pkg/

LLMSafeSpaces Core Packages

Shared Go packages used by both the API service and the controller. All packages target Go 1.25+ and follow Kubernetes operator patterns where applicable.

Package Index

Kubernetes Client (kubernetes)

Manages Kubernetes API interactions for the API service.

client, err := kubernetes.New(cfg, logger)
client.Start()
defer client.Stop()

wsClient := client.LlmsafespacesV1().Workspaces("namespace")
ws, err := wsClient.Get("my-workspace", metav1.GetOptions{})

Key features: in-cluster or kubeconfig auth, connection pooling (QPS 100, Burst 200), leader election via Lease locks, SharedInformerFactory (30m resync), typed REST client for llmsafespaces.dev/v1.

CRD Types (apis/llmsafespaces/v1)

Three CRDs in the llmsafespaces.dev/v1 API group:

Nine Workspace phases: Pending → Creating → Active → Suspending → Suspended → Resuming → Active, with Terminating → Terminated and Failed terminal exits.

Secrets (secrets)

Encrypted at rest secret store. Per-user DEK derived from password via HKDF-SHA256.

Components: SecretService (CRUD + bindings + audit), KeyService (DEK wrapping/caching/rotation), crypto.go (AES-256-GCM), SecretProvider interface (Postgres impl), RedisCache (session DEK cache).

Secret types: llm-provider, ssh-key, git-credential, secret-file, env-secret

Settings (settings)

Declarative tiered configuration. Single Go schema drives validation, seeding, API, and frontend forms.

• Tier 2 (Instance): admin-mutable, instance_settings table, singleflight-cached (60s TTL)
• Tier 3 (User): per-user, user_settings table

Typed accessors: GetBool(ctx, key), GetInt(ctx, key), GetString(ctx, key)

Credentials (credentials)

Admin-managed credential sets with AES-256-GCM encryption and versioned key rotation.

Interfaces (interfaces)

type KubernetesClient interface {
    Start() error
    Stop()
    Clientset() kubernetes.Interface
    DynamicClient() dynamic.Interface
    RESTConfig() *rest.Config
    InformerFactory() informers.SharedInformerFactory
    LlmsafespacesV1() LLMSafespacesV1Interface
}

type LoggerInterface interface {
    Debug(msg string, keysAndValues ...interface{})
    Info(msg string, keysAndValues ...interface{})
    Warn(msg string, keysAndValues ...interface{})
    Error(msg string, err error, keysAndValues ...interface{})
    Fatal(msg string, err error, keysAndValues ...interface{})
    With(keysAndValues ...interface{}) LoggerInterface
    Sync() error
}

Testing

All packages include unit tests. Mocks in /mocks (kubernetes, types, logger).

go test -timeout 90s -race ./pkg/...