Cargo.toml

[package]
name = "stellar-k8s"
version = "0.1.0"
edition = "2021"
authors = ["Stellar K8s Contributors"]
description = "Cloud-Native Kubernetes Operator for Stellar Infrastructure"
license = "Apache-2.0"
repository = "https://github.com/OtowoOrg/Stellar-K8s"

[dependencies]
ed25519-dalek = { version = "2", features = ["rand_core"] }
lru = "0.16"
printpdf = "0.7"
toml = "0.5"
# Glob pattern matching for label propagation filters
glob = "0.3"

# Directory tree walking (used by build.rs and doc-check)
walkdir = "2"

# Kubernetes client and operator framework
kube = { version = "0.94", features = [
    "runtime",
    "derive",
    "unstable-runtime",
    "admission",
    "client",
    "ws",
] }
kube-runtime = { version = "0.94", features = ["unstable-runtime"] }
k8s-openapi = { version = "0.22", default-features = false, features = [
    "v1_30",
] }

# Async runtime
tokio = { version = "1", features = ["full"] }
tokio-util = { version = "0.7", features = ["io"] }
futures = "0.3"

# Serialization
serde = { version = "1", features = ["derive"] }
serde_json = "1"
serde_yaml = "0.9"

# JWT support
jsonwebtoken = "9"

# Regex for routing
regex = "1"

# HTTP types
http = "1"

# Schema generation for CRDs
schemars = { version = "0.8", features = ["chrono"] }

# Error handling
thiserror = "1"
anyhow = "1.0.103" # Pinned to Cargo.lock; 1.0.108 was unpublished
# CLI argument parsing
clap = { version = "4.5", features = ["derive", "env"] }
clap_complete = "4.6"

# Date/time handling
chrono = { version = "0.4", features = ["serde"] }
# Pinned to latest patch for security fixes; used transitively by many HTTP/async crates.
bytes = "1.11.1"
# Zip compression for incident reports
zip = "2"

# Hostname for leader election
hostname = "0.4"

# Logging and tracing
tracing = "0.1"
tracing-subscriber = { version = "0.3", features = [
    "env-filter",
    "json",
    "registry",
] }
tracing-opentelemetry = "0.22"

# OpenTelemetry for distributed tracing
opentelemetry = "0.21"
opentelemetry_sdk = { version = "0.21", features = ["rt-tokio", "trace"] }
opentelemetry-otlp = { version = "0.14", features = [
    "grpc-tonic",
    "http-proto",
] }

# HTTP client for health checks
reqwest = { version = "0.12", features = [
    "json",
    "rustls-tls-manual-roots",
    "native-tls",
    "multipart",
] }
rdkafka = { version = "0.36", optional = true, features = [
    "cmake-build",
    "ssl",
    "sasl",
] }
async-nats = { version = "0.35", optional = true }
# Vendored libsasl2; required only when the kafka feature is enabled.
sasl2-sys = { version = "0.1.22", features = ["vendored"], optional = true }

# REST API (optional)
axum = { version = "0.7.5", optional = true, features = ["ws"] }
tower = { version = "0.4", optional = true }
tower-http = { version = "0.5", features = ["trace"], optional = true }

# Metrics
prometheus-client = { version = "0.22", optional = true }
once_cell = { version = "1", optional = true }

# TLS and certificate generation
rustls = { version = "0.23", default-features = false, features = ["ring", "std", "tls12"] }
rcgen = { version = "0.13", features = ["pem", "x509-parser"] }
axum-server = { version = "0.7.0", features = ["tls-rustls"] }
rustls-pki-types = "1.14.1"
x509-parser = "0.16"

# Wasm runtime for custom validation plugins
wasmtime = { version = "24.0.11", optional = true }
wasmtime-wasi = { version = "24.0.11", features = ["preview1"], optional = true }

# Additional crypto for webhook TLS
tokio-rustls = { version = "0.26", optional = true }

# Base64 for Wasm plugin loading
base64 = "0.21"

# HMAC-SHA256 for webhook payload signing
hmac = "0.12"

# SHA256 for plugin integrity verification
sha2 = "0.10"
hex = "0.4"
rand = { version = "0.8", features = ["small_rng"] }

