Documentation
¶
Overview ¶
Package clusteraccess resolves, per recipe execution, which Kubernetes cluster a recipe should deploy to and how to authenticate to it. It returns an in-memory *rest.Config that the recipe engines consume instead of assuming the in-cluster config.
The resolver dispatches to an ordered list of strategies. The first strategy whose appliesTo reports true is used. Strategy precedence is:
- injectedKubeconfigStrategy — a kubeconfig supplied out-of-band via RADIUS_TARGET_KUBECONFIG (the Repo Radius workflow contract).
- localStrategy — the control-plane cluster (in-cluster config, falling back to the local kubeconfig when not running in-cluster). This is the default and matches today's behavior.
Cloud-derived strategies (EKS/AKS) are added later behind the same seam.
Index ¶
Constants ¶
const TargetKubeconfigEnvVar = kubeutil.TargetKubeconfigEnvVar
TargetKubeconfigEnvVar is the environment variable that points at a kubeconfig for an external target cluster. The Repo Radius deploy workflow mounts a kubeconfig into the Radius RP pods and sets this variable; honoring it is the v1 multi-cluster contract that Radius owns. It is defined canonically in kubeutil so the recipe path and the direct-resource path share one source.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type ClusterAccessResolver ¶
type ClusterAccessResolver interface {
// Resolve returns a *rest.Config for the cluster targeted by this execution.
// When nothing names an external cluster, it returns the control-plane
// (in-cluster / local kubeconfig) config.
Resolve(ctx context.Context, envConfig *recipes.Configuration) (*rest.Config, error)
// ResolveKubeconfigSource returns a KubeconfigSource for the cluster targeted
// by this execution, for consumers that read a kubeconfig path natively (the
// Terraform kubernetes provider). When nothing names an external cluster, it
// describes the control-plane (in-cluster / local kubeconfig) cluster.
ResolveKubeconfigSource(ctx context.Context, envConfig *recipes.Configuration) (KubeconfigSource, error)
}
ClusterAccessResolver returns the Kubernetes cluster a recipe execution targets and how to authenticate to it. The returned config and any embedded credentials are scoped to a single recipe execution and must not be persisted.
func NewResolver ¶
func NewResolver() ClusterAccessResolver
NewResolver creates a ClusterAccessResolver with the default strategy set: injected kubeconfig first, then the local (control-plane) cluster.
type KubeconfigSource ¶
type KubeconfigSource struct {
// Path is the kubeconfig file path to use. An empty Path means the in-cluster
// config should be used (no explicit kubeconfig file).
Path string
}
KubeconfigSource describes how a kubeconfig-based consumer (notably the Terraform kubernetes provider, which reads a kubeconfig path natively) should reach the target cluster.
A Path-based source is preferred over an in-memory *rest.Config for consumers that read a kubeconfig file directly: it keeps any bearer token in the file the workflow already mounted rather than copying it into generated config, and it preserves exec-plugin / client-certificate kubeconfigs that a *rest.Config round-trip would lose.
Source Files