Documentation
¶
Overview ¶
Package translator converts a CLI config kind into the deployable outputs: operator chart values + the four platform CRs (EducatesClusterConfig, SecretsManager, LookupService, SessionManager).
Each kind has a Translate* method returning *Output. One renderer serialises Output to YAML.
Defaulting of environment-dependent fields (e.g. ingress.domain from host IP, operator.image.tag from CLI binary version) does NOT happen here. Translate consumes whatever the loader produced + any caller-side pre-translate defaulting. This keeps the translator deterministic and unit-testable.
Index ¶
- func RenderCRs(out *Output) ([]byte, error)
- func RenderOperatorValues(out *Output) ([]byte, error)
- type Options
- type Output
- func Translate(cfg v1alpha1.Config, opts Options) (*Output, error)
- func TranslateEKS(cfg *v1alpha1.EducatesEKSConfig, _ Options) (*Output, error)
- func TranslateEscape(cfg *v1alpha1.EducatesConfig) *Output
- func TranslateGKE(cfg *v1alpha1.EducatesGKEConfig, _ Options) (*Output, error)
- func TranslateInline(cfg *v1alpha1.EducatesInlineConfig, _ Options) (*Output, error)
- func TranslateLocal(cfg *v1alpha1.EducatesLocalConfig, opts Options) (*Output, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func RenderCRs ¶
RenderCRs serialises the four (or three) platform CRs in Output as a single multi-document YAML stream, in deploy order:
- EducatesClusterConfig
- SecretsManager
- LookupService (omitted when nil)
- SessionManager
The order matches the controller dependency chain: ECC must be Ready before SecretsManager reconciles; SecretsManager must be Ready before SessionManager. LookupService is independent of SessionManager.
yaml.v3 is used so the output has stable, alphabetical key ordering (yaml.v2 emits Go-map iteration order, which is randomised).
func RenderOperatorValues ¶
RenderOperatorValues serialises OperatorChartValues as a YAML values file, suitable for `helm install -f`. Empty map renders as "{}\n".
Types ¶
type Options ¶
type Options struct {
// CASecretName is the name of the Secret in CASecretNamespace that
// holds the CustomCA's tls.crt + tls.key. Looked up by domain at
// the call site (typically via secrets.LocalCachedSecretForCertificateAuthority).
// Required for TranslateLocal; ignored for TranslateEscape (which
// passes user-declared CRs through verbatim).
CASecretName string
// CASecretNamespace is the namespace of the CA Secret. Empty means
// the operator namespace. For laptop-mode installs aligned with v3,
// the caller sets this to "educates-secrets".
CASecretNamespace string
}
Options carries caller-side inputs that are too environmental for the translator to compute on its own.
type Output ¶
type Output struct {
OperatorChartValues map[string]interface{}
EducatesClusterConfig map[string]interface{}
SecretsManager map[string]interface{}
LookupService map[string]interface{} // nil = not deployed
SessionManager map[string]interface{}
}
Output is the internal representation produced by every Translate*. The renderer serialises it to YAML.
Each CR map carries the full resource (apiVersion + kind + metadata + spec). Nil means "do not deploy" for LookupService; the other three are always present for both scenario and escape kinds.
func Translate ¶
Translate dispatches on kind. Returns ErrUnknownKind if the loaded config is one this translator does not handle.
func TranslateEKS ¶
func TranslateEKS(cfg *v1alpha1.EducatesEKSConfig, _ Options) (*Output, error)
TranslateEKS converts EducatesEKSConfig into the deployable output. ECC.spec is mode: Managed with the EKS-prod stack: BundledContour (LoadBalancer envoy), BundledCertManager with ACME-DNS01-Route53, BundledExternalDNS with Route53, BundledKyverno.
func TranslateEscape ¶
func TranslateEscape(cfg *v1alpha1.EducatesConfig) *Output
TranslateEscape converts EducatesConfig (the escape-hatch kind) into the deployable output. Pure mechanical YAML slicing: every spec block is passed through verbatim. No defaults, no invariants, no field-level mapping.
LookupService is omitted from output when the user omitted it from the config — its presence is the deploy signal.
func TranslateGKE ¶
func TranslateGKE(cfg *v1alpha1.EducatesGKEConfig, _ Options) (*Output, error)
TranslateGKE converts EducatesGKEConfig into the deployable output. ECC.spec is mode: Managed with the full GKE-prod stack: BundledContour (LoadBalancer envoy), BundledCertManager with ACME-DNS01-CloudDNS, BundledExternalDNS with CloudDNS, BundledKyverno.
opts is accepted for signature uniformity with TranslateLocal; the CASecret fields are not consumed (ACME does its own cert lifecycle).
func TranslateInline ¶
func TranslateInline(cfg *v1alpha1.EducatesInlineConfig, _ Options) (*Output, error)
TranslateInline converts EducatesInlineConfig into the deployable output. ECC.spec is mode: Inline; everything funnels under spec.inline. No cluster services are installed by the operator.
opts.CASecretName is ignored — Inline mode brings its own CA reference via the optional caCertificateSecret field. The signature stays uniform with TranslateLocal so the dispatcher in Translate() doesn't have to special-case.
func TranslateLocal ¶
func TranslateLocal(cfg *v1alpha1.EducatesLocalConfig, opts Options) (*Output, error)
TranslateLocal converts EducatesLocalConfig into the deployable output.
Translator invariants applied here:
- mode: Managed
- ingress.ingressClassName: contour
- ingress.controller.provider: BundledContour
- ingress.certificates.provider: BundledCertManager
- ingress.certificates.bundledCertManager.issuerType: CustomCA
- policyEnforcement: BundledKyverno (cluster + workshop)
The CustomCA caCertificateRef name and namespace come from opts — the caller (typically the cmd code) looks them up by domain via secrets.LocalCachedSecretForCertificateAuthority and supplies them here. Returns an error when opts.CASecretName is empty: the install cannot complete without a CA, so failing at translate time prevents late surprises at deploy time.
When ingress.insecure is set the cluster serves plain HTTP: the certificates provider becomes None, no CA is required, and opts.CASecretName is ignored.
Static field defaults (clusterAdmin true, lookupService true, imagePrePuller false, operator.logLevel info, cluster.listenAddress 127.0.0.1) have already been applied by EducatesLocalConfig.WithDefaults() at load time.
Environment-dependent defaults are NOT applied here:
- ingress.domain stays empty unless the caller set it (host-IP nip.io defaulting belongs upstream of the translator).
- operator.image.tag stays as-is (CLI-binary-version defaulting belongs in command code that has access to the build info).
Source Files