plugin

package
v0.7.24 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 11, 2026 License: Apache-2.0 Imports: 61 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func ApplyTestHack added in v0.7.20 

func ApplyTestHack(cfg *RenderConfig)

ApplyTestHack overrides cfg's time-sensitive hooks for deterministic output: a fixed Now, a fixed "1m" DurationRound, and a fixed "started after" clause. Real creation and kubelet-ack timestamps only carry 1-second resolution over the wire, so whether the "started after" clause appears is otherwise a coin flip; this forces it present whenever Status.startTime is set.

Both the "--test-hack" CLI flag (cmd/main.go, used by `make update-artifacts`/`make new-artifact`) and the e2e test suite (cmd/e2e_*_test.go) call this, so the artifacts generated on disk and the output the tests compare against can never drift apart.

func DefaultDurationRound added in v0.7.14 

func DefaultDurationRound() func(duration interface{}) string

func Run added in v0.7.0 

func Run(f util.Factory, streams genericiooptions.IOStreams, args []string, cfg *RenderConfig) error

Types

type IstioHostRef added in v0.7.24 

type IstioHostRef struct {
	// Key is the canonical form two host references compare on. Two references with the same
	// Key name the same thing; an empty Key means there was nothing to resolve.
	Key string
	// Name and Namespace are the Service the reference resolves to. Both empty unless InCluster.
	Name      string
	Namespace string
	// InCluster is true when the reference names a Service in this cluster, as opposed to an
	// external host (usually backed by a ServiceEntry) or a wildcard pattern.
	InCluster bool
}

IstioHostRef is the resolved form of an Istio host reference -- the string a VirtualService destination, a VirtualService/DestinationRule host or a mirror target points at.

type OwnersResult added in v0.7.19 

type OwnersResult struct {
	Owners  []RenderableObject
	Orphans []metav1.OwnerReference
}

OwnersResult is the result of resolving an object's ownerReferences: the owner objects that could be found, plus any ownerReferences whose owner no longer exists (orphans).

type RenderConfig added in v0.7.20 

type RenderConfig struct {
	Viper              *viper.Viper
	Now                func() time.Time
	DurationRound      func(duration interface{}) string
	StartedAfterClause func(createdKubeDate, startedKubeDate string) string
	// StatefulSetRollbackTrapThreshold is how long a StatefulSet-owned Pod must have been unready
	// before StatefulSetRollbackTrap treats it as evidence of the kubernetes/kubernetes#67250
	// "stuck rollback" trap, rather than ordinary image-pull/startup latency. Deliberately
	// compared against real wall-clock time (not Now, which tests freeze to a fixed date for
	// deterministic rendering) and left overridable here so e2e tests don't need to wait out the
	// real default.
	StatefulSetRollbackTrapThreshold time.Duration
}

RenderConfig carries the per-invocation configuration and time/duration hooks that template functions read, so that concurrent renders (e.g. parallel e2e subtests) don't share mutable process-global state. Viper is a *viper.Viper instance owned by this invocation (not the package-level global singleton); Now/DurationRound/StartedAfterClause default to the real implementations and are only overridden by tests.

func NewRenderConfig added in v0.7.20 

func NewRenderConfig(v *viper.Viper) *RenderConfig

NewRenderConfig builds a RenderConfig backed by v, with the real Now/DurationRound/ StartedAfterClause implementations.

type RenderableObject added in v0.7.0 

type RenderableObject struct {
	unstructured.Unstructured

	Config *viper.Viper
	// contains filtered or unexported fields
}

RenderableObject is the object passed to the templates, also provides methods to run queries against Kubernetes API. It is an unstructured.Unstructured (so it has the Object field that keeps the Object) but there a numerous helper methods that already helps with the templates.

func (RenderableObject) APIVersion added in v0.7.24 

func (r RenderableObject) APIVersion() (apiVersion string)

func (RenderableObject) Annotations added in v0.7.0 

func (r RenderableObject) Annotations() (annotations map[string]interface{})

func (RenderableObject) DefaultResourceTemplates added in v0.7.24 

func (r RenderableObject) DefaultResourceTemplates() []string

DefaultResourceTemplates returns, in registration order, the name of every template that DefaultResource (common.tmpl) should render for r in addition to the generic per-object skeleton, as decided by defaultResourceDetectors. Called from DefaultResource as `{{- range .DefaultResourceTemplates }}{{ template . $ }}{{- end }}`.

