Documentation
¶
Index ¶
- func ApplicationNeedsInitialization(durable, currentBoot string) bool
- func AssertVaultAgentReady(ctx context.Context, options VaultAgentOptions) error
- func BootstrapState(ctx context.Context, marker string) (string, error)
- func ClearVaultReadiness(options VaultReadinessOptions) error
- func ConfigureHost(ctx context.Context, options ConfigureOptions) error
- func ConfigureMetadataFirewall(ctx context.Context, options MetadataFirewallOptions) error
- func ConsumeFreshMarker(path, identity string) error
- func ConvergeKeyRotation(ctx context.Context, options KeyRotationOptions) error
- func EnsureBootstrap(ctx context.Context, marker string, options SystemdOptions) error
- func InitializeVaultAgent(ctx context.Context, options VaultAgentOptions) error
- func InstallDockerPlugins(ctx context.Context, options DockerPluginOptions) error
- func InstallManagedArtifacts(ctx context.Context, options ArtifactInstallOptions) error
- func InstallManagedRuntime(ctx context.Context, options RuntimeInstallOptions) error
- func MarkerValid(path string) bool
- func MigrateLegacyUnits(ctx context.Context, directory string, stdout, stderr io.Writer) error
- func MountOverlays(ctx context.Context, options OverlayOptions) error
- func PrepareFilesystems(ctx context.Context, options FilesystemOptions) error
- func PrepareVaultReadiness(options VaultReadinessOptions) error
- func PruneDocker(ctx context.Context, until, lockPath string, stdout, stderr io.Writer) error
- func PublishMarker(path string) error
- func RetireKeyCredentials(ctx context.Context, options KeyRotationOptions) error
- func RollbackKeyRotation(ctx context.Context, options KeyRotationOptions) error
- func RunMariaDBBackups(ctx context.Context, manifest Manifest, options BackupOptions) error
- func RunOffhostBackup(ctx context.Context, manifest Manifest, options BackupOptions) error
- func RunRestoreTest(ctx context.Context, options BackupOptions) error
- func SecureRuntimeHome(options SecureRuntimeOptions) error
- func ServeRollout(options RolloutServeOptions) error
- func SetComposeEnv(path, name, value, markerPrefix string) error
- func SetRuntimeEnv(path, name, value string) error
- func StartAndWaitSystemd(ctx context.Context, options SystemdOptions) error
- func SyncComposeEnv(path, jsonPath string) error
- func WaitForVaultReadiness(ctx context.Context, options VaultReadinessOptions) error
- func WriteDiagnostics(ctx context.Context, manifest Manifest, dump bool, stdout io.Writer) error
- type Application
- type Apps
- type ArtifactInstallOptions
- type BackupOptions
- type ConfigureOptions
- type CredentialCopy
- type DockerPluginOptions
- type FilesystemOptions
- type Ingress
- type KeyRotationOptions
- type Lock
- type Manifest
- type MetadataFirewallOptions
- type OverlayOptions
- type RolloutServeOptions
- type RuntimeInstallOptions
- type SecureRuntimeOptions
- type SystemdOptions
- type VaultAgentOptions
- type VaultReadinessOptions
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ApplicationNeedsInitialization ¶
ApplicationNeedsInitialization reports whether neither durable nor current-boot readiness exists.
func AssertVaultAgentReady ¶
func AssertVaultAgentReady(ctx context.Context, options VaultAgentOptions) error
AssertVaultAgentReady gates applications on the explicitly enabled service.
func BootstrapState ¶
BootstrapState reports complete, active, or idle for host provisioning.
func ClearVaultReadiness ¶
func ClearVaultReadiness(options VaultReadinessOptions) error
ClearVaultReadiness removes the current-boot readiness marker.
func ConfigureHost ¶
func ConfigureHost(ctx context.Context, options ConfigureOptions) error
ConfigureHost normalizes the managed account, runtime paths, and provider metadata.
func ConfigureMetadataFirewall ¶
func ConfigureMetadataFirewall(ctx context.Context, options MetadataFirewallOptions) error
ConfigureMetadataFirewall installs the idempotent GCP metadata deny policy.
func ConsumeFreshMarker ¶
ConsumeFreshMarker validates and removes a one-shot fresh-filesystem marker.
func ConvergeKeyRotation ¶
func ConvergeKeyRotation(ctx context.Context, options KeyRotationOptions) error
ConvergeKeyRotation advances a durable key rotation by one idempotent pass.
func EnsureBootstrap ¶
func EnsureBootstrap(ctx context.Context, marker string, options SystemdOptions) error
EnsureBootstrap starts bootstrap only when its durable marker is absent.
func InitializeVaultAgent ¶
func InitializeVaultAgent(ctx context.Context, options VaultAgentOptions) error
InitializeVaultAgent enables the service only after its trusted inputs are ready.
