Documentation
¶
Overview ¶
Package fleet is the ONE per-org registry of attached compute (BYO k8s clusters / BYO GPU / bare metal). It is the single source of truth consumed by BOTH the fleet surface (clients/visor, which serves /v1/clusters — managed clusters from Visor MERGED with these BYO ones) AND ML serving (clients/ml, whose dynForOrg federates a workload onto the org's registered cluster). One registry, two consumers — never a second cluster surface.
Tenant isolation is the org boundary, narrowed by the org SUB-SCOPE (project): the kubeconfig is sealed in the org's KMS (MPC nodes see only ciphertext) under a per-org(+project) ref prefix, and every method takes the org + project as resolved from the ZAP-propagated, gateway-validated X-Org-Id / X-Project-Id — never a client field. So lux sees only lux's clusters, zoo only zoo's, a customer only their own — and, within an org, one project's fleet is a distinct shard. The DEFAULT project (principal.IsDefaultProject) keeps the legacy org-only key, so existing single- project fleets are untouched (scopeRef).
Index ¶
- type Cluster
- type Registry
- func (r *Registry) Deregister(org, project, name string) (bool, error)
- func (r *Registry) DynForOrg(org, project string) dynamic.Interface
- func (r *Registry) Enabled() bool
- func (r *Registry) List(org, project string) ([]Cluster, error)
- func (r *Registry) Register(ctx context.Context, org, project, name, kubeconfig, provider string, ...) (Cluster, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Cluster ¶
type Cluster struct {
Name string `json:"name"`
Org string `json:"org"`
Kind string `json:"kind"` // byo | byo-gpu | metal (managed clusters come from Visor, not here)
Provider string `json:"provider"` // byo | k3s | ...
Endpoint string `json:"endpoint,omitempty"`
Nodes int `json:"nodes"`
NvidiaGPU int `json:"nvidiaGpu"`
AmdGPU int `json:"amdGpu"`
Registered string `json:"registered"`
Default bool `json:"default"`
}
Cluster is an attached compute source (metadata only — the kubeconfig is sealed separately in KMS and never surfaced). Owned by exactly one org.
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry is the KMS-backed BYO-cluster store. A nil KMS (unconfigured) makes it disabled: Register fails closed (never plaintext) and DynForOrg/List no-op.
func New ¶
New opens the registry against the deployment's KMS (CLOUD_KMS_NODES / CLOUD_KMS_PASSPHRASE — the ONE bootstrap env, shared with the rest of cloud). Nil KMS => Enabled() is false and the registry is a graceful no-op.
func (*Registry) Deregister ¶
Deregister detaches a BYO cluster from the org+project fleet (index + sealed kubeconfig + cached client).
func (*Registry) DynForOrg ¶
DynForOrg returns the k8s client the org+project's workloads should target: its default registered cluster (KMS-loaded, cached) or nil when the shard has none (the caller then falls back to the home in-cluster client). This is the ONE federation seam.
func (*Registry) List ¶
List returns the org+project's registered BYO clusters (metadata only). Absent == empty.
func (*Registry) Register ¶
func (r *Registry) Register(ctx context.Context, org, project, name, kubeconfig, provider string, isDefault bool) (Cluster, error)
Register attaches a BYO cluster to the org+project fleet: validate by REACHING it (node + GPU inventory), seal the kubeconfig in the org's KMS, and index the metadata. Idempotent on name within the (org, project) shard.
Source Files