {
|
||||
found++
|
||||
}
|
||||
|
||||
if found == 0 {
|
||||
return append(allErrs, field.Invalid(fieldPath, provider, "provider does not contain any of the expected providers: KMS, AESGCM, AESCBC, Secretbox, Identity"))
|
||||
}
|
||||
|
||||
if found > 1 {
|
||||
return append(allErrs, field.Invalid(fieldPath, provider, moreThanOneElementErr))
|
||||
}
|
||||
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateKeys(keys []config.Key, fieldPath *field.Path, expectedLen []int) field.ErrorList {
|
||||
allErrs := field.ErrorList{}
|
||||
|
||||
if len(keys) == 0 {
|
||||
allErrs = append(allErrs, field.Required(fieldPath, fmt.Sprintf(atLeastOneRequiredErrFmt, "keys")))
|
||||
return allErrs
|
||||
}
|
||||
|
||||
for i, key := range keys {
|
||||
allErrs = append(allErrs, validateKey(key, fieldPath.Index(i), expectedLen)...)
|
||||
}
|
||||
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateKey(key config.Key, fieldPath *field.Path, expectedLen []int) field.ErrorList {
|
||||
allErrs := field.ErrorList{}
|
||||
|
||||
if key.Name == "" {
|
||||
allErrs = append(allErrs, field.Required(fieldPath.Child("name"), fmt.Sprintf(mandatoryFieldErrFmt, "name", "key")))
|
||||
}
|
||||
|
||||
if key.Secret == "" {
|
||||
allErrs = append(allErrs, field.Required(fieldPath.Child("secret"), fmt.Sprintf(mandatoryFieldErrFmt, "secret", "key")))
|
||||
return allErrs
|
||||
}
|
||||
|
||||
secret, err := base64.StdEncoding.DecodeString(key.Secret)
|
||||
if err != nil {
|
||||
allErrs = append(allErrs, field.Invalid(fieldPath.Child("secret"), "REDACTED", base64EncodingErr))
|
||||
return allErrs
|
||||
}
|
||||
|
||||
lenMatched := false
|
||||
for _, l := range expectedLen {
|
||||
if len(secret) == l {
|
||||
lenMatched = true
|
||||
break
|
||||
}
|
||||
}
|
||||
|
||||
if !lenMatched {
|
||||
allErrs = append(allErrs, field.Invalid(fieldPath.Child("secret"), "REDACTED", fmt.Sprintf(keyLenErrFmt, len(secret), expectedLen)))
|
||||
}
|
||||
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateKMSConfiguration(c *config.KMSConfiguration, fieldPath *field.Path, kmsProviderNames sets.String, reload bool) field.ErrorList {
|
||||
allErrs := field.ErrorList{}
|
||||
|
||||
allErrs = append(allErrs, validateKMSConfigName(c, fieldPath.Child("name"), kmsProviderNames, reload)...)
|
||||
allErrs = append(allErrs, validateKMSTimeout(c, fieldPath.Child("timeout"))...)
|
||||
allErrs = append(allErrs, validateKMSEndpoint(c, fieldPath.Child("endpoint"))...)
|
||||
allErrs = append(allErrs, validateKMSCacheSize(c, fieldPath.Child("cachesize"))...)
|
||||
allErrs = append(allErrs, validateKMSAPIVersion(c, fieldPath.Child("apiVersion"))...)
