Skip to content

Commit b25ed06

Browse files
zreigzzreigz
authored
add AgentRuntimePolicy CR (#4016)
1 parent 827fa2c commit b25ed06

16 files changed

Lines changed: 1234 additions & 0 deletions

‎charts/console-rapid/charts/controller-0.0.205.tgz‎

502 Bytes
Binary file not shown.

‎charts/console/charts/controller-0.0.205.tgz‎

505 Bytes
Binary file not shown.

‎charts/controller/crds/deployments.plural.sh_agentruntimepolicies.yaml‎

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
---
2+
apiVersion: apiextensions.k8s.io/v1
3+
kind: CustomResourceDefinition
4+
metadata:
5+
annotations:
6+
controller-gen.kubebuilder.io/version: v0.19.0
7+
name: agentruntimepolicies.deployments.plural.sh
8+
spec:
9+
group: deployments.plural.sh
10+
names:
11+
kind: AgentRuntimePolicy
12+
listKind: AgentRuntimePolicyList
13+
plural: agentruntimepolicies
14+
singular: agentruntimepolicy
15+
scope: Cluster
16+
versions:
17+
- additionalPrinterColumns:
18+
- description: Name of the AgentRuntime this policy applies to.
19+
jsonPath: .spec.runtime
20+
name: Runtime
21+
type: string
22+
- description: ID of the AgentRuntime in the Console API.
23+
jsonPath: .status.id
24+
name: ID
25+
type: string
26+
name: v1alpha1
27+
schema:
28+
openAPIV3Schema:
29+
description: |-
30+
AgentRuntimePolicy centrally defines who can create agent runs on an AgentRuntime.
31+
Bindings must be managed from the management cluster: if a target cluster could set
32+
its own bindings, cluster operators could grant themselves clone/PR access against
33+
any repository reachable by the runtime's SCM credentials.
34+
properties:
35+
apiVersion:
36+
description: |-
37+
APIVersion defines the versioned schema of this representation of an object.
38+
Servers should convert recognized schemas to the latest internal value, and
39+
may reject unrecognized values.
40+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
41+
type: string
42+
kind:
43+
description: |-
44+
Kind is a string value representing the REST resource this object represents.
45+
Servers may infer this from the endpoint the client submits requests to.
46+
Cannot be updated.
47+
In CamelCase.
48+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
49+
type: string
50+
metadata:
51+
type: object
52+
spec:
53+
description: AgentRuntimePolicySpec defines the desired access policy
54+
for an AgentRuntime.
55+
properties:
56+
bindings:
57+
description: Bindings define who can create agent runs on the targeted
58+
runtime.
59+
properties:
60+
create:
61+
description: Create bindings control who can create agent runs
62+
on this runtime.
63+
items:
64+
description: Binding used to assign permissions to a resource
65+
for a user or a group in the system.
66+
properties:
67+
UserID:
68+
type: string
69+
groupID:
70+
type: string
71+
groupName:
72+
type: string
73+
id:
74+
description: |-
75+
ID of a binding.
76+
Deprecated.
77+
Do not use.
78+
type: string
79+
userEmail:
80+
type: string
81+
type: object
82+
type: array
83+
type: object
84+
cluster:
85+
description: Cluster is the handle of the target Cluster where this
86+
service will be deployed. Leave it empty to use the clusterRef field
87+
instead.
88+
type: string
89+
clusterRef:
90+
description: ClusterRef references the target Cluster where this service
91+
will be deployed. Leave it as an empty struct to use the cluster
92+
field instead.
93+
properties:
94+
apiVersion:
95+
description: API version of the referent.
96+
type: string
97+
fieldPath:
98+
description: |-
99+
If referring to a piece of an object instead of an entire object, this string
100+
should contain a valid JSON/Go field access statement, such as desiredState.manifest.containers[2].
101+
For example, if the object reference is to a container within a pod, this would take on a value like:
102+
"spec.containers{name}" (where "name" refers to the name of the container that triggered
103+
the event) or if no container name is specified "spec.containers[2]" (container with
104+
index 2 in this pod). This syntax is chosen only to have some well-defined way of
105+
referencing a part of an object.
106+
type: string
107+
kind:
108+
description: |-
109+
Kind of the referent.
110+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
111+
type: string
112+
name:
113+
description: |-
114+
Name of the referent.
115+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
116+
type: string
117+
namespace:
118+
description: |-
119+
Namespace of the referent.
120+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
121+
type: string
122+
resourceVersion:
123+
description: |-
124+
Specific resourceVersion to which this reference is made, if any.
125+
More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
126+
type: string
127+
uid:
128+
description: |-
129+
UID of the referent.
130+
More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
131+
type: string
132+
type: object
133+
x-kubernetes-map-type: atomic
134+
reconciliation:
135+
description: |-
136+
Reconciliation settings for this resource.
137+
Controls drift detection and reconciliation intervals.
138+
properties:
139+
driftDetection:
140+
default: true
141+
description: |-
142+
DriftDetection enables drift detection for this resource.
143+
It is destined to detect changes made to the related
144+
resources that are not referenced with owner ref.
145+
Use with Interval to set how often drift detection runs.
146+
example: false
147+
type: boolean
148+
interval:
149+
default: 30m
150+
description: |-
151+
Interval for the drift detection mechanism.
152+
It is subject to jitter to avoid the thundering herd problem,
153+
it is calculated as a random value between 50% and 150% of the given duration.
154+
example: 5m30s
155+
type: string
156+
type: object
157+
runtime:
158+
description: |-
159+
Runtime is the name of the AgentRuntime this policy applies to.
160+
Defaults to metadata.name if not specified.
161+
type: string
162+
type: object
163+
status:
164+
properties:
165+
conditions:
166+
description: Represents the observations of a PrAutomation's current
167+
state.
168+
items:
169+
description: Condition contains details for one aspect of the current
170+
state of this API Resource.
171+
properties:
172+
lastTransitionTime:
173+
description: |-
174+
lastTransitionTime is the last time the condition transitioned from one status to another.
175+
This should be when the underlying condition changed. If that is not known, then using the time when the API field changed is acceptable.
176+
format: date-time
177+
type: string
178+
message:
179+
description: |-
180+
message is a human readable message indicating details about the transition.
181+
This may be an empty string.
182+
maxLength: 32768
183+
type: string
184+
observedGeneration:
185+
description: |-
186+
observedGeneration represents the .metadata.generation that the condition was set based upon.
187+
For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
188+
with respect to the current state of the instance.
189+
format: int64
190+
minimum: 0
191+
type: integer
192+
reason:
193+
description: |-
194+
reason contains a programmatic identifier indicating the reason for the condition's last transition.
195+
Producers of specific condition types may define expected values and meanings for this field,
196+
and whether the values are considered a guaranteed API.
197+
The value should be a CamelCase string.
198+
This field may not be empty.
199+
maxLength: 1024
200+
minLength: 1
201+
pattern: ^[A-Za-z]([A-Za-z0-9_,:]*[A-Za-z0-9_])?$
202+
type: string
203+
status:
204+
description: status of the condition, one of True, False, Unknown.
205+
enum:
206+
- "True"
207+
- "False"
208+
- Unknown
209+
type: string
210+
type:
211+
description: type of condition in CamelCase or in foo.example.com/CamelCase.
212+
maxLength: 316
213+
pattern: ^([a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*/)?(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])$
214+
type: string
215+
required:
216+
- lastTransitionTime
217+
- message
218+
- reason
219+
- status
220+
- type
221+
type: object
222+
type: array
223+
x-kubernetes-list-map-keys:
224+
- type
225+
x-kubernetes-list-type: map
226+
id:
227+
description: ID of the resource in the Console API.
228+
type: string
229+
readonly:
230+
default: false
231+
description: ReadOnly indicates whether the resource is read-only.
232+
type: boolean
233+
sha:
234+
description: SHA of last applied configuration.
235+
type: string
236+
required:
237+
- readonly
238+
type: object
239+
type: object
240+
served: true
241+
storage: true
242+
subresources:
243+
status: {}

