kubernetes union_content 源码

kubernetes union_content 代码

文件路径：/staging/src/k8s.io/apiserver/pkg/server/dynamiccertificates/union_content.go

/*
Copyright 2019 The Kubernetes Authors.

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

package dynamiccertificates

import (
	"bytes"
	"context"
	"crypto/x509"
	"strings"

	utilerrors "k8s.io/apimachinery/pkg/util/errors"
)

type unionCAContent []CAContentProvider

var _ CAContentProvider = &unionCAContent{}
var _ ControllerRunner = &unionCAContent{}

// NewUnionCAContentProvider returns a CAContentProvider that is a union of other CAContentProviders
func NewUnionCAContentProvider(caContentProviders ...CAContentProvider) CAContentProvider {
	return unionCAContent(caContentProviders)
}

// Name is just an identifier
func (c unionCAContent) Name() string {
	names := []string{}
	for _, curr := range c {
		names = append(names, curr.Name())
	}
	return strings.Join(names, ",")
}

// CurrentCABundleContent provides ca bundle byte content
func (c unionCAContent) CurrentCABundleContent() []byte {
	caBundles := [][]byte{}
	for _, curr := range c {
		if currCABytes := curr.CurrentCABundleContent(); len(currCABytes) > 0 {
			caBundles = append(caBundles, []byte(strings.TrimSpace(string(currCABytes))))
		}
	}

	return bytes.Join(caBundles, []byte("\n"))
}

// CurrentCABundleContent provides ca bundle byte content
func (c unionCAContent) VerifyOptions() (x509.VerifyOptions, bool) {
	currCABundle := c.CurrentCABundleContent()
	if len(currCABundle) == 0 {
		return x509.VerifyOptions{}, false
	}

	// TODO make more efficient.  This isn't actually used in any of our mainline paths.  It's called to build the TLSConfig
	// TODO on file changes, but the actual authentication runs against the individual items, not the union.
	ret, err := newCABundleAndVerifier(c.Name(), c.CurrentCABundleContent())
	if err != nil {
		// because we're made up of already vetted values, this indicates some kind of coding error
		panic(err)
	}

	return ret.verifyOptions, true
}

// AddListener adds a listener to be notified when the CA content changes.
func (c unionCAContent) AddListener(listener Listener) {
	for _, curr := range c {
		curr.AddListener(listener)
	}
}

// AddListener adds a listener to be notified when the CA content changes.
func (c unionCAContent) RunOnce(ctx context.Context) error {
	errors := []error{}
	for _, curr := range c {
		if controller, ok := curr.(ControllerRunner); ok {
			if err := controller.RunOnce(ctx); err != nil {
				errors = append(errors, err)
			}
		}
	}

	return utilerrors.NewAggregate(errors)
}

// Run runs the controller
func (c unionCAContent) Run(ctx context.Context, workers int) {
	for _, curr := range c {
		if controller, ok := curr.(ControllerRunner); ok {
			go controller.Run(ctx, workers)
		}
	}
}

相关信息

kubernetes 源码目录

相关文章

kubernetes cert_key 源码

kubernetes cert_key_test 源码

kubernetes client_ca 源码

kubernetes client_ca_test 源码

kubernetes configmap_cafile_content 源码

kubernetes dynamic_cafile_content 源码

kubernetes dynamic_serving_content 源码

kubernetes dynamic_sni_content 源码

kubernetes interfaces 源码

kubernetes named_certificates 源码