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateKMSCacheSize(c *config.KMSConfiguration, fieldPath *field.Path) field.ErrorList {
|
||||
allErrs := field.ErrorList{}
|
||||
if *c.CacheSize == 0 {
|
||||
allErrs = append(allErrs, field.Invalid(fieldPath, *c.CacheSize, fmt.Sprintf(nonZeroErrFmt, "cachesize")))
|
||||
}
|
||||
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateKMSTimeout(c *config.KMSConfiguration, fieldPath *field.Path) field.ErrorList {
|
||||
allErrs := field.ErrorList{}
|
||||
if c.Timeout.Duration <= 0 {
|
||||
allErrs = append(allErrs, field.Invalid(fieldPath, c.Timeout, fmt.Sprintf(zeroOrNegativeErrFmt, "timeout")))
|
||||
}
|
||||
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateKMSEndpoint(c *config.KMSConfiguration, fieldPath *field.Path) field.ErrorList {
|
||||
allErrs := field.ErrorList{}
|
||||
if len(c.Endpoint) == 0 {
|
||||
return append(allErrs, field.Invalid(fieldPath, "", fmt.Sprintf(mandatoryFieldErrFmt, "endpoint", "kms")))
|
||||
}
|
||||
|
||||
u, err := url.Parse(c.Endpoint)
|
||||
if err != nil {
|
||||
return append(allErrs, field.Invalid(fieldPath, c.Endpoint, fmt.Sprintf("invalid endpoint for kms provider, error: %v", err)))
|
||||
}
|
||||
|
||||
if u.Scheme != "unix" {
|
||||
return append(allErrs, field.Invalid(fieldPath, c.Endpoint, fmt.Sprintf(unsupportedSchemeErrFmt, u.Scheme)))
|
||||
}
|
||||
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateKMSAPIVersion(c *config.KMSConfiguration, fieldPath *field.Path) field.ErrorList {
|
||||
allErrs := field.ErrorList{}
|
||||
if c.APIVersion != "v1" && c.APIVersion != "v2" {
|
||||
allErrs = append(allErrs, field.Invalid(fieldPath, c.APIVersion, fmt.Sprintf(unsupportedKMSAPIVersionErrFmt, "apiVersion")))
|
||||
}
|
||||
|
||||
return allErrs
|
||||
}
|
||||
|
||||
func validateKMSConfigName(c *config.KMSConfiguration, fieldPath *field.Path, kmsProviderNames sets.String, reload bool) field.ErrorList {
|
||||
allErrs := field.ErrorList{}
|
||||
if c.Name == "" {
|
||||
allErrs = append(allErrs, field.Required(fieldPath, fmt.Sprintf(mandatoryFieldErrFmt, "name", "provider")))
|
||||
}
|
||||
|
||||
// kms v2 providers are not allowed to have a ":" in their name
|
||||
if c.APIVersion != "v1" && strings.Contains(c.Name, ":") {
|
||||
allErrs = append(allErrs, field.Invalid(fieldPath, c.Name, fmt.Sprintf(invalidKMSConfigNameErrFmt, c.Name)))
|
||||
}
|
||||
|
||||
// kms v2 providers name must always be unique across all kms providers (v1 and v2)
|
||||
// kms v1 provider names must be unique across all kms providers (v1 and v2) when hot reloading of encryption configuration is enabled (reload=true)
|
||||
if reload || c.APIVersion != "v1" {
|
||||
if kmsProviderNames.Has(c.Name) {
|
||||
allErrs = append(allErrs, field.Invalid(fieldPath, c.Name, fmt.Sprintf(duplicateKMSConfigNameErrFmt, c.Name)))
|
||||
}
|
||||
}
|
||||
|
||||
return allErrs
|
||||
}
|
||||
228
vendor/k8s.io/apiserver/pkg/apis/config/zz_generated.deepcopy.go
generated
vendored
Normal file
228
vendor/k8s.io/apiserver/pkg/apis/config/zz_generated.deepcopy.go
generated
vendored
Normal file
@ -0,0 +1,228 @@
|
||||
//go:build !ignore_autogenerated
|
||||
// +build !ignore_autogenerated
|
||||
|
||||
/*
|
||||
Copyright The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
// Code generated by deepcopy-gen. DO NOT EDIT.
|
||||
|
||||
package config
|
||||
|
||||
import (
|
||||
v1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
runtime "k8s.io/apimachinery/pkg/runtime"
|
||||
)
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *AESConfiguration) DeepCopyInto(out *AESConfiguration) {
|
||||
*out = *in
|
||||
if in.Keys != nil {
|
||||
in, out := &in.Keys, &out.Keys
|
||||
*out = make([]Key, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AESConfiguration.
|
||||
func (in *AESConfiguration) DeepCopy() *AESConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(AESConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *EncryptionConfiguration) DeepCopyInto(out *EncryptionConfiguration) {
|
||||
*out = *in
|
||||
out.TypeMeta = in.TypeMeta
|
||||
if in.Resources != nil {
|
||||
in, out := &in.Resources, &out.Resources
|
||||
*out = make([]ResourceConfiguration, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new EncryptionConfiguration.
|
||||
func (in *EncryptionConfiguration) DeepCopy() *EncryptionConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(EncryptionConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
|
||||
func (in *EncryptionConfiguration) DeepCopyObject() runtime.Object {
|
||||
if c := in.DeepCopy(); c != nil {
|
||||
return c
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *IdentityConfiguration) DeepCopyInto(out *IdentityConfiguration) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new IdentityConfiguration.
