Documentation
¶
Overview ¶
Package home is the Kubernetes home: fiberd is PID 1 of a grant Pod. It is the integration point with fiberd: everything fiberd needs from an environment is the home.Home interface (pkg/home) plus the optional interfaces pkg/fiberd looks for, and this package implements them against the Kubernetes API. Grants arrive as *.jwt files the issuer controller projects into the Pod; control-plane liveness is the API server answering for the Pod; readiness is a Pod readiness gate fiberd sets once a template is warm; the cgroup subtree is the Pod's own, with the kubelet's ceiling on it; endpoints are the Pod's IP; the device channel is the Pod's DRA claim. Scope is what the Pod is: namespace, service account, node, claim. The home loses it when the namespace or the claim goes away under a live Pod, or the service-account issuer rotates, and then bumps the epoch through the hook it was given.
Index ¶
- Constants
- type Config
- type Home
- func (h *Home) CgroupRoot() string
- func (h *Home) Devices(context.Context, core.Grant) (core.DeviceChannel, func(), error)
- func (h *Home) EndpointHost() string
- func (h *Home) Grants(ctx context.Context) (<-chan home.GrantEvent, error)
- func (h *Home) Health() *core.SourceHealth
- func (h *Home) Name() string
- func (h *Home) OnScopeLost(fn func(ctx context.Context, reason string))
- func (h *Home) PublishReady(ctx context.Context, grantUID string, ready bool) error
- func (h *Home) Run(ctx context.Context)
- func (h *Home) Scope() []core.ScopeClaim
- func (h *Home) SetIssuerReachable(reachable bool)
Constants ¶
const ReadyCondition = "fiberd.io/zygote-ready"
ReadyCondition is the readiness gate the issuer puts on grant Pods and fiberd sets once any grant's template is warm.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// Client is the cluster; nil means the in-cluster configuration.
Client *kube.Client
// Namespace and PodName identify this Pod; defaults: the projected
// namespace file and the hostname.
Namespace, PodName string
// GrantsDir is the projected volume polled for *.jwt files.
GrantsDir string
Poll time.Duration
// StaleTTL: the API server not answering for this long is unhealthy.
StaleTTL time.Duration
// CgroupRoot is the Pod's cgroup as seen from inside (default
// /sys/fs/cgroup); the runtime gets a `fiberd` subtree under it.
CgroupRoot string
// Devices is what the DRA driver exposed to this Pod (device paths
// or ids), handed to every grant's engine as its device channel.
Devices []string
// Family picks which Pod IP callers dial (inet4 or inet6; unix means
// fibers are reachable from this Pod only).
Family endpoint.Family
// TokenFile is the projected service-account token, watched for an
// issuer change (default: the in-cluster path).
TokenFile string
}
type Home ¶
type Home struct {
// contains filtered or unexported fields
}
func (*Home) CgroupRoot ¶
func (*Home) Devices ¶
Devices: the Pod's DRA claim, with the devices the driver exposed; a static set when the Pod has devices but no claim; nothing otherwise. The claim is the Pod's, so there is nothing to release per grant.
func (*Home) EndpointHost ¶
EndpointHost is the Pod IP of the configured family, "" when the Pod has none of that family.
func (*Home) Health ¶
func (h *Home) Health() *core.SourceHealth
func (*Home) OnScopeLost ¶
OnScopeLost sets what to call (once per reason) when the Pod's scope goes away under it: cmd/fiberd wires Core.BumpEpoch.
func (*Home) PublishReady ¶
PublishReady sets the Pod's readiness gate: True while any admitted grant has a warm template, False once none has.
func (*Home) Run ¶
Run polls the API server: the Pod answering is liveness; the namespace terminating, a bound claim gone, or the token's issuer changing is scope loss.
func (*Home) SetIssuerReachable ¶
SetIssuerReachable is the test-only override behind fiberd's admin socket.
Source Files