Documentation
¶
Overview ¶
Package dovolume implements the "do-volume" storage driver — Rune's reference cloud driver, backed by DigitalOcean Block Storage.
The driver is registered under the name "do-volume" (operator-facing, hyphenated) while the Go package itself is "dovolume" (Go forbids hyphens). Operators consume it by writing a StorageClass that points at it:
storageClass:
name: do-ssd-nyc3
driver: do-volume
parameters:
region: nyc3
fsType: ext4
reclaimPolicy: retain
allowedTopologies:
- matchLabels:
rune.io/region: nyc3
Auth uses a DigitalOcean Personal Access Token. The token may be supplied two ways via the runefile [storage.drivers.do-volume] section:
- `apiToken: "dop_v1_..."` — literal token (typically operator environment substitution, e.g. ${env:DO_API_TOKEN}). Use for dev / single-tenant clusters.
- `apiTokenSecretRef: "<ns>/<name>#<key>"` — reference to a Rune Secret. Resolved at every API call so token rotation works without restarting runed. Requires a SecretLookup to be injected into the factory config under the reserved key "_secretLookup" (cmd/runed does this from a SecretRepo).
Introduced in RUNE-069. See _docs/designs/RUNE-069-Storage-Management.md §5.1.
Index ¶
Constants ¶
const ConfigKeySecretLookup = "_secretLookup"
ConfigKeySecretLookup is the reserved key the factory map[string]any carries the SecretLookup callable under. Wired by cmd/runed; tests supply their own. Using a leading underscore signals "not a runefile field" — viper would never produce a key beginning with one.
const DriverName = "do-volume"
DriverName is the registry key.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Config ¶
type Config struct {
// APIToken is a literal DO Personal Access Token. Mutually
// exclusive with APITokenSecretRef.
APIToken string
// APITokenSecretRef references a Rune Secret. Format:
// "<namespace>/<name>#<key>". Resolved via SecretLookup at call
// time. Mutually exclusive with APIToken.
APITokenSecretRef string
// APIBaseURL overrides the DO API endpoint. Defaults to
// "https://api.digitalocean.com" — only set in tests against a
// httptest.Server.
APIBaseURL string
// VolumeNamePrefix is prepended to every DO volume name created by
// this driver, so multiple Rune clusters can share one DO
// account without colliding. Default "rune-".
VolumeNamePrefix string
// SecretLookup is injected by cmd/runed (or tests). nil is
// allowed at parse time; resolveToken() returns a clear error if
// APITokenSecretRef is set without it.
SecretLookup SecretLookup
}
Config is the runefile [storage.drivers.do-volume] section after parsing. Every field is optional at parse time; required-fields validation happens at first use so a misconfigured do-volume stanza doesn't crash runed for clusters that don't use DO.
type SecretLookup ¶
SecretLookup resolves a single field from a Rune Secret. namespace + name identify the Secret; key selects a field of Secret.Data. Returns the plaintext value or an error.
Drivers call this synchronously on every Provision / Attach / etc. so secret rotation takes effect on the next reconcile without requiring a runed restart.
Source Files