Documentation
¶
Overview ¶
Package steps holds the install and teardown operations that the shell installer implemented as bash functions. Each exported function corresponds to one of those and keeps its name in the [step] log line.
Index ¶
- Constants
- func ActorTemplateFromManifest(manifest []byte) (*ateapipb.ActorTemplate, error)
- func CreateActorTemplate(ctx context.Context, client *ateclient.Client, ...) error
- func EnsureAtespace(ctx context.Context, client *ateclient.Client, atespace string) error
- func SystemOverlay(cfg *config.Config) string
- func ValidateCSIDriver(driver string) error
- func WaitActorTemplateGolden(ctx context.Context, client *ateclient.Client, ref resources.ActorTemplateRef, ...) error
- type BenchmarkOptions
- type Deleter
- type DeployOptions
- type Env
- func (e *Env) AteClient(ctx context.Context) (*ateclient.Client, error)
- func (e *Env) AteletDaemonSetName() (string, error)
- func (e *Env) CheckCSIDriver(driver string) error
- func (e *Env) CreateAPIAuthenticationConfig(ctx context.Context) error
- func (e *Env) CreateAPIServerEnvVars(ctx context.Context) error
- func (e *Env) CreateActorIDCACertsSecret(ctx context.Context) error
- func (e *Env) CreateActorIDCAPoolSecret(ctx context.Context) error
- func (e *Env) CreateEgressMITMCAPoolSecret(ctx context.Context) error
- func (e *Env) CreateJWTAuthorityPoolSecret(ctx context.Context) error
- func (e *Env) CreatePodCertificateControllerCAs(ctx context.Context) error
- func (e *Env) DeleteAll(ctx context.Context, demos []Deleter) error
- func (e *Env) DeleteAteSystem(ctx context.Context) error
- func (e *Env) DeleteAtenet(ctx context.Context) error
- func (e *Env) DeleteBenchmarks(ctx context.Context, opts BenchmarkOptions) error
- func (e *Env) DeleteSubstrateDemo(ctx context.Context, refs []resources.ActorTemplateRef, atespaces []string) error
- func (e *Env) DeployAteAPIServer(ctx context.Context) error
- func (e *Env) DeployAteController(ctx context.Context) error
- func (e *Env) DeployAteSystem(ctx context.Context, opts DeployOptions) error
- func (e *Env) DeployAtelet(ctx context.Context) error
- func (e *Env) DeployAtenet(ctx context.Context) error
- func (e *Env) DeployBenchmarks(ctx context.Context, opts BenchmarkOptions) error
- func (e *Env) DeployCRDs(ctx context.Context) error
- func (e *Env) DeployPodCertificateController(ctx context.Context) error
- func (e *Env) DeployPostgres(ctx context.Context) error
- func (e *Env) DeploySandboxConfig(ctx context.Context) error
- func (e *Env) EnsureAPIServerPrerequisites(ctx context.Context) error
- func (e *Env) EnsureAteSystemNamespace(ctx context.Context) error
- func (e *Env) EnsureCRDs(ctx context.Context) error
- func (e *Env) EnsureEgressMITMCAPoolSecret(ctx context.Context) error
- func (e *Env) EnsureEnvVarsSafeStandalone(ctx context.Context) error
- func (e *Env) EnsurePodCertificateCAs(ctx context.Context) error
- func (e *Env) Kustomize(overlay string) ([]byte, error)
- func (e *Env) KustomizeResolve(ctx context.Context, overlay string) ([]byte, error)
- func (e *Env) LabelNodesSubstrateVersion(ctx context.Context) error
- func (e *Env) Namespace() string
- func (e *Env) PublishWorkerImages(ctx context.Context, w io.Writer) error
- func (e *Env) RequireCanonicalNamespace(step string) error
- func (e *Env) RequireKind(what string) error
- func (e *Env) ResolveAndApply(ctx context.Context, path string) error
- func (e *Env) ResolveAndApplyBytes(ctx context.Context, manifest []byte) error
- func (e *Env) ResolveManifest(ctx context.Context, path string) ([]byte, error)
- func (e *Env) ResolveManifestBytes(ctx context.Context, manifest []byte) ([]byte, error)
- func (e *Env) RestartAteletDaemonSets(ctx context.Context) error
- func (e *Env) SetupCSI(ctx context.Context, driver string) error
