Help us shape the future of Go! Take the 2026 Go Developer Survey

tenant

package
v0.15.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 22, 2026 License: Apache-2.0 Imports: 38 Imported by: 0

Documentation

Index

Constants

View Source 
const LegacyQuotaReservationsAnnotation = capsulev1beta2.ResourceUsedAnnotationPrefix + "/reservations"

LegacyQuotaReservationsAnnotation shares the usage counter's protected prefix. Reservations and usage are written atomically on the same Tenant, including when webhook and controller requests are served by different replicas.

View Source 
const NamespaceOwnerReferenceIndexerFieldName = ".metadata.ownerReferences[*].capsule"

NamespaceOwnerReferenceIndexerFieldName selects namespace candidates by Tenant name. Callers must also check the owner reference UID before using a candidate.

View Source 
const (
	ObjectReferenceTenantKind = "Tenant"
)

Variables

View Source 
var ErrLegacyQuotaStateCapacity = errors.New("legacy quota coordination state capacity exceeded")

Functions

func AddNamespaceNameLabels 

func AddNamespaceNameLabels(labels map[string]string, ns *corev1.Namespace)

func AddTenantNameLabel 

func AddTenantNameLabel(labels map[string]string, tnt *capsulev1beta2.Tenant)

func BuildInstanceMetadataForNamespace 

func BuildInstanceMetadataForNamespace(ns *corev1.Namespace, tnt *capsulev1beta2.Tenant) (labels map[string]string, annotations map[string]string)

func BuildNamespaceAnnotationsForTenant 

func BuildNamespaceAnnotationsForTenant(tnt *capsulev1beta2.Tenant) map[string]string

func BuildNamespaceLabelsForTenant 

func BuildNamespaceLabelsForTenant(tnt *capsulev1beta2.Tenant) map[string]string

func BuildNamespaceMetadataForTenant 

func BuildNamespaceMetadataForTenant(ns *corev1.Namespace, tnt *capsulev1beta2.Tenant) (labels map[string]string, annotations map[string]string, err error)

func BuildNamespaceRuleBodyStatus 

func BuildNamespaceRuleBodyStatus(
	scheme *runtime.Scheme,
	ns *corev1.Namespace,
	tnt *capsulev1beta2.Tenant,
) ([]*rules.NamespaceRuleBodyNamespace, error)

BuildNamespaceRuleBodyStatus returns the aggregated rule bodies that apply to ns. - Rules with nil NamespaceSelector match all namespaces. - Matching rules are returned in the order they appear in tnt.Spec.Rules. - Order is important because registry/QoS evaluation uses "later allow/deny wins" semantics.

func CollectOwners 

func CollectOwners(
	ctx context.Context,
	c client.Reader,
	tnt *capsulev1beta2.Tenant,
	cfg configuration.Configuration,
) (rbac.OwnerStatusListSpec, error)

func CollectPromotions 

func CollectPromotions(
	ctx context.Context,
	c client.Client,
	tnt *capsulev1beta2.Tenant,
	cfg configuration.Configuration,
) (promotions rbac.PromotionStatusListSpec, err error)

func CollectTenantNamespaceByLabel 

func CollectTenantNamespaceByLabel(
	ctx context.Context,
	c client.Client,
	tnt capsulev1beta2.Tenant,
	additionalSelector *metav1.LabelSelector,
) (namespaces []corev1.Namespace, err error)

func FastContextForTenantAndNamespace 

func FastContextForTenantAndNamespace(tnt *capsulev1beta2.Tenant, ns *corev1.Namespace) map[string]string

TemplateForTenantAndNamespace applies templatingto the provided string.

func GetManagedRuleStatus 

func GetManagedRuleStatus(
	ctx context.Context,
	c client.Reader,
	ns *corev1.Namespace,
) (*capsulev1beta2.RuleStatus, error)

func GetNamespaceRuleBodies added in v0.15.0 

func GetNamespaceRuleBodies(ctx context.Context, reader client.Reader, scheme *runtime.Scheme, namespace string, tnt *capsulev1beta2.Tenant) ([]*rules.NamespaceRuleBodyNamespace, error)

GetNamespaceRuleBodies reads effective namespace rules, using the same namespace rendering fallback as admission wrappers when RuleStatus is absent. The reader controls freshness; callers making admission decisions use the API reader (or its request-local caching wrapper).