func (RenderableObject) HealthSummary added in v0.7.24 

func (r RenderableObject) HealthSummary(callerNamespace string) (string, error)

HealthSummary renders this object's compact one-line summary: its own paired "<Kind>.summary"/"<Kind>.<group>.summary" template if one is defined -- built-in (living alongside that Kind's own <Kind>.tmpl) or a user override/CRD-author-provided one, discovered the same way a "<Kind>.tmpl" full view already is -- falling back to generic_health_summary otherwise. This is what resource_health_summary calls; see https://github.com/bergerx/kubectl-status/issues/826 for why it's a lookup rather than a hand-maintained per-Kind chain.

func (RenderableObject) Include added in v0.7.0 

func (r RenderableObject) Include(templateName string, data interface{}) (string, error)

func (RenderableObject) IncludeRenderableObject added in v0.7.0 

func (r RenderableObject) IncludeRenderableObject(obj RenderableObject) (output string)

func (RenderableObject) KStatus added in v0.7.2 

func (r RenderableObject) KStatus() *kstatus.Result

KStatus return a Result object of kstatus for the object.

func (RenderableObject) Kind added in v0.7.0 

func (r RenderableObject) Kind() (kind string)

func (RenderableObject) KubeGet added in v0.7.0 

func (r RenderableObject) KubeGet(namespace string, args ...string) (out []RenderableObject)

func (RenderableObject) KubeGetByLabelsMap added in v0.7.0 

func (r RenderableObject) KubeGetByLabelsMap(namespace, resourceType string, labels map[string]interface{}) (out []RenderableObject)

KubeGetByLabelsMap returns results similar to this: 

> kubectl get -n {namespace} {resourceType} -l {label_key=label_val,...}

func (RenderableObject) KubeGetCalicoGlobalNetworkPoliciesMatchingPod added in v0.7.19 

func (r RenderableObject) KubeGetCalicoGlobalNetworkPoliciesMatchingPod(namespace string, podLabels map[string]interface{}) (out []RenderableObject)

KubeGetCalicoGlobalNetworkPoliciesMatchingPod returns all Calico GlobalNetworkPolicies whose spec.selector matches podLabels and whose spec.namespaceSelector (if any) accepts the Pod's namespace. GlobalNetworkPolicy is cluster-scoped -- an empty namespaceSelector matches every namespace rather than being confined to the Pod's own namespace, unlike the namespaced Calico NetworkPolicy case -- so the Namespace object is fetched once to evaluate namespaceSelector against its labels (via calicoNamespaceSelectorMatches).

func (RenderableObject) KubeGetCalicoNetworkPoliciesMatchingPod added in v0.7.19 

func (r RenderableObject) KubeGetCalicoNetworkPoliciesMatchingPod(namespace string, podLabels map[string]interface{}) (out []RenderableObject)

KubeGetCalicoNetworkPoliciesMatchingPod returns all Calico NetworkPolicies in namespace whose spec.selector matches podLabels. Calico's own NetworkPolicy kind is served under the crd.projectcalico.org/v1 group -- a different API group than both upstream networking.k8s.io/v1 NetworkPolicy and the projectcalico.org/v3 API calicoctl/the optional Calico API server present -- because kubectl-status only ever talks to the Kubernetes API server directly, and crd.projectcalico.org/v1 is what the CRD-backed ("Kubernetes datastore") storage actually serves there; "networkpolicies.crd.projectcalico.org" disambiguates the kind so the resource builder resolves the right CRD. See calicoPolicySelectsPod for why this evaluates Calico's own selector expression language rather than treating spec.selector as a Kubernetes LabelSelector. Degrades to "no policies found" the same way as KubeGetCiliumNetworkPoliciesMatchingPod when the CRD isn't registered.

func (RenderableObject) KubeGetCiliumClusterwideNetworkPoliciesMatchingPod added in v0.7.19 

func (r RenderableObject) KubeGetCiliumClusterwideNetworkPoliciesMatchingPod(podLabels map[string]interface{}) (out []RenderableObject)