- func (e *Env) SubstituteVersion(manifest []byte) ([]byte, error)
- func (e *Env) SubstrateVersion() (version, suffix string, err error)
- func (e *Env) UnlabelNodesSubstrateVersion(ctx context.Context) error
- func (e *Env) WaitForPodCertificateTrustBundles(ctx context.Context) error
- type TemplateRef
Constants ¶
const ( SecretActorIDJWTPool = "actor-id-jwt-pool" SecretActorIDCAPool = "actor-id-ca-pool" SecretActorIDCACerts = "actor-id-ca-certs" SecretServiceDNSCA = "service-dns-ca-pool" SecretPodIdentityCA = "pod-identity-ca-pool" SecretEgressMITMCAPool = "egress-mitm-ca-pool" SecretAPIEnvVars = "ate-api-server-secret-envvars" SecretPostgresServerCA = "postgres-server-ca" ConfigMapAPIEnvVars = "ate-api-server-envvars" ConfigMapAPIAuthn = "ate-api-authentication" )
Secret and ConfigMap names the control plane reads.
const ( NamespaceTimeout = 60 * time.Second // BootstrapTimeout covers the waits the scripts fixed at 120s rather than // deriving from --rollout-timeout: the podcertificate controller and the // CSI drivers. Pass it through Config.WaitTimeout, which lets the flag // raise it without its shorter default lowering it. BootstrapTimeout = 120 * time.Second // TrustBundleTimeout bounds the wait for the podcertificate controller's // first ClusterTrustBundles, shared across both bundles. The controller is // Ready before it has signed anything, so this covers its first pass over // the CA pools rather than a rollout. Config.WaitTimeout applies here too. TrustBundleTimeout = 300 * time.Second // DemoTimeout is longer because a cold cluster pays one-time costs on the // first ActorTemplate: downloading runsc, the first gVisor pod start, and // image pulls. DemoTimeout = 300 * time.Second )
Timeouts carried over from the --timeout values in the shell installer.
const ( // NamespaceAteSystem is the canonical control-plane namespace. It is the // default for Config.Namespace and the only value the checked-in manifests // under manifests/ate-install/ carry; steps address the installed control // plane through Env.Namespace rather than this constant. NamespaceAteSystem = "ate-system" NamespacePodCert = "podcertificate-controller-system" )
Well-known namespaces.
Variables ¶
This section is empty.
Functions ¶
func ActorTemplateFromManifest ¶
func ActorTemplateFromManifest(manifest []byte) (*ateapipb.ActorTemplate, error)
ActorTemplateFromManifest parses a single protojson-shaped YAML or JSON document into an ActorTemplate, as `kubectl ate create actor-template` does. Parsing is strict: unknown fields are an error, so typos don't silently drop configuration.
func CreateActorTemplate ¶
func CreateActorTemplate(ctx context.Context, client *ateclient.Client, template *ateapipb.ActorTemplate) error
CreateActorTemplate creates the template through the ate API. Actor templates are immutable (no update RPC), so an existing template is left in place: delete the demo and redeploy to change it.
func EnsureAtespace ¶
EnsureAtespace creates the atespace if it does not already exist. The store enforces that an ActorTemplate's atespace exists at create time.
func SystemOverlay ¶
SystemOverlay picks the kustomization for a full control plane install.
The choice is a product of two switches: kind vs GKE, and the atenet router dataplane. The plain GKE envoy install renders the base kustomization rather than the raw manifests/ate-install directory: the directory would also re-apply pod-certificate-controller.yaml (reverting the size10 flags and the WORKERS_PER_SIGNER value set earlier in the install), both atenet-egress variants, and the sandboxconfig files, all of which have their own apply steps.
func ValidateCSIDriver ¶ added in v0.2.0
ValidateCSIDriver reports whether driver names something --setup-csi accepts.
