Documentation
¶
Overview ¶
Package kubernetes implements Kubernetes Secret backend used for persisting identity and state for agent's running in Kubernetes clusters.
Index ¶
- func InKubeCluster() bool
- type Backend
- func (b *Backend) Create(ctx context.Context, i backend.Item) (*backend.Lease, error)
- func (b *Backend) Exists(ctx context.Context) bool
- func (b *Backend) Get(ctx context.Context, key []byte) (*backend.Item, error)
- func (b *Backend) Put(ctx context.Context, i backend.Item) (*backend.Lease, error)
- func (b *Backend) PutRange(ctx context.Context, items []backend.Item) error
- type Config
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func InKubeCluster ¶
func InKubeCluster() bool
InKubeCluster detemines if the agent is running inside a Kubernetes cluster and has access to service account token and cluster CA. Besides, it also validates the presence of `KUBE_NAMESPACE` and `TELEPORT_REPLICA_NAME` environment variables to generate the secret name.
Types ¶
type Backend ¶
type Backend struct {
Config
// contains filtered or unexported fields
}
Backend uses Kubernetes Secrets to store identities.
func NewWithClient ¶
func NewWithClient(restClient kubernetes.Interface) (*Backend, error)
NewWithClient returns a new instance of Kubernetes Secret identity backend storage with the provided client.
func NewWithConfig ¶
NewWithConfig returns a new instance of Kubernetes Secret identity backend storage with the provided config.
func (*Backend) Exists ¶
Exists checks if the secret already exists in Kubernetes. It's used to determine if the agent never created a secret and might upgrade from local SQLite database. In that case, the agent reads local database and creates a copy of the keys in Kube Secret.
func (*Backend) Get ¶
Get reads the secret and extracts the key from it. If the secret does not exist or the key is not found it returns trace.Notfound, otherwise returns the underlying error.
func (*Backend) Put ¶
Put puts value into backend (creates if it does not exist, updates it otherwise)
func (*Backend) PutRange ¶
PutRange receives multiple items and upserts them into the Kubernetes Secret. This function is only used when the Agent's Secret does not exist, but local SQLite database has identity credentials. TODO(tigrato): remove this once the compatibility layer between local storage and Kube secret storage is no longer required!
type Config ¶
type Config struct {
// Namespace is the Agent's namespace
// Field is required
Namespace string
// SecretName is unique secret per agent where state and identity will be stored.
// Field is required
SecretName string
// ReplicaName is the Agent's pod name
// Field is required
ReplicaName string
// ReleaseName is the HELM release name
// Field is optional
ReleaseName string
// KubeClient is the Kubernetes rest client
// Field is required
KubeClient kubernetes.Interface
}
Config structure represents configuration section
Source Files