fs

func BlueprintPath ¶ added in v0.6.0

func BlueprintPath(baseRunPath, realmName, spaceName, stackName, blueprintName string) string

BlueprintPath returns the host-side path of a single daemon-managed blueprint document: <scope>/blueprints/<name>, root-owned and 0o644.

func BlueprintScopeDir ¶ added in v0.6.0

func BlueprintScopeDir(baseRunPath, realmName, spaceName, stackName string) string

BlueprintScopeDir returns the metadata directory of the scope a `kind: CellBlueprint` is bound to (issue #620). Unlike a Secret, a Blueprint is scopable at realm/space/stack only — never cell — so the deepest coordinate this resolves is the stack dir. The caller is responsible for having validated coordinate completeness.

func BlueprintsDir ¶ added in v0.6.0

func BlueprintsDir(baseRunPath, realmName, spaceName, stackName string) string

BlueprintsDir returns the per-scope blueprints directory — the root-owned, world-readable (0o755) directory under the scope's metadata tree that owns daemon-managed blueprint documents (issue #620). Nested inside the scope dir so scope teardown reclaims it.

func CellEtcHostnamePath ¶ added in v0.4.0

func CellEtcHostnamePath(baseRunPath, realmName, spaceName, stackName, cellName string) string

CellEtcHostnamePath returns the host-side path of the per-cell /etc/hostname file kukeond renders and bind-mounts into every container in the cell. Lives under the cell's metadata directory so cell teardown cleans it up.

func CellEtcHostsPath ¶ added in v0.4.0

func CellEtcHostsPath(baseRunPath, realmName, spaceName, stackName, cellName string) string

CellEtcHostsPath returns the host-side path of the per-cell /etc/hosts file kukeond renders and bind-mounts into every container in the cell. Lives under the cell's metadata directory so cell teardown cleans it up.

func CellMetadataDir ¶

func CellMetadataDir(baseRunPath, realmName, spaceName, stackName, cellName string) string

CellMetadataDir returns the metadata directory for the given cell within a realm, space, and stack.

func CellMetadataPath ¶

func CellMetadataPath(baseRunPath, realmName, spaceName, stackName, cellName string) string

CellMetadataPath returns the metadata file path for the given cell within a realm, space, and stack.

func ConfigPath ¶ added in v0.6.0

func ConfigPath(baseRunPath, realmName, spaceName, stackName, configName string) string

ConfigPath returns the host-side path of a single daemon-managed config document: <scope>/configs/<name>, root-owned and 0o644.

func ConfigScopeDir ¶ added in v0.6.0

func ConfigScopeDir(baseRunPath, realmName, spaceName, stackName string) string

ConfigScopeDir returns the metadata directory of the scope a `kind: CellConfig` is bound to (issue #624). Like a CellBlueprint a Config is scopable at realm/space/stack only — never cell — so the deepest coordinate this resolves is the stack dir. The caller is responsible for having validated coordinate completeness.

func ConfigsDir ¶ added in v0.6.0

func ConfigsDir(baseRunPath, realmName, spaceName, stackName string) string

ConfigsDir returns the per-scope configs directory — the root-owned, world-readable (0o755) directory under the scope's metadata tree that owns daemon-managed config documents (issue #624). Nested inside the scope dir so scope teardown reclaims it.

func ContainerCapturePath ¶ added in v0.3.0

func ContainerCapturePath(baseRunPath, realmName, spaceName, stackName, cellName, containerName string) string

ContainerCapturePath returns the host-side path of the per-container sbsh capture file. It is the host-visible peer of the in-container path /run/kukeon/tty/capture (ctr.AttachableCapturePath); both resolve to the same inode because the per-container tty directory is bind-mounted into the container. `kuke log` tails this path.

func ContainerKukettyLogPath ¶ added in v0.6.0

func ContainerKukettyLogPath(baseRunPath, realmName, spaceName, stackName, cellName, containerName string) string

ContainerKukettyLogPath returns the host-side path of the per-Attachable- container kuketty wrapper's own slog output. It is the host-visible peer of the in-container ctr.AttachableKukettyLogPath; both resolve to the same inode through the per-container tty directory bind mount. The path is daemon-controlled (operators do not configure it via cell YAML) so an operator debugging a misbehaving attach session always knows where to look. Issue #599.

func ContainerLogPath ¶ added in v0.4.0

func ContainerLogPath(baseRunPath, realmName, spaceName, stackName, cellName, containerName string) string

