Skip to content

Commit 7a1e06c

Browse files
colinjlacycolinjlacy
committed
adds network policies and s3 promise
1 parent df8e327 commit 7a1e06c

35 files changed

Lines changed: 1849 additions & 58 deletions

‎.github/workflows/publish-ghcr-images.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,11 @@ on:
77
paths:
88
- ".github/workflows/publish-ghcr-images.yml"
99
- "platform/kratix/promises/redis/pipeline/**"
10+
- "platform/kratix/promises/cilium-api-access/pipeline/**"
11+
- "platform/kratix/promises/cilium-namespace-lockdown/pipeline/**"
12+
- "platform/kratix/promises/s3-bucket/pipeline/**"
1013
- "platform/kratix/promises/runtime-workload/pipeline/**"
14+
- "demo/aws-sdk-go-v2/**"
1115
- "platform/demo/provider/todos-api/**"
1216
- "go/apps/request-logger-http/**"
1317
- "go/runtimeconditions/**"
@@ -30,14 +34,23 @@ jobs:
3034
- name: redis-pipeline
3135
context: platform/kratix/promises/redis/pipeline
3236
file: platform/kratix/promises/redis/pipeline/Dockerfile
37+
- name: cilium-api-access-pipeline
38+
context: platform/kratix/promises/cilium-api-access/pipeline
39+
file: platform/kratix/promises/cilium-api-access/pipeline/Dockerfile
40+
- name: cilium-namespace-lockdown-pipeline
41+
context: platform/kratix/promises/cilium-namespace-lockdown/pipeline
42+
file: platform/kratix/promises/cilium-namespace-lockdown/pipeline/Dockerfile
43+
- name: s3-bucket-pipeline
44+
context: platform/kratix/promises/s3-bucket/pipeline
45+
file: platform/kratix/promises/s3-bucket/pipeline/Dockerfile
3346
- name: runtime-workload-pipeline
3447
context: platform/kratix/promises/runtime-workload/pipeline
3548
file: platform/kratix/promises/runtime-workload/pipeline/Dockerfile
3649
- name: todos-api
3750
context: platform/demo/provider/todos-api
3851
file: platform/demo/provider/todos-api/Dockerfile
3952
- name: request-logger
40-
context: go
53+
context: .
4154
file: go/apps/request-logger-http/Dockerfile
4255

4356
steps:

‎demo/aws-sdk-go-v2/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,4 +7,6 @@ The important Runtime Conditions convention is inside `service/s3`:
77
- `runtimeconditions.package.yaml` maps SDK symbols to Runtime Conditions.
88
- `aws-object-store-v1alpha1.yaml` is the extension definition owned by this SDK package.
99

10+
The manifest also declares the environment variable names the SDK needs for bucket, region, and credential inputs. It does not include those values.
11+
1012
The demo application imports `service/s3` and calls `Client.PutObject` normally. The generator resolves the direct import through `go.mod`, reads the package manifest, loads the embedded extension definition, and emits an `aws.object_store` Condition without any explicit no-op declaration in the application source.

‎demo/aws-sdk-go-v2/service/s3/aws-object-store-v1alpha1.yaml‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ metadata:
88
spec:
99
dependencies:
1010
- https://runtimeconditions.io/extensions/common-integrations:v1alpha1
11+
- https://runtimeconditions.io/extensions/env-configuration:v1alpha1
1112

1213
kinds:
1314
- name: aws.object_store
@@ -28,6 +29,24 @@ spec:
2829
values:
2930
- standard
3031
- archive
32+
- field: configuration.env[].property
33+
targetKind: aws.object_store
34+
targetType: aws.s3
35+
values:
36+
- bucket
37+
- region
38+
- accessKeyId
39+
- secretAccessKey
40+
- sessionToken
41+
- field: configuration.alternatives[].env[].property
42+
targetKind: aws.object_store
43+
targetType: aws.s3
44+
values:
45+
- bucket
46+
- region
47+
- accessKeyId
48+
- secretAccessKey
49+
- sessionToken
3150

3251
schemas:
3352
- id: aws-s3-interface
@@ -56,3 +75,44 @@ spec:
5675
- archive
5776
additionalProperties: true
5877
additionalProperties: true
78+
79+
- id: aws-s3-configuration-properties
80+
appliesToKind: aws.object_store
81+
appliesToInterfaceType: aws.s3
82+
description: Validates allowed environment configuration properties for AWS S3 integrations.
83+
schema:
84+
$schema: https://json-schema.org/draft/2020-12/schema
85+
type: object
86+
properties:
87+
configuration:
88+
$ref: '#/$defs/configuration'
89+
additionalProperties: true
90+
$defs:
91+
allowedProperty:
92+
enum:
93+
- bucket
94+
- region
95+
- accessKeyId
96+
- secretAccessKey
97+
- sessionToken
98+
configuration:
99+
type: object
100+
properties:
101+
env:
102+
type: array
103+
items:
104+
$ref: '#/$defs/envInput'
105+
alternatives:
106+
type: array
107+
items:
108+
type: object
109+
properties:
110+
env:
111+
type: array
112+
items:
113+
$ref: '#/$defs/envInput'
114+
envInput:
115+
type: object
116+
properties:
117+
property:
118+
$ref: '#/$defs/allowedProperty'

‎demo/aws-sdk-go-v2/service/s3/client.go‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,9 @@ package s3
55

66
import (
77
"context"
8+
"errors"
89
"io"
10+
"os"
911
)
1012

1113
// Config represents SDK configuration.
@@ -34,5 +36,13 @@ type PutObjectOutput struct{}
3436

3537
// PutObject stores an object in an S3 bucket.
3638
func (c *Client) PutObject(ctx context.Context, input *PutObjectInput, optFns ...func(*Options)) (*PutObjectOutput, error) {
39+
if input == nil || input.Bucket == nil || *input.Bucket == "" {
40+
return nil, errors.New("s3 bucket is required")
41+
}
42+
for _, key := range []string{"AWS_REGION", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"} {
43+
if os.Getenv(key) == "" {
44+
return nil, errors.New(key + " is not set")
45+
}
46+
}
3747
return &PutObjectOutput{}, nil
3848
}

‎demo/aws-sdk-go-v2/service/s3/runtimeconditions.package.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,15 @@ go:
2626
values:
2727
- target: interface.bucketClass
2828
value: standard
29+
configuration:
30+
env:
31+
- property: bucket
32+
name: AUDIT_LOG_BUCKET
33+
- property: region
34+
name: AWS_REGION
35+
- property: accessKeyId
36+
name: AWS_ACCESS_KEY_ID
37+
sensitive: true
38+
- property: secretAccessKey
39+
name: AWS_SECRET_ACCESS_KEY
40+
sensitive: true

‎docs/guides/generator-discovery-workflow.md‎

Lines changed: 62 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,9 +63,13 @@ The workload calls the SDK normally:
6363

6464
```go
6565
func writeAuditLog(ctx context.Context, event string) error {
66+
bucket := os.Getenv("AUDIT_LOG_BUCKET")
67+
if bucket == "" {
68+
return errors.New("AUDIT_LOG_BUCKET is not set")
69+
}
6670
client := s3.NewFromConfig(s3.Config{})
6771
_, err := client.PutObject(ctx, &s3.PutObjectInput{
68-
Bucket: stringPtr(envOrDefault("AUDIT_LOG_BUCKET", "demo-audit-log")),
72+
Bucket: stringPtr(bucket),
6973
Key: stringPtr("request-logger/demo.json"),
7074
Body: strings.NewReader(event),
7175
})
@@ -87,6 +91,18 @@ The package manifest maps `Client.PutObject` to:
8791
```yaml
8892
kind: aws.object_store
8993
interfaceType: aws.s3
94+
configuration:
95+
env:
96+
- property: bucket
97+
name: AUDIT_LOG_BUCKET
98+
- property: region
99+
name: AWS_REGION
100+
- property: accessKeyId
101+
name: AWS_ACCESS_KEY_ID
102+
sensitive: true
103+
- property: secretAccessKey
104+
name: AWS_SECRET_ACCESS_KEY
105+
sensitive: true
90106
```
91107
92108
Running the generator:
@@ -106,26 +122,70 @@ produces a profile that includes both explicit declarations and SDK-discovered C
106122
extensions:
107123
- https://aws.example.com/runtimeconditions/object-store:v1alpha1
108124
- https://runtimeconditions.io/extensions/common-integrations:v1alpha1
125+
- https://runtimeconditions.io/extensions/env-configuration:v1alpha1
109126

110127
conditions:
111128
- name: todos-api
112129
kind: api
113130
interface:
114131
type: http
132+
configuration:
133+
env:
134+
- property: baseUrl
135+
name: TODOS_API_URL
115136
- name: request-cache
116137
kind: cache
117138
interface:
118139
type: key_value
119140
engine: redis
141+
configuration:
142+
alternatives:
143+
- env:
144+
- property: url
145+
name: REDIS_URL
146+
- env:
147+
- property: hostname
148+
name: REDIS_HOST
149+
- property: port
150+
name: REDIS_PORT
120151
- name: s3-object-store
121152
kind: aws.object_store
122153
interface:
123154
type: aws.s3
124155
bucketClass: standard
156+
configuration:
157+
env:
158+
- property: bucket
159+
name: AUDIT_LOG_BUCKET
160+
- property: region
161+
name: AWS_REGION
162+
- property: accessKeyId
163+
name: AWS_ACCESS_KEY_ID
164+
sensitive: true
165+
- property: secretAccessKey
166+
name: AWS_SECRET_ACCESS_KEY
167+
sensitive: true
125168
```
126169
127170
The `todos-api` and `request-cache` Conditions come from explicit `rc` declarations in the workload. The `s3-object-store` Condition comes from normal SDK usage plus the SDK package manifest.
128171

