README
¶
KRM Filter - RefHash
Find references to secrets and configmaps and annotate their holder with checksums
Find all references to resource and annotate their holder with a checksum of the found reference. This allows to trigger a new deployment rollout or similar pod restarts when the content of the references resource has changed-
Examples
The function config is a simple configmap-like object containing options.
apiVersion: v1
kind: ConfigMap
metadata:
name: hash
data:
secret_kinds: Secret,SealedSecret
configmap_kinds: ConfigMap
Run the function as standalone providing the function config and resources.
refhash fn-config.yaml - < resources.yaml
Documentation
¶
Index ¶
Constants ¶
const ( KindSecret = "Secret" KindConfigMap = "ConfigMap" KindSealedSecret = "SealedSecret" KindPod = "Pod" AnnotationChecksum = "internal.refhash/checksum" AnnotationPodChecksumFstr = "%s.checksum/%s" )
Variables ¶
var ( DefaultSecretKinds = []string{KindSecret, KindSealedSecret} DefaultConfigMapKinds = []string{KindConfigMap} )
var ( PathVolumeSecrets = []string{"spec", "volumes", "*", "secret", "secretName"} PathVolumeConfigMaps = []string{"spec", "volumes", "*", "configMap", "name"} PathContainerEnvSecrets = []string{"spec", "containers", "*", "env", "*", "valueFrom", "secretKeyRef", "name"} PathContainerEnvConfigMaps = []string{"spec", "containers", "*", "env", "*", "valueFrom", "configMapKeyRef", "name"} PathContainerEnvFromSecrets = []string{"spec", "containers", "*", "envFrom", "*", "secretRef", "name"} PathContainerEnvFromConfigs = []string{"spec", "containers", "*", "envFrom", "*", "configMapRef", "name"} )
the matchers will always return a sequence node, meaning any filter after them need to anticipate the sequence and handle it accordingly
Functions ¶
func Processor ¶
func Processor() framework.ResourceListProcessor
This processor finds potential ref sources in the input node list and annotates pods with their checksum where applicable.
Types ¶
type FunctionConfig ¶
type FunctionConfig struct {
Data Data `json:"data,omitempty"`
}
func (*FunctionConfig) Default ¶
func (config *FunctionConfig) Default() error
type RefHasher ¶
type RefHasher struct {
SecretKinds []string
ConfigMapKinds []string
Refs []*yaml.RNode
Results framework.Results
// contains filtered or unexported fields
}
the ref hasher implements a yaml filter
func (*RefHasher) Each ¶
call the filter func for each element in the node list this methods implements the kio.Filter interface
func (*RefHasher) Filter ¶
the filter filters by pod and finds references to secrets and configmap in the pod spec. Each found reference is matched against the Refs list known to the hasher and if a match is found, an annotation with the ref sources checksum is added to the pod spec. This method implements the yaml.Filter interface
Source Files
Directories