config

Documentation

Index

• Constants
• func CreateClientConfig(kubeconfig string, qps float64, burst int) (*rest.Config, error)
• func CreateClientConfigWithContext(kubeconfig string, context string) (*rest.Config, error)
• func KyvernoConfigMapName() string
• func KyvernoDeploymentName() string
• func KyvernoDryRunNamespace() string
• func KyvernoNamespace() string
• func KyvernoPodName() string
• func KyvernoServiceAccountName() string
• func KyvernoServiceName() string
• func NewDefaultConfiguration() *configuration
• func NewDefaultMetricsConfiguration() *metricsConfig
• type Configuration
  • func NewConfiguration(client kubernetes.Interface) (Configuration, error)
• type MetricsConfiguration
  • func NewMetricsConfiguration(client kubernetes.Interface) (MetricsConfiguration, error)
• type WebhookConfig

Constants

const (
	// PolicyValidatingWebhookConfigurationName default policy validating webhook configuration name
	PolicyValidatingWebhookConfigurationName = "kyverno-policy-validating-webhook-cfg"
	// ValidatingWebhookConfigurationName ...
	ValidatingWebhookConfigurationName = "kyverno-resource-validating-webhook-cfg"
	// ExceptionValidatingWebhookConfigurationName ...
	ExceptionValidatingWebhookConfigurationName = "kyverno-exception-validating-webhook-cfg"
	// CleanupValidatingWebhookConfigurationName ...
	CleanupValidatingWebhookConfigurationName = "kyverno-cleanup-validating-webhook-cfg"
	// PolicyMutatingWebhookConfigurationName default policy mutating webhook configuration name
	PolicyMutatingWebhookConfigurationName = "kyverno-policy-mutating-webhook-cfg"
	// MutatingWebhookConfigurationName default resource mutating webhook configuration name
	MutatingWebhookConfigurationName = "kyverno-resource-mutating-webhook-cfg"
	// VerifyMutatingWebhookConfigurationName default verify mutating webhook configuration name
	VerifyMutatingWebhookConfigurationName = "kyverno-verify-mutating-webhook-cfg"
)

webhook configuration names

const (
	// PolicyValidatingWebhookName default policy validating webhook name
	PolicyValidatingWebhookName = "validate-policy.kyverno.svc"
	// ValidatingWebhookName ...
	ValidatingWebhookName = "validate.kyverno.svc"
	// PolicyMutatingWebhookName default policy mutating webhook name
	PolicyMutatingWebhookName = "mutate-policy.kyverno.svc"
	// MutatingWebhookName default resource mutating webhook name
	MutatingWebhookName = "mutate.kyverno.svc"
	// VerifyMutatingWebhookName default verify mutating webhook name
	VerifyMutatingWebhookName = "monitor-webhooks.kyverno.svc"
)

webhook names

const (
	// PolicyValidatingWebhookServicePath is the path for policy validation webhook(used to validate policy resource)
	PolicyValidatingWebhookServicePath = "/policyvalidate"
	// ValidatingWebhookServicePath is the path for validation webhook
	ValidatingWebhookServicePath = "/validate"
	// ExceptionValidatingWebhookServicePath is the path for policy exception validation webhook(used to validate policy exception resource)
	ExceptionValidatingWebhookServicePath = "/exceptionvalidate"
	// CleanupValidatingWebhookServicePath is the path for cleanup policy validation webhook(used to validate cleanup policy resource)
	CleanupValidatingWebhookServicePath = "/validate"
	// PolicyMutatingWebhookServicePath is the path for policy mutation webhook(used to default)
	PolicyMutatingWebhookServicePath = "/policymutate"
	// MutatingWebhookServicePath is the path for mutation webhook
	MutatingWebhookServicePath = "/mutate"
	// VerifyMutatingWebhookServicePath is the path for verify webhook(used to veryfing if admission control is enabled and active)
	VerifyMutatingWebhookServicePath = "/verifymutate"
	// LivenessServicePath is the path for check liveness health
	LivenessServicePath = "/health/liveness"
	// ReadinessServicePath is the path for check readness health
	ReadinessServicePath = "/health/readiness"
	// MetricsPath is the path for exposing metrics
	MetricsPath = "/metrics"
)