# Backup scheduler dependencies
cron = "0.15"
tar = "0.4"
flate2 = "1"
async-trait = "0.1"
sqlx = { version = "0.8.6", default-features = false, features = [
    "runtime-tokio",
    "postgres",
    "chrono",
] }
comfy-table = "7.2.2"
csv = "1.4.0"
url = "2.5"
urlencoding = "2.1"
aws-sdk-s3 = "1.132.0"
aws-config = "1.8.17"
json-patch = "4.2.0"
md5 = "0.8.0"

[build-dependencies]
chrono = "0.4"
serde_json = "1"
walkdir = "2"
serde = { version = "1", features = ["derive"] }

[features]
default = ["rest-api", "metrics", "admission-webhook", "k8s-v1-30"]
rest-api = ["dep:axum", "dep:tower", "dep:tower-http"]
metrics = ["prometheus-client", "once_cell"]
kafka = ["dep:rdkafka", "dep:sasl2-sys"]
nats = ["dep:async-nats"]
admission-webhook = [
    "wasmtime",
    "wasmtime-wasi",
    "tokio-rustls",
    "dep:axum",
    "dep:tower",
    "dep:tower-http",
]
# Expose reconciler for state-machine fuzzing (reconcile_no_panic, event sequences)
reconciler-fuzz = []

# Kubernetes API version selection (exactly one must be enabled)
k8s-v1-30 = ["k8s-openapi/v1_30"]

[dev-dependencies]
tokio-test = "0.4"
tempfile = "3"
wiremock = "=0.6.5"
proptest = "1.5"
wat = "1.251"
# CLI smoke test dependencies
assert_cmd = "2"
predicates = "3"
# Ensure dev builds that pull k8s-openapi 0.22 have an explicit API version feature.
k8s-openapi = { version = "0.22", default-features = false, features = [
    "v1_30",
] }

[[bin]]
name = "stellar-scaffold"
path = "src/bin/stellar-scaffold.rs"

[[bin]]
name = "stellar-operator"
path = "src/main.rs"

[[bin]]
name = "doc-check"
path = "src/bin/doc_check.rs"

[[bin]]
name = "check-unreachable-modules"
path = "src/bin/check_unreachable_modules.rs"

[[bin]]
name = "check-pipeline-log-redaction"
path = "src/bin/check_pipeline_log_redaction.rs"

[[bin]]
name = "stellar-sidecar"
path = "src/sidecar.rs"

[[bin]]
name = "kubectl-stellar"
path = "src/kubectl_plugin.rs"

[[bin]]
name = "stellar-completions"
path = "src/bin/completions.rs"

# Cross-platform developer bootstrap verifier — pure Rust so it also runs on
# plain Windows (no WSL/Git Bash needed), unlike scripts/preflight.sh.
[[bin]]
name = "stellar-bootstrap-verify"
path = "src/bin/stellar-bootstrap-verify.rs"

# Byzantine Monitoring Watcher — deployed as a sidecar in multiple cloud regions
# to detect local vs. global consensus issues (Byzantine partition detection).
[[bin]]
name = "stellar-watcher"
path = "src/bin/stellar-watcher.rs"
required-features = ["rest-api", "metrics"]

# Fork Detection Sidecar — compares local ledger hash against public anchors
# to detect potential network forks early.
[[bin]]
name = "stellar-fork-detector"
path = "src/bin/stellar-fork-detector.rs"
required-features = ["rest-api", "metrics"]

# Health Check Sidecar — provides advanced liveness/readiness probes
# that query Stellar Core API instead of just checking process status
[[bin]]
name = "stellar-health-sidecar"
path = "src/bin/stellar-health-sidecar.rs"
required-features = ["rest-api"]

[workspace]

# Security-hardened release profile
[profile.release]
# Remove debug symbols to reduce binary size and attack surface
strip = true
# Don't unwind on panic - abort immediately for security
panic = "abort"  
# Single codegen unit for better optimization
codegen-units = 1
# Enable link-time optimization for better security and performance
lto = true
# Optimize for performance while maintaining security
opt-level = 3

# Security-hardened profile for production deployments
[profile.production]
inherits = "release" 
# Maximum optimization for production
opt-level = 3
# Aggressive dead code elimination
lto = "fat"
# Abort on panic in production
panic = "abort"
# Strip all symbols
strip = "symbols"
# Single codegen unit for maximum optimization
codegen-units = 1