takodclient

package
v0.11.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 18, 2026 License: MIT Imports: 20 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	DefaultSocket       = "/run/tako/takod.sock"
	DefaultWorkerSocket = "/run/tako-platform/worker.sock"
)
View Source 
const (
	JSONRequestTimeout   = 2 * time.Minute
	StreamRequestTimeout = 30 * time.Minute
)
View Source 
const ACMEDNSRequestTimeout = 5 * time.Minute

Variables

This section is empty.

Functions

func ACMEDNSEndpoint added in v0.9.3 

func ACMEDNSEndpoint(project, environment string) string

func AccessLogsEndpoint 

func AccessLogsEndpoint(tail int, follow bool) string

func ActualStateEndpoint 

func ActualStateEndpoint(project string, environment string) string

func BackupsEndpoint 

func BackupsEndpoint(project string, environment string, volume string, backupID string) string

func CertificatesEndpoint added in v0.9.2 

func CertificatesEndpoint(domain string) string

func DiscoveryExportsEndpoint added in v0.4.35 

func DiscoveryExportsEndpoint(environment string) string

func EnvBundleEndpoint 

func EnvBundleEndpoint(project string, environment string) string

func ExecEndpoint added in v0.8.0 

func ExecEndpoint() string

func ImageBuildEndpoint 

func ImageBuildEndpoint(image string, dockerfile ...string) string

func ImageBuildEndpointWithAuth added in v0.8.0 

func ImageBuildEndpointWithAuth(image string, dockerfile ...string) string

ImageBuildEndpointWithAuth marks the build request body as carrying a registry-auth JSON preamble line ahead of the tar stream. The flag is the only auth-related value in the URL; credentials ride the body.

func ImageBuildEndpointWithOptions 

func ImageBuildEndpointWithOptions(image string, dockerfile string, withAuth bool) string

ImageBuildEndpointWithOptions marks the body as carrying a JSON options preamble before the build-context archive. Build arg values stay out of URLs.

func ImageExistsEndpoint added in v0.5.4 

func ImageExistsEndpoint(image string) string

func ImageExportEndpoint added in v0.10.0 

func ImageExportEndpoint(image string, expectedImageID ...string) string

func ImageImportEndpoint added in v0.10.0 

func ImageImportEndpoint(image string, expectedImageID ...string) string

func ImageInspectEndpoint added in v0.10.0 

func ImageInspectEndpoint(image string) string

func JobsApplyEndpoint added in v0.8.0 

func JobsApplyEndpoint() string

ExecEndpoint returns the takod exec endpoint path.

func LeaseEndpoint 

func LeaseEndpoint(project string, environment string) string

func LogsEndpoint 

func LogsEndpoint(project string, environment string, service string, tail int, follow bool) string

func MetricsEndpoint 

func MetricsEndpoint(collect bool) string

func ParseACMEDNSError added in v0.9.3 

func ParseACMEDNSError(server string, err error) error

ParseACMEDNSError converts a structured takod error response into a stable typed error. Non-ACME and malformed responses retain their original type.

func ProxyFileEndpoint 

func ProxyFileEndpoint(name string) string

func RequestJSON 

func RequestJSON(client any, socket string, method string, endpoint string, value any) (string, error)

func RequestJSONWithContext added in v0.7.0 

func RequestJSONWithContext(ctx context.Context, client any, socket string, method string, endpoint string, value any) (string, error)

func RequestJSONWithTimeout added in v0.4.1 

func RequestJSONWithTimeout(client any, socket string, method string, endpoint string, value any, timeout time.Duration) (string, error)

func RequestJSONWithTimeoutContext added in v0.7.0 

func RequestJSONWithTimeoutContext(ctx context.Context, client any, socket string, method string, endpoint string, value any, timeout time.Duration) (string, error)

func RequireCapability added in v0.9.2 

func RequireCapability(ctx context.Context, client any, socket string, server string, required string, feature string) error

RequireCapability reads /v1/status and fails closed before a caller sends a payload or invokes an endpoint an older node would silently ignore.

func ScopedCertificatesEndpoint added in v0.10.0 

func ScopedCertificatesEndpoint(project, environment, domain string) string

func ScopedImageBuildEndpoint added in v0.10.0 

func ScopedImageBuildEndpoint(project, environment, image string, dockerfile ...string) string

func ScopedImageBuildEndpointWithAuth added in v0.10.0 

func ScopedImageBuildEndpointWithAuth(project, environment, image string, dockerfile ...string) string

func ScopedImageBuildEndpointWithOptions added in v0.10.0 

func ScopedImageBuildEndpointWithOptions(project, environment, image, dockerfile string, withAuth bool) string

func ScopedImageImportEndpoint added in v0.10.0 

func ScopedImageImportEndpoint(project, environment, image string, expectedImageID ...string) string

func ScopedProxyFileEndpoint added in v0.10.0 

func ScopedProxyFileEndpoint(project, environment, name string) string

func StateEndpoint 

func StateEndpoint(project string, environment string, document string) string

func StateNodeEndpoint 

func StateNodeEndpoint(project string, environment string, document string, node string) string

func StateRevisionEndpoint 

func StateRevisionEndpoint(project string, environment string, document string, revisionID string) string

func StatsEndpoint 

func StatsEndpoint(project string, environment string, service string, all bool) string

func StreamOutput 

func StreamOutput(client any, socket string, endpoint string, stdout io.Writer, stderr io.Writer) error

func StreamOutputWithContext added in v0.7.0 

func StreamOutputWithContext(ctx context.Context, client any, socket string, endpoint string, stdout io.Writer, stderr io.Writer) error

func StreamRequest 

func StreamRequest(client any, socket string, method string, endpoint string, reader io.Reader) (string, error)

func StreamRequestOutputWithContext added in v0.8.0 

func StreamRequestOutputWithContext(ctx context.Context, client any, socket string, method string, endpoint string, body io.Reader, stdout io.Writer, stderr io.Writer) error

StreamRequestOutputWithContext sends a request body and streams the chunked response live to stdout/stderr (no buffering, no status marker) — the POST counterpart of StreamOutputWithContext. Clients without stdin streaming get the body embedded base64-encoded in the remote command.

func StreamRequestWithContext added in v0.7.0 

func StreamRequestWithContext(ctx context.Context, client any, socket string, method string, endpoint string, reader io.Reader) (string, error)

func WithOperationFence added in v0.10.0 

func WithOperationFence(ctx context.Context, fence *nodeidentity.OperationFence) context.Context

WithOperationFence binds the controller-signed mutation authority to every structured request issued with the returned context.

func WithOperationFenceSource added in v0.10.0 

func WithOperationFenceSource(ctx context.Context, source OperationFenceSource) context.Context

Types

type ACMECompletedCertificate added in v0.9.3 

type ACMECompletedCertificate struct {
	NotAfter time.Time `json:"notAfter"`
}

type ACMECompletedOperation added in v0.9.3 

type ACMECompletedOperation struct {
	Domain      string                   `json:"domain"`
	Action      string                   `json:"action"`
	Certificate ACMECompletedCertificate `json:"certificate"`
}

type ACMEOperationError added in v0.9.3 

type ACMEOperationError struct {
	Server     string
	Code       string
	Domain     string
	RetryAfter time.Time
	Completed  []ACMECompletedOperation
	Err        error
}

ACMEOperationError preserves takod's issuance classification so a control plane can distinguish local cooldown and CA rate-limit responses from other deployment failures.

func (*ACMEOperationError) Error added in v0.9.3 

func (e *ACMEOperationError) Error() string

func (*ACMEOperationError) Unwrap added in v0.9.3 

func (e *ACMEOperationError) Unwrap() error

type AgentClient added in v0.10.0 

type AgentClient struct {
	// contains filtered or unexported fields
}

AgentClient sends structured HTTP directly to a takod Unix socket. Dialer may open a local Unix socket or an SSH direct-streamlocal channel; callers do not compose shell or curl commands.

