Help us shape the future of Go! Take the 2026 Go Developer Survey

elastic

package
v0.4.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 30, 2026 License: Apache-2.0 Imports: 38 Imported by: 0

Documentation

Overview

Package elastic reconciles Elasticsearch nodes and their Kibana, Logstash and APM component services. Ownership is established by recorded service IDs, retained-volume IDs, identities returned by the member's own import, a service-bound non-sensitive KARAKORAM_OWNER marker, or readable legacy agent token secrets. Sensitive variables are masked for tokens without sudo mode; masked values and service hostnames alone never establish ownership.

An unrecorded volume service may also be verified by a runtime whose marker or legacy secret proves ownership and whose data directory names that exact volume mount. Markers are backfilled only after every existing service of the member is verified. Expired import processes are reconciled against actual services: missing services are imported again, while existing services still require ownership evidence.

RuntimeSpec and the shared engine service builders describe deployments and imports using the backend's layout, without rendering platform manifests. Optional stack services are declared in an engine.ComponentSet, which supplies defaults, validation and topology information. Its stateless lifecycle helper preserves the import, deploy, readiness and scale stages; Elasticsearch keeps ownership checks, durable operation tracking and database safety decisions.

TCP and Kibana/APM HTTPS admission is persisted independently of runtime route receipts. Resume and runtime repair restore admitted access even outside maintenance windows; deferred policy changes still prevent generation acknowledgement until a window opens or its override is accepted. Legacy TCP digests seed admission only when the applied policy is recoverable; otherwise an unacknowledged legacy generation falls back to private access.

Agent connectivity means a successful status response, independently of child health. Node and pinned component observations retain paused/error diagnostics as Process conditions without losing native roles. Every live component must pass process, configuration and application readiness checks. Paused children keep the member unhealthy and the cluster nonReady; investigate the stop before manually sending SIGCONT to a verified process. Reconciliation never resumes or kills a child in response to these diagnostics.

A dataSource target remains unready until its durable initial snapshot restore completion marker is saved, independently of desired generation and process health. Failed or cancelled initial restores are terminal and never replayed implicitly. Native restore claim fences conflicting mutations; target deletion remains permitted. Snapshot submission waits for an explicit successful native shard result and persists that completion receipt before advancing. Accepted-only legacy receipts and interrupted submissions remain fail-closed without replay. Historical superseded creates without restore evidence remain nonReady and never enqueue a replacement restore. Their ordinary runtime, access, backup storage and exposure reconciliation continues without the old source dependency.

Data MCP uses native, scoped read-only and opt-in document-write identities. Their roles exclude restricted indices, but wildcard grants still match non-restricted dot indices: the native gateway must independently exclude all dot indices and prevent alias or wildcard expansion from reaching them. Agent rollouts freeze their target build. If the control-plane build changes, no new deployment is admitted or retried for that rollout. An already stopped component is started on its existing artifact; an accepted deployment consumes operator-corrected configuration at its existing engine version and waits for service readiness. Elasticsearch allocation and shard health recover before the rolling journal is retired and the operation fails. Recovery never reports the changed artifact as satisfying the old target.

SPDX-License-Identifier: Apache-2.0 Copyright 2026 The Karakoram Authors

SPDX-License-Identifier: Apache-2.0 Copyright 2026 The Karakoram Authors

SPDX-License-Identifier: Apache-2.0 Copyright 2026 The Karakoram Authors

Index

Constants

View Source 
const (
	DataAccessReadRole      = "karakoram_mcp_ro"
	DataAccessReadWriteRole = "karakoram_mcp_rw"
)
View Source 
const (
	AdminUser          = "karakoram"
	MonitorUser        = "karakoram-monitor"
	MonitorRole        = "karakoram_monitor"
	LogstashUser       = "karakoram_logstash"
	LogstashWriterRole = "karakoram_logstash_writer"
	APMUser            = "karakoram_apm"
	APMWriterRole      = "karakoram_apm_writer"
)

Provider-owned security identities.

Variables

This section is empty.