ContainerLogPath returns the host-side path of the per-container stdout/ stderr log file written by the containerd runtime shim via cio.LogFile. Used for non-Attachable containers (kukeond included): the shim opens this path and appends every byte the task writes to stdout or stderr; `kuke log` tails the same path. Attachable containers do not use this file — their output is captured by sbsh into ContainerCapturePath.

func ContainerMetadataDir ¶ added in v0.2.0

func ContainerMetadataDir(baseRunPath, realmName, spaceName, stackName, cellName, containerName string) string

ContainerMetadataDir returns the per-container metadata directory inside the owning cell's metadata tree. Used as the host anchor for per-container state such as the sbsh control socket.

func ContainerSocketPath ¶ added in v0.2.0

func ContainerSocketPath(baseRunPath, realmName, spaceName, stackName, cellName, containerName string) string

ContainerSocketPath returns the host-side path of the kuketty terminal socket inode for a container — the bind-mount source path the kuketty listener inside the container resolves to via /run/kukeon/tty/socket. This path can be arbitrarily long (it inherits the full metadata layout depth) and is NOT safe to pass to `connect(2)`; see ContainerSocketSymlinkPath for the SUN_PATH-safe handle that `kuke attach` uses.

func ContainerSocketSymlinkDir ¶ added in v0.6.0

func ContainerSocketSymlinkDir(baseRunPath string) string

ContainerSocketSymlinkDir returns the per-RunPath directory that holds SUN_PATH-safe symlinks to per-container kuketty sockets. The daemon creates this directory once and stages one symlink per Attachable container inside it; cell / container teardown removes the symlinks but leaves the directory itself in place (idempotent — re-provisioning the same container regenerates its symlink).

func ContainerSocketSymlinkPath ¶ added in v0.6.0

func ContainerSocketSymlinkPath(baseRunPath, realmName, spaceName, stackName, cellName, containerName string) string

ContainerSocketSymlinkPath returns the SUN_PATH-safe host-side path `kuke attach` connects to. It is a short symlink staged by the daemon inside ContainerSocketSymlinkDir that resolves to the deep socket inode returned by ContainerSocketPath. Linux's sockaddr_un.sun_path is bounded at 108 bytes including the terminator (consts.KukeonMaxSocketPath = 107 usable bytes); the deep metadata-rooted ContainerSocketPath overflows on long RunPaths or long realm/space/stack/cell IDs (issue #521), so every host-side `connect(2)` is routed through this short handle.

The basename is a 16-hex (sha256[:8]) digest of the realm|space|stack|cell|container tuple, which is deterministic across process restarts (so a freshly-spawned `kuke attach` re-derives the same path the provisioning runner staged) and uniquely identifies a container without inheriting the depth of the metadata layout. With a RunPath ≤ 60 bytes the resolved path is `<RunPath>/s/<16hex>` ≤ 79 bytes — well inside SUN_PATH.

func ContainerTTYDir ¶ added in v0.2.0

func ContainerTTYDir(baseRunPath, realmName, spaceName, stackName, cellName, containerName string) string

ContainerTTYDir returns the host-side per-container directory that owns the sbsh terminal socket and its capture/log siblings. It is bind-mounted into the container at /run/kukeon/tty so that sbsh's unlink-and-recreate cycle on the socket inode stays host-visible.

func ConvertCellListToExternal ¶

func ConvertCellListToExternal(internalCells []intmodel.Cell) ([]*v1beta1.CellDoc, error)

ConvertCellListToExternal converts a slice of internal cells to a slice of external cell docs.

func ConvertCellToExternal ¶

func ConvertCellToExternal(internalCell intmodel.Cell) (*v1beta1.CellDoc, error)

ConvertCellToExternal converts an internal cell to an external cell doc.

func ConvertContainerSpecListToExternal ¶

func ConvertContainerSpecListToExternal(internalSpecs []intmodel.ContainerSpec) ([]*v1beta1.ContainerSpec, error)

ConvertContainerSpecListToExternal converts a slice of internal container specs to a slice of external specs.

func ConvertContainerToExternal ¶

func ConvertContainerToExternal(internalContainer intmodel.Container) (*v1beta1.ContainerDoc, error)

ConvertContainerToExternal converts an internal container to an external container doc.

func ConvertRealmListToExternal ¶

func ConvertRealmListToExternal(internalRealms []intmodel.Realm) ([]*v1beta1.RealmDoc, error)

ConvertRealmListToExternal converts a slice of internal realms to a slice of external realm docs.

func ConvertRealmToExternal ¶

func ConvertRealmToExternal(internalRealm intmodel.Realm) (*v1beta1.RealmDoc, error)

ConvertRealmToExternal converts an internal realm to an external realm doc.