172+
The profile records the environment variable names expected by the workload. It does not contain the values for those variables. In the Kratix demo, the runtime-workload adapter maps these requested properties to provider-owned outputs:
173+
174+
| Condition property | Kubernetes source |
175+
| ---- | ---- |
176+
| `baseUrl` | Literal service URL from the API catalog |
177+
| `url`, `hostname`, `port` | Redis Promise connection ConfigMap |
178+
| `bucket`, `region` | S3Bucket Promise connection ConfigMap |
179+
| `accessKeyId`, `secretAccessKey` | S3Bucket Promise credentials Secret |
180+
181+
The same adapter emits Cilium policy requests for the resolved workload:
182+
183+
- A `CiliumNamespaceLockdown` request creates namespace default-deny pod networking.
184+
- A `CiliumAPIAccess` request is emitted for API Conditions that declare HTTP operations. That request contains the workload selector, resolved service or FQDN destination, port, and only the `method` and `path` pairs declared by the Condition.
185+
- Redis and S3Bucket requests include the workload selector so their Promises can render dependency-specific Cilium policies.
186+
187+
The generator still emits only the Runtime Conditions Profile. Network-policy requests are adapter output.
188+
129189
---
130190

131191
# 4. Extension Dependency Resolution
@@ -144,6 +204,7 @@ The extension definition declares its dependencies:
144204
spec:
145205
dependencies:
146206
- https://runtimeconditions.io/extensions/common-integrations:v1alpha1
207+
- https://runtimeconditions.io/extensions/env-configuration:v1alpha1
147208
```
148209

149210
Generators and validators should resolve dependencies by extension identifier from configured sources such as:

‎docs/guides/package-artifact-conventions.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,6 +101,18 @@ go:
101101
values:
102102
- target: interface.bucketClass
103103
value: standard
104+
configuration:
105+
env:
106+
- property: bucket
107+
name: AUDIT_LOG_BUCKET
108+
- property: region
109+
name: AWS_REGION
110+
- property: accessKeyId
111+
name: AWS_ACCESS_KEY_ID
112+
sensitive: true
113+
- property: secretAccessKey
114+
name: AWS_SECRET_ACCESS_KEY
115+
sensitive: true
104116
```
105117

106118
Fields:
@@ -132,6 +144,7 @@ Declaration fields:
132144
| `interfaceType` | YES | `interface.type` value |
133145
| `values` | NO | Static field values to include in the generated Condition |
134146
| `options` | NO | Nested function calls that provide field values |
147+
| `configuration` | NO | Static workload-facing configuration mappings to include in the generated Condition |
135148

136149
At least one of `method` or `function` must be present. A declaration should provide either `name` or `nameArg`.
137150

@@ -154,6 +167,8 @@ options:
154167

155168
Nested options are useful for no-op declaration packages. SDK operation manifests usually prefer static values or future language-specific extraction rules.
156169

170+
Configuration mappings let SDK authors surface hidden SDK inputs without emitting concrete values. For example, an SDK can state that generated S3 Conditions require a `bucket`, `region`, `accessKeyId`, and `secretAccessKey`, and can name the environment variables that the workload expects for those inputs. The generated profile carries the names; adapters map those properties to platform-provided ConfigMaps, Secrets, service URLs, or other delivery mechanisms.
171+
157172
---
158173

159174
# 4. Language Placement Conventions
@@ -254,13 +269,16 @@ The extension definition owns vocabulary and dependencies:
254269
spec:
255270
dependencies:
256271
- https://runtimeconditions.io/extensions/common-integrations:v1alpha1
272+
- https://runtimeconditions.io/extensions/env-configuration:v1alpha1
257273
258274
kinds:
259275
- name: aws.object_store
260276
```
261277

262278
The package manifest maps source symbols to that vocabulary. It does not define vocabulary itself.
263279

280+
If a package manifest emits `configuration`, the extension definition should depend on `https://runtimeconditions.io/extensions/env-configuration:v1alpha1` or another extension that defines the configuration shape it uses.
281+
264282
---
265283

266284
# 6. Safety Rules

0 commit comments

Comments
 (0)