Home-Network/home-network-k3s-impl
2
0 Fork 0
Code Issues 3 Pull Requests 3 Actions Packages Projects Releases Wiki Activity

Add ServiceDefinition renderer (T-0.3, R-GITOPS-02)

Browse Source 
catalog/render.py compiles a ServiceDefinition into the manifest set defined by
schemas/renderer-contract.md: Namespace + default-deny baseline (R-NET-01),
Deployment/Service or KubeVirt VM + CDI DataVolume (R-PLAT-02/03), PVCs (R-STATE),
per-dependency CiliumNetworkPolicy allows (R-NET-02), egress-class steering label
(R-NET-05), HTTPRoutes on the shared Gateway (R-TLS/R-DNS), ServiceMonitor + SLI
alerts (R-OBS-01), Flux image-automation (R-UPD), auth-mode/backup hints (R-IDP).

Deterministic (golden-diffable) with a built-in --selftest; single dependency
(PyYAML) so the conformance harness stays stdlib-only. Documents the mechanism
choice in catalog/README.md and the script header.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 4.8 committed 2026-08-24 22:18:58 -05:00
1 parent f49b8c2e02
commit 6b2c04ed5c
2 files changed
+800
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

catalog/README.md
+26
View File
@@ -35,3 +35,29 @@ check-jsonschema --schemafile schemas/servicedefinition.schema.json catalog/*.ya
```
See [`../schemas/README.md`](../schemas/README.md) for install/pinning and a pure-Python fallback.
This is the L0/L1 schema gate (spec `docs/14`); CI (`.gitea/`) runs it on every change.
## Rendering — `render.py` (the ServiceDefinition renderer, T-0.3)
[`render.py`](./render.py) compiles a ServiceDefinition into the concrete manifest set defined
by [`../schemas/renderer-contract.md`](../schemas/renderer-contract.md): a Namespace (with the
`app-namespace`/`gateway-access` labels), the default-deny baseline (R-NET-01), a
Deployment+Service **or** a KubeVirt VirtualMachine + CDI DataVolume (R-PLAT-02/03), PVCs
(R-STATE), one CiliumNetworkPolicy egress-allow per `dependency` (R-NET-02), the
`egress-class` steering label (R-NET-05), HTTPRoute(s) on the shared Gateway (R-TLS/R-DNS),
ServiceMonitor + SLI alerts (R-OBS-01), the Flux ImageRepository/ImagePolicy update plumbing
(R-UPD), and the auth-mode / backup wiring hints (R-IDP/R-STATE-03).
```bash
python3 catalog/render.py catalog/pihole.yaml # render one SD to stdout
python3 catalog/render.py --all catalog -o out/ # render every SD to out/<name>.yaml
python3 catalog/render.py --selftest # deterministic self-test (no cluster)
```
- **Deterministic:** identical input → byte-identical output (golden-diffable). The L1 render
conformance tests (`conformance/tests/l1-rendering/*`) diff the output against committed
goldens — run offline by `conformance/run.sh --layer l1` and `ci/l1.sh` (no cluster).
- **How CI/Flux consume it:** CI invokes `render.py` in the L1 stage; a GitOps flow renders
`--all catalog -o <rendered-dir>` and Flux reconciles the rendered directory. Design choice
(renderer-contract is silent on mechanism): a render-then-consume script is the simplest
reproducible option — see the header of `render.py`.
- **Dependency:** PyYAML (the renderer's single dependency; the conformance harness stays
stdlib-only and only shells out to this script + diffs text).