func NewAgentClient added in v0.10.0 

func NewAgentClient(dialer UnixSocketDialer, socket string) (*AgentClient, error)

NewAgentClient constructs a reusable structured takod client.

func NewLocalAgentClient added in v0.10.0 

func NewLocalAgentClient(socket string) (*AgentClient, error)

NewLocalAgentClient constructs a direct, shell-free local takod client.

func NewLocalAgentClientForUID added in v0.10.0 

func NewLocalAgentClientForUID(socket string, expectedUID uint32) (*AgentClient, error)

NewLocalAgentClientForUID authenticates a non-root protected worker ingress by its persisted operating-system UID.

func (*AgentClient) CloseIdleConnections added in v0.10.0 

func (c *AgentClient) CloseIdleConnections()

CloseIdleConnections releases reusable local or SSH streamlocal channels.

func (*AgentClient) DialUnixSocket added in v0.10.0 

func (c *AgentClient) DialUnixSocket(ctx context.Context, _ string) (net.Conn, error)

DialUnixSocket exposes the client's already-authorized transport for protocol upgrades. The requested path is intentionally ignored: transport selection has already bound this client to either the protected worker ingress or the legacy takod socket, and a caller must not be able to bypass that decision by supplying a different path.

func (*AgentClient) RequestJSON added in v0.10.0 

func (c *AgentClient) RequestJSON(ctx context.Context, method string, endpoint string, value any) (string, error)

RequestJSON performs a structured takod request and returns its response body. It preserves the existing HTTPError taxonomy without shell status markers.

func (*AgentClient) RequestJSONWithTimeout added in v0.10.0 

func (c *AgentClient) RequestJSONWithTimeout(ctx context.Context, method string, endpoint string, value any, timeout time.Duration) (string, error)

RequestJSONWithTimeout is RequestJSON with an explicit request deadline.

func (*AgentClient) SetOperationFenceSource added in v0.10.0 

func (c *AgentClient) SetOperationFenceSource(source OperationFenceSource)

SetOperationFenceSource supplies a request-time fallback for helpers that predate context-aware takod calls. An explicit context fence takes priority.

func (*AgentClient) Status added in v0.10.0 

func (c *AgentClient) Status(ctx context.Context) (*AgentStatus, error)

Status returns and validates the immutable installation identity exposed by takod. A malformed identity cannot authorize a local transport decision.

func (*AgentClient) StreamOutput added in v0.10.0 

func (c *AgentClient) StreamOutput(ctx context.Context, method string, endpoint string, input io.Reader, contentType string, output io.Writer, errorOutput io.Writer) error

StreamOutput performs a request and copies its response live to output. A non-success response is copied to errorOutput and returned as HTTPError.

func (*AgentClient) StreamRequest added in v0.10.0 

func (c *AgentClient) StreamRequest(ctx context.Context, method string, endpoint string, input io.Reader, contentType string) (string, error)

StreamRequest sends input without buffering and returns a bounded response.

func (*AgentClient) UpgradeStream added in v0.10.0 

func (c *AgentClient) UpgradeStream(ctx context.Context, endpoint string, value any) (*UpgradedStream, error)

UpgradeStream opens a structured upgraded takod connection using the same dialer and socket as normal requests.

type AgentStatus added in v0.10.0 

type AgentStatus struct {
	Runtime                string                      `json:"runtime"`
	Version                string                      `json:"version"`
	UpgradeProtocol        int                         `json:"upgradeProtocol"`
	MinimumUpgradeProtocol int                         `json:"minimumUpgradeProtocol"`
	Capabilities           []string                    `json:"capabilities,omitempty"`
	Hostname               string                      `json:"hostname"`
	Identity               *nodeidentity.Identity      `json:"identity,omitempty"`
	EnrollmentRoles        []string                    `json:"enrollmentRoles,omitempty"`
	Membership             *nodeidentity.InventoryNode `json:"membership,omitempty"`
	MembershipGeneration   uint64                      `json:"membershipGeneration,omitempty"`
}

AgentStatus contains the installation-level fields used to authenticate a local transport decision. Mutable project/environment metadata is intentionally not part of this trust decision.

func (AgentStatus) Validate added in v0.10.0 

func (s AgentStatus) Validate() error

Validate defensively checks a status value before it is used as identity attestation. Callers must not rely on a particular IdentityProbe having obtained the value through AgentClient.Status.

type CapabilityRequiredError added in v0.9.2 

type CapabilityRequiredError struct {
	Server     string
	Capability string
	Feature    string
}

CapabilityRequiredError rejects an operation before mutation when a target node agent does not advertise a capability required by the request.

func (*CapabilityRequiredError) Error added in v0.9.2 

func (e *CapabilityRequiredError) Error() string

type HTTPError added in v0.9.2 

type HTTPError struct {
	Method   string
	Endpoint string
	Status   int
	Body     string
}

HTTPError preserves a non-success takod response status so command adapters can map rejected input to their typed machine error taxonomy.

func (*HTTPError) Error added in v0.9.2 

func (e *HTTPError) Error() string

func (*HTTPError) HTTPStatus added in v0.10.0 

func (e *HTTPError) HTTPStatus() int

HTTPStatus allows durable operation adapters to distinguish a known upstream HTTP rejection from an uncertain transport failure.

type LocalUnixSocketDialer added in v0.10.0 

type LocalUnixSocketDialer struct {
	// ExpectedUID is the operating-system UID that must own the connected
	// takod process. The zero value intentionally requires root.
	ExpectedUID uint32
}

LocalUnixSocketDialer opens a Unix socket in the current network namespace.

func (LocalUnixSocketDialer) DialUnixSocket added in v0.10.0 

func (d LocalUnixSocketDialer) DialUnixSocket(ctx context.Context, path string) (net.Conn, error)

type OperationFenceSource added in v0.10.0 

type OperationFenceSource interface {
	OperationFence() *nodeidentity.OperationFence
}

OperationFenceSource returns the latest renewed controller fence at request time. RemoteLeaseSet implements this so long operations do not keep sending the signature from their initial lease window.

type RequestExecutor 

type RequestExecutor interface {
	ExecuteWithContext(ctx context.Context, cmd string) (string, error)
	ExecuteWithInput(ctx context.Context, cmd string, input io.Reader) (string, error)
}

type StreamExecutor 

type StreamExecutor interface {
	RequestExecutor
	ExecuteStream(cmd string, stdout io.Writer, stderr io.Writer) error
}

type UnixSocketDialer added in v0.8.1 

type UnixSocketDialer interface {
	DialUnixSocket(ctx context.Context, path string) (net.Conn, error)
}

UnixSocketDialer opens a full-duplex connection to a Unix socket on the takod node, typically through an SSH direct-streamlocal channel.

type UpgradedStream added in v0.8.1 

type UpgradedStream struct {
	Conn   net.Conn
	Reader *bufio.Reader
}

UpgradedStream is a hijacked takod connection speaking the ptystream frame protocol. Reader buffers bytes that arrived with the handshake response; always read frames from Reader, never from Conn directly.

func UpgradeStream added in v0.8.1 

func UpgradeStream(ctx context.Context, dialer UnixSocketDialer, socket string, endpoint string, value any) (*UpgradedStream, error)

UpgradeStream dials the takod socket, POSTs value to endpoint with an Upgrade: tako-pty/1 handshake, and returns the connection as a raw frame stream once the server switches protocols. A non-101 response is returned as an error carrying the response body.

func (*UpgradedStream) Close added in v0.8.1 

func (s *UpgradedStream) Close() error

Close closes the underlying connection.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.