{"id":13846242,"url":"https://github.com/yahoo/k8s-ingress-claim","last_synced_at":"2025-05-05T06:32:15.792Z","repository":{"id":57508217,"uuid":"113917428","full_name":"yahoo/k8s-ingress-claim","owner":"yahoo","description":"An admission control policy that safeguards against accidental duplicate claiming of Hosts/Domains.","archived":false,"fork":false,"pushed_at":"2018-07-09T06:21:37.000Z","size":20,"stargazers_count":14,"open_issues_count":1,"forks_count":5,"subscribers_count":19,"default_branch":"master","last_synced_at":"2025-04-08T18:51:37.300Z","etag":null,"topics":["admission-controllers","big-data","golang","ingress","kubernetes"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/yahoo.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-12-11T22:55:48.000Z","updated_at":"2024-03-13T00:21:23.000Z","dependencies_parsed_at":"2022-08-29T22:41:37.409Z","dependency_job_id":null,"html_url":"https://github.com/yahoo/k8s-ingress-claim","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yahoo%2Fk8s-ingress-claim","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yahoo%2Fk8s-ingress-claim/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yahoo%2Fk8s-ingress-claim/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/yahoo%2Fk8s-ingress-claim/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/yahoo","download_url":"https://codeload.github.com/yahoo/k8s-ingress-claim/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":252451790,"owners_count":21749984,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["admission-controllers","big-data","golang","ingress","kubernetes"],"created_at":"2024-08-04T18:00:20.801Z","updated_at":"2025-05-05T06:32:15.474Z","avatar_url":"https://github.com/yahoo.png","language":"Go","funding_links":[],"categories":["Operators vs Controllers"],"sub_categories":["Admission"],"readme":"# k8s-ingress-claim\n\n## Description\nk8s-ingress-claim provides an admission control policy that safeguards against accidental duplicate claiming of \nHosts/Domains by ingresses that have already been claimed by existing ingresses.\n\n## Implementation\nThis is implemented as an [External Admission Webhook](https://kubernetes.io/docs/admin/extensible-admission-controllers/#external-admission-webhooks) \nwith the k8s-ingress-claim service running as a deployment on each cluster.  \n\nThe webhook is configured to send admission review requests for *CREATE* and *UPDATE* operations on `ingress` resources\nto the k8s-ingress-claim service. The k8s-ingress-claim service listens on a HTTPS port and on receiving such requests, \nit resolves the ingress claim provider for the new ingress resource and the provider implementation validates that no \nother existing ingresses own the hosts/domains being claimed. Every ingress claim provider may implement the validation \nto make sure the domain claims conform to its routing policies. \n   \nThis repository includes the domain claim validation check implementations for two ingress claim providers:\n- Apache Traffic Server\n- Istio\n\nThe example implementations on this repository assume that the ingresses claim domains on a FCFS basis.\n\nThe admission webhook service also provides a `ValidateSemantics` interface for the ingress claim provider to perform\nprovider specific semantic validation checks to ensure the ingress resources spec conform to policy specifications.\n\n## Basic Dev Setup\n1. Git clone to your local directory.\n2. Build binary:\n    - Mac os: `go build -i -o k8s-ingress-claim`\n    - Rhel: `env GOOS=linux GOARCH=386 go build -i -o k8s-ingress-claim`\n3. Run binary: `./k8s-ingress-claim`.\n4. Follow standard Go code format: `gofmt -w *.go`\n\n## Command Line Parameters\n```\nUsage of k8s-ingress-claim:\n  -admitAll\n    \tTrue to admit all ingress without validation.\n  -alsologtostderr\n    \tlog to standard error as well as files\n  -certFile string\n    \tThe cert file for the https server. (default \"/etc/ssl/certs/ingress-claim/server.crt\")\n  -clientAuth\n    \tTrue to verify client cert/auth during TLS handshake.\n  -clientCAFile string\n    \tThe cluster root CA that signs the apiserver cert (default \"/var/run/secrets/kubernetes.io/serviceaccount/ca.crt\")\n  -keyFile string\n    \tThe key file for the https server. (default \"/etc/ssl/certs/ingress-claim/server-key.pem\")\n  -logFile string\n    \tLog file name and full path. (default \"/var/log/ingress-claim.log\")\n  -logLevel string\n    \tThe log level. (default \"info\")\n  -port string\n    \tHTTPS server port. (default \"443\")\n```\n\nCopyright 2017 Yahoo Holdings Inc. Licensed under the terms of the 3-Clause BSD License.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyahoo%2Fk8s-ingress-claim","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fyahoo%2Fk8s-ingress-claim","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fyahoo%2Fk8s-ingress-claim/lists"}