server

Documentation

Index

• Constants
• func SeedBuiltinNamespaces(ctx context.Context, st store.Store) error
• func SeedBuiltinPolicies(ctx context.Context, st store.Store) error
• type APIServer
  • func New(opts ...Option) (*APIServer, error)
  • func (s *APIServer) GetOrchestrator() orchestrator.Orchestrator
  • func (s *APIServer) GetStore() store.Store
  • func (s *APIServer) Start() error
  • func (s *APIServer) Stop() error
• type AuthInfo
• type Option
  • func WithAuth(_ []string) Option
  • func WithDockerRunner(runner runner.Runner) Option
  • func WithExtraGRPCRegistrar(reg func(grpc.ServiceRegistrar)) Option
  • func WithGRPCAddr(addr string) Option
  • func WithHTTPAddr(addr string) Option
  • func WithInitialMountResolver(resolver controllers.MountResolver) Option
  • func WithLogger(logger log.Logger) Option
  • func WithNetworkStatusProvider(p service.NetworkStatusProvider) Option
  • func WithOrchestrator(orchestrator orchestrator.Orchestrator) Option
  • func WithProcessRunner(runner runner.Runner) Option
  • func WithStorageDefaultStorageClass(name *string) Option
  • func WithStorageDriverConfigs(cfg map[string]map[string]any) Option
  • func WithStoragePreserveOnDelete(preserve bool) Option
  • func WithStorageSecretLookup(lookup driverparams.SecretLookup) Option
  • func WithStore(store store.Store) Option
  • func WithTLS(certFile, keyFile string) Option
  • func WithVIPAllocator(a service.VIPAllocator) Option
• type Options
  • func DefaultOptions() *Options

Constants

const (
	// AuthorizationHeader is the header key for API key authentication.
	AuthorizationHeader = "authorization"

	// APIKeyPrefix is the prefix for API key values in the Authorization header.
	APIKeyPrefix = "Bearer "
)

Functions

func SeedBuiltinNamespaces

func SeedBuiltinNamespaces(ctx context.Context, st store.Store) error

SeedBuiltinNamespaces ensures the built-in namespaces exist (idempotent).

func SeedBuiltinPolicies

func SeedBuiltinPolicies(ctx context.Context, st store.Store) error

SeedBuiltinPolicies ensures the built-in policies exist (idempotent).

Types

type APIServer

type APIServer struct {
	// contains filtered or unexported fields
}

APIServer represents the gRPC API server for Rune.

func New

func New(opts ...Option) (*APIServer, error)

New creates a new API server with the given options.

func (*APIServer) GetOrchestrator

func (s *APIServer) GetOrchestrator() orchestrator.Orchestrator

GetOrchestrator returns the orchestrator instance. Used by runed to wire post-construction collaborators (e.g. RUNE-063 networking data plane endpoint publisher).

func (*APIServer) GetStore

func (s *APIServer) GetStore() store.Store

GetStore returns the store instance.

func (*APIServer) Start

func (s *APIServer) Start() error

Start starts the API server.

func (*APIServer) Stop

func (s *APIServer) Stop() error

Stop stops the API server gracefully.

type AuthInfo

type AuthInfo struct {
	SubjectID string
}

AuthInfo holds minimal identity used by handlers for RBAC checks

type Option

type Option func(*Options)

Option is a function that configures options.

func WithAuth

func WithAuth(_ []string) Option

WithAuth enables authentication with the given API keys.

func WithDockerRunner

func WithDockerRunner(runner runner.Runner) Option

WithDockerRunner sets the Docker runner.

func WithExtraGRPCRegistrar

func WithExtraGRPCRegistrar(reg func(grpc.ServiceRegistrar)) Option

WithExtraGRPCRegistrar appends a function that registers an additional gRPC service when the server starts. Callers (e.g. runed wiring up WatchService) use this to inject services without the API server package having to import them.

func WithGRPCAddr

func WithGRPCAddr(addr string) Option

WithGRPCAddr sets the gRPC address.

func WithHTTPAddr

func WithHTTPAddr(addr string) Option

WithHTTPAddr sets the HTTP address.

func WithInitialMountResolver

func WithInitialMountResolver(resolver controllers.MountResolver) Option

WithInitialMountResolver pre-installs a MountResolver on the instance controller before the orchestrator's first reconcile. cmd/runed passes a never-ready stub so the production startup window between orchestrator start and agent.volumes registering the real resolver returns transient "not yet mounted" errors — rather than falling back to Volume.Handle as the bind source, which is a UUID for cloud drivers and a fast-path that's correct only for local-driver tests.

func WithLogger

func WithLogger(logger log.Logger) Option

WithLogger sets the logger.

func WithNetworkStatusProvider

func WithNetworkStatusProvider(p service.NetworkStatusProvider) Option

WithNetworkStatusProvider plugs the live VIP allocator into the AdminService.NetworkStatus RPC.

func WithOrchestrator

func WithOrchestrator(orchestrator orchestrator.Orchestrator) Option

WithOrchestrator sets the orchestrator.

func WithProcessRunner

func WithProcessRunner(runner runner.Runner) Option

WithProcessRunner sets the process runner.

func WithStorageDefaultStorageClass

func WithStorageDefaultStorageClass(name *string) Option

WithStorageDefaultStorageClass threads the runefile [storage].defaultStorageClass knob through to the orchestrator. Nil means "keep built-in default"; pointer-to-empty-string means "no cluster default — error on missing storageClassName".

func WithStorageDriverConfigs

func WithStorageDriverConfigs(cfg map[string]map[string]any) Option

WithStorageDriverConfigs threads per-driver opaque configuration from the runefile through to the orchestrator that the API server constructs internally. No-op when the caller also supplies an already-built orchestrator via WithOrchestrator.

func WithStoragePreserveOnDelete

func WithStoragePreserveOnDelete(preserve bool) Option

WithStoragePreserveOnDelete threads the runefile [storage].preserveOnDelete knob through to the orchestrator.

func WithStorageSecretLookup

func WithStorageSecretLookup(lookup driverparams.SecretLookup) Option

WithStorageSecretLookup threads a SecretLookup function through to the orchestrator's volume + snapshot controllers, where it resolves `secret:...` references inside StorageClass / Volume parameter maps before drivers see them. cmd/runed wires a store-backed implementation here; tests typically pass nil (literal token paths only). See RUNE-200 PR 3.

func WithStore

func WithStore(store store.Store) Option

WithStore sets the state store.

func WithTLS

func WithTLS(certFile, keyFile string) Option

WithTLS enables TLS with the given certificate and key files.

func WithVIPAllocator

func WithVIPAllocator(a service.VIPAllocator) Option

WithVIPAllocator plugs the VIP allocator into ServiceService so CreateService assigns a stable VIP from the cluster pool.

type Options

type Options struct {
	// Server addresses
	GRPCAddr string
	HTTPAddr string

	// TLS configuration
	EnableTLS   bool
	TLSCertFile string
	TLSKeyFile  string

	// Authentication (token-only)
	EnableAuth bool

	// Logging
	Logger log.Logger

	// State store
	Store store.Store

	// Runner manager
	RunnerManager *manager.RunnerManager

	// Orchestrator
	Orchestrator orchestrator.Orchestrator

	// ExtraGRPCRegistrars are invoked during gRPC server startup to
	// register additional services beyond the built-in set. Used by
	// runed to plug in WatchService (RUNE-028) without forcing the
	// API server to depend on every networking-layer package.
	ExtraGRPCRegistrars []func(grpc.ServiceRegistrar)

	// NetworkStatusProvider, if set, is wired into AdminService so
	// the NetworkStatus RPC can report ClusterNetwork CIDR + VIP
	// allocations. Supplied by runed alongside the VIP allocator
	// (RUNE-040).
	NetworkStatusProvider service.NetworkStatusProvider

	// VIPAllocator, if set, is plugged into ServiceService so each
	// CreateService call assigns a stable VIP from the pool.
	// Supplied by runed at startup.
	VIPAllocator service.VIPAllocator

	// StorageDriverConfigs is the per-driver opaque configuration
	// map (driver name → key/value) passed to the orchestrator when
	// the server constructs one itself (i.e. when WithOrchestrator
	// was not used). Sourced from the runefile [storage.drivers]
	// table by runed. Nil-safe — drivers fall back to their own
	// defaults.
	StorageDriverConfigs map[string]map[string]any

	// StorageDefaultStorageClass mirrors the runefile [storage].
	// defaultStorageClass knob. *string so empty-string ("no cluster
	// default") is distinguishable from unset.
	StorageDefaultStorageClass *string

	// StorageSecretLookup resolves `secret:...` references inside
	// StorageClass / Volume parameters before they reach the storage
	// drivers. Wired by cmd/runed against the store-backed SecretRepo.
	// See RUNE-200 PR 3 / pkg/storage/driverparams.
	StorageSecretLookup driverparams.SecretLookup

	// StoragePreserveOnDelete mirrors the runefile [storage].
	// preserveOnDelete knob. When true the local driver treats
	// ReclaimPolicy:delete as retain.
	StoragePreserveOnDelete bool

	// InitialMountResolver, if set, is installed on the instance
	// controller before the orchestrator's first reconcile tick. Lets
	// cmd/runed pre-seed a never-ready stub so the production window
	// between orchestrator start and agent.volumes registering the
	// real resolver returns transient "not yet mounted" errors instead
	// of falling back to Volume.Handle.
	InitialMountResolver controllers.MountResolver
}

Options defines the options for the API server.

func DefaultOptions

func DefaultOptions() *Options

DefaultOptions returns the default options.