controller

Documentation

Index

• Constants
• type Clock
• type FakeClock
  • func NewFakeClock(t time.Time) *FakeClock
  • func (f *FakeClock) Advance(d time.Duration)
  • func (f *FakeClock) Now() time.Time
  • func (f *FakeClock) Set(t time.Time)
  • func (f *FakeClock) Since(t time.Time) time.Duration
  • func (f *FakeClock) Until(t time.Time) time.Duration
• type RealClock
  • func (RealClock) Now() time.Time
  • func (RealClock) Since(t time.Time) time.Duration
  • func (RealClock) Until(t time.Time) time.Duration
• type RootfsSnapshotReconciler
  • func (r *RootfsSnapshotReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
  • func (r *RootfsSnapshotReconciler) SetupWithManager(mgr ctrl.Manager) error
• type SandboxReconciler
  • func (r *SandboxReconciler) CreateSandboxPod(ctx context.Context, sandbox *sandboxv1alpha1.Sandbox, ...) error
  • func (r *SandboxReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)
  • func (r *SandboxReconciler) SetupWithManager(mgr ctrl.Manager) error

Constants

const (
	SandboxPodReadyCondition       = "PodReady"
	SandboxNetworkReadyCondition   = "NetworkConfigured"
	SandboxRootfsSnapshotCondition = "RootfsSnapshot"
)

const (
	CondReasonPodPending        = "PodPending"
	CondReasonPodRunning        = "PodRunning"
	CondReasonPodFailed         = "PodFailed"
	CondReasonPodSucceeded      = "PodSucceeded"
	CondReasonPodCreating       = "PodCreating"
	CondReasonPodCreationFailed = "PodCreationFailed"
	CondReasonDeleting          = "Deleting"
	CondReasonReconciling       = "Reconciling"

	// RootfsSnapshot-related reasons
	CondReasonRootfsSnapshottingInProgress = "RootfsSnapshottingInProgress"
	CondReasonRootfsSnapshotComplete       = "RootfsSnapshotComplete"
	CondReasonRootfsSnapshotFailed         = "RootfsSnapshotFailed"
	CondReasonRootfsSnapshotTimeout        = "RootfsSnapshotTimeout"
	CondReasonInvalidRuntime               = "InvalidRuntime"

	CondReasonStartupTimeoutExceeded = "StartupTimeoutExceeded"
	CondReasonTimeout                = "Timeout"

	// Restore-related reasons
	CondReasonRootfsRestoreConfigError = "RootfsRestoreConfigurationError"
	CondReasonNoRootfsSnapshot         = "NoRootfsSnapshot"

	// NetworkPolicy-related reasons
	CondReasonNetworkPolicyApplied = "NetworkPolicyApplied"
	CondReasonNetworkPolicyFailed  = "NetworkPolicyFailed"
)

const (

	// Trust boundary label: identifies untrusted sandbox pods for NetworkPolicy selection
	LabelSandbox = "isola.run/sandbox"

	// Network labels for pod selection by Helm-installed NetworkPolicies
	LabelAllowIPv4Internet = "isola.run/allow-ipv4-internet-egress"
	LabelAllowIPv6Internet = "isola.run/allow-ipv6-internet-egress"
	LabelAllowClusterDNS   = "isola.run/allow-cluster-dns"

	// SidecarVersionAnnotation records on the sandbox pod the isola-operator
	// GitVersion at the moment the pod was created. Sandbox.Status.SidecarVersion
	// is a mirror of this annotation; the pod is the durable source of truth so
	// the field survives operator upgrades and transient status-patch failures.
	SidecarVersionAnnotation = "isola.run/sidecar-version"
)

const SandboxFinalizer = "sandbox.isola.run/cleanup"

Types

type Clock

type Clock interface {
	Now() time.Time
	Since(t time.Time) time.Duration
	Until(t time.Time) time.Duration
}