KubeGetCiliumClusterwideNetworkPoliciesMatchingPod returns all CiliumClusterwideNetworkPolicies whose endpointSelector matches podLabels. CiliumClusterwideNetworkPolicy is cluster-scoped, so unlike CiliumNetworkPolicy it can select Pods in any namespace -- there's no namespace filter on the list, only the label match. See KubeGetCiliumNetworkPoliciesMatchingPod for the missing-CRD handling, which applies here identically.

func (RenderableObject) KubeGetCiliumNetworkPoliciesMatchingPod added in v0.7.19 

func (r RenderableObject) KubeGetCiliumNetworkPoliciesMatchingPod(namespace string, podLabels map[string]interface{}) (out []RenderableObject)

KubeGetCiliumNetworkPoliciesMatchingPod returns all CiliumNetworkPolicies in namespace whose spec/specs endpointSelector matches podLabels -- same client-side matching approach as KubeGetNetworkPoliciesMatchingPod, since CiliumNetworkPolicy has no back-reference to the Pods it covers either. CiliumNetworkPolicy is an optional CRD (only present when Cilium is the CNI); when it's not registered, r.repo.Objects returns an error (unknown resource type), which is swallowed the same way as any other listing error below -- this degrades to "no policies found" rather than failing the render, exactly like the upstream NetworkPolicy helper already does when e.g. RBAC denies the list.

func (RenderableObject) KubeGetContainerLogs added in v0.7.19 

func (r RenderableObject) KubeGetContainerLogs(namespace, podName, containerName string, previous bool, tailLines int) string

KubeGetContainerLogs returns up to tailLines lines of log output for the named container in the named pod. When previous is true it fetches logs from the container's previous (terminated) instance, equivalent to `kubectl logs --previous`. Returns an empty string if there are no logs or the fetch fails.

func (RenderableObject) KubeGetEndpointSlicesForService added in v0.7.15 

func (r RenderableObject) KubeGetEndpointSlicesForService(namespace, serviceName string) (out []RenderableObject)

KubeGetEndpointSlicesForService returns EndpointSlices associated with the given service.

func (RenderableObject) KubeGetEvents added in v0.7.0 

func (r RenderableObject) KubeGetEvents() RenderableObject

func (RenderableObject) KubeGetFirst added in v0.7.0 

func (r RenderableObject) KubeGetFirst(namespace string, args ...string) RenderableObject

KubeGetFirst returns a new RenderableObject with a nil Object when no object found.

func (RenderableObject) KubeGetGatekeeperConstraintsMatchingNamespace added in v0.7.24 

func (r RenderableObject) KubeGetGatekeeperConstraintsMatchingNamespace() (out []RenderableObject)

KubeGetGatekeeperConstraintsMatchingNamespace returns every live Gatekeeper Constraint (of any kind an installed ConstraintTemplate declares) whose spec.match would admit objects created in this Namespace, per gatekeeperConstraintMatchesNamespace. There is no single "constraint" resource to list -- Gatekeeper generates one CRD per ConstraintTemplate (K8sRequiredLabels, K8sAllowedRepos, ...) -- so every installed ConstraintTemplate's declared Kind is discovered first and then listed in turn. Called on the Namespace RenderableObject itself (like KubeGetEvents), not given one as a parameter, since it only ever makes sense for the object being rendered.

func (RenderableObject) KubeGetIngressesMatchingService added in v0.7.0 

func (r RenderableObject) KubeGetIngressesMatchingService(namespace, svcName string) (out []RenderableObject)

func (RenderableObject) KubeGetNetworkPoliciesMatchingPod added in v0.7.19 

func (r RenderableObject) KubeGetNetworkPoliciesMatchingPod(namespace string, podLabels map[string]interface{}) (out []RenderableObject)

KubeGetNetworkPoliciesMatchingPod returns all NetworkPolicies in namespace whose spec.podSelector matches podLabels -- the mirror direction of KubeGetServicesMatchingPod: a Service's selector is matched against a Pod's labels via endpoints, but a NetworkPolicy has no reference back to the Pods it covers, so every policy in the Pod's namespace has to be listed and its podSelector checked client-side. See networkPolicySelectsPod for the selector-matching semantics.

func (RenderableObject) KubeGetNodeConfigz added in v0.7.20 

func (r RenderableObject) KubeGetNodeConfigz(nodeName string) map[string]interface{}

func (RenderableObject) KubeGetNodeHealthz added in v0.7.20 

func (r RenderableObject) KubeGetNodeHealthz(nodeName string) string

KubeGetNodeHealthz returns the kubelet proxy healthz body, or a description of the failure if the apiserver->kubelet proxy path is unreachable. The error is surfaced (not swallowed) since a failure here is the whole point of the check.

