README
¶
Kubernetes Resource Type Metadata
This package contains per-resource-type metadata used by ConfigHub's Kubernetes functions. When adding support for new CRDs or custom resource types, update the relevant files described below.
Files to update
public/configkit/k8skit/immutable_fields.go
Maps resource types to field paths that cannot be changed after creation (require delete + recreate). Sources of truth for immutability:
- Built-in K8s types:
pkg/apis/*/validation/validation.goin the Kubernetes source - ACK CRDs:
is_immutable: trueingenerator.yaml, orx-kubernetes-validationsrules withself == oldSelf - Other CRDs: look for "immutable", "cannot be updated", or "cannot be changed" in CRD field descriptions, and for immutability checks in controller reconciliation code
public/configkit/k8skit/merge_keys.go
Maps resource types to strategic merge patch keys for array fields. These determine how list items are matched during merges (e.g., containers matched by name). Sources:
- Built-in K8s types:
x-kubernetes-patch-merge-keyin the Kubernetes OpenAPI/Swagger spec, orpatchMergeKeystruct tags in Go types - CRDs:
x-kubernetes-list-map-keysandx-kubernetes-list-type: mapin the CRD schema
Pod-spec merge keys shared across workloads are in PodSpecMergeKeyFields; per-type prefixes are in WorkloadMergeKeyFields.
reference_fields.go
Maps resource types to fields that reference other Kubernetes resources. This enables cross-resource dependency tracking. The Target field uses group/version/Kind format.
- ACK CRDs: references follow the
spec.<field>Ref.from.namepattern (single) orspec.<field>Refs.*.from.name(list) - Other CRDs: look for fields named
*Ref,*SecretName,*ServiceAccountName,*ConfigMapRef, etc.
public/configkit/k8skit/cluster_resource_types.go
Lists cluster-scoped (non-namespaced) resource types. Check the scope field in a CRD's spec. Most CRDs are Namespaced; only add types here if scope: Cluster.
Resource type format
All resource types use group/version/Kind format throughout:
v1/Pod # core API (no group)
apps/v1/Deployment # grouped API
eks.services.k8s.aws/v1alpha1/Cluster # CRD
Adding a new controller's types
- Read the CRD YAML files and controller source code
- Check
scope:for cluster-scoped types and add tocluster_resource_types.go - Search for immutability markers and add to
public/configkit/k8skit/immutable_fields.go - Check for strategic merge keys and add to
public/configkit/k8skit/merge_keys.go - Identify cross-resource reference fields and add to
reference_fields.go - Run
make build-funcexec && make test-publicto verify
Documentation
¶
Index ¶
- Constants
- func DecryptResponse(privateKey *ecdh.PrivateKey, encryptedJSON []byte) ([]byte, error)
- func GenerateKubecontextFunction(fArgs handler.FunctionImplementationArguments) (gaby.Container, any, error)
- func GetGenerateKubecontextSignature() api.FunctionSignature
- func InitAccess() error
- func InitSchemaFinder() error
- func K8sCELEnvOpts() []cel.EnvOption
- func RegisterFunctions(rp *k8skit.K8sResourceProviderType, fh handler.FunctionRegistry)
- type EncryptedResponse
- type ResourceQuantityComparison
- type SchemaFinder
- type SchemaInfo
Constants ¶
const ( // AnnotationGenerateKubecontext must be set to "allow" on the ServiceAccount // for the function to issue a token. AnnotationGenerateKubecontext = "confighub.com/generate-kubecontext" // AnnotationAccessTTL controls the token lifetime. AnnotationAccessTTL = "confighub.com/access-ttl" // AnnotationAccessMaxTTL caps user-requested TTL overrides. AnnotationAccessMaxTTL = "confighub.com/access-max-ttl" // AnnotationKubernetesAPIEndpoint is the external API server endpoint to use in the // generated kubeconfig. Required, since the function will not be able to determine it // itself from inside the cluster. AnnotationKubernetesAPIEndpoint = "confighub.com/kubernetes-api-endpoint" )
const AttributeNameAnnotationValue = api.AttributeName("annotation-value")
const AttributeNameLabelValue = api.AttributeName("label-value")
const AttributeNameMetadataName = api.AttributeName("metadata-name")
const AttributeNameNamespaceNameReference = api.AttributeName("namespace-name-reference")
const AttributeNameWorkloadLabels = api.AttributeName("workload-labels")
Variables ¶
This section is empty.
