README
¶
cmd/internal
Wiring layer for Orkestra. Assembles every komponent, threads dependencies, and hands the result to pkg/orkestra — the supervisor that calls Start() and Stop() in order.
Two public entrypoints:
KonductRuntime— runtime. Reconcile loop, informers, leader election. Called byork run.KonductGateway— gateway. TLS + admission webhooks, no reconcilers, no leader election. Called byork gateway. Cluster-only.
Docs
Documentation
¶
Overview ¶
cmd/internal/gateway.go
Gateway startup — a minimal process that handles only TLS/security setup and serves admission/conversion webhooks. No reconcilers, no informer factory, no konductor election (webhook servers are stateless and can run as multiple replicas).
internal/security.go
Security wiring — called from konstructRuntime after the HealthServer is constructed and before Orkestra starts.
Handles:
TLS certificate generation — when deletion protection, admission webhooks, or conversion webhooks are enabled and no explicit cert is configured. Uses certmanager.Manager to generate and store the bundle in orkestra-tls Secret.
CRD conversion webhook patch — when a CRD declares conversion.updateCRD: true, Orkestra patches the CRD's spec.conversion.webhook.clientConfig.caBundle with the CA certificate from the generated (or configured) TLS bundle.
All operations fatal-log on failure — if security cannot be applied, the operator cannot function correctly.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func KonductGateway ¶ added in v0.4.9
KonductGateway starts the gateway — TLS + WebhookServer only. No konductor election — the gateway is stateless and supports multiple replicas.
Types ¶
This section is empty.
Source Files