Support useful kubectl core inspection and strict TLS #10

Merged

toasterson merged 7 commits from codex/kubectl-inspection-20261005 into main

2026-10-06 01:39:09 +00:00

toasterson commented

2026-10-05 21:10:32 +00:00

Owner

Current source: c35221a2fde07d1b38d7d9460bd92839eac52197. All 13 native checks passed on oibldofgate/global, including 310 tests, both release binaries and library closure, API/auth smokes, formatting and strict workspace/all-targets Clippy. Real kubectl v1.37.0 passed discovery/get/describe, ordinary/wide Tables, selectors, JSON/YAML and strict TLS against this exact build; both fixture and tunnel stopped with credentials removed. All 55 refreshed IPS stages passed. Package pkg://openindiana.org/application/reddwarf@0.1.0,5.11-0.20261005.8:20261006T000736Z, P5P SHA256 edff6afd3a4d8f29dcebccaf943a89b3d57d55c312b6520145bd388183e4a9e4, 7,874,560 bytes. Portable 22-file packet reddwarf-kubectl-delivery-20261005-2.tar.gz, 8,364,464 bytes, SHA256 86c0cf18e5d04523e224e329e667b4a1a063d694f1c783b318f3f4c7a5bb4f77. All four current-head AI dimensions approved; canonical CI dispatch recorded, result pending. Private package remains uninstalled and inactive. The predecessor evidence below is retained as history.

Work item: WI-8 (01a10dc4-3c04-7230-be5d-f14e9d08fdba).

Standard kubectl get previously showed only Name/Age and discovery could not identify the core inspection API. This change enables authenticated discovery, api-resources, get and describe for Nodes, Pods, Services and Namespaces, with useful ordinary and wide Table output.

Negotiate meta.k8s.io/v1 Tables while preserving JSON responses for JSON/YAML client output. Honor Accept quality/specificity, explicit exclusions and unsupported-transform fallback; include row metadata for -A, and support Metadata/Object/None row-object policies.
Show Node status/roles/version and wide IP/OS/kernel/runtime; Pod ready/status/restarts and wide IP/node; Service type/addresses/ports and wide selector; Namespace status. Ages and counters use actual stored metadata/status, with explicit placeholders when unavailable.
Apply authorization, worker assignment visibility and supported label/field selectors before projection. Unsupported selectors return 400; unknown APIs remain 404. Discovery advertises only implemented operations.
Keep /version honest: RedDwarf major 0/minor 1 and v0.1.0+reddwarf, with core schemas from Kubernetes 1.31. Version-skew warnings remain visible. Generated CAs now encode certificate/CRL signing usage and ECDSA server certificates encode digital-signature usage; existing TLS trust is preserved and requires explicit enrollment to replace.

Validation at 40134dfd9ee57e9ac6b78975ba6ad93e9fd50689: 310 native workspace tests passed on OpenIndiana, including Table protocol, metadata, selector and authorization regressions. The focused source change passed independent review. Both native release binaries and library closure pass; native HTTP/TLS and operator/worker authorization smokes pass. Real kubectl v1.37.0 passed the final strict-TLS discovery/get/describe/Table/selector/JSON/YAML smoke. Its owned tunnel and native fixture stopped with temporary credentials removed. All 55 native IPS stages pass; disabled SMF manifests validate. Package pkg://openindiana.org/application/reddwarf@0.1.0,5.11-0.20261005.7:20261005T224435Z P5P SHA256 0a3cbae0f855cb44e919e09656af73b39a7ff1658f1d80b7f79e8a23041187dc. Package is staged privately, uninstalled and inactive. Portable 20-file packet reddwarf-kubectl-delivery-20261005-1.tar.gz: 8361392 bytes, SHA256 de2178bcb1baf9b761bf73f127584a5dbc684061b302984672b89ee57caa6642. Native evidence is separate from canonical Anima review/CI.

This is core inspection compatibility. Events, EndpointSlices, Leases, quotas/limit ranges and other unimplemented APIs remain unavailable; missing auxiliary describe output is not evidence of an empty backend. Kubernetes watch, logs/exec/apply, controllers and conformance are outside this change. The bounded smoke helper uses a dedicated disposable TLS API and private credentials; it launches no zone workload.

Current source: `c35221a2fde07d1b38d7d9460bd92839eac52197`. All 13 native checks passed on oibldofgate/global, including 310 tests, both release binaries and library closure, API/auth smokes, formatting and strict workspace/all-targets Clippy. Real kubectl v1.37.0 passed discovery/get/describe, ordinary/wide Tables, selectors, JSON/YAML and strict TLS against this exact build; both fixture and tunnel stopped with credentials removed. All 55 refreshed IPS stages passed. Package `pkg://openindiana.org/application/reddwarf@0.1.0,5.11-0.20261005.8:20261006T000736Z`, P5P SHA256 `edff6afd3a4d8f29dcebccaf943a89b3d57d55c312b6520145bd388183e4a9e4`, 7,874,560 bytes. Portable 22-file packet `reddwarf-kubectl-delivery-20261005-2.tar.gz`, 8,364,464 bytes, SHA256 `86c0cf18e5d04523e224e329e667b4a1a063d694f1c783b318f3f4c7a5bb4f77`. All four current-head AI dimensions approved; canonical CI dispatch recorded, result pending. Private package remains uninstalled and inactive. The predecessor evidence below is retained as history. Work item: WI-8 (`01a10dc4-3c04-7230-be5d-f14e9d08fdba`). Standard `kubectl get` previously showed only Name/Age and discovery could not identify the core inspection API. This change enables authenticated discovery, `api-resources`, `get` and `describe` for Nodes, Pods, Services and Namespaces, with useful ordinary and wide Table output. - Negotiate `meta.k8s.io/v1` Tables while preserving JSON responses for JSON/YAML client output. Honor Accept quality/specificity, explicit exclusions and unsupported-transform fallback; include row metadata for `-A`, and support Metadata/Object/None row-object policies. - Show Node status/roles/version and wide IP/OS/kernel/runtime; Pod ready/status/restarts and wide IP/node; Service type/addresses/ports and wide selector; Namespace status. Ages and counters use actual stored metadata/status, with explicit placeholders when unavailable. - Apply authorization, worker assignment visibility and supported label/field selectors before projection. Unsupported selectors return 400; unknown APIs remain 404. Discovery advertises only implemented operations. - Keep `/version` honest: RedDwarf major 0/minor 1 and `v0.1.0+reddwarf`, with core schemas from Kubernetes 1.31. Version-skew warnings remain visible. Generated CAs now encode certificate/CRL signing usage and ECDSA server certificates encode digital-signature usage; existing TLS trust is preserved and requires explicit enrollment to replace. Validation at `40134dfd9ee57e9ac6b78975ba6ad93e9fd50689`: 310 native workspace tests passed on OpenIndiana, including Table protocol, metadata, selector and authorization regressions. The focused source change passed independent review. Both native release binaries and library closure pass; native HTTP/TLS and operator/worker authorization smokes pass. Real kubectl v1.37.0 passed the final strict-TLS discovery/get/describe/Table/selector/JSON/YAML smoke. Its owned tunnel and native fixture stopped with temporary credentials removed. All 55 native IPS stages pass; disabled SMF manifests validate. Package `pkg://openindiana.org/application/reddwarf@0.1.0,5.11-0.20261005.7:20261005T224435Z` P5P SHA256 `0a3cbae0f855cb44e919e09656af73b39a7ff1658f1d80b7f79e8a23041187dc`. Package is staged privately, uninstalled and inactive. Portable 20-file packet `reddwarf-kubectl-delivery-20261005-1.tar.gz`: 8361392 bytes, SHA256 `de2178bcb1baf9b761bf73f127584a5dbc684061b302984672b89ee57caa6642`. Native evidence is separate from canonical Anima review/CI. This is core inspection compatibility. Events, EndpointSlices, Leases, quotas/limit ranges and other unimplemented APIs remain unavailable; missing auxiliary `describe` output is not evidence of an empty backend. Kubernetes watch, logs/exec/apply, controllers and conformance are outside this change. The bounded smoke helper uses a dedicated disposable TLS API and private credentials; it launches no zone workload.

toasterson added 4 commits

2026-10-05 21:10:32 +00:00

Support kubectl discovery and core resource inspection (WI-8) 0bbd5cfdee

Bound and protect kubectl fixture client inputs a4992a19d3

Account for the API bootstrap namespace in kubectl smoke 89b1157694

Normalize server creation timestamps to wire precision 0bdcaf52c5

toasterson added 1 commit

2026-10-05 21:22:46 +00:00

Issue TLS certificates with strict-client signing key usages 2d60c15b20

toasterson added 1 commit

2026-10-05 22:24:06 +00:00

Serve useful kubectl tables for core resource inspection 40134dfd9e

toasterson changed title from ~~Support standard kubectl discovery and cluster inspection~~ to Support useful kubectl core inspection and strict TLS

2026-10-05 22:48:21 +00:00

toasterson added 1 commit

2026-10-05 23:42:46 +00:00

Resolve strict Clippy warnings in kubectl inspection c35221a2fd

toasterson merged commit be9f865257 into main

2026-10-06 01:39:09 +00:00

toasterson referenced this pull request from a commit

2026-10-06 01:39:12 +00:00

Merge pull request 'Support useful kubectl core inspection and strict TLS' (#10) from codex/kubectl-inspection-20261005 into main