config

Documentation

Index

• Variables
• type ACME
• type Auth
• type Client
• type Config
  • func Default() *Config
  • func Load(path string) (*Config, error)
  • func (c *Config) KEKOptions() *crypto.KEKOptions
• type Docker
• type DockerRegistryAuth
• type DockerRegistryConfig
• type FailedInstanceRetention
• type Ingress
• type KEKConfig
• type Log
• type Networking
• type Node
• type Plugins
• type Resources
• type SecretEncryption
• type Server
• type Storage
• type TLS
• type Telemetry

Variables

var (
	// DefaultGRPCPort is the default gRPC port for Rune (T9 keypad for RUNE -> 7863)
	DefaultGRPCPort = 7863
	// DefaultHTTPPort is the default HTTP port for Rune (T9 keypad for RUNE -> 7861)
	DefaultHTTPPort = 7861
)

Types

type ACME

type ACME struct {
	Directory string `yaml:"directory"`
	Email     string `yaml:"email"`
}

ACME holds the Let's Encrypt directory + contact email used by the edge ingress (RUNE-067). See note on Networking above.

type Auth

type Auth struct {
	APIKeys          string `yaml:"api_keys"`
	Provider         string `yaml:"provider"`
	Token            string `yaml:"token"`
	AllowRemoteAdmin bool   `yaml:"allow_remote_admin"`
}

type Client

type Client struct {
	Timeout time.Duration `yaml:"timeout"`
	Retries int           `yaml:"retries"`
}

type Config

type Config struct {
	Server    Server    `yaml:"server"`
	DataDir   string    `yaml:"data_dir"`
	Client    Client    `yaml:"client"`
	Docker    Docker    `yaml:"docker"`
	Namespace string    `yaml:"namespace"`
	Auth      Auth      `yaml:"auth"`
	Resources Resources `yaml:"resources"`
	Log       Log       `yaml:"log"`
	Secret    struct {
		Encryption SecretEncryption `yaml:"encryption"`
		Limits     store.Limits     `yaml:"limits"`
	} `yaml:"secret"`
	ConfigResource struct {
		Limits store.Limits `yaml:"limits"`
	} `yaml:"config"`
	Plugins    Plugins    `yaml:"plugins"`
	Networking Networking `yaml:"networking"`
	Telemetry  Telemetry  `yaml:"telemetry"`
	Node       Node       `yaml:"node"`
	Ingress    Ingress    `yaml:"ingress"`
	ACME       ACME       `yaml:"acme"`
	Storage    Storage    `yaml:"storage"`

	// FailedInstanceRetention controls how long failed-but-preserved
	// instance containers stick around for postmortem (logs, exec --debug)
	// before the reconciler evicts them. See FailedInstanceRetention for
	// individual knobs and defaults.
	FailedInstanceRetention FailedInstanceRetention `yaml:"failed_instance_retention"`
}

func Default

func Default() *Config

func Load

func Load(path string) (*Config, error)

func (*Config) KEKOptions

func (c *Config) KEKOptions() *crypto.KEKOptions

type Docker

type Docker struct {
	APIVersion                string                 `yaml:"api_version"`
	FallbackAPIVersion        string                 `yaml:"fallback_api_version"`
	NegotiationTimeoutSeconds int                    `yaml:"negotiation_timeout_seconds"`
	Registries                []DockerRegistryConfig `yaml:"registries"`
}

type DockerRegistryAuth

type DockerRegistryAuth struct {
	Type       string            `yaml:"type"` // basic | token | ecr
	Username   string            `yaml:"username"`
	Password   string            `yaml:"password"`
	Token      string            `yaml:"token"`
	Region     string            `yaml:"region"`
	FromSecret any               `yaml:"fromSecret"` // string or {name,namespace}
	Bootstrap  bool              `yaml:"bootstrap"`
	Manage     string            `yaml:"manage"` // create|update|ignore
	Immutable  bool              `yaml:"immutable"`
	Data       map[string]string `yaml:"data"` // inline source (env-expanded)
}

DockerRegistryAuth holds authentication configuration for a registry

type DockerRegistryConfig

type DockerRegistryConfig struct {
	Name     string             `yaml:"name"`
	Registry string             `yaml:"registry"`
	Auth     DockerRegistryAuth `yaml:"auth"`
}

DockerRegistryConfig represents a registry entry in the runefile

type FailedInstanceRetention

type FailedInstanceRetention struct {
	// PerServiceCap is the maximum number of Failed instances to retain
	// per service before the oldest is evicted. 0 disables the cap.
	PerServiceCap int `yaml:"per_service_cap"`

	// TTL is the maximum age of a Failed instance before it is evicted,
	// regardless of cap. 0 disables TTL (only the cap applies).
	TTL time.Duration `yaml:"ttl"`

	// SnapshotLogBytes is the upper bound on the per-instance log
	// snapshot we capture into Instance.LastLogs at eviction time, so
	// `rune logs --previous` still has output to show after the
	// container is gone. 0 disables snapshotting.
	SnapshotLogBytes int `yaml:"snapshot_log_bytes"`
}

FailedInstanceRetention configures the reconciler's failed-instance GC. When an instance enters the Failed state, the runner stops (but does not remove) its container so operators can inspect it via `rune logs` and `rune exec --debug`. This struct bounds the resulting disk and container- slot growth.

type Ingress

type Ingress struct {
	HTTPAddr  string `yaml:"http_addr"`
	HTTPSAddr string `yaml:"https_addr"`
}

Ingress holds the bind addresses for the edge ingress (RUNE-067). See note on Networking above.

type KEKConfig

type KEKConfig struct {
	Source     string `yaml:"source"`
	File       string `yaml:"file"`
	Passphrase struct {
		Enabled bool   `yaml:"enabled"`
		Env     string `yaml:"env"`
	} `yaml:"passphrase"`
}

type Log

type Log struct {
	Level  string `yaml:"level"`
	Format string `yaml:"format"`
}

type Networking

type Networking struct {
	ClusterCIDR string `yaml:"cluster_cidr"`
	DevMode     bool   `yaml:"dev_mode"`
}

Networking holds the networking-layer settings (RUNE-040..067).

runed currently reads these via viper.GetString("networking.*") directly in cmd/runed/main.go rather than through the Config unmarshal path, but the fields are declared here so that the runefile schema-of-record stays complete (and so the lint-side parity test stays bidirectional). If/when the runed boot path migrates to reading these off Config, no further struct work is needed.

type Node

type Node struct {
	Role string `yaml:"role"`
}

Node holds per-node placement metadata (edge / worker / leader). See note on Networking above.

type Plugins

type Plugins struct {
	Dir     string   `yaml:"dir"`
	Enabled []string `yaml:"enabled"`
}

type Resources

type Resources struct {
	CPU struct {
		DefaultRequest string `yaml:"default_request"`
		DefaultLimit   string `yaml:"default_limit"`
	} `yaml:"cpu"`
	Memory struct {
		DefaultRequest string `yaml:"default_request"`
		DefaultLimit   string `yaml:"default_limit"`
	} `yaml:"memory"`
}

type SecretEncryption

type SecretEncryption struct {
	Enabled bool      `yaml:"enabled"`
	KEK     KEKConfig `yaml:"kek"`
}

type Server

type Server struct {
	GRPCAddr string `yaml:"grpc_address"`
	HTTPAddr string `yaml:"http_address"`
	TLS      TLS    `yaml:"tls"`
}

type Storage

type Storage struct {
	// DefaultStorageClass selects which StorageClass is marked
	// Default:true at orchestrator boot. *string so the empty-string
	// case ("no cluster default — error on missing storageClassName")
	// is distinguishable from "unset → keep built-in default".
	DefaultStorageClass *string `yaml:"defaultStorageClass,omitempty"`

	// PreserveOnDelete, when true, converts ReclaimPolicy:delete to
	// retain for volumes provisioned by the in-tree "local" driver.
	// Useful for single-node dev clusters where accidental rm -rf is
	// unrecoverable.
	PreserveOnDelete bool `yaml:"preserveOnDelete,omitempty"`

	// AllowCreateMissing, when true, lets drivers auto-create missing
	// host paths instead of failing validation. Plumbed through to the
	// driver layer; per-driver enforcement is a separate slice.
	AllowCreateMissing bool `yaml:"allowCreateMissing,omitempty"`

	Drivers map[string]map[string]any `yaml:"drivers,omitempty"`
}

Storage holds operator-facing configuration for the storage subsystem. The runefile schema is:

storage:
  defaultStorageClass: local       # name of the cluster-default class
                                    # ("" disables the cluster default;
                                    # missing storageClassName then errors)
  preserveOnDelete: false          # when true, the local driver demotes
                                    # reclaimPolicy:delete to retain
  allowCreateMissing: false        # plumbing only; enforced by drivers
  drivers:
    local:
      localVolumeRoot: /var/lib/rune/volumes
    local-host:
      hostPathAllowlist: ["/srv/rune"]

Keys under `drivers` are driver names registered with the storage driver registry. Values are passed verbatim to Driver constructors via OrchestratorOptions.StorageDriverConfigs; missing entries fall back to the driver's own defaults.

type TLS

type TLS struct {
	Enabled  bool   `yaml:"enabled"`
	CertFile string `yaml:"cert_file"`
	KeyFile  string `yaml:"key_file"`
}

type Telemetry

type Telemetry struct {
	MetricsAddr string `yaml:"metrics_addr"`
}

Telemetry holds the metrics endpoint configuration. See note on Networking above for the viper-direct-vs-unmarshal status.