func (RenderableObject) KubeGetNodeMetrics added in v0.7.19 

func (r RenderableObject) KubeGetNodeMetrics(name string) RenderableObject

KubeGetNodeMetrics returns the NodeMetrics for the named node. It fetches NodeMetrics for the whole cluster once per render (via the KubeGet cache) so that rendering multiple nodes only requires a single metrics.k8s.io request instead of one per node.

func (RenderableObject) KubeGetNodeStatsSummary added in v0.7.0 

func (r RenderableObject) KubeGetNodeStatsSummary(nodeName string) map[string]interface{}

func (RenderableObject) KubeGetNonTerminatedPodsOnNode added in v0.7.0 

func (r RenderableObject) KubeGetNonTerminatedPodsOnNode(nodeName string) (podList []RenderableObject)

KubeGetNonTerminatedPodsOnNode returns details of all pods which are not in terminal status

func (RenderableObject) KubeGetOwners added in v0.7.0 

func (r RenderableObject) KubeGetOwners() (out OwnersResult)

KubeGetOwners resolves the Owner references of an object, returning both the owners that could be found and any ownerReferences left dangling because their owner no longer exists.

func (RenderableObject) KubeGetPodDisruptionBudgetsMatchingLabels added in v0.7.19 

func (r RenderableObject) KubeGetPodDisruptionBudgetsMatchingLabels(namespace string, labels_ map[string]interface{}) (out []RenderableObject)

KubeGetPodDisruptionBudgetsMatchingLabels returns all PodDisruptionBudgets in namespace whose spec.selector matches the given label set. PDB spec.selector is a full metav1.LabelSelector (matchLabels + matchExpressions), unlike Service selectors, so this uses real LabelSelectorAsSelector/.Matches semantics rather than the isSubset helper. An empty selector (spec.selector: {}) is valid in policy/v1 and matches every pod in the namespace, unlike the removed policy/v1beta1 where it matched none -- policy/v1beta1 is no longer served as of Kubernetes 1.25, so that legacy case isn't handled here.

func (RenderableObject) KubeGetPodMetrics added in v0.7.19 

func (r RenderableObject) KubeGetPodMetrics(namespace, name string) RenderableObject

KubeGetPodMetrics returns the PodMetrics for the named pod. It first tries a single cluster-wide PodMetrics list, reused for every pod/node in the render (see AllNamespacesPodMetrics). If that's not available (e.g. RBAC only allows namespace-scoped access), it falls back to fetching PodMetrics for the whole namespace once per render, so that rendering multiple pods in the same namespace still only requires a single metrics.k8s.io request instead of one per pod.

func (RenderableObject) KubeGetRoutesMatchingService added in v0.7.18 

func (r RenderableObject) KubeGetRoutesMatchingService(namespace, svcName string) (out []RenderableObject)

KubeGetRoutesMatchingService lists Gateway API route resources (HTTPRoute, GRPCRoute, TCPRoute, UDPRoute, TLSRoute) whose spec.rules[].backendRefs[] reference the given Service. All 5 route kinds share the same rules[].backendRefs[].name shape, so a single implementation covers them.

func (RenderableObject) KubeGetServicesMatchingLabels added in v0.7.0 

func (r RenderableObject) KubeGetServicesMatchingLabels(namespace string, labels map[string]interface{}) (out []RenderableObject)

func (RenderableObject) KubeGetServicesMatchingPod added in v0.7.7 

func (r RenderableObject) KubeGetServicesMatchingPod(namespace, podName string) (out []RenderableObject)

func (RenderableObject) KubeGetUnifiedDiffString added in v0.7.0 

func (r RenderableObject) KubeGetUnifiedDiffString(resourceOrKind, namespace, nameA, nameB string) string

KubeGetUnifiedDiffString generates a unified diff between given 2 resources and ignores several keys which are known to be creating noise in diff, see the removeFieldsThatCreateDiffNoise function to see which fields are being dropped.

func (RenderableObject) KubeMetricsUnavailableReason added in v0.7.19 

func (r RenderableObject) KubeMetricsUnavailableReason() string

KubeMetricsUnavailableReason reports why the metrics.k8s.io API (metrics-server) can't be used right now, or "" if it's healthy, so templates can tell users specifically whether it was never installed or is installed but unhealthy, instead of silently omitting the usage section either way. When live queries are disabled (--shallow or --local) no cluster call is made (per this file's convention) and "" (available) is assumed, so callers don't spuriously warn about something that was never checked.

func (RenderableObject) Labels added in v0.7.0 

func (r RenderableObject) Labels() (labels map[string]interface{})

func (RenderableObject) LiveQueriesDisabled added in v0.7.21 

func (r RenderableObject) LiveQueriesDisabled() bool

LiveQueriesDisabled reports whether this render should avoid contacting the apiserver. True for --shallow (user opted out of extra queries) and --local (there is no live cluster backing the rendered object at all). Used both from Go template functions below and directly from templates in place of `.Config.GetBool "shallow"`.

func (RenderableObject) Metadata added in v0.7.0 

func (r RenderableObject) Metadata() (metadata map[string]interface{})

func (RenderableObject) Name added in v0.7.0 

func (r RenderableObject) Name() string

func (RenderableObject) Namespace added in v0.7.0 

func (r RenderableObject) Namespace() string

func (RenderableObject) RolloutStatus added in v0.7.0 

func (r RenderableObject) RolloutStatus(obj RenderableObject) map[string]interface{}

RolloutStatus returns a map[string]interface{} with 3 keys: done: bool, message, error: string

func (RenderableObject) Spec added in v0.7.0 

func (r RenderableObject) Spec() (spec map[string]interface{})

func (RenderableObject) StatefulSetRollbackTrap added in v0.7.23 

func (r RenderableObject) StatefulSetRollbackTrap() map[string]interface{}

StatefulSetRollbackTrap detects the kubernetes/kubernetes#67250 StatefulSet RollingUpdate recovery trap, documented upstream as "Forced rollback" (https://kubernetes.io/docs/concepts/workloads/controllers/statefulset/#forced-rollback): with the default OrderedReady Pod management the controller stops its sync at the first Pod that isn't Running and Ready and never reaches the phase where it would delete Pods that are off the update revision. So a Pod created for an update that never becomes Ready blocks the rollout even after spec.template is fixed or reverted -- that specific Pod has to be deleted by hand so it gets recreated on the (possibly reverted) target revision.

Closed upstream as working-as-intended: auto-deleting a Pod that may already have run containers isn't safe for workloads that own data, so RollingUpdate will never self-heal. The escape hatch is instead the opt-in `Recreate` update strategy (KEP-3541, alpha in v1.37 behind the StatefulSetRecreateStrategy feature gate), which is excluded here along with OnDelete.

Only OrderedReady is affected: with `podManagementPolicy: Parallel` the sync isn't monotonic, so the controller reaches its update phase and deletes the stuck off-revision Pod itself.

Returns nil unless the StatefulSet is an OrderedReady RollingUpdate one with revision status, and the Pod its sync is blocked on is one this trap explains -- see statefulSetRollbackTrapBlocker. Callers are expected to already be inside a "rollout isn't done" gate (e.g. StatefulSet.tmpl checks RolloutStatus first), but this is also correct standalone.

func (RenderableObject) Status added in v0.7.0 

func (r RenderableObject) Status() (status map[string]interface{})

func (RenderableObject) StatusConditions added in v0.7.0 

func (r RenderableObject) StatusConditions() (conditions []interface{})

StatusConditions returns status.conditions sorted by type, ascending. Controllers don't guarantee a stable order for this list (see #787, where a Deployment's Available/Progressing conditions flipped order between runs), so every caller gets a deterministic order here rather than each render site having to tolerate either ordering on its own.

func (RenderableObject) String added in v0.7.0 

func (r RenderableObject) String() string

Source Files

View all Source files

Directories

Path Synopsis
Package calicoselector evaluates Calico's label-selector expression language (e.g.
 Package calicoselector evaluates Calico's label-selector expression language (e.g.
Package crossplanedrift computes a leaf-field comparison between a Crossplane managed resource's desired configuration (spec.forProvider) and the provider-observed external state (status.atProvider).
 Package crossplanedrift computes a leaf-field comparison between a Crossplane managed resource's desired configuration (spec.forProvider) and the provider-observed external state (status.atProvider).

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.