controller

Documentation

Index

• Constants
• func ConstructCustomDNSNames(serviceAccounts []string, serviceNames []string, namespace string, ...) map[string]*DNSNameEntry
• func GetSecretName(saName string) string
• type DNSNameEntry
• type SecretController
  • func NewSecretController(ca ca.CertificateAuthority, certTTL time.Duration, gracePeriodRatio float32, ...) (*SecretController, error)
  • func (sc *SecretController) Run(stopCh chan struct{})

Constants

const (
	// The Istio secret annotation type
	IstioSecretType = "istio.io/key-and-cert"

	// The ID/name for the certificate chain file.
	CertChainID = "cert-chain.pem"
	// The ID/name for the private key file.
	PrivateKeyID = "key.pem"
	// The ID/name for the CA root certificate file.
	RootCertID = "root-cert.pem"
	// The key to specify corresponding service account in the annotation of K8s secrets.
	ServiceAccountNameAnnotationKey = "istio.io/service-account.name"
)

#nosec: disable gas linter

Functions

func ConstructCustomDNSNames

func ConstructCustomDNSNames(serviceAccounts []string, serviceNames []string,
	namespace string, customDNSNames string) map[string]*DNSNameEntry

func GetSecretName

func GetSecretName(saName string) string

GetSecretName returns the secret name for a given service account name.

Types

type DNSNameEntry

type DNSNameEntry struct {
	// ServiceName is the name of the service account to match
	ServiceName string

	// Namespace restricts to a specific namespace.
	Namespace string

	// CustomDomain allows adding a user-defined domain.
	CustomDomains []string
}

DNSNameEntry stores the service name and namespace to construct the DNS id. Service accounts matching the ServiceName and Namespace will have additional DNS SANs: ServiceName.Namespace.svc, ServiceName.Namespace and optionall CustomDomain. This is intended for control plane and trusted services.

type SecretController

type SecretController struct {
	// contains filtered or unexported fields
}

SecretController manages the service accounts' secrets that contains Istio keys and certificates.

func NewSecretController

func NewSecretController(ca ca.CertificateAuthority, certTTL time.Duration,
	gracePeriodRatio float32, minGracePeriod time.Duration, dualUse bool,
	core corev1.CoreV1Interface, forCA bool, namespaces []string,
	dnsNames map[string]*DNSNameEntry) (*SecretController, error)

NewSecretController returns a pointer to a newly constructed SecretController instance.

func (*SecretController) Run

func (sc *SecretController) Run(stopCh chan struct{})

Run starts the SecretController until a value is sent to stopCh.