config

package
v0.1.8 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 13, 2026 License: MIT Imports: 31 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	// ConfigDir is the base directory for AKS Flex Node configuration files
	// installed on the host.
	ConfigDir = "/etc/aks-flex-node"

	// Default configuration values
	DefaultLogDir = "/var/log/aks-flex-node"

	// Machine client modes.
	MachineClientModeARM       = "arm"
	MachineClientModeInCluster = "in-cluster"

	// DefaultResourceManagerEndpointURL is the public Azure Resource Manager
	// endpoint used when azure.resourceManagerEndpoint is omitted.
	DefaultResourceManagerEndpointURL = "https://management.azure.com"

	// DefaultResourceManagerAudience is the public Azure Resource Manager token
	// audience used by Azure SDK for Go's ARM pipeline.
	DefaultResourceManagerAudience = "https://management.azure.com"

	// DefaultResourceManagerTokenScope is the OAuth scope for public Azure
	// Resource Manager tokens.
	DefaultResourceManagerTokenScope = DefaultResourceManagerAudience + "/.default"
)
View Source 
const (
	LocalDNSModeRequired  = localdns.LocalDNSModeRequired
	LocalDNSModePreferred = localdns.LocalDNSModePreferred
	LocalDNSModeDisabled  = localdns.LocalDNSModeDisabled
)
View Source 
const AgentBinaryBaseName = "aks-flex-node"

AgentBinaryBaseName is the installed command and release artifact base name.

Variables

View Source 
var AKSClusterResourceIDPattern = regexp.MustCompile(`(?i)^/subscriptions/([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})/resourcegroups/([a-zA-Z0-9_\-\.]+)/providers/microsoft\.containerservice/managedclusters/([a-zA-Z0-9_\-\.]+)$`)

AKSClusterResourceIDPattern is AKS cluster resource ID regex pattern with capture groups Format: /subscriptions/{subscription-id}/resourceGroups/{resource-group}/providers/Microsoft.ContainerService/managedClusters/{cluster-name} Pattern is case insensitive to handle variations in Azure resource path casing

View Source 
var BootstrapTokenPattern = regexp.MustCompile(`^[a-z0-9]{6}\.[a-z0-9]{16}$`)

BootstrapTokenPattern is the regex pattern for Kubernetes bootstrap tokens Format: <token-id>.<token-secret> where token-id is 6 chars [a-z0-9] and token-secret is 16 chars [a-z0-9]

Functions

func AgentBinaryArchiveMember added in v0.1.7 

func AgentBinaryArchiveMember(goos, goarch string) (string, error)

AgentBinaryArchiveMember returns the binary member name used by a release archive for the requested platform.

func LoadServicePrincipalCredentialFile added in v0.1.6 

func LoadServicePrincipalCredentialFile(path string) ([]byte, error)

LoadServicePrincipalCredentialFile reads a service principal credential file after verifying it is a protected regular file.

func MarshalClientCertificatePEM added in v0.1.6 

func MarshalClientCertificatePEM(certificates []*x509.Certificate, privateKey crypto.PrivateKey) (string, error)

MarshalClientCertificatePEM converts a client certificate chain and private key into PKCS#8 PEM form for consumers that require PEM files.

func RemoveRuntimeDirs added in v0.1.0 

func RemoveRuntimeDirs(logger *slog.Logger) phases.Task

func ResolveMachineGoalState added in v0.1.4 

func ResolveMachineGoalState(ctx context.Context, log *slog.Logger, cfg *Config, machineName string) (*agentconfig.AgentConfig, *goalstates.MachineGoalState, *goalstates.ContainerImageArchiveStaging, error)

ResolveMachineGoalState converts FlexNode config to the shared agent config and resolves the nspawn machine goal state. Bootstrap and preflight both use this helper so preflight validates the same sources that bootstrap consumes.

func ToAgentConfig added in v0.1.0 

func ToAgentConfig(cfg *Config, machineName string) *agentconfig.AgentConfig

ToAgentConfig converts a FlexNode Config to the shared agent library's AgentConfig. The resulting struct can be passed to goalstates.ResolveMachine to produce goal states for the nspawn-based bootstrap phases.

cfg.Node.Kubelet.ClusterFQDN and cfg.Node.Kubelet.CACertData must be populated.

func ValidateServicePrincipalCertificateFile added in v0.1.6 

func ValidateServicePrincipalCertificateFile(path string) error

ValidateServicePrincipalCertificateFile verifies that a certificate credential file is protected, well-formed, and compatible with service principal auth.

