httpkit

Documentation

Overview

Package httpkit is the shared HTTP client plumbing that each seanfarm operator used to hand-roll: cluster CA-trust transports, credential-rotation-aware client caches, and bounded response reads with condition-safe error excerpts. Only the common LEAVES live here. Domain policy, such as openbao's namespace-scoped token TTLs and SSRF gate, or kratos's per-CR endpoints, stays operator-side, built on top of these.

Index

• Constants
• func BoundedRead(r io.Reader, max int64) ([]byte, error)
• func ClusterCATransport() *http.Transport
• func ErrorExcerpt(body []byte) string
• type CredentialCache
  • func (cc *CredentialCache[C]) Get(key, credential string, build func() (C, error)) (C, error)
  • func (cc *CredentialCache[C]) Invalidate(key string)

Constants

const ClusterCABundlePath = "/etc/ssl/cluster-trust/ca-bundle.crt"

ClusterCABundlePath is where the Kyverno trust injection mounts the trust-manager bundle, in every non-excluded pod.

const MaxResponseBytes = 1 << 20

MaxResponseBytes is the default bound for reading remote API responses. It is generous for JSON APIs, but small enough that a misbehaving remote cannot balloon operator memory.

Functions

func BoundedRead

func BoundedRead(r io.Reader, max int64) ([]byte, error)

BoundedRead reads r to EOF, capped at max bytes. Pass 0 for max to use MaxResponseBytes.

func ClusterCATransport

func ClusterCATransport() *http.Transport

ClusterCATransport returns an *http.Transport that trusts the cluster CA bundle: the internal CA, the LE-staging root, and the Mozilla roots. It falls back to the system pool when the bundle is absent, such as in local dev or tests. Connection pooling is tuned for the operator reconcile pattern: many small calls to ONE in-cluster endpoint. This tuning was extracted from forgejo-operator's sharedTransport.

func ErrorExcerpt

func ErrorExcerpt(body []byte) string

ErrorExcerpt bounds a remote error body, for embedding in errors that land in status conditions. The limit deliberately equals the library's condition-message bound, so an excerpt never triggers truncation downstream. Kratos documented this coupling by hand. Now it is structural.

Types

type CredentialCache

type CredentialCache[C any] struct {
	// contains filtered or unexported fields
}

CredentialCache is a keyed client cache that rebuilds an entry when its credential changes. This is the rotated-token pattern every operator needs. A VSO or ESO rotation must transparently invalidate the cached client. Otherwise calls return 401 until a restart. See the forgejo token-rotation incidents. Build runs OUTSIDE the lock, because it may do I/O. The loser of a build race is discarded.

func (*CredentialCache[C]) Get

func (cc *CredentialCache[C]) Get(key, credential string, build func() (C, error)) (C, error)

Get returns the cached client for key when its credential still matches. Otherwise it builds a fresh client through build and caches it. The credential is compared in memory only. It is never stored anywhere else.

func (*CredentialCache[C]) Invalidate

func (cc *CredentialCache[C]) Invalidate(key string)

Invalidate drops one entry. Call it after an auth failure that suggests the cached credential died before its watcher noticed.