Documentation
¶
Index ¶
- Constants
- Variables
- func Contains(list []string, s string) bool
- func GenerateDefaultOidcProviderArn(clusterId string, uid int64) string
- func GetConfigFromSecret(ctx context.Context, r client.Client, secretRef *v1alpha1.SecretRef) ([]byte, error)
- func GetJsonSecrets(jmesObj []v1alpha1.JMESPathObject, secretValue, key string) (jsonMap map[string]string, err error)
- func GetWaitTimeExponential(retryTimes int) time.Duration
- func IgnoreNotFoundError(err error) error
- func IsNamespaceAllowedForClusterExternalSecret(ces *v1alpha1.ClusterExternalSecret, namespace corev1.Namespace) bool
- func IsNamespaceAllowedForClusterSecretStore(clusterSecretStore *v1alpha1.ClusterSecretStore, namespaceName string, ...) bool
- func IsNamespaceWatched(watchNs map[string]bool, namespace string) bool
- func IsValidJSON(data []byte) bool
- func IsValidOidcProviderArn(arn string) bool
- func JsonStr(o interface{}) string
- func JudgeNeedRetry(err error) bool
- func PatchTriggerAnnotation(ctx context.Context, c client.Client, store client.Object) error
- func ReadyConditionObservedGeneration(conditions []v1alpha1.SecretStoreStatusCondition) (observed int64, found bool)
- func Remove(list []string, s string) []string
- func RetryOnTransient(ctx context.Context, maxAttempts int, fn func() error) error
- func RewriteRegexp(operation v1alpha1.ReplaceRule, in map[string]string) (map[string]string, error)
- func YamlStr(o interface{}) string
Constants ¶
const ( REJECTED_THROTTLING = "Rejected.Throttling" SERVICE_UNAVAILABLE_TEMPORARY = "ServiceUnavailableTemporary" INTERNAL_FAILURE = "InternalFailure" )
const (
BinaryType = "binary"
)
const TriggerReconcileAnnotation = "ack-secret-manager.alibabacloud.com/trigger-reconcile"
TriggerReconcileAnnotation forces store client recreation when set on a SecretStore/ClusterSecretStore; shared by the store controllers and the Secret/ServiceAccount trigger controllers so the literal never drifts.
Variables ¶
Functions ¶
func GenerateDefaultOidcProviderArn ¶ added in v0.6.2
func GetConfigFromSecret ¶ added in v0.5.0
func GetJsonSecrets ¶ added in v0.5.5
func GetJsonSecrets(jmesObj []v1alpha1.JMESPathObject, secretValue, key string) (jsonMap map[string]string, err error)
GetJsonSecrets evaluates jmesPath expressions against the fetched secret value (JSON or YAML). Per-expression failures are logged and skipped; the only returned error is a structurally invalid secret value.
func GetWaitTimeExponential ¶ added in v0.5.5
GetWaitTimeExponential returns 2^retryTimes * BACKOFF_DEFAULT_RETRY_INTERVAL with +/-20% jitter (spreads concurrent retries), capped at BACKOFF_DEFAULT_CAPACITY.
func IgnoreNotFoundError ¶ added in v0.5.0
Ignore not found errors
func IsNamespaceAllowedForClusterExternalSecret ¶ added in v0.6.2
func IsNamespaceAllowedForClusterExternalSecret(ces *v1alpha1.ClusterExternalSecret, namespace corev1.Namespace) bool
IsNamespaceAllowedForClusterExternalSecret reports whether the namespace is selected by the CES conditions (fail-closed): only an explicit match allows; only a fully empty selection config matches every namespace; any invalid selector/regex denies all namespaces.
func IsNamespaceAllowedForClusterSecretStore ¶ added in v0.6.2
func IsNamespaceAllowedForClusterSecretStore(clusterSecretStore *v1alpha1.ClusterSecretStore, namespaceName string, getClient func(context.Context, client.ObjectKey, client.Object, ...client.GetOption) error) bool
IsNamespaceAllowedForClusterSecretStore reports whether the namespace may access the ClusterSecretStore (fail-closed on invalid selectors/regexes)
func IsNamespaceWatched ¶ added in v0.6.7
IsNamespaceWatched reports whether the namespace falls inside the watch scope built from --watch-namespaces / --exclude-namespaces (a map with true entries for watched and false entries for excluded namespaces). Include mode (any true entry present): only explicitly listed namespaces are watched. Exclude-only mode: a namespace is excluded only when mapped to false; an empty map or a missing key passes.
func IsValidJSON ¶ added in v0.6.6
IsValidJSON reports whether data is a strict JSON document: the first byte must be '{' or '[' (leading whitespace is treated as YAML by design).
func IsValidOidcProviderArn ¶ added in v0.6.2
func JudgeNeedRetry ¶ added in v0.5.5
JudgeNeedRetry reports whether err is transient and worth retrying: throttling/unavailability/internal-failure codes, 5xx/429 statuses (legacy ClientError by code, tea.SDKError by status fallback), and transient network errors (timeouts, resets, broken pipes). Permanent errors (403/404, DNS failures, invalid parameters) are NOT retryable; wrapped errors are matched via errors.As.
func PatchTriggerAnnotation ¶ added in v0.6.7
PatchTriggerAnnotation patches the trigger annotation onto the given store so its controller recreates the provider clients; the value is the current unix-nanosecond timestamp, so consecutive calls always produce a change. Callers must skip stores already carrying a non-empty trigger annotation (a pending rebuild is already guaranteed) to avoid amplifying rebuilds.
func ReadyConditionObservedGeneration ¶ added in v0.6.7
func ReadyConditionObservedGeneration(conditions []v1alpha1.SecretStoreStatusCondition) (observed int64, found bool)
ReadyConditionObservedGeneration locates the condition whose Type is SecretStoreReady and returns its ObservedGeneration. found is false when no such condition exists; callers treat that as "never managed by a Store controller" rather than assuming any particular list position.
func Remove ¶
Remove returns a new slice with all occurrences of s removed; the input slice is never modified in place.
func RetryOnTransient ¶ added in v0.6.6
RetryOnTransient invokes fn up to maxAttempts times, backing off exponentially (GetWaitTimeExponential) after each transient error judged by JudgeNeedRetry; non-retryable errors return immediately. The wait is interruptible via ctx: on cancellation the ctx error is wrapped (%w) with the last transient error included as text.
func RewriteRegexp ¶ added in v0.5.5
RewriteRegexp applies one regexp rewrite rule. An uncompilable Source is a configuration error returned to the caller (fail closed), not silently dropped.
Types ¶
This section is empty.
Source Files