Help us shape the future of Go! Take the 2026 Go Developer Survey

application

package
v0.4.15 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Sep 25, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	LogsEnabledEnv        = "BASEHARBOR_LOGS_ENABLED"
	LogsCollectSourcesEnv = "BASEHARBOR_LOGS_COLLECT"
)
View Source 
const (
	MetricsEnabledEnv        = "BASEHARBOR_METRICS_ENABLED"
	MetricsCollectSourcesEnv = "BASEHARBOR_METRICS_COLLECT"
)
View Source 
const (
	S3TLSHostCAEnv   = "S3_TLS_CA_FILE"
	S3TLSContainerCA = "/run/baseharbor/bindings/object-storage/ca.pem"
)
View Source 
const (
	DefaultRuntimeAPIURL                   = "https://baseharbor-runtime:8443"
	RuntimeIdentityContainerTokenPath      = "/run/secrets/baseharbor-runtime-token"
	RuntimeIdentityContainerCAPath         = "/run/secrets/baseharbor-runtime-ca"
	RuntimeIdentityContainerClientCertPath = "/run/secrets/baseharbor-runtime-client-cert"
	RuntimeIdentityContainerClientKeyPath  = "/run/secrets/baseharbor-runtime-client-key"
	RuntimeIdentityContainerTLSCertPath    = "/run/secrets/baseharbor-tls-cert"
	RuntimeIdentityContainerTLSKeyPath     = "/run/secrets/baseharbor-tls-key"
	SecretFileBindingContainerDir          = "/run/baseharbor/bindings/secrets"
)
View Source 
const (
	OTLPProviderEnv = "BASEHARBOR_OTLP_PROVIDER"
	OTLPEndpointEnv = "BASEHARBOR_OTLP_ENDPOINT"
)
View Source 
const (
	OTLPTLSHostCAEnv         = "OTLP_TLS_CA_FILE"
	OTLPTLSHostClientCertEnv = "OTLP_TLS_CLIENT_CERT_FILE"
	OTLPTLSHostClientKeyEnv  = "OTLP_TLS_CLIENT_KEY_FILE"

	OTLPTLSContainerCA         = "/run/baseharbor/bindings/telemetry/ca.pem"
	OTLPTLSContainerClientCert = "/run/baseharbor/bindings/telemetry/client-cert.pem"
	OTLPTLSContainerClientKey  = "/run/baseharbor/bindings/telemetry/client-key.pem"
)
View Source 
const (
	TracesEnabledEnv        = "BASEHARBOR_TRACES_ENABLED"
	TracesCollectSourcesEnv = "BASEHARBOR_TRACES_COLLECT"
)
View Source 
const (
	WorkloadSecurityModeEnv  = "BASEHARBOR_WORKLOAD_SECURITY_MODE"
	WorkloadSecurityAllowEnv = "BASEHARBOR_WORKLOAD_SECURITY_ALLOW"
)
View Source 
const CurrentVersion = 1
View Source 
const (
	LastBackupMetadataVersion = 1
)
View Source 
const (
	LastRecoveryMetadataVersion = 1
)
View Source 
const (
	LastUpdateMetadataVersion = 1
)
View Source 
const MaxPostgresBackupBytes int64 = 512 << 20
View Source 
const RepositoryManifestName = "baseharbor.yaml"

Variables

View Source 
var ErrExists = errors.New("application already exists")
View Source 
var ErrNoBackupMetadata = errors.New("no application backup metadata recorded")
View Source 
var ErrNoRecoveryMetadata = errors.New("no application recovery metadata recorded")
View Source 
var ErrNoUpdateMetadata = errors.New("no application update metadata recorded")
View Source 
var ErrRepositoryManifestNotFound = errors.New("repository manifest not found")
View Source 
var ErrRuntimeAPIURL = errors.New("application runtime API URL is invalid")
View Source 
var ErrRuntimeDefinitionChanged = errors.New("application runtime definition differs from the BaseHarbor-managed definition")
View Source 
var ErrRuntimeNotApplied = errors.New("application runtime has not been applied")
View Source 
var ErrUnsupportedService = errors.New("application contains services that are not yet supported by apply")
View Source 
var ErrWorkloadComposeAmbiguous = errors.New("multiple application Compose files found")
View Source 
var ErrWorkloadComposeNotFound = errors.New("application Compose file not found")

Functions

func AddConnectivityRule added in v0.4.8 

func AddConnectivityRule(rule ConnectivityRule) error

func AddConnectivityRuleAt added in v0.4.15 

func AddConnectivityRuleAt(dataDir string, rule ConnectivityRule) error

func ApplicationBackendNetworkName 

func ApplicationBackendNetworkName(m Manifest) string

ApplicationBackendNetworkName returns the legacy stable network name.

func ApplicationBackendNetworkNameForProject added in v0.4.15 

func ApplicationBackendNetworkNameForProject(project string) string

func ApplicationExposureNetworkName added in v0.4.4 

func ApplicationExposureNetworkName(m Manifest) string

ApplicationExposureNetworkName returns the legacy exposure network name.