|
||||
func (in *IdentityConfiguration) DeepCopy() *IdentityConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(IdentityConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *KMSConfiguration) DeepCopyInto(out *KMSConfiguration) {
|
||||
*out = *in
|
||||
if in.CacheSize != nil {
|
||||
in, out := &in.CacheSize, &out.CacheSize
|
||||
*out = new(int32)
|
||||
**out = **in
|
||||
}
|
||||
if in.Timeout != nil {
|
||||
in, out := &in.Timeout, &out.Timeout
|
||||
*out = new(v1.Duration)
|
||||
**out = **in
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new KMSConfiguration.
|
||||
func (in *KMSConfiguration) DeepCopy() *KMSConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(KMSConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *Key) DeepCopyInto(out *Key) {
|
||||
*out = *in
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Key.
|
||||
func (in *Key) DeepCopy() *Key {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(Key)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ProviderConfiguration) DeepCopyInto(out *ProviderConfiguration) {
|
||||
*out = *in
|
||||
if in.AESGCM != nil {
|
||||
in, out := &in.AESGCM, &out.AESGCM
|
||||
*out = new(AESConfiguration)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.AESCBC != nil {
|
||||
in, out := &in.AESCBC, &out.AESCBC
|
||||
*out = new(AESConfiguration)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Secretbox != nil {
|
||||
in, out := &in.Secretbox, &out.Secretbox
|
||||
*out = new(SecretboxConfiguration)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
if in.Identity != nil {
|
||||
in, out := &in.Identity, &out.Identity
|
||||
*out = new(IdentityConfiguration)
|
||||
**out = **in
|
||||
}
|
||||
if in.KMS != nil {
|
||||
in, out := &in.KMS, &out.KMS
|
||||
*out = new(KMSConfiguration)
|
||||
(*in).DeepCopyInto(*out)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderConfiguration.
|
||||
func (in *ProviderConfiguration) DeepCopy() *ProviderConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ProviderConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *ResourceConfiguration) DeepCopyInto(out *ResourceConfiguration) {
|
||||
*out = *in
|
||||
if in.Resources != nil {
|
||||
in, out := &in.Resources, &out.Resources
|
||||
*out = make([]string, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
if in.Providers != nil {
|
||||
in, out := &in.Providers, &out.Providers
|
||||
*out = make([]ProviderConfiguration, len(*in))
|
||||
for i := range *in {
|
||||
(*in)[i].DeepCopyInto(&(*out)[i])
|
||||
}
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ResourceConfiguration.
|
||||
func (in *ResourceConfiguration) DeepCopy() *ResourceConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(ResourceConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
|
||||
// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
|
||||
func (in *SecretboxConfiguration) DeepCopyInto(out *SecretboxConfiguration) {
|
||||
*out = *in
|
||||
if in.Keys != nil {
|
||||
in, out := &in.Keys, &out.Keys
|
||||
*out = make([]Key, len(*in))
|
||||
copy(*out, *in)
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new SecretboxConfiguration.
|
||||
func (in *SecretboxConfiguration) DeepCopy() *SecretboxConfiguration {
|
||||
if in == nil {
|
||||
return nil
|
||||
}
|
||||
out := new(SecretboxConfiguration)
|
||||
in.DeepCopyInto(out)
|
||||
return out
|
||||
}
|
||||
573
vendor/k8s.io/apiserver/pkg/apis/flowcontrol/bootstrap/default.go
generated
vendored
Normal file
573
vendor/k8s.io/apiserver/pkg/apis/flowcontrol/bootstrap/default.go
generated
vendored
Normal file
@ -0,0 +1,573 @@
|
||||
/*
|
||||
Copyright 2019 The Kubernetes Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package bootstrap
|
||||
|
||||
import (
|
||||
coordinationv1 "k8s.io/api/coordination/v1"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
flowcontrol "k8s.io/api/flowcontrol/v1beta3"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apiserver/pkg/authentication/serviceaccount"
|
||||
"k8s.io/apiserver/pkg/authentication/user"
|
||||
"k8s.io/utils/pointer"
|
||||
)
|
||||
|
||||
// The objects that define an apiserver's initial behavior. The
|
||||
// registered defaulting procedures make no changes to these
|
||||
// particular objects (this is verified in the unit tests of the
|
||||
// internalbootstrap package; it can not be verified in this package
|
||||
// because that would require importing k8s.io/kubernetes).
|
||||
var (
|
||||
MandatoryPriorityLevelConfigurations = []*flowcontrol.PriorityLevelConfiguration{
|
||||
MandatoryPriorityLevelConfigurationCatchAll,
|
||||
MandatoryPriorityLevelConfigurationExempt,
|
||||
}
|
||||
MandatoryFlowSchemas = []*flowcontrol.FlowSchema{
|
||||
MandatoryFlowSchemaExempt,
|
||||
MandatoryFlowSchemaCatchAll,
|
||||
}
|
||||
)
|
||||
|
||||
// The objects that define the current suggested additional configuration
|
||||
var (
|
||||
SuggestedPriorityLevelConfigurations = []*flowcontrol.PriorityLevelConfiguration{
|
||||
// "system" priority-level is for the system components that affects self-maintenance of the
|
||||
// cluster and the availability of those running pods in the cluster, including kubelet and
|
||||
// kube-proxy.
