Documentation ¶
Index ¶
- func AddGraphEventHandlers(graph *Graph, nodes coreinformers.NodeInformer, pods coreinformers.PodInformer, ...)
- func NewAuthorizer(graph *Graph, identifier nodeidentifier.NodeIdentifier, ...) authorizer.Authorizer
- type Graph
- func (g *Graph) AddPV(pv *api.PersistentVolume)
- func (g *Graph) AddPod(pod *api.Pod)
- func (g *Graph) AddVolumeAttachment(attachmentName, nodeName string)
- func (g *Graph) DeletePV(name string)
- func (g *Graph) DeletePod(name, namespace string)
- func (g *Graph) DeleteVolumeAttachment(name string)
- func (g *Graph) SetNodeConfigMap(nodeName, configMapName, configMapNamespace string)
- type NodeAuthorizer
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AddGraphEventHandlers ¶
func AddGraphEventHandlers( graph *Graph, nodes coreinformers.NodeInformer, pods coreinformers.PodInformer, pvs coreinformers.PersistentVolumeInformer, attachments storageinformers.VolumeAttachmentInformer, )
func NewAuthorizer ¶
func NewAuthorizer(graph *Graph, identifier nodeidentifier.NodeIdentifier, rules []rbacv1.PolicyRule) authorizer.Authorizer
NewAuthorizer returns a new node authorizer
Types ¶
type Graph ¶
type Graph struct {
// contains filtered or unexported fields
}
Graph holds graph vertices and a way to look up a vertex for a particular API type/namespace/name. All edges point toward the vertices representing Kubernetes nodes:
node <- pod pod <- secret,configmap,pvc pvc <- pv pv <- secret
func (*Graph) AddPV ¶
func (g *Graph) AddPV(pv *api.PersistentVolume)
AddPV sets up edges for the following relationships:
secret -> pv pv -> pvc
func (*Graph) AddPod ¶
AddPod should only be called once spec.NodeName is populated. It sets up edges for the following relationships (which are immutable for a pod once bound to a node):
pod -> node secret -> pod configmap -> pod pvc -> pod svcacct -> pod
func (*Graph) AddVolumeAttachment ¶ added in v1.10.0
AddVolumeAttachment sets up edges for the following relationships:
volume attachment -> node
func (*Graph) DeleteVolumeAttachment ¶ added in v1.10.0
func (*Graph) SetNodeConfigMap ¶ added in v1.11.0
SetNodeConfigMap sets up edges for the Node.Spec.ConfigSource.ConfigMap relationship:
configmap -> node
type NodeAuthorizer ¶
type NodeAuthorizer struct {
// contains filtered or unexported fields
}
NodeAuthorizer authorizes requests from kubelets, with the following logic:
- If a request is not from a node (NodeIdentity() returns isNode=false), reject
- If a specific node cannot be identified (NodeIdentity() returns nodeName=""), reject
- If a request is for a secret, configmap, persistent volume or persistent volume claim, reject unless the verb is get, and the requested object is related to the requesting node: node <- configmap node <- pod node <- pod <- secret node <- pod <- configmap node <- pod <- pvc node <- pod <- pvc <- pv node <- pod <- pvc <- pv <- secret
- For other resources, authorize all nodes uniformly using statically defined rules
func (*NodeAuthorizer) Authorize ¶
func (r *NodeAuthorizer) Authorize(attrs authorizer.Attributes) (authorizer.Decision, string, error)