katalog

package
v0.1.7 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Apr 16, 2026 License: Apache-2.0 Imports: 25 Imported by: 0

README

pkg/katalog

The katalog package is the schema registry for an Orkestra operator. It parses and validates the user's Katalog YAML, enriches each CRD entry with runtime metadata, and exposes the result as a queryable *Katalog value that every other subsystem reads from.

Nothing in Orkestra hardcodes a CRD — everything is driven by what the Katalog says.

What the Katalog holds

What Where in code
Enabled CRD entries (enriched, validated) k.enabledCRDs
Katalog metadata (name, version, author, license) k.metadata
Security configuration (deletion protection, RBAC) k.Security
Conversion rules (/convert webhook) k.conversionRegistry
Admission rules (/validate, /mutate webhooks) k.admissionRegistry
Dependency DAG built lazily by NewDependencyGraph(k)

Boot sequence

merger.Merger (merges N katalog YAML files)
    ↓
NewKatalog(merger, konfig)
    → KomposeKatalogFromYaml  — decode YAML, enrich entries
    → ValidateConfig          — field-level, uniqueness, dependency, GVK, defaults
    → updateResourceMapAndReturn — build GVK → type index
    ↓
*Katalog (ready to use)

NewKatalog calls utils.Exit on any validation failure — the operator does not start with a broken Katalog.

CRD entry lifecycle

Each CRDEntry goes through several enrichment phases before it is considered ready:

  1. Parse — decoded from YAML via the merger.
  2. Enrich — EnrichCRDEntry fills in computed fields (API path, plural, GVK).
  3. Validate — uniqueness, dependency graph (existence + cycle), reconciler mode.
  4. Defaults — workers, resync interval, namespace handling, finalizers, description.
  5. Runtime objects — dynamic mode → *unstructured.Unstructured factory; typed mode → ObjectRegistry lookup.
  6. Reconcilers — hooks from HookRegistry, constructors from ReconcilerRegistry.
  7. Status flags — IgnoreStatusPatch and IgnoreObservedGeneration set from builtins.go.

After this pipeline, k.enabledCRDs contains fully-prepared entries. All runtime code reads from this map — it is never mutated after boot.

Developer documentation

I want to… Go to
Query the Katalog at runtime docs/01-querying.md
Understand the dependency graph docs/02-dependencies.md
Understand deletion protection docs/03-deletion-protection.md
Understand security defaults docs/04-security.md
Understand built-in type handling docs/05-builtins.md

Documentation

Overview

pkg/katalog/admission_registry.go

pkg/katalog/builtins.go

pkg/katalog/conversion_registry.go

pkg/katalog/deletion_protection.go

Deletion protection — webhook rules and protected CRD name resolution.

Architecture: two-level filtering. 

Level 1 — Webhook rules (DeletionProtectionGVRs):
  Intercepts ALL DELETE on customresourcedefinitions and Orkestra deployments.
  Must be broad — Kubernetes webhook rules filter by GVR, not by object name.

Level 2 — Handler (isProtectedCRD):
  Narrows to only the CRDs managed by THIS Katalog.
  "websites.demo.orkestra.io" from a different operator → allowed.
  "cronjobs.demo.orkestra.io" from this Katalog → denied.

When to register the webhook: 

Requires a reachable Kubernetes Service. With ork run the operator runs
locally — there is no Service. failurePolicy: Fail would block ALL CRD
deletions when unreachable. Only register when running inside the cluster.

pkg/katalog/dependencies.go

pkg/katalog/enrichment.go

pkg/katalog/parsek.go

pkg/katalog/rbac_apply.go

RBAC auto-apply — applies the generated RBAC to the cluster at startup when security.rbac.enabled: true.

Uses server-side apply (PATCH with fieldManager) so the operation is idempotent: safe to call on every restart, no diff check needed.

The generated RBAC bundle:

  • ClusterRole — least-privilege verbs for all managed resources
  • ClusterRoleBinding — binds the ClusterRole to the operator ServiceAccount
  • ServiceAccount — the identity the operator runs as

All three are owned by Orkestra (field manager: "orkestra"). On shutdown with cleanupOnShutdown: true, all three are deleted.

pkg/katalog/security.go

Security accessors on *Katalog.

Precedence (highest → lowest):

  1. Katalog YAML (k.Security)
  2. ENV vars via SecurityConfig (k.konfig.Security())
  3. Hard defaults coded below

KatalogSecurity uses *bool fields which allows detecting "not declared" (nil) vs "explicitly false" (*false).

Deletion protection is ENABLED BY DEFAULT when the security block is present but deletionProtection is not declared. RBAC is also enabled by default when the rbac block is present.

Index

Constants

This section is empty.

Variables

This section is empty.

Functions

func AllBuiltInKinds 

func AllBuiltInKinds() []string

AllBuiltInKinds returns the canonical Kind names of all registered built-ins. Sorted alphabetically (simple O(n^2) sort to avoid extra imports).

func ApplyAutoscalerProfile 

func ApplyAutoscalerProfile(profile string, baseline orktypes.AutoscaleBaseline) (*orktypes.AutoscaleSpec, error)

ApplyAutoscalerProfile expands a named autoscale profile into a complete AutoscaleSpec using the CRD's declared baseline values.

This runs BEFORE merge, so the runtime only ever sees a fully-formed spec.

func ApplyRBAC 

func ApplyRBAC(ctx context.Context, client kubernetes.Interface, bundle *RBACBundle) error

ApplyRBAC applies the RBAC bundle to the cluster using server-side apply. Idempotent — safe to call on every startup. Does nothing when security.rbac.enabled is false.

func DeleteRBAC 

func DeleteRBAC(ctx context.Context, client kubernetes.Interface, bundle *RBACBundle) error

DeleteRBAC removes the RBAC bundle from the cluster. Called on shutdown when security.rbac.cleanupOnShutdown: true.

func DetectCyclesForTest 

func DetectCyclesForTest(k *Katalog) error

DetectCyclesForTest exposes detectDependencyCycles for integration tests.

func EnrichCRDEntry 

func EnrichCRDEntry(entry *orktypes.CRDEntry) (orktypes.EnrichmentOutcome, error)

EnrichCRDEntry checks whether a CRD entry uses kind-only declaration and, if so, enriches it with the corresponding built-in API metadata.

Called during Katalog validation before the CRD entry is used at runtime.

A CRD entry qualifies for enrichment when:

  • apiTypes.kind is set
  • apiTypes.group is empty
  • apiTypes.version is empty
  • apiTypes.plural is empty

All three must be empty for enrichment to trigger — a partially-specified entry (e.g. kind + group but no version) is an error, not an enrichment candidate. This prevents silent misconfigurations.

Returns:

  • EnrichmentNotNeeded: entry was already fully specified, no change
  • EnrichmentApplied: entry was enriched successfully
  • EnrichmentFailed: kind not found in built-in registry, error returned

func IsBuiltIn 

func IsBuiltIn(kind string) bool

IsBuiltIn reports whether a kind string refers to a known Kubernetes built-in. Case-insensitive. Does not require the fully-qualified group/version.

func NewSchemeRegistry 

func NewSchemeRegistry(k *Katalog) (*runtime.Scheme, error)

NewSchemeRegistry returns a new scheme

func SkipObservedGenerationGVKs 

func SkipObservedGenerationGVKs() []string

SkipObservedGenerationGVKs returns the GVKs that should skip generation-based readiness checks.

func SkipStatusSubresourceGVKs 

func SkipStatusSubresourceGVKs() []string

SkipStatusSubresourceGVKs returns the GVKs that do not have a /status subresource.

func StatuslessGVKs 

func StatuslessGVKs() []string

StatuslessGVKs returns the GVKs that should be treated as "ready on existence".

Types

type AdmissionRegistry 

type AdmissionRegistry interface {
	// GetValidationRules returns the validation config for a GVR key.
	// Returns nil when no rules are registered for that resource.
	GetValidationRules(gvrKey string) *orktypes.ValidationConfig

	// GetMutationRules returns the mutation config for a GVR key.
	// Returns nil when no rules are registered for that resource.
	GetMutationRules(gvrKey string) *orktypes.MutationConfig

	// RegisterValidationRules stores validation rules for a GVR key.
	RegisterValidationRules(gvrKey string, cfg *orktypes.ValidationConfig)

	// RegisterMutationRules stores mutation rules for a GVR key.
	RegisterMutationRules(gvrKey string, cfg *orktypes.MutationConfig)

	// ValidationGVRs returns all GVR keys that have validation rules.
	// Used at startup to build the ValidatingWebhookConfiguration rules.
	ValidationGVRs() []GVREntry

	// MutationGVRs returns all GVR keys that have mutation rules.
	// Used at startup to build the MutatingWebhookConfiguration rules.
	MutationGVRs() []GVREntry
}

AdmissionRegistry is the interface used by the health server's admission handlers.

type AutoscaleProfile 

type AutoscaleProfile string
const (
	Burst            AutoscaleProfile = "burst"
	Steady           AutoscaleProfile = "steady"
	Batch            AutoscaleProfile = "batch"
	LatencySensitive AutoscaleProfile = "latency-sensitive"
	CostOptimized    AutoscaleProfile = "cost-optimized"
)

type BuiltInKind 

type BuiltInKind struct {
	// Kubernetes API metadata
	Group      string // API group; empty for core
	Version    string // API version
	Plural     string // plural resource name
	Namespaced bool   // true if namespaced
	APIPath    string // "/api" for core, "/apis" otherwise

	// Orkestra readiness metadata
	Statusless             bool // No meaningful status; treat as ready on existence
	SkipStatusSubresource  bool // No /status subresource; never PATCH status
	SkipObservedGeneration bool // Has status but no observedGeneration; skip generation-based checks
	IsChild                bool // Orkestra may create this as a child resource
}

BuiltInKind holds the fully-qualified API metadata for a Kubernetes built-in resource kind, plus Orkestra-specific readiness metadata.

Lookup is always by Kind (case-insensitive) via LookupBuiltIn / BuiltInMeta.

func BuiltInMeta 

func BuiltInMeta(kind string) BuiltInKind

BuiltInMeta returns metadata for a built-in kind. Zero value is returned when the kind is unknown.

type ConversionRegistry 

type ConversionRegistry interface {
	GetConversionRules(kind string) *orktypes.ConversionRules
	RegisterConversionRules(rules *orktypes.ConversionRules)
}

ConversionRegistry is the interface used by the health server's /convert handler. Decoupled from the Katalog struct so the health server has no import cycle.

type DependencyGraph 

type DependencyGraph struct {
	// contains filtered or unexported fields
}

DependencyGraph represents the CRD dependency DAG for a Katalog. Each CRD is a node, and edges represent "A must start before B" relationships.

The graph is used to:

  • compute deterministic startup order (topological sort)
  • compute deterministic shutdown order (reverse topological sort)
  • validate dependency correctness (no cycles, no missing CRDs)
  • expose dependency metadata to the runtime

The graph is immutable after construction.

func NewDependencyGraph 

func NewDependencyGraph(katalog *Katalog) *DependencyGraph

NewDependencyGraph constructs the dependency DAG for all enabled CRDs. It validates that all declared dependencies exist and builds the adjacency lists.

func (*DependencyGraph) GetDependencies 

func (g *DependencyGraph) GetDependencies(name string) []string

GetDependencies returns all CRDs that the given CRD depends on.

func (*DependencyGraph) GetDependents 

func (g *DependencyGraph) GetDependents(name string) []string

GetDependents returns all CRDs that depend on the given CRD.

func (*DependencyGraph) GetEdges 

func (g *DependencyGraph) GetEdges() map[string][]string

GetEdges returns the adjacency list: dependency → dependents.

func (*DependencyGraph) GetInDegree 

func (g *DependencyGraph) GetInDegree(name string) int

GetInDegree returns how many CRDs this CRD depends on.

func (*DependencyGraph) GetNode 

func (g *DependencyGraph) GetNode(name string) *Node

GetNode returns the node for a CRD name.

func (*DependencyGraph) GetNodes 

func (g *DependencyGraph) GetNodes() map[string]*Node

GetNodes returns all nodes in the graph.

func (*DependencyGraph) GetOutDegree 

func (g *DependencyGraph) GetOutDegree(name string) int

GetOutDegree returns how many CRDs depend on this CRD.

func (*DependencyGraph) ShutdownOrder 

func (g *DependencyGraph) ShutdownOrder() []string

ShutdownOrder returns the reverse of the startup order. This ensures CRDs are stopped only after all dependents have been drained.

func (*DependencyGraph) StartupOrder 

func (g *DependencyGraph) StartupOrder() []string

StartupOrder returns a deterministic topological ordering of CRDs. CRDs with no dependencies appear first; dependents appear after their prerequisites.

This order is used by the runtime to start CRDs in the correct sequence.

The result is cached and computed only once.

func (*DependencyGraph) Validate 

func (g *DependencyGraph) Validate() error

Validate performs basic sanity checks on the graph.

type EnrichmentResult 

type EnrichmentResult struct {
	Found        bool
	Kind         string
	BuiltIn      BuiltInKind
	DisplayGroup string
}

EnrichmentResult holds the result of a built-in lookup.

func LookupBuiltIn 

func LookupBuiltIn(kind string) EnrichmentResult

LookupBuiltIn looks up a Kind in the built-in registry. Case-insensitive. Returns EnrichmentResult; check .Found before use.

type GVREntry 

type GVREntry struct {
	// Key — the full GVR key string: "group/version/resource" or "version/resource"
	Key string

	// Group — API group. Empty for core group resources.
	Group string

	// Version — API version.
	Version string

	// Resource — plural resource name.
	Resource string

	// Operations — which operations this GVR should be webhoooked for.
	// Comes from AdmissionWebhookConfig.Operations or the default ["CREATE", "UPDATE"]
	Operations []string
}

GVREntry holds the parsed GVR components for webhook configuration. Built from the key during registry population.

type InMemoryAdmissionRegistry 

type InMemoryAdmissionRegistry struct {
	// contains filtered or unexported fields
}

InMemoryAdmissionRegistry is the concrete implementation used at runtime. Safe for concurrent use — the /validate and /mutate handlers read from it concurrently; the Katalog load writes to it once at startup.

func NewInMemoryAdmissionRegistry 

func NewInMemoryAdmissionRegistry() *InMemoryAdmissionRegistry

NewInMemoryAdmissionRegistry returns an initialised registry.

func (*InMemoryAdmissionRegistry) GetMutationRules 

func (r *InMemoryAdmissionRegistry) GetMutationRules(gvrKey string) *orktypes.MutationConfig

func (*InMemoryAdmissionRegistry) GetValidationRules 

func (r *InMemoryAdmissionRegistry) GetValidationRules(gvrKey string) *orktypes.ValidationConfig

func (*InMemoryAdmissionRegistry) MutationGVRs 

func (r *InMemoryAdmissionRegistry) MutationGVRs() []GVREntry

func (*InMemoryAdmissionRegistry) RegisterAdmissionRulesFromEntry 

func (reg *InMemoryAdmissionRegistry) RegisterAdmissionRulesFromEntry(entry orktypes.CRDEntry)

RegisterAdmissionRulesFromEntry populates the admission registry from one CRD entry. Called during KomposeKatalogFromYaml after all CRD entries are loaded and enriched.

Only CRDs with validation or mutation rules declared are registered. CRDs with neither are not added to the registry — they will not appear in the webhook configurations and no admission calls will be made for them.

func (*InMemoryAdmissionRegistry) RegisterMutationRules 

func (r *InMemoryAdmissionRegistry) RegisterMutationRules(gvrKey string, cfg *orktypes.MutationConfig)

func (*InMemoryAdmissionRegistry) RegisterValidationRules 

func (r *InMemoryAdmissionRegistry) RegisterValidationRules(gvrKey string, cfg *orktypes.ValidationConfig)

func (*InMemoryAdmissionRegistry) ValidationGVRs 

func (r *InMemoryAdmissionRegistry) ValidationGVRs() []GVREntry

type InMemoryConversionRegistry 

type InMemoryConversionRegistry struct {
	// contains filtered or unexported fields
}

InMemoryConversionRegistry holds per-Kind conversion rules. Safe for concurrent use — the /convert endpoint reads from multiple goroutines and Katalog load writes once at startup.

func NewInMemoryConversionRegistry 

func NewInMemoryConversionRegistry() *InMemoryConversionRegistry

NewInMemoryConversionRegistry returns an initialised registry.

func NewInMemoryRegistryForTest 

func NewInMemoryRegistryForTest() *InMemoryConversionRegistry

Test exports

func (*InMemoryConversionRegistry) GetConversionRules 

func (r *InMemoryConversionRegistry) GetConversionRules(kind string) *orktypes.ConversionRules

GetConversionRules returns the rules for a given Kind. Returns nil when no rules are registered for that Kind.

func (*InMemoryConversionRegistry) RegisterConversionRules 

func (r *InMemoryConversionRegistry) RegisterConversionRules(rules *orktypes.ConversionRules)

RegisterConversionRules stores rules for the Kind declared in rules.Kind. Called once per CRD entry during Katalog load.

type Katalog 

type Katalog struct {
	APIVersion       string                                `yaml:"apiVersion"`
	Kind             string                                `yaml:"kind"`
	Spec             orktypes.KatalogSpec                  `yaml:"spec"`
	Security         orktypes.KatalogSecurity              `yaml:"security"`
	Notification     *orktypes.KatalogNotification         `yaml:"notification,omitempty"`
	Providers        []orktypes.KatalogProviderRequirement `yaml:"providers,omitempty"`
	KomposerMetadata orktypes.KatalogMeta                  `yaml:"metadata"`
	// contains filtered or unexported fields
}

----------------------------------------------------------------------------- Structs -----------------------------------------------------------------------------

func NewEmptyKatalog 

func NewEmptyKatalog() *Katalog

Empty katalog for testing

func NewKatalog 

func NewKatalog(m *merger.Merger, kfg *konfig.Konfig) *Katalog

NewKatalog returns a list of CRD data

func NewKatalogForTest 

func NewKatalogForTest(crds map[string]orktypes.CRDEntry) *Katalog

NewKatalogForTest creates a Katalog with pre-set enabledCRDs for testing. Bypasses YAML parsing and ValidateConfig so tests can construct controlled graphs.

func (*Katalog) AdmissionRegistry 

func (k *Katalog) AdmissionRegistry() AdmissionRegistry

func (*Katalog) All 

func (k *Katalog) All() map[string]orktypes.CRDEntry

All returns every CRD in the katalog, including disabled ones.

func (*Katalog) AllCRDs 

func (k *Katalog) AllCRDs() map[string]orktypes.CRDEntry

AllCRDs returns all CRDs including disabled ones (from Spec).

func (*Katalog) BuildRBACBundle 

func (k *Katalog) BuildRBACBundle(namespace, serviceAccountName string) *RBACBundle

BuildRBACBundle builds the complete RBAC bundle from the Katalog. The bundle is built but not applied here — call ApplyRBAC to apply it.

func (*Katalog) CRDNames 

func (k *Katalog) CRDNames() []string

CRDNames returns the names of all enabled CRDs.

func (*Katalog) Controllers 

func (k *Katalog) Controllers() []string

Controllers returns a list of CRDs that have reconcilers.

func (*Katalog) ConversionRegistry 

func (k *Katalog) ConversionRegistry() ConversionRegistry

func (*Katalog) ConversionWindow 

func (k *Katalog) ConversionWindow() int

ConversionWindow returns the effective rolling window size for conversion/admission stats.

Precedence: 

YAML security.conversion.conversionWindow > 0 → use YAML value
YAML absent or zero                           → fall back to CONVERSION_WINDOW env

func (*Katalog) DeletionProtectionCleanupOnShutdown 

func (k *Katalog) DeletionProtectionCleanupOnShutdown() bool

DeletionProtectionCleanupOnShutdown reports whether Deletion Protection should be deleted on shutdown.

Precedence: 

YAML security.deletionProtection.cleanupOnShutdown present → use YAML value
YAML block absent                                      → fall back to DELETION_PROTECTION_CLEANUP_ON_SHUTDOWN env

func (*Katalog) DeletionProtectionFailurePolicy 

func (k *Katalog) DeletionProtectionFailurePolicy() string

DeletionProtectionFailurePolicy returns the effective failure policy string. YAML value takes precedence over ENV.

func (*Katalog) DeletionProtectionGVRs 

func (k *Katalog) DeletionProtectionGVRs() []GVREntry

DeletionProtectionGVRs returns the webhook intercept rules. Returns nil when running outside the cluster (ork run) — in that case the webhook cannot be reached and must not be registered.

func (*Katalog) DeletionProtectionServiceName 

func (k *Katalog) DeletionProtectionServiceName() string

DeletionProtectionServiceName returns the effective service name for deletion protection. YAML value takes precedence over ENV.

func (*Katalog) Dependents 

func (k *Katalog) Dependents(name string) []string

Dependents returns all CRDs that depend on the given CRD.

func (*Katalog) Depends 

func (k *Katalog) Depends(crdName, target string) bool

Depends returns true if crdName depends on target.

func (*Katalog) Describe 

func (k *Katalog) Describe(name string) (string, error)

Describe returns a human‑readable summary of a CRD.

func (*Katalog) Enabled 

func (k *Katalog) Enabled() map[string]orktypes.CRDEntry

Enabled returns only the enabled CRDs in the katalog.

func (*Katalog) EnabledCRDs 

func (k *Katalog) EnabledCRDs() map[string]orktypes.CRDEntry

EnabledCRDs returns a map of enabled CRDs.

func (*Katalog) Exists 

func (k *Katalog) Exists(name string) bool

Exists returns true if a CRD with the given name exists in the katalog.

func (*Katalog) Explain 

func (k *Katalog) Explain(name string) (string, error)

Explain returns a technical explanation of how Orkestra handles this CRD.

func (*Katalog) GenerateRBACRules 

func (k *Katalog) GenerateRBACRules() []rbacv1.PolicyRule

func (*Katalog) Get 

func (k *Katalog) Get(name string) (*orktypes.CRDEntry, error)

Get returns an enabled CRD by name.

func (*Katalog) Graph 

func (k *Katalog) Graph() map[string][]string

Graph returns a map of CRD name → dependency names.

func (*Katalog) HasConversionPaths 

func (k *Katalog) HasConversionPaths() bool

Methods to maintain the zero footprint promise of orkestra

HasConversionPaths returns true only if:

  1. Conversion is enabled in konfig, AND
  2. At least one CRD declares conversion paths.

This protects the zero‑footprint promise: Orkestra exposes /convert ONLY when the user explicitly declares conversion.

func (*Katalog) HasMutationRules 

func (k *Katalog) HasMutationRules() bool

HasMutationRules returns true only if:

  1. Admission is enabled in konfig, AND
  2. At least one CRD declares mutation rules.

This ensures /mutate is created ONLY when the user declares rules.

func (*Katalog) HasTeams 

func (k *Katalog) HasTeams() bool

HasTeams returns whether a katalog has teams configured or not

func (*Katalog) HasValidationRules 

func (k *Katalog) HasValidationRules() bool

HasValidationRules returns true only if:

  1. Admission is enabled in konfig, AND
  2. At least one CRD declares validation rules.

This ensures /validate is created ONLY when the user declares rules.

func (*Katalog) IsAdmissionEnabled 

func (k *Katalog) IsAdmissionEnabled() bool

IsAdmissionEnabled reports whether admission webhooks are globally enabled.

Precedence: 

YAML security.webhooks.admission block present → use YAML value
YAML block absent                              → fall back to ENABLE_ADMISSION_WEBHOOK env

func (*Katalog) IsConversionEnabled 

func (k *Katalog) IsConversionEnabled() bool

IsConversionEnabled reports whether the conversion webhook is globally enabled.

Precedence: 

YAML security.conversion block present → use YAML value
YAML block absent                      → fall back to ENABLE_CONVERSION env

func (*Katalog) IsDeletionProtectionEnabled 

func (k *Katalog) IsDeletionProtectionEnabled() bool

IsDeletionProtectionEnabled reports whether deletion protection is active.

Precedence: 

YAML security.deletionProtection block present → use YAML value (default-on when block declared)
YAML block absent                              → fall back to ENABLE_DELETION_PROTECTION env

func (*Katalog) IsEmailNotificationEnabled 

func (k *Katalog) IsEmailNotificationEnabled() bool

IsEmailNotificationEnabled reports whether email notifications are possible.

Precedence: 

YAML team.email present → require SMTP env capability
YAML absent             → no email notifications

func (*Katalog) IsRBACEnabled 

func (k *Katalog) IsRBACEnabled() bool

IsRBACEnabled reports whether RBAC auto-apply is active.

Precedence: 

YAML security.rbac block present → use YAML value (default-on when block declared)
YAML block absent                → fall back to RBAC_AUTO_APPLY env

func (*Katalog) IsSlackNotificationEnabled 

func (k *Katalog) IsSlackNotificationEnabled() bool

IsSlackNotificationEnabled reports whether Slack notifications are possible.

func (*Katalog) KomposeKatalogFromYaml 

func (k *Katalog) KomposeKatalogFromYaml(m *merger.Merger, paths ...string) (map[string]orktypes.CRDEntry, error)

----------------------------------------------------------------------------- 

YAML Builder

-----------------------------------------------------------------------------

func (*Katalog) List 

func (k *Katalog) List() map[string]orktypes.CRDEntry

func (*Katalog) Meta 

func (k *Katalog) Meta() orktypes.KatalogMeta

Useful Metadata

func (*Katalog) Metadata 

func (k *Katalog) Metadata() orktypes.KatalogMeta

func (*Katalog) NeedsCertificates 

func (k *Katalog) NeedsCertificates() bool

NeedsCertificates reports whether Orkestra must generate TLS certificates.

Certificates are required when deletion protection, admission webhooks, or conversion webhooks are enabled — all three use the same TLS cert.

func (*Katalog) NotificationInterval 

func (k *Katalog) NotificationInterval(teamName string) orktypes.Duration

NotificationInterval returns the effective interval for a team.

Precedence: 

YAML team.interval > YAML defaults.interval > ENV defaultInterval > hard default

func (*Katalog) Order 

func (k *Katalog) Order() []string

Order returns CRDs in dependency‑safe order (topological sort).

func (*Katalog) ProtectedCRDNames 

func (k *Katalog) ProtectedCRDNames() map[string]struct{}

ProtectedCRDNames returns the set of CRD full names managed by this Katalog. e.g. {"cronjobs.demo.orkestra.io": {}} Used by the /deletion-protection handler for name-based filtering. A CRD not in this set is allowed through even though the webhook intercepted it.

func (*Katalog) RBACCleanupOnShutdown 

func (k *Katalog) RBACCleanupOnShutdown() bool

RBACCleanupOnShutdown reports whether RBAC should be deleted on shutdown.

Precedence: 

YAML security.rbac.cleanupOnShutdown present → use YAML value
YAML block absent                            → fall back to RBAC_CLEANUP_ON_SHUTDOWN env

func (*Katalog) SMTPConfig 

func (k *Katalog) SMTPConfig() (host string, port int, user, pass, from string)

SMTPConfig returns the effective SMTP configuration (from ENV only).

func (*Katalog) SlackWebhook 

func (k *Katalog) SlackWebhook() string

SlackWebhook returns the effective Slack webhook URL (from ENV only).

func (*Katalog) ToUI 

func (k *Katalog) ToUI() *orktypes.KatalogForUI

ToUI returns a UI-friendly representation of the merged Katalog. This method extracts only the fields needed for display in the Control Center:

  • API version and kind (always "Katalog" at runtime)
  • Metadata (name, description, version, author, license)
  • All merged CRD definitions

Internal fields (Scheme, GroupVersionKind, etc.) are excluded because they have `yaml:"-" json:"-"` tags and won't be serialized to JSON.

This method is used by the /katalog/raw endpoint to provide a clean, readable view of the Katalog that created the current operator.

func (*Katalog) Uses 

func (k *Katalog) Uses(resource string) bool

Uses returns true if ANY CRD in the katalog uses the given resource type.

func (*Katalog) ValidateConfig 

func (k *Katalog) ValidateConfig(kfg *konfig.Konfig) (*Katalog, error)

Validate Config

func (*Katalog) WebhookCleanupOnShutdown 

func (k *Katalog) WebhookCleanupOnShutdown() bool

WebhookCleanupOnShutdown reports whether Admission Webhook should be deleted on shutdown.

Precedence: 

YAML security.webhooks.cleanupOnShutdown present → use YAML value
YAML block absent                            → fall back to WEBHOOK_CLEANUP_ON_SHUTDOWN env

func (*Katalog) WebhooksFailurePolicy 

func (k *Katalog) WebhooksFailurePolicy() string

WebhooksFailurePolicy returns the effective failure policy for admission webhooks. YAML value takes precedence over ENV.

func (*Katalog) WebhooksServiceName 

func (k *Katalog) WebhooksServiceName() string

WebhooksServiceName returns the effective service name for admission/conversion webhooks. YAML value takes precedence over ENV.

type Node 

type Node struct {
	Name      string
	CRD       orktypes.CRDEntry
	InDegree  int // number of CRDs this CRD depends on
	OutDegree int // number of CRDs that depend on this CRD
}

Node represents a single CRD in the dependency graph.

type RBACBundle 

type RBACBundle struct {
	ClusterRole        *rbacv1.ClusterRole
	ClusterRoleBinding *rbacv1.ClusterRoleBinding
	ServiceAccount     *corev1.ServiceAccount
}

RBACBundle is the generated RBAC for one operator instance.

type RBACRule 

type RBACRule struct {
	APIGroup string
	Resource string
	Verbs    []string
}

RBACRule describes how to generate RBAC for a Kubernetes resource.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.