Help us shape the future of Go! Take the 2026 Go Developer Survey

kube

package
v0.7.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 19, 2026 License: Apache-2.0 Imports: 31 Imported by: 0

Documentation

Overview

Package kube is the Kubernetes implementation of the sandbox backend (ADR-0002): per seat a ServiceAccount, a retained workspace PVC, a manifest ConfigMap, a default-deny NetworkPolicy and a StatefulSet with 0 or 1 replicas. The rendering functions in this file are pure and implement the Seat Pod contract in docs/architecture.html#seat-pod.

Index

Constants

View Source 
const (
	// LabelWorkload distinguishes the seat runner Pod from other seat-labelled
	// Pods (the enforcement probe), so the StatefulSet never adopts them.
	LabelWorkload = "steadmesh.io/workload"
	// LabelProbe marks enforcement probe Pods.
	LabelProbe = "steadmesh.io/probe"
	// AnnotationConfigRevision records the config revision of a Pod template
	// or manifest ConfigMap.
	AnnotationConfigRevision = "steadmesh.io/config-revision"

	WorkloadRunner = "seat-runner"
	ComponentSeat  = "seat"
	// ComponentPlatform labels the platform Pods seats may reach.
	ComponentPlatform = "platform"

	ContainerName   = "seat-runner"
	RunnerBinary    = "/usr/local/bin/seat-runner"
	TokenDir        = "/var/run/steadmesh"
	TokenPath       = TokenDir + "/token"
	TokenExpiration = int64(3600)
	SeatMount       = "/seat"
	ManifestDir     = "/etc/steadmesh/manifest"
	RunnerUID       = int64(1000)
	HealthPort      = int32(8081)
	PlatformPort    = int32(8080)
	GracePeriod     = int64(300)

	ManifestFile     = "manifest.json"
	InstructionsFile = "instructions.md"
)
View Source 
const AnnotationProvides = "steadmesh.io/provides"

AnnotationProvides on a RuntimeClass declares the enforcement features it provides (comma-separated, e.g. "gvisor" or "microvm"), in addition to those inferred from well-known handlers.

View Source 
const BackendName = "kubernetes"

BackendName is the execution profile backend this implementation serves.

View Source 
const ComponentEgress = "egress"

ComponentEgress labels the egress gateway Pods.

View Source 
const LabelParentSeat = "steadmesh.io/parent-seat"
View Source 
const LabelTaskRun = "steadmesh.io/task-run"

Variables

This section is empty.

Functions

func ProbePodName 

func ProbePodName(profileDigest string) string

ProbePodName is the deterministic name of an enforcement probe Pod.

func ProfileDigest 

func ProfileDigest(p spec.SandboxProfile) string

ProfileDigest identifies a sandbox profile's contents for probe caching.

func RenderManifestConfigMap 

func RenderManifestConfigMap(s *seatruntime.Seat, files map[string]string) *corev1.ConfigMap

RenderManifestConfigMap renders the read-only manifest ConfigMap.

func RenderNetworkPolicy 

func RenderNetworkPolicy(s *seatruntime.Seat, o Options) *networkingv1.NetworkPolicy

RenderNetworkPolicy renders the default-deny seat policy: no ingress; egress only to platform Pods in the control-plane namespace on TCP 8080 and DNS, plus what the seat's access allows: the egress gateway Pods when the seat uses it, and the network plugin's CIDR rules.

func RenderProbePod 

func RenderProbePod(p seatruntime.EnforcementProbe, o Options) *corev1.Pod

RenderProbePod renders the NetworkPolicy enforcement probe. It carries the seat's policy labels (but not the runner workload label), so the seat deny policy applies to it while the StatefulSet never adopts it.

func RenderServiceAccount 

func RenderServiceAccount(s *seatruntime.Seat) *corev1.ServiceAccount

RenderServiceAccount renders the seat identity. The Kubernetes API token is never mounted; the seat only receives a gateway-audience projected token.

func RenderStatefulSet 

func RenderStatefulSet(s *seatruntime.Seat, o Options, replicas int32) (*appsv1.StatefulSet, error)

RenderStatefulSet renders the seat workload with the given replica count. The update strategy is OnDelete: the controller replaces the Pod at a safe boundary when the config revision changes (A13, A14).

