Documentation
¶
Index ¶
Constants ¶
const DefaultAuditMaxRequestBodyBytes = int64(10 * 1024 * 1024)
DefaultAuditMaxRequestBodyBytes limits incoming audit payload size.
const ( // ValidateAllPath is the broad observe-all validating admission endpoint. It // matches every resource and always allows — a test-only capture/observation // surface today (the e2e SUT wires it; the Helm chart does not), kept as the // stable extension point for a future cluster-wide policy. Per-our-type handling // (authorship, config validation) lives on ValidateOperatorTypesPath instead. ValidateAllPath = "/validate-all" )
const ValidateOperatorTypesPath = "/validate-operator-types"
ValidateOperatorTypesPath is the validating admission endpoint scoped to our own operator CRDs. Today its one job is command authorship — capturing the submitter of a command kind (a CommitRequest) into Redis and always allowing — but it is the intended home for per-our-type admission generally (e.g. config validation of WatchRule / GitProvider / GitTarget later), which would be added as additional webhook-config entries with their own rules and failurePolicy. Distinct from the broad observe-all ValidateAllPath.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type AdmissionAllowHandler ¶
type AdmissionAllowHandler struct{}
AdmissionAllowHandler is a validating admission handler that always allows requests.
type AuditFactPublisher ¶ added in v0.41.0
type AuditFactPublisher interface {
PublishFacts(ctx context.Context, key queue.FactStreamKey, facts []queue.AuthorFact) error
}
AuditFactPublisher appends one request's attribution facts to the stream for a (audit route, group/resource). A nil publisher means the fact stream is not wired.
It is the batch shape that makes this cheap: the API server delivers audit events in batches, so one request's 400 events over three types become THREE appends rather than 400 writes. The batching that causes the delivery delay attribution has to wait out is the same batching that makes publishing nearly free.
type AuditHandler ¶
type AuditHandler struct {
// contains filtered or unexported fields
}
AuditHandler receives kube-apiserver audit events on /audit-webhook and records the author-attribution fact for each Git-relevant mutation. It never writes object state — that comes from WATCH — so it decodes, applies the intrinsic accept gate (stage, verb, success, dry-run, unchanged-RV, subresource), and records the fact.
func NewAuditHandler ¶
func NewAuditHandler(config AuditHandlerConfig) (*AuditHandler, error)
NewAuditHandler creates a new audit handler with the given configuration.
func (*AuditHandler) ServeHTTP ¶
func (h *AuditHandler) ServeHTTP(w http.ResponseWriter, r *http.Request)
ServeHTTP implements http.Handler for audit event processing.
type AuditHandlerConfig ¶
type AuditHandlerConfig struct {
// MaxRequestBodyBytes is the maximum accepted HTTP request body size.
MaxRequestBodyBytes int64
// FactPublisher appends the facts one request produced, grouped by stream. A publish failure
// returns an audit-request error so the API server retries the delivery; mirrored-resource
// author attribution depends on these facts arriving. A nil publisher means configured-author
// mode — the handler is not wired at all.
FactPublisher AuditFactPublisher
// CollectionUIDCap is how many object uids a deletecollection fact may carry before the set is
// dropped and the join falls back to scope matching. Zero means queue.DefaultCollectionUIDCap.
CollectionUIDCap int
// AuditRouteAnnotationKey enables the bare /audit-webhook endpoint for a SHARED audit stream
// that carries several logical clusters: the AUDIT ROUTE is read PER EVENT from this
// audit-event annotation, so one batch may fan out to several routes. Empty (the default) means
// the bare endpoint is NOT enabled and every producer must post to a named
// /audit-webhook/<audit-route>.
AuditRouteAnnotationKey string
}
AuditHandlerConfig contains configuration for the audit handler.
type CommandAuthorRecorder ¶
type CommandAuthorRecorder interface {
RecordCommandAuthor(ctx context.Context, uid types.UID, author queue.CommandAuthor) error
}
CommandAuthorRecorder records the authenticated submitter of one command object. *queue.CommandAuthorStore satisfies it; the interface keeps the handler unit-testable without a live Redis.
type ValidateOperatorTypesHandler ¶
type ValidateOperatorTypesHandler struct {
Store CommandAuthorRecorder
}
ValidateOperatorTypesHandler is the admission handler for our operator CRDs. Today it does one thing: for a command kind (a CommitRequest) it captures the authenticated submitter into the CommandAuthorStore and always allows — pure observation with a single side effect (a Redis upsert), never a rejection, so a user's command never depends on it succeeding (a missed capture leaves the request without a claimed actor; see docs/spec/commitrequest-admission-authorship.md). It dispatches on the resource (isCommandKind today), so a future config-validation branch for non-command kinds slots in alongside without disturbing this one.
func (*ValidateOperatorTypesHandler) Handle ¶
func (h *ValidateOperatorTypesHandler) Handle(ctx context.Context, req admission.Request) admission.Response
Handle records {uid → author} for an admitted command CREATE before the object persists (the authorship invariant, §2), then allows. Every early return still allows: a non-command kind, a dry-run, a missing uid, or an unauthenticated request simply records nothing and leaves the request without a claimed actor downstream.
Source Files