func ApplicationExposureNetworkNameForProject added in v0.4.15 

func ApplicationExposureNetworkNameForProject(project string) string

func CacheInstanceNames added in v0.4.15 

func CacheInstanceNames(m Manifest) []string

func CapabilityBindings added in v0.4.1 

func CapabilityBindings(m Manifest) ([]capability.Binding, error)

func CheckAdditionalProviderResources added in v0.4.9 

func CheckAdditionalProviderResources(m Manifest, additional []capability.Resource) error

func CheckAdditionalProviderResourcesAt added in v0.4.15 

func CheckAdditionalProviderResourcesAt(dataDir string, m Manifest, additional []capability.Resource) error

func CheckApplicationConnectivityReleased added in v0.4.8 

func CheckApplicationConnectivityReleased(m Manifest) error

func CheckApplicationConnectivityReleasedAt added in v0.4.15 

func CheckApplicationConnectivityReleasedAt(dataDir string, m Manifest) error

func CheckControlPlaneDestroySafe added in v0.4.4 

func CheckControlPlaneDestroySafe() error

func CheckControlPlaneDestroySafeAt added in v0.4.15 

func CheckControlPlaneDestroySafeAt(dataDir string) error

func CheckManagedRuntimeDefinition 

func CheckManagedRuntimeDefinition(files RuntimeFiles, m Manifest) error

CheckManagedRuntimeDefinition prevents destructive operations from trusting a locally modified Compose file. BaseHarbor may only mutate the runtime shape it originally generated and understands for the current manifest.

func CheckReferenceProviderRegistry added in v0.4.4 

func CheckReferenceProviderRegistry(m Manifest) error

CheckReferenceProviderRegistry validates the protected provider registry and simulates the desired application reconciliation without writing it. Lifecycle callers use this during preflight so invalid provider metadata fails before any runtime or workload mutation.

func CheckReferenceProviderRegistryAt added in v0.4.15 

func CheckReferenceProviderRegistryAt(dataDir string, m Manifest) error

func CheckRuntimePermissions 

func CheckRuntimePermissions(files RuntimeFiles) error

func CheckSupportedRuntimeServices 

func CheckSupportedRuntimeServices(m Manifest) error

func ConfiguredRuntimeAPIURL 

func ConfiguredRuntimeAPIURL() (string, bool, error)

func ConnectivityNetworkName added in v0.4.8 

func ConnectivityNetworkName(rule ConnectivityRule) string

func ConnectivityRuleID added in v0.4.8 

func ConnectivityRuleID(rule ConnectivityRule) string

func ConnectivityTargetAlias added in v0.4.8 

func ConnectivityTargetAlias(rule ConnectivityRule) string

func DefaultProviderPlacement added in v0.4.8 

func DefaultProviderPlacement(provider capability.ProviderKind) (capability.ProviderPlacement, error)

func EnsureBackendServiceAccess added in v0.4.15 

func EnsureBackendServiceAccess(ctx context.Context, issuer serviceaccess.Issuer, files RuntimeFiles, m Manifest) error

func EnsureRuntimeIdentity 

func EnsureRuntimeIdentity(m Manifest, files RuntimeFiles) (string, error)

func EnsureRuntimeServiceIdentities added in v0.4.8 

func EnsureRuntimeServiceIdentities(m Manifest, files RuntimeFiles) (map[string]string, error)

func ExpectedPersistentRuntimeResources 

func ExpectedPersistentRuntimeResources(m Manifest) []bhruntime.ProjectResource

func ExpectedPersistentRuntimeResourcesForProject added in v0.4.15 

func ExpectedPersistentRuntimeResourcesForProject(m Manifest, project string) []bhruntime.ProjectResource

func ExpectedPostgresRuntimeResources 

func ExpectedPostgresRuntimeResources(m Manifest) []bhruntime.ProjectResource

ExpectedPostgresRuntimeResources is kept for compatibility with the first runtime milestone. New lifecycle code should use ExpectedRuntimeResources.

func ExpectedRuntimeResources 

func ExpectedRuntimeResources(m Manifest) []bhruntime.ProjectResource

func ExpectedRuntimeResourcesForProject added in v0.4.15 

func ExpectedRuntimeResourcesForProject(m Manifest, project string) []bhruntime.ProjectResource

func ExternalOTLPEndpoint added in v0.4.7 

func ExternalOTLPEndpoint() string

func FindRepositoryManifest 

func FindRepositoryManifest(start string) (string, error)

FindRepositoryManifest returns the nearest baseharbor.yaml from start upward. This lets developers run baha from nested directories inside an application repository.

func GenerateSecretValue 

func GenerateSecretValue(generation SecretGeneration) ([]byte, error)

func HasExplicitWorkload added in v0.3.0 

func HasExplicitWorkload(m Manifest) bool

HasExplicitWorkload reports whether the repository manifest explicitly declares a Compose workload. Workload-only applications must be explicit so validation never guesses based on files outside the manifest.

func HasLogsCollection added in v0.4.11 

func HasLogsCollection(m Manifest) bool

func HasManagedRuntimeServices added in v0.3.0 

func HasManagedRuntimeServices(m Manifest) bool

HasManagedRuntimeServices reports whether BaseHarbor owns a materialized PostgreSQL or Valkey runtime for the application. Shared object storage uses its own lazy provider runtime and is intentionally not part of this project.

func HasMetricsSources added in v0.4.8 

func HasMetricsSources(m Manifest) bool

func HasOTLPTelemetry added in v0.4.7 

func HasOTLPTelemetry(m Manifest) bool

func HasObjectStorage added in v0.4.6 

func HasObjectStorage(m Manifest) bool

HasObjectStorage reports whether the application explicitly requests at least one logical S3 bucket.

func HasRepositoryApplication added in v0.4.13 

func HasRepositoryApplication(start string) (bool, error)

HasRepositoryApplication reports whether start is inside a repository that carries either the compatibility root manifest or one or more complete environment manifests. It intentionally does not select an environment.

func HasRequiredFileSecrets 

func HasRequiredFileSecrets(m Manifest) bool

func HasRuntimeCapabilityPermission added in v0.4.8 

func HasRuntimeCapabilityPermission(m Manifest, capabilityID string) bool

func HasRuntimeMetricsPermissions added in v0.4.8 

func HasRuntimeMetricsPermissions(m Manifest) bool

func HasTraceSignal added in v0.4.10 

func HasTraceSignal(m Manifest) bool

func InspectOwnedRuntimeResources 

func InspectOwnedRuntimeResources(ctx context.Context, compose bhruntime.Compose, m Manifest) ([]bhruntime.ProjectResource, error)

func InspectOwnedRuntimeResourcesForFiles added in v0.4.15 

func InspectOwnedRuntimeResourcesForFiles(ctx context.Context, compose bhruntime.Compose, m Manifest, files RuntimeFiles) ([]bhruntime.ProjectResource, error)

func LogsCollectionEnabled added in v0.4.9 

func LogsCollectionEnabled(m Manifest) (bool, error)

func ManagedSecretsSecureBinding added in v0.4.5 

func ManagedSecretsSecureBinding(m Manifest) capability.SecureBinding

ManagedSecretsSecureBinding describes the existing BaseHarbor runtime identity/secret-delivery semantics without exposing OpenBao paths, AppRoles, policies, tokens, private keys, or provider-specific object names.

func MaterializeOTLPBinding added in v0.4.7 

func MaterializeOTLPBinding(m Manifest, files RuntimeFiles, provider capability.ProviderKind, hostEndpoint, containerEndpoint string) error

func MaterializeOTLPTLSBinding added in v0.4.15 

func MaterializeOTLPTLSBinding(m Manifest, files RuntimeFiles, caFile, clientCertFile, clientKeyFile string) error

func MaterializeObjectStorageBinding added in v0.4.6 

func MaterializeObjectStorageBinding(m Manifest, files RuntimeFiles, logicalBucket, physicalBucket, endpoint, containerEndpoint, caFile string) error

MaterializeObjectStorageBinding updates the standard application-facing environment/file binding after the selected provider has materialized its concrete endpoint and bucket identity.

func MaterializeRuntimeIdentityWorkloadOverride 

func MaterializeRuntimeIdentityWorkloadOverride(m Manifest, workload WorkloadFiles, files RuntimeFiles, plan WorkloadBindingPlan) (string, bool, error)

MaterializeRuntimeIdentityWorkloadOverride adds only the protected bindings that selected application services actually consume. Runtime identity is injected through ordinary environment file paths plus Compose secret mounts; applications do not configure certificates, keys or broker topology.

func MetricsCollectionEnabled added in v0.4.8 

func MetricsCollectionEnabled(m Manifest) (bool, error)

MetricsCollectionEnabled is deployment policy, not portable application intent. Local development enables collection by default; test/staging/production require an explicit operator opt-in unless overridden with BASEHARBOR_METRICS_ENABLED.

func MetricsProviderNetworkName added in v0.4.8 

func MetricsProviderNetworkName(m Manifest) string

func MetricsProviderNetworkNameForNamespace added in v0.4.15 

func MetricsProviderNetworkNameForNamespace(m Manifest, namespace string) string

func MetricsRuntimeTargetVolumeName added in v0.4.8 

func MetricsRuntimeTargetVolumeName(m Manifest) string

func MetricsRuntimeTargetVolumeNameForNamespace added in v0.4.15 

func MetricsRuntimeTargetVolumeNameForNamespace(m Manifest, namespace string) string

func MetricsTargetAlias added in v0.4.8 

func MetricsTargetAlias(m Manifest, service string) string

func MetricsTargetAliasFor added in v0.4.8 

func MetricsTargetAliasFor(applicationName, environment, service string) string

func ObjectStorageBucketNames added in v0.4.6 

func ObjectStorageBucketNames(m Manifest) []string

func ObjectStorageSecureBinding added in v0.4.6 

func ObjectStorageSecureBinding(m Manifest, bucket string) capability.SecureBinding

ObjectStorageSecureBinding describes one application-owned S3 bucket without exposing concrete credentials or provider-specific identity/policy objects.

func OptionalSecretNames added in v0.4.15 

func OptionalSecretNames(m Manifest) []string

func ProviderExternalReferenceEnv added in v0.4.8 

func ProviderExternalReferenceEnv(provider capability.ProviderKind) string

func ProviderPlacementNameToken added in v0.4.8 

func ProviderPlacementNameToken(value string) string

func ProviderScopeEnv added in v0.4.8 

func ProviderScopeEnv(provider capability.ProviderKind) string

func ProviderSharingBoundaryEnv added in v0.4.8 

func ProviderSharingBoundaryEnv(provider capability.ProviderKind) string

func ReallocateRuntimePorts 

func ReallocateRuntimePorts(m Manifest, files RuntimeFiles) error

ReallocateRuntimePorts replaces only the generated host-port assignments for an already materialized application runtime. Credentials, databases, volumes and other persisted runtime values are left unchanged. This is used when the container runtime proves that a probed loopback port was claimed between allocation and the actual container bind.

