Andrei Kvapil
2eb5374e90
Review found the observation could be silenced and the feature could not be turned on. Both are fixed here; enforcement itself stays out of scope for this step. Rate-limit the observation instead of remembering issuers. Keying on the issuer was the mistake: with RequestClientCert that string comes from the caller, so a bounded set of first-seen values can be filled with 32 fabricated issuers before the API server's first call, permanently suppressing the signal the feature exists to produce, while an unbounded one grows without limit. A rate limit cannot be starved -- a burst costs the current interval and the next real handshake is logged in the one after. The two outcomes are limited separately so a flood of one cannot hide the other, and both lines now carry the peer address, since 'none presented' fires for any certless caller and was not attributable. Say 'verified' rather than 'UNVERIFIED' once enforcement is on, where the handshake really has checked the chain. Stop telling operators to point --client-ca-file at an in-pod path. No such path exists: the pod mounts only its own serving secret, whose ca.crt is this webhook's serving CA, so every value either aborts startup or rejects the API server -- and with failurePolicy: Fail that stops pod creation cluster-wide. Say what is actually true and defer enabling to the step that adds the volume. Correct the claim in cert.go that this webhook configures no ClientCAs. It can now, that pool is read once at startup and never reloaded, and the comment justified skipping reload on the old premise. Record that reloading has to land together with the mount, since neither is usable alone. Cover the observation with tests: rate limiting, the burst it exists to survive, concurrency, both branches, the enforcing wording, and that admission is never blocked by logging. Signed-off-by: Andrei Kvapil <andrei.kvapil@aenix.io>
Cozystack
Cozystack is a free platform and framework for building clouds.
Cozystack is a CNCF Sandbox Level Project that was originally built and sponsored by Ænix.
With Cozystack, you can transform a bunch of servers into an intelligent system with a simple REST API for spawning Kubernetes clusters, Database-as-a-Service, virtual machines, load balancers, HTTP caching services, and other services with ease.
Use Cozystack to build your own cloud or provide a cost-effective development environment.
Use-Cases
-
Using Cozystack to build a public cloud
You can use Cozystack as a backend for a public cloud -
Using Cozystack to build a private cloud
You can use Cozystack as a platform to build a private cloud powered by Infrastructure-as-Code approach -
Using Cozystack as a Kubernetes distribution
You can use Cozystack as a Kubernetes distribution for Bare Metal
Documentation
The documentation is located on the cozystack.io website.
Read the Getting Started section for a quick start.
If you encounter any difficulties, start with the troubleshooting guide and work your way through the process that we've outlined.
Versioning
Versioning adheres to the Semantic Versioning principles.
A full list of the available releases is available in the GitHub repository's Release section.
Contributions
Contributions are highly appreciated and very welcomed!
In case of bugs, please check if the issue has already been opened by checking the GitHub Issues section. If it isn't, you can open a new one. A detailed report will help us replicate it, assess it, and work on a fix.
You can express your intention to on the fix on your own. Commits are used to generate the changelog, and their author will be referenced in it.
If you have a concrete feature request, open an issue. For a cross-cutting or architectural change, open a design proposal in the community repo. For questions or early ideas, use GitHub Discussions. See CONTRIBUTING.md for the full routing.
Community
You are welcome to join our Telegram group and come to our weekly community meetings. Add them to your Google Calendar or iCal for convenience.
License
Cozystack is licensed under Apache 2.0.
The code is provided as-is with no warranties.
Commercial Support
A list of companies providing commercial support for this project can be found on official site.