Documentation
¶
Overview ¶
Package bootstrap embeds bootstrap resources for hub initialization.
Index ¶
- Constants
- func InstallCRDs(ctx context.Context, config *rest.Config) error
- func InstallPermissionClaimPolicy(ctx context.Context, discoveryClient discovery.DiscoveryInterface, ...) error
- func PermissionClaimPolicyServed(discoveryClient discovery.DiscoveryInterface) (bool, error)
- func PermissionClaimPolicyTargetConfig(kcpAdminConfig *rest.Config) *rest.Config
- func PreserveInitialWorkspaceRequests(ctx context.Context, dyn dynamic.Interface) error
Constants ¶
const AdminVirtualWorkspacePath = "/services/admin/clusters/root"
AdminVirtualWorkspacePath is where kcp serves the admin virtual workspace, which is the only place a PermissionClaimPolicy can be written. The object is installation-wide and lives in the admin workspace's root cluster, so the path is fixed rather than derived from whatever workspace the hub is pointed at.
Verified against kcp's custom-subresources build (kcp-dev/kcp#4388): applying this repository's generated policy to <base>/services/admin/clusters/root created it and it reads back unchanged. The hub's own kcp admin identity is accepted, because the admin workspace authorizer admits system:kcp:admin and system:masters, and permissionclaimpolicies is one of the resources that workspace owns and therefore accepts a create for.
const PermissionClaimPolicyGroupVersion = "admin.kcp.io/v1alpha1"
PermissionClaimPolicyGroupVersion is the group/version the policy lives in. kcp-dev/kcp#4385 is unmerged, so today's kcp does not serve it and this hub carries no dependency on the type: the object is applied as unstructured YAML through the dynamic client, and discovery decides whether to apply it at all.
const PermissionClaimPolicyResource = "permissionclaimpolicies"
PermissionClaimPolicyResource is the resource name discovery is probed for.
Variables ¶
This section is empty.
Functions ¶
func InstallCRDs ¶
InstallCRDs installs the railgrid CRDs into the cluster.
func InstallPermissionClaimPolicy ¶ added in v0.2.7
func InstallPermissionClaimPolicy(ctx context.Context, discoveryClient discovery.DiscoveryInterface, dynamicClient dynamic.Interface) error
InstallPermissionClaimPolicy applies the generated PermissionClaimPolicy when — and only when — the cluster serves the API.
The policy is config/kcp/permissionclaimpolicy.yaml, generated from every provider manifest's spec.requires[] by hack/generate-permission-claim-policy.mjs. It whitelists, per claiming API group, the groups that claimer may claim without an identityHash, which is the kcp-side expression of the same relationships that already drive tenant consent at Enable and the hub-minted scoped identity.
On a cluster without the API this logs once, at info, and returns nil. Today that is every cluster.
func PermissionClaimPolicyServed ¶ added in v0.2.7
func PermissionClaimPolicyServed(discoveryClient discovery.DiscoveryInterface) (bool, error)
PermissionClaimPolicyServed reports whether the cluster serves admin.kcp.io/v1alpha1 permissionclaimpolicies.
A missing group/version is the expected answer on today's kcp and is not an error. Any other discovery failure is returned: "I could not tell" must not look like "it is not there", or a transient outage would silently skip the policy on a cluster that does serve it.
func PermissionClaimPolicyTargetConfig ¶ added in v0.2.7
PermissionClaimPolicyTargetConfig returns the rest.Config the policy is applied through: the hub's kcp admin credentials against the admin virtual workspace, not the ordinary cluster path the rest of bootstrap uses.
The base URL is rebuilt rather than appended to, because the hub's config may already carry a /clusters/<name> path and the admin workspace is not reached underneath one.
func PreserveInitialWorkspaceRequests ¶ added in v0.2.7
PreserveInitialWorkspaceRequests must run before replacing the Organization schema. The old schema cannot store the new status.defaultWorkspace field; metadata preserves the old UUID across pruning until the org controller can adopt it. Keep all conditions unchanged, including completed/access handoffs.
Types ¶
This section is empty.
Source Files