ironcore

IronCore Generator

Published on kadet-hub: pin a released version by digest from its catalog page.

Kapitan kadet generator for IronCore IaaS resources. Built for IronCore 0.8.0 (v1alpha1, the only version of these groups at that release):

MachineClass, MachinePool, VolumeClass, VolumePool and IPAM Prefixes are operator-managed and only referenced. Secrets for ignition and disk encryption belong in the kubernetes generator.

Usage

Kapitan Configuration

parameters:
  kapitan:
    dependencies:
      - type: oci
        source: ghcr.io/kadet-hub/ironcore@sha256:<digest>
        output_path: lib/ironcore
    compile:
      - output_path: manifests/ironcore/
        input_type: kadet
        output_type: yml
        input_paths:
          - lib/ironcore

Inventory Contract

All keys live under parameters.generators.ironcore. The namespace resolves per resource: namespace on the resource, then generators.ironcore.namespace, then parameters.namespace, then default.

Every resource accepts namespace, labels, annotations and spec. Precedence is generator defaults < spec < flat keys; a flat key that overrides a spec value logs Flat key '<key>' overrides spec passthrough '<field>' for resource '<name>'.

Flat keys are the snake_case spelling of the spec fields; the camelCase spelling is accepted too. Values nested inside them use the API’s camelCase field names.

Shorthands (a dict passes through unchanged, for example networkRef: {name: x, namespace: y}; other keys of peerings, ports and Machine attachments stay verbatim):

Defaults and derived values:

Required inputs without a default: LoadBalancer type (Public exposes the selected interfaces to the internet, so choose Public or Internal), VirtualIP and NATGateway ip_family, LoadBalancer ip_families when it has no ips, and NetworkInterface ips (an ephemeral IP needs a parent Prefix only the operator knows). Without them the schema check fails. A VirtualIP is bound to an interface through the NetworkInterface’s virtual_ip: {virtualIPRef: <name>}; targetRef needs the interface UID, which is unknown at compile time. NetworkPolicy policyTypes, NATGateway portsPerNetworkInterface, Machine power and volume device are left to the API server, which derives policyTypes from ingress/egress, defaults the others and assigns od* device names. A default-deny policy without rules needs policy_types set explicitly.

Example

parameters:
  generators:
    ironcore:
      namespace: production
      networks:
        main-net: {}
      network_interfaces:
        web-01:
          network_ref: main-net
          ips:
            - 10.0.1.10
            - "2001:db8::10"
          labels:
            role: web
      volumes:
        web-01-root:
          volume_class_ref: fast
          resources:
            storage: 20Gi
          data_source:
            osImage: registry.example.com/os-images/ubuntu:24.04
      machines:
        web-01:
          machine_class_ref: x1-medium
          network_interfaces:
            - name: primary
              networkInterfaceRef: web-01
          volumes:
            - name: root
              volumeRef: web-01-root
          ignition_ref:
            name: web-01-ignition
            key: ignition.json
      load_balancers:
        web:
          type: Public
          ip_families:
            - IPv4
          network_ref: main-net
          network_interface_selector:
            matchLabels:
              role: web
          ports:
            - port: 443
              protocol: TCP
      nat_gateways:
        egress:
          ip_family: IPv4
          network_ref: main-net
      network_policies:
        web-ingress:
          network_ref: main-net
          network_interface_selector:
            matchLabels:
              role: web
          ingress:
            - ports:
                - port: 443
                  protocol: TCP

Schemas

IronCore serves these kinds through an aggregated API server, not CRDs. The schemas under schemas/ come from the generated OpenAPI v3 documents in gen/v3/ at IronCore v0.8.0 (Apache-2.0); see schemas/sources.yaml.