steps

package
v0.1.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 9, 2026 License: Apache-2.0 Imports: 31 Imported by: 0

Documentation

Overview

Package steps holds the install and teardown operations that the shell installer implemented as bash functions. Each exported function corresponds to one of those and keeps its name in the [step] log line.

Index

Constants

View Source 
const (
	SecretActorIDJWTPool   = "actor-id-jwt-pool"
	SecretActorIDCAPool    = "actor-id-ca-pool"
	SecretActorIDCACerts   = "actor-id-ca-certs"
	SecretServiceDNSCA     = "service-dns-ca-pool"
	SecretPodIdentityCA    = "pod-identity-ca-pool"
	SecretEgressMITMCAPool = "egress-mitm-ca-pool"
	ConfigMapAPIEnvVars    = "ate-api-server-envvars"
	ConfigMapAPIAuthn      = "ate-api-authentication"
)

Secret and ConfigMap names the control plane reads.

View Source 
const (
	NamespaceTimeout = 60 * time.Second
	// BootstrapTimeout covers the waits the scripts fixed at 120s rather than
	// deriving from --rollout-timeout: the podcertificate controller and the
	// CSI drivers. Pass it through Config.WaitTimeout, which lets the flag
	// raise it without its shorter default lowering it.
	BootstrapTimeout = 120 * time.Second
	// DemoTimeout is longer because a cold cluster pays one-time costs on the
	// first ActorTemplate: downloading runsc, the first gVisor pod start, and
	// image pulls.
	DemoTimeout = 300 * time.Second
)

Timeouts carried over from the --timeout values in the shell installer.

View Source 
const (
	NamespaceAteSystem = "ate-system"
	NamespacePodCert   = "podcertificate-controller-system"
)

Well-known namespaces.

Variables

This section is empty.

Functions

func ActorTemplateFromManifest 

func ActorTemplateFromManifest(manifest []byte) (*ateapipb.ActorTemplate, error)

ActorTemplateFromManifest parses a single protojson-shaped YAML or JSON document into an ActorTemplate, as `kubectl ate create actor-template` does. Parsing is strict: unknown fields are an error, so typos don't silently drop configuration.

func CreateActorTemplate 

func CreateActorTemplate(ctx context.Context, client *ateclient.Client, template *ateapipb.ActorTemplate) error

CreateActorTemplate creates the template through the ate API. Actor templates are immutable (no update RPC), so an existing template is left in place: delete the demo and redeploy to change it.

func EnsureAtespace 

func EnsureAtespace(ctx context.Context, client *ateclient.Client, atespace string) error

EnsureAtespace creates the atespace if it does not already exist. The store enforces that an ActorTemplate's atespace exists at create time.

func SystemOverlay 

func SystemOverlay(cfg *config.Config) string

SystemOverlay picks the manifest source for a full control plane install.

The choice is a product of two switches: kind vs GKE, and the atenet router dataplane. An empty return means "no overlay": apply the base manifests/ate-install directory directly, which is what a plain GKE envoy install does.

func WaitActorTemplateGolden 

func WaitActorTemplateGolden(ctx context.Context, client *ateclient.Client, ref resources.ActorTemplateRef, timeout time.Duration) error

WaitActorTemplateGolden blocks until the template's golden snapshot is built. It fails fast when the template reconciler reports an error.

Types

type BenchmarkOptions 

type BenchmarkOptions struct {
	// WorkerCount is the number of WorkerPool replicas.
	WorkerCount int
	// SandboxClass is the sandbox runtime: gvisor or microvm.
	SandboxClass string
}

BenchmarkOptions shapes the benchmark WorkerPool.

func (BenchmarkOptions) Validate 

func (o BenchmarkOptions) Validate() error

Validate checks the options the shell script would otherwise reject after having already started work.

type Deleter 

type Deleter interface {
	Delete(ctx context.Context, e *Env) error
}

Deleter is the demo teardown DeleteAll drives.