func ConvertSpaceListToExternal ¶

func ConvertSpaceListToExternal(internalSpaces []intmodel.Space) ([]*v1beta1.SpaceDoc, error)

ConvertSpaceListToExternal converts a slice of internal spaces to a slice of external space docs.

func ConvertSpaceToExternal ¶

func ConvertSpaceToExternal(internalSpace intmodel.Space) (*v1beta1.SpaceDoc, error)

ConvertSpaceToExternal converts an internal space to an external space doc.

func ConvertStackListToExternal ¶

func ConvertStackListToExternal(internalStacks []intmodel.Stack) ([]*v1beta1.StackDoc, error)

ConvertStackListToExternal converts a slice of internal stacks to a slice of external stack docs.

func ConvertStackToExternal ¶

func ConvertStackToExternal(internalStack intmodel.Stack) (*v1beta1.StackDoc, error)

ConvertStackToExternal converts an internal stack to an external stack doc.

func DetectMetadataVersion ¶

func DetectMetadataVersion(raw []byte) (v1beta1.Version, error)

DetectMetadataVersion detects the API version from raw metadata bytes by parsing the apiVersion field. It returns the normalized version using apischeme.DefaultVersion.

func MetadataRoot ¶ added in v0.5.0

func MetadataRoot(baseRunPath string) string

MetadataRoot returns the root of kukeon's on-disk metadata tree under the daemon's RunPath. All realm/space/stack/cell metadata lives beneath this directory; siblings of the RunPath (e.g. <RunPath>/bin staging the kuketty binary, or the .kukeon-instance.json file) stay outside it so the reconcile loop and the subnet allocator can walk the metadata tree without treating non-metadata subdirectories as realms.

func RealmMetadataDir ¶

func RealmMetadataDir(baseRunPath, realmName string) string

RealmMetadataDir returns the metadata directory for the given realm.

func RealmMetadataPath ¶

func RealmMetadataPath(baseRunPath, realmName string) string

RealmMetadataPath returns the metadata file path for the given realm.

func SecretPath ¶ added in v0.6.0

func SecretPath(baseRunPath, realmName, spaceName, stackName, cellName, secretName string) string

SecretPath returns the host-side path of a single daemon-managed secret's bytes: <scope>/secrets/<name>, root-owned and 0o600.

func SecretScopeDir ¶ added in v0.6.0

func SecretScopeDir(baseRunPath, realmName, spaceName, stackName, cellName string) string

SecretScopeDir returns the metadata directory of the scope a `kind: Secret` is bound to (issue #619). The scope is the deepest non-empty coordinate: passing only realmName yields the realm dir, realmName+spaceName the space dir, and so on. Empty deeper coordinates are ignored — the caller is responsible for having validated coordinate completeness (a non-empty cell requires a non-empty stack, space, and realm) before calling.

func SecretsDir ¶ added in v0.6.0

func SecretsDir(baseRunPath, realmName, spaceName, stackName, cellName string) string

SecretsDir returns the per-scope secrets directory — the root-only (0o700) directory under the scope's metadata tree that owns daemon-managed secret bytes. Nested inside the scope dir so scope teardown reclaims it.

func SpaceMetadataDir ¶

func SpaceMetadataDir(baseRunPath, realmName, spaceName string) string

SpaceMetadataDir returns the metadata directory for the given space within a realm.

func SpaceMetadataPath ¶

func SpaceMetadataPath(baseRunPath, realmName, spaceName string) string

SpaceMetadataPath returns the metadata file path for the given space within a realm.

func SpaceNetworkConfigPath ¶

func SpaceNetworkConfigPath(baseRunPath, realmName, spaceName string) (string, error)

SpaceNetworkConfigPath returns the path to the space's network conflist file.

func StackMetadataDir ¶

func StackMetadataDir(baseRunPath, realmName, spaceName, stackName string) string

StackMetadataDir returns the metadata directory for the given stack within a realm and space.

func StackMetadataPath ¶

func StackMetadataPath(baseRunPath, realmName, spaceName, stackName string) string

StackMetadataPath returns the metadata file path for the given stack within a realm and space.

func WriteSpaceNetworkConfig ¶

func WriteSpaceNetworkConfig(confPath, networkName, subnetCIDR string) error

WriteSpaceNetworkConfig writes the network conflist at the provided path, pinning the bridge to subnetCIDR. Pass an empty subnetCIDR to fall back to the package default — left in place for tests and the legacy shared-subnet path; runtime callers must allocate per-space subnets via cni.SubnetAllocator and pass the result here.