欢迎关注我的公众号：
目前刚开始写一个月，一共写了18篇原创文章，文章目录如下：
istio防故障利器，你知道几个,istio新手不要读，太难！
不懂envoyfilter也敢说精通istio系列-http-rbac-不要只会用AuthorizationPolicy配置权限
不懂envoyfilter也敢说精通istio系列-02-http-corsFilter-不要只会vs
不懂envoyfilter也敢说精通istio系列-03-http-csrf filter-再也不用再代码里写csrf逻辑了
不懂envoyfilter也敢说精通istio系列http-jwt_authn-不要只会RequestAuthorization
不懂envoyfilter也敢说精通istio系列-05-fault-filter-故障注入不止是vs
不懂envoyfilter也敢说精通istio系列-06-http-match-配置路由不只是vs
不懂envoyfilter也敢说精通istio系列-07-负载均衡配置不止是dr
不懂envoyfilter也敢说精通istio系列-08-连接池和断路器
不懂envoyfilter也敢说精通istio系列-09-http-route filter
不懂envoyfilter也敢说精通istio系列-network filter-redis proxy
不懂envoyfilter也敢说精通istio系列-network filter-HttpConnectionManager
不懂envoyfilter也敢说精通istio系列-ratelimit-istio ratelimit完全手册
————————————————
type ReconcileOptions struct {//reconcile结构体
PrintFlags *genericclioptions.PrintFlags
FilenameOptions *resource.FilenameOptions
DryRun bool
RemoveExtraPermissions bool
RemoveExtraSubjects bool
Visitor resource.Visitor
RBACClient rbacv1client.RbacV1Interface
NamespaceClient corev1client.CoreV1Interface
PrintObject printers.ResourcePrinterFunc
genericclioptions.IOStreams
}func NewReconcileOptions(ioStreams genericclioptions.IOStreams) *ReconcileOptions {
return &ReconcileOptions{//初始化结构体
FilenameOptions: &resource.FilenameOptions{},
PrintFlags: genericclioptions.NewPrintFlags("reconciled").WithTypeSetter(scheme.Scheme),
IOStreams: ioStreams,
}
}//创建reconcile命令
func NewCmdReconcile(f cmdutil.Factory, streams genericclioptions.IOStreams) *cobra.Command {
o := NewReconcileOptions(streams)//初始化结构体
cmd := &cobra.Command{//创建cobra命令
Use: "reconcile -f FILENAME",
DisableFlagsInUseLine: true,
Short: "Reconciles rules for RBAC Role, RoleBinding, ClusterRole, and ClusterRole binding objects",
Long: reconcileLong,
Example: reconcileExample,
Run: func(cmd *cobra.Command, args []string) {
cmdutil.CheckErr(o.Complete(cmd, f, args))//准备
cmdutil.CheckErr(o.Validate())//校验
cmdutil.CheckErr(o.RunReconcile())//运行
},
}
o.PrintFlags.AddFlags(cmd)//打印选项
cmdutil.AddFilenameOptionFlags(cmd, o.FilenameOptions, "identifying the resource to reconcile.")//文件选项
cmd.Flags().BoolVar(&o.DryRun, "dry-run", o.DryRun, "If true, display results but do not submit changes")//干跑选项
cmd.Flags().BoolVar(&o.RemoveExtraPermissions, "remove-extra-permissions", o.RemoveExtraPermissions, "If true, removes extra permissions added to roles")//删除多余权限选项
cmd.Flags().BoolVar(&o.RemoveExtraSubjects, "remove-extra-subjects", o.RemoveExtraSubjects, "If true, removes extra subjects added to rolebindings")//删除多余主体选项
return cmd
}//准备
func (o *ReconcileOptions) Complete(cmd *cobra.Command, f cmdutil.Factory, args []string) error {
if err := o.FilenameOptions.RequireFilenameOrKustomize(); err != nil {//文件选项是必须的
return err
}
if len(args) > 0 {//不能有参数
return errors.New("no arguments are allowed")
}
namespace, enforceNamespace, err := f.ToRawKubeConfigLoader().Namespace()//获取namespace和enforceNamespace
if err != nil {
return err
}
r := f.NewBuilder().
WithScheme(scheme.Scheme, scheme.Scheme.PrioritizedVersionsAllGroups()...).
ContinueOnError().
NamespaceParam(namespace).DefaultNamespace().
FilenameParam(enforceNamespace, o.FilenameOptions).
Flatten().
Do()//构造result对象
if err := r.Err(); err != nil {
return err
}
o.Visitor = r//设置visitor
clientConfig, err := f.ToRESTConfig()//获取restconfig
if err != nil {
return err
}
o.RBACClient, err = rbacv1client.NewForConfig(clientConfig)//通过restconfig获取rbacclient
if err != nil {
return err
}
o.NamespaceClient, err = corev1client.NewForConfig(clientConfig)//通过restconfig获取namespaceCient
if err != nil {
return err
}
if o.DryRun {//准备干跑
o.PrintFlags.Complete("%s (dry run)")
}
printer, err := o.PrintFlags.ToPrinter()//printflag转printer
if err != nil {
return err
}
o.PrintObject = printer.PrintObj//设置printObj函数
return nil
}//校验
func (o *ReconcileOptions) Validate() error {
if o.Visitor == nil {//visitor不能为空
return errors.New("ReconcileOptions.Visitor must be set")
}
if o.RBACClient == nil {// rbacclient不能为空
return errors.New("ReconcileOptions.RBACClient must be set")
}
if o.NamespaceClient == nil {//namespaceClient不能为空
return errors.New("ReconcileOptions.NamespaceClient must be set")
}
if o.PrintObject == nil {//printObject不能为空
return errors.New("ReconcileOptions.Print must be set")
}
if o.Out == nil {//out不能为空
return errors.New("ReconcileOptions.Out must be set")
}
if o.ErrOut == nil {//errout不能为空
return errors.New("ReconcileOptions.Err must be set")
}
return nil
}//运行
func (o *ReconcileOptions) RunReconcile() error {
return o.Visitor.Visit(func(info *resource.Info, err error) error {//visit result
if err != nil {//有错误直接返回
return err
}
switch t := info.Object.(type) {//判断info的object类型
case *rbacv1.Role://如果是role
reconcileOptions := reconciliation.ReconcileRoleOptions{//创建reconcileOptions
Confirm: !o.DryRun,
RemoveExtraPermissions: o.RemoveExtraPermissions,
Role: reconciliation.RoleRuleOwner{Role: t},
Client: reconciliation.RoleModifier{
NamespaceClient: o.NamespaceClient.Namespaces(),
Client: o.RBACClient,
},
}
result, err := reconcileOptions.Run()//执行reconcile
if err != nil {
return err
}
o.printResults(result.Role.GetObject(), nil, nil, result.MissingRules, result.ExtraRules, result.Operation, result.Protected)//打印结果
case *rbacv1.ClusterRole://如果是clusterrole
reconcileOptions := reconciliation.ReconcileRoleOptions{//创建reconcileOptions
Confirm: !o.DryRun,
RemoveExtraPermissions: o.RemoveExtraPermissions,
Role: reconciliation.ClusterRoleRuleOwner{ClusterRole: t},
Client: reconciliation.ClusterRoleModifier{
Client: o.RBACClient.ClusterRoles(),
},
}
result, err := reconcileOptions.Run()//执行reconcile
if err != nil {
return err
}
o.printResults(result.Role.GetObject(), nil, nil, result.MissingRules, result.ExtraRules, result.Operation, result.Protected)//打印结果
case *rbacv1.RoleBinding://如果是rolebinding
reconcileOptions := reconciliation.ReconcileRoleBindingOptions{//创建reconcileOptions
Confirm: !o.DryRun,
RemoveExtraSubjects: o.RemoveExtraSubjects,
RoleBinding: reconciliation.RoleBindingAdapter{RoleBinding: t},
Client: reconciliation.RoleBindingClientAdapter{
Client: o.RBACClient,
NamespaceClient: o.NamespaceClient.Namespaces(),
},
}
result, err := reconcileOptions.Run()//执行reconcile
if err != nil {
return err
}
o.printResults(result.RoleBinding.GetObject(), result.MissingSubjects, result.ExtraSubjects, nil, nil, result.Operation, result.Protected)//打印结果
case *rbacv1.ClusterRoleBinding://如果是clusterrolebinding
reconcileOptions := reconciliation.ReconcileRoleBindingOptions{//创建reconcileOptions
Confirm: !o.DryRun,
RemoveExtraSubjects: o.RemoveExtraSubjects,
RoleBinding: reconciliation.ClusterRoleBindingAdapter{ClusterRoleBinding: t},
Client: reconciliation.ClusterRoleBindingClientAdapter{
Client: o.RBACClient.ClusterRoleBindings(),
},
}
result, err := reconcileOptions.Run()//执行reconcile
if err != nil {
return err
}
o.printResults(result.RoleBinding.GetObject(), result.MissingSubjects, result.ExtraSubjects, nil, nil, result.Operation, result.Protected)//打印结果
case *rbacv1beta1.Role,
*rbacv1beta1.RoleBinding,
*rbacv1beta1.ClusterRole,
*rbacv1beta1.ClusterRoleBinding,
*rbacv1alpha1.Role,
*rbacv1alpha1.RoleBinding,
*rbacv1alpha1.ClusterRole,
*rbacv1alpha1.ClusterRoleBinding:
return fmt.Errorf("only rbac.authorization.k8s.io/v1 is supported: not %T", t)//返回错误
default:
klog.V(1).Infof("skipping %#v", info.Object.GetObjectKind())
// skip ignored resources
}
return nil
})
}//打印结果
func (o *ReconcileOptions) printResults(object runtime.Object,
missingSubjects, extraSubjects []rbacv1.Subject,
missingRules, extraRules []rbacv1.PolicyRule,
operation reconciliation.ReconcileOperation,
protected bool) {
o.PrintObject(object, o.Out)//打印对象
caveat := ""
if protected {//受保护信息
caveat = ", but object opted out (rbac.authorization.kubernetes.io/autoupdate: false)"
}
switch operation {//判断操作类型
case reconciliation.ReconcileNone://如果是nono直接返回
return
case reconciliation.ReconcileCreate://如果是创建
fmt.Fprintf(o.ErrOut, "\treconciliation required create%s\n", caveat)
case reconciliation.ReconcileUpdate://如果是更新
fmt.Fprintf(o.ErrOut, "\treconciliation required update%s\n", caveat)
case reconciliation.ReconcileRecreate://如果是重建
fmt.Fprintf(o.ErrOut, "\treconciliation required recreate%s\n", caveat)
}
if len(missingSubjects) > 0 {//打印丢失的主体
fmt.Fprintf(o.ErrOut, "\tmissing subjects added:\n")
for _, s := range missingSubjects {
fmt.Fprintf(o.ErrOut, "\t\t%+v\n", s)
}
}
if o.RemoveExtraSubjects {
if len(extraSubjects) > 0 {//打印多余的主体
fmt.Fprintf(o.ErrOut, "\textra subjects removed:\n")
for _, s := range extraSubjects {
fmt.Fprintf(o.ErrOut, "\t\t%+v\n", s)
}
}
}
if len(missingRules) > 0 {//打印丢失的权限
fmt.Fprintf(o.ErrOut, "\tmissing rules added:\n")
for _, r := range missingRules {
fmt.Fprintf(o.ErrOut, "\t\t%+v\n", r)
}
}
if o.RemoveExtraPermissions {//打印多余的权限
if len(extraRules) > 0 {
fmt.Fprintf(o.ErrOut, "\textra rules removed:\n")
for _, r := range extraRules {
fmt.Fprintf(o.ErrOut, "\t\t%+v\n", r)
}
}
}
}
扫一扫
1503
被折叠的 条评论
为什么被折叠?
到【灌水乐园】发言
