Module scout 

Bindy Scout — Ingress-to-ARecord controller.

Scout watches Kubernetes Ingresses across all namespaces (except its own and any configured exclusions). When an Ingress is annotated with bindy.firestoned.io/recordKind: "ARecord", Scout creates an ARecord CR in the configured target namespace.

See docs/roadmaps/bindy-scout-ingress-controller.md for the full design.

Phase 1 / 1.5 — Same-cluster mode (current)

Scout uses a single in-cluster client. ARecords are created in the same cluster.

Phase 2 — Remote cluster mode

When BINDY_SCOUT_REMOTE_SECRET is set, Scout reads a kubeconfig from a Kubernetes Secret and builds a second client (remote_client) targeting the dedicated Bindy cluster. The local client still handles Ingress watching and finalizer management. The remote client handles ARecord creation/deletion and DNSZone validation.

Structs

ARecordParams

Parameters for building an ARecord CR.

Gateway

Minimal Gateway definition for Scout’s chain-following.

GatewaySpec

Minimal Gateway spec — only gatewayClassName, used to match the running class.

GatewayStatus

Minimal Gateway status — only the assigned addresses.

GatewayStatusAddress

A single entry in Gateway.status.addresses.

HTTPRoute

Minimal HTTPRoute definition for Scout’s use case.

HTTPRouteARecordParams

Parameters for building an ARecord CR from an HTTPRoute.

HTTPRouteSpec

Minimal HTTPRoute spec for Scout’s use case.

NamespacedName

A namespaced object reference (namespace + name).

ParentReference

A minimal Gateway API parentRef — the reference from a route back to the Gateway (or other parent) that serves it.

ScoutContext

Shared context passed to every reconciler invocation.

ScoutError

Reconcile error type — wraps anyhow::Error so that it satisfies the std::error::Error bound required by kube::runtime::Controller::run.

ServiceARecordParams

Parameters for building a Service-sourced ARecord CR.

TCPRoute

Minimal TCPRoute definition for Scout’s use case.

TCPRouteARecordParams

Parameters for building an ARecord CR from a TCPRoute.

TCPRouteSpec

Minimal TCPRoute spec for Scout’s use case.

TLSRoute

Minimal TLSRoute definition for Scout’s use case.

TLSRouteARecordParams

Parameters for building an ARecord CR from a TLSRoute.

TLSRouteSpec

Minimal TLSRoute spec for Scout’s use case.

Enums

GatewayServiceTarget

How Scout locates the LoadBalancer Service backing a gateway class.

Constants

ANNOTATION_IP

Annotation for explicitly overriding the IP(s) used in the ARecord.

ANNOTATION_RECORD_KIND

Annotation specifying the DNS record kind Scout should create for this Ingress. Set to "ARecord" to create an A record. Any other value (or absent) is ignored.

ANNOTATION_RECORD_NAME

Annotation for overriding the DNS record name (spec.name) on the created ARecord.

ANNOTATION_SCOUT_ENABLED

Simplified opt-in annotation — set to "true" to enable Scout for this Ingress. Takes precedence over (and is preferred to) ANNOTATION_RECORD_KIND for new users. Both annotations are accepted for backward compatibility.

ANNOTATION_TTL

Annotation for overriding the TTL (in seconds) on the created ARecord. When absent, the ARecord inherits the TTL from the DNSZone spec.

ANNOTATION_ZONE

Annotation specifying which DNS zone owns this Ingress host

DEFAULT_SCOUT_NAMESPACE

Default namespace where ARecords are created when BINDY_SCOUT_NAMESPACE is not set

FINALIZER_SCOUT

Finalizer added to Ingresses managed by Scout to ensure cleanup on deletion

GATEWAY_API_GROUP

Gateway API group used for parentRefs and Gateway lookups.

GATEWAY_KIND

Gateway API kind for a Gateway parent reference.

LABEL_MANAGED_BY

Label placed on created ARecords identifying Scout as the manager

LABEL_MANAGED_BY_SCOUT

Label value for ARecords created by Scout

LABEL_SOURCE_CLUSTER

Label identifying the source cluster on created ARecords

LABEL_SOURCE_NAME

Label identifying the source resource name on created ARecords. Used for all resource kinds (Ingress, Service, HTTPRoute, TLSRoute).

LABEL_SOURCE_NAMESPACE

Label identifying the source namespace on created ARecords

LABEL_ZONE

Label carrying the DNS zone name on created ARecords (for DNSZone selector matching)

RECORD_KIND_ARECORD

Expected value of ANNOTATION_RECORD_KIND for A record creation.

Functions

arecord_cr_name

Builds a sanitized Kubernetes resource name for an ARecord CR.

arecord_label_selector

Builds a Kubernetes label selector string matching all ARecords created by Scout for a specific Ingress.

build_arecord

Builds the ARecord CR that Scout will create on the target cluster.

build_httproute_arecord

Builds the ARecord CR that Scout will create for an HTTPRoute.

build_service_arecord

Builds the ARecord CR that Scout will create for a LoadBalancer Service.

build_tcproute_arecord

Builds the ARecord CR that Scout will create for a TCPRoute.

build_tlsroute_arecord

Builds the ARecord CR that Scout will create for a TLSRoute.

derive_record_name

Derives the DNS record name from a hostname and zone.

gateway_addresses_as_ips

Extracts the IP-typed addresses from a Gateway’s status.addresses.

gateway_parent_refs

Resolves a route’s parentRefs to the Gateways they point at.

gateway_service_target_from_str

Parses a single gatewayClass target: either namespace/name (explicit Service) or namespace/<label-selector> (any entry whose Service part contains =, since Service names never do).

get_record_name_annotation

Returns the explicit DNS record name override from bindy.firestoned.io/record-name.

get_zone_annotation

Returns the DNS zone specified by the bindy.firestoned.io/zone annotation.

has_finalizer

Returns true if the Scout finalizer is present on the Ingress.

httproute_arecord_cr_name

Derives the ARecord CR name for an HTTPRoute.

httproute_arecord_label_selector

Builds a Kubernetes label selector matching all ARecords created by Scout for a specific HTTPRoute.

is_arecord_enabled

Returns true if the Ingress is annotated for ARecord creation.

is_being_deleted

Returns true if the Ingress has been marked for deletion.

is_loadbalancer_service

Returns true if the Service is of type LoadBalancer.

is_scout_opted_in

Returns true if Scout should manage this Ingress.

parse_gateway_service_entry

Parses a single class=<target> mapping entry.

parse_gateway_services

Parses the operator’s gatewayClass → LoadBalancer Service map from a single comma-separated string (the BINDY_SCOUT_GATEWAY_SERVICES env form).

resolve_ip_from_lb_status

Resolves the IP to use for an ARecord from the Ingress load-balancer status.

resolve_ip_from_service_lb_status

Extracts the first non-empty IP from the Service’s LoadBalancer status.

resolve_ips

Resolves the IP address(es) to use for an ARecord, in priority order:

resolve_ips_from_annotation

Returns the explicit IP overrides from the bindy.firestoned.io/ip annotation.

resolve_ips_from_gateways

Follows a route’s parentRefs back to the serving Gateway(s) and resolves their external IP(s).

resolve_record_name

Resolves the DNS record name for an ARecord, in priority order:

resolve_zone

Resolves the DNS zone for an Ingress, in priority order:

run_scout

Entry point for the bindy scout subcommand.

service_arecord_cr_name

Derives the ARecord CR name for a Service.

service_arecord_label_selector

Builds a Kubernetes label selector matching all ARecords created by Scout for a specific Service.

service_ref_from_str

Parses a namespace/name string into a NamespacedName.

stale_arecord_label_selector

Builds a label selector string matching ARecords for the given Ingress that belong to any cluster other than current_cluster.

stale_httproute_arecord_label_selector

Builds a label selector string matching ARecords for the given HTTPRoute that belong to any cluster other than current_cluster.

stale_tcproute_arecord_label_selector

Builds a label selector string matching ARecords for the given TCPRoute that belong to any cluster other than current_cluster.

stale_tlsroute_arecord_label_selector

Builds a label selector string matching ARecords for the given TLSRoute that belong to any cluster other than current_cluster.

tcproute_arecord_cr_name

Derives the ARecord CR name for a TCPRoute.

tcproute_arecord_label_selector

Builds a Kubernetes label selector matching all ARecords created by Scout for a specific TCPRoute.

tlsroute_arecord_cr_name

Derives the ARecord CR name for a TLSRoute.

tlsroute_arecord_label_selector

Builds a Kubernetes label selector matching all ARecords created by Scout for a specific TLSRoute.

zone_allows_source_namespace

Whether a DNSZone authorizes DNS records sourced from source_namespace.