Documentation
¶
Overview ¶
Package manifestreport is the integration layer that drives the cluster-free manifestedit library against a real repository and cluster state. It supplies the two pieces of policy manifestedit deliberately refuses to own — the Git projection and the canonical renderer — and provides a read-only reconcile that reports what it would add, remove, or update.
It is the read-only reconcile seam described in docs/spec/manifest-system.md. It depends on internal/sanitize (the projection/renderer) and internal/git/manifestedit (the mechanism); manifestedit itself stays free of both.
Index ¶
- func EditInPlace(path string, existing []byte, obj *unstructured.Unstructured) ([]byte, bool)
- func EditOptions() manifestedit.EditOptions
- func Project(obj *unstructured.Unstructured) *unstructured.Unstructured
- func Render(obj *unstructured.Unstructured) ([]byte, error)
- type Action
- type Entry
- type Report
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EditInPlace ¶
func EditInPlace(path string, existing []byte, obj *unstructured.Unstructured) ([]byte, bool)
EditInPlace produces a minimal, formatting-preserving edit of an existing single-file manifest so its document for obj matches the desired projection, instead of rewriting the file wholesale. It finds the document for obj's identity, patches only what changed (preserving comments, key order, and block scalars of everything else), and returns the full new file content.
ok is false when there is no editable document for obj in the file — wrong identity, an encrypted (SOPS) document, a disallowed construct, or snapshot drift — so the caller must fall back to writing canonical content. The returned content is never partial: when ok is true it is the whole file.
This is the seam that brings the manifestedit comparison into the live writer: the writer hands EditInPlace the bytes already on disk and the desired object, and gets back a faithful in-place edit. It uses Apply (not just Decide), so it is a real edit — but a read-only-safe one: it only transforms the bytes passed in and never touches Git itself.
func EditOptions ¶
func EditOptions() manifestedit.EditOptions
EditOptions returns the production manifestedit options:
- Render: the house renderer above (so canonical output never drifts);
- ListMatch: zero value = index-based, deliberately not a global keyed strategy — keyed matching needs a path/GVK-aware policy that does not exist yet, and a blanket KeyField would change every named list's behavior;
- Owns: nil = whole-object truth (API-first), the only supported policy (docs/spec/manifestedit-field-ownership-spike.md).
func Project ¶
func Project(obj *unstructured.Unstructured) *unstructured.Unstructured
Project computes the Git projection of a live API object: the clean desired state the reverser would store. This is the "what does clean mean" policy that manifestedit does not own; the integration layer supplies it, and it is exactly the projection the live writer path uses (internal/sanitize).
func Render ¶
func Render(obj *unstructured.Unstructured) ([]byte, error)
Render is the house canonical renderer injected into manifestedit for whole-document replacement and new files. It is the same renderer the Git writer uses (sanitize.MarshalToOrderedYAML, see internal/git/content_writer.go buildContentForWrite), so whole-replace and new-file output cannot drift from committed content. The object passed in is the already-projected desired state.
Types ¶
type Action ¶
type Action string
Action is what the reconcile would do to bring Git in line with the cluster. The report is read-only: these are intents, never executed here.
const ( // ActionNoChange means Git already matches the desired projection. ActionNoChange Action = "no-change" // ActionUpdate means an existing document would be edited (patch or whole-replace). ActionUpdate Action = "update" // ActionCreate means a desired resource has no document in Git yet. Placement // is an upstream decision; this report only flags that a file would be created. ActionCreate Action = "create" // ActionDelete means a document exists in Git for a resource the cluster no // longer has (or a duplicate loser). A prune candidate — the prune trigger // lives in the reconcile layer, not here. ActionDelete Action = "delete" // ActionSkip means the document exists but cannot be edited in place // (encrypted, disallowed construct, non-KRM) — reported, never silently acted on. ActionSkip Action = "skip" )
type Entry ¶
type Entry struct {
Identity manifestedit.Identity
Action Action
// Location is the Git document this verdict concerns. It is the zero value for
// ActionCreate, which has no existing location.
Location manifestedit.Location
// Reason is the human-readable explanation, carried straight from the Decide
// reason for update/no-op/skip verdicts.
Reason string
}
Entry is one resource's verdict in the report.
type Report ¶
type Report struct {
Entries []Entry
}
Report is the read-only verdict over a (Git folder, cluster state) pair.
func BuildReport ¶
func BuildReport( files []manifestedit.FileContent, desired []*unstructured.Unstructured, ) (Report, []manifestedit.Diagnostic)
BuildReport is the read-only, inventory-driven reconcile: it indexes the Git folder, compares it to the desired cluster state, and reports what it would add, remove, or update — without mutating Git or touching the writer. It uses manifestedit.Decide only (never Apply), so it cannot change anything; this is the trust-building step before the comparison is wired into the commit path.
The trust model is a single repository transaction: files must be the content of one checked-out commit/worktree, and the resulting verdicts are valid only for that snapshot. See docs/spec/manifest-system.md.
Source Files