rate-limit

Overview

rate-limit is a custom resource managed by the network-suite operator running on Inrun. Resources of this type are namespace-scoped.

Field	Value
API Version	net.demo.inrun.dev/v1alpha1
Kind	RateLimit
GVR (plural)	net.demo.inrun.dev/v1alpha1, Resource=ratelimits
Scope	Namespaced
Cross-read access	✓ allowed — sibling operators may read this CRD's CR state via cross:

---

Reconcile Mode

This CRD runs in dynamic mode: Inrun works with the unstructured object, and no Go types are compiled in.

It is reconciled declaratively: the Blueprint's onCreate and onReconcile templates, with expressions like {{ .spec.field }}, become the CR's children and status.

Whatever the reconciler, the runtime owns the lifecycle: Inrun's finalizer, managed labels, applying and pruning children, events, metrics, health, and holding a deleted CR until its finalizing reconcile is done.

---

Configuration

The operator maintains 3 worker goroutines to process reconcile events concurrently. Each worker dequeues one CR key at a time, reconciles it, and returns. The queue has a maximum depth of 500 events.

Inrun resyncs all managed resources every 15s by re-enqueueing every CR key. This ensures drift caused by external changes is corrected even without a Kubernetes watch event.

---

Child Resources

When the operator reconciles a rate-limit instance it creates and manages the following Kubernetes resources on its behalf. These are owned by the CR via owner references and are deleted automatically when the CR is deleted (unless deletion protection is active).

Resources listed under onCreate are created on the first reconcile. Resources listed under onReconcile are re-applied on every reconcile cycle. A resource appearing in both phases is created once and kept in sync thereafter.

Kind	Count	Lifecycle phases
ConfigMap	1	onCreate
Secret	1	onCreate

To see the actual child resources created for a running instance, navigate to the instance's detail page from the network-suite control panel.

---

operatorBox

Summary of the reconciler configuration declared in the Blueprint for this CRD.

Feature	Configured	Detail
Hooks	—	No reconcile hooks
Constructor	—	None
Finalizers	1	inrun.dev/cleanup

---

kubectl Reference

Use the commands below to interact with rate-limit resources from the command line.

List resources

kubectl get ratelimit -n <namespace>

Describe a resource

kubectl describe ratelimit <name> -n <namespace>

Get YAML

kubectl get ratelimit <name> -n <namespace> -o yaml

Watch for changes

kubectl get ratelimit -n <namespace> -w

Delete a resource

kubectl delete ratelimit <name> -n <namespace>

Filter by Inrun managed label

kubectl get ratelimit -l inrun.dev/managed=true -n <namespace>

---

Access Control

The operator holds the following RBAC permissions to manage rate-limit resources. 1 configmaps, 1 ratelimits, 1 ratelimits/status, 1 secrets

API Groups	Resources	Verbs
net.demo.inrun.dev	ratelimits	get list watch create update patch delete
net.demo.inrun.dev	ratelimits/status	get update patch
core	configmaps	get list watch create update patch delete
core	secrets	get list watch create update patch delete

---

Endpoints

Inrun exposes per-CRD HTTP endpoints for health reporting and runtime introspection. Endpoints can be selectively disabled in the Blueprint via endpoints:.

Endpoint	Path	Status
Health	/blueprint/rate-limit/health	✓ enabled
Info	/blueprint/rate-limit	✓ enabled
CR List	/blueprint/rate-limit/cr	✓ enabled

---