Clock interface allows mocking time in tests for deterministic behavior

type FakeClock

type FakeClock struct {
	CurrentTime time.Time
}

func NewFakeClock

func NewFakeClock(t time.Time) *FakeClock

func (*FakeClock) Advance

func (f *FakeClock) Advance(d time.Duration)

func (*FakeClock) Now

func (f *FakeClock) Now() time.Time

func (*FakeClock) Set

func (f *FakeClock) Set(t time.Time)

func (*FakeClock) Since

func (f *FakeClock) Since(t time.Time) time.Duration

func (*FakeClock) Until

func (f *FakeClock) Until(t time.Time) time.Duration

type RealClock

type RealClock struct{}

RealClock implements Clock using real time functions

func (RealClock) Now

func (RealClock) Now() time.Time

func (RealClock) Since

func (RealClock) Since(t time.Time) time.Duration

func (RealClock) Until

func (RealClock) Until(t time.Time) time.Duration

type RootfsSnapshotReconciler

type RootfsSnapshotReconciler struct {
	client.Client
	Scheme   *runtime.Scheme
	Recorder events.EventRecorder
	Clock    Clock

	// BucketURL is the bucket URL for rootfs snapshot storage (e.g., s3://bucket?region=us-east-1)
	BucketURL string
	// CredentialSecretName is the optional Secret name for bucket credentials
	CredentialSecretName string
	// UploaderImage is the container image for the snapshot-uploader
	UploaderImage string
	// UploaderImagePullPolicy is the pull policy for the snapshot-uploader container
	UploaderImagePullPolicy corev1.PullPolicy
	// SnapshotServiceAccount is the ServiceAccount for rootfs snapshot jobs
	SnapshotServiceAccount string
	// ImagePullSecrets for pulling snapshot-uploader images from private registries
	ImagePullSecrets []corev1.LocalObjectReference

	// Enabled controls whether rootfs snapshot capability is enabled
	// When false, reconciliation fails fast with "rootfs snapshot not configured"
	Enabled bool
	// GvisorRunscPath is the path to the runsc binary on cluster nodes
	GvisorRunscPath string
	// GvisorRunscRoot is the root directory where runsc stores runtime state
	GvisorRunscRoot string
}

func (*RootfsSnapshotReconciler) Reconcile

func (r *RootfsSnapshotReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)

func (*RootfsSnapshotReconciler) SetupWithManager

func (r *RootfsSnapshotReconciler) SetupWithManager(mgr ctrl.Manager) error

type SandboxReconciler

type SandboxReconciler struct {
	client.Client
	Scheme                        *runtime.Scheme
	Recorder                      events.EventRecorder
	SandboxSidecarImage           string
	SandboxSidecarImagePullPolicy corev1.PullPolicy
	RuntimeClassName              string                        // RuntimeClassName to use for sandbox pods (e.g. "gvisor"). Empty means use cluster default.
	PriorityClassName             string                        // PriorityClassName to use for sandbox pods. Empty means use cluster default.
	ImagePullSecrets              []corev1.LocalObjectReference // ImagePullSecrets for pulling sandbox-sidecar images from private registries.
	Clock                         Clock                         // Clock interface for time operations, allows mocking in tests
	RootfsSnapshotHostMountPath   string                        // Host path where rootfs snapshot tars are NFS-mounted (e.g., /mnt/isola-snapshots)
}

func (*SandboxReconciler) CreateSandboxPod

func (r *SandboxReconciler) CreateSandboxPod(ctx context.Context, sandbox *sandboxv1alpha1.Sandbox, baseSandbox *sandboxv1alpha1.Sandbox) error

func (*SandboxReconciler) Reconcile

func (r *SandboxReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error)

func (*SandboxReconciler) SetupWithManager

func (r *SandboxReconciler) SetupWithManager(mgr ctrl.Manager) error

SetupWithManager sets up the controller with the Manager.