Documentation
¶
Overview ¶
Package k8s reads what a namespace is running and, opt-in, one image pull secret.
It is the read-only, scoped Kubernetes adaptor of AGENTS.md §4.2 and the repo map's "kubeconfig" boundary: one kubeconfig context named by the caller, one namespace listed, one secret read by name. Nothing here writes, and no error, log line or return value names the API server (§4.4 — the context *name* may reach output, its address never; every client error goes through pkg/redact and the server host is scrubbed from it as a second guard). The pull secret's contents never leave the package except as an authn.Keychain (R-002), which pkg/registry hands to go-containerregistry.
Which containers count (a stated decision, see RunningImages): pods in phase Running or Pending that are not terminating, their app and init containers with a non-empty imageID. Completed Jobs, failed pods, pods on the way out and ephemeral debug containers do not describe what the env is running.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Cluster ¶
type Cluster interface {
// RunningImages lists the images running in exactly namespace (see the package doc for
// which containers count), sorted by pod, then app containers before init containers,
// then container name.
RunningImages(ctx context.Context, namespace string) ([]RunningImage, error)
// DockerConfigSecret reads the kubernetes.io/dockerconfigjson Secret namespace/name
// and returns its credentials as a keychain. The credentials are not otherwise
// exposed; the error for a missing or mistyped secret names the secret, never its data.
DockerConfigSecret(ctx context.Context, namespace, name string) (authn.Keychain, error)
}
Cluster is what the resolver and the registry auth chain need from a cluster. Both methods read; there is no method that writes.
func FromClientset ¶
func FromClientset(cs kubernetes.Interface, hide ...string) Cluster
FromClientset wraps an existing clientset — client-go's fake in tests. Every string in hide is scrubbed from every error message the returned Cluster produces.
func NewCluster ¶
NewCluster builds a Cluster over the user's kubeconfig ($KUBECONFIG or ~/.kube/config) using the named context, or the file's current context when kubeconfigContext is "". The second result is the context actually in use, for the caller to print — the one piece of cluster identity that may reach output (AGENTS.md §4.4). Nothing is contacted here; the first request happens in RunningImages or DockerConfigSecret.
type Fake ¶
type Fake struct {
Images map[string][]RunningImage
Secrets map[string]authn.Keychain
Err error
Calls []string
}
Fake is an in-memory Cluster for tests in other packages. Images is keyed by namespace; Secrets by "namespace/name". Err, when set, is returned by every call. Calls records every method invocation as "RunningImages <ns>" or "DockerConfigSecret <ns>/<name>" so a test can assert scope (nothing outside the namespace it named) and count.
func (*Fake) DockerConfigSecret ¶
func (f *Fake) DockerConfigSecret(_ context.Context, namespace, name string) (authn.Keychain, error)
DockerConfigSecret implements Cluster.
func (*Fake) RunningImages ¶
RunningImages implements Cluster.
type RunningImage ¶
type RunningImage struct {
Pod string
Container string
Init bool // an initContainer
Ref image.Ref
}
RunningImage is one container of one pod and the image it is actually running, as the runtime reported it in status.*containerStatuses[].imageID: repo plus digest, never a tag (imageID carries none). The repo is the one from imageID, which can differ from the manifest's image field (a mirror, a docker.io alias); callers compare repos through image.Canonical rather than by string.
type StaticKeychain ¶
type StaticKeychain struct{ Username, Password string }
StaticKeychain is an authn.Keychain that answers every registry with one credential; for tests that need a secret without a cluster.
func (StaticKeychain) Resolve ¶
func (s StaticKeychain) Resolve(authn.Resource) (authn.Authenticator, error)
Resolve implements authn.Keychain.
Source Files