// STRYKE-K8S — KUBERNETES CLIENT FOR STRYKE // GET + APPLY + DELETE + SCALE + LOGS + WATCH + EXEC

Install

# from a release (no rustc on the consumer machine)
s pkg install -g github.com/MenkeTechnologies/stryke-k8s

# from a local checkout
cd ~/projects/stryke-k8s
cargo build --release            # produces target/release/libstryke_k8s.{dylib,so}
s pkg install -g .               # cdylib lands in ~/.stryke/store/k8s@<version>/

# one-liner
make install

The cdylib is dlopened in-process on first use K8s — no helper-binary fork per call. A shared tokio runtime + kube::Client cache keyed by kubeconfig context is held in OnceCell for the life of the process. Any stryke script that declares use K8s resolves the package automatically.

Quick start: use K8s

Connection is implicit — $KUBECONFIG, ~/.kube/config, or an in-cluster service account, in that resolution order, with no setup call. Every public fn accepts the same per-call connection overrides (see Per-call overrides).

use K8s

# Connection: $KUBECONFIG / ~/.kube/config / in-cluster SA — no setup.
p K8s::current_context()
p K8s::version()->{gitVersion}

# List — `kind` accepts short forms or strict GVK.
val @pods   = K8s::get "pods",  namespace => "default"
val @deploy = K8s::get "apps/v1/Deployment", namespace => "kube-system"

# Get one.
val $pod = K8s::get_one "pod", "echo-7d9f", namespace => "default"

# Server-side apply (full doc; idempotent).
K8s::apply {
    apiVersion => "v1",
    kind       => "ConfigMap",
    metadata   => { name => "cfg", namespace => "ci" },
    data       => { hello => "world" },
}

# Scale.
K8s::scale "deploy", "echo", 5, namespace => "ci"

# Logs (buffered).
val $text = K8s::logs "echo-7d9f", namespace => "ci", tail => 100

# Delete (cascading on Namespace).
K8s::delete_resource "namespace", "ci"

Per-call connection overrides

Every public fn takes the same connection options at the tail of its %opts. Pass a context for a single call without changing the ambient kubeconfig:

val %prod = (context => "prod-eks")
K8s::get "pods", namespace => "payments", %prod

GVK shortcuts

Anywhere a kind is accepted, the helper resolves the input against the cluster's discovery API. All of the following work for Pods:

pod        pods        po        v1/Pod        /v1/Pod

For namespaced typed kinds you can use the strict triple:

apps/v1/Deployment            batch/v1/Job
networking.k8s.io/v1/Ingress  rbac.authorization.k8s.io/v1/Role

Custom resources work the same way once installed:

example.com/v1/Widget

API reference

The package exposes 74 public K8s::* functions, backed by 70 k8s__* FFI symbols on the cdylib (the authoritative export list is [ffi].exports in stryke.toml). They split into cluster operations (which dispatch over FFI to kube) and pure helpers (which compute locally, no cluster contact). Streaming-only ops (watch, logs_follow, exec) are deferred — calling them dies with a message until the callback FFI ships.

Read paths

Events for one resource are reachable as K8s::get "events", field_selector => "involvedObject.name=$name".

Write paths

Rollouts + workload ops

Nodes + scheduling + eviction

Events + metrics + wait

Logs + exec

Connection + plumbing

Pure helpers (no cluster contact)

These compute locally. Validation and quantity math mirror apimachinery rules; selector and reference helpers come in parse/build inverse pairs.

parse_quantity resolves a resource quantity to its base-unit value: binary suffixes (Ki/Mi/Gi/Ti/Pi/Ei) are powers of 1024, decimal suffixes (n/u/m/k/M/G/T/P/E) powers of 1000 — so 100Mi → 104857600 bytes and 500m → 0.5 cores.

Selectors + quantity math (examples)

Pure helpers run with no cluster — safe to use anywhere, including CI without a kubeconfig:

# label-selector round trip
val @reqs = K8s::parse_selector("app=web,tier in (db,cache)")
val $sel  = K8s::build_selector(\@reqs)        # inverse

# does a label map satisfy the selector?
val $ok = K8s::selector_matches({ app => "web", tier => "db" }, "app=web")

# total container memory requests across units
val $r = K8s::sum_quantities("100Mi", "256Mi", "128Mi")
p $r->{quantity}                                # 484Mi

# headroom: allocatable - requested
val $free = K8s::sub_quantity("8Gi", "2Gi")
p $free->{quantity}                             # 6Gi

# utilization across units
p K8s::resource_ratio("512Mi", "1Gi")->{percent}   # 50

# readiness summary from a Pod object
val $st = K8s::pod_status($pod)
p "$st->{ready_containers}/$st->{total_containers}"

Deferred streaming ops

K8s::watch, K8s::logs_follow, and K8s::exec are deferred in the current cdylib — they die with a clear message until the callback FFI ships. Streaming-only ops need a callback FFI shape that the v1 FfiSig::StrToStr envelope does not model. Buffered logs (K8s::logs) work today.

