README
¶
Kubernetes Resource Type Metadata
This package contains per-resource-type metadata used by ConfigHub's Kubernetes functions. When adding support for new CRDs or custom resource types, update the relevant files described below.
Files to update
public/configkit/k8skit/immutable_fields.go
Maps resource types to field paths that cannot be changed after creation (require delete + recreate). Sources of truth for immutability:
- Built-in K8s types:
pkg/apis/*/validation/validation.goin the Kubernetes source - ACK CRDs:
is_immutable: trueingenerator.yaml, orx-kubernetes-validationsrules withself == oldSelf - Other CRDs: look for "immutable", "cannot be updated", or "cannot be changed" in CRD field descriptions, and for immutability checks in controller reconciliation code
public/configkit/k8skit/merge_keys.go
Maps resource types to strategic merge patch keys for array fields. These determine how list items are matched during merges (e.g., containers matched by name). Sources:
- Built-in K8s types:
x-kubernetes-patch-merge-keyin the Kubernetes OpenAPI/Swagger spec, orpatchMergeKeystruct tags in Go types - CRDs:
x-kubernetes-list-map-keysandx-kubernetes-list-type: mapin the CRD schema
Pod-spec merge keys shared across workloads are in PodSpecMergeKeyFields; per-type prefixes are in WorkloadMergeKeyFields.
reference_fields.go
Maps resource types to fields that reference other Kubernetes resources. This enables cross-resource dependency tracking. The Target field uses group/version/Kind format.
- ACK CRDs: references follow the
spec.<field>Ref.from.namepattern (single) orspec.<field>Refs.*.from.name(list) - Other CRDs: look for fields named
*Ref,*SecretName,*ServiceAccountName,*ConfigMapRef, etc.
public/configkit/k8skit/cluster_resource_types.go
Lists cluster-scoped (non-namespaced) resource types. Check the scope field in a CRD's spec. Most CRDs are Namespaced; only add types here if scope: Cluster.
Resource type format
All resource types use group/version/Kind format throughout:
v1/Pod # core API (no group)
apps/v1/Deployment # grouped API
eks.services.k8s.aws/v1alpha1/Cluster # CRD
Adding a new controller's types
- Read the CRD YAML files and controller source code
- Check
scope:for cluster-scoped types and add tocluster_resource_types.go - Search for immutability markers and add to
public/configkit/k8skit/immutable_fields.go - Check for strategic merge keys and add to
public/configkit/k8skit/merge_keys.go - Identify cross-resource reference fields and add to
reference_fields.go - Run
make build-funcexec && make test-publicto verify
Documentation
¶
Index ¶
- Constants
- func DecryptResponse(privateKey *ecdh.PrivateKey, encryptedJSON []byte) ([]byte, error)
- func GenerateKubecontextFunction(fArgs handler.FunctionImplementationArguments) (gaby.Container, any, error)
- func GetGenerateKubecontextSignature() api.FunctionSignature
- func InitAccess() error
- func InitSchemaFinder() error
- func RegisterFunctions(rp *k8skit.K8sResourceProviderType, fh handler.FunctionRegistry)
- type EncryptedResponse
- type ResourceQuantityComparison
- type SchemaFinder
- type SchemaInfo
Constants ¶
const ( // AnnotationGenerateKubecontext must be set to "allow" on the ServiceAccount // for the function to issue a token. AnnotationGenerateKubecontext = "confighub.com/generate-kubecontext" // AnnotationAccessTTL controls the token lifetime. AnnotationAccessTTL = "confighub.com/access-ttl" // AnnotationAccessMaxTTL caps user-requested TTL overrides. AnnotationAccessMaxTTL = "confighub.com/access-max-ttl" // AnnotationKubernetesAPIEndpoint is the external API server endpoint to use in the // generated kubeconfig. Required, since the function will not be able to determine it // itself from inside the cluster. AnnotationKubernetesAPIEndpoint = "confighub.com/kubernetes-api-endpoint" )
const AttributeNameAnnotationValue = api.AttributeName("annotation-value")
const AttributeNameLabelValue = api.AttributeName("label-value")
const AttributeNameMetadataName = api.AttributeName("metadata-name")
const AttributeNameNamespaceNameReference = api.AttributeName("namespace-name-reference")
const AttributeNameWorkloadLabels = api.AttributeName("workload-labels")
Variables ¶
This section is empty.
Functions ¶
func DecryptResponse ¶ added in v0.1.26
func DecryptResponse(privateKey *ecdh.PrivateKey, encryptedJSON []byte) ([]byte, error)
DecryptResponse decrypts an EncryptedResponse using the caller's private key. This is used by the CLI plugin.
func GenerateKubecontextFunction ¶ added in v0.1.26
func GenerateKubecontextFunction(fArgs handler.FunctionImplementationArguments) (gaby.Container, any, error)
GenerateKubecontextFunction is the function implementation.
func GetGenerateKubecontextSignature ¶ added in v0.1.26
func GetGenerateKubecontextSignature() api.FunctionSignature
GetGenerateKubecontextSignature returns the function signature.
func InitAccess ¶ added in v0.1.26
func InitAccess() error
InitAccess initializes the Kubernetes client for token requests. It tries in-cluster config first, then falls back to kubeconfig.
func InitSchemaFinder ¶
func InitSchemaFinder() error
func RegisterFunctions ¶
func RegisterFunctions(rp *k8skit.K8sResourceProviderType, fh handler.FunctionRegistry)
RegisterFunctions registers all Kubernetes functions onto the provided FunctionHandler using the given registrar's resource provider.
Types ¶
type EncryptedResponse ¶ added in v0.1.26
type EncryptedResponse struct {
PublicKey string `json:"publicKey"` // Worker's ephemeral public key (base64)
Nonce string `json:"nonce"` // AES-GCM nonce (base64)
Ciphertext string `json:"ciphertext"` // Encrypted kubeconfig (base64)
}
EncryptedResponse is the JSON structure returned in function output.
type ResourceQuantityComparison ¶
type ResourceQuantityComparison struct {
// contains filtered or unexported fields
}
ResourceQuantityComparison implements CustomStringComparator for Kubernetes resource quantities
func NewResourceQuantityComparison ¶
func NewResourceQuantityComparison() *ResourceQuantityComparison
NewResourceQuantityComparison creates a new ResourceQuantityComparison instance
func (*ResourceQuantityComparison) Evaluate ¶
func (r *ResourceQuantityComparison) Evaluate(expr *api.RelationalExpression, value string) (bool, error)
Evaluate implements CustomStringComparator.Evaluate
func (*ResourceQuantityComparison) MatchesPath ¶
func (r *ResourceQuantityComparison) MatchesPath(path string) bool
MatchesPath implements CustomStringComparator.MatchesPath
type SchemaFinder ¶
type SchemaFinder struct {
// contains filtered or unexported fields
}
func NewSchemaFinder ¶
func NewSchemaFinder() (*SchemaFinder, error)
func (*SchemaFinder) LookupPath ¶
func (e *SchemaFinder) LookupPath(gvkString, fieldPath string) (*SchemaInfo, error)
type SchemaInfo ¶
type SchemaInfo struct {
Description string
}
func LookupPath ¶
func LookupPath(gvkString, fieldPath string) (*SchemaInfo, error)
Source Files