Documentation
¶
Overview ¶
Package runtimeexecutoropentofu is the standard StackKits runtime executor (ADR-0045): it realizes one module's CUE-generated OpenTofu root with the packaged tofu binary and an offline provider mirror, keeps OpenTofu state in that root, and verifies the result with the native Verify semantics of the module. The native Compose executor in runtimeexecutorlocal stays the fallback behind the compose target (S-F).
Index ¶
- Constants
- func ModuleRootRelativePath(moduleRef string) (string, error)
- func RenderContractRoot(target runtimeexecutor.RuntimeTarget, contract runtimeexecutor.Artifact) ([]byte, error)
- func RenderWorkloadRoot(prepared runtimeexecutorlocal.NativeWorkloadCompose) ([]byte, error)
- func RootRelativePath(runtimeDir string) (string, error)
- func WorkloadRootRelativePath(project string) (string, error)
- type Authority
- type ContractRootExecutor
- type Executor
- type ModuleBinding
- type RootMarker
- type Runtime
- type WorkloadOperations
- func (o *WorkloadOperations) ApplyWorkload(ctx context.Context, ...) (runtimeexecutorlocal.SelectedPaaSApplyReceipt, error)
- func (o *WorkloadOperations) ObserveWorkload(ctx context.Context, ...) (runtimeexecutorlocal.SelectedPaaSWorkloadObservation, error)
- func (o *WorkloadOperations) ValidateWorkloadObservation(deployment runtimeexecutorlocal.SelectedPaaSWorkloadDeployment, ...) error
Constants ¶
const ( // UnitRef is the render unit, and runtime target unit, this executor owns. UnitRef = "opentofu" // TerramateUnitRef is the Core unit under the terramate target: the same // OpenTofu root plus its Terramate stack file. TerramateUnitRef = "terramate" // ArtifactKind and ArtifactFormat identify the executable root artifact. ArtifactKind = "opentofu" ArtifactFormat = "hcl" ArtifactMode = "0640" // RootDirName is the per-module root directory below the module's native // runtime directory: .stackkit/runtime/<runtimeDir>/opentofu. RootDirName = "opentofu" // ConfigFile, StateFile, and ComposeFile are the root files the // executor-state checkpoint captures. ConfigFile = "main.tf" StateFile = "terraform.tfstate" ComposeFile = "compose.yaml" // StackFile is the Terramate stack file placed beside main.tf. StackFile = "stack.tm.hcl" // EnvFile is the private interpolation file of a workload project; the // workload root references it and never embeds it. EnvFile = ".env" // PlanFile is the saved plan between plan and apply; it is removed after // apply because it embeds the full configuration. PlanFile = "tfplan" // CLIConfigFile is the generated offline CLI configuration. CLIConfigFile = "stackkit.tofurc" // MarkerFile binds a root directory to the module that owns it. MarkerFile = "stackkit-root.json" // ObservationFile holds the last apply observation; its digest is the // RuntimeOutcome observation digest. ObservationFile = "stackkit-apply-observation.json" // RootMarkerSchemaVersion versions the root marker