recovery

package

v0.11.0 Latest Latest Go to latest Published: Jul 18, 2026 License: MIT Imports: 24 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/redentordev/tako-cli

Links

Open Source Insights

Documentation ¶

Rendered for

Index ¶

Constants
Variables
func AcquireMaintenanceBarrier(dataDir string) (func(), error)
func AcquireMutationLock(dataDir string) (func(), error)
func AcquireNodeUpgradeLifecycleExclusion() (func(), error)
func AcquireNodeUpgradeLifecycleExclusionForDataDir(dataDir string) (func(), error)
func AcquireOperationBarrier(dataDir string) (func(), error)
func AcquireSnapshotLock(dataDir string) (func(), error)
func EnsureNoActiveControllerOperation(dataDir string, controllerPublicKey ...string) error
func ParseKey(encoded string) ([]byte, error)
type Entry
type Manifest
type Result
- func Create(path, clusterID string, sources []Source) (*Result, error)
- func CreateEncrypted(destination, clusterID string, sources []Source, masterKey []byte) (*Result, error)
type Source

Constants ¶

View Source

const (
	BundleKind       = "TakoPlatformRecoveryBundle"
	BundleAPIVersion = "tako.io/v1"
)

Variables ¶

View Source

var ErrNodeUpgradeLeaseActive = errors.New("node lifecycle mutation blocked by active node upgrade lease")

Functions ¶

func AcquireMaintenanceBarrier ¶

func AcquireMaintenanceBarrier(dataDir string) (func(), error)

func AcquireMutationLock ¶

func AcquireMutationLock(dataDir string) (func(), error)

func AcquireNodeUpgradeLifecycleExclusion ¶

func AcquireNodeUpgradeLifecycleExclusion() (func(), error)

AcquireNodeUpgradeLifecycleExclusion serializes controller-local membership mutations with the per-node upgrade transaction. The returned release keeps the same kernel guard held for the entire lifecycle mutation.

func AcquireNodeUpgradeLifecycleExclusionForDataDir ¶

func AcquireNodeUpgradeLifecycleExclusionForDataDir(dataDir string) (func(), error)

AcquireNodeUpgradeLifecycleExclusionForDataDir derives the child node-upgrade lock from the takod data directory. It keeps production and isolated test roots on the same lock-ordering path.

func AcquireOperationBarrier ¶

func AcquireOperationBarrier(dataDir string) (func(), error)

func AcquireSnapshotLock ¶

func AcquireSnapshotLock(dataDir string) (func(), error)

func EnsureNoActiveControllerOperation ¶

func EnsureNoActiveControllerOperation(dataDir string, controllerPublicKey ...string) error

EnsureNoActiveControllerOperation is called only while the caller holds the exclusive snapshot lock. New HTTP operations are then blocked, so observing no active durable authority is a race-free snapshot precondition.

func ParseKey ¶

func ParseKey(encoded string) ([]byte, error)

ParseKey accepts an out-of-band 256-bit base64 recovery key. The key is never stored in the bundle or object metadata.

Types ¶

type Entry ¶

type Entry struct {
	Path   string      `json:"path"`
	Mode   fs.FileMode `json:"mode"`
	Size   int64       `json:"size"`
	SHA256 string      `json:"sha256,omitempty"`
	Link   string      `json:"link,omitempty"`
}

type Manifest ¶

type Manifest struct {
	APIVersion string    `json:"apiVersion"`
	Kind       string    `json:"kind"`
	ClusterID  string    `json:"clusterId"`
	CreatedAt  time.Time `json:"createdAt"`
	Roots      []string  `json:"roots"`
	Entries    []Entry   `json:"entries"`
}

func RestoreEncrypted ¶

func RestoreEncrypted(path, destination, expectedClusterID string, masterKey []byte) (*Manifest, error)

RestoreEncrypted authenticates the bundle, then extracts only into a new staging directory. It never overwrites live /etc/tako or /var/lib/tako.

func Verify ¶

func Verify(path, expectedClusterID string) (*Manifest, error)

func VerifyEncrypted ¶

func VerifyEncrypted(path, expectedClusterID string, masterKey []byte) (*Manifest, error)

type Result ¶

type Result struct {
	Path     string
	SHA256   string
	Manifest Manifest
}

func Create ¶

func Create(path, clusterID string, sources []Source) (*Result, error)

func CreateEncrypted ¶

func CreateEncrypted(destination, clusterID string, sources []Source, masterKey []byte) (*Result, error)

CreateEncrypted streams tar/gzip output directly into authenticated encryption. No plaintext controller archive is ever written to disk.

type Source ¶

type Source struct {
	Path     string
	Archive  string
	Required bool
}

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL