Documentation
¶
Overview ¶
Package poolrender produces a fully rendered SandboxPool CR from an Env + Member + SandboxTemplate triple. It is the single source of truth for the "what should the member Pool look like" projection.
Both the Env Reconciler and the API service call RenderSandboxPool — that way the SandboxPool object handed to plugin admission at the API edge is byte-equal to the one the Reconciler eventually persists, modulo Reconciler-only side-effects (e.g. the dynamic image-pull-secret stamp based on Secret existence) that flow through ImagePullSecretExists.
Index ¶
- func ImagePullSecretExists(ctx context.Context, c client.Client, namespace, secretName string) (bool, error)
- func MaterializeFromMember(env *agentsv1alpha1.SandboxEnv, member agentsv1alpha1.EnvClusterMember, ...) *agentsv1alpha1.SandboxPool
- func MergeOwnedMapKeys(dst *map[string]string, desired map[string]string)
- func OwnerReferenceForEnv(env *agentsv1alpha1.SandboxEnv) metav1.OwnerReference
- func RenderSandboxPool(in Inputs) (*agentsv1alpha1.SandboxPool, error)
- func Validate(spec *agentsv1alpha1.SandboxPoolSpec) error
- type Inputs
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ImagePullSecretExists ¶
func ImagePullSecretExists(ctx context.Context, c client.Client, namespace, secretName string) (bool, error)
ImagePullSecretExists is a small helper for callers that need to compute the ImagePullSecretExists bit before calling RenderSandboxPool. Treats transient lookup errors as "missing" so a flaky API server doesn't make the renderer stamp a stale reference; callers can ignore the error or log it.
func MaterializeFromMember ¶
func MaterializeFromMember(env *agentsv1alpha1.SandboxEnv, member agentsv1alpha1.EnvClusterMember, ipsExists bool) *agentsv1alpha1.SandboxPool
MaterializeFromMember projects a frozen EnvClusterMember snapshot onto a fresh SandboxPool object. The Member's Metadata (sanitised at API time) and Spec are copied verbatim; the Pool's OwnerReference is stamped from the supplied Env; the dynamic ImagePullSecret reference is recomputed from the supplied existence flag so a Secret created or deleted after AddMember still propagates onto the Pool.
LabelEnv is stamped unconditionally and overwrites any caller-supplied value — the Env reconciler is the authoritative source for that indexing label, and downstream consumers (e.g. the Pool autoscaler's listSiblings) rely on the label being present on every Env-owned Pool. Pools created before this stamping was introduced get the label added the next time updateMemberPoolIfDrifted runs against them.
Unlike RenderSandboxPool this function does NOT consult the Template or run plugin admission — plugin side-effects already live inside Member.Metadata + Member.Spec by construction (AddMember captures them post-PreCreatePool). The Env Reconciler is the only intended caller.
func MergeOwnedMapKeys ¶
MergeOwnedMapKeys upserts every entry in desired into *dst. Foreign keys already present in *dst are preserved — the Env Reconciler only manages keys it has been asked to set; kubectl edits to unrelated keys survive. Exported for use from the Reconciler drift-merge path.
func OwnerReferenceForEnv ¶
func OwnerReferenceForEnv(env *agentsv1alpha1.SandboxEnv) metav1.OwnerReference
OwnerReferenceForEnv is the canonical controlling OwnerReference stamped onto every member SandboxPool. Exported so the poolmigration adopter and any direct test set-up can produce identical references.
func RenderSandboxPool ¶
func RenderSandboxPool(in Inputs) (*agentsv1alpha1.SandboxPool, error)
RenderSandboxPool produces the complete SandboxPool CR a member should look like.
The output carries:
- ObjectMeta: Name (=member.Name), Namespace (=env.Namespace), OwnerRef (controlling, blockOwnerDeletion), team/user identity labels, the subset of Template labels/annotations that survive the sync filter, member-supplied labels/annotations, plus template-name and template-version provenance annotations.
- Spec: Replicas (=member.Replicas), TemplateName, PodCreationImagePolicy and the default startup/idle timeouts (all from env.Spec.Overrides), and a fully rendered EmbeddedSandboxTemplate.
Rendering follows v0.0.3 SandboxPoolService.Create semantics: copy EmbeddedSandboxTemplate → apply overrides (image, inline resources) → stamp the imagePullSecret reference → sync labels/annotations → write provenance.
Errors are deterministic input-validation failures; callers wrap them into domain.AppError at the HTTP boundary.
func Validate ¶
func Validate(spec *agentsv1alpha1.SandboxPoolSpec) error
Validate runs cross-field checks the rendered SandboxPool spec must satisfy. Idle image must differ from the runtime container image so the idle / running state machine can distinguish the two. Other CRD-level constraints (replica bounds, etc.) are enforced by OpenAPI / the Pool Reconciler.
Types ¶
type Inputs ¶
type Inputs struct {
// Env is the owning SandboxEnv. Required. Contributes the namespace,
// owner reference, team/user identity labels, and Spec.Overrides.
Env *agentsv1alpha1.SandboxEnv
// Template is the source SandboxTemplate (resolved from Env.Spec.TemplateRef.Name).
// Required. Contributes EmbeddedSandboxTemplate plus labels/annotations
// that get synced onto the Pool.
Template *agentsv1alpha1.SandboxTemplate
// Member is the EnvClusterMember being projected. Member.Name becomes
// the Pool's metadata.name; Member.Labels/Annotations land on the Pool.
Member agentsv1alpha1.EnvClusterMember
// ImagePullSecretExists reports whether the convention-named
// dockerconfigjson Secret (agentsv1alpha1.EnvImagePullSecretName(env.Name))
// currently exists in the namespace. When true the renderer appends a
// LocalObjectReference to that Secret onto the pod's imagePullSecrets;
// when false an existing reference (if any) is removed so deletion of
// the Env-managed Secret propagates cleanly.
ImagePullSecretExists bool
}
Inputs carries everything RenderSandboxPool needs to project an Env + Member into a complete SandboxPool CR.
Source Files