Documentation
¶
Overview ¶
Package agentconn resolves the credential-free, agent-layer control-plane client the scoped agent binary uses (ADR-0005, ADR-0038). It is module-private shared connection logic: the same building blocks burrow-mcp uses (connect.KubeconfigTransport, client.NewClientVersion, and the localconfig scoped-credential lookup), lifted out so a second thin client — burrow-agent — reaches burrowd over one seam without duplicating the precedence or the fail-closed rules.
Like burrow-mcp it holds no cluster-operating credentials of its own: it reaches the in-cluster control plane through the scoped, burrowd-only agent kubeconfig `burrow install` mints (ADR-0038) and the Kubernetes API-server proxy (ADR-0014), and it fails closed — a handle that records a scoped credential whose file is missing is an error, never a silent escalation to the ambient/admin kubeconfig. In strict mode a context with no scoped credential is an error too. The package is binary-neutral: its messages name no particular environment variable.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ConnectOptions ¶
func ConnectOptions(kubeContext, kubeconfig, namespace string, strict bool, stderr io.Writer) (connect.Options, error)
ConnectOptions builds the auto-connect options for a requested kube context, applying the explicit-kubeconfig > scoped-per-handle > ambient precedence (a direct control-plane URL is handled earlier, in NewFactory). An explicit kubeconfig is the operator's deliberate choice and is used unchanged (allowed even in strict mode); otherwise it defaults to the scoped, burrowd-only agent kubeconfig recorded for the matching handle (ADR-0038). It fails closed: a recorded scoped credential whose file is missing is always an error, and in strict mode a handle with no scoped credential is an error too, rather than escalating to the ambient/admin kubeconfig. It is exported so the resolver is unit-testable.
Types ¶
type ClientForContext ¶
ClientForContext resolves a control-plane client for a kubeconfig context (which cluster's burrowd a call targets; ADR-0035, ADR-0036). An empty context means the current kubeconfig context.
func NewFactory ¶
NewFactory builds the per-context control-plane client factory. Its credential precedence is, highest first:
- ControlPlaneURL — a direct URL (e.g. an ingress) with Token; it names exactly one control plane, so the per-call context does not apply and every call uses it. An empty Token is an error.
- Kubeconfig — an explicit kubeconfig used for every context.
- the scoped, burrowd-only agent kubeconfig recorded for the handle whose context matches the requested one (ADR-0038), so the agent's reachable credential is confined to burrowd.
- the ambient kubeconfig — the fallback for a context with no matching handle or scoped credential.
Like burrow-mcp it fails closed (ADR-0038): step 4 is refused when the handle records a scoped credential whose file is missing (always an error, never a silent escalation to admin), and in strict mode the ambient fallback is refused entirely — only the explicit escape hatches (steps 1 and 2) remain. The proxy-path factory is concurrency-safe and caches one client per context.
type Config ¶
type Config struct {
ControlPlaneURL string
Token string
Kubeconfig string
Namespace string
Strict bool
Version string
}
Config configures the agent-layer client factory. ControlPlaneURL (with Token) names a single control plane directly and outranks everything; Kubeconfig is an explicit kubeconfig used for every context; Namespace is the control-plane namespace burrowd runs in; Strict refuses the ambient fallback for a context with no scoped credential; Version is forwarded as X-Burrow-Client-Version (ADR-0039).
Source Files