The demos live in their own packages, which import this one for Env, so the interface is declared here rather than imported from there.

type DeployOptions 

type DeployOptions struct {
	// SetupCSI additionally installs the CSI driver (nfs, hostpath, both, none).
	// Kind only. The hostpath driver is Kind only.
	SetupCSI string
}

DeployOptions carries the per-invocation choices for DeployAteSystem.

type Env 

type Env struct {
	Cfg  *config.Config
	Kube *kube.Client
	// contains filtered or unexported fields
}

Env is the shared execution context for every step: resolved configuration plus the clients needed to act on the cluster.

func NewEnv 

func NewEnv(cfg *config.Config) (*Env, error)

NewEnv connects to the cluster described by cfg.

func (*Env) AteClient 

func (e *Env) AteClient(ctx context.Context) (*ateclient.Client, error)

AteClient connects to the ate-api-server, port-forwarding if needed.

func (*Env) AteletDaemonSetName 

func (e *Env) AteletDaemonSetName() (string, error)

func (*Env) CreateAPIAuthenticationConfig 

func (e *Env) CreateAPIAuthenticationConfig(ctx context.Context) error

CreateAPIAuthenticationConfig writes the default ate-api-server authentication config, pointing it at the cluster's service account issuer.

func (*Env) CreateAPIServerEnvVars 

func (e *Env) CreateAPIServerEnvVars(ctx context.Context) error

CreateAPIServerEnvVars writes the ConfigMap that tells ate-api-server how to reach its PostgreSQL store. ate-api-server.yaml pulls it in via an optional envFrom and resolves --postgres-connection-string=@env and --postgres-schema=@env from it.

func (*Env) CreateActorIDCACertsSecret 

func (e *Env) CreateActorIDCACertsSecret(ctx context.Context) error

CreateActorIDCACertsSecret derives a certificate-only trust bundle from the actor-identity CA pool.

The egress gateway verifies actor client certificates and so needs the root, but actor-id-ca-pool also holds the CA signing key. This publishes just the root.

func (*Env) CreateActorIDCAPoolSecret 

func (e *Env) CreateActorIDCAPoolSecret(ctx context.Context) error

CreateActorIDCAPoolSecret generates the actor-identity CA pool.

func (*Env) CreateEgressMITMCAPoolSecret 

func (e *Env) CreateEgressMITMCAPoolSecret(ctx context.Context) error

CreateEgressMITMCAPoolSecret generates the egress MITM CA pool.

func (*Env) CreateJWTAuthorityPoolSecret 

func (e *Env) CreateJWTAuthorityPoolSecret(ctx context.Context) error

CreateJWTAuthorityPoolSecret generates the actor-identity JWT signing pool. This is the make-jwt-pool call create_jwt_authority_pool_secret shelled out to kubectl-ate for.

func (*Env) CreatePodCertificateControllerCAs 

func (e *Env) CreatePodCertificateControllerCAs(ctx context.Context) error

CreatePodCertificateControllerCAs generates the two signer pools the podcertificate controller issues from.

func (*Env) DeleteAll 

func (e *Env) DeleteAll(ctx context.Context, demos []Deleter) error

DeleteAll removes every registered demo and then the control plane.

func (*Env) DeleteAteSystem 

func (e *Env) DeleteAteSystem(ctx context.Context) error

DeleteAteSystem removes the control plane.

PostgreSQL, the agentgateway ConfigMap, and the CRDs are deleted explicitly afterwards because they are not part of every rendered bundle: which of them the install created depends on the router that was selected, and teardown must not depend on remembering that.

func (*Env) DeleteAtenet 

func (e *Env) DeleteAtenet(ctx context.Context) error

DeleteAtenet removes the atenet dataplane.

func (*Env) DeleteBenchmarks 

func (e *Env) DeleteBenchmarks(ctx context.Context, opts BenchmarkOptions) error

DeleteBenchmarks removes the locust stack and the benchmark workloads.

func (*Env) DeleteDemoActors 

func (e *Env) DeleteDemoActors(ctx context.Context, refs ...TemplateRef) error

DeleteDemoActors removes every actor created from the given ActorTemplates.

Demo teardown has to do this before deleting the manifests: an ActorTemplate removed out from under running actors leaves them stranded. As in the shell version, a cluster with no ate-api-server, or an apiserver that cannot be reached, is not an error -- there is nothing to clean up on a cluster that never had the control plane, and DeleteAll runs this for every demo.

func (*Env) DeleteSubstrateDemo 

func (e *Env) DeleteSubstrateDemo(ctx context.Context, refs []resources.ActorTemplateRef, atespaces []string) error

DeleteSubstrateDemo removes a substrate demo's control-plane resources: every actor created from the given templates, then the templates (which server-side also removes their golden actors and snapshots), then the atespaces. As with DeleteDemoActors, a cluster without a reachable ate-api-server is not an error -- there is nothing to clean up.

func (*Env) DeployAteAPIServer 

func (e *Env) DeployAteAPIServer(ctx context.Context) error

DeployAteAPIServer redeploys only ate-api-server.

func (*Env) DeployAteController 

func (e *Env) DeployAteController(ctx context.Context) error

DeployAteController redeploys only ate-controller.

func (*Env) DeployAteSystem 

func (e *Env) DeployAteSystem(ctx context.Context, opts DeployOptions) error

DeployAteSystem installs the whole control plane: CRDs, RBAC, the podcertificate controller, the store, ateapi, the controller, atenet, and atelet.

func (*Env) DeployAtelet 

func (e *Env) DeployAtelet(ctx context.Context) error

DeployAtelet redeploys only the atelet DaemonSet.

func (*Env) DeployAtenet 

func (e *Env) DeployAtenet(ctx context.Context) error

DeployAtenet redeploys the atenet dataplane: router, egress, and DNS.

func (*Env) DeployBenchmarks 

func (e *Env) DeployBenchmarks(ctx context.Context, opts BenchmarkOptions) error

DeployBenchmarks installs the benchmark workloads and the locust load test stack.

func (*Env) DeployCRDs 

func (e *Env) DeployCRDs(ctx context.Context) error

DeployCRDs applies the generated CRDs and RBAC, waiting for them to reach Established condition.

func (*Env) DeployPostgres 

func (e *Env) DeployPostgres(ctx context.Context) error

DeployPostgres deploys the experimental single-replica PostgreSQL StatefulSet on its own.

func (*Env) EnsureAPIServerPrerequisites 

func (e *Env) EnsureAPIServerPrerequisites(ctx context.Context) error

EnsureAPIServerPrerequisites creates the secrets and config ate-api-server needs, skipping anything already present.

func (*Env) EnsureAteSystemNamespace 

func (e *Env) EnsureAteSystemNamespace(ctx context.Context) error

EnsureAteSystemNamespace applies the ate-system namespace manifest and waits for it to go Active. Every deploy path starts here so that RBAC, ConfigMaps, and workloads have somewhere to land.

func (*Env) EnsureCRDs 

func (e *Env) EnsureCRDs(ctx context.Context) error

EnsureCRDs installs the CRDs only if they are missing. Component redeploys use this so they do not pay for a full CRD apply on every run.

func (*Env) EnsureEgressMITMCAPoolSecret 

func (e *Env) EnsureEgressMITMCAPoolSecret(ctx context.Context) error

EnsureEgressMITMCAPoolSecret creates the egress MITM CA pool secret if sdsmint is enabled.

func (*Env) EnsurePodCertificateCAs 

func (e *Env) EnsurePodCertificateCAs(ctx context.Context) error

EnsurePodCertificateCAs creates the podcertificate signer pools if either is missing.

func (*Env) Kustomize 

func (e *Env) Kustomize(overlay string) ([]byte, error)

Kustomize renders an overlay directory under the repository root.

func (*Env) KustomizeResolve 

func (e *Env) KustomizeResolve(ctx context.Context, overlay string) ([]byte, error)

KustomizeResolve renders an overlay and resolves its images, the `kubectl kustomize ... | run_ko resolve -f -` pipeline.

