internal

README

cmd/internal

Wiring layer for Orkestra. Assembles every komponent, threads dependencies, and hands the result to pkg/orkestra — the supervisor that calls Start() and Stop() in order.

Two public entrypoints:

• KonductRuntime — runtime. Reconcile loop, informers, leader election. Called by ork run.
• KonductGateway — gateway. TLS + admission webhooks, no reconcilers, no leader election. Called by ork gate. Cluster-only.

Docs

• 01 — Overview
• 02 — Runtime
• 03 — Gateway
• 04 — Security

Documentation

Overview

cmd/internal/gateway.go

Gateway startup — a minimal process that handles only TLS/security setup and serves admission/conversion webhooks. No reconcilers, no informer factory, no konductor election (webhook servers are stateless and can run as multiple replicas).

internal/security.go

Security wiring — called from konstructRuntime after the HealthServer is constructed and before Orkestra starts.

Handles:

1. TLS certificate generation — when deletion protection, admission webhooks, or conversion webhooks are enabled and no explicit cert is configured. Uses certmanager.Manager to generate and store the bundle in orkestra-tls Secret.

2. CRD conversion webhook patch — when a CRD declares conversion.updateCRD: true, Orkestra patches the CRD's spec.conversion.webhook.clientConfig.caBundle with the CA certificate from the generated (or configured) TLS bundle.

All operations fatal-log on failure — if security cannot be applied, the operator cannot function correctly.

Index

• func KonductGateway(kfg *konfig.Konfig, m *merger.Merger, ctx context.Context)
• func KonductRuntime(kfg *konfig.Konfig, m *merger.Merger, ctx context.Context)
• func WireWebhookHousekeeperInfra(ws *webhook.WebhookServer, kube *kubeclient.Kubeclient, kat *katalog.Katalog, ...)

Functions

func KonductGateway

func KonductGateway(kfg *konfig.Konfig, m *merger.Merger, ctx context.Context)

KonductGateway starts the gateway — TLS + WebhookServer only. No konductor election — the gateway is stateless and supports multiple replicas.

func KonductRuntime

func KonductRuntime(kfg *konfig.Konfig, m *merger.Merger, ctx context.Context)

func WireWebhookHousekeeperInfra

func WireWebhookHousekeeperInfra(
	ws *webhook.WebhookServer,
	kube *kubeclient.Kubeclient,
	kat *katalog.Katalog,
	kfg *konfig.Konfig,
)

WireWebhookHousekeeperInfra provides the WebhookServer with the callbacks it needs to keep CRD conversion webhooks correct throughout the deployment lifecycle. Called after ensureSecurity and before webhook.Start().

Two hooks are set:

• ConversionCRDPatcher — re-patches the caBundle on any CRD with conversion.updateCRD: true when the housekeeper detects drift.
• CRDWatcher — watches each conversion CRD for MODIFIED events so the housekeeper restores a stripped caBundle within a single API round-trip rather than waiting for the safety ticker.