README
¶
cmd/internal
Wiring layer for Orkestra. Assembles every komponent, threads dependencies, and hands the result to pkg/orkestra — the supervisor that calls Start() and Stop() in order.
Two public entrypoints:
KonductRuntime— runtime. Reconcile loop, informers, leader election. Called byork run.KonductGateway— gateway. TLS + admission webhooks, no reconcilers, no leader election. Called byork gate. Cluster-only.
Docs
Documentation
¶
Overview ¶
cmd/internal/gateway.go
Gateway startup — a minimal process that handles only TLS/security setup and serves admission/conversion webhooks. No reconcilers, no informer factory, no konductor election (webhook servers are stateless and can run as multiple replicas).
internal/security.go
Security wiring — called from konstructRuntime after the HealthServer is constructed and before Orkestra starts.
Handles:
TLS certificate generation — when deletion protection, admission webhooks, or conversion webhooks are enabled and no explicit cert is configured. Uses certmanager.Manager to generate and store the bundle in orkestra-tls Secret.
CRD conversion webhook patch — when a CRD declares conversion.updateCRD: true, Orkestra patches the CRD's spec.conversion.webhook.clientConfig.caBundle with the CA certificate from the generated (or configured) TLS bundle.
All operations fatal-log on failure — if security cannot be applied, the operator cannot function correctly.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func KonductGateway ¶ added in v0.4.9
KonductGateway starts the gateway — TLS + WebhookServer only. No konductor election — the gateway is stateless and supports multiple replicas.
func KonductRuntime ¶ added in v0.5.1
func WireWebhookHousekeeperInfra ¶ added in v0.6.2
func WireWebhookHousekeeperInfra( ws *webhook.WebhookServer, kube *kubeclient.Kubeclient, kat *katalog.Katalog, kfg *konfig.Konfig, )
WireWebhookHousekeeperInfra provides the WebhookServer with the callbacks it needs to keep CRD conversion webhooks correct throughout the deployment lifecycle. Called after ensureSecurity and before webhook.Start().
Two hooks are set:
- ConversionCRDPatcher — re-patches the caBundle on any CRD with conversion.updateCRD: true when the housekeeper detects drift.
- CRDWatcher — watches each conversion CRD for MODIFIED events so the housekeeper restores a stripped caBundle within a single API round-trip rather than waiting for the safety ticker.
Types ¶
This section is empty.
Source Files