Add support for systemd socket activation (#704)

* feat: add support for systemd socket activation

If webhook has been launched via systemd socket activation, simply use the systemd-provided socket rather than opening our own.

* docs: documentation for the systemd socket activation mode

* refactor: moved setuid and setgid flags into platform-specific section

The setuid and setgid flags do not work on Windows, so moved them to platform_unix so they are only added to the flag set on compatible platforms.

Also disallow the use of setuid and setgid in combination with -socket, since a setuid webhook process would not be able to clean up a socket that was created while running as root.  If you _need_ to have the socket owned by root but the webhook process running as a normal user, you can achieve the same effect with systemd socket activation.
This commit is contained in:
Ian Roberts 2024-10-25 22:18:04 +01:00 committed by GitHub
parent 9cd78fca1a
commit 98cf5d0163
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
13 changed files with 529 additions and 5 deletions

3
vendor/modules.txt vendored
View file

@ -8,6 +8,9 @@ github.com/Microsoft/go-winio/pkg/guid
# github.com/clbanning/mxj/v2 v2.7.0
## explicit; go 1.15
github.com/clbanning/mxj/v2
# github.com/coreos/go-systemd/v22 v22.5.0
## explicit; go 1.12
github.com/coreos/go-systemd/v22/activation
# github.com/dustin/go-humanize v1.0.1
## explicit; go 1.16
github.com/dustin/go-humanize