func InstallDockerPlugins ¶
func InstallDockerPlugins(ctx context.Context, options DockerPluginOptions) error
InstallDockerPlugins installs checksum-verified Compose and Buildx executables.
func InstallManagedArtifacts ¶
func InstallManagedArtifacts(ctx context.Context, options ArtifactInstallOptions) error
InstallManagedArtifacts validates the complete manifest, then atomically installs each artifact.
func InstallManagedRuntime ¶
func InstallManagedRuntime(ctx context.Context, options RuntimeInstallOptions) error
InstallManagedRuntime stages and verifies the complete package set before atomically publishing it as one immutable generation.
func MarkerValid ¶
MarkerValid reports whether a Cloud Compose readiness marker is safe and valid.
func MigrateLegacyUnits ¶
MigrateLegacyUnits removes only exact generic units previously shipped by Cloud Compose.
func MountOverlays ¶
func MountOverlays(ctx context.Context, options OverlayOptions) error
MountOverlays converges the declared Docker volume overlays.
func PrepareFilesystems ¶
func PrepareFilesystems(ctx context.Context, options FilesystemOptions) error
PrepareFilesystems converges the host's data, Docker-volume, optional overlay, bind mounts, and managed fstab block without ever formatting a signed disk.
func PrepareVaultReadiness ¶
func PrepareVaultReadiness(options VaultReadinessOptions) error
PrepareVaultReadiness removes stale state and creates the root-only sink directory.
func PruneDocker ¶
PruneDocker removes stopped and dangling Docker data older than the supplied duration.
func PublishMarker ¶
PublishMarker atomically writes a root-owned readiness marker.
func RetireKeyCredentials ¶
func RetireKeyCredentials(ctx context.Context, options KeyRotationOptions) error
RetireKeyCredentials removes the managed remote key and every local credential copy.
func RollbackKeyRotation ¶
func RollbackKeyRotation(ctx context.Context, options KeyRotationOptions) error
RollbackKeyRotation restores the prior key while it is in the disable grace period.
func RunMariaDBBackups ¶
func RunMariaDBBackups(ctx context.Context, manifest Manifest, options BackupOptions) error
RunMariaDBBackups creates one validated daily dump per manifest application.
func RunOffhostBackup ¶
func RunOffhostBackup(ctx context.Context, manifest Manifest, options BackupOptions) error
RunOffhostBackup proves complete recovery coverage through an operator-owned driver.
func RunRestoreTest ¶
func RunRestoreTest(ctx context.Context, options BackupOptions) error
RunRestoreTest asks the off-host driver to prove the latest backup in a disposable recovery.
func SecureRuntimeHome ¶
func SecureRuntimeHome(options SecureRuntimeOptions) error
SecureRuntimeHome verifies and normalizes the privileged Cloud Compose runtime.
func ServeRollout ¶
func ServeRollout(options RolloutServeOptions) error
ServeRollout validates the root-owned configuration and replaces sitectl with the rollout service.
func SetComposeEnv ¶
func SetRuntimeEnv ¶
func StartAndWaitSystemd ¶
func StartAndWaitSystemd(ctx context.Context, options SystemdOptions) error
StartAndWaitSystemd enables, starts, and waits for an allowed Cloud Compose oneshot.
func SyncComposeEnv ¶
func WaitForVaultReadiness ¶
func WaitForVaultReadiness(ctx context.Context, options VaultReadinessOptions) error
WaitForVaultReadiness waits for a non-empty, single-link regular sink token.
Types ¶
type Application ¶
type Application struct {
Name string `json:"name"`
DockerComposeRepo string `json:"docker_compose_repo"`
DockerComposeBranch string `json:"docker_compose_branch"`
RepoPath string `json:"repo_path"`
ProjectDir string `json:"project_dir"`
ComposeProjectName string `json:"compose_project_name"`
IngressPort int `json:"ingress_port"`
SitectlContextName string `json:"sitectl_context_name"`
SitectlPlugin string `json:"sitectl_plugin"`
SitectlEnvironment string `json:"sitectl_environment"`
SitectlPackages []string `json:"sitectl_packages"`
SitectlVerifyArgs []string `json:"sitectl_verify_args"`
Ingress Ingress `json:"ingress"`
InitCommands []string `json:"init_commands"`
UpCommands []string `json:"up_commands"`
DownCommands []string `json:"down_commands"`
RolloutCommands []string `json:"rollout_commands"`
}
func (Application) Environment ¶
func (a Application) Environment() []string
type Apps ¶
type Apps struct {
Manifest Manifest
LifecycleExecutor string
ApplicationEnv string
StateDir string
SitectlExecutable string
Stdout io.Writer
Stderr io.Writer
}
func (Apps) ConvergeFilesystems ¶
func (Apps) PrepareSources ¶
type ArtifactInstallOptions ¶
type ArtifactInstallOptions struct {
Manifest string
StateDir string
Client *http.Client
AllowHTTP bool
Restart func(context.Context, string) error
TrustedUID int
}
ArtifactInstallOptions controls installation of verified managed artifacts.