Functions

func APMHostname 

func APMHostname(cluster string) string

APMHostname names the shared APM Server service.

func ArtifactURL 

func ArtifactURL(component, version string) string

ArtifactURL returns the official Linux x86_64 archive URL. Invalid product or version text returns an empty URL and is never embedded in shell commands.

func DefaultResources 

func DefaultResources(component string) (domain.Resources, error)

DefaultResources returns defaults for spec component names (engine, master, kibana, logstash, apm). Unknown components return an error.

func ElasticsearchHeapMB 

func ElasticsearchHeapMB(ramGB float64) int

ElasticsearchHeapMB computes an explicit equal minimum/maximum JVM heap from minimum RAM in GB (1024 MB). Dedicated masters use the same rule.

func FlattenSettings 

func FlattenSettings(settings map[string]any) (map[string]any, error)

FlattenSettings converts nested JSON settings to dotted keys. It rejects ambiguous dotted/nested duplicates instead of depending on map iteration order. Empty maps remain values so managed namespaces cannot bypass validation.

func IssueHTTP 

func IssueHTTP(ca *CA, node string, dnsNames []string, ips []net.IP) (certPEM, keyPEM []byte, err error)

IssueHTTP issues a server-only HTTP identity covering service discovery, loopback probes and any explicitly supplied public DNS names/IP addresses.

func IssueTransport 

func IssueTransport(ca *CA, node string, ips []net.IP) (certPEM, keyPEM []byte, err error)

IssueTransport issues a node's mutually authenticated transport identity. Bare service hostnames are the Zerops discovery names, as for PSMDB; no undocumented DNS suffix is assumed. Loopback SANs support local probes.

func KibanaActiveMinimumRAM added in v0.2.0 

func KibanaActiveMinimumRAM(version string) float64

KibanaActiveMinimumRAM returns the version-dependent active admission floor in GiB. Invalid versions return zero; provider catalog validation rejects them. Structural validation remains separate so persisted smaller specs can be read.

func KibanaHeapMB 

func KibanaHeapMB(ramGB float64) int

KibanaHeapMB computes Node.js' maximum old-space size, with a 512 MB minimum.

func KibanaHostname 

func KibanaHostname(cluster string) string

KibanaHostname names the shared Kibana service.

func LogstashHeapMB 

func LogstashHeapMB(ramGB float64) int

LogstashHeapMB computes an equal minimum/maximum JVM heap, minimum 384 MB.

func LogstashHostname 

func LogstashHostname(cluster string) string

LogstashHostname names the shared Logstash service.

func MasterHostname 

func MasterHostname(cluster string, index int) string

MasterHostname names a dedicated master using its monotonic member index.

func NeedsRenewal 

func NeedsRenewal(certPEM []byte, before time.Duration, now time.Time) (bool, error)

NeedsRenewal checks a leaf certificate using the shared renewal policy.

func NodeHostname 

func NodeHostname(cluster string, index int) string

NodeHostname names a combined or data node using its monotonic member index.

func NodeRestartToken 

func NodeRestartToken(version string, heapMB int, roles []string, providerSettings, userSettings map[string]any) (string, error)

NodeRestartToken computes the ES process restart identity from version, heap, the unordered role set and static provider/user settings. Maps are flattened then JSON-encoded (sorted keys), so nested/dotted spelling and insertion order do not affect the token. User settings override provider settings, after the caller has validated them. Seed hosts and initial master nodes are excluded: seed files hot-reload and bootstrap nodes must never trigger a restart when removed after formation. Certificates, file realm and secure settings are intentionally not inputs; their reloads are managed independently.

func PrepareCommands added in v0.2.0 

func PrepareCommands(component, version, user string) []string

PrepareCommands returns the verified installation command used by deployments of an Elastic component, or nil for invalid component or version text.

func ProtectedRoleName 

func ProtectedRoleName(name string) bool

ProtectedRoleName identifies built-in and provider-owned roles.

func ProtectedUserName 

func ProtectedUserName(name string) bool

ProtectedUserName identifies built-in and provider-owned identities.

func RenderFileRealm 

func RenderFileRealm(users map[string]string, roles map[string][]string, previousUsersFile string) (usersFile, usersRolesFile string, err error)

RenderFileRealm renders users (name -> password) and roles (role -> usernames). previousUsersFile is the persisted prior rendering: matching bcrypt hashes are reused to prevent salted-hash churn. New hashes use $2a$ at cost 10, the format demonstrated by Elastic's file-realm documentation: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/file-based Internal/reserved identities are allowed here, but all names remain file-safe.

func RenderFileRoles 

func RenderFileRoles() (string, error)

RenderFileRoles renders roles.yml for the provider-owned monitoring role.