|
||||
SuggestedPriorityLevelConfigurationSystem,
|
||||
// "node-high" priority-level is for the node health reporting. It is separated from "system"
|
||||
// to make sure that nodes are able to report their health even if kube-apiserver is not capable of
|
||||
// handling load caused by pod startup (fetching secrets, events etc).
|
||||
// NOTE: In large clusters 50% - 90% of all API calls use this priority-level.
|
||||
SuggestedPriorityLevelConfigurationNodeHigh,
|
||||
// "leader-election" is dedicated for controllers' leader-election, which majorly affects the
|
||||
// availability of any controller runs in the cluster.
|
||||
SuggestedPriorityLevelConfigurationLeaderElection,
|
||||
// "workload-high" is used by those workloads with higher priority but their failure won't directly
|
||||
// impact the existing running pods in the cluster, which includes kube-scheduler, and those well-known
|
||||
// built-in workloads such as "deployments", "replicasets" and other low-level custom workload which
|
||||
// is important for the cluster.
|
||||
SuggestedPriorityLevelConfigurationWorkloadHigh,
|
||||
// "workload-low" is used by those workloads with lower priority which availability only has a
|
||||
// minor impact on the cluster.
|
||||
SuggestedPriorityLevelConfigurationWorkloadLow,
|
||||
// "global-default" serves the rest traffic not handled by the other suggested flow-schemas above.
|
||||
SuggestedPriorityLevelConfigurationGlobalDefault,
|
||||
}
|
||||
SuggestedFlowSchemas = []*flowcontrol.FlowSchema{
|
||||
SuggestedFlowSchemaSystemNodes, // references "system" priority-level
|
||||
SuggestedFlowSchemaSystemNodeHigh, // references "node-high" priority-level
|
||||
SuggestedFlowSchemaProbes, // references "exempt" priority-level
|
||||
SuggestedFlowSchemaSystemLeaderElection, // references "leader-election" priority-level
|
||||
SuggestedFlowSchemaWorkloadLeaderElection, // references "leader-election" priority-level
|
||||
SuggestedFlowSchemaEndpointsController, // references "workload-high" priority-level
|
||||
SuggestedFlowSchemaKubeControllerManager, // references "workload-high" priority-level
|
||||
SuggestedFlowSchemaKubeScheduler, // references "workload-high" priority-level
|
||||
SuggestedFlowSchemaKubeSystemServiceAccounts, // references "workload-high" priority-level
|
||||
SuggestedFlowSchemaServiceAccounts, // references "workload-low" priority-level
|
||||
SuggestedFlowSchemaGlobalDefault, // references "global-default" priority-level
|
||||
}
|
||||
)
|
||||
|
||||
// Mandatory PriorityLevelConfiguration objects
|
||||
var (
|
||||
MandatoryPriorityLevelConfigurationExempt = newPriorityLevelConfiguration(
|
||||
flowcontrol.PriorityLevelConfigurationNameExempt,
|
||||
flowcontrol.PriorityLevelConfigurationSpec{
|
||||
Type: flowcontrol.PriorityLevelEnablementExempt,
|
||||
},
|
||||
)
|
||||
MandatoryPriorityLevelConfigurationCatchAll = newPriorityLevelConfiguration(
|
||||
flowcontrol.PriorityLevelConfigurationNameCatchAll,
|
||||
flowcontrol.PriorityLevelConfigurationSpec{
|
||||
Type: flowcontrol.PriorityLevelEnablementLimited,
|
||||
Limited: &flowcontrol.LimitedPriorityLevelConfiguration{
|
||||
NominalConcurrencyShares: 5,
|
||||
LendablePercent: pointer.Int32(0),
|
||||
LimitResponse: flowcontrol.LimitResponse{
|
||||
Type: flowcontrol.LimitResponseTypeReject,
|
||||
},
|
||||
},
|
||||
})
|
||||
)
|
||||
|
||||
// Mandatory FlowSchema objects
|
||||
var (
|
||||
// "exempt" priority-level is used for preventing priority inversion and ensuring that sysadmin
|
||||
// requests are always possible.