Why a package, not a builtin

Built on the kube crate (kube-client + kube-runtime) with k8s-openapi typed APIs. Drop-in replacement for kubectl one-liners that pipe through jq / yq / awk.

The stryke side is a thin .stk wrapper that calls k8s__* FFI symbols on the cdylib; the heavy code lives in libstryke_k8s.{dylib,so}, dlopened in-process on first use K8s. Core stryke is never linked against this package's deps, so the daily-driver install stays slim.

FFI layer

Each K8s::* wrapper builds a JSON args dict and calls a sibling k8s__* symbol resolved out of libstryke_k8s.{dylib,so}. The cdylib is dlopened in-process on first use K8s (via stryke's pkg::commands::try_load_ffi_for resolver hook); a shared tokio RUNTIME + a kube::Client cache keyed by kubeconfig context is held in OnceCell — no fork-per-call, no fresh TLS+auth handshake each time. Responses are JSON; errors come back as {"error": "<msg>"} and the wrapper dies with the message.

The exports cover version/discovery, get/list (get / get_one / get_yaml / exists / nodes), write paths (create / replace / apply / delete / delete_collection / scale / get_scale / patch), rollouts (set_image / rollout_restart / rollout_status / rollout_history / autoscale / label / annotate), node scheduling (cordon / uncordon / taint / untaint / evict), events, metrics (top_pods / top_nodes), wait, snapshot logs, raw HTTP (raw / healthz), plus the cluster-free helper set. The authoritative list is [ffi].exports in stryke.toml — 70 symbols.

Persistent state: RUNTIME is one shared tokio multi-thread runtime driving every async call; CLIENTS is the kube::Client cache keyed by kubeconfig context, reusing the same client + underlying HTTP pool across calls rather than rebuilding the TLS+auth handshake each time.

Tests

cargo test                                   # compiles, no live cluster
KUBECONFIG=~/.kube/config s test t/          # live round-trip

Tests use a unique stryke-test-$$ namespace and tear it down at exit. A local test cluster works fine:

# kind
kind create cluster --name stryke

# or k3s in docker
docker run --rm --name k3s -p 6443:6443 \
    -v $PWD/k3s-data:/output rancher/k3s:latest \
    server --disable=traefik --tls-san=127.0.0.1

Dev workflow

make             # release build
make debug
make test
make install
make clean

Roadmap

Layout

stryke-k8s/
├── Cargo.toml             # cdylib crate manifest (crate-type = ["cdylib"], publish = false)
├── src/
│   └── lib.rs            # cdylib — k8s__* extern "C" exports
├── lib/                   # stryke .stk wrapper(s) — `use K8s`
├── stryke.toml            # stryke package manifest ([ffi] exports table)
├── t/                     # zunit-style tests
├── examples/              # runnable .stk examples
├── Makefile               # `make install` builds + installs
└── docs/                  # this site (GitHub Pages)

Sibling packages

Part of the stryke package family. Browse the others via the MenkeTechnologiesMeta umbrella repo:

• stryke-arrow — Apache Arrow / Parquet / Feather
• stryke-aws — S3, DynamoDB, SQS, Lambda, STS
• stryke-azure — Blob, Queues, Cosmos DB, Key Vault, Entra
• stryke-clickhouse — ClickHouse
• stryke-demo — live demos for every connector
• stryke-docker — Docker daemon API
• stryke-duckdb — embedded DuckDB SQL engine
• stryke-email — email + campaign client
• stryke-fleet — parallel expect/PTY automation
• stryke-gcp — Cloud Storage, Pub/Sub, Secret Manager, BigQuery, Firestore
• stryke-grpc — reflection-based gRPC client
• stryke-gui — mouse / keyboard / screen / clipboard automation
• stryke-kafka — Apache Kafka
• stryke-mcpd — MCP servers without a runtime
• stryke-mongo — MongoDB
• stryke-mssql — Microsoft SQL Server
• stryke-mysql — MySQL / MariaDB
• stryke-neo4j — Neo4j graph (Bolt)
• stryke-office — Office docs / PDF / images
• stryke-parquet — Parquet file inspector
• stryke-polars — Polars + ndarray + linalg + FFT
• stryke-postgres — PostgreSQL
• stryke-redis — Redis / Valkey
• stryke-scrape — web scraping / crawling
• stryke-scylla — ScyllaDB / Cassandra
• stryke-search — Elasticsearch / OpenSearch
• stryke-selenium — browser automation (WebDriver)
• stryke-spark — Spark Connect (no JVM)
• stryke-utils — pure-stryke utility belt
• stryke-zmq — ZeroMQ messaging