Documentation
¶
Overview ¶
Package render is the single kustomize entry point for the Go binary.
Build renders a kustomization directory the way `kustomize build --enable-alpha-plugins [--enable-exec] <dir>` does. Two builds of the binary exist, selected by the `inprocess` build tag (see core.go and inprocess.go):
- lo (CORE, the default build): the render EXECS the pinned kustomize binary from the project's toolchain (.bin first, then PATH) with KUSTOMIZE_PLUGIN_HOME defaulted to <project>/.kustomize, where the b-managed exec generators live — khelm's ChartRenderer and the kustomize-secret Secret plugin (`lo toolchain install` installs all three, pinned). No kustomize API, no khelm, no helm are linked in. The secrets.lok8s.dev generator itself IS still part of core (kustomize/plugins/secret, imported) — the registry TLS mint calls it in-process, it is ours and small.
- lo-full (build tag `inprocess`): the pinned kustomize API (sigs.k8s.io/kustomize/api — the module behind the kustomize binary the toolchain pins) runs inside the binary, and both exec generators are served by the binary ITSELF through a per-process plugin home of symlinks pointing at the running executable (DispatchPlugin routes argv[0]). No kustomize, khelm or .kustomize/ is needed. LO_RENDER=exec restores the subprocess pipeline for an A/B comparison.
Byte parity is the contract: both pipelines produce the same bytes. The pins that make that true — the kustomize API version and the kustomize CLI release it corresponds to, the khelm library/binary version (+ its helm) — live in internal/toolchain (pins.go) and are drift-tested against go.mod and the generated .bin/b.yaml template.
Index ¶
- Constants
- func Build(ctx context.Context, dir string, o Options) ([]byte, error)
- func Cleanup()
- func DispatchPlugin(_ context.Context, _ []string, _ io.Reader, _, _ io.Writer) (handled bool, rc int)
- func InProcessAvailable() bool
- func SecretInProcess() bool
- func Variant() string
- type LoadRestrictions
- type Mode
- type Options
Constants ¶
const ModeEnv = "LO_RENDER"
ModeEnv selects the render pipeline. lo-full: unset/"inprocess" (the default) runs kustomize in-process, "exec" restores the subprocess pipeline. lo core: unset/"exec" run the subprocess pipeline (the only one it has) and "inprocess" is rejected with a pointer to lo-full. Any other value is rejected (fail closed).
Variables ¶
This section is empty.
Functions ¶
func Build ¶
Build renders dir and returns the YAML stream `kustomize build` would have written to stdout. On failure the kustomize error line has already been written to Options.Stderr (exec: by the child; in-process: the same `Error: <msg>` cobra line) and the error is returned for the caller's own reporting — callers print their own [error] lines exactly as before.
func Cleanup ¶
func Cleanup()
Cleanup is a no-op on core (no self-exec plugin home is ever created).
func DispatchPlugin ¶
func DispatchPlugin(_ context.Context, _ []string, _ io.Reader, _, _ io.Writer) (handled bool, rc int)
DispatchPlugin is a no-op on core: kustomize runs as a child process and execs the plugin BINARIES under KUSTOMIZE_PLUGIN_HOME, never this executable. main still calls it first so both builds share one entry.
func InProcessAvailable ¶
func InProcessAvailable() bool
InProcessAvailable reports whether this build links the in-process renderer (lo-full). Tests use it to skip in-process assertions on core.
func SecretInProcess ¶
func SecretInProcess() bool
SecretInProcess reports whether the imported secrets.lok8s.dev generator runs inside this process for the registry TLS mint: true unless LO_RENDER=exec asks for the subprocess pipeline explicitly. Independent of the build variant — the generator is linked into core as well — so core mints the dev registry cert without the plugin binary, exactly like lo-full, and only the explicit escape hatch reproduces the bash behaviour (exec the built plugin, fail when it is missing).
Types ¶
type LoadRestrictions ¶
type LoadRestrictions int
LoadRestrictions is `--load-restrictor`: RootOnly (the default, like the CLI) or None. Declared here rather than borrowed from the kustomize API so core does not link it.
const ( // LoadRestrictionsRootOnly forbids files outside the kustomization root. LoadRestrictionsRootOnly LoadRestrictions = iota // LoadRestrictionsNone allows them. LoadRestrictionsNone )
type Mode ¶
type Mode string
Mode is the resolved value of ModeEnv.
func CurrentMode ¶
CurrentMode reads LO_RENDER. An unknown value is an error so a typo can never silently pick a pipeline; on core an explicit "inprocess" is an error too, naming the build that has it.
type Options ¶
type Options struct {
// Paths locates the project. In-process it is unused; in exec mode it
// resolves the kustomize binary (.bin first) and hands the child
// KUSTOMIZE_PLUGIN_HOME from config.KustomizePluginHome: the variable
// when set, else <Base>/.kustomize. Every render that runs in a
// project (the domain build, the addon render, `lo k8s`) passes it.
// Nil is allowed only for a render outside a project: then exec mode
// needs Runner and leaves the plugin home to the process environment.
Paths *config.Paths
// Runner runs the exec-mode kustomize child (the hermetic seam the
// addon tests stub). Nil = execx.NewRunner(Paths).
Runner execx.Runner
// EnableExec is `--enable-exec` (KRM exec functions). The addon render
// passes it; the domain build does not. Legacy exec generators are
// enabled by --enable-alpha-plugins in both cases.
EnableExec bool
// LoadRestrictions is `--load-restrictor` (default RootOnly, like the
// CLI).
LoadRestrictions LoadRestrictions
// Env is the per-render environment overlay (KEY=VALUE), the entries
// the exec pipeline handed to the kustomize child on top of its own
// environment: KUBECONFIG, KHELM_TRUST_ANY_REPO, LOK8S_SECRETS_DISABLE,
// a PATH with the toolchain, per-addon LOK8S_* overrides. In-process
// the plugins are children of THIS process; the overlay reaches them
// through a per-render file under the self-exec plugin home, never
// through the process environment, so renders run in parallel and a
// goroutine that reads the environment or starts a child meanwhile
// sees nothing of it.
Env []string
// Stderr receives what the kustomize child wrote to its stderr: in
// exec mode the child's stream, in-process the `Error: …` line the
// kustomize CLI prints on failure. Nil = os.Stderr.
Stderr io.Writer
}
Options shapes one render.