install

Documentation

Overview

Package install provides the core logic for applying the EarlyWatch infrastructure manifests (CRD, RBAC, webhook) onto a Kubernetes cluster.

Package install provides the core logic for applying and removing the EarlyWatch infrastructure manifests (CRD, RBAC, webhook) on a Kubernetes cluster.

Index

• Constants
• Variables
• func Run(opts Options) error
• func Uninstall(opts UninstallOptions) error
• type Options
• type UninstallOptions

Constants

const CreatedByAnnotation = "earlywatch.io/created-by"

CreatedByAnnotation is the annotation key written onto every resource applied by "watchctl install". Its value identifies the tool that created the resource, making it easy to list or delete all managed resources later.

Variables

var Version = "latest"

Version is the current release of EarlyWatch. It is set at build time via:

go build -ldflags "-X github.com/brendandburns/early-watch/pkg/install.Version=<git-tag>" ./cmd/watchctl

When built without the flag the value defaults to "latest".

Functions

func Run

func Run(opts Options) error

Run applies all EarlyWatch infrastructure manifests to the cluster described by opts.Kubeconfig, printing progress to stdout.

func Uninstall

func Uninstall(opts UninstallOptions) error

Uninstall removes all EarlyWatch infrastructure resources from the cluster described by opts.Kubeconfig, printing progress to stdout. Resources are deleted in reverse manifest order so that higher-level objects (e.g. the ValidatingWebhookConfiguration) are removed before lower-level ones (e.g. the CRD), minimizing the window during which the webhook could intercept its own teardown. Resources that no longer exist are silently skipped.

Types

type Options

type Options struct {
	// Kubeconfig is the path to a kubeconfig file. Falls back to in-cluster
	// config when empty.
	Kubeconfig string
	// Image overrides the container image for the webhook Deployment.
	// Defaults to defaultWebhookImage when empty.
	Image string
	// Namespace is the Kubernetes namespace to install EarlyWatch into.
	// Defaults to defaultNamespace ("early-watch-system") when empty.
	Namespace string
	// ManualTouchInstall, when true, additionally installs the audit-monitor
	// CRDs, RBAC, Deployment, and Service required for manual touch monitoring.
	// Defaults to false.
	ManualTouchInstall bool
	// AuditMonitorImage overrides the container image for the audit-monitor
	// Deployment. Only used when ManualTouchInstall is true.
	// Defaults to defaultAuditMonitorImage when empty.
	AuditMonitorImage string
	// APIServerCertSigning, when true, provisions the webhook TLS
	// certificate using the Kubernetes built-in
	// CertificateSigningRequest API and stores the result in a Secret.
	// When false, the install step relies on cert-manager (or another
	// external CA) to populate the Secret and inject the caBundle into the
	// ValidatingWebhookConfiguration. The CLI may default this to true, but
	// library callers using Options{} must set it explicitly.
	APIServerCertSigning bool
	// ImagePullSecret is the name of an existing Kubernetes Secret of type
	// kubernetes.io/dockerconfigjson that is added as an imagePullSecret to
	// every Deployment managed by the install. Leave empty when the cluster
	// can pull images without authentication.
	ImagePullSecret string
}

Options holds the parameters for an install operation.

type UninstallOptions

type UninstallOptions struct {
	// Kubeconfig is the path to a kubeconfig file. Falls back to in-cluster
	// config when empty.
	Kubeconfig string
	// Namespace is the Kubernetes namespace that EarlyWatch was installed into.
	// Defaults to defaultNamespace ("early-watch-system") when empty.
	Namespace string
	// ManualTouchUninstall, when true, also removes the audit-monitor CRDs,
	// RBAC, Deployment, and Service installed by the manual touch monitoring
	// option. Defaults to false.
	ManualTouchUninstall bool
}

UninstallOptions holds the parameters for an uninstall operation.