func (*Env) LabelNodesSubstrateVersion 

func (e *Env) LabelNodesSubstrateVersion(ctx context.Context) error

LabelNodesSubstrateVersion stamps ate.dev/substrate-version on every node that does not carry it yet. Nodes that already carry the label keep their value: during a rolling upgrade the operator owns the per-node value, and an install must not yank nodes across versions behind its back.

func (*Env) PublishWorkerImages 

func (e *Env) PublishWorkerImages(ctx context.Context, w io.Writer) error

PublishWorkerImages builds and pushes the ateom images for this build and writes their pushed references to w, one "<binary>: <ref>" line per image, after every build has finished so the refs sit together below ko's build output. A WorkerPool moves to this build by pointing its workerImage at the ref.

func (*Env) RequireKind 

func (e *Env) RequireKind(what string) error

RequireKind fails a step that only makes sense on a local Kind cluster. The Kind-only demos, which live outside this package, use it too.

func (*Env) ResolveAndApply 

func (e *Env) ResolveAndApply(ctx context.Context, path string) error

ResolveAndApply resolves the images in a manifest path and applies the result. This is the run_ko apply of the shell scripts, split into its two real steps.

func (*Env) ResolveAndApplyBytes 

func (e *Env) ResolveAndApplyBytes(ctx context.Context, manifest []byte) error

ResolveAndApplyBytes resolves an in-memory manifest and applies the result.

func (*Env) ResolveManifest 

func (e *Env) ResolveManifest(ctx context.Context, path string) ([]byte, error)

ResolveManifest turns the ko:// references in a manifest path into pullable image references.

func (*Env) ResolveManifestBytes 

func (e *Env) ResolveManifestBytes(ctx context.Context, manifest []byte) ([]byte, error)

ResolveManifestBytes resolves an in-memory manifest, such as kustomize output.

func (*Env) RestartAteletDaemonSets 

func (e *Env) RestartAteletDaemonSets(ctx context.Context) error

RestartAteletDaemonSets pod-restarts every atelet DaemonSet by label.

func (*Env) SetupCSI 

func (e *Env) SetupCSI(ctx context.Context, driver string) error

SetupCSI installs the hostpath and NFS CSI drivers used by external volume demos. Kind only: both drivers are patched for the single-node Kind layout and reach into the node container over docker.

func (*Env) SubstituteVersion 

func (e *Env) SubstituteVersion(manifest []byte) ([]byte, error)

SubstituteVersion fills the ${SUBSTRATE_VERSION} and ${SUBSTRATE_VERSION_SUFFIX} placeholders in a rendered manifest.

func (*Env) SubstrateVersion 

func (e *Env) SubstrateVersion() (version, suffix string, err error)

SubstrateVersion returns the build version and the object-name suffix for atelet. The version is the same one ko stamps into the binaries.

With --image-repo nothing is built, so `git describe` would report the checkout rather than the images being installed. The image tag is the version in that case. It has to be: the version names the atelet DaemonSet and sets the node label that partitions nodes across coexisting versions, so it must describe the atelet that is actually running, which came from the image. VERSION still wins over both, so a tag that is not a valid label value can be worked around the same way.

func (*Env) UnlabelNodesSubstrateVersion 

func (e *Env) UnlabelNodesSubstrateVersion(ctx context.Context) error

UnlabelNodesSubstrateVersion clears ate.dev/substrate-version from every node that carries it. Uninstall removes the label with the system: the install won't relabels a labeled node, so a leftover label would pin the next install to the old version world.

func (*Env) WaitForPodCertificateTrustBundles 

func (e *Env) WaitForPodCertificateTrustBundles(ctx context.Context) error

WaitForPodCertificateTrustBundles blocks until the podcertificate controller has published both identity bundles.

type TemplateRef 

type TemplateRef struct {
	// Atespace the object lives in. The demos name each atespace after the
	// k8s namespace holding its worker pool, so this field also addresses
	// the namespaced objects a demo waits on, such as pool Deployments.
	Atespace string
	Name     string
}

TemplateRef identifies a demo's ActorTemplate. Actors are deleted by matching against it because the demo manifests own the template, not the actors that were created from it.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.