podbouncer

type PodBouncer ¶

type PodBouncer interface {
	BouncePods(
		ctx context.Context,
		podBounceDirective *certificatesv1.PodBounceDirective,
		pods corev1sets.PodSet,
		configMaps corev1sets.ConfigMapSet,
		secrets corev1sets.SecretSet,
	) (bool, error)
}

bounce (delete) the listed pods returns true if we need to wait before proceeding to process the podBounceDirective. we must wait for the following conditions: 1. istiod control plane has come back online after it has been restarted 2. istio's root cert has been propagated to all istio-controlled namespaces for consumption by the data plane. this should cause the reconcile to end early and persist the IssuedCertificate in the Issued state

func NewPodBouncer(
	podClient corev1client.PodClient,
	rootCertMatcher RootCertMatcher,
) PodBouncer

type RootCertMatcher ¶

type RootCertMatcher interface {
	MatchesRootCert(
		ctx context.Context,
		rootCert []byte,
		selector *certificatesv1.PodBounceDirectiveSpec_PodSelector,
		allSecrets corev1sets.SecretSet,
	) (matches bool, err error)
}

func NewSecretRootCertMatcher() RootCertMatcher