render

package
v0.5.0 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 15, 2026 License: MIT Imports: 9 Imported by: 0

Documentation

Overview

Package render is the single kustomize entry point for the Go binary.

Build renders a kustomization directory the way `kustomize build --enable-alpha-plugins [--enable-exec] <dir>` does. Two builds of the binary exist, selected by the `inprocess` build tag (see core.go and inprocess.go):

  • lo (CORE, the default build): the render EXECS the pinned kustomize binary from the project's toolchain (.bin first, then PATH) with KUSTOMIZE_PLUGIN_HOME defaulted to <project>/.kustomize, where the b-managed exec generators live — khelm's ChartRenderer and the kustomize-secret Secret plugin (`lo toolchain install` installs all three, pinned). No kustomize API, no khelm, no helm are linked in. The secrets.lok8s.dev generator itself IS still part of core (kustomize/plugins/secret, imported) — the registry TLS mint calls it in-process, it is ours and small.
  • lo-full (build tag `inprocess`): the pinned kustomize API (sigs.k8s.io/kustomize/api — the module behind the kustomize binary the toolchain pins) runs inside the binary, and both exec generators are served by the binary ITSELF through a per-process plugin home of symlinks pointing at the running executable (DispatchPlugin routes argv[0]). No kustomize, khelm or .kustomize/ is needed. LO_RENDER=exec restores the subprocess pipeline for an A/B comparison.

Byte parity is the contract: both pipelines produce the same bytes. The pins that make that true — the kustomize API version and the kustomize CLI release it corresponds to, the khelm library/binary version (+ its helm) — live in internal/toolchain (pins.go) and are drift-tested against go.mod and the generated .bin/b.yaml template.

Index

Constants

View Source
const ModeEnv = "LO_RENDER"

ModeEnv selects the render pipeline. lo-full: unset/"inprocess" (the default) runs kustomize in-process, "exec" restores the subprocess pipeline. lo core: unset/"exec" run the subprocess pipeline (the only one it has) and "inprocess" is rejected with a pointer to lo-full. Any other value is rejected (fail closed).

Variables

This section is empty.

Functions

func Build

func Build(ctx context.Context, dir string, o Options) ([]byte, error)

Build renders dir and returns the YAML stream `kustomize build` would have written to stdout. On failure the kustomize error line has already been written to Options.Stderr (exec: by the child; in-process: the same `Error: <msg>` cobra line) and the error is returned for the caller's own reporting — callers print their own [error] lines exactly as before.

func Cleanup

func Cleanup()

Cleanup is a no-op on core (no self-exec plugin home is ever created).

func DispatchPlugin

func DispatchPlugin(_ context.Context, _ []string, _ io.Reader, _, _ io.Writer) (handled bool, rc int)

DispatchPlugin is a no-op on core: kustomize runs as a child process and execs the plugin BINARIES under KUSTOMIZE_PLUGIN_HOME, never this executable. main still calls it first so both builds share one entry.

func InProcessAvailable

func InProcessAvailable() bool

InProcessAvailable reports whether this build links the in-process renderer (lo-full). Tests use it to skip in-process assertions on core.

func SecretInProcess

func SecretInProcess() bool

SecretInProcess reports whether the imported secrets.lok8s.dev generator runs inside this process for the registry TLS mint: true unless LO_RENDER=exec asks for the subprocess pipeline explicitly. Independent of the build variant — the generator is linked into core as well — so core mints the dev registry cert without the plugin binary, exactly like lo-full, and only the explicit escape hatch reproduces the bash behaviour (exec the built plugin, fail when it is missing).

func Variant

func Variant() string

Variant names the build: "core" (exec render) or "full" (in-process).

Types

type LoadRestrictions

type LoadRestrictions int

LoadRestrictions is `--load-restrictor`: RootOnly (the default, like the CLI) or None. Declared here rather than borrowed from the kustomize API so core does not link it.

const (
	// LoadRestrictionsRootOnly forbids files outside the kustomization root.
	LoadRestrictionsRootOnly LoadRestrictions = iota
	// LoadRestrictionsNone allows them.
	LoadRestrictionsNone
)

type Mode

type Mode string

Mode is the resolved value of ModeEnv.

const (
	// ModeInProcess runs the kustomize API inside lo (lo-full's default).
	ModeInProcess Mode = "inprocess"
	// ModeExec execs the pinned kustomize binary (core's only mode;
	// lo-full's escape hatch).
	ModeExec Mode = "exec"
)

func CurrentMode

func CurrentMode() (Mode, error)

CurrentMode reads LO_RENDER. An unknown value is an error so a typo can never silently pick a pipeline; on core an explicit "inprocess" is an error too, naming the build that has it.

type Options

type Options struct {
	// Paths locates the project. In-process it is unused; in exec mode it
	// resolves the kustomize binary (.bin first) and hands the child
	// KUSTOMIZE_PLUGIN_HOME from config.KustomizePluginHome: the variable
	// when set, else <Base>/.kustomize. Every render that runs in a
	// project (the domain build, the addon render, `lo k8s`) passes it.
	// Nil is allowed only for a render outside a project: then exec mode
	// needs Runner and leaves the plugin home to the process environment.
	Paths *config.Paths
	// Runner runs the exec-mode kustomize child (the hermetic seam the
	// addon tests stub). Nil = execx.NewRunner(Paths).
	Runner execx.Runner
	// EnableExec is `--enable-exec` (KRM exec functions). The addon render
	// passes it; the domain build does not. Legacy exec generators are
	// enabled by --enable-alpha-plugins in both cases.
	EnableExec bool
	// LoadRestrictions is `--load-restrictor` (default RootOnly, like the
	// CLI).
	LoadRestrictions LoadRestrictions
	// Env is the per-render environment overlay (KEY=VALUE), the entries
	// the exec pipeline handed to the kustomize child on top of its own
	// environment: KUBECONFIG, KHELM_TRUST_ANY_REPO, LOK8S_SECRETS_DISABLE,
	// a PATH with the toolchain, per-addon LOK8S_* overrides. In-process
	// the plugins are children of THIS process; the overlay reaches them
	// through a per-render file under the self-exec plugin home, never
	// through the process environment, so renders run in parallel and a
	// goroutine that reads the environment or starts a child meanwhile
	// sees nothing of it.
	Env []string
	// Stderr receives what the kustomize child wrote to its stderr: in
	// exec mode the child's stream, in-process the `Error: …` line the
	// kustomize CLI prints on failure. Nil = os.Stderr.
	Stderr io.Writer
}

Options shapes one render.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL