Instructions for AI coding agents. For project overview, see README.md. For contribution guidelines, see CONTRIBUTING.md.
| Directory | Purpose |
|---|---|
api/v1alpha1/ |
CRD types (IPPool, IPClaim, IPAddress) - separate Go module |
controllers/ |
Reconciliation logic |
ipam/ |
Core IP allocation algorithms |
internal/webhooks/ |
Validation/defaulting webhooks |
config/ |
Kustomize manifests (CRDs, RBAC, webhooks) - auto-generated by make generate, rarely edit directly |
hack/ |
CI scripts (prefer Make targets locally) |
CI is managed by Prow. Run these locally before submitting PRs:
Make targets:
| Command | Purpose |
|---|---|
make test |
Full verification (generate + lint + unit) |
make generate |
Regenerate code (DeepCopy, CRDs, RBAC, mocks) |
make unit |
Unit tests (requires envtest - do not use go test directly) |
make lint |
Go linting via golangci-lint (all modules) |
make verify-boilerplate |
Check license headers |
make modules |
Verify go.mod is tidy |
Hack scripts (auto-containerized, match CI exactly):
| Script | Purpose |
|---|---|
./hack/shellcheck.sh |
Shell script linting (shellcheck) |
./hack/markdownlint.sh |
Markdown linting (config: .markdownlint-cli2.yaml) |
./hack/manifestlint.sh |
Kubernetes manifest validation (kubeconform) |
GitHub Actions (reusable workflows from project-infra):
| Workflow | Purpose |
|---|---|
| yamllint | YAML linting (config: .yamllint.yaml) |
- Go: Linting rules in
.golangci.yaml, license headers inhack/boilerplate/ - Shell: Use
set -o errexit -o nounset -o pipefail - Markdown: 3-space indent for lists (
.markdownlint-cli2.yaml)
- Edit
api/v1alpha1/*_types.go - Run
make generate - Update webhooks in
internal/webhooks/if validation changes - Run
make test
When reviewing pull requests:
- Security - Hardcoded secrets, unpinned dependencies, missing input validation
- Test coverage - New functionality should have tests
- Consistency - Match existing patterns in the codebase
- Breaking changes - Flag API/behavior changes affecting users
Focus on: controllers/, ipam/, api/, internal/webhooks/.
- Run
make unitto verify baseline - Check patterns in similar existing files
- Make minimal, surgical edits
- Run
make generateafter API changes - Run
make testbefore committing - Add tests for new functionality
- Pin external dependencies by SHA (containers, GitHub Actions, binaries)
- No hardcoded credentials
- Validate all inputs
IPAM has no standalone e2e tests. E2E runs through CAPM3.