paths

const (
	// Due to kubernetes issue, we must use next literal constants instead of deployment TypeMeta fields
	// Issue: https://github.com/kubernetes/kubernetes/pull/63972
	// When the issue is closed, we should use TypeMeta struct instead of this constants
	// ClusterRoleAPIVersion define the default clusterrole resource apiVersion
	ClusterRoleAPIVersion = "rbac.authorization.k8s.io/v1"
	// ClusterRoleKind define the default clusterrole resource kind
	ClusterRoleKind = "ClusterRole"
)

Functions

func CreateClientConfig

func CreateClientConfig(kubeconfig string, qps float64, burst int) (*rest.Config, error)

CreateClientConfig creates client config and applies rate limit QPS and burst

func CreateClientConfigWithContext

func CreateClientConfigWithContext(kubeconfig string, context string) (*rest.Config, error)

CreateClientConfigWithContext creates client config from custom kubeconfig file and context Used for cli commands

func KyvernoConfigMapName

func KyvernoConfigMapName() string

func KyvernoDeploymentName

func KyvernoDeploymentName() string

func KyvernoDryRunNamespace

func KyvernoDryRunNamespace() string

func KyvernoNamespace

func KyvernoNamespace() string

func KyvernoPodName

func KyvernoPodName() string

func KyvernoServiceAccountName

func KyvernoServiceAccountName() string

func KyvernoServiceName

func KyvernoServiceName() string

func NewDefaultConfiguration

func NewDefaultConfiguration() *configuration

NewDefaultConfiguration ...

func NewDefaultMetricsConfiguration

func NewDefaultMetricsConfiguration() *metricsConfig

NewDefaultMetricsConfiguration ...

Types

type Configuration

type Configuration interface {
	// ToFilter checks if the given resource is set to be filtered in the configuration
	ToFilter(kind, namespace, name string) bool
	// GetExcludeGroupRole return exclude roles
	GetExcludeGroupRole() []string
	// GetExcludeUsername return exclude username
	GetExcludeUsername() []string
	// GetGenerateSuccessEvents return if should generate success events
	GetGenerateSuccessEvents() bool
	// FilterNamespaces filters exclude namespace
	FilterNamespaces(namespaces []string) []string
	// GetWebhooks returns the webhook configs
	GetWebhooks() []WebhookConfig
	// GetWebhookAnnotations returns annotations to set on webhook configs
	GetWebhookAnnotations() map[string]string
	// Load loads configuration from a configmap
	Load(cm *corev1.ConfigMap)
}

Configuration to be used by consumer to check filters

func NewConfiguration

func NewConfiguration(client kubernetes.Interface) (Configuration, error)

NewConfiguration ...

type MetricsConfiguration

type MetricsConfiguration interface {
	// GetExcludeNamespaces returns the namespaces to ignore for metrics exposure
	GetExcludeNamespaces() []string
	// GetIncludeNamespaces returns the namespaces to specifically consider for metrics exposure
	GetIncludeNamespaces() []string
	// GetMetricsRefreshInterval returns the refresh interval for the metrics
	GetMetricsRefreshInterval() time.Duration
	// CheckNamespace returns `true` if the namespace has to be considered
	CheckNamespace(string) bool
}

MetricsConfig stores the config for metrics

func NewMetricsConfiguration

func NewMetricsConfiguration(client kubernetes.Interface) (MetricsConfiguration, error)

NewMetricsConfiguration ...

type WebhookConfig

type WebhookConfig struct {
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
	ObjectSelector    *metav1.LabelSelector `json:"objectSelector,omitempty"`
}