Documentation
¶
Index ¶
- Variables
- type CachingIdentityAllocator
- func (m *CachingIdentityAllocator) AllocateIdentity(ctx context.Context, lbls labels.Labels, notifyOwner bool, ...) (id *identity.Identity, allocated bool, err error)
- func (m *CachingIdentityAllocator) Close()
- func (m *CachingIdentityAllocator) GetIdentities() IdentitiesModel
- func (m *CachingIdentityAllocator) GetIdentityCache() IdentityCache
- func (m *CachingIdentityAllocator) InitIdentityAllocator(client clientset.Interface) <-chan struct{}
- func (m *CachingIdentityAllocator) LookupIdentity(ctx context.Context, lbls labels.Labels) *identity.Identity
- func (m *CachingIdentityAllocator) LookupIdentityByID(ctx context.Context, id identity.NumericIdentity) *identity.Identity
- func (m *CachingIdentityAllocator) Observe(ctx context.Context, next func(IdentityChange), complete func(error))
- func (m *CachingIdentityAllocator) Release(ctx context.Context, id *identity.Identity, notifyOwner bool) (released bool, err error)
- func (m *CachingIdentityAllocator) ReleaseSlice(ctx context.Context, identities []*identity.Identity) error
- func (m *CachingIdentityAllocator) RemoveRemoteIdentities(name string)
- func (m *CachingIdentityAllocator) UnwithholdLocalIdentities(nids []identity.NumericIdentity)
- func (m *CachingIdentityAllocator) WaitForInitialGlobalIdentities(ctx context.Context) error
- func (m *CachingIdentityAllocator) WatchRemoteIdentities(remoteName string, backend kvstore.BackendOperations, cachedPrefix bool) (*allocator.RemoteCache, error)
- func (m *CachingIdentityAllocator) WithholdLocalIdentities(nids []identity.NumericIdentity)
- type IdentitiesModel
- type IdentityAllocator
- type IdentityAllocatorOwner
- type IdentityCache
- type IdentityChange
- type IdentityChangeKind
Constants ¶
This section is empty.
Variables ¶
var ( // IdentitiesPath is the path to where identities are stored in the // key-value store. IdentitiesPath = path.Join(kvstore.BaseKeyPrefix, "state", "identities", "v1") )
Functions ¶
This section is empty.
Types ¶
type CachingIdentityAllocator ¶
type CachingIdentityAllocator struct {
// IdentityAllocator is an allocator for security identities from the
// kvstore.
IdentityAllocator *allocator.Allocator
// contains filtered or unexported fields
}
CachingIdentityAllocator manages the allocation of identities for both global and local identities.
func NewCachingIdentityAllocator ¶
func NewCachingIdentityAllocator(owner IdentityAllocatorOwner) *CachingIdentityAllocator
NewCachingIdentityAllocator creates a new instance of an CachingIdentityAllocator.
func (*CachingIdentityAllocator) AllocateIdentity ¶
func (m *CachingIdentityAllocator) AllocateIdentity(ctx context.Context, lbls labels.Labels, notifyOwner bool, oldNID identity.NumericIdentity) (id *identity.Identity, allocated bool, err error)
AllocateIdentity allocates an identity described by the specified labels. If an identity for the specified set of labels already exist, the identity is re-used and reference counting is performed, otherwise a new identity is allocated via the kvstore or via the local identity allocator. A possible previously used numeric identity for these labels can be passed in as the 'oldNID' parameter; identity.InvalidIdentity must be passed if no previous numeric identity exists.
func (*CachingIdentityAllocator) Close ¶
func (m *CachingIdentityAllocator) Close()
Close closes the identity allocator
func (*CachingIdentityAllocator) GetIdentities ¶
func (m *CachingIdentityAllocator) GetIdentities() IdentitiesModel
GetIdentities returns all known identities
func (*CachingIdentityAllocator) GetIdentityCache ¶
func (m *CachingIdentityAllocator) GetIdentityCache() IdentityCache
GetIdentityCache returns a cache of all known identities
func (*CachingIdentityAllocator) InitIdentityAllocator ¶
func (m *CachingIdentityAllocator) InitIdentityAllocator(client clientset.Interface) <-chan struct{}
InitIdentityAllocator creates the global identity allocator. Only the first invocation of this function will have an effect. The Caller must have initialized well known identities before calling this (by calling identity.InitWellKnownIdentities()). The client is only used by the CRD identity allocator currently. Returns a channel which is closed when initialization of the allocator is completed. TODO: identity backends are initialized directly in this function, pulling in dependencies on kvstore and k8s. It would be better to decouple this, since the backends are an interface.
func (*CachingIdentityAllocator) LookupIdentity ¶
func (m *CachingIdentityAllocator) LookupIdentity(ctx context.Context, lbls labels.Labels) *identity.Identity
LookupIdentity looks up the identity by its labels but does not create it. This function will first search through the local cache, then the caches for remote kvstores and finally fall back to the main kvstore. May return nil for lookups if the allocator has not yet been synchronized.
func (*CachingIdentityAllocator) LookupIdentityByID ¶
func (m *CachingIdentityAllocator) LookupIdentityByID(ctx context.Context, id identity.NumericIdentity) *identity.Identity
LookupIdentityByID returns the identity by ID. This function will first search through the local cache, then the caches for remote kvstores and finally fall back to the main kvstore May return nil for lookups if the allocator has not yet been synchronized.
func (*CachingIdentityAllocator) Observe ¶
func (m *CachingIdentityAllocator) Observe(ctx context.Context, next func(IdentityChange), complete func(error))
Observe the identity changes. Conforms to stream.Observable. Replays the current state of the cache when subscribing.
