-
Notifications
You must be signed in to change notification settings - Fork 4
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: add listener and secret constants (#102)
- Loading branch information
Showing
10 changed files
with
194 additions
and
127 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,25 @@ | ||
| package constants | ||
|
|
||
| // k8s recommended labels for app | ||
| // https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/ | ||
| // https://kubernetes.io/docs/reference/labels-annotations-taints/ | ||
| const ( | ||
| LabelKubernetesComponent = "app.kubernetes.io/component" | ||
| LabelKubernetesInstance = "app.kubernetes.io/instance" | ||
| LabelKubernetesName = "app.kubernetes.io/name" | ||
| LabelKubernetesManagedBy = "app.kubernetes.io/managed-by" | ||
| LabelKubernetesRoleGroup = "app.kubernetes.io/role-group" | ||
| LabelKubernetesVersion = "app.kubernetes.io/version" | ||
|
|
||
| ZncdataDomain = "zncdata.dev" | ||
| ) | ||
|
|
||
| func MatchingLabelsNames() []string { | ||
| return []string{ | ||
| LabelKubernetesName, | ||
| LabelKubernetesInstance, | ||
| LabelKubernetesRoleGroup, | ||
| LabelKubernetesComponent, | ||
| LabelKubernetesManagedBy, | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| package constants | ||
|
|
||
| const ( | ||
| ListenerOperatorGroup string = "listeners." + ZncdataDomain | ||
| ListenerStorageClass string = ListenerOperatorGroup | ||
|
|
||
| listenerOperatorGroupPrefix string = ListenerOperatorGroup + "/" | ||
| ) | ||
|
|
||
| func ListenerStorageClassPtr() *string { | ||
| listenersStorageClass := ListenerStorageClass | ||
| return &listenersStorageClass | ||
| } | ||
|
|
||
| // Zncdata defined annotations for PVCTemplate. | ||
| // Then csi driver can extract annotations from PVC to prepare the listener for pod. | ||
| const ( | ||
| // Specify which network listening rules to use, it is REQUIRED. | ||
| // It can be one of the following values: | ||
| // - cluster-internal | ||
| // - external-unstable | ||
| // - external-stable | ||
| // - <other user defined class name> | ||
| AnnotationListenersClass string = listenerOperatorGroupPrefix + "class" | ||
| // The listener name is used to identify the listener, it is OPTIONAL. | ||
| // If not set, the listener name will be the same as the pod name. | ||
| AnnotationListenerName string = listenerOperatorGroupPrefix + "listenerName" | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,107 @@ | ||
| package constants | ||
|
|
||
| const ( | ||
| SecretOperatorGroup string = "secrets." + ZncdataDomain | ||
| SecretStorageClass string = SecretOperatorGroup | ||
|
|
||
| secretOperatorGroupPrefix string = SecretOperatorGroup + "/" | ||
| ) | ||
|
|
||
| func SecretStorageClassPtr() *string { | ||
| secretStorageClass := SecretStorageClass | ||
| return &secretStorageClass | ||
| } | ||
|
|
||
| // Labels for k8s search secret | ||
| // k8s search secret obj by filter one or more labels | ||
| const ( | ||
| LabelSecretsNode string = secretOperatorGroupPrefix + "node" | ||
| LabelSecretsPod string = secretOperatorGroupPrefix + "/pod" | ||
| LabelSecretsService string = secretOperatorGroupPrefix + "service" | ||
| ) | ||
|
|
||
| // Annotation for expiration time of zncdata secret for pod. | ||
| // When the secret is created, the expiration time is set to the current time plus the lifetime. | ||
| // Then we can clean up the secret after expiration time | ||
| const ( | ||
| SecretZncdataExpirationTimeName string = secretOperatorGroupPrefix + "expirationTime" | ||
| ) | ||
|
|
||
| // Zncdata defined annotations for PVCTemplate. | ||
