Repository navigation
Conversation
- coordinator/reconcile runs one pass per key; the coordinator keeps workers and queues - simulate calls reconcile.Run and admits keys through informer.AdmitPrimary - the fake kubeclient persists maintain's writes; simulate's own gate and seed are gone
… security - pkg/runtime/app and pkg/gateway/app wire each process; cmd only starts it. One gateway path: outside a pod it serves the API without TLS or webhooks - reconcilers.Factory and informer/crds own their wiring; simulate builds reconcilers and informers through them - pipeline.NewCatalog marks the instance; process.New takes cfg and components, logs one registered and one running line, and no longer sleeps per component - gateway security in security.go, tls.go and conversion.go: conversion.manageCRD (default on the entry with paths) replaces updateCRD, a configured certificate leaves spec.conversion to its owner, and conversionReviewVersions is always v1 - security.serviceName.gateway is the one Service every webhook uses; the per-feature serviceName fields are gone - a conditional reconcile.requeue holds a deleting CR like a Result's requeue - removed: the startup banner and the unread INRUN_REGISTRY plumbing
- CRDEntry methods (registrations.go) look up constructors, hooks, per-target factories and object types in the registries; reconcilers.Factory, the generic reconciler, informer/crds and vitals call them - validation checks the registrations in one read-only step with the same messages; the gateway skips constructors and hooks - removed: the five Add* wiring steps and the function fields they filled, the unused resourceTypeMap, and Catalog methods nothing calls - webhook fixtures: e2e step files reference CRs one directory up
- validate runs one package per Catalog block (metadata, crds, reconcile, runtime, observe, emit, admission, security, notes, profiles, serve, gateway, publish) in the schema reference's order; internal/check holds what blocks share - checks read only what the user declared and add warnings; applyDefaults then sets mode, the status flags, the expanded autoscale profile and onThreshold.drop - the onThreshold drop warning fires only for an explicit drop: false (ShouldDrop compared pointers)
- CRDEntry.ReconcilerKind (declarative, hooks, constructor, remote) decides which reconciler the factory builds, and TargetReconcilerKinds names targets that differ; pkg/types/reconciler.go holds the kind, the constructor signature and the registry lookups - /catalog reports that kind, the targets, and the finalizers the runtime applies (none with runtime.finalizers.remove) - console: a badge per kind; the CRD docs page keeps typed or dynamic as its own line, describes each kind, and says the runtime owns the lifecycle for all of them - console tests parse every template and render both CRD pages for each kind
migrate.from in the Catalog serve fields drives forward migration, snapshot-based rollback, and cleanup. Runs as or on gateway startup with , before serving. Idempotent, drift-aware, fails loudly.
inrun gate migrate → inrun migrate, with rollback and clean as subcommands. Shared flags move to the parent as PersistentFlags; runMigrateCmd handles all three modes. --clean flag replaced by the clean subcommand. Output package moves to cmd/cli/migrate/output. No behaviour change.
The template function library moves to its own module, KEL (github.com/intentd/kel v0.1.0), and pkg/kel is removed. Inrun uses it through pkg/template/funcs. - A Catalog's notes: block is now functions:, with definitions: - Function docs are generated from Go doc comments
pkg/utils becomes pkg/util/{term,fileio,structured,kube,retry,httpapi}.
The runtime's HTTP API moves to pkg/runtimeapi, annotation helpers to
pkg/labels, sentinel to pkg/sentinel, and the informer's client provider
to pkg/runtime/informer/crds. Wrappers around KEL and local pointer
helpers give way to kel/core and ptr.To.
External calls and the remote's request and finalize share CallSpec. Header values are templates, and POST and PATCH send an Idempotency-Key so a retried create is not applied twice.
…ache kind: Blueprint, blueprint.yaml, pkg/blueprint and the /blueprint routes; cat/Cat are bp/Blueprint. Prepare and the preReconcile gate copy the CR they read from the informer (domain.FromCache), so the reconcile no longer writes into the cache. Copies go through domain.Copy.
…responsibilities No behaviour change.
