rulestore

package
v0.41.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 24, 2026 License: Apache-2.0 Imports: 5 Imported by: 0

Documentation

Overview

Package rulestore manages the in-memory cache of compiled WatchRule configurations. It provides efficient lookup and matching of Kubernetes resources against active watch rules.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

This section is empty.

Types

type CompiledClusterResourceRule 

type CompiledClusterResourceRule struct {
	// Operations specifies which operations trigger this rule.
	Operations []configv1alpha3.OperationType
	// APIGroups specifies which API groups this rule matches.
	APIGroups []string
	// APIVersions specifies which API versions this rule matches.
	APIVersions []string
	// Resources specifies which resource types this rule matches.
	Resources []string
}

CompiledClusterResourceRule represents a single cluster resource rule.

It carries no scope: a ClusterWatchRule is cluster-scope-only, so resolution always matches cluster-scoped records and a stored scope other than Cluster is refused at compile time. Keeping a scope field here would let a pruned or absent value widen a stream, which is the failure the narrowing exists to prevent.

type CompiledClusterRule 

type CompiledClusterRule struct {
	// Source is the NamespacedName of the ClusterWatchRule CR (namespace will be empty).
	Source types.NamespacedName

	// GitTarget reference (for event routing)
	GitTargetRef       string
	GitTargetNamespace string

	// Resolved values (from GitTarget)
	GitProviderRef       string
	GitProviderNamespace string
	Branch               string
	Path                 string

	// Rules contains the compiled cluster resource rules with per-rule scope.
	Rules []CompiledClusterResourceRule
}

CompiledClusterRule represents a fully processed ClusterWatchRule, ready for quick lookups.

type CompiledResourceRule 

type CompiledResourceRule struct {
	// Operations specifies which operations trigger this rule.
	Operations []configv1alpha3.OperationType
	// APIGroups specifies which API groups this rule matches.
	APIGroups []string
	// APIVersions specifies which API versions this rule matches.
	APIVersions []string
	// Resources specifies which resource types this rule matches.
	Resources []string

	// SourceNamespaces is this item's RESOLVED source-namespace set IN THE SOURCE CLUSTER —
	// spec.rules[i].sourceNamespace fully expanded to concrete names at compile time. Neither a
	// wildcard nor a policy reference ever survives into the data plane.
	//
	// It is per item, and separate from Source.Namespace, because the two are genuinely different
	// namespaces in (potentially) different clusters: Source names the WatchRule OBJECT in the
	// control plane, while these name the namespaces whose objects are mirrored. They coincide
	// only for a legacy item. Every watch-planning consumer — the watched-type selection, the
	// stream roll-up, and the fingerprint that decides whether that table is re-projected — must
	// read THIS field; reading Source.Namespace instead yields a stale watch, not an error.
	//
	// An EMPTY set is a legitimate resolved answer for a wildcard whose policy currently admits
	// nothing: the item watches nothing. It is never a stand-in for "could not resolve" — an
	// unevaluatable policy stops the rule from compiling at all, because an empty set that reached
	// here would be the input to a resync sweep.
	SourceNamespaces []string
}

CompiledResourceRule represents a single resource matching rule with all its filters.

type CompiledRule 

type CompiledRule struct {
	// Source is the NamespacedName of the WatchRule CR.
	Source types.NamespacedName

	// GitTarget reference (for event routing)
	GitTargetRef       string
	GitTargetNamespace string

	// Resolved values (from GitTarget)
	GitProviderRef       string
	GitProviderNamespace string
	Branch               string
	Path                 string

	// IsClusterScoped indicates if this rule watches cluster-scoped resources.
	// Always false for WatchRule (namespace-scoped).
	IsClusterScoped bool
	// ResourceRules contains the compiled resource matching rules.
	ResourceRules []CompiledResourceRule
}

CompiledRule represents a fully processed WatchRule, ready for quick lookups.

type RuleStore 

type RuleStore struct {
	// contains filtered or unexported fields
}

RuleStore holds the in-memory representation of all active watch rules. It is safe for concurrent use.

func NewStore 

func NewStore() *RuleStore

NewStore creates a new, empty RuleStore.

func (*RuleStore) AddOrUpdateClusterWatchRule 

func (s *RuleStore) AddOrUpdateClusterWatchRule(
	rule configv1alpha3.ClusterWatchRule,
	gitTargetName string,
	gitTargetNamespace string,
	gitProviderName string,
	gitProviderNamespace string,
	branch string,
	path string,
)

AddOrUpdateClusterWatchRule adds or updates a ClusterWatchRule with a resolved target from GitTarget. The chain is: ClusterWatchRule -> GitTarget -> GitProvider Parameters:

  • rule: the ClusterWatchRule to add or update
  • gitTargetName: the name of the GitTarget
  • gitTargetNamespace: the namespace containing the GitTarget
  • gitProviderName: the name of the resolved GitProvider (from GitTarget.Spec.Provider)
  • gitProviderNamespace: the namespace containing the resolved GitProvider
  • branch: the Git branch to write to (from GitTarget.Spec.Branch)
  • path: POSIX-like relative path prefix for writes (from GitTarget.Spec.Path, sanitized upstream)

func (*RuleStore) AddOrUpdateWatchRule 

func (s *RuleStore) AddOrUpdateWatchRule(
	rule configv1alpha3.WatchRule,
	sourceNamespaces [][]string,
	gitTargetName string,
	gitTargetNamespace string,
	gitProviderName string,
	gitProviderNamespace string,
	branch string,
	path string,
)

AddOrUpdateWatchRule adds or updates a WatchRule with a resolved target from GitTarget. The chain is: WatchRule -> GitTarget -> GitProvider

The whole compiled rule — including every item's resolved source-namespace set — is replaced ATOMICALLY. Nothing per-item survives a spec change, which is what lets rule items have no stable API identity: no state outlives the spec that produced it, so a reorder cannot make one item inherit another's grant.

Parameters:

  • rule: the WatchRule to add or update
  • sourceNamespaces: the resolved source-namespace set PER rule item, index-aligned with rule.Spec.Rules. A shorter slice leaves the remaining items with no namespaces, which is a compile bug rather than a scope: callers must resolve every item (see authz.ResolveWatchRuleSourceScope).
  • gitTargetName: the name of the GitTarget
  • gitTargetNamespace: the namespace containing the GitTarget
  • gitProviderName: the name of the resolved GitProvider (from GitTarget.Spec.Provider)
  • gitProviderNamespace: the namespace containing the resolved GitProvider
  • branch: the Git branch to write to (from GitTarget.Spec.Branch)
  • path: POSIX-like relative path prefix for writes (from GitTarget.Spec.Path, sanitized upstream)

func (*RuleStore) Delete 

func (s *RuleStore) Delete(key types.NamespacedName)

Delete removes a rule from the store.

func (*RuleStore) DeleteClusterWatchRule 

func (s *RuleStore) DeleteClusterWatchRule(key types.NamespacedName)

DeleteClusterWatchRule removes a ClusterWatchRule from the store.

func (*RuleStore) GetMatchingClusterRules 

func (s *RuleStore) GetMatchingClusterRules(
	resourcePlural string,
	operation configv1alpha3.OperationType,
	apiGroup string,
	apiVersion string,
	isClusterScoped bool,
	_ map[string]string,
) []CompiledClusterRule

GetMatchingClusterRules returns ClusterWatchRules matching the resource. This handles both cluster-scoped and namespaced resources with per-rule scope matching. Parameters:

  • resourcePlural: The plural form of the resource (e.g., "nodes", "pods")
  • operation: The operation type (CREATE, UPDATE, DELETE)
  • apiGroup: The API group of the resource (empty string for core API)
  • apiVersion: The API version of the resource
  • isClusterScoped: Whether the resource is cluster-scoped
  • namespaceLabels: Labels of the namespace (ignored in simplified MVP)

func (*RuleStore) GetMatchingRules 

func (s *RuleStore) GetMatchingRules(
	obj client.Object,
	resourcePlural string,
	operation configv1alpha3.OperationType,
	apiGroup string,
	apiVersion string,
	isClusterScoped bool,
) []CompiledRule

GetMatchingRules returns all namespaced WatchRules that match the given resource. For namespaced resources, callers should provide an object carrying the event namespace so namespaced WatchRules only match objects from their own namespace. Parameters:

  • obj: The Kubernetes object to match; its namespace is used for WatchRule filtering
  • resourcePlural: The plural form of the resource (e.g., "pods", "deployments")
  • operation: The operation type (CREATE, UPDATE, DELETE)
  • apiGroup: The API group of the resource (empty string for core API)
  • apiVersion: The API version of the resource
  • isClusterScoped: Whether the resource is cluster-scoped

func (*RuleStore) GetWatchRule added in v0.39.0 

func (s *RuleStore) GetWatchRule(key types.NamespacedName) (CompiledRule, bool)

GetWatchRule returns a compiled WatchRule by key, and whether it is compiled at all.

The status roll-up reads it because a WatchRule's watched namespaces can no longer be derived from its spec: a "*" item's set exists only after resolution, so a roll-up computed from the spec would look for streams under keys that were never opened and report a healthy wildcard rule as permanently not-ready.

func (*RuleStore) IsReady 

func (s *RuleStore) IsReady() bool

IsReady reports whether the store has completed initial rule bootstrap.

func (*RuleStore) MarkReady 

func (s *RuleStore) MarkReady()

MarkReady records that initial WatchRule and ClusterWatchRule bootstrap has completed.

func (*RuleStore) SnapshotClusterWatchRules 

func (s *RuleStore) SnapshotClusterWatchRules() []CompiledClusterRule

SnapshotClusterWatchRules returns a deep-copied slice of compiled ClusterWatchRule entries. Safe for concurrent use; the returned slice can be freely modified by callers.

func (*RuleStore) SnapshotWatchRules 

func (s *RuleStore) SnapshotWatchRules() []CompiledRule

SnapshotWatchRules returns a deep-copied slice of compiled WatchRule entries. Safe for concurrent use; the returned slice can be freely modified by callers.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.