| // Then csi driver can extract annotations from PVC to prepare the secret for pod. | ||
| const ( | ||
| AnnotationSecretsClass string = secretOperatorGroupPrefix + "class" | ||
|
|
||
| // Scope is the scope of the secret. | ||
| // It can be one of the following values: | ||
| // - pod | ||
| // - node | ||
| // - service | ||
| // - listener-volume | ||
| // | ||
| // Example: | ||
| // - "secrets.zncdata.dev/scope": "pod" | ||
| // - "secrets.zncdata.dev/scope": "node" | ||
| // - "secrets.zncdata.dev/scope": "service=foo" | ||
| // - "secrets.zncdata.dev/scope": "listener-volume=foo" | ||
| // - "secrets.zncdata.dev/scope": "pod,service=foo,bar,listner-volume=xyz" | ||
| AnnotationSecretsScope string = secretOperatorGroupPrefix + "scope" | ||
|
|
||
| // Format is mounted format of the secret. | ||
| // It can be one of the following values: | ||
| // - tls-pem A PEM-encoded TLS certificate, include "tls.crt", "tls.key", "ca.crt". | ||
| // - tls-p12 A PKCS#12 archive, include "keystore.p12", "truststore.p12". | ||
| // - kerberos A Kerberos keytab, include "keytab", "krb5.conf". | ||
| AnnotationSecretsFormat string = secretOperatorGroupPrefix + "format" | ||
|
|
||
| // PKCS12 format password, it will be used truststore and keystore password. | ||
| AnnotationSecretsPKCS12Password string = secretOperatorGroupPrefix + "tlsPKCS12Password" | ||
| // golang time.Duration string, it will be used to create certificate expiration time. | ||
| AnnotationSecretCertLifeTime string = secretOperatorGroupPrefix + "autoTlsCertLifetime" | ||
| AnnotationSecretsCertJitterFactor string = secretOperatorGroupPrefix + "autoTlsCertJitterFactor" | ||
|
|
||
| // KerberosServiceNames is the list of Kerberos service names. | ||
| // It is a comma separated list of Kerberos realms. | ||
| // | ||
| // If this filed value is "HTTP,NN,DN", and scope is specified a service name: "service=<k8s-service>". | ||
| // It is used to create kerberos realm. | ||
| // - HTTP -> HTTP/<k8s-service>.<k8s-namespace>.cluster.local@REALM | ||
| // - NN -> nn/<k8s-service>.<k8s-namespace>.cluster.local@REALM | ||
| // - DN -> dn/<k8s-service>.<k8s-namespace>.cluster.local@REALM | ||
| // | ||
| // If this field value is "NN", and scope is "pod" | ||
| // It is used to create kerberos realm: | ||
| // - nn/<pod-name>.<pod-subdomain>.<k8s-namespace>.cluster.local@REALM # https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/#pods | ||
| // | ||
| // If this field value is "DN", and scope is "node" | ||
| // It is used to create kerberos realm: | ||
| // - dn/<node-name>.<k8s-namespace>.cluster.local@REALM | ||
| // | ||
| // If this field value is "HTTP", and scope is "listener-volume=foo" | ||
| // It is used to create kerberos realm: | ||
| // - HTTP/<the-service-of-listener-foo>.<k8s-namespace>.cluster.local@REALM | ||
| AnnotationSecretsKerberosServiceNames string = secretOperatorGroupPrefix + "kerberosServiceNames" | ||
| ) | ||
|
|
||
| type SecretFormat string | ||
|
|
||
| const ( | ||
| TLSPEM SecretFormat = "tls-pem" | ||
| TLSP12 SecretFormat = "tls-p12" | ||
| Kerberos SecretFormat = "kerberos" | ||
| ) | ||
|
|
||
| const ( | ||
| CommonDelimiter string = "," | ||
| ListenerVolumeDelimiter string = CommonDelimiter | ||
| KerberosServiceNamesDelimiter string = CommonDelimiter | ||
| ) | ||
|
|
||
| type SecretScope string | ||
|
|
||
| const ( | ||
| PodScope SecretScope = "pod" | ||
| NodeScope SecretScope = "node" | ||
| ServiceScope SecretScope = "service" | ||
| ListenerVolumeScope SecretScope = "listener-volume" | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
Oops, something went wrong.