TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-08-25 20:57:31 +00:00
Code Issues Packages Projects Releases Wiki Activity

kube,cmd/{k8s-operator,containerboot},envknob,ipn/store/kubestore,*/depaware.txt: rename packages (#13418)

Browse Source 
Rename kube/{types,client,api} -> kube/{kubetypes,kubeclient,kubeapi}
so that we don't need to rename the package on each import to
convey that it's kubernetes specific.

Updates#cleanup

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
This commit is contained in:
Irbe Krumina
2024-09-08 22:57:29 +03:00
committed by GitHub
parent d6dfb7f242
commit 209567e7a0
24 changed files with 36 additions and 36 deletions
Download Patch File Download Diff File Expand all files Collapse all files

55
kube/kubetypes/grants.go Normal file
View File

@@ -0,0 +1,55 @@
// Copyright (c) Tailscale Inc & AUTHORS
// SPDX-License-Identifier: BSD-3-Clause
// Package kubetypes contains types and constants related to the Tailscale
// Kubernetes Operator.
// These are split into a separate package for consumption of
// non-Kubernetes shared libraries and binaries. Be mindful of not increasing
// dependency size for those consumers when adding anything new here.
package kubetypes
import "net/netip"
// KubernetesCapRule is a rule provided via PeerCapabilityKubernetes capability.
type KubernetesCapRule struct {
// Impersonate is a list of rules that specify how to impersonate the caller
// when proxying to the Kubernetes API.
Impersonate *ImpersonateRule `json:"impersonate,omitempty"`
// Recorders defines a tag of a tsrecorder instance(s) that a recording
// of a 'kubectl exec' session, matching `src` of this grant, to an API
// server proxy, matching `dst` of this grant, should be sent to.
// This list must not contain more than one tag. The field
// name matches the `Recorder` field with equal semantics for Tailscale
// SSH session recorder. This field is set by users in ACL grants and is
// then parsed by control, which resolves the tags and populates `RecorderAddrs``.
// https://tailscale.com/kb/1246/tailscale-ssh-session-recording#turn-on-session-recording-in-acls
Recorders []string `json:"recorder,omitempty"`
// RecorderAddrs is a list of addresses that should be addresses of one
// or more tsrecorder instance(s). If set, any `kubectl exec` session
// from a client matching `src` of this grant to an API server proxy
// matching `dst` of this grant will be recorded and the recording will
// be sent to the tsrecorder. This field does not exist in the user
// provided ACL grants - it is populated by control, which obtains the
// addresses by resolving the tags provided via `Recorders` field.
RecorderAddrs []netip.AddrPort `json:"recorderAddrs,omitempty"`
// EnforceRecorder defines whether a kubectl exec session from a client
// matching `src` to an API server proxy matching `dst` should fail
// closed if it cannot be recorded (i.e if no recorder can be reached).
// Default is to fail open.
// The field name matches `EnforceRecorder` field with equal semantics for Tailscale SSH
// session recorder.
// https://tailscale.com/kb/1246/tailscale-ssh-session-recording#turn-on-session-recording-in-acls
EnforceRecorder bool `json:"enforceRecorder,omitempty"`
}
// ImpersonateRule defines how a request from the tailnet identity matching
// 'src' of this grant should be impersonated.
type ImpersonateRule struct {
// Groups can be used to set a list of groups that a request to
// Kubernetes API server should be impersonated as from. Groups in
// Kubernetes only exist as subjects that RBAC rules refer to. Caller
// can choose to use an existing group, such as system:masters, or
// create RBAC for a new group.
// https://kubernetes.io/docs/reference/access-authn-authz/rbac/#referring-to-subjects
Groups []string `json:"groups,omitempty"`
}