Documentation
¶
Overview ¶
Package layout is where a writer's files go in a GitOps repository and what one write changes there: every writer (a manager, a CLI) owns one directory under the directory a Flux Kustomization builds from, holding one file per object and its own kustomization.yaml that lists them, and the parent's kustomization.yaml, where there is one, lists the directory. Flux then builds the directory whether the parent has a kustomization.yaml (the entry is added there) or not (Flux generates one that includes every directory with a kustomization.yaml).
Build decides a write against the base branch — which files are added, updated, removed or already there — encrypts new secret files for the repository's .sops.yaml recipients and never re-encrypts one that exists. The plan's Change is what commit.Open lands as the person.
Index ¶
Constants ¶
const ( // OrganizationsDirectory holds the organizations under a root. OrganizationsDirectory = "organizations" // WorkloadClustersDirectory holds an organization's clusters. WorkloadClustersDirectory = "workload-clusters" )
const KustomizationFile = "kustomization.yaml"
KustomizationFile lists a directory's files for kustomize.
const SOPSConfigFile = ".sops.yaml"
SOPSConfigFile is the repository's encryption rules, read at its root.
Variables ¶
var ( // ErrNotReconciled: the Organization carries no Flux Kustomization, so // no repository owns it. ErrNotReconciled = errors.New("not reconciled by a Flux Kustomization") // ErrNoOrganization: the root has no directory for the organization. ErrNoOrganization = errors.New("no organization directory") )
Functions ¶
Types ¶
type Cluster ¶ added in v0.11.0
type Cluster struct {
// Location is the root: the repository, branch and directory the
// Organization's Kustomization builds from.
provenance.Location
// Owner is the Organization's Kustomization; the cluster's Kustomization
// takes its source, service account, interval, timeout and keys.
Owner provenance.Kustomization
// Installation names the cluster's Kustomization,
// <installation>-clusters-<cluster>.
Installation string
Organization string
Name string
}
Cluster is a new workload cluster's place in the repository that owns its Organization.
func NewCluster ¶ added in v0.11.0
func NewCluster(flux provenance.Flux, ownerNamespace, ownerName, installation, organization, name string) (Cluster, error)
NewCluster places the cluster name of organization on installation: the Organization is reconciled by the Kustomization ownerNamespace/ownerName (its kustomize.toolkit.fluxcd.io labels) among the Flux objects. An Organization without one is ErrNotReconciled; one whose Kustomization does not build from a GitHub branch is refused with Resolve's error.
func (Cluster) Directory ¶ added in v0.11.0
Directory is the cluster's own directory, <cluster>/ under the organization's workload-clusters/; its ObjectFile names the object files.
func (Cluster) Kustomization ¶ added in v0.11.0
Kustomization is the cluster's Flux Kustomization, namespace/name, next to the Organization's.
func (Cluster) KustomizationPath ¶ added in v0.11.0
KustomizationPath is the file of the cluster's Flux Kustomization.
func (Cluster) OrganizationPath ¶ added in v0.11.0
OrganizationPath is the organization's directory, repository-relative.
type ClusterPlan ¶ added in v0.11.0
type ClusterPlan struct {
*Plan
// Kustomization is the cluster's Flux Kustomization, namespace/name.
Kustomization string
// Prune is the Organization's Kustomization's spec.prune. Without it a
// removal's merge leaves the cluster's Kustomization on the installation:
// deleting it is the live step, and Flux then removes the cluster.
Prune bool
}
ClusterPlan is the change set of a cluster's add or removal.
func BuildCluster ¶ added in v0.11.0
func BuildCluster(ctx context.Context, r ClusterReader, c Cluster, write map[string][]byte) (*ClusterPlan, error)
BuildCluster decides a new cluster's files against the base branch: the objects in write (paths inside Directory, named by its ObjectFile, a new secret file encrypted as Build does), the directory's kustomization.yaml, the cluster's Flux Kustomization and its entry in the organization's workload-clusters/kustomization.yaml, created when absent. A root without the organization's directory is ErrNoOrganization, naming the path looked for. A re-run whose files are on the base changes nothing.
func RemoveCluster ¶ added in v0.11.0
func RemoveCluster(ctx context.Context, r ClusterReader, c Cluster) (*ClusterPlan, error)
RemoveCluster decides a cluster's removal against the base branch: every file under its directory, its Flux Kustomization and the entry in the organization's workload-clusters/kustomization.yaml; what the base does not carry is no change.
type ClusterReader ¶ added in v0.11.0
ClusterReader is what a cluster's plan reads of the base branch: files, and the files under a directory.
type Directory ¶
type Directory struct {
provenance.Location
// Name is the writer's directory name, one path segment
// ("cluster-manager", "model-manager").
Name string
}
Directory is a writer's directory: Name under the directory of Location, on its repository and branch.
func (Directory) ObjectFile ¶
ObjectFile is the path of an object's file in the directory: named after the object, a Secret in a secret file of its own (sopsenc's naming convention), so it is encrypted and never written in plaintext.
type File ¶
File is one file of a plan. Content is the new content of an added or updated plain file, for a dry run to show; a secret file's content is never carried.
type Plan ¶
type Plan struct {
Directory Directory
// Files are every file the write decided on, sorted by path — unchanged
// ones included, so a dry run shows the whole directory the write owns.
Files []File
// contains filtered or unexported fields
}
Plan is the change set of one write in a directory.
func Build ¶
func Build(ctx context.Context, r commit.Reader, dir Directory, write map[string][]byte, remove []string) (*Plan, error)
Build decides a write in dir against the base branch: write are the files to land by path, remove the paths to take away (a path the base does not carry is no change); every path lies inside the directory. A plain file is added, updated or unchanged; a new secret file is encrypted for the recipients of the repository's .sops.yaml, one that exists is left as it is. The directory's kustomization.yaml lists every file it keeps and is removed with the last one; the parent's kustomization.yaml, where there is one, lists the directory while it has files. Both are edited on their YAML nodes: comments and every other key stay. Read errors from r are returned as they are (commit.AuthError included).
type SecretError ¶
SecretError refuses secret files the repository cannot take encrypted: no .sops.yaml, one that does not parse, or no creation rule with recipients for their paths. They are never written in plaintext; the caller names its way out.
func (*SecretError) Error ¶
func (e *SecretError) Error() string