Types

type AdditionalHostMount added in v0.1.5 

type AdditionalHostMount = agentconfig.AdditionalHostMount

AdditionalHostMount re-exports the shared agent's host bind-mount config.

type AgentConfig 

type AgentConfig struct {
	LogLevel string `json:"logLevel"` // Logging level: debug, info, warning, error
	LogDir   string `json:"logDir"`   // Directory for log files
	// NodeName is resolved from the host hostname when omitted.
	NodeName string `json:"nodeName,omitempty"`

	// MachineClient selects how the agent reads the AKS machine resource.
	MachineClient MachineClientConfig `json:"machineClient,omitempty"`

	// MachineReconcileInterval controls how often the daemon re-reads the AKS
	// machine resource when no Kubernetes Node event wakes the controller.
	MachineReconcileInterval JSONDuration `json:"machineReconcileInterval,omitempty"`

	// RequireMachineRegistration fails bootstrap if the AKS machine resource
	// cannot be read or created. When false, registration is best-effort.
	RequireMachineRegistration *bool `json:"requireMachineRegistration,omitempty"`

	// MachineOperationMode controls MachineOperation handling. Supported values:
	// "auto" detects Machina CRs, "disable" uses a noop reconciler.
	MachineOperationMode string `json:"machineOperationMode,omitempty"`
}

AgentConfig holds agent-specific operational configuration.

type ArcConfig 

type ArcConfig struct {
	Enabled       bool              `json:"enabled"`       // Whether to enable Azure Arc registration
	MachineName   string            `json:"machineName"`   // Name for the Arc machine resource
	Tags          map[string]string `json:"tags"`          // Tags to apply to the Arc machine
	ResourceGroup string            `json:"resourceGroup"` // Azure resource group for Arc machine
	Location      string            `json:"location"`      // Azure region for Arc machine
}

ArcConfig holds Azure Arc machine configuration for registering the machine with Azure Arc.

type AzureConfig 

type AzureConfig struct {
	SubscriptionID             string                  `json:"subscriptionId"`                    // Azure subscription ID; defaults from targetCluster.resourceId when omitted
	TenantID                   string                  `json:"tenantId"`                          // Azure tenant ID
	Cloud                      string                  `json:"cloud,omitempty"`                   // Optional Azure cloud label used when resourceManagerEndpoint is omitted
	ResourceManagerEndpointURL string                  `json:"resourceManagerEndpoint,omitempty"` // Azure Resource Manager endpoint; defaults to https://management.azure.com
	ServicePrincipal           *ServicePrincipalConfig `json:"servicePrincipal,omitempty"`        // Optional service principal authentication
	ManagedIdentity            *ManagedIdentityConfig  `json:"managedIdentity,omitempty"`         // Optional managed identity authentication
	BootstrapToken             *BootstrapTokenConfig   `json:"bootstrapToken,omitempty"`          // Optional bootstrap token authentication
	Arc                        *ArcConfig              `json:"arc"`                               // Azure Arc machine configuration
	TargetCluster              *TargetClusterConfig    `json:"targetCluster"`                     // Target AKS cluster configuration
	TargetAgentPoolName        string                  `json:"targetAgentPoolName"`               // Target AKS agent pool for FlexNode machines
}

AzureConfig holds Azure-specific configuration required for connecting to Azure services.

type BootstrapConfig added in v0.1.4 

type BootstrapConfig struct {
	// OCIImage is the nspawn rootfs OCI image used by the shared agent library.
	// When empty, the agent uses its built-in default image selection.
	OCIImage string `json:"ociImage,omitempty"`

	// OfflineArtifacts points at a complete offline binary artifact source.
	// When source is set, bootstrap resolves Kubernetes, containerd, runc, CNI,
	// crictl, and optional sandbox image archive artifacts from this source.
	OfflineArtifacts OfflineArtifactsConfig `json:"offlineArtifacts,omitempty"`

