provision

package
v0.25.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 12, 2026 License: Apache-2.0 Imports: 15 Imported by: 0

Documentation

Index

Constants

View Source 
const AllocationBootstrapDir = "/var/lib/unbounded/bootstrap"

AllocationBootstrapDir is the directory the bootstrap files of an allocated host are written to.

View Source 
const FirstBootBootstrapUnit = "unbounded-agent-bootstrap.service"

FirstBootBootstrapUnit is the unit an Ignition config installs to bootstrap the agent on every boot. kubectl-unbounded writes it and reset removes it.

Variables

This section is empty.

Functions

func AgentArtifactInstallEnv added in v0.24.0 

func AgentArtifactInstallEnv(artifact *v1alpha3.AgentArtifact) []string

AgentArtifactInstallEnv returns the KEY=VALUE pairs that make the unbounded-agent install script download the digest-pinned agent tarball and verify its SHA-256 before extracting it. Values are POSIX-single-quoted.

func AgentInstallEnv added in v0.1.3 

func AgentInstallEnv(agent *v1alpha3.AgentSpec) []string

AgentInstallEnv returns the KEY=VALUE pairs that should be exported before the unbounded-agent install script runs, based on optional download overrides. Values are POSIX-single-quoted so they can be safely prepended to a shell command. Empty overrides are omitted.

func AllocationCloudInit added in v0.24.0 

func AllocationCloudInit(agentConfig UnboundedAgentConfig, installEnv []string, bootstrapFiles map[string]string) (string, error)

AllocationCloudInit renders first-boot cloud-init user data for a host launched for a MachineAllocation. Each bootstrap file is written, sorted by name, to AllocationBootstrapDir with mode 0700, and the "run" file runs before the agent installer, which starts only when it succeeds. The agent config and the installer are removed when the command exits. Without bootstrap files only the installer runs. A bootstrap file name that is not a plain file name, or bootstrap files without "run", is an error. The output is the same for the same inputs.

func AllocationUID added in v0.24.0 

func AllocationUID(cfg *AgentConfig) (uid string, backed bool)

AllocationUID reports whether cfg belongs to a host launched for a MachineAllocation, and that allocation's UID. A host is allocation-backed when its kubelet providerID carries v1alpha3.AllocationProviderIDPrefix. A backed config with an empty uid is a malformed identity. A nil cfg is not backed.

func CheckIsolationEnabled added in v0.24.0 

func CheckIsolationEnabled(mode v1alpha3.IsolationMode, containerEnabled bool, component, enable string) error

CheckIsolationEnabled returns an error when mode is experimental and the provisioner does not enable it. Every provisioner that writes an agent configuration (machina, metalman, machine-ops-controller) refuses to provision such a Machine, since the agent would refuse the mode without the Experimental.ContainerIsolation opt-in those provisioners write.

component names the provisioner ("machina") and enable says how its operator turns the mode on ("set experimentalContainerIsolation: true in the machina configuration"); both only shape the message.

func LocalDNSFromSpec added in v0.2.3 

func LocalDNSFromSpec(spec *v1alpha3.LocalDNSSpec) *config.AgentLocalDNSConfig

LocalDNSFromSpec converts the Machine API LocalDNS settings to agent config.

func ReplaceCloudInit added in v0.1.4 

func ReplaceCloudInit(agentConfig UnboundedAgentConfig, installEnv []string) (string, error)

ReplaceCloudInit renders cloud-init user data that reinstalls the unbounded-agent after a host VM replacement.

func ResolveDownloadOverrides added in v0.1.3 

func ResolveDownloadOverrides(d *AgentDownloads) *goalstates.DownloadOverrides

ResolveDownloadOverrides converts the provision AgentDownloads into the goalstates.DownloadOverrides shape that rootfs phase tasks consume.

func ResolveDownloadOverridesWithOfflineArtifacts added in v0.1.21 

func ResolveDownloadOverridesWithOfflineArtifacts(ctx context.Context, cfg *UnboundedAgentConfig) (*goalstates.DownloadOverrides, *goalstates.ContainerImageArchiveStaging, error)