This is the half of the check that needs neither configuration nor a cluster, so the commands run it while cobra is still validating arguments: a typo should not cost a credential fetch, let alone an install.
func WaitActorTemplateGolden ¶
func WaitActorTemplateGolden(ctx context.Context, client *ateclient.Client, ref resources.ActorTemplateRef, timeout time.Duration) error
WaitActorTemplateGolden blocks until the template's golden snapshot is built. It fails fast when the template reconciler reports an error.
Types ¶
type BenchmarkOptions ¶
type BenchmarkOptions struct {
// WorkerCount is the number of WorkerPool replicas.
WorkerCount int
// SandboxClass is the sandbox runtime: gvisor or microvm.
SandboxClass string
}
BenchmarkOptions shapes the benchmark WorkerPool.
func (BenchmarkOptions) Validate ¶
func (o BenchmarkOptions) Validate() error
Validate is a precondition on the exported benchmark methods. The commands check the same two settings first and report which channel supplied a bad value; these messages name the field, because a caller that reaches them built the options itself and has no channel to be sent to.
type Deleter ¶
Deleter is the demo teardown DeleteAll drives.
The demos live in their own packages, which import this one for Env, so the interface is declared here rather than imported from there.
type DeployOptions ¶
type DeployOptions struct {
// SetupCSI additionally installs the CSI driver (nfs, hostpath, both, none).
// Kind only. The hostpath driver is Kind only.
SetupCSI string
}
DeployOptions carries the per-invocation choices for DeployAteSystem.
func (DeployOptions) Validate ¶ added in v0.2.0
func (o DeployOptions) Validate() error
Validate checks the options that can be checked without configuration or a cluster, so the command can reject them while cobra is still parsing.
type Env ¶
Env is the shared execution context for every step: resolved configuration plus the clients needed to act on the cluster.
func (*Env) AteletDaemonSetName ¶
func (*Env) CheckCSIDriver ¶ added in v0.2.0
CheckCSIDriver is ValidateCSIDriver plus the part that needs the resolved configuration: the hostpath driver exists only for Kind.
DeployAteSystem calls it before it installs anything, so that `--setup-csi=hostpath` against a cluster that is not Kind is refused up front rather than after a full control-plane install.
func (*Env) CreateAPIAuthenticationConfig ¶
CreateAPIAuthenticationConfig writes the default ate-api-server authentication config, pointing it at the cluster's service account issuer.
func (*Env) CreateAPIServerEnvVars ¶
CreateAPIServerEnvVars reconciles how ate-api-server reaches its PostgreSQL store: both DSNs and the schema into the ate-api-server-secret-envvars Secret, stable roles and Cloud SQL settings into the ConfigMap, and an external server CA into postgres-server-ca.
ate-api-server.yaml pulls both in through optional envFrom sources and resolves the PostgreSQL connection, role, and schema flags from the result. It lists the secretRef last, so the Secret wins over a DSN a previous installer left in the ConfigMap.
func (*Env) CreateActorIDCACertsSecret ¶
CreateActorIDCACertsSecret derives a certificate-only trust bundle from the actor-identity CA pool.
The egress gateway verifies actor client certificates and so needs the root, but actor-id-ca-pool also holds the CA signing key. This publishes just the root.
func (*Env) CreateActorIDCAPoolSecret ¶
CreateActorIDCAPoolSecret generates the actor-identity CA pool.
func (*Env) CreateEgressMITMCAPoolSecret ¶
CreateEgressMITMCAPoolSecret generates the egress MITM CA pool.
func (*Env) CreateJWTAuthorityPoolSecret ¶
CreateJWTAuthorityPoolSecret generates the actor-identity JWT signing pool. This is the make-jwt-pool call create_jwt_authority_pool_secret shelled out to kubectl-ate for.
func (*Env) CreatePodCertificateControllerCAs ¶
CreatePodCertificateControllerCAs generates the two signer pools the podcertificate controller issues from.
func (*Env) DeleteAteSystem ¶
DeleteAteSystem removes the control plane.
PostgreSQL, the agentgateway ConfigMap, the bundled credential provider, and the CRDs are deleted explicitly because they are not part of every rendered bundle: which of them the install created depends on the router and credential provider that were selected, and teardown must not depend on remembering that. The provider goes first so that a later failure cannot leave its ClusterRole and binding behind.
func (*Env) DeleteAtenet ¶
DeleteAtenet removes the atenet dataplane and the bundled credential provider, deleting the provider first so that a later failure cannot leave its ClusterRole and binding behind. The provider's policy ConfigMap stays: it holds the operator's allow-list.
func (*Env) DeleteBenchmarks ¶
func (e *Env) DeleteBenchmarks(ctx context.Context, opts BenchmarkOptions) error
DeleteBenchmarks removes the locust stack and the benchmark workloads.
func (*Env) DeleteSubstrateDemo ¶
func (e *Env) DeleteSubstrateDemo(ctx context.Context, refs []resources.ActorTemplateRef, atespaces []string) error
DeleteSubstrateDemo removes a substrate demo's control-plane resources: every actor created from the given templates, then the templates (which server-side also removes their golden actors and snapshots), then the atespaces. A cluster without a reachable ate-api-server is not an error -- there is nothing to clean up.
func (*Env) DeployAteAPIServer ¶
DeployAteAPIServer redeploys only ate-api-server.
func (*Env) DeployAteController ¶
DeployAteController redeploys only ate-controller.
func (*Env) DeployAteSystem ¶
func (e *Env) DeployAteSystem(ctx context.Context, opts DeployOptions) error
DeployAteSystem installs the whole control plane: CRDs, RBAC, the podcertificate controller, the store, ateapi, the controller, atenet, and atelet.
func (*Env) DeployAtelet ¶
DeployAtelet redeploys only the atelet DaemonSet.
func (*Env) DeployAtenet ¶
DeployAtenet redeploys the atenet dataplane: router and egress.
func (*Env) DeployBenchmarks ¶
func (e *Env) DeployBenchmarks(ctx context.Context, opts BenchmarkOptions) error
DeployBenchmarks installs the benchmark workloads and the locust load test stack.
func (*Env) DeployCRDs ¶
DeployCRDs applies the generated CRDs and RBAC, waiting for them to reach Established condition.
func (*Env) DeployPodCertificateController ¶ added in v0.2.0
DeployPodCertificateController applies the podcertificate controller and waits until it is rolling and has published its trust bundles.
size10 clusters render the podcert-size10 overlay instead of the base file. It appends --kube-api-qps=100 / --kube-api-burst=200 so the controller keeps up with the request volume the size10 postgres profile enables. An overlay rather than a post-apply patch, so that no later apply of the base file can reconcile the flags away; the base kustomization leaves the file out for the same reason.
--podcert-workers-per-signer is set on the rendered objects for the same reason: one apply means one rollout, and the rollout wait sees the pod that will actually serve.
func (*Env) DeployPostgres ¶
DeployPostgres deploys the experimental single-replica PostgreSQL StatefulSet on its own.
func (*Env) DeploySandboxConfig ¶ added in v0.3.0
DeploySandboxConfig applies the SandboxConfig admission policy, then the default gVisor SandboxConfig.
func (*Env) EnsureAPIServerPrerequisites ¶
EnsureAPIServerPrerequisites creates the secrets and config ate-api-server needs, skipping anything already present.
func (*Env) EnsureAteSystemNamespace ¶
EnsureAteSystemNamespace creates the control-plane namespace and waits for it to go Active. Every deploy path starts here so that RBAC, ConfigMaps, and workloads have somewhere to land.
The canonical namespace comes from the checked-in manifest, which carries labels of its own and stays the source of truth for it. Any other namespace is created plainly, because that manifest names ate-system literally.
func (*Env) EnsureCRDs ¶
EnsureCRDs installs the CRDs only if they are missing. Component redeploys use this so they do not pay for a full CRD apply on every run.
func (*Env) EnsureEgressMITMCAPoolSecret ¶
EnsureEgressMITMCAPoolSecret creates the egress MITM CA pool secret. Both dataplanes need it: the agentgateway-egress overlay mounts the same Secret the envoy egress does.