func RepositoryBasePath 

func RepositoryBasePath(storagePrefix, namespace, cluster, uid string) string

RepositoryBasePath scopes a snapshot repository to one cluster lifetime. Persisted bindings retain their historical empty-component normalization.

func RepositoryName 

func RepositoryName(storage string) string

RepositoryName returns the cluster-local repository name for a storage.

func RestartToken 

func RestartToken(parts ...string) string

RestartToken hashes a canonical JSON array of ordered restart-relevant parts. JSON framing prevents ambiguous concatenations; callers canonicalize any structured parts first. The digest contains no raw configuration or secrets.

func RuntimeSpec added in v0.2.0 

func RuntimeSpec(layout infra.Layout, in RuntimeInput) (infra.RuntimeSpec, error)

RuntimeSpec describes a member without depending on a backend manifest. Data and master nodes share the Elasticsearch product runtime.

func S3ClientName 

func S3ClientName(namespace, storage string) string

S3ClientName returns a stable, bounded node client name scoped by namespace and storage. JSON array framing avoids collisions between differently split names.

func S3ClientSettings 

func S3ClientSettings(name, endpoint, region string) map[string]any

S3ClientSettings builds static elasticsearch.yml client settings. endpoint must be the storage's full URL including scheme; the deprecated protocol setting is never emitted. These values require a rolling restart when changed.

func S3SecureSettings 

func S3SecureSettings(name, accessKey, secret string) map[string]string

S3SecureSettings builds reloadable keystore credentials. Never log this map.

func UpgradeAllowed 

func UpgradeAllowed(from, to string) (ok bool, requiresBackup bool)

UpgradeAllowed accepts strictly newer releases of the same major, or the supported 8.19.x to 9.1+ bridge. Cross-major upgrades require a fresh backup. It describes compatibility, not membership in the offered version catalog.

func ValidClusterName 

func ValidClusterName(name string) bool

ValidClusterName checks the cluster naming contract shared with Zerops.

func ValidHostname 

func ValidHostname(name string) bool

ValidHostname checks Zerops' lowercase alphanumeric service hostname limit.

func ValidateMinimumRAM 

func ValidateMinimumRAM(component string, ramGB float64) error

ValidateMinimumRAM checks each spec component's minimum RAM requirement in GB.

func ValidateRoleName 

func ValidateRoleName(name string) error

ValidateRoleName validates names for user-managed roles, excluding built-ins.

func ValidateUserName 

func ValidateUserName(name string) error

ValidateUserName validates names for user-managed native users, excluding reserved identities. Karakoram deliberately accepts a narrower ES-safe set.

func VolumeHostname 

func VolumeHostname(node string) string

VolumeHostname names the local storage service belonging to a node.

Types

type APIKey 

type APIKey struct {
	ID          string `json:"id"`
	Name        string `json:"name"`
	Creation    int64  `json:"creation"`
	Expiration  int64  `json:"expiration,omitempty"`
	Invalidated bool   `json:"invalidated"`
	Username    string `json:"username"`
}

APIKey is the non-secret inventory of a Karakoram-created key.

type APIKeyCreate 

type APIKeyCreate struct {
	Name            string                    `json:"name"`
	Expiration      string                    `json:"expiration,omitempty"`
	RoleDescriptors map[string]RoleDescriptor `json:"roleDescriptors"`
}

APIKeyCreate requests a key owned by the control-plane identity.

type APIKeyCreated 

type APIKeyCreated struct {
	ID         string `json:"id"`
	Name       string `json:"name"`
	APIKey     string `json:"apiKey"`
	Encoded    string `json:"encoded"`
	Expiration int64  `json:"expiration,omitempty"`
}

APIKeyCreated contains a secret returned only when a key is created.

type Access 

type Access interface {
	ListUsers(context.Context, *engine.Context) ([]User, error)
	GetUser(context.Context, *engine.Context, string) (*User, error)
	CreateUser(context.Context, *engine.Context, UserWrite) error
	UpdateUser(context.Context, *engine.Context, UserWrite) error
	DeleteUser(context.Context, *engine.Context, string) error
	ListRoles(context.Context, *engine.Context) ([]AccessRole, error)
	GetRole(context.Context, *engine.Context, string) (*AccessRole, error)
	PutRole(context.Context, *engine.Context, AccessRole, bool) error
	DeleteRole(context.Context, *engine.Context, string) error
	ListAPIKeys(context.Context, *engine.Context) ([]APIKey, error)
	CreateAPIKey(context.Context, *engine.Context, APIKeyCreate) (*APIKeyCreated, error)
	InvalidateAPIKey(context.Context, *engine.Context, string) error
}