	// AdditionalHostDevices lists extra host device nodes under /dev to expose to
	// the nspawn machine in addition to devices discovered by the shared agent.
	AdditionalHostDevices []string `json:"additionalHostDevices,omitempty"`

	// AdditionalHostMounts lists non-device host paths to bind mount into the
	// nspawn machine. Read-only mounts should be preferred unless write access is
	// required.
	AdditionalHostMounts []AdditionalHostMount `json:"additionalHostMounts,omitempty"`
}

BootstrapConfig holds bootstrap settings that are not Kubernetes component versions.

type BootstrapTokenConfig 

type BootstrapTokenConfig struct {
	Token string `json:"token"` // Bootstrap token in format: <token-id>.<token-secret>
}

BootstrapTokenConfig holds Kubernetes bootstrap token authentication configuration. Bootstrap tokens provide a lightweight authentication method for node joining.

type ComponentsConfig added in v0.1.2 

type ComponentsConfig struct {
	Kubernetes   string        `json:"kubernetes,omitempty"`
	Containerd   string        `json:"containerd,omitempty"`
	Runc         string        `json:"runc,omitempty"`
	SandboxImage string        `json:"sandboxImage,omitempty"`
	Gantry       *GantryConfig `json:"gantry,omitempty"`
}

ComponentsConfig is the AKS RP component version contract used by the agent at runtime.

type Config 

type Config struct {
	Azure       AzureConfig       `json:"azure"`
	Agent       AgentConfig       `json:"agent"`
	Components  ComponentsConfig  `json:"components"`
	Bootstrap   BootstrapConfig   `json:"bootstrap"`
	Networking  NetworkingConfig  `json:"networking"`
	Node        NodeConfig        `json:"node"`
	Npd         NPDConfig         `json:"npd"`
	HostRouting HostRoutingConfig `json:"hostRouting"`
}

Config represents the complete agent configuration structure. It contains Azure-specific settings and agent operational settings.

func LoadConfig 

func LoadConfig(configPath string) (*Config, error)

LoadConfig loads configuration from a JSON file. The configPath parameter is required and cannot be empty.

func (*Config) APIServerURL added in v0.1.2 

func (c *Config) APIServerURL() string

APIServerURL returns the kube-apiserver URL derived from the RP cluster FQDN.

func (*Config) DeepCopy added in v0.0.17 

func (cfg *Config) DeepCopy() *Config

DeepCopy returns a copy of the config that does not share mutable sub-objects (maps/pointers) with the original.

func (*Config) IsARCEnabled 

func (cfg *Config) IsARCEnabled() bool

IsARCEnabled checks if Azure Arc registration is enabled in the configuration.

func (*Config) IsBootstrapTokenConfigured 

func (cfg *Config) IsBootstrapTokenConfigured() bool

IsBootstrapTokenConfigured checks if bootstrap token authentication is selected.

func (*Config) IsMIConfigured 

func (cfg *Config) IsMIConfigured() bool

IsMIConfigured checks if managed identity configuration is provided in the configuration.

func (*Config) IsSPConfigured 

func (cfg *Config) IsSPConfigured() bool

IsSPConfigured checks if service principal authentication is selected.

func (*Config) NeedsBootstrapDataRefresh added in v0.1.8 

func (cfg *Config) NeedsBootstrapDataRefresh() bool

NeedsBootstrapDataRefresh reports whether repave can replace the short-lived bootstrap token by authenticating to AKS RP with a durable Azure credential.

type GantryConfig added in v0.1.5 

type GantryConfig struct {
	// Disabled opts out of the Gantry containerd registry routing that the
	// shared agent enables by default.
	Disabled bool `json:"disabled,omitempty"`
}

GantryConfig holds optional Gantry integration settings.

type HostRoutingConfig added in v0.1.0 

type HostRoutingConfig struct {
	// StaticRoutes installs explicit IPv4 routes to prevent provider-installed
	// connected routes (e.g. Azure IB /16 on ND-isr SKUs) from shadowing
	// cluster CIDRs.
	StaticRoutes StaticRoutesConfig `json:"staticRoutes"`

	// RouteOverlap checks that the expected CIDRs all route via the default
	// outbound interface. Use this to catch unmitigated routing overlaps at
	// boot time instead of hours after a node silently misbehaves.
	RouteOverlap RouteOverlapConfig `json:"routeOverlap"`
}

HostRoutingConfig groups host-level routing tasks that run before the nspawn machine starts.

type ImageCredentialProviderConfig added in v0.1.7 

type ImageCredentialProviderConfig struct {
	ConfigPath string `json:"configPath"`
	BinDir     string `json:"binDir"`
}

ImageCredentialProviderConfig identifies the exec image credential provider configuration and binary directory inside the nspawn machine.

type JSONDuration added in v0.1.0 

type JSONDuration time.Duration

JSONDuration accepts Go duration strings in config JSON while preserving compatibility with time.Duration's numeric nanosecond representation.

func (JSONDuration) MarshalJSON added in v0.1.0 

func (d JSONDuration) MarshalJSON() ([]byte, error)

func (*JSONDuration) UnmarshalJSON added in v0.1.0 

func (d *JSONDuration) UnmarshalJSON(data []byte) error

type KubeletConfig 

type KubeletConfig struct {
	Verbosity            int               `json:"verbosity"`
	ImageGCHighThreshold int               `json:"imageGCHighThreshold"`
	ImageGCLowThreshold  int               `json:"imageGCLowThreshold"`
	ClusterFQDN          string            `json:"clusterFQDN,omitempty"`    // Kubernetes API server FQDN from AKS RP bootstrap data
	CACertData           string            `json:"caCertData"`               // Base64-encoded CA certificate data
	NodeIP               string            `json:"nodeIP"`                   // IP address to advertise as the node's primary IP (--node-ip kubelet flag)
	SystemReserved       map[string]string `json:"systemReserved,omitempty"` // Resources reserved for OS system daemons; defaults to zero
	KubeReserved         map[string]string `json:"kubeReserved,omitempty"`   // Resources reserved for Kubernetes daemons; defaults follow AKS guidance

	// ImageCredentialProvider configures kubelet's exec image credential
	// provider. The referenced paths are inside the nspawn machine.
	ImageCredentialProvider *ImageCredentialProviderConfig `json:"imageCredentialProvider,omitempty"`
}

KubeletConfig holds kubelet-specific configuration settings.

type LocalDNSOverride added in v0.1.7 

type LocalDNSOverride = localdns.LocalDNSOverride

LocalDNSOverride configures one AKS LocalDNS server block.

type LocalDNSProfile added in v0.1.7 

type LocalDNSProfile = localdns.LocalDNSProfile

LocalDNSProfile is the AKS node-pool LocalDNS configuration contract.

type MachineClientConfig added in v0.1.4 

type MachineClientConfig struct {
	// Mode selects the machine backend: "arm" or "in-cluster".
	Mode string `json:"mode,omitempty"`

	// EndpointURL optionally points at the selected backend. In arm mode it is a
	// dev-test ARM proxy URL. In in-cluster mode it is an absolute Kubernetes API
	// service-proxy path for the read-only machine endpoint.
	EndpointURL string `json:"endpointUrl,omitempty"`
}

MachineClientConfig configures the machine resource backend.

type ManagedIdentityConfig 

type ManagedIdentityConfig struct {
	ClientID string `json:"clientId,omitempty"` // Client ID of the managed identity (optional, for VMs with multiple identities)
}

ManagedIdentityConfig holds managed identity authentication configuration. It can only be used when the agent is running on an Azure VM with a managed identity assigned.

type NPDConfig 

type NPDConfig struct {
	Version string `json:"version"`
}

NPDConfig holds configuration settings for the Node Problem Detector (NPD).

type NetworkingConfig added in v0.1.2 

type NetworkingConfig struct {
	DNSServiceIP string           `json:"dnsServiceIP,omitempty"` // Cluster DNS service IP (default: 10.0.0.10 for AKS)
	CNIVersion   string           `json:"cniVersion,omitempty"`
	LocalDNS     *LocalDNSProfile `json:"localDNS,omitempty"`
}

NetworkingConfig is the AKS RP networking contract used by the agent at runtime.