‎go/controller/api/v1alpha1/agentruntimepolicy_types.go‎

Lines changed: 94 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,94 @@
1+
package v1alpha1
2+
3+
import (
4+
corev1 "k8s.io/api/core/v1"
5+
"k8s.io/apimachinery/pkg/api/meta"
6+
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
7+
)
8+
9+
func init() {
10+
SchemeBuilder.Register(&AgentRuntimePolicy{}, &AgentRuntimePolicyList{})
11+
}
12+
13+
//+kubebuilder:object:root=true
14+
15+
// AgentRuntimePolicyList contains a list of AgentRuntimePolicy resources.
16+
type AgentRuntimePolicyList struct {
17+
metav1.TypeMeta `json:",inline"`
18+
metav1.ListMeta `json:"metadata,omitempty"`
19+
Items []AgentRuntimePolicy `json:"items"`
20+
}
21+
22+
// +kubebuilder:object:root=true
23+
// +kubebuilder:resource:scope=Cluster
24+
// +kubebuilder:subresource:status
25+
// +kubebuilder:printcolumn:name="Runtime",type="string",JSONPath=".spec.runtime",description="Name of the AgentRuntime this policy applies to."
26+
// +kubebuilder:printcolumn:name="ID",type="string",JSONPath=".status.id",description="ID of the AgentRuntime in the Console API."
27+
28+
// AgentRuntimePolicy centrally defines who can create agent runs on an AgentRuntime.
29+
// Bindings must be managed from the management cluster: if a target cluster could set
30+
// its own bindings, cluster operators could grant themselves clone/PR access against
31+
// any repository reachable by the runtime's SCM credentials.
32+
type AgentRuntimePolicy struct {
33+
metav1.TypeMeta `json:",inline"`
34+
metav1.ObjectMeta `json:"metadata,omitempty"`
35+
36+
Spec AgentRuntimePolicySpec `json:"spec,omitempty"`
37+
Status Status `json:"status,omitempty"`
38+
}
39+
40+
// RuntimeName returns the AgentRuntime name this policy applies to.
41+
// It returns spec.runtime when set, otherwise metadata.name.
42+
func (in *AgentRuntimePolicy) RuntimeName() string {
43+
if in.Spec.Runtime != nil && len(*in.Spec.Runtime) > 0 {
44+
return *in.Spec.Runtime
45+
}
46+
47+
return in.Name
48+
}
49+
50+
// SetCondition sets a condition on the AgentRuntimePolicy status.
51+
func (in *AgentRuntimePolicy) SetCondition(condition metav1.Condition) {
52+
meta.SetStatusCondition(&in.Status.Conditions, condition)
53+
}
54+
55+
func (in *AgentRuntimePolicy) Diff(hasher Hasher) (changed bool, sha string, err error) {
56+
currentSha, err := hasher(in.Spec)
57+
if err != nil {
58+
return false, "", err
59+
}
60+
61+
return !in.Status.IsSHAEqual(currentSha), currentSha, nil
62+
}
63+
64+
// AgentRuntimePolicySpec defines the desired access policy for an AgentRuntime.
65+
type AgentRuntimePolicySpec struct {
66+
// Runtime is the name of the AgentRuntime this policy applies to.
67+
// Defaults to metadata.name if not specified.
68+
// +kubebuilder:validation:Optional
69+
Runtime *string `json:"runtime,omitempty"`
70+
71+
// Bindings define who can create agent runs on the targeted runtime.
72+
// +kubebuilder:validation:Optional
73+
Bindings *AgentRuntimePolicyBindings `json:"bindings,omitempty"`
74+
75+
// ClusterRef references the target Cluster where this service will be deployed. Leave it as an empty struct to use the cluster field instead.
76+
// +kubebuilder:validation:Optional
77+
ClusterRef corev1.ObjectReference `json:"clusterRef"`
78+
79+
// Cluster is the handle of the target Cluster where this service will be deployed. Leave it empty to use the clusterRef field instead.
80+
// +kubebuilder:validation:Optional
81+
Cluster *string `json:"cluster,omitempty"`
82+
83+
// Reconciliation settings for this resource.
84+
// Controls drift detection and reconciliation intervals.
85+
// +kubebuilder:validation:Optional
86+
Reconciliation *Reconciliation `json:"reconciliation,omitempty"`
87+
}
88+
89+
// AgentRuntimePolicyBindings defines create permissions for an AgentRuntime.
90+
type AgentRuntimePolicyBindings struct {
91+
// Create bindings control who can create agent runs on this runtime.
92+
// +kubebuilder:validation:Optional
93+
Create []Binding `json:"create,omitempty"`
94+
}

0 commit comments

Comments
 (0)