Access is Elasticsearch-specific native user, role and API-key management.

type AccessRole 

type AccessRole struct {
	Name     string `json:"name"`
	Reserved bool   `json:"reserved"`
	Role
}

AccessRole is a named security role. Built-ins are readable but immutable.

type ApplicationPrivileges 

type ApplicationPrivileges struct {
	Application string   `json:"application" yaml:"application"`
	Privileges  []string `json:"privileges" yaml:"privileges"`
	Resources   []string `json:"resources" yaml:"resources"`
}

ApplicationPrivileges grants application-defined privileges.

type CA 

type CA = pki.CA

CA is the shared certificate authority type. Its signing key is secret.

func LoadCA 

func LoadCA(certPEM, keyPEM []byte) (*CA, error)

LoadCA validates a cluster CA certificate and its matching signing key.

func NewCA 

func NewCA(commonName string, validity time.Duration) (*CA, error)

NewCA creates a cluster CA using the shared PKI implementation.

type FieldSecurity 

type FieldSecurity struct {
	Grant  *[]string `json:"grant,omitempty" yaml:"grant,omitempty"`
	Except *[]string `json:"except,omitempty" yaml:"except,omitempty"`
}

FieldSecurity distinguishes omitted field lists from explicit empty lists.

type IndexPrivileges 

type IndexPrivileges struct {
	Names                  []string       `json:"names" yaml:"names"`
	Privileges             []string       `json:"privileges" yaml:"privileges"`
	AllowRestrictedIndices bool           `json:"allow_restricted_indices" yaml:"allow_restricted_indices"`
	Query                  *string        `json:"query,omitempty" yaml:"query,omitempty"`
	FieldSecurity          *FieldSecurity `json:"field_security,omitempty" yaml:"field_security,omitempty"`
}

IndexPrivileges grants privileges over a set of index patterns.

type Options 

type Options struct {
	Kibana struct {
		Public            bool           `json:"public"`
		AllowAllAddresses bool           `json:"allowAllAddresses,omitempty"`
		Settings          map[string]any `json:"settings,omitempty"`
	} `json:"kibana"`
	APM struct {
		Public            bool  `json:"public"`
		AllowAllAddresses bool  `json:"allowAllAddresses,omitempty"`
		APIKeys           *bool `json:"apiKeys,omitempty"`
	} `json:"apm"`
	Logstash struct {
		Pipelines       []agentspec.Pipeline `json:"pipelines,omitempty"`
		PersistentQueue bool                 `json:"persistentQueue"`
	} `json:"logstash"`
	Elasticsearch struct {
		Settings map[string]any `json:"settings,omitempty"`
	} `json:"elasticsearch"`
}

Options contains spec.engineOptions. Elasticsearch does not consume spec.engineConfig: the provider must reject non-empty engineConfig rather than silently ignore it. User settings belong in these typed options instead.

func ParseOptions 

func ParseOptions(raw []byte) (Options, error)

ParseOptions decodes exactly one JSON object, rejects unknown fields, defaults APM API-key authentication to true, and validates user-controlled content.

func (Options) Validate 

func (o Options) Validate() error

Validate enforces pipeline bounds and protects provider-managed settings. It deliberately does not guess whether other arbitrary setting names are secure.

type Provider 

type Provider struct {
	// contains filtered or unexported fields
}

Provider reconciles Elasticsearch and its optional stack components.

func New 

func New(o ProviderOptions) *Provider

New constructs an Elasticsearch provider.

func (*Provider) ApplyDefaults 

func (*Provider) ApplyDefaults(s *domain.ClusterSpec)

ApplyDefaults fills omitted spec values without enabling optional components.

func (*Provider) Balancer 

func (*Provider) Balancer(context.Context, *engine.Context) (domain.BalancerStatus, error)

Balancer is unsupported; Elasticsearch manages shard allocation itself.

func (*Provider) CanCancelOperation added in v0.4.0 

func (*Provider) CanCancelOperation(_ context.Context, op *domain.Operation) error

func (*Provider) CanClaimOperation added in v0.2.0 

func (*Provider) CanClaimOperation(c *domain.Cluster) (bool, error)

func (*Provider) CancelOperation added in v0.4.0 

func (p *Provider) CancelOperation(ctx context.Context, rc *engine.Context, op *domain.Operation) (engine.OpResult, error)

func (*Provider) Cleanup 

func (p *Provider) Cleanup(ctx context.Context, rc *engine.Context, opts domain.DeleteOptions) (done bool, err error)

Cleanup retires all runtime writers and optional volumes before bounded, control-plane cleanup of exact owned repository prefixes.

func (*Provider) Connection 

func (p *Provider) Connection(ctx context.Context, rc *engine.Context) (domain.ConnectionDetails, error)

Connection returns credentials only through the protected data-plane endpoint.

func (*Provider) CreateAPIKey 

func (p *Provider) CreateAPIKey(ctx context.Context, rc *engine.Context, req APIKeyCreate) (*APIKeyCreated, error)

CreateAPIKey creates a managed key and returns its one-time secret.

func (*Provider) CreateDatabaseRole 

func (*Provider) CreateDatabaseRole(context.Context, *engine.Context, domain.DatabaseRole) error

CreateDatabaseRole rejects MongoDB-shaped requests; use native Elasticsearch access.

func (*Provider) CreateDatabaseUser 

func (*Provider) CreateDatabaseUser(context.Context, *engine.Context, domain.DatabaseUser, string) (string, error)

CreateDatabaseUser rejects MongoDB-shaped requests; use native Elasticsearch access.

func (*Provider) CreateUser 

func (p *Provider) CreateUser(ctx context.Context, rc *engine.Context, u UserWrite) error

CreateUser creates a native realm user, rejecting an existing identity.

func (*Provider) DataAccessCredentials added in v0.3.0 

func (p *Provider) DataAccessCredentials(ctx context.Context, rc *engine.Context, level engine.DataAccessLevel) (engine.DataAccessCredentials, error)

DataAccessCredentials returns private HTTPS endpoints and a scoped native identity.

func (*Provider) DataMcp added in v0.3.0 

func (*Provider) DataMcp(c *domain.Cluster) (engine.DataMcpBackend, error)

DataMcp selects the native gateway and validates Elasticsearch-only scope.

func (*Provider) DeleteDatabaseRole 

func (*Provider) DeleteDatabaseRole(context.Context, *engine.Context, string, string) error

DeleteDatabaseRole rejects MongoDB-shaped requests; use native Elasticsearch access.

func (*Provider) DeleteDatabaseUser 

func (*Provider) DeleteDatabaseUser(context.Context, *engine.Context, string, string) error

DeleteDatabaseUser rejects MongoDB-shaped requests; use native Elasticsearch access.

func (*Provider) DeleteRetainedBackup 

func (p *Provider) DeleteRetainedBackup(ctx context.Context, storage domain.BackupStorage, b domain.Backup) error

DeleteRetainedBackup removes a retired repository only when its last snapshot is the requested backup. Individual snapshots share blobs; without a running Elasticsearch writer, deleting per-snapshot objects can corrupt other backups. For a multi-snapshot repository, register it in another cluster and delete the snapshot through Elasticsearch instead. No writer may use a retired base path.

func (*Provider) DeleteRole 

func (p *Provider) DeleteRole(ctx context.Context, rc *engine.Context, name string) error

DeleteRole removes a user-managed native role.

func (*Provider) DeleteUser 

func (p *Provider) DeleteUser(ctx context.Context, rc *engine.Context, name string) error

DeleteUser removes an existing native realm user.

func (*Provider) Describe 

func (*Provider) Describe() domain.ProviderInfo

Describe returns the supported catalog and lifecycle capabilities.

func (*Provider) GetDatabaseRole 

func (*Provider) GetDatabaseRole(context.Context, *engine.Context, string, string) (*domain.DatabaseRole, error)

GetDatabaseRole rejects MongoDB-shaped requests; use native Elasticsearch access.

func (*Provider) GetDatabaseUser 

func (*Provider) GetDatabaseUser(context.Context, *engine.Context, string, string) (*domain.DatabaseUser, error)

GetDatabaseUser rejects MongoDB-shaped requests; use native Elasticsearch access.

func (*Provider) GetRole 

func (p *Provider) GetRole(ctx context.Context, rc *engine.Context, name string) (*AccessRole, error)

GetRole reads a user role or built-in role.

func (*Provider) GetUser 

func (p *Provider) GetUser(ctx context.Context, rc *engine.Context, name string) (*User, error)

GetUser reads a visible native realm identity.

func (*Provider) InitialDataSourceApplied added in v0.2.0 

func (*Provider) InitialDataSourceApplied(c *domain.Cluster) (bool, error)

InitialDataSourceApplied is generation-independent: process health and an applied spec generation are not evidence that the initial snapshot restored.

func (*Provider) InvalidateAPIKey 

func (p *Provider) InvalidateAPIKey(ctx context.Context, rc *engine.Context, id string) error

InvalidateAPIKey revokes only a key created through Karakoram.

func (*Provider) ListAPIKeys 

func (p *Provider) ListAPIKeys(ctx context.Context, rc *engine.Context) ([]APIKey, error)

ListAPIKeys lists only keys created through Karakoram, without their secrets.

func (*Provider) ListDatabaseRoles 

func (*Provider) ListDatabaseRoles(context.Context, *engine.Context) ([]domain.DatabaseRole, error)

ListDatabaseRoles rejects MongoDB-shaped requests; use native Elasticsearch access.

func (*Provider) ListDatabaseUsers 

func (*Provider) ListDatabaseUsers(context.Context, *engine.Context) ([]domain.DatabaseUser, error)

ListDatabaseUsers rejects MongoDB-shaped requests; use native Elasticsearch access.

func (*Provider) ListRoles 

func (p *Provider) ListRoles(ctx context.Context, rc *engine.Context) ([]AccessRole, error)

ListRoles lists user roles and readable built-ins, hiding managed roles.

func (*Provider) ListUsers 

func (p *Provider) ListUsers(ctx context.Context, rc *engine.Context) ([]User, error)

ListUsers lists native users, hiding reserved and managed identities.

func (*Provider) MemberConfig 

func (p *Provider) MemberConfig(ctx context.Context, rc *engine.Context, name string) (agentapi.MemberConfig, error)

MemberConfig renders a member's currently activated secret-bearing payload.

func (*Provider) MemberLogs 

func (p *Provider) MemberLogs(ctx context.Context, rc *engine.Context, name, process string, lines int) ([]domain.MemberLogLine, error)

MemberLogs reads a bounded, allowlisted member process log.

func (*Provider) Metrics 

func (*Provider) Metrics() []domain.MetricDescriptor

Metrics maps the engine's exposition families to canonical monitoring series.

func (*Provider) Name 

func (*Provider) Name() string

Name returns the stable provider identifier.

func (*Provider) PITRWindow 

func (*Provider) PITRWindow(context.Context, *engine.Context) ([]domain.TimeWindow, error)

PITRWindow is unsupported; Elasticsearch recovery uses snapshots.

func (*Provider) Placement 

func (p *Provider) Placement(ctx context.Context, rc *engine.Context) (domain.Placement, error)

Placement uses the same authoritative groups or agent evidence as status.

func (*Provider) PutRole 

func (p *Provider) PutRole(ctx context.Context, rc *engine.Context, r AccessRole, create bool) error

PutRole creates (create=true) or replaces an existing role (create=false).

func (*Provider) RelayTargets 

func (*Provider) RelayTargets(c *domain.Cluster) []string

RelayTargets lists observed and planned member destinations.

func (*Provider) RequiredCapabilities added in v0.2.0 

func (*Provider) RequiredCapabilities(spec domain.ClusterSpec) []string

RequiredCapabilities reports optional backend features needed by a validated spec.

func (*Provider) RunOperation 

func (p *Provider) RunOperation(ctx context.Context, rc *engine.Context, op *domain.Operation) (result engine.OpResult, err error)

RunOperation advances a durable provider operation.

func (*Provider) SetBalancer 

func (*Provider) SetBalancer(context.Context, *engine.Context, bool) error

SetBalancer is unsupported; Elasticsearch manages shard allocation itself.

func (*Provider) Status 

func (p *Provider) Status(ctx context.Context, rc *engine.Context) (status domain.ClusterStatus, statusErr error)

Status combines Elasticsearch health, member agents and infrastructure placement.

func (*Provider) Sync 

func (p *Provider) Sync(ctx context.Context, rc *engine.Context) (result engine.Result, err error)

Sync makes at most one disruptive platform or database transition per call.

func (*Provider) SyncDuringOperation 

func (*Provider) SyncDuringOperation(op *domain.Operation) bool

SyncDuringOperation permits convergence only at operation-safe checkpoints.

func (*Provider) SystemUsers 

func (*Provider) SystemUsers(_ context.Context, rc *engine.Context) ([]domain.SystemUser, error)

SystemUsers lists the managed identities that the rotate-system-user operation accepts, without credential material. The control-plane admin user is internal to the file realm and is not rotated through this list.

func (*Provider) UpdateDatabaseRole 

func (*Provider) UpdateDatabaseRole(context.Context, *engine.Context, domain.DatabaseRole) error

UpdateDatabaseRole rejects MongoDB-shaped requests; use native Elasticsearch access.

func (*Provider) UpdateDatabaseUser 

func (*Provider) UpdateDatabaseUser(context.Context, *engine.Context, domain.DatabaseUser, string) error

UpdateDatabaseUser rejects MongoDB-shaped requests; use native Elasticsearch access.

func (*Provider) UpdateUser 

func (p *Provider) UpdateUser(ctx context.Context, rc *engine.Context, u UserWrite) error

UpdateUser replaces an existing native realm user.

func (*Provider) Validate 

func (p *Provider) Validate(ctx context.Context, old, n *domain.Cluster) error

Validate rejects unsupported configurations and unsafe simultaneous changes.

func (*Provider) ValidateMemberReplacement added in v0.4.0 

func (p *Provider) ValidateMemberReplacement(c *domain.Cluster, name string) error

ValidateMemberReplacement rejects components and singleton native clusters.

func (*Provider) VolumeReferences added in v0.4.1 

func (*Provider) VolumeReferences(c *domain.Cluster) ([]engine.VolumeReference, error)

VolumeReferences exposes persistent identities for backend sizing observation.

type ProviderOptions 

type ProviderOptions struct {
	ControlPlaneURL, InternalCAPEM string
	Store                          engine.ClusterStore
	Logger                         *slog.Logger
}

ProviderOptions supplies control-plane endpoints and inventory lookups.

type Role 

type Role struct {
	Cluster      []string                `json:"cluster" yaml:"cluster"`
	Indices      []IndexPrivileges       `json:"indices" yaml:"indices"`
	Applications []ApplicationPrivileges `json:"applications,omitempty" yaml:"applications,omitempty"`
}

Role is the provider's JSON/YAML security privilege definition.

func APMRoleDefinition 

func APMRoleDefinition() Role

APMRoleDefinition returns the managed event writer and configuration reader.

func DataAccessRoleDefinition added in v0.3.0 

func DataAccessRoleDefinition(patterns []string, level engine.DataAccessLevel) Role

DataAccessRoleDefinition grants document access, never index or user management. Restricted-index exclusion is defense in depth: Elasticsearch's '*' also matches non-restricted dot indices. The native gateway must exclude every dot index independently, including when resolving wildcards and aliases.

func LogstashRoleDefinition 

func LogstashRoleDefinition() Role

LogstashRoleDefinition returns the managed Logstash writer privileges.

func MonitorRoleDefinition 

func MonitorRoleDefinition() Role

MonitorRoleDefinition returns fresh slices for the least-privilege monitor.

type RoleDescriptor 

type RoleDescriptor = Role

RoleDescriptor defines API-key permissions without a role name.

type RuntimeInput added in v0.2.0 

type RuntimeInput struct {
	Hostname      string
	Cluster       string
	Component     string // agentspec component, not the spec component name.
	Version       string
	Volume        string // Empty for stateless stack components.
	AgentURL      string
	InternalCAPEM string
}

RuntimeInput contains non-secret deployment inputs for one member. AgentURL is already resolved for its namespace; agent tokens are imported separately.

type User 

type User struct {
	Username string   `json:"username"`
	Roles    []string `json:"roles"`
	FullName string   `json:"fullName,omitempty"`
	Email    string   `json:"email,omitempty"`
	Enabled  bool     `json:"enabled"`
}

User is a user-managed native realm identity; reserved identities are hidden.

type UserWrite 

type UserWrite struct {
	User
	Password string `json:"password,omitempty"`
}

UserWrite replaces a native user's properties and optionally its password.

Source Files

View all Source files

Directories

Path Synopsis
Package agentspec defines the Elasticsearch engine payload carried in agentapi.MemberConfig.EngineSpec.
 Package agentspec defines the Elasticsearch engine payload carried in agentapi.MemberConfig.EngineSpec.
Package esapi implements Elasticsearch administration over CA-pinned HTTPS.
 Package esapi implements Elasticsearch administration over CA-pinned HTTPS.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.