type NodeConfig 

type NodeConfig struct {
	MaxPods int               `json:"maxPods"`
	Labels  map[string]string `json:"labels"`
	// Taints to apply at node registration time via --register-with-taints.
	// Each entry must use the kubelet taint format: "key=value:Effect" or "key:Effect"
	// (e.g. "dedicated=infra:NoSchedule", "gpu:NoExecute").
	Taints  []string      `json:"taints,omitempty"`
	Kubelet KubeletConfig `json:"kubelet"`
}

NodeConfig holds configuration settings for the Kubernetes node.

type OfflineArtifactsConfig added in v0.1.4 

type OfflineArtifactsConfig struct {
	// Source is a Go template string that resolves to an absolute filesystem
	// path, file:// URL, or oci:// artifact reference. The template may use
	// .KubernetesVersion and .KubernetesVersionNoV.
	Source string `json:"source,omitempty"`
}

OfflineArtifactsConfig mirrors Unbounded's OfflineArtifacts bootstrap setting in the AKS Flex public config shape.

type RouteOverlapConfig added in v0.1.0 

type RouteOverlapConfig struct {
	// ExpectedCIDRs is the list of IPv4 CIDRs that must route via the default
	// outbound interface. Typically pod CIDR + service CIDR + API server prefix.
	ExpectedCIDRs []string `json:"expectedCidrs,omitempty"`

	// Mode controls behaviour on overlap detection.
	// "WARN" (default): log the overlap and let kubelet start.
	// "STRICT": log the overlap and prevent kubelet from starting.
	Mode string `json:"mode,omitempty"`
}

RouteOverlapConfig holds the spec for the check-route-overlap systemd oneshot.

type ServicePrincipalConfig 

type ServicePrincipalConfig struct {
	TenantID         string `json:"tenantId"`                   // Azure AD tenant ID
	ClientID         string `json:"clientId"`                   // Azure AD application (client) ID
	ClientSecret     string `json:"clientSecret,omitempty"`     // Azure AD application client secret
	ClientSecretFile string `json:"clientSecretFile,omitempty"` // File containing an Azure AD application client secret or certificate
	// contains filtered or unexported fields
}

ServicePrincipalConfig holds Azure service principal authentication configuration. When provided, service principal authentication will be used instead of Azure CLI.

func (*ServicePrincipalConfig) LoadClientCertificate added in v0.1.6 

func (c *ServicePrincipalConfig) LoadClientCertificate() ([]*x509.Certificate, crypto.PrivateKey, error)

LoadClientCertificate loads the service principal certificate and private key from ClientSecretFile.

type StaticRoute added in v0.1.0 

type StaticRoute struct {
	// Destination is an IPv4 CIDR, e.g. "172.16.1.0/24". Required.
	Destination string `json:"destination"`

	// Gateway is the next-hop IPv4 address. When empty the script resolves the
	// default gateway on Dev at boot time (with a bounded retry for DHCP races).
	Gateway string `json:"gateway,omitempty"`

	// Dev is the outbound interface (e.g. "eth0"). When empty the script
	// resolves the IPv4 default route's outbound interface at boot time.
	Dev string `json:"dev,omitempty"`

	// Metric sets the route metric for tie-breaking. 0 means use kernel default.
	Metric uint32 `json:"metric,omitempty"`
}

StaticRoute describes a single IPv4 route to install via `ip -4 route replace`.

type StaticRoutesConfig added in v0.1.0 

type StaticRoutesConfig struct {
	// Enabled must be set to true when routes are provided. This explicit
	// opt-in prevents accidental route injection.
	Enabled bool `json:"enabled"`

	// Routes is the list of IPv4 static routes to install before kubelet starts.
	Routes []StaticRoute `json:"routes,omitempty"`
}

StaticRoutesConfig holds the spec for the static-routes systemd oneshot.

type TargetClusterConfig 

type TargetClusterConfig struct {
	ResourceID     string `json:"resourceId"` // Full resource ID of the target AKS cluster
	Location       string `json:"location"`   // Azure region of the cluster (e.g., "eastus", "westus2")
	Name           string // will be populated from ResourceID
	ResourceGroup  string // will be populated from ResourceID
	SubscriptionID string // will be populated from ResourceID
}

TargetClusterConfig holds configuration for the target AKS cluster the ARC machine will connect to.

Source Files

View all Source files

Directories

Path Synopsis
internal
localdns

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.