package kube

  1. Overview
  2. Docs
Native OCaml Kubernetes client and controller runtime

Install 

dune-project
 Dependency

github.com Readme Changelog Edit opam file Versions (1)

Authors

  1. V
    Ville Vesilehto
  2. O
    ocaml-kube contributors

Maintainers

  1. V
    Ville Vesilehto <ville@vesilehto.fi>

Sources

v0.1.3.tar.gz
md5=3c6916dea849fb2842c4a2e8a92b6cdd
sha512=b57daa3bb4879e1f33efc157cf5c648f88455e0f7c87484d572096d46345d6a8081cc7cefb4887aa95507af8daf73b3b8570b8583106953a5ba96a874159ff00

doc/kube/Kube/Config/index.html

Module Kube.ConfigSource

Kubernetes connection and authentication configuration.

Sourcetype exec
Sourcetype credential =
  1. | Anonymous
  2. | Static_token of string
  3. | Token_file of string
  4. | Basic of {
    1. username : string;
    2. password : string;
    }
  5. | Exec of exec
Sourcetype tls = {
  1. ca_pem : string option;
  2. client_certificate_pem : string option;
  3. client_key_pem : string option;
  4. insecure_skip_verify : bool;
  5. server_name : string option;
}
Sourcetype impersonation
Sourceval default_tls : tls
Sourceval make_impersonation : ?uid:string -> ?groups:string list -> ?extra:(string * string list) list -> user:string -> unit -> (impersonation, string) result

Validate Kubernetes user impersonation state. Extra keys must be lowercase; their header suffixes are percent-escaped when requests are prepared.

Sourcetype t = {
  1. server : Uri.t;
  2. namespace : string option;
  3. credential : credential;
  4. tls : tls;
  5. proxy_url : Uri.t option;
  6. impersonation : impersonation option;
}
Sourceval make : ?namespace:string -> ?credential:credential -> ?tls:tls -> ?proxy_url:Uri.t -> ?impersonation:impersonation -> Uri.t -> t

Construct a validated client configuration. Explicit proxy URLs may use the http, https, or socks5 kubeconfig schemes; transport support is checked when a connection is opened.

Sourceval load_kubeconfig : ?context:string -> string -> (t, string) result

Load one kubeconfig and select its current or explicitly named context.

Sourceval load_kubeconfigs : ?context:string -> string list -> (t, string) result

Merge kubeconfigs using first-file-wins name resolution. Relative certificate, key, and token paths are resolved against the file that defines their entry.

Sourceval in_cluster : unit -> (t, string) result
Sourceval load_default : ?context:string -> unit -> (t, string) result

Prefer in-cluster configuration when service environment variables exist; otherwise load every path in KUBECONFIG, or the standard user path.

Sourceval bearer_token : t -> (string option, string) result

Resolve only bearer-token credentials. Prefer authorization_header for general request code.

Sourceval authorization_header : t -> (string option, string) result

Resolve the current Authorization value, refreshing token files and expiring exec-plugin credentials when needed.

Sourcetype credential_origin = [
  1. | `Protected
  2. | `Heap
]

Whether the credential bytes originated outside the OCaml heap. Inline, basic, and exec-plugin credentials are necessarily `Heap; token files are read directly into protected memory and are `Protected.

Sourceval with_authorization_secret : ?hardened:bool -> t -> (origin:credential_origin -> Secret.t option -> 'a) -> ('a, string) result

Resolve the current Authorization value into a scoped Secret.t. The value is destroyed when the callback returns or raises. Token files are read with Secret_unix without first creating an OCaml string. Other credential kinds remain available for compatibility but are marked as heap-originating so security-sensitive callers can reject them.

Sourceval impersonation_headers : t -> (string * string) list

Return the validated Kubernetes impersonation headers for this config.

Sourceval invalidate_credential : t -> bool

Clear a refreshable credential after an authentication failure. Returns true when a refresh is possible.