ResolveDownloadOverridesWithOfflineArtifacts resolves the rootfs download overrides and container image archive staging for cfg. AgentConfig.OfflineArtifacts takes precedence over cfg.Downloads when configured; otherwise cfg.Downloads is converted into the goalstates.DownloadOverrides shape that rootfs phase tasks consume.

func ResolveMachineName added in v0.1.14 

func ResolveMachineName(cfg *AgentConfig) (string, error)

ResolveMachineName resolves and stores the MachineName on cfg once. It returns the source of the resolved value ("config", "env", or "hostname") so callers can log the resolution; the source is "config" when an explicit value was already present. Resolution order:

  1. An explicit, valid MachineName already in the config is kept as-is.
  2. The AGENT_MACHINE_NAME environment variable.
  3. The host hostname.

Values resolved from the environment or the hostname are normalized (trimmed and lowercased) before validation. This lives in internal/provision (the unbounded-specific config layer) rather than the shared pkg/agent library so the resolution behavior is not imposed on external consumers of that library.

Callers must invoke ResolveMachineName before AgentConfig.BackfillNodeName because the latter falls back to MachineName.

func ShellSingleQuote added in v0.1.3 

func ShellSingleQuote(v string) string

ShellSingleQuote wraps v in POSIX-safe single quotes, escaping any embedded single quotes. The result can be used verbatim on the right-hand side of an `export KEY=...` statement in bash.

func UnboundedAgentInstallScript 

func UnboundedAgentInstallScript() string

UnboundedAgentInstallScript returns the install script for using the unbounded-agent to bootstrap a node.

Types

type AgentAttestConfig 

type AgentAttestConfig struct {
	// URL is the base URL of the metalman serve-pxe instance (e.g.
	// "http://10.0.0.1:8880"). The agent appends "/attest" to this URL
	// when performing TPM attestation.
	URL string `json:"URL"`
}

AgentAttestConfig holds configuration for TPM-based attestation against a metalman serve-pxe instance.

type AgentClusterConfig 

type AgentClusterConfig = config.AgentClusterConfig

type AgentConfig 

type AgentConfig = config.AgentConfig

type AgentDownloadSource added in v0.1.3 

type AgentDownloadSource struct {
	BaseURL string `json:"BaseURL,omitempty"`
	URL     string `json:"URL,omitempty"`
	Version string `json:"Version,omitempty"`
}

AgentDownloadSource configures an override for a single binary download source. BaseURL replaces the upstream host + path prefix; URL replaces the entire URL template. Version overrides the version that would otherwise be derived from the cluster Kubernetes version or the agent's compiled-in defaults.

type AgentDownloads added in v0.1.3 

type AgentDownloads struct {
	Kubernetes *AgentDownloadSource `json:"Kubernetes,omitempty"`
	Containerd *AgentDownloadSource `json:"Containerd,omitempty"`
	Runc       *AgentDownloadSource `json:"Runc,omitempty"`
	CNI        *AgentDownloadSource `json:"CNI,omitempty"`
	Crictl     *AgentDownloadSource `json:"Crictl,omitempty"`
	CoreDNS    *AgentDownloadSource `json:"CoreDNS,omitempty"`
}

AgentDownloads optionally overrides the download sources for the binaries the agent installs into the nspawn rootfs. Each entry is optional; unset entries fall back to the upstream defaults compiled into the agent.

func AgentDownloadsFromSpec added in v0.24.0 

func AgentDownloadsFromSpec(spec *v1alpha3.AgentDownloadsSpec) *AgentDownloads

AgentDownloadsFromSpec converts the Machine API AgentDownloadsSpec into the agent-facing AgentDownloads config. Returns nil if every entry is unset, so the resulting JSON config remains minimal.

type AgentKubeletConfig 

type AgentKubeletConfig = config.AgentKubeletConfig

type AgentOfflineArtifacts added in v0.1.21 

type AgentOfflineArtifacts = config.AgentOfflineArtifacts

type BuildAgentConfigParams 

type BuildAgentConfigParams struct {
	// Machine is the Machine object to build the config for.
	Machine *v1alpha3.Machine

	// Cluster holds the cluster-level connection parameters.
	Cluster ClusterEndpoint

	// ProviderLabels are cloud-provider-injected labels that override
	// all other labels. These are typically resolved from
	// cloudprovider.Provider.DefaultLabels().
	ProviderLabels map[string]string