func ReconcileReferenceProviderRegistry added in v0.4.2 

func ReconcileReferenceProviderRegistry(m Manifest, additional ...capability.Resource) error

func ReconcileReferenceProviderRegistryAt added in v0.4.15 

func ReconcileReferenceProviderRegistryAt(dataDir string, m Manifest, additional ...capability.Resource) error

func ReconcileRuntimeComponentObservability added in v0.4.15 

func ReconcileRuntimeComponentObservability(m Manifest, component RuntimeComponentObservability) error

func RegisteredProviderPlacement added in v0.4.8 

func RegisteredProviderPlacement(m Manifest, provider capability.ProviderKind) (capability.ProviderPlacement, bool, error)

func RegisteredProviderPlacementAt added in v0.4.15 

func RegisteredProviderPlacementAt(dataDir string, m Manifest, provider capability.ProviderKind) (capability.ProviderPlacement, bool, error)

func ReleaseApplicationProviderRegistry added in v0.4.2 

func ReleaseApplicationProviderRegistry(m Manifest) error

func ReleaseApplicationProviderRegistryAt added in v0.4.15 

func ReleaseApplicationProviderRegistryAt(dataDir string, m Manifest) error

func RemoveConnectivityRule added in v0.4.8 

func RemoveConnectivityRule(rule ConnectivityRule) error

func RemoveConnectivityRuleAt added in v0.4.15 

func RemoveConnectivityRuleAt(dataDir string, rule ConnectivityRule) error

func RepositoryEnvironmentStateRoot added in v0.4.13 

func RepositoryEnvironmentStateRoot(selection RepositoryEnvironmentSelection) string

RepositoryEnvironmentStateRoot keeps the v0.4.12 state path for the unchanged single-environment compatibility case and isolates every explicit/multi-env deployment below a stable environment scope.

func RequiredSecretNames 

func RequiredSecretNames(m Manifest) []string

func RequiredSecretUsesFileBinding 

func RequiredSecretUsesFileBinding(name string) bool

func RequiresRuntimeBroker added in v0.4.8 

func RequiresRuntimeBroker(m Manifest) bool

RequiresRuntimeBroker reports whether the application currently needs the per-application Application Runtime Broker. Keep broker lifecycle decisions centralized here so new authorized runtime capabilities can extend the requirement without duplicating lifecycle conditionals throughout the CLI.

func ResolveCapabilityResources added in v0.4.1 

func ResolveCapabilityResources(contract PortableContract) ([]capability.Resource, error)

func ResolveProviderPlacement added in v0.4.8 

func ResolveProviderPlacement(_ Manifest, provider capability.ProviderKind) (capability.ProviderPlacement, error)

ResolveProviderPlacement resolves deployment/operator placement for a provider. Portable application intent never participates in this decision. Defaults are deliberately simple; advanced users can override supported placement fields through the generic provider policy namespace.

func ResolveWorkloadCompose 

func ResolveWorkloadCompose(repositoryRoot string, m Manifest) (string, bool, error)

func ResourceExists 

func ResourceExists(resources []bhruntime.ProjectResource, kind string) bool

func ResourceNamedExists 

func ResourceNamedExists(resources []bhruntime.ProjectResource, wanted bhruntime.ProjectResource) bool

func RestorePostgresInstances 

func RestorePostgresInstances(ctx context.Context, runtime PostgresBackupRuntime, m Manifest, files RuntimeFiles, backups []PostgresBackup) error

func RevokeRuntimeIdentity 

func RevokeRuntimeIdentity(m Manifest, files RuntimeFiles) error

func RotateRuntimeIdentity 

func RotateRuntimeIdentity(m Manifest, files RuntimeFiles) error

func RuntimeAuthorizedServices added in v0.4.8 

func RuntimeAuthorizedServices(m Manifest) []string

func RuntimeComposeYAML 

func RuntimeComposeYAML(m Manifest) (string, error)

func RuntimeEnvironment added in v0.4.15 

func RuntimeEnvironment(files RuntimeFiles) (map[string]string, error)

func RuntimeIdentityRevoked 

func RuntimeIdentityRevoked(files RuntimeFiles) bool

func RuntimeIdentityRevokedPath 

func RuntimeIdentityRevokedPath(files RuntimeFiles) string

func RuntimeIdentityTokenPath 

func RuntimeIdentityTokenPath(files RuntimeFiles) string

func RuntimeMTLSHostDir 

func RuntimeMTLSHostDir(files RuntimeFiles) string

func RuntimePermissionFor added in v0.4.8 

func RuntimePermissionFor(m Manifest, capabilityID, operation string) bool

func RuntimeProjectName 

func RuntimeProjectName(m Manifest) string

func RuntimeProjectNameForStore added in v0.4.15 

func RuntimeProjectNameForStore(store Store, m Manifest) string

func RuntimeServiceIdentityDir added in v0.4.8 

func RuntimeServiceIdentityDir(files RuntimeFiles) string

func RuntimeServiceIdentityTokenPath added in v0.4.8 

func RuntimeServiceIdentityTokenPath(files RuntimeFiles, service string) string

func SQLInstanceNames added in v0.4.15 

func SQLInstanceNames(m Manifest) []string

func SecretFileContainerPath 

func SecretFileContainerPath(name string) string

func SecretFileHostDir 

func SecretFileHostDir(files RuntimeFiles) string

func SecretFileHostPath 

func SecretFileHostPath(files RuntimeFiles, name string) string

func SelectedWorkloadServices added in v0.4.9 

func SelectedWorkloadServices(repositoryRoot string, m Manifest) ([]string, string, bool, error)

func TelemetryProviderForDeployment added in v0.4.7 

func TelemetryProviderForDeployment() capability.Provider

func TracesCollectionEnabled added in v0.4.10 

func TracesCollectionEnabled(m Manifest) (bool, error)

func ValidatePostgresBackupSet 

func ValidatePostgresBackupSet(m Manifest, backups []PostgresBackup) error

func VerifyManagedProviderInteractions added in v0.4.15 

func VerifyManagedProviderInteractions(ctx context.Context, runtime bhruntime.Compose, m Manifest, files RuntimeFiles, sources []observability.SignalSource) error

func VerifyPostgresRuntime 

func VerifyPostgresRuntime(ctx context.Context, compose bhruntime.Compose, m Manifest, files RuntimeFiles) error

func VerifyValkeyRuntime 

func VerifyValkeyRuntime(ctx context.Context, compose bhruntime.Compose, m Manifest, files RuntimeFiles) error

func WorkloadProjectName 

func WorkloadProjectName(m Manifest) string

func WorkloadProjectNameForNamespace added in v0.4.15 

func WorkloadProjectNameForNamespace(m Manifest, namespace string) string

func WorkloadProjectNameForRuntime added in v0.4.15 

func WorkloadProjectNameForRuntime(m Manifest, runtime RuntimeFiles) string

Types

type Action 

type Action struct {
	Kind        string `json:"kind"`
	Resource    string `json:"resource"`
	Description string `json:"description"`
}

type BackendTLSLifecycleObservation added in v0.4.15 

type BackendTLSLifecycleObservation struct {
	Kind      string                             `json:"kind"`
	Instance  string                             `json:"instance"`
	Lifecycle serviceaccess.LifecycleObservation `json:"lifecycle"`
}

func InspectBackendTLSLifecycle added in v0.4.15 

func InspectBackendTLSLifecycle(files RuntimeFiles, m Manifest) ([]BackendTLSLifecycleObservation, error)

type BackupMetadata added in v0.3.0 

type BackupMetadata struct {
	Version           int       `json:"version"`
	Application       string    `json:"application"`
	Environment       string    `json:"environment"`
	CreatedAt         time.Time `json:"created_at"`
	ArchivePath       string    `json:"archive_path"`
	PostgresResources []string  `json:"postgres_resources,omitempty"`
	IncludesSecrets   bool      `json:"includes_secrets"`
}

func (BackupMetadata) Validate added in v0.3.0 

func (m BackupMetadata) Validate() error

type CapabilityKind added in v0.4.0 

type CapabilityKind = capability.Kind

CapabilityKind and CapabilityRequirement remain aliases in the application package so existing v0.4 callers keep their source-compatible contract while the reusable capability domain moves into the shared core. 

const (
	CapabilitySQL             CapabilityKind = capability.SQL
	CapabilityKeyValue        CapabilityKind = capability.KeyValue
	CapabilityExposureHTTP    CapabilityKind = capability.ExposureHTTP
	CapabilityObjectStorageS3 CapabilityKind = capability.ObjectStorageS3
	CapabilityTelemetryOTLP   CapabilityKind = capability.TelemetryOTLP
	CapabilityMetrics         CapabilityKind = capability.Metrics
	CapabilityLogs            CapabilityKind = capability.Logs
)

type CapabilityRequirement added in v0.4.0 

type CapabilityRequirement = capability.Requirement

type ConnectivityEndpoint added in v0.4.8 

type ConnectivityEndpoint struct {
	Application string `json:"application"`
	Environment string `json:"environment"`
	Service     string `json:"service"`
	Port        int    `json:"port,omitempty"`
}

func (ConnectivityEndpoint) Validate added in v0.4.8 

func (e ConnectivityEndpoint) Validate() error

type ConnectivityRule added in v0.4.8 

type ConnectivityRule struct {
	Source ConnectivityEndpoint `json:"source"`
	Target ConnectivityEndpoint `json:"target"`
}

func LoadConnectivityRules added in v0.4.8 

func LoadConnectivityRules() ([]ConnectivityRule, error)

func LoadConnectivityRulesAt added in v0.4.15 

func LoadConnectivityRulesAt(dataDir string) ([]ConnectivityRule, error)

func (ConnectivityRule) Validate added in v0.4.8 

func (r ConnectivityRule) Validate() error

type HTTPExposureRequirement added in v0.4.4 

type HTTPExposureRequirement struct {
	Name       string
	Service    string
	Port       int
	Protocol   string
	Visibility string
}

HTTPExposureRequirement is provider-neutral public HTTP exposure intent. Hostname, host port, TLS source paths and reverse-proxy implementation are deployment/provider state and deliberately absent.

type LogsDeploymentPolicy added in v0.4.9 

type LogsDeploymentPolicy struct {
	Enabled bool
	Collect map[LogsSourceClass]bool
}

func LogsPolicy added in v0.4.9 

func LogsPolicy(m Manifest) (LogsDeploymentPolicy, error)

type LogsRequirements added in v0.4.11 

type LogsRequirements struct {
	Collect []string
}

type LogsSourceClass added in v0.4.9 

type LogsSourceClass string
const (
	LogsSourceApplication         LogsSourceClass = "application"
	LogsSourceApplicationProvider LogsSourceClass = "application-provider"
	LogsSourcePlatformProvider    LogsSourceClass = "platform-provider"
)

type Manifest 

type Manifest struct {
	Version     int
	Name        string
	Environment string
	Services    Services
	Secrets     SecretRequirements
	Workload    WorkloadConfig
	Exposures   []HTTPExposureRequirement
	Telemetry   TelemetryRequirements
	Metrics     MetricsRequirements
	Logs        LogsRequirements
	Runtime     RuntimeRequirements
}

Manifest is the declarative application backend request understood by BaseHarbor.

func LoadManifestFile 

func LoadManifestFile(path string) (Manifest, error)

func New 

func New(name, environment string, sql, cache, secrets bool) Manifest

func ParseYAML 

func ParseYAML(input string) (Manifest, error)

ParseYAML parses the intentionally small v1 manifest grammar without adding a runtime dependency.

func WithCacheInstances added in v0.4.15 

func WithCacheInstances(m Manifest, names ...string) Manifest

func WithGeneratedSecret 

func WithGeneratedSecret(m Manifest, name, generationType string, size int) Manifest

func WithHTTPExposure added in v0.4.4 

func WithHTTPExposure(m Manifest, name, service string, port int, protocol string) Manifest

func WithLogsCollection added in v0.4.11 

func WithLogsCollection(m Manifest, sources ...string) Manifest

func WithMetricsSource added in v0.4.8 

func WithMetricsSource(m Manifest, name, service string, port int, path string) Manifest

func WithOTLPTelemetry added in v0.4.7 

func WithOTLPTelemetry(m Manifest, signals ...string) Manifest

func WithObjectStorageBuckets added in v0.4.6 

func WithObjectStorageBuckets(m Manifest, names ...string) Manifest

func WithOptionalGeneratedSecret added in v0.4.15 

func WithOptionalGeneratedSecret(m Manifest, name, generationType string, size int) Manifest

func WithOptionalSecrets added in v0.4.15 

func WithOptionalSecrets(m Manifest, names ...string) Manifest

func WithRequiredSecrets 

func WithRequiredSecrets(m Manifest, names ...string) Manifest

func WithRuntimePermission added in v0.4.8 

func WithRuntimePermission(m Manifest, capabilityID string, services []string, operations ...string) Manifest

func WithSQLInstances added in v0.4.15 

func WithSQLInstances(m Manifest, names ...string) Manifest

func WithWorkload 

func WithWorkload(m Manifest, compose string, services ...string) Manifest

func (Manifest) Validate 

func (m Manifest) Validate() error

func (Manifest) YAML 

func (m Manifest) YAML() string

type MetricsDeploymentPolicy added in v0.4.8 

type MetricsDeploymentPolicy struct {
	Enabled bool
	Collect map[MetricsSourceClass]bool
}

func MetricsPolicy added in v0.4.8 

func MetricsPolicy(m Manifest) (MetricsDeploymentPolicy, error)

MetricsPolicy is deployment/operator state, never portable application intent. Defaults keep the user-facing path simple: when metrics collection is enabled, BaseHarbor also observes managed providers that explicitly advertise safe OpenMetrics endpoints. Policy can narrow the collected source classes.

type MetricsRequirements added in v0.4.8 

type MetricsRequirements struct {
	Sources []MetricsSourceRequirement
}

type MetricsSourceClass added in v0.4.8 

type MetricsSourceClass string
const (
	MetricsSourceApplication         MetricsSourceClass = "application"
	MetricsSourceApplicationProvider MetricsSourceClass = "application-provider"
	MetricsSourcePlatformProvider    MetricsSourceClass = "platform-provider"
)

type MetricsSourceRequirement added in v0.4.8 

type MetricsSourceRequirement struct {
	Name    string
	Service string
	Port    int
	Path    string
}

type OTLPRequirement added in v0.4.7 

type OTLPRequirement struct {
	Signals []string
}

type ObjectStorageCredentials added in v0.4.6 

type ObjectStorageCredentials struct {
	AccessKeyID     string
	SecretAccessKey string
}

func LoadObjectStorageCredentials added in v0.4.6 

func LoadObjectStorageCredentials(files RuntimeFiles, bucket string) (ObjectStorageCredentials, error)

type Plan 

type Plan struct {
	ContractVersion string   `json:"contract_version"`
	Application     string   `json:"application"`
	Environment     string   `json:"environment"`
	Actions         []Action `json:"actions"`
}

func BuildPlan 

func BuildPlan(m Manifest) (Plan, error)

type PortableContract added in v0.4.0 

type PortableContract struct {
	Application  string
	Capabilities []CapabilityRequirement
	Secrets      SecretContract
	Exposures    []HTTPExposureRequirement
	Metrics      []MetricsSourceRequirement
	Logs         []string
}

PortableContract is the provider-neutral application requirement view used as the seam between manifest compatibility and runtime/capability providers.

Deployment context such as environment, Compose paths, host ports, TLS source directories and provider object names must not be added here. Those belong to deployment state or provider-specific configuration.

func PortableContractFromManifest added in v0.4.0 

func PortableContractFromManifest(m Manifest) (PortableContract, error)

PortableContractFromManifest translates the current manifest v1 compatibility surface into provider-neutral requirements without changing manifest behavior.

type PostgresBackup 

type PostgresBackup struct {
	Instance string
	SQL      []byte
}

func DumpPostgresInstances 

func DumpPostgresInstances(ctx context.Context, runtime PostgresBackupRuntime, m Manifest, files RuntimeFiles) ([]PostgresBackup, error)

type PostgresBackupRuntime 

type PostgresBackupRuntime interface {
	ExecProject(ctx context.Context, project, composeFile, envFile, service string, args ...string) (string, error)
	ExecProjectInput(ctx context.Context, project, composeFile, envFile string, input []byte, service string, args ...string) (string, error)
}

type RecoveryMetadata added in v0.3.0 

type RecoveryMetadata struct {
	Version         int       `json:"version"`
	Application     string    `json:"application"`
	Environment     string    `json:"environment"`
	RestoredAt      time.Time `json:"restored_at"`
	BackupCreatedAt time.Time `json:"backup_created_at"`
	ArchivePath     string    `json:"archive_path"`
}

func (RecoveryMetadata) Validate added in v0.3.0 

func (m RecoveryMetadata) Validate() error

type RepositoryEnvironmentSelection added in v0.4.13 

type RepositoryEnvironmentSelection struct {
	RepositoryRoot      string
	ManifestPath        string
	Manifest            Manifest
	Environment         string
	EnvironmentSpecific bool
	LegacyState         bool
}

RepositoryEnvironmentSelection is the deterministic repository/application source selected for one deployment environment. Environment-specific manifests are complete application contracts; they are never overlays.

func ResolveRepositoryEnvironment added in v0.4.13 

func ResolveRepositoryEnvironment(start, requested string) (RepositoryEnvironmentSelection, error)

ResolveRepositoryEnvironment resolves the repository root, complete manifest and deployment environment as one operation.

A root baseharbor.yaml remains the compatibility path for simple repositories. An explicit environment first prefers envs/<environment>/baseharbor.yaml. If that file does not exist, the root manifest is reused as complete intent and only its deployment context is overridden. This preserves the established -e/--environment behavior without mutating the repository contract.

type RuntimeComponentObservability added in v0.4.15 

type RuntimeComponentObservability struct {
	ID               string
	Provider         capability.ProviderKind
	Class            observability.SourceClass
	Scope            capability.ProviderScope
	OwnerApplication string

	MetricsNetwork  string
	MetricsTarget   string
	MetricsPath     string
	MetricsSecurity observability.Security

	LogsTarget string

	TracesTarget   string
	TracesSecurity observability.Security
}

type RuntimeContract 

type RuntimeContract struct {
	Env         string
	BindingsDir string
	Metadata    string
}

func EnsureRuntimeContract 

func EnsureRuntimeContract(m Manifest, files RuntimeFiles) (RuntimeContract, error)

type RuntimeFiles 

type RuntimeFiles struct {
	Dir            string
	Compose        string
	Env            string
	ApplicationEnv string
	Bindings       string
	Project        string
	Namespace      string
}

func EnsurePostgresRuntime 

func EnsurePostgresRuntime(ctx context.Context, issuer serviceaccess.Issuer, store Store, m Manifest) (RuntimeFiles, error)

EnsurePostgresRuntime is kept for callers from the first runtime milestone.

func EnsureRuntime 

func EnsureRuntime(ctx context.Context, issuer serviceaccess.Issuer, store Store, m Manifest) (RuntimeFiles, error)

func ExistingRuntimeFiles 

func ExistingRuntimeFiles(store Store, m Manifest) (RuntimeFiles, error)

func RuntimeFilesFor added in v0.4.4 

func RuntimeFilesFor(store Store, m Manifest) RuntimeFiles

type RuntimeOTLPBinding added in v0.4.15 

type RuntimeOTLPBinding struct {
	Provider          capability.ProviderKind
	ContainerEndpoint string
	CAFile            string
	ClientCertFile    string
	ClientKeyFile     string
	Headers           string
}

func ExistingRuntimeOTLPBinding added in v0.4.15 

func ExistingRuntimeOTLPBinding(m Manifest, files RuntimeFiles) (RuntimeOTLPBinding, bool, error)

type RuntimePermission added in v0.4.8 

type RuntimePermission struct {
	Capability string
	Services   []string
	Operations []string
}

type RuntimeRequirements added in v0.4.8 

type RuntimeRequirements struct {
	Permissions []RuntimePermission
}

type SecretContract added in v0.4.0 

type SecretContract struct {
	Managed  bool
	Required []SecretRequirement
}

SecretContract describes secret intent without selecting a concrete secret backend or delivery mechanism. Required values remain names/generation intent only; provider credentials and provider object identifiers never belong here.

type SecretGeneration 

type SecretGeneration struct {
	Type   string
	Length int
	Bytes  int
}

type SecretRequirement 

type SecretRequirement struct {
	Name     string
	Generate *SecretGeneration
}

func GeneratedSecretRequirements 

func GeneratedSecretRequirements(m Manifest) []SecretRequirement

func SecretRequirementByName 

func SecretRequirementByName(m Manifest, name string) (SecretRequirement, bool)

type SecretRequirements 

type SecretRequirements struct {
	Required []SecretRequirement
	Optional []SecretRequirement
}

SecretRequirements declares application-owned secret requirements. Values never belong in the manifest. Generate only expresses explicit intent for BaseHarbor to create a missing value directly in the managed secret backend.

type ServiceBinding added in v0.3.0 

type ServiceBinding struct {
	Kind             string
	Instance         string
	Host             string
	Port             string
	Database         string
	Username         string
	Password         string
	URI              string
	CertificatesPath string
}

ServiceBinding is the provider-neutral information needed by developer access actions. Callers should prefer these fields over runtime/container names so a later provider can satisfy the same action model.

func ResolveServiceBinding added in v0.3.0 

func ResolveServiceBinding(files RuntimeFiles, kind, instance string) (ServiceBinding, error)

ResolveServiceBinding loads an already-materialized owner-only service binding. It never creates or rotates credentials.

type ServiceInstance 

type ServiceInstance struct{}

ServiceInstance is the stable logical identity of one requested backend service. The empty v1 shape is intentional: topology remains a BaseHarbor implementation detail and future intent such as availability can evolve here.

type Services 

type Services struct {
	SQL                  bool
	Cache                bool
	Secrets              bool
	ObjectStorage        bool
	SQLInstances         map[string]ServiceInstance
	CacheInstances       map[string]ServiceInstance
	ObjectStorageBuckets map[string]ServiceInstance
}

type StatusCheck added in v0.4.11 

type StatusCheck struct {
	Name   string `json:"name"`
	OK     bool   `json:"ok"`
	Detail string `json:"detail,omitempty"`
}

StatusCheck is a secret-safe readiness observation shared by CLI and future machine-oriented control surfaces.

type StatusResult added in v0.4.11 

type StatusResult struct {
	ContractVersion string        `json:"contract_version"`
	Target          string        `json:"target"`
	Application     string        `json:"application"`
	Environment     string        `json:"environment"`
	Manifest        string        `json:"manifest,omitempty"`
	Project         string        `json:"project"`
	State           string        `json:"state"`
	Ready           bool          `json:"ready"`
	Checks          []StatusCheck `json:"checks"`
}

StatusResult is the shared application readiness model. It intentionally contains operational state only and never credential or secret values.

