// STRYKE-K8S — ENGINEERING REPORT

>_EXECUTIVE SUMMARY

stryke-k8s is one of the opt-in connector packages in the stryke ecosystem. Kubernetes client for stryke. Get / apply / delete / scale / logs / watch / exec against any kubeconfig-reachable cluster (kind, k3s, minikube, EKS, GKE, AKS, OpenShift, vanilla). Opt-in package, kept out of the stryke core binary so the daily-driver install stays slim; ships as a Rust cdylib that stryke dlopens in-process on first use K8s.

Built on the kube crate (kube-client + kube-runtime). Drop-in replacement for kubectl one-liners that pipe through jq / yq / awk.

The surface splits into cluster operations (dispatched over FFI to the kube client) and pure helpers (selector/quantity/reference math computed locally, no cluster contact). Streaming-only ops (watch, logs_follow, exec) are deferred — the surface is defined but the wrappers die until the callback FFI ships.

~ARCHITECTURE

In-process cdylib design: the stryke side is a thin .stk wrapper that calls FFI symbols on the dlopen'd library. No subprocess, no pipe — calls return on the same thread that made them.

+DEPENDENCIES

The cdylib links the Kubernetes client stack; core stryke links none of it. Versions are pinned in Cargo.toml.

Release profile: opt-level = 3, lto = "thin", codegen-units = 1, strip = true, panic = "abort".

@PERSISTENT STATE

The v1 helper rebuilt the client (full TLS+auth handshake) on every fork. The cdylib holds two process-lifetime caches instead:

Both are held in OnceCell for the life of the process. The first use K8s dlopens the library; subsequent calls hit the warm caches.

$WHY OPT-IN (NOT BUILTIN)

Built on the kube crate (kube-client + kube-runtime). Drop-in replacement for kubectl one-liners that pipe through jq / yq / awk.

The trade-off is intentional. The core stryke binary stays under ~40 MB precisely because each connector ships separately. Daily-driver work (one-liners, awk replacement, data scripting) doesn't need MongoDB drivers, AWS SDKs, or Spark Connect bindings linked in.

&FFI ENVELOPE

JSON in / JSON out across the FFI boundary. Each K8s::* wrapper serializes its args to a JSON dict and calls the matching k8s__* symbol on the dlopen'd cdylib; the cdylib returns a JSON CString the wrapper parses. catch_unwind on every call converts panics to JSON errors. The returned CString is freed via the cdylib-exported stryke_free_cstring, wired automatically by rust_ffi::load_cdylib.

# request shape (built by the .stk wrapper)
{"verb": "<op>", "...": ...}

# response shape
{"result": ...}            # success — per-fn shape
{"error": "<msg>"}        # failure — wrapper die()s with the message

/SCOPE

74 public K8s::* functions. The package is intentionally narrower than the full Kubernetes API — the goal is "useful from a shell pipeline", not "complete API coverage". The surface groups into:

Full signatures live in the Docs API reference. The README's project page carries the same authoritative scope.

!DEFERRED OPS

Streaming-only operations — watch, logs_follow, and exec — are defined on the surface but die with a clear message. They need a callback FFI shape that the current FfiSig::StrToStr JSON-in/JSON-out envelope does not model: each emits an unbounded sequence of events rather than a single response. Buffered logs (K8s::logs) ship today. The callback FFI is the gate; once it lands, these light up without surface changes.

#PROJECT METADATA