	// BootstrapToken is the kubelet bootstrap token (e.g. "abc123.xyz789").
	// When empty, the agent is expected to obtain a token via attestation.
	BootstrapToken string

	// AttestURL is the base URL of a metalman serve-pxe instance for
	// TPM-based attestation (e.g. "http://10.0.0.1:8880"). When non-empty
	// an Attest section is included in the config.
	AttestURL string

	// NodeName overrides the Kubernetes Node name used by kubelet. When empty,
	// the agent resolves the node name from the host hostname.
	NodeName string

	// ExperimentalContainerIsolation opts the agent in to the experimental
	// container isolation mode (Experimental.ContainerIsolation). It is set
	// for every Machine the caller provisions, not only for one that declares
	// container, so a node can later be changed to that mode at a repave.
	ExperimentalContainerIsolation bool
}

BuildAgentConfigParams holds the inputs for BuildAgentConfig. Cluster-level values are resolved once at controller startup and reused across reconcile loops. Machine-level values come from the Machine object.

type CNIConfig added in v0.1.1 

type CNIConfig = config.CNIConfig

type CRIConfig added in v0.1.1 

type CRIConfig = config.CRIConfig

type ClusterEndpoint 

type ClusterEndpoint struct {
	// APIServer is the Kubernetes API server endpoint (e.g.
	// "my-cluster-dns.hcp.eastus.azmk8s.io:443").
	APIServer string

	// CACertBase64 is the base64-encoded cluster CA certificate.
	CACertBase64 string

	// ClusterDNS is the ClusterIP of the kube-dns Service.
	ClusterDNS string

	// KubeVersion is the cluster's Kubernetes version (e.g. "v1.34.0"),
	// used as a fallback when the Machine's Spec.Kubernetes.Version is
	// empty.
	KubeVersion string
}

ClusterEndpoint holds the cluster-level connection parameters needed to build agent configuration. These values are typically resolved once at controller startup and reused across reconcile loops.

type ContainerdConfig added in v0.1.1 

type ContainerdConfig = config.ContainerdConfig

type ExperimentalConfig added in v0.24.0 

type ExperimentalConfig = config.ExperimentalConfig

type GantryConfig added in v0.1.23 

type GantryConfig = config.GantryConfig

type ImageCredentialProvider added in v0.2.3 

type ImageCredentialProvider = config.ImageCredentialProvider

type KubeletAuthInfo added in v0.1.1 

type KubeletAuthInfo = config.KubeletAuthInfo

type RuncConfig added in v0.1.1 

type RuncConfig = config.RuncConfig

type UnboundedAgentConfig added in v0.1.1 

type UnboundedAgentConfig struct {
	config.AgentConfig

	// Attest configures TPM-based attestation for obtaining a bootstrap
	// token from a metalman serve-pxe instance. When set, the agent
	// performs TPM attestation on the host instead of requiring a static
	// BootstrapToken in the Kubelet.Auth config.
	Attest *AgentAttestConfig `json:"Attest,omitempty"`

	// Downloads optionally overrides the download sources for binaries
	// the agent installs into the nspawn rootfs (kubelet, containerd,
	// runc, CNI plugins, crictl). When unset the agent downloads each
	// artifact from its upstream default host.
	Downloads *AgentDownloads `json:"Downloads,omitempty"`
}

UnboundedAgentConfig extends the shared AgentConfig with unbounded-specific fields that are not part of the public agent IR. Controllers and the agent CLI use this type; the shared agent library uses only AgentConfig.

func BuildAgentConfig 

func BuildAgentConfig(params BuildAgentConfigParams) UnboundedAgentConfig

BuildAgentConfig constructs an AgentConfig from a Machine and cluster-level parameters. This is the canonical function used by all codepaths that produce agent configuration (machina SSH provisioner, metalman PXE templates, and kubectl-unbounded manual bootstrap).

Label priority (lowest to highest):

  1. User-defined labels from Machine.Spec.Kubernetes.NodeLabels.
  2. Common labels applied unconditionally (e.g. cloud provider exclusion).
  3. Provider-injected labels from params.ProviderLabels.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.