type BackupOptions ¶
type BackupOptions struct {
Root string
RetentionDays int
StateRoot string
Driver string
DataRoot string
VolumesRoot string
Provider string
Instance string
Now func() time.Time
Sitectl string
LockPath string
Stdout io.Writer
Stderr io.Writer
}
BackupOptions controls local and off-host managed backups.
type ConfigureOptions ¶
type ConfigureOptions struct {
Provider string
RuntimeHome string
DataRoot string
VolumesRoot string
EnvironmentFile string
InternalEnabled bool
MetadataURL string
HTTPClient *http.Client
Stdout io.Writer
Stderr io.Writer
}
ConfigureOptions controls root-owned host account and runtime preparation.
type CredentialCopy ¶
CredentialCopy declares one application-owned copy of a central credential.
type DockerPluginOptions ¶
type DockerPluginOptions struct {
Directory string
ComposeVersion string
BuildxVersion string
Architecture string
ReleaseBase string
Client *http.Client
AllowHTTP bool
}
DockerPluginOptions controls verified Docker CLI plugin installation.
type FilesystemOptions ¶
type FilesystemOptions struct {
DataDevice string
VolumesDevice string
OverlayDevice string
DataMount string
VolumesMount string
OverlayMount string
FreshIdentity string
ReadyMarker string
FstabPath string
FstabLockPath string
SystemdDir string
DeviceWait time.Duration
AutomountWait time.Duration
Stdout io.Writer
Stderr io.Writer
}
FilesystemOptions controls durable disk discovery, formatting, mounting, and persistence.
type Ingress ¶
type Ingress struct {
LetsEncrypt bool `json:"letsencrypt"`
BotMitigation bool `json:"bot_mitigation"`
Mode string `json:"mode"`
Domain string `json:"domain"`
ACMEEmail string `json:"acme_email"`
TrustedIPs []string `json:"trusted_ips"`
MaxUploadSize string `json:"max_upload_size"`
UploadTimeout string `json:"upload_timeout"`
}
type KeyRotationOptions ¶
type KeyRotationOptions struct {
ServiceAccount string
ProjectID string
CredentialsFile string
Owner string
Group string
Copies []CredentialCopy
RestartUnit string
MinimumAge time.Duration
DisableGrace time.Duration
AllowOrphanReconcile bool
FreshMarker string
FreshIdentity string
HTTPClient *http.Client
IAMBaseURL string
MetadataTokenURL string
Now func() time.Time
Stdout io.Writer
}
KeyRotationOptions defines one managed GCP service-account credential.
type Lock ¶
type Lock struct {
// contains filtered or unexported fields
}
func AcquireLock ¶
AcquireLock obtains an exclusive host lifecycle lock without following a symbolic-link target. The environment-configured timeout bounds contention.
type MetadataFirewallOptions ¶
type MetadataFirewallOptions struct {
Provider string
Mode string
Stdout io.Writer
Stderr io.Writer
}
MetadataFirewallOptions controls GCP metadata isolation for the host and containers.
type OverlayOptions ¶
type OverlayOptions struct {
VolumesRoot string
LowerRoot string
Volumes []string
Reset bool
Stdout io.Writer
Stderr io.Writer
}
OverlayOptions controls read-only production volume overlays.
type RolloutServeOptions ¶
type RolloutServeOptions struct {
Port, JWKSURI, Audience, CustomClaims, Binary string
}
RolloutServeOptions controls the managed rollout service process.
type RuntimeInstallOptions ¶
type RuntimeInstallOptions struct {
StateDir string
PublishedDir string
Packages []string
Versions map[string]string
Fallback string
GitHubOwner string
ReleaseBase string
APIBase string
Architecture string
Client *http.Client
AllowHTTP bool
TrustedUID int
Artifact ArtifactInstallOptions
}
RuntimeInstallOptions controls installation of the shared sitectl package set.
type SecureRuntimeOptions ¶
type SecureRuntimeOptions struct {
Home string
TrustedUID uint32
TrustedGID uint32
RuntimeGID uint32
}
SecureRuntimeOptions controls the root trust boundary around host programs.
type SystemdOptions ¶
type SystemdOptions struct {
Unit string
Timeout time.Duration
Poll time.Duration
Heartbeat time.Duration
Stdout io.Writer
Stderr io.Writer
}
SystemdOptions controls bounded Cloud Compose oneshot convergence.