Documentation
¶
Overview ¶
Package userkube owns the workflow for materializing a kubectl- ready kubeconfig from cloudbox onto this host's disk. Used by:
- the daemon at startup (when fc.Cluster.Enabled is on) so kubectl / helm work without the operator running any extra command;
- the admin UI's Cluster section "Refresh" button so the operator can re-mint after the token rotates server-side;
- the `outpost cluster kubeconfig` CLI, which now defaults to writing the file (was stdout).
The package is intentionally tiny — fetch via vkpodman, render to YAML, write atomically. Path resolution + observability (LastStatus for the UI) live here so all three callers stay in sync.
Index ¶
- Constants
- func DefaultKubectlPath() string
- func FetchAndWrite(ctx context.Context, cloudboxBase, accessToken, nodeName, outPath string) (string, error)
- func FetchUserKubeconfigYAML(ctx context.Context, cloudboxBase, accessToken string) ([]byte, error)
- func MergeIntoKubectl(newYAML []byte, path string) (string, error)
- func Path() string
- func Render(contextName string, p *vknode.ParsedKubeconfig) string
- func WriteStandalone(yaml []byte, path string) error
- type Status
Constants ¶
const DefaultFilename = "outpost.yaml"
DefaultFilename is what kubectl-readable kubeconfig gets written as inside the chosen directory.
const UserKubeconfigEndpoint = "/api/cluster/userkubeconfig"
UserKubeconfigEndpoint is cloudbox's user-mode kubeconfig issuer. The route accepts the outpost's access_token as a Bearer (via middleware.DecodeUser, which trusts any cloudbox-signed JWT) and mints a per-user ServiceAccount token in the outpost-users namespace scoped to the calling account.
Variables ¶
This section is empty.
Functions ¶
func DefaultKubectlPath ¶
func DefaultKubectlPath() string
DefaultKubectlPath returns where kubectl looks for its config by default: the first writable entry in $KUBECONFIG (colon-separated) or $HOME/.kube/config. Matches kubectl's own resolution so a merge targets the same file kubectl will read from on the next call.
func FetchAndWrite ¶
func FetchAndWrite(ctx context.Context, cloudboxBase, accessToken, nodeName, outPath string) (string, error)
FetchAndWrite reaches cloudbox for fresh kubeconfig credentials, renders the minimal kubectl-ready YAML, and writes to outPath atomically (write to .tmp + rename). When outPath is empty, resolves via Path(). Updates the package-level Status either way.
func FetchUserKubeconfigYAML ¶
FetchUserKubeconfigYAML POSTs to cloudbox's user-kubeconfig issuer and returns the rendered YAML body verbatim. Cloudbox renders the four-stanza kubeconfig server-side (handlers.renderKubeconfigYAML) so the outpost never reconstructs it.
1 MiB response cap is intentionally generous — a real kubeconfig is ~1500 bytes; anything materially larger means a misconfigured server or a non-YAML body the operator should see truncated rather than have eaten by an unbounded reader.
func MergeIntoKubectl ¶
MergeIntoKubectl splices the clusters/users/contexts from newYAML into the kubeconfig at path (treating a missing file as an empty config) and re-points current-context to newYAML's. Existing entries with names that don't collide are preserved — running this repeatedly only churns the cloudbox user/cluster/context entries (stable names) and refreshes the SA bearer.
path is resolved via DefaultKubectlPath when empty. The write is atomic (.tmp + rename) at mode 0600.
func Path ¶
func Path() string
Path returns the canonical place to write the kubectl-ready kubeconfig:
- $OUTPOST_KUBECONFIG_PATH override (operator-set)
- $HOME/.kube/<DefaultFilename>
Returns "" only on systems with no resolvable HOME — caller should surface a useful error to the operator in that case.
func Render ¶
func Render(contextName string, p *vknode.ParsedKubeconfig) string
Render returns the minimal kubeconfig YAML kubectl needs: one cluster, one user, one context, current-context set. CA inlined as certificate-authority-data when present; empty CA means trust the system roots, which is what cloudbox-fronted HTTPS through a real public cert wants.
String built by hand to keep the surface tiny + the import set light — no sigs.k8s.io/yaml dep just to emit four stanzas.
func WriteStandalone ¶
WriteStandalone writes the kubeconfig YAML to path verbatim, with 0600 perms and atomic rename — useful when the caller wants the cloudbox kubeconfig in a separate file (e.g. for KUBECONFIG-list merging in tools that prefer that over an in-place rewrite).
Types ¶
type Status ¶
type Status struct {
Path string `json:"path"`
Exists bool `json:"exists"`
LastRefresh time.Time `json:"last_refresh,omitzero"`
LastError string `json:"last_error,omitempty"`
NodeName string `json:"node_name,omitempty"`
APIURL string `json:"api_url,omitempty"`
}
Status carries the most recent FetchAndWrite outcome. The admin UI's Cluster section renders this to show "kubectl is ready" + a useful error when it isn't.
func LastStatus ¶
func LastStatus() Status
LastStatus returns a snapshot of the most recent FetchAndWrite state. Safe to call concurrently with refreshes.
Source Files