func (*CachingIdentityAllocator) Release ¶
func (m *CachingIdentityAllocator) Release(ctx context.Context, id *identity.Identity, notifyOwner bool) (released bool, err error)
Release is the reverse operation of AllocateIdentity() and releases the identity again. This function may result in kvstore operations. After the last user has released the ID, the returned lastUse value is true.
func (*CachingIdentityAllocator) ReleaseSlice ¶
func (m *CachingIdentityAllocator) ReleaseSlice(ctx context.Context, identities []*identity.Identity) error
ReleaseSlice attempts to release a set of identities. It is a helper function that may be useful for cleaning up multiple identities in paths where several identities may be allocated and another error means that they should all be released.
func (*CachingIdentityAllocator) RemoveRemoteIdentities ¶
func (m *CachingIdentityAllocator) RemoveRemoteIdentities(name string)
func (*CachingIdentityAllocator) UnwithholdLocalIdentities ¶ added in v1.15.0
func (m *CachingIdentityAllocator) UnwithholdLocalIdentities(nids []identity.NumericIdentity)
func (*CachingIdentityAllocator) WaitForInitialGlobalIdentities ¶
func (m *CachingIdentityAllocator) WaitForInitialGlobalIdentities(ctx context.Context) error
WaitForInitialGlobalIdentities waits for the initial set of global security identities to have been received and populated into the allocator cache.
func (*CachingIdentityAllocator) WatchRemoteIdentities ¶
func (m *CachingIdentityAllocator) WatchRemoteIdentities(remoteName string, backend kvstore.BackendOperations, cachedPrefix bool) (*allocator.RemoteCache, error)
WatchRemoteIdentities returns a RemoteCache instance which can be later started to watch identities in another kvstore and sync them to the local identity cache. remoteName should be unique unless replacing an existing remote's backend. When cachedPrefix is set, identities are assumed to be stored under the "cilium/cache" prefix, and the watcher is adapted accordingly.
func (*CachingIdentityAllocator) WithholdLocalIdentities ¶ added in v1.15.0
func (m *CachingIdentityAllocator) WithholdLocalIdentities(nids []identity.NumericIdentity)
type IdentitiesModel ¶
IdentitiesModel is a wrapper so that we can implement the sort.Interface to sort the slice by ID
func (IdentitiesModel) FromIdentityCache ¶
func (s IdentitiesModel) FromIdentityCache(cache IdentityCache) IdentitiesModel
FromIdentityCache populates the provided model from an identity cache.
func (IdentitiesModel) Less ¶
func (s IdentitiesModel) Less(i, j int) bool
Less returns true if the element in index `i` is lower than the element in index `j`
type IdentityAllocator ¶
type IdentityAllocator interface {
// Identity changes are observable.
stream.Observable[IdentityChange]
// WaitForInitialGlobalIdentities waits for the initial set of global
// security identities to have been received.
WaitForInitialGlobalIdentities(context.Context) error
// AllocateIdentity allocates an identity described by the specified labels.
// A possible previously used numeric identity for these labels can be passed
// in as the last parameter; identity.InvalidIdentity must be passed if no
// previous numeric identity exists.
AllocateIdentity(context.Context, labels.Labels, bool, identity.NumericIdentity) (*identity.Identity, bool, error)
// Release is the reverse operation of AllocateIdentity() and releases the
// specified identity.
Release(context.Context, *identity.Identity, bool) (released bool, err error)
// ReleaseSlice is the slice variant of Release().
ReleaseSlice(context.Context, []*identity.Identity) error
// LookupIdentityByID returns the identity that corresponds to the given
// labels.
LookupIdentity(ctx context.Context, lbls labels.Labels) *identity.Identity
// LookupIdentityByID returns the identity that corresponds to the given
// numeric identity.
LookupIdentityByID(ctx context.Context, id identity.NumericIdentity) *identity.Identity
// GetIdentityCache returns the current cache of identities that the
// allocator has allocated. The caller should not modify the resulting
// identities by pointer.
GetIdentityCache() IdentityCache
// GetIdentities returns a copy of the current cache of identities.
GetIdentities() IdentitiesModel
// WithholdLocalIdentities holds a set of numeric identities out of the local
// allocation pool(s). Once withheld, a numeric identity can only be used
// when explicitly requested via AllocateIdentity(..., oldNID).
WithholdLocalIdentities(nids []identity.NumericIdentity)
// UnwithholdLocalIdentities removes numeric identities from the withheld set,
// freeing them for general allocation.
UnwithholdLocalIdentities(nids []identity.NumericIdentity)
}
IdentityAllocator is any type which is responsible for allocating security identities based of sets of labels, and caching information about identities locally.
type IdentityAllocatorOwner ¶
type IdentityAllocatorOwner interface {
// UpdateIdentities will be called when identities have changed
//
// The caller is responsible for making sure the same identity
// is not present in both 'added' and 'deleted', so that they
// can be processed in either order.
UpdateIdentities(added, deleted IdentityCache)
// GetSuffix must return the node specific suffix to use
GetNodeSuffix() string
}
IdentityAllocatorOwner is the interface the owner of an identity allocator must implement
type IdentityCache ¶
type IdentityCache map[identity.NumericIdentity]labels.LabelArray
IdentityCache is a cache of identity to labels mapping
type IdentityChange ¶
type IdentityChange struct {
Kind IdentityChangeKind
ID identity.NumericIdentity
Labels labels.Labels
}
type IdentityChangeKind ¶
type IdentityChangeKind string
const ( IdentityChangeSync IdentityChangeKind = IdentityChangeKind(allocator.AllocatorChangeSync) IdentityChangeUpsert IdentityChangeKind = IdentityChangeKind(allocator.AllocatorChangeUpsert) IdentityChangeDelete IdentityChangeKind = IdentityChangeKind(allocator.AllocatorChangeDelete) )
Source Files