Documentation
¶
Overview ¶
Package kube bootstraps a read-only kubeconfig for the cell.
Flow: take an admin kubeconfig on the host, create a ServiceAccount bound to the built-in `view` ClusterRole on the cluster, mint a token, and write a sibling kubeconfig authenticated as that SA. The cell mounts the sibling and gets cluster reads with server-enforced no-writes — regardless of which tool inside the cell uses it (kubectl, helm, the kubernetes-mcp-server).
All cluster mutation happens via host `kubectl`. No client-go dependency.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
Types ¶
type Options ¶
type Options struct {
Source string // path to admin kubeconfig
Output string // path to write the -read sibling
SAName string // ServiceAccount name on the cluster
Namespace string // ServiceAccount namespace
TTL time.Duration // requested token duration (cluster may cap)
SkipCluster bool // skip SA/binding/token creation (kubeconfig writeback only)
Yes bool // skip the interactive confirmation prompt
}
Options controls Bootstrap. Zero-value Options should be passed through Defaults() before use.
func Defaults ¶
Defaults fills in zero fields from the host environment.
- Source: $KUBECONFIG, else ~/.kube/config
- Output: derived from Source: `nmd-prod` → `nmd-prod-read`, `config` → `config-read`
- SAName: $USER + "-readonly" (e.g. dmitry-readonly)
- Namespace: "default"
- TTL: 8760h (1 year; cluster may cap shorter)
type SourceInfo ¶
SourceInfo summarises the source kubeconfig for the confirmation prompt.
Source Files