func (*StatusResult) AddCheck added in v0.4.11 

func (r *StatusResult) AddCheck(name string, ok bool, detail string)

AddCheck appends one readiness observation and folds failures into Ready.

type Store 

type Store struct {
	Root      string
	Namespace string
}

func DefaultStore 

func DefaultStore() Store

func (Store) Create 

func (s Store) Create(m Manifest) (string, error)

func (Store) Delete 

func (s Store) Delete(name string) error

func (Store) LastBackup added in v0.3.0 

func (s Store) LastBackup(applicationName string) (BackupMetadata, error)

func (Store) LastRecovery added in v0.3.0 

func (s Store) LastRecovery(applicationName string) (RecoveryMetadata, error)

func (Store) LastUpdate added in v0.3.0 

func (s Store) LastUpdate(applicationName string) (UpdateMetadata, error)

func (Store) List 

func (s Store) List() ([]Manifest, error)

func (Store) Load 

func (s Store) Load(name string) (Manifest, string, error)

func (Store) RecordLastBackup added in v0.3.0 

func (s Store) RecordLastBackup(metadata BackupMetadata) error

func (Store) RecordLastRecovery added in v0.3.0 

func (s Store) RecordLastRecovery(metadata RecoveryMetadata) error

func (Store) RecordLastUpdate added in v0.3.0 

func (s Store) RecordLastUpdate(metadata UpdateMetadata) error

func (Store) Sync 

func (s Store) Sync(m Manifest) (string, error)

Sync stores a canonical internal copy of a repository manifest while preserving already materialized runtime state. The repository file remains authoritative.

type TelemetryRequirements added in v0.4.7 

type TelemetryRequirements struct {
	OTLP *OTLPRequirement
}

type TracesDeploymentPolicy added in v0.4.15 

type TracesDeploymentPolicy struct {
	Enabled bool
	Collect map[TracesSourceClass]bool
}

func TracesPolicy added in v0.4.15 

func TracesPolicy(m Manifest) (TracesDeploymentPolicy, error)

type TracesSourceClass added in v0.4.15 

type TracesSourceClass string
const (
	TracesSourceApplication         TracesSourceClass = "application"
	TracesSourceApplicationProvider TracesSourceClass = "application-provider"
	TracesSourcePlatformProvider    TracesSourceClass = "platform-provider"
)

type UpdateMetadata added in v0.3.0 

type UpdateMetadata struct {
	Version         int       `json:"version"`
	Application     string    `json:"application"`
	Environment     string    `json:"environment"`
	UpdatedAt       time.Time `json:"updated_at"`
	Branch          string    `json:"branch"`
	Upstream        string    `json:"upstream"`
	FromRevision    string    `json:"from_revision"`
	ToRevision      string    `json:"to_revision"`
	Result          string    `json:"result"`
	BackupPath      string    `json:"backup_path,omitempty"`
	BackupCreatedAt time.Time `json:"backup_created_at,omitempty"`
}

func (UpdateMetadata) Validate added in v0.3.0 

func (m UpdateMetadata) Validate() error

type WorkloadBindingPlan 

type WorkloadBindingPlan struct {
	RuntimeIdentityServices []string
	FileSecretsByService    map[string][]string
}

func (WorkloadBindingPlan) Empty 

func (p WorkloadBindingPlan) Empty() bool

type WorkloadConfig 

type WorkloadConfig struct {
	Compose  string
	Services []string
}

WorkloadConfig optionally disambiguates an existing application Compose workload. Empty values keep the common case convention-based: BaseHarbor may detect one unambiguous Compose file and attach all of its services.

type WorkloadFiles 

type WorkloadFiles struct {
	RepositoryRoot string
	Compose        string
	Override       string
	Services       []string
	Project        string
	Partial        bool
}

func MaterializeWorkload 

func MaterializeWorkload(repositoryRoot string, m Manifest, runtime RuntimeFiles) (WorkloadFiles, bool, error)

type WorkloadSecurityDecision added in v0.4.9 

type WorkloadSecurityDecision string
const (
	WorkloadSecurityAllow WorkloadSecurityDecision = "allow"
	WorkloadSecurityWarn  WorkloadSecurityDecision = "warn"
	WorkloadSecurityDeny  WorkloadSecurityDecision = "deny"
)

type WorkloadSecurityFinding added in v0.4.9 

type WorkloadSecurityFinding struct {
	Code     string                   `json:"code"`
	Decision WorkloadSecurityDecision `json:"decision"`
	Service  string                   `json:"service"`
	Field    string                   `json:"field"`
	Value    string                   `json:"value,omitempty"`
	Message  string                   `json:"message"`
}

type WorkloadSecurityPolicy added in v0.4.13 

type WorkloadSecurityPolicy struct {
	Mode             string   `json:"mode"`
	AllowedOverrides []string `json:"allowed_overrides,omitempty"`
}

func ResolveWorkloadSecurityPolicy added in v0.4.13 

func ResolveWorkloadSecurityPolicy(m Manifest) (WorkloadSecurityPolicy, error)

type WorkloadSecurityReport added in v0.4.9 

type WorkloadSecurityReport struct {
	Mode     string                    `json:"mode"`
	Findings []WorkloadSecurityFinding `json:"findings"`
}

func AnalyzeRenderedComposeSecurity added in v0.4.9 

func AnalyzeRenderedComposeSecurity(m Manifest, rendered []byte) (WorkloadSecurityReport, error)

func (WorkloadSecurityReport) Denied added in v0.4.9 

func (r WorkloadSecurityReport) Denied() bool

func (WorkloadSecurityReport) Error added in v0.4.9 

func (r WorkloadSecurityReport) Error() error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.