func (*Env) EnsureEnvVarsSafeStandalone ¶ added in v0.2.0
EnsureEnvVarsSafeStandalone guards `ate-setup create api-server-env-vars` on a cluster installed before the DSN moved from the ConfigMap to the Secret. Rewriting the environment alone would prune the ConfigMap key and leave the running Deployment without a DSN on its next restart. A full deploy is safe because it updates the Deployment in the same run.
func (*Env) EnsurePodCertificateCAs ¶
EnsurePodCertificateCAs creates the podcertificate signer pools if either is missing.
func (*Env) KustomizeResolve ¶
KustomizeResolve renders an overlay and resolves its images, the `kubectl kustomize ... | run_ko resolve -f -` pipeline.
func (*Env) LabelNodesSubstrateVersion ¶
LabelNodesSubstrateVersion stamps ate.dev/substrate-version on every node that does not carry it yet. Nodes that already carry the label keep their value: during a rolling upgrade the operator owns the per-node value, and an install must not yank nodes across versions behind its back.
func (*Env) Namespace ¶ added in v0.2.0
Namespace is the namespace the control plane is installed into. It is Config.Namespace, which defaults to NamespaceAteSystem.
func (*Env) PublishWorkerImages ¶
PublishWorkerImages builds and pushes the ateom images for this build and writes their pushed references to w, one "<binary>: <ref>" line per image, after every build has finished so the refs sit together below ko's build output. A WorkerPool moves to this build by pointing its workerImage at the ref.
func (*Env) RequireCanonicalNamespace ¶ added in v0.2.0
RequireCanonicalNamespace refuses a relocated install for the steps that apply the checked-in manifests. Those manifests name ate-system literally, so proceeding would put the workloads there while this tool created their secrets and ConfigMaps somewhere else — an install that comes up far enough to look healthy and then fails on a missing envFrom source.
func (*Env) RequireKind ¶
RequireKind fails a step that only makes sense on a local Kind cluster. The Kind-only demos, which live outside this package, use it too.
func (*Env) ResolveAndApply ¶
ResolveAndApply resolves the images in a manifest path and applies the result. This is the run_ko apply of the shell scripts, split into its two real steps.
func (*Env) ResolveAndApplyBytes ¶
ResolveAndApplyBytes resolves an in-memory manifest and applies the result.
func (*Env) ResolveManifest ¶
ResolveManifest turns the ko:// references in a manifest path into pullable image references.
func (*Env) ResolveManifestBytes ¶
ResolveManifestBytes resolves an in-memory manifest, such as kustomize output.
func (*Env) RestartAteletDaemonSets ¶
RestartAteletDaemonSets pod-restarts every atelet DaemonSet by label.
func (*Env) SetupCSI ¶
SetupCSI installs the hostpath and NFS CSI drivers used by external volume demos. The hostpath driver is Kind only: it is patched for the single-node Kind layout and reaches into the node container over docker.
func (*Env) SubstituteVersion ¶
SubstituteVersion fills the ${SUBSTRATE_VERSION} and ${SUBSTRATE_VERSION_SUFFIX} placeholders in a rendered manifest.
func (*Env) SubstrateVersion ¶
SubstrateVersion returns the build version and the object-name suffix for atelet. The version is the same one ko stamps into the binaries.
With --image-repo nothing is built, so `git describe` would report the checkout rather than the images being installed. The image tag is the version in that case. It has to be: the version names the atelet DaemonSet and sets the node label that partitions nodes across coexisting versions, so it must describe the atelet that is actually running, which came from the image. VERSION still wins over both, so a tag that is not a valid label value can be worked around the same way.
func (*Env) UnlabelNodesSubstrateVersion ¶
UnlabelNodesSubstrateVersion clears ate.dev/substrate-version from every node that carries it. Uninstall removes the label with the system: the install won't relabels a labeled node, so a leftover label would pin the next install to the old version world.
type TemplateRef ¶
type TemplateRef struct {
// Atespace the object lives in. The demos name each atespace after the
// k8s namespace holding its worker pool, so this field also addresses
// the namespaced objects a demo waits on, such as pool Deployments.
Atespace string
Name string
}
TemplateRef identifies a demo's ActorTemplate. Actors are deleted by matching against it because the demo manifests own the template, not the actors that were created from it.
Source Files