func RenderTaskWorker added in v0.6.0 

func RenderTaskWorker(parent *seatruntime.Seat, t runtimeapi.TaskRun, o Options) (*corev1.Pod, *corev1.ServiceAccount, *networkingv1.NetworkPolicy, error)

func RenderWorkspaceClaim 

func RenderWorkspaceClaim(s *seatruntime.Seat) *corev1.PersistentVolumeClaim

RenderWorkspaceClaim renders the workspace PVC. It deliberately has no owner reference so it survives retirement and organisation deletion (§5.5).

func RunnerSelector 

func RunnerSelector(s *seatruntime.Seat) map[string]string

RunnerSelector selects the seat runner Pod of the StatefulSet.

func SeatLabels 

func SeatLabels(s *seatruntime.Seat) map[string]string

SeatLabels are the labels of every seat object.

func TaskSeat added in v0.6.0 

func TaskSeat(parent *seatruntime.Seat, t runtimeapi.TaskRun) *seatruntime.Seat

TaskSeat gives the disposable runtime its own name and policy selector. Using the parent's seat label would union its broader network permissions.

Types

type Backend 

type Backend struct {

	// ProbeFailureTTL is how long a failed enforcement probe is cached.
	ProbeFailureTTL time.Duration
	// ProbeTimeout bounds how long a probe Pod may take to complete.
	ProbeTimeout time.Duration
	// contains filtered or unexported fields
}

Backend implements runtime.Backend on Kubernetes.

func New 

func New(c client.Client, live client.Reader, o Options) *Backend

New returns a Kubernetes backend. c may be cached; live must read the API server directly and is used for safety-relevant checks (Pod existence).

func (*Backend) CachedEnforcement 

func (b *Backend) CachedEnforcement(ns, digest string) (seatruntime.ProbeResult, bool)

CachedEnforcement returns the cached enforcement result without starting a probe.

func (*Backend) Capabilities 

func (b *Backend) Capabilities(context.Context) seatruntime.Capabilities

func (*Backend) Cleanup 

func (b *Backend) Cleanup(ctx context.Context, s *seatruntime.Seat, retention seatruntime.Retention) (bool, error)

func (*Backend) Ensure 

func (b *Backend) Ensure(ctx context.Context, s *seatruntime.Seat, replicas int32) (*seatruntime.Status, error)

func (*Backend) Options 

func (b *Backend) Options() Options

Options returns the effective options.

func (*Backend) PodGone 

func (b *Backend) PodGone(ctx context.Context, s *seatruntime.Seat, uid string) (bool, error)

func (*Backend) PublishManifest 

func (b *Backend) PublishManifest(ctx context.Context, s *seatruntime.Seat, files map[string]string) error

func (*Backend) Quiesce 

func (b *Backend) Quiesce(ctx context.Context, s *seatruntime.Seat, pod string) error

func (*Backend) Status 

func (b *Backend) Status(ctx context.Context, s *seatruntime.Seat) (*seatruntime.Status, error)

func (*Backend) Stop 

func (b *Backend) Stop(ctx context.Context, s *seatruntime.Seat) error

func (*Backend) Validate 

func (b *Backend) Validate(ctx context.Context, s *seatruntime.Seat) error

func (*Backend) VerifyEnforcement 

func (b *Backend) VerifyEnforcement(ctx context.Context, p seatruntime.EnforcementProbe) (seatruntime.ProbeResult, error)

VerifyEnforcement runs a short-lived Pod under the seat NetworkPolicy that must reach the platform and must not reach the denied URL. Results are cached per namespace and sandbox profile digest; a passed result is reused until a new verify nonce is requested, a failed one for ProbeFailureTTL.

type Options 

type Options struct {
	// PlatformURL is propagated to seats as STEADMESH_PLATFORM_URL.
	PlatformURL string
	// ControlPlaneNamespace runs the platform Pods seats may reach.
	ControlPlaneNamespace string
	// ImagePullPolicy of seat and probe containers.
	ImagePullPolicy corev1.PullPolicy
	// NetprobeImage runs `seat-runner netprobe`.
	NetprobeImage string
	// NetprobeDeniedURL must be unreachable from a seat when policy is enforced.
	NetprobeDeniedURL string
	// DNSNamespace hosts the cluster DNS service seats may query.
	DNSNamespace string
	// FieldOwner is the server-side apply field manager.
	FieldOwner string
	// EgressURL is the egress gateway, empty when it is not enabled. Seats
	// whose access needs it reach its Pods (component egress) only.
	EgressURL string
}

Options configures the Kubernetes backend.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.