- push refuses a version that is already published; --overwrite replaces it and records the digest it replaced (io.inrun.pattern.replaces), which inspect shows in full - push passes --chart, --set, --values and --version to its e2e gate, so patterns can be proven against an unreleased Inrun; e2e and push share cmdutil.ChartDir and HelmSetArgs - one place knows the pattern layout: registry.ResolvePatternFile, which FindPatternFile, cmdutil.FindFile, projectFile and inspect --view use, so --view cr.yaml finds manifests/cr.yaml - inspect's pull hint uses the reference inspected, so a digest pulls exactly that artifact - patterns are packed with oras.PackManifest (OCI manifest v1.1), as the index already was; oras.Pack is deprecated - descriptions and tags wrap between words, with tests for the term text helpers
…ns to When Runners - Replace the 21 per-kind runner files with one generic loop (child.go): each kind declares a child[S, Spec] descriptor and runChildren handles conditions, the namespace guard, conditional cleanup, create/apply, toNamespaces fan-out and before/after steps. Files are grouped like pkg/template/resources: workloads, networking, config, policy, rbac, storage. 2,406 lines down to 1,191. - Error prefixes are now the Blueprint field names, e.g. deployments[2].update. - Fix the services runner logging "ConfigMap". - Use apierrors.IsNotFound in place of string matching. - Merge secrets_once.go and secret_tls.go into secrets.go. Types - Rename the template Conditions field to When (yaml:"when") everywhere. - Shorten the When/Or comments on every template entry; the full explanation now lives once, on Condition. - Rename the kubewright types alias restypes to kwtypes. Secrets - Remove pkg/secrets. Move the rotation annotations and NeedsRotation to pkg/labels, and the Secret read, exists, delete and rotation checks to pkg/util/kube. e2e - Pass HelmArgs to imported suite sub-runners, so --set values reach their installs.
A CRD's migrate block can now move its CRs to another CRD (new kind, group or scope). Each source is rebuilt as a destination CR and server-side applied, with a snapshot on the destination so the move rolls back. migrate.selection (namespaces, name, label selector, when/or) scopes migrations at either level; CLI flags can narrow it, never widen it. Migration - pkg/migrate splits into core (runner, results, selection, merge patch), field (migrate.from) and kind (migrate.to); root keeps Migrator and aliases, so the CLI is unchanged. - Forward dry-run-applies first and refuses a destination that drops or changes a source field; drift ignores server defaults; collisions fail, also within one run and in dry-run. - Prune waits until the destination holds every source field, and deletes only if the source is unchanged since it was read. - Rollback recreates the source before deleting the destination, restores its status, honours --dry-run, and only touches its own snapshots. - Field patches carry resourceVersion; clean leaves the other level's snapshot alone. - migrate.to.carryStatus copies source status to the destination. - inrun migrate: per-kind scope and destination in the output, drifted / pruned / not-selected states, spinner, prune confirmation (--yes), and --kind filters before running. RBAC for the gateway's startup migration. Blueprint and validation - migrate.to.crdFile fills apiVersion/kind/plural at parse (declared values must match) and is inlined in bundles; a crdFile's scope now sets namespaced. - Validate checks scopes, that the destination schema holds every source field, selection conditions, and rejects a destination that is the source itself. - CRD header reads live in util/kube (ReadCRDFileHeader); types.APITypesFromCRDHeader converts. util never imports types. Shared - Template resolution in one place: ResolveNested (KeepOnError, DropEmpty), ResolveMapLenient, ResolveEnvVarsLenient; children, template/resources, the conversion webhook and migrate use them. - structured.MissingPaths, kube.SchemaLeafPaths / CompareSchemas. - AnnotationMigrateSnapshot -> AnnotationMigrateFieldSnapshot (inrun.dev/migrate-field-snapshot). - The CLI runs commands with the main context (ExecuteContext). Examples - examples/schema-migration -> examples/migration, now an init pack (inrun init --pack migration): field/ (fanout, relocation) and kind/ (rename, rescope), each a walkthrough run on a kind cluster.
…ne cache
The registry pack walks a pattern's lifecycle: consume a published pattern,
publish your own through the simulate and e2e gates, then deprecate it so
consumers keep running it only by accepting that in their Stack.
Registry
- registry.Fetch is the one place OCI artifacts reach the disk: it returns
the cache directory (~/.inrun/registry/<host>/<repo>/<tag>/), pulling into
a temporary sibling first and renaming it into place, so a failed pull
leaves no partial entry. Client.Pull, the merger's registry and module
imports, and module pre-pulls all use it; the merger's own OCI pull and its
flat cache copy (which dropped manifests/ and test/) are gone.
- Registry imports load from the pattern's real cached path, not its display
label, so a pattern's relative crdFile resolves when a Stack imports it,
and running the Stack installs that CRD.
- inspect --view prints several files as one YAML stream ("---" between
them); warnings and read errors go to stderr.
CLI
- --dev checks the cluster first and only creates a kind cluster when none
is reachable, instead of always reporting it unreachable.
Examples
- examples/registry: consume (deployment-stack from ghcr.io/intentd/registry),
publish (a WebService built on the deployment-stack module, with simulate
and e2e), deprecate (lifecycle block, push --overwrite, lifecycle.accept).
- The registry pack is embedded for inrun init --pack registry, packaged in
releases, and listed in both READMEs; migration was missing from the
release summary and the README's pack list too.
README
- migrate.to joins migrate.from: when the CRD itself changes, stored
resources move to it.
- Each "What comes with it" point links the example that shows it: registry,
migration, and existing-service-ids for Kubernetes as a backend.
…s govulncheck reports
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Runs CI on develop before the launch commit. Not to be merged: main restarts as one initial commit.