func GetOwnersWithKinds 

func GetOwnersWithKinds(tenant *capsulev1beta2.Tenant) (owners []string)

func GetTenantByLabels 

func GetTenantByLabels(
	ctx context.Context,
	c client.Reader,
	ns *corev1.Namespace,
) (*capsulev1beta2.Tenant, error)

getTenantByLabels returns tenant from labels.

func GetTenantByLabelsAndUser 

func GetTenantByLabelsAndUser(
	ctx context.Context,
	c client.Reader,
	cfg configuration.Configuration,
	ns *corev1.Namespace,
	user users.AdmissionUser,
) (*capsulev1beta2.Tenant, error)

func GetTenantByNamespace 

func GetTenantByNamespace(
	ctx context.Context,
	r client.Reader,
	namespace string,
) (*capsulev1beta2.Tenant, error)

func GetTenantByNamespaceWithSnapshot added in v0.15.0 

func GetTenantByNamespaceWithSnapshot(
	ctx context.Context,
	r client.Reader,
	namespace string,
) (*capsulev1beta2.Tenant, *corev1.Namespace, error)

GetTenantByNamespaceWithSnapshot also returns the namespace used to resolve ownership. Callers can evaluate its profile without a second, inconsistent read.

func GetTenantByOwnerreferences 

func GetTenantByOwnerreferences(
	ctx context.Context,
	c client.Reader,
	refs []metav1.OwnerReference,
) (tnt *capsulev1beta2.Tenant, err error)

getNamespaceTenant returns namespace owner tenant.

func GetTenantByUserInfo 

func GetTenantByUserInfo(
	ctx context.Context,
	c client.Client,
	cfg configuration.Configuration,
	ns *corev1.Namespace,
	user users.AdmissionUser,
) (sortedTenants, error)

func GetTenantNameByNamespace 

func GetTenantNameByNamespace(
	ctx context.Context,
	c client.Reader,
	namespace string,
) (tnt string, err error)

func GetTenantNameByOwnerreferences 

func GetTenantNameByOwnerreferences(
	refs []metav1.OwnerReference,
) (string, bool)

func GetTenantNameByStatusNamespace 

func GetTenantNameByStatusNamespace(
	ctx context.Context,
	c client.Client,
	namespace string,
) (string, error)

func HasConsistentTenantReference added in v0.13.10 

func HasConsistentTenantReference(ns *corev1.Namespace) bool

HasConsistentTenantReference reports whether Tenant ownership is either completely absent or represented by one matching label and ownerReference.

func HasCustomResourceQuotaAnnotation 

func HasCustomResourceQuotaAnnotation(tenant *capsulev1beta2.Tenant) bool

func HasTenantOwnership 

func HasTenantOwnership(ns *corev1.Namespace) bool

func HasTenantReference 

func HasTenantReference(ns *corev1.Namespace) bool

func IsNamespaceInTenant 

func IsNamespaceInTenant(
	ctx context.Context,
	c client.Client,
	namespace string,
) (bool, error)

func IsTenantOwnerReference 

func IsTenantOwnerReference(or metav1.OwnerReference) bool

func IsTenantOwnerReferenceForTenant 

func IsTenantOwnerReferenceForTenant(or metav1.OwnerReference, tnt *capsulev1beta2.Tenant) bool

func LegacyQuotaRequeueAfter added in v0.15.0 

func LegacyQuotaRequeueAfter(annotations map[string]string, now time.Time) time.Duration

LegacyQuotaRequeueAfter only schedules the Tenant/resource-quota queues. It never holds the independent namespace permission queue while objects persist.

func NamespaceIsOwned 

func NamespaceIsOwned(
	ctx context.Context,
	c client.Reader,
	cfg configuration.Configuration,
	ns *corev1.Namespace,
	tnt *capsulev1beta2.Tenant,
	user users.AdmissionUser,
) bool

func NamespaceIsPendingPodTerminating 

func NamespaceIsPendingPodTerminating(
	ctx context.Context,
	c client.Reader,
	ns *corev1.Namespace,
) (pending bool, err error)

func NamespaceIsPendingUnmanagedTerminationByStatus 

func NamespaceIsPendingUnmanagedTerminationByStatus(ctx context.Context, c client.Reader, ns *corev1.Namespace) (bool, error)

func NamespacedCascadingCleanup 

func NamespacedCascadingCleanup(ctx context.Context, reader client.Reader, disco discovery.DiscoveryInterface, resourceCache NamespacedResourceCache, dyn dynamic.Interface, ns *corev1.Namespace) (bool, error)

NamespacedCascadingCleanup completes cleanup of a terminating namespace after Pods have gone. The reader must bypass the informer cache. Namespace identity is checked immediately before destructive writes; object preconditions protect replacements between those checks and the writes themselves.

func NewTenantContext 

func NewTenantContext(tnt *capsulev1beta2.Tenant, _ *runtime.Scheme, opts sanitize.SanitizeOptions) (map[string]any, error)

NewTenantContext returns the context for the tenant.

func NewTenantNamespaceContext added in v0.13.7 

func NewTenantNamespaceContext(
	tnt *capsulev1beta2.Tenant,
	ns *corev1.Namespace,
	scheme *runtime.Scheme,
	opts sanitize.SanitizeOptions,
) (map[string]any, error)

NewTenantNamespaceContext returns the context for the tenant and a given namespace.

func OwnerKindIndexKey added in v0.13.2 

func OwnerKindIndexKey(kind, name string) string

func ResolveNamespaceTenant 

func ResolveNamespaceTenant(
	ctx context.Context,
	reader client.Reader,
	ns *corev1.Namespace,
) (*capsulev1beta2.Tenant, error)

func RuleGlobalResourceQuota added in v0.14.0 

func RuleGlobalResourceQuota(
	tnt *capsulev1beta2.Tenant,
	ruleIndex int,
	itemIndex int,
) *capsulev1beta2.GlobalResourceQuota

func RuleGlobalResourceQuotaName added in v0.14.0 

func RuleGlobalResourceQuotaName(tnt *capsulev1beta2.Tenant, quotaName string) string

func TenanLabelValue 

func TenanLabelValue(ns *corev1.Namespace) string

func TenantByStatusNamespace 

func TenantByStatusNamespace(
	ctx context.Context,
	c client.Client,
	namespace string,
) (*capsulev1beta2.Tenant, error)

func TenantOwnerReferenceName 

func TenantOwnerReferenceName(ns *corev1.Namespace) string

func TenantOwnerReferences 

func TenantOwnerReferences(ns *corev1.Namespace) []metav1.OwnerReference

func TenantOwnershipChanged 

func TenantOwnershipChanged(oldNs, newNs *corev1.Namespace) bool

func ValidateRuleGlobalResourceQuotaName added in v0.14.0 

func ValidateRuleGlobalResourceQuotaName(tnt *capsulev1beta2.Tenant, quotaName string) error

func ValidateTenantOwner added in v0.13.6 

func ValidateTenantOwner(owner rbac.UserSpec) error

func WriteLegacyQuotaReservations added in v0.15.0 

func WriteLegacyQuotaReservations(annotations map[string]string, reservations *LegacyQuotaReservations) error

Types

type LegacyQuotaDeletion added in v0.15.0 

type LegacyQuotaDeletion struct {
	capsulev1beta2.QuantityLedgerPendingDelete

	NamespaceUID types.UID    `json:"namespaceUid"`
	ExpiresAt    *metav1.Time `json:"expiresAt"`
}

LegacyQuotaDeletion schedules authoritative recounts until deletion is observed. Admission alone cannot prove that a DELETE will be persisted.

type LegacyQuotaReservation added in v0.15.0 

type LegacyQuotaReservation struct {
	capsulev1beta2.QuantityLedgerReservation

	NamespaceUID types.UID `json:"namespaceUid"`
}

LegacyQuotaReservation uses the existing ledger reservation representation. NamespaceUID additionally prevents a recreated namespace materializing an old reservation. This is internal coordination for the legacy annotation API.

type LegacyQuotaReservations added in v0.15.0 

type LegacyQuotaReservations struct {
	Pending  map[string][]LegacyQuotaReservation `json:"pending,omitempty"`
	Deleting map[string][]LegacyQuotaDeletion    `json:"deleting,omitempty"`
	// Namespace pins bridge informer/status visibility independently of create TTL.
	Namespaces map[string]types.UID `json:"namespaces,omitempty"`
}

func ReadLegacyQuotaReservations added in v0.15.0 

func ReadLegacyQuotaReservations(annotations map[string]string) (*LegacyQuotaReservations, error)

type NamespacedResourceCache 

type NamespacedResourceCache interface {
	Get(disco discovery.DiscoveryInterface) ([]schema.GroupVersionResource, error)
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.