✨ Hook server and Tilt setup

Tiltfile

@@ -17,6 +17,8 @@ settings = {
     "allowed_contexts": [
         "kind-cso",
     ],
+    "local_mode": False,
+    "runtime_sdk": True,
     "deploy_cert_manager": True,
     "preload_images_for_kind": True,
     "kind_cluster_name": "cso",
@@ -110,6 +112,12 @@ def fixup_yaml_empty_arrays(yaml_str):
     yaml_str = yaml_str.replace("conditions: null", "conditions: []")
     return yaml_str.replace("storedVersions: null", "storedVersions: []")
 
+tilt_dockerfile_header_runtime = """
+FROM docker.io/library/alpine:3.18.0
+WORKDIR /
+COPY extension/.tiltbuild/manager .
+"""
+
 ## This should have the same versions as the Dockerfile
 tilt_dockerfile_header_cso = """
 FROM docker.io/alpine/helm:3.12.2 as helm
@@ -185,6 +193,54 @@ def deploy_cso():
         labels = ["CSO"],
     )
 
+def deploy_runtime_extension():
+    yaml = str(kustomizesub("./extension/config/default"))
+
+    local_resource(
+        name = "runtime-components",
+        cmd = ["sh", "-ec", sed_cmd, yaml, "|", envsubst_cmd],
+        labels = ["runtime"],
+    )
+
+    local_resource(
+        "runtime-manager",
+        cmd = 'cd extension; mkdir -p .tiltbuild;CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -ldflags \'-extldflags "-static"\' -o .tiltbuild/manager main.go',
+        deps = ["extension/handlers", "extension/main.go"],
+        labels = ["runtime"],
+    )
+
+    entrypoint = ["/manager"]
+    extra_args = settings.get("extra_args")
+    if extra_args:
+        entrypoint.extend(extra_args)
+
+    docker_build_with_restart(
+    ref = "ghcr.io/sovereigncloudstack/runtime-sdk-staging",
+    context = ".",
+    dockerfile_contents = tilt_dockerfile_header_runtime,
+    entrypoint = entrypoint,
+    live_update = [
+        sync("extension/.tiltbuild/manager", "/manager"),
+        # sync(".release", "/tmp/cluster-stacks"),
+    ],
+    ignore = ["templates"],
+    )
+
+    k8s_yaml(blob(yaml))
+    k8s_resource(workload = "test-runtime-sdk", labels = ["runtime"])
+    k8s_resource(
+        objects = [
+            "runtimesdk:namespace",
+            # "test-runtime-sdk:deployment",
+            "test-runtime-sdk-sa:serviceaccount",
+            "test-runtime-sdk-role:clusterrole",
+            "test-runtime-sdk-role-rolebinding:clusterrolebinding",
+            "runtime-sdk-selfsigned-issuer:issuer",
+        ],
+        new_name = "runtime-misc",
+        labels = ["runtime"],
+    )
+
 def clusterstack():
     k8s_resource(objects = ["clusterstack:clusterstack"], new_name = "clusterstack", labels = ["CLUSTERSTACK"])
 
@@ -252,6 +308,9 @@ deploy_cso()
 
 clusterstack()
 
+if settings.get("runtime_sdk"):
+    deploy_runtime_extension()
+
 waitforsystem()
 
 prepare_environment()

extension/Dockerfile

@@ -0,0 +1,36 @@
+# Copyright 2024 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Build the extension binary
+# Run this with docker build --build-arg builder_image=<golang:x.y.z>
+FROM --platform=${BUILDPLATFORM} docker.io/library/golang:1.21.5-bullseye as build
+ARG TARGETOS TARGETARCH
+
+COPY . /src/cluster-stack-operator-runtimesdk
+WORKDIR /src/cluster-stack-operator-runtimesdk
+RUN --mount=type=cache,target=/go/pkg \
+    GOOS=${TARGETOS} GOARCH=${TARGETARCH} CGO_ENABLED=0 \
+    go build -mod=vendor -trimpath -ldflags "-s -w ${LDFLAGS} -extldflags '-static'" \
+    -o manager main.go
+
+RUN ls /src
+
+# Production image
+FROM --platform=${BUILDPLATFORM} docker.io/library/alpine:3.19.0
+WORKDIR /
+COPY --from=build /src/cluster-stack-operator-runtimesdk/manager .
+
+# Use uid of nonroot user (65532) because kubernetes expects numeric user when applying pod security policies
+USER 65532:65532
+ENTRYPOINT ["/manager"]

extension/config/certmanager/certificate.yaml

@@ -0,0 +1,23 @@
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: runtime-sdk-selfsigned-issuer
+  # namespace: runtimesdk
+spec:
+  selfSigned: {}
+
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: serving-cert
+  # namespace: runtimesdk
+spec:
+  dnsNames:
+    - test-runtime-sdk-svc.runtimesdk.svc
+    - test-runtime-sdk-svc.runtimesdk.svc.cluster.local
+    - localhost
+  issuerRef:
+    kind: Issuer
+    name: runtime-sdk-selfsigned-issuer
+  secretName: test-runtime-sdk-svc-cert

extension/config/certmanager/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - certificate.yaml
+
+configurations:
+  - kustomizeconfig.yaml

extension/config/certmanager/kustomizeconfig.yaml

@@ -0,0 +1,19 @@
+# This configuration is for teaching kustomize how to update name ref and var substitution
+nameReference:
+- kind: Issuer
+  group: cert-manager.io
+  fieldSpecs:
+  - kind: Certificate
+    group: cert-manager.io
+    path: spec/issuerRef/name
+
+varReference:
+- kind: Certificate
+  group: cert-manager.io
+  path: spec/commonName
+- kind: Certificate
+  group: cert-manager.io
+  path: spec/dnsNames
+- kind: Certificate
+  group: cert-manager.io
+  path: spec/secretName

extension/config/default/deployment.yaml

@@ -0,0 +1,39 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-runtime-sdk
+spec:
+  selector:
+    matchLabels:
+      app: test-runtime-sdk
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: test-runtime-sdk
+    spec:
+      containers:
+        - command:
+            - /manager
+          image: controller:latest
+          name: manager
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+            privileged: false
+            runAsUser: 65532
+            runAsGroup: 65532
+      terminationGracePeriodSeconds: 10
+      serviceAccountName: test-runtime-sdk-sa
+      tolerations:
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/master
+        - effect: NoSchedule
+          key: node-role.kubernetes.io/control-plane
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault

extension/config/default/deployment_image_patch.yaml

@@ -0,0 +1,10 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-runtime-sdk
+spec:
+  template:
+    spec:
+      containers:
+        - image: ghcr.io/sovereigncloudstack/runtime-sdk-staging:latest
+          name: manager

extension/config/default/deployment_webhook.yaml

@@ -0,0 +1,21 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: test-runtime-sdk
+spec:
+  template:
+    spec:
+      containers:
+        - name: manager
+          ports:
+            - containerPort: 9443
+              name: webhook-server
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /tmp/k8s-webhook-server/serving-certs
+              name: cert
+              readOnly: true
+      volumes:
+        - name: cert
+          secret:
+            secretName: test-runtime-sdk-svc-cert

extension/config/default/extensionconfig.yaml

@@ -0,0 +1,18 @@
+apiVersion: runtime.cluster.x-k8s.io/v1alpha1
+kind: ExtensionConfig
+metadata:
+  annotations:
+    runtime.cluster.x-k8s.io/inject-ca-from-secret: runtimesdk/test-runtime-sdk-svc-cert
+  name: test-runtime-sdk-extensionconfig
+spec:
+  clientConfig:
+    service:
+      name: test-runtime-sdk-svc
+      namespace: runtimesdk # Note: this assumes the test extension get deployed in the default namespace defined in its own runtime-extensions-components.yaml
+      port: 443
+  namespaceSelector:
+    matchExpressions:
+      - key: kubernetes.io/metadata.name
+        operator: In
+        values:
+          - cluster # Note: this assumes the test extension is used by Cluster in the default namespace only

extension/config/default/kustomization.yaml

@@ -0,0 +1,22 @@
+namespace: runtimesdk
+
+commonLabels:
+  cluster.x-k8s.io/provider: "test-runtime-sdk"
+
+bases:
+  - ../certmanager
+
+patchesStrategicMerge:
+  # Enable webhook with corresponding certificate mount.
+  - deployment_webhook.yaml
+  - deployment_image_patch.yaml
+
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - sa-roles.yaml
+  - extensionconfig.yaml
+
+configurations:
+  - kustomizeconfig.yaml

extension/config/default/kustomizeconfig.yaml

@@ -0,0 +1,4 @@
+# This configuration is for teaching kustomize how to update name ref and var substitution
+varReference:
+  - kind: Deployment
+    path: spec/template/spec/volumes/secret/secretName

extension/config/default/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: runtimesdk

extension/config/default/sa-roles.yaml

@@ -0,0 +1,36 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test-runtime-sdk-sa
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: test-runtime-sdk-role
+rules:
+  - apiGroups:
+      - cluster.x-k8s.io
+    resources:
+      - clusters
+    verbs:
+      - get
+  - apiGroups:
+      - clusterstack.x-k8s.io
+    resources:
+      - clusteraddons
+    verbs:
+      - get
+      - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: test-runtime-sdk-role-rolebinding
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: test-runtime-sdk-role
+subjects:
+  - kind: ServiceAccount
+    name: test-runtime-sdk-sa
+    namespace: default

extension/config/default/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: test-runtime-sdk-svc
+  # namespace: runtimesdk
+spec:
+  type: ClusterIP
+  selector:
+    app: test-runtime-sdk
+  ports:
+    - port: 443
+      targetPort: 9443