package sessionrecording

import "tailscale.com/k8s-operator/sessionrecording"

Package sessionrecording contains functionality for recording Kubernetes API server proxy 'kubectl exec' sessions.

Index ¶

• Variables
• type Hijacker
• func New(opts HijackerOpts) *Hijacker
• func (h *Hijacker) Hijack() (net.Conn, *bufio.ReadWriter, error)
• type HijackerOpts
• type Protocol
• type RecorderDialFn

Variables ¶

var (
	// CounterSessionRecordingsAttempted counts the number of session recording attempts.
	CounterSessionRecordingsAttempted = clientmetric.NewCounter("k8s_auth_proxy_session_recordings_attempted")
)

Types ¶

type Hijacker ¶

type Hijacker struct {
	http.ResponseWriter
	// contains filtered or unexported fields
}

Hijacker implements net/http.Hijacker interface. It must be configured with an http request for a 'kubectl exec' session that needs to be recorded. It knows how to hijack the connection and configure for the session contents to be sent to a tsrecorder instance.

func New ¶

func New(opts HijackerOpts) *Hijacker

func (*Hijacker) Hijack ¶

func (h *Hijacker) Hijack() (net.Conn, *bufio.ReadWriter, error)

Hijack hijacks a 'kubectl exec' session and configures for the session contents to be sent to a recorder.

type HijackerOpts ¶

type HijackerOpts struct {
	TS        *tsnet.Server
	Req       *http.Request
	W         http.ResponseWriter
	Who       *apitype.WhoIsResponse
	Addrs     []netip.AddrPort
	Log       *zap.SugaredLogger
	Pod       string
	Namespace string
	FailOpen  bool
	Proto     Protocol
}

type Protocol ¶

type Protocol string

Protocol is the streaming protocol of the hijacked session. Supported protocols are SPDY and WebSocket.

const (
	SPDYProtocol Protocol = "SPDY"
	WSProtocol   Protocol = "WebSocket"
)

type RecorderDialFn ¶

type RecorderDialFn func(context.Context, []netip.AddrPort, netx.DialFunc) (io.WriteCloser, []*tailcfg.SSHRecordingAttempt, <-chan error, error)

RecorderDialFn dials the specified netip.AddrPorts that should be tsrecorder addresses. It tries to connect to recorder endpoints one by one, till one connection succeeds. In case of success, returns a list with a single successful recording attempt and an error channel. If the connection errors after having been established, an error is sent down the channel.

Source Files ¶

hijacker.go

Directories ¶