Documentation
¶
Overview ¶
Package v1alpha1 contains the platform-owner-only admin API. It holds the Provider type, which declaratively provisions a provider's kcp sub-workspace + ServiceAccount + kubeconfig Secret.
The group name carries "admin" deliberately: the admin.railgrid.ai APIExport is bound ONLY in root:railgrid:providers (admin/hub). This is distinct from providers.railgrid.ai, which serves CatalogEntry and IS bound into provider sub-workspaces so providers can self-register their catalog entry. Because Provider lives behind the admin-only export, a provider running in its own sub-workspace (with cluster-admin over that workspace) cannot create a Provider and thereby bootstrap sibling provider workspaces.
Index ¶
Constants ¶
const ( GroupName = "admin.railgrid.ai" Version = "v1alpha1" )
Variables ¶
var ( SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: Version} SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) AddToScheme = SchemeBuilder.AddToScheme )
Functions ¶
func Resource ¶
func Resource(resource string) schema.GroupResource
Types ¶
type Provider ¶
type Provider struct {
metav1.TypeMeta `json:",inline"`
metav1.ObjectMeta `json:"metadata,omitempty"`
Spec ProviderSpec `json:"spec,omitempty"`
Status ProviderStatus `json:"status,omitempty"`
}
Provider declaratively provisions the kcp-side scaffolding a third-party extension needs to run: the per-provider sub-workspace root:railgrid:providers:<name>, a "provider" ServiceAccount with cluster-admin inside that workspace, and a long-lived kubeconfig the provider pod mounts — written into a Secret in root:railgrid:system:providers (the same workspace this CR lives in). It also binds the providers.railgrid.ai APIExport (CatalogEntry) into the new sub-workspace so the provider can self-register its CatalogEntry.
It is deliberately minimal: workspace + ServiceAccount + kubeconfig Secret + the CatalogEntry binding, and NOTHING ELSE. The provider's APIExport, APIResourceSchemas, APIExportEndpointSlice, bind grant, and CatalogEntry all come from the provider's own `init` (running inside the sub-workspace with the minted kubeconfig).
Provider lives in the admin.railgrid.ai APIExport, bound ONLY in root:railgrid:system:providers — a provider cannot create a Provider from its own sub-workspace, so it cannot bootstrap sibling providers.
WARNING: deleting a Provider triggers FULL teardown — its finalizer deletes the sub-workspace (cascading the ServiceAccount, its token, the CatalogEntry, and any APIExport / APIResourceSchemas the provider's init created there) plus the kubeconfig Secret. Do not delete a Provider whose exports tenants still depend on.
func (*Provider) DeepCopy ¶
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new Provider.
func (*Provider) DeepCopyInto ¶
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*Provider) DeepCopyObject ¶
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ProviderList ¶
type ProviderList struct {
metav1.TypeMeta `json:",inline"`
metav1.ListMeta `json:"metadata,omitempty"`
Items []Provider `json:"items"`
}
ProviderList contains a list of Provider.
func (*ProviderList) DeepCopy ¶
func (in *ProviderList) DeepCopy() *ProviderList
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderList.
func (*ProviderList) DeepCopyInto ¶
func (in *ProviderList) DeepCopyInto(out *ProviderList)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
func (*ProviderList) DeepCopyObject ¶
func (in *ProviderList) DeepCopyObject() runtime.Object
DeepCopyObject is an autogenerated deepcopy function, copying the receiver, creating a new runtime.Object.
type ProviderSecretRef ¶
type ProviderSecretRef struct {
// Namespace is the namespace the Secret lives in within
// root:railgrid:system:providers. Typically "default".
// +optional
Namespace string `json:"namespace,omitempty"`
// Name is the Secret name.
Name string `json:"name"`
// Key is the data key holding the kubeconfig YAML. Typically "kubeconfig".
// +optional
Key string `json:"key,omitempty"`
}
ProviderSecretRef locates the minted kubeconfig Secret in root:railgrid:system:providers.
func (*ProviderSecretRef) DeepCopy ¶
func (in *ProviderSecretRef) DeepCopy() *ProviderSecretRef
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderSecretRef.
func (*ProviderSecretRef) DeepCopyInto ¶
func (in *ProviderSecretRef) DeepCopyInto(out *ProviderSecretRef)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ProviderSpec ¶
type ProviderSpec struct {
// DisplayName is informational, shown in admin tooling. The provisioned
// sub-workspace is always root:railgrid:providers:<metadata.name> regardless.
// +optional
// +kubebuilder:validation:MaxLength=128
DisplayName string `json:"displayName,omitempty"`
// SecretName overrides the name of the kubeconfig Secret the controller
// writes into root:railgrid:system:providers. Defaults to "<name>-kubeconfig".
// +optional
// +kubebuilder:validation:MaxLength=253
SecretName string `json:"secretName,omitempty"`
// ServerURLOverride overrides the API server URL baked into the minted
// kubeconfig. Empty means the controller's configured provider server URL
// (the hub's --hub-internal-url when set, otherwise --hub-external-url).
// +optional
// +kubebuilder:validation:MaxLength=512
ServerURLOverride string `json:"serverURLOverride,omitempty"`
}
ProviderSpec defines the desired state of a Provider. The provider's name (metadata.name) is the identity: it drives the sub-workspace path (root:railgrid:providers:<name>) and the ServiceAccount, so the spec carries only optional knobs.
func (*ProviderSpec) DeepCopy ¶
func (in *ProviderSpec) DeepCopy() *ProviderSpec
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderSpec.
func (*ProviderSpec) DeepCopyInto ¶
func (in *ProviderSpec) DeepCopyInto(out *ProviderSpec)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
type ProviderStatus ¶
type ProviderStatus struct {
// WorkspacePath is the kcp workspace path the controller provisioned, e.g.
// "root:railgrid:providers:kuery".
// +optional
WorkspacePath string `json:"workspacePath,omitempty"`
// WorkspaceCluster is the logical-cluster ID of the provisioned
// sub-workspace (Workspace.spec.cluster).
// +optional
WorkspaceCluster string `json:"workspaceCluster,omitempty"`
// SecretRef points at the kubeconfig Secret the controller wrote into
// root:railgrid:system:providers.
// +optional
SecretRef *ProviderSecretRef `json:"secretRef,omitempty"`
// LastProvisioned is the wall-clock time provisioning last succeeded.
// +optional
LastProvisioned *metav1.Time `json:"lastProvisioned,omitempty"`
// Conditions describe the current state of the Provider. The "Ready"
// condition is True once the workspace, ServiceAccount, and kubeconfig
// Secret all exist.
// +optional
Conditions []metav1.Condition `json:"conditions,omitempty"`
}
ProviderStatus defines the observed state of a Provider.
func (*ProviderStatus) DeepCopy ¶
func (in *ProviderStatus) DeepCopy() *ProviderStatus
DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new ProviderStatus.
func (*ProviderStatus) DeepCopyInto ¶
func (in *ProviderStatus) DeepCopyInto(out *ProviderStatus)
DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
Source Files