Documentation
¶
Overview ¶
Package rotation provides a reusable multi-cycle TLS rotation saga step built on workflow.WorkflowStepReconcilerActionWithDiff.
The saga phases are:
"" -> Rotate : emit new CA + leaf with ca.crt = newCA||oldCA bundle.
Rotate -> Converge : hold desired state stable, gate on an operator-injected
convergence check, then advance.
Converge -> "" : emit leaf with ca.crt = newCA only (strip old CA).
Backends with RequiresRotationSaga() == false degrade to a single-cycle emit of DesiredObjects with no phase writes.
Index ¶
- Constants
- func NewTLSStep[T object.MultiPhaseObject](c client.Client, phaseName shared.PhaseName, ...) workflow.WorkflowStepReconcilerActionWithDiff[T, client.Object]
- type AnnotationsDecorator
- type ConvergenceCheck
- type LabelsDecorator
- type Option
- func WithAnnotationsDecorator[T object.MultiPhaseObject](f AnnotationsDecorator[T]) Option[T]
- func WithCertificateCustomizer[T object.MultiPhaseObject](c certificate.CertificateCustomizer[T]) Option[T]
- func WithConvergenceCheck[T object.MultiPhaseObject](f ConvergenceCheck[T]) Option[T]
- func WithForceRegenerateAllAnnotation[T object.MultiPhaseObject](name string) Option[T]
- func WithForceRegenerateLeafAnnotation[T object.MultiPhaseObject](name string) Option[T]
- func WithLabelsDecorator[T object.MultiPhaseObject](f LabelsDecorator[T]) Option[T]
Constants ¶
const ( // PhaseRotate is the saga phase during which the new CA + bundled leaf // have been applied and the operator waits for convergence. PhaseRotate apworkflow.WorkflowPhase = "Rotate" // PhaseConverge is the saga phase that strips the old CA from the leaf. PhaseConverge apworkflow.WorkflowPhase = "Converge" )
Variables ¶
This section is empty.
Functions ¶
func NewTLSStep ¶
func NewTLSStep[T object.MultiPhaseObject]( c client.Client, phaseName shared.PhaseName, conditionName shared.ConditionName, recorder record.EventRecorder, fieldManager string, backend certificate.TLSBackend[T], provider certificate.TLSSpecProvider[T], opts ...Option[T], ) workflow.WorkflowStepReconcilerActionWithDiff[T, client.Object]
NewTLSStep creates a reusable TLS rotation saga step.
- phaseName/conditionName/recorder/fieldManager: standard step wiring.
- backend: the TLSBackend (selfmanaged → saga; byo/certmanager → single cycle).
- provider: supplies the computed TLSSpec for the reconciled object.
- opts: WithConvergenceCheck, WithLabelsDecorator, WithAnnotationsDecorator, WithForceRegenerateAllAnnotation, WithForceRegenerateLeafAnnotation.
The returned step is a WorkflowStepReconcilerActionWithDiff[T, client.Object].
Types ¶
type AnnotationsDecorator ¶
type AnnotationsDecorator[T object.MultiPhaseObject] func(o T, obj client.Object)
AnnotationsDecorator mutates annotations on each expected object.
type ConvergenceCheck ¶
type ConvergenceCheck[T object.MultiPhaseObject] func(ctx context.Context, o T, data map[string]any) (bool, error)
ConvergenceCheck is invoked during the Rotate phase to decide whether the system has absorbed the new CA bundle (e.g., all pods have rolled). Return true to advance to Converge; return false to requeue.
type LabelsDecorator ¶
type LabelsDecorator[T object.MultiPhaseObject] func(o T, obj client.Object)
LabelsDecorator mutates labels on each expected object.
type Option ¶
type Option[T object.MultiPhaseObject] func(*tlsStep[T])
Option configures a TLS saga step.
func WithAnnotationsDecorator ¶
func WithAnnotationsDecorator[T object.MultiPhaseObject](f AnnotationsDecorator[T]) Option[T]
WithAnnotationsDecorator applies annotations to every expected object.
func WithCertificateCustomizer ¶ added in v3.0.6
func WithCertificateCustomizer[T object.MultiPhaseObject](c certificate.CertificateCustomizer[T]) Option[T]
WithCertificateCustomizer injects the content customizer. Applied once per Read cycle; the customized spec is threaded to every backend call and to drift/renewal checks in that cycle.
func WithConvergenceCheck ¶
func WithConvergenceCheck[T object.MultiPhaseObject](f ConvergenceCheck[T]) Option[T]
WithConvergenceCheck injects the Rotate-phase convergence gate. If not set, the Rotate phase advances to Converge immediately (no waiting).
func WithForceRegenerateAllAnnotation ¶
func WithForceRegenerateAllAnnotation[T object.MultiPhaseObject](name string) Option[T]
WithForceRegenerateAllAnnotation overrides the force-all annotation name.
func WithForceRegenerateLeafAnnotation ¶
func WithForceRegenerateLeafAnnotation[T object.MultiPhaseObject](name string) Option[T]
WithForceRegenerateLeafAnnotation overrides the force-leaf annotation name.
func WithLabelsDecorator ¶
func WithLabelsDecorator[T object.MultiPhaseObject](f LabelsDecorator[T]) Option[T]
WithLabelsDecorator applies labels to every expected object.
Source Files