|
||||
MandatoryFlowSchemaExempt = newFlowSchema(
|
||||
"exempt",
|
||||
flowcontrol.PriorityLevelConfigurationNameExempt,
|
||||
1, // matchingPrecedence
|
||||
"", // distinguisherMethodType
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: groups(user.SystemPrivilegedGroup),
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{
|
||||
resourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.APIGroupAll},
|
||||
[]string{flowcontrol.ResourceAll},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
true,
|
||||
),
|
||||
},
|
||||
NonResourceRules: []flowcontrol.NonResourcePolicyRule{
|
||||
nonResourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.NonResourceAll},
|
||||
),
|
||||
},
|
||||
},
|
||||
)
|
||||
// "catch-all" priority-level only gets a minimal positive share of concurrency and won't be reaching
|
||||
// ideally unless you intentionally deleted the suggested "global-default".
|
||||
MandatoryFlowSchemaCatchAll = newFlowSchema(
|
||||
flowcontrol.FlowSchemaNameCatchAll,
|
||||
flowcontrol.PriorityLevelConfigurationNameCatchAll,
|
||||
10000, // matchingPrecedence
|
||||
flowcontrol.FlowDistinguisherMethodByUserType, // distinguisherMethodType
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: groups(user.AllUnauthenticated, user.AllAuthenticated),
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{
|
||||
resourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.APIGroupAll},
|
||||
[]string{flowcontrol.ResourceAll},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
true,
|
||||
),
|
||||
},
|
||||
NonResourceRules: []flowcontrol.NonResourcePolicyRule{
|
||||
nonResourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.NonResourceAll},
|
||||
),
|
||||
},
|
||||
},
|
||||
)
|
||||
)
|
||||
|
||||
// Suggested PriorityLevelConfiguration objects
|
||||
var (
|
||||
// system priority-level
|
||||
SuggestedPriorityLevelConfigurationSystem = newPriorityLevelConfiguration(
|
||||
"system",
|
||||
flowcontrol.PriorityLevelConfigurationSpec{
|
||||
Type: flowcontrol.PriorityLevelEnablementLimited,
|
||||
Limited: &flowcontrol.LimitedPriorityLevelConfiguration{
|
||||
NominalConcurrencyShares: 30,
|
||||
LendablePercent: pointer.Int32(33),
|
||||
LimitResponse: flowcontrol.LimitResponse{
|
||||
Type: flowcontrol.LimitResponseTypeQueue,
|
||||
Queuing: &flowcontrol.QueuingConfiguration{
|
||||
Queues: 64,
|
||||
HandSize: 6,
|
||||
QueueLengthLimit: 50,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
SuggestedPriorityLevelConfigurationNodeHigh = newPriorityLevelConfiguration(
|
||||
"node-high",
|
||||
flowcontrol.PriorityLevelConfigurationSpec{
|
||||
Type: flowcontrol.PriorityLevelEnablementLimited,
|
||||
Limited: &flowcontrol.LimitedPriorityLevelConfiguration{
|
||||
NominalConcurrencyShares: 40,
|
||||
LendablePercent: pointer.Int32(25),
|
||||
LimitResponse: flowcontrol.LimitResponse{
|
||||
Type: flowcontrol.LimitResponseTypeQueue,
|
||||
Queuing: &flowcontrol.QueuingConfiguration{
|
||||
Queues: 64,
|
||||
HandSize: 6,
|
||||
QueueLengthLimit: 50,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
// leader-election priority-level
|
||||
SuggestedPriorityLevelConfigurationLeaderElection = newPriorityLevelConfiguration(
|
||||
"leader-election",
|
||||
flowcontrol.PriorityLevelConfigurationSpec{
|
||||
Type: flowcontrol.PriorityLevelEnablementLimited,
|
||||
Limited: &flowcontrol.LimitedPriorityLevelConfiguration{
|
||||
NominalConcurrencyShares: 10,
|
||||
LendablePercent: pointer.Int32(0),
|
||||
LimitResponse: flowcontrol.LimitResponse{
|
||||
Type: flowcontrol.LimitResponseTypeQueue,
|
||||
Queuing: &flowcontrol.QueuingConfiguration{
|
||||
Queues: 16,
|
||||
HandSize: 4,
|
||||
QueueLengthLimit: 50,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
// workload-high priority-level
|
||||
SuggestedPriorityLevelConfigurationWorkloadHigh = newPriorityLevelConfiguration(
|
||||
"workload-high",
|
||||
flowcontrol.PriorityLevelConfigurationSpec{
|
||||
Type: flowcontrol.PriorityLevelEnablementLimited,
|
||||
Limited: &flowcontrol.LimitedPriorityLevelConfiguration{
|
||||
