Skip to content

feat: native Go K8s operations — 12/12 migration complete#21

Merged
robbycochran merged 3 commits into
mainfrom
rc-k8s2
Jun 5, 2026
Merged

feat: native Go K8s operations — 12/12 migration complete#21
robbycochran merged 3 commits into
mainfrom
rc-k8s2

Conversation

@robbycochran

@robbycochran robbycochran commented Jun 5, 2026

Copy link
Copy Markdown
Collaborator

Summary

Ports all remaining K8s bash wrappers to native Go. Every command path is now native Go — 12/12.

New: internal/k8s/ package

Modeled on stackrox/roxie kubectl wrapper:

  • RunKubectl with automatic retry on transient errors + exponential backoff
  • RunHelm, RunOC — shell out to helm/oc CLI binaries
  • ApplyYAML — build K8s resources as Go maps, marshal via yaml.v3, pipe to kubectl apply
  • 9 stub-based tests

Ported commands

  • deploy --remote: namespace, CRDs, SCCs, RBAC, Helm, Route, mTLS certs
  • teardown --k8s: Helm uninstall, CRD/SCC/secret/namespace cleanup
  • new --remote: prerequisite chain (deploy+providers+creds), ConfigMap, Job YAML, log tailing
  • creds.go: K8s secrets for GWS + Atlassian

Fixes from manual testing

  • new --remote now ensures gateway/providers/creds before sandbox creation (was silently failing)
  • Errors printed to stderr (SilenceErrors was hiding all errors)

Only new dep: gopkg.in/yaml.v3.

Test results

Path Result
Go unit tests 47/47
Launcher tests 7/7
Bats (both) 29/29
bash + podman 19/19
Go + podman 19/19
Go + OCP 17/17
Manual: harness new --remote Sandbox created + ready

robbycochran and others added 3 commits June 4, 2026 21:47
New internal/k8s/ package (modeled on stackrox/roxie): RunKubectl with
transient error retry + exponential backoff, RunHelm, RunOC, ApplyYAML
(map → yaml.Marshal → kubectl apply -f -). 9 stub-based tests.

deploy --remote: namespace, CRDs, SCCs, RBAC (Go maps), Helm install,
Route, mTLS cert extraction, gateway registration. Replaces 160 lines
of bash + Python (TOML parsing for chart version now native Go).

teardown --k8s: Helm uninstall, CRD/SCC/secret/namespace cleanup,
gateway config cleanup. All operations tolerate "not found" errors.

new --remote: ConfigMap creation, Job YAML (Go map), log tailing,
status polling. No more inline heredoc YAML.

creds.go: K8s secret management for GWS + Atlassian credentials.
Extracted from creds.sh.

Gateway interface: added GatewayAdd, GatewayRemove.
Only new dependency: gopkg.in/yaml.v3.

Validated: unit 47+7, bats 29+29, podman 19+19, Go+OCP 17/17.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Two fixes from manual testing:

1. new --remote now runs the same prerequisite chain as the bash version:
   deploy (if gateway unreachable) → providers (if none registered) →
   creds (ensure K8s secrets) → sandbox create. Previously jumped
   straight to sandbox creation, failing with "namespace not found".

2. Print errors to stderr in main.go — SilenceErrors hid ALL errors
   including legitimate failures, producing silent exit 1 with no output.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@robbycochran robbycochran merged commit 9134077 into main Jun 5, 2026
@robbycochran robbycochran deleted the rc-k8s2 branch June 13, 2026 14:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant