Facts and templates

Keel renders every parameter value and service name using Go text/template. The root object has .Node and .Cluster fields. Parameter keys, selectors, intervals and the handler type are not templated. Rendering produces plain text; Keel does not escape it for YAML, shell, JSON or the target file format.

Node facts

Fields	Source and meaning
`.Node.Name`	Kubernetes Node name
`.Node.Hostname`	Node Hostname address, falling back to host `/proc/sys/kernel/hostname`
`.Node.InternalIP`, `.Node.ExternalIP`	Node addresses; empty when unavailable
`.Node.AllAddresses`	Slice of all Node address values
`.Node.OS`, `.Node.OSVersion`, `.Node.OSName`	Host `/etc/os-release` `ID`, `VERSION_ID`, `NAME`
`.Node.Kernel`	Host `/proc/sys/kernel/osrelease`
`.Node.Arch`	Node-reported architecture
`.Node.MachineID`, `.Node.BootID`, `.Node.SystemUUID`	Node status identifiers
`.Node.ProviderID`	Node spec provider identifier
`.Node.ContainerRuntime`, `.Node.KubeletVersion`	Versions from Node status
`.Node.Labels`	Map of current Node labels
`.Node.Conditions`	Map with lowercase condition names, e.g. `ready`, and string values such as `True`
`.Node.Capacity`, `.Node.Allocatable`	Maps of resource names to quantity strings, e.g. `cpu`, `memory`

Multiple addresses of the same InternalIP or ExternalIP type overwrite the scalar field in encounter order. Use AllAddresses when the complete list matters.

Cluster facts

Field	Meaning
`.Cluster.Name`	Optional `keel.tlspu.io/cluster-name` annotation on `kube-system`
`.Cluster.UID`	UID of the `kube-system` namespace
`.Cluster.KubernetesVersion`	API server GitVersion from discovery
`.Cluster.Platform`	Server platform from discovery
`.Cluster.ServerURL`	API URL used by the agent

An administrator can set a friendly name:

kubectl annotate namespace kube-system keel.tlspu.io/cluster-name=lab --overwrite

Node facts refresh on startup, local Node events and --facts-interval (default 5m). Cluster facts are cached after the first successful cluster collection; changing the cluster-name annotation requires restarting agents to recollect it. API version discovery failure can leave version and platform empty in that cache. Missing host fact files likewise produce empty fields.

The controller waits for initial facts before running configurations. Afterward it reads the latest cached snapshot. Readiness means initial collection succeeded; it does not prove the snapshot is still fresh. A fact refresh alone does not bypass a NodeConfig's successful-run interval. ConfigMap trigger contents are not available as facts. Keel has no Secret lookup template function.

Helpers

The standard Go template built-ins (index, printf, if, with, range, and others) are available, together with these Keel helpers. Argument order is significant; pipelines supply their value as the final argument.

Helper	Example	Result
`lower`	`{{ lower "NODE-A" }}`	`node-a`
`upper`	`{{ upper "lab" }}`	`LAB`
`trim`	`{{ trim " lab " }}`	`lab`
`quote`	`{{ quote "lab" }}`	`"lab"` (Go string quoting)
`contains`	`{{ contains "node-a" "node" }}`	`true`
`replace`	`{{ replace "node-a" "-" "_" }}`	`node_a`
`join`	`{{ join .Node.AllAddresses "," }}`	Comma-separated addresses
`default`	`{{ default "unnamed" .Cluster.Name }}`	`unnamed` if the value is an empty string

default takes two strings. It cannot rescue an invalid struct field or a direct missing map key, because argument evaluation fails first. Keel uses missingkey=error; misspelled fields and direct missing keys fail the run. Existing string fields can be empty without causing a template error.

Examples

Use index for keys containing dots, slashes or hyphens. With a string-valued map, index returns an empty string for a missing key, permitting a fallback:

Node: {{ .Node.Hostname | lower }}
Cluster: {{ default "unnamed" .Cluster.Name }}
Zone: {{ default "unknown" (index .Node.Labels "topology.kubernetes.io/zone") }}
Ready: {{ index .Node.Conditions "ready" }}
CPU: {{ index .Node.Allocatable "cpu" }}
Addresses: {{ join .Node.AllAddresses "," }}

To preserve a template expression for a downstream application, emit the literal braces from a Go template string, for example {{ "{{ application_value }}" }}. Keel interprets any unescaped {{ ... }} in managed content itself.

The optional admission webhook validates syntax without node facts; valid syntax can still fail on a particular node. Use the local CLI with an explicit --facts-file and a temporary file root to exercise rendering, then verify the full configuration on a canary node. Local CLI snapshots replace, rather than merge with, locally collected facts.