Functions ¶
func DecryptResponse ¶ added in v0.1.26
func DecryptResponse(privateKey *ecdh.PrivateKey, encryptedJSON []byte) ([]byte, error)
DecryptResponse decrypts an EncryptedResponse using the caller's private key. This is used by the CLI plugin.
func GenerateKubecontextFunction ¶ added in v0.1.26
func GenerateKubecontextFunction(fArgs handler.FunctionImplementationArguments) (gaby.Container, any, error)
GenerateKubecontextFunction is the function implementation.
func GetGenerateKubecontextSignature ¶ added in v0.1.26
func GetGenerateKubecontextSignature() api.FunctionSignature
GetGenerateKubecontextSignature returns the function signature.
func InitAccess ¶ added in v0.1.26
func InitAccess() error
InitAccess initializes the Kubernetes client for token requests. It tries in-cluster config first, then falls back to kubeconfig.
func InitSchemaFinder ¶
func InitSchemaFinder() error
func K8sCELEnvOpts ¶ added in v0.2.8
K8sCELEnvOpts returns the additional CEL environment options that provide Kubernetes-specific CEL libraries matching the admission policy environment. This includes quantity(), url(), ip(), cidr(), regex(), and format() functions.
It is exported so that callers evaluating CEL against Kubernetes configuration outside the function executor -- such as a server-side View column read from stored JSON -- get the same environment the get-cel function provides.
func RegisterFunctions ¶
func RegisterFunctions(rp *k8skit.K8sResourceProviderType, fh handler.FunctionRegistry)
RegisterFunctions registers all Kubernetes functions onto the provided FunctionHandler using the given registrar's resource provider.
Types ¶
type EncryptedResponse ¶ added in v0.1.26
type EncryptedResponse struct {
PublicKey string `json:"publicKey"` // Worker's ephemeral public key (base64)
Nonce string `json:"nonce"` // AES-GCM nonce (base64)
Ciphertext string `json:"ciphertext"` // Encrypted kubeconfig (base64)
}
EncryptedResponse is the JSON structure returned in function output.
type ResourceQuantityComparison ¶
type ResourceQuantityComparison struct {
// contains filtered or unexported fields
}
ResourceQuantityComparison implements CustomStringComparator for Kubernetes resource quantities
func NewResourceQuantityComparison ¶
func NewResourceQuantityComparison() *ResourceQuantityComparison
NewResourceQuantityComparison creates a new ResourceQuantityComparison instance
func (*ResourceQuantityComparison) Evaluate ¶
func (r *ResourceQuantityComparison) Evaluate(expr *api.RelationalExpression, value string) (bool, error)
Evaluate implements CustomStringComparator.Evaluate
func (*ResourceQuantityComparison) MatchesPath ¶
func (r *ResourceQuantityComparison) MatchesPath(path string) bool
MatchesPath implements CustomStringComparator.MatchesPath
type SchemaFinder ¶
type SchemaFinder struct {
// contains filtered or unexported fields
}
func NewSchemaFinder ¶
func NewSchemaFinder() (*SchemaFinder, error)
func (*SchemaFinder) LookupPath ¶
func (e *SchemaFinder) LookupPath(gvkString, fieldPath string) (*SchemaInfo, error)
type SchemaInfo ¶
type SchemaInfo struct {
Description string
}
func LookupPath ¶
func LookupPath(gvkString, fieldPath string) (*SchemaInfo, error)
Source Files