controllers

Documentation

Index

• Variables
• func ApplySandboxSecureDefaults(template *extensionsv1beta1.SandboxTemplate, spec *corev1.PodSpec)
• func SandboxTemplateRefHash(templateRefName string) string
• type SandboxClaimReconciler
  • func (r *SandboxClaimReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
  • func (r *SandboxClaimReconciler) SetupWithManager(mgr ctrl.Manager, concurrentWorkers int) error
• type SandboxTemplateReconciler
  • func (r *SandboxTemplateReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
  • func (r *SandboxTemplateReconciler) SetupWithManager(mgr ctrl.Manager, concurrentWorkers int) error
• type SandboxWarmPoolReconciler
  • func (r *SandboxWarmPoolReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
  • func (r *SandboxWarmPoolReconciler) SetupWithManager(mgr ctrl.Manager, concurrentWorkers int) error

Variables

var (
	ErrTemplateNotFound                      = errors.New("SandboxTemplate not found")
	ErrInvalidMetadata                       = errors.New("invalid additionalPodMetadata")
	ErrSandboxNotOwned                       = errors.New("sandbox not owned by this claim")
	ErrWarmPoolNotFound                      = errors.New("SandboxWarmPool not found")
	ErrCrossNamespaceAdoption                = errors.New("cross-namespace adoption forbidden")
	ErrEnvVarsInjectionRejected              = errors.New("environment variable injection rejected")
	ErrVolumeClaimTemplatesDisallowed        = errors.New("volume claim templates are disallowed by the template")
	ErrVolumeClaimTemplatesOverrideForbidden = errors.New("overriding volume claim templates is forbidden by the template")
	ErrVolumeClaimTemplatesInvalid           = errors.New("invalid volume claim templates")
)

Functions

func ApplySandboxSecureDefaults

func ApplySandboxSecureDefaults(template *extensionsv1beta1.SandboxTemplate, spec *corev1.PodSpec)

ApplySandboxSecureDefaults applies the controller's "Secure by Default" logic to a PodSpec.

func SandboxTemplateRefHash

func SandboxTemplateRefHash(templateRefName string) string

SandboxTemplateRefHash encapsulates the generation of the hash for a sandbox template ref.

Types

type SandboxClaimReconciler

type SandboxClaimReconciler struct {
	client.Client
	Scheme           *runtime.Scheme
	WarmSandboxQueue *queue.SimpleSandboxQueue
	Recorder         events.EventRecorder
	Tracer           asmetrics.Instrumenter

	AllowedLabelDomains []string
	// contains filtered or unexported fields
}

SandboxClaimReconciler reconciles a SandboxClaim object.

func (*SandboxClaimReconciler) Reconcile

func (r *SandboxClaimReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)

func (*SandboxClaimReconciler) SetupWithManager

func (r *SandboxClaimReconciler) SetupWithManager(mgr ctrl.Manager, concurrentWorkers int) error

SetupWithManager sets up the controller with the Manager.

type SandboxTemplateReconciler

type SandboxTemplateReconciler struct {
	client.Client
	Scheme *runtime.Scheme
	Tracer asmetrics.Instrumenter
	// RouterNamespace is the namespace the sandbox-router runs in — the same
	// namespace the operator is installed into. The managed default NetworkPolicy
	// only admits ingress from that namespace, so it must track the install
	// namespace rather than a hardcoded default.
	RouterNamespace string
}

SandboxTemplateReconciler reconciles a SandboxTemplate object.

func (*SandboxTemplateReconciler) Reconcile

func (r *SandboxTemplateReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)

func (*SandboxTemplateReconciler) SetupWithManager

func (r *SandboxTemplateReconciler) SetupWithManager(mgr ctrl.Manager, concurrentWorkers int) error

SetupWithManager sets up the controller with the Manager.

type SandboxWarmPoolReconciler

type SandboxWarmPoolReconciler struct {
	client.Client
	Scheme                 *runtime.Scheme
	MaxBatchSize           int
	EnableWarmPoolEviction bool
	// DisableSandboxCRManagement makes the controller stop creating/deleting
	// per-pool Sandbox CRs and only report status. In the L3 writable-aggregation
	// design warm capacity is driven per node by sandboxd (PUT /v1/pools), NOT by
	// N Sandbox CRs — and because Sandbox create now routes through the aggregated
	// apiserver's node-local claim, CR-based replenishment would fight that path
	// (claiming the very warm VMs the pool is meant to hold). The zero value keeps
	// the legacy CR-management behavior, so existing deployments are unaffected.
	DisableSandboxCRManagement bool
	// Tracer stamps the creating trace onto each pool Sandbox so the Sandbox
	// controller does not have to back-patch it on first reconcile — that patch
	// costs one apiserver write per Sandbox, i.e. a full batch per pool refill.
	Tracer asmetrics.Instrumenter
}

SandboxWarmPoolReconciler reconciles a SandboxWarmPool object.

func (*SandboxWarmPoolReconciler) Reconcile

func (r *SandboxWarmPoolReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)

func (*SandboxWarmPoolReconciler) SetupWithManager

func (r *SandboxWarmPoolReconciler) SetupWithManager(mgr ctrl.Manager, concurrentWorkers int) error

SetupWithManager sets up the controller with the Manager.