NominalConcurrencyShares: 40,
|
||||
LendablePercent: pointer.Int32(50),
|
||||
LimitResponse: flowcontrol.LimitResponse{
|
||||
Type: flowcontrol.LimitResponseTypeQueue,
|
||||
Queuing: &flowcontrol.QueuingConfiguration{
|
||||
Queues: 128,
|
||||
HandSize: 6,
|
||||
QueueLengthLimit: 50,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
// workload-low priority-level
|
||||
SuggestedPriorityLevelConfigurationWorkloadLow = newPriorityLevelConfiguration(
|
||||
"workload-low",
|
||||
flowcontrol.PriorityLevelConfigurationSpec{
|
||||
Type: flowcontrol.PriorityLevelEnablementLimited,
|
||||
Limited: &flowcontrol.LimitedPriorityLevelConfiguration{
|
||||
NominalConcurrencyShares: 100,
|
||||
LendablePercent: pointer.Int32(90),
|
||||
LimitResponse: flowcontrol.LimitResponse{
|
||||
Type: flowcontrol.LimitResponseTypeQueue,
|
||||
Queuing: &flowcontrol.QueuingConfiguration{
|
||||
Queues: 128,
|
||||
HandSize: 6,
|
||||
QueueLengthLimit: 50,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
// global-default priority-level
|
||||
SuggestedPriorityLevelConfigurationGlobalDefault = newPriorityLevelConfiguration(
|
||||
"global-default",
|
||||
flowcontrol.PriorityLevelConfigurationSpec{
|
||||
Type: flowcontrol.PriorityLevelEnablementLimited,
|
||||
Limited: &flowcontrol.LimitedPriorityLevelConfiguration{
|
||||
NominalConcurrencyShares: 20,
|
||||
LendablePercent: pointer.Int32(50),
|
||||
LimitResponse: flowcontrol.LimitResponse{
|
||||
Type: flowcontrol.LimitResponseTypeQueue,
|
||||
Queuing: &flowcontrol.QueuingConfiguration{
|
||||
Queues: 128,
|
||||
HandSize: 6,
|
||||
QueueLengthLimit: 50,
|
||||
},
|
||||
},
|
||||
},
|
||||
})
|
||||
)
|
||||
|
||||
// Suggested FlowSchema objects.
|
||||
// Ordered by matching precedence, so that their interactions are easier
|
||||
// to follow while reading this source.
|
||||
var (
|
||||
// the following flow schema exempts probes
|
||||
SuggestedFlowSchemaProbes = newFlowSchema(
|
||||
"probes", "exempt", 2,
|
||||
"", // distinguisherMethodType
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: groups(user.AllUnauthenticated, user.AllAuthenticated),
|
||||
NonResourceRules: []flowcontrol.NonResourcePolicyRule{
|
||||
nonResourceRule(
|
||||
[]string{"get"},
|
||||
[]string{"/healthz", "/readyz", "/livez"}),
|
||||
},
|
||||
},
|
||||
)
|
||||
SuggestedFlowSchemaSystemLeaderElection = newFlowSchema(
|
||||
"system-leader-election", "leader-election", 100,
|
||||
flowcontrol.FlowDistinguisherMethodByUserType,
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: append(
|
||||
users(user.KubeControllerManager, user.KubeScheduler),
|
||||
kubeSystemServiceAccount(flowcontrol.NameAll)...),
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{
|
||||
resourceRule(
|
||||
[]string{"get", "create", "update"},
|
||||
[]string{coordinationv1.GroupName},
|
||||
[]string{"leases"},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
false),
|
||||
},
|
||||
},
|
||||
)
|
||||
// We add an explicit rule for endpoint-controller with high precedence
|
||||
// to ensure that those calls won't get caught by the following
|
||||
// <workload-leader-election> flow-schema.
|
||||
//
|
||||
// TODO(#80289): Get rid of this rule once we get rid of support for
|
||||
// using endpoints and configmaps objects for leader election.
|
||||
SuggestedFlowSchemaEndpointsController = newFlowSchema(
|
||||
"endpoint-controller", "workload-high", 150,
|
||||
flowcontrol.FlowDistinguisherMethodByUserType,
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: append(
|
||||
users(user.KubeControllerManager),
|
||||
kubeSystemServiceAccount("endpoint-controller", "endpointslicemirroring-controller")...),
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{
|
||||
resourceRule(
|
||||
[]string{"get", "create", "update"},
|
||||
[]string{corev1.GroupName},
|
||||
[]string{"endpoints"},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
false),
|
||||
},
|
||||
},
|
||||
)
|
||||
// TODO(#80289): Get rid of this rule once we get rid of support for
|
||||
// using endpoints and configmaps objects for leader election.
|
||||
SuggestedFlowSchemaWorkloadLeaderElection = newFlowSchema(
|
||||
"workload-leader-election", "leader-election", 200,
|
||||
flowcontrol.FlowDistinguisherMethodByUserType,
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: kubeSystemServiceAccount(flowcontrol.NameAll),
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{
|
||||
resourceRule(
|
||||
[]string{"get", "create", "update"},
|
||||
[]string{corev1.GroupName},
|
||||
[]string{"endpoints", "configmaps"},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
false),
|
||||
resourceRule(
|
||||
[]string{"get", "create", "update"},
|
||||
[]string{coordinationv1.GroupName},
|
||||
[]string{"leases"},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
false),
|
||||
},
|
||||
},
|
||||
)
|
||||
SuggestedFlowSchemaSystemNodeHigh = newFlowSchema(
|
||||
"system-node-high", "node-high", 400,
|
||||
flowcontrol.FlowDistinguisherMethodByUserType,
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: groups(user.NodesGroup), // the nodes group
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{
|
||||
resourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{corev1.GroupName},
|
||||
[]string{"nodes", "nodes/status"},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
true),
|
||||
resourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{coordinationv1.GroupName},
|
||||
[]string{"leases"},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
false),
|
||||
},
|
||||
},
|
||||
)
|
||||
SuggestedFlowSchemaSystemNodes = newFlowSchema(
|
||||
"system-nodes", "system", 500,
|
||||
flowcontrol.FlowDistinguisherMethodByUserType,
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: groups(user.NodesGroup), // the nodes group
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{resourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.APIGroupAll},
|
||||
[]string{flowcontrol.ResourceAll},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
true)},
|
||||
NonResourceRules: []flowcontrol.NonResourcePolicyRule{
|
||||
nonResourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.NonResourceAll}),
|
||||
},
|
||||
},
|
||||
)
|
||||
SuggestedFlowSchemaKubeControllerManager = newFlowSchema(
|
||||
"kube-controller-manager", "workload-high", 800,
|
||||
flowcontrol.FlowDistinguisherMethodByNamespaceType,
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: users(user.KubeControllerManager),
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{resourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.APIGroupAll},
|
||||
[]string{flowcontrol.ResourceAll},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
true)},
|
||||
NonResourceRules: []flowcontrol.NonResourcePolicyRule{
|
||||
nonResourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.NonResourceAll}),
|
||||
},
|
||||
},
|
||||
)
|
||||
SuggestedFlowSchemaKubeScheduler = newFlowSchema(
|
||||
"kube-scheduler", "workload-high", 800,
|
||||
flowcontrol.FlowDistinguisherMethodByNamespaceType,
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: users(user.KubeScheduler),
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{resourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.APIGroupAll},
|
||||
[]string{flowcontrol.ResourceAll},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
true)},
|
||||
NonResourceRules: []flowcontrol.NonResourcePolicyRule{
|
||||
nonResourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.NonResourceAll}),
|
||||
},
|
||||
},
|
||||
)
|
||||
SuggestedFlowSchemaKubeSystemServiceAccounts = newFlowSchema(
|
||||
"kube-system-service-accounts", "workload-high", 900,
|
||||
flowcontrol.FlowDistinguisherMethodByNamespaceType,
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: kubeSystemServiceAccount(flowcontrol.NameAll),
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{resourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.APIGroupAll},
|
||||
[]string{flowcontrol.ResourceAll},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
true)},
|
||||
NonResourceRules: []flowcontrol.NonResourcePolicyRule{
|
||||
nonResourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.NonResourceAll}),
|
||||
},
|
||||
},
|
||||
)
|
||||
SuggestedFlowSchemaServiceAccounts = newFlowSchema(
|
||||
"service-accounts", "workload-low", 9000,
|
||||
flowcontrol.FlowDistinguisherMethodByUserType,
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: groups(serviceaccount.AllServiceAccountsGroup),
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{resourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.APIGroupAll},
|
||||
[]string{flowcontrol.ResourceAll},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
true)},
|
||||
NonResourceRules: []flowcontrol.NonResourcePolicyRule{
|
||||
nonResourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.NonResourceAll}),
|
||||
},
|
||||
},
|
||||
)
|
||||
SuggestedFlowSchemaGlobalDefault = newFlowSchema(
|
||||
"global-default", "global-default", 9900,
|
||||
flowcontrol.FlowDistinguisherMethodByUserType,
|
||||
flowcontrol.PolicyRulesWithSubjects{
|
||||
Subjects: groups(user.AllUnauthenticated, user.AllAuthenticated),
|
||||
ResourceRules: []flowcontrol.ResourcePolicyRule{resourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.APIGroupAll},
|
||||
[]string{flowcontrol.ResourceAll},
|
||||
[]string{flowcontrol.NamespaceEvery},
|
||||
true)},
|
||||
NonResourceRules: []flowcontrol.NonResourcePolicyRule{
|
||||
nonResourceRule(
|
||||
[]string{flowcontrol.VerbAll},
|
||||
[]string{flowcontrol.NonResourceAll}),
|
||||
},
|
||||
},
|
||||
)
|
||||
)
|
||||
|
||||
func newPriorityLevelConfiguration(name string, spec flowcontrol.PriorityLevelConfigurationSpec) *flowcontrol.PriorityLevelConfiguration {
|
||||
return &flowcontrol.PriorityLevelConfiguration{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: name,
|
||||
Annotations: map[string]string{
|
||||
flowcontrol.AutoUpdateAnnotationKey: "true",
|
||||
},
|
||||
},
|
||||
Spec: spec,
|
||||
}
|
||||
}
|
||||
|
||||
func newFlowSchema(name, plName string, matchingPrecedence int32, dmType flowcontrol.FlowDistinguisherMethodType, rules ...flowcontrol.PolicyRulesWithSubjects) *flowcontrol.FlowSchema {
|
||||
var dm *flowcontrol.FlowDistinguisherMethod
|
||||
if dmType != "" {
|
||||
dm = &flowcontrol.FlowDistinguisherMethod{Type: dmType}
|
||||
}
|
||||
return &flowcontrol.FlowSchema{
|
||||
ObjectMeta: metav1.ObjectMeta{
|
||||
Name: name,
|
||||
Annotations: map[string]string{
|
||||
flowcontrol.AutoUpdateAnnotationKey: "true",
|
||||
},
|
||||
},
|
||||
Spec: flowcontrol.FlowSchemaSpec{
|
||||
PriorityLevelConfiguration: flowcontrol.PriorityLevelConfigurationReference{
|
||||
Name: plName,
|
||||
},
|
||||
MatchingPrecedence: matchingPrecedence,
|
||||
DistinguisherMethod: dm,
|
||||
Rules: rules},
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
func groups(names ...string) []flowcontrol.Subject {
|
||||
ans := make([]flowcontrol.Subject, len(names))
|
||||
for idx, name := range names {
|
||||
ans[idx] = flowcontrol.Subject{
|
||||
Kind: flowcontrol.SubjectKindGroup,
|
||||
Group: &flowcontrol.GroupSubject{
|
||||
Name: name,
|
||||
},
|
||||
}
|
||||
}
|
||||
return ans
|
||||
}
|
||||
|
||||
func users(names ...string) []flowcontrol.Subject {
|
||||
ans := make([]flowcontrol.Subject, len(names))
|
||||
for idx, name := range names {
|
||||
ans[idx] = flowcontrol.Subject{
|
||||
Kind: flowcontrol.SubjectKindUser,
|
||||
User: &flowcontrol.UserSubject{
|
||||
Name: name,
|
||||
},
|
||||
}
|
||||
}
|
||||
return ans
|
||||
}
|
||||
|
||||
func kubeSystemServiceAccount(names ...string) []flowcontrol.Subject {
|
||||
subjects := []flowcontrol.Subject{}
|
||||
for _, name := range names {
|
||||
subjects = append(subjects, flowcontrol.Subject{
|
||||
Kind: flowcontrol.SubjectKindServiceAccount,
|
||||
ServiceAccount: &flowcontrol.ServiceAccountSubject{
|
||||
Name: name,
|
||||
Namespace: metav1.NamespaceSystem,
|
||||
},
|
||||
})
|
||||
}
|
||||
return subjects
|
||||
}
|
||||
|
||||
func resourceRule(verbs []string, groups []string, resources []string, namespaces []string, clusterScoped bool) flowcontrol.ResourcePolicyRule {
|
||||
return flowcontrol.ResourcePolicyRule{
|
||||
Verbs: verbs,
|
||||
APIGroups: groups,
|
||||
Resources: resources,
|
||||
Namespaces: namespaces,
|
||||
ClusterScope: clusterScoped,
|
||||
}
|
||||
}
|
||||
|
||||
func nonResourceRule(verbs []string, nonResourceURLs []string) flowcontrol.NonResourcePolicyRule {
|
||||
return flowcontrol.NonResourcePolicyRule{Verbs: verbs, NonResourceURLs: nonResourceURLs}
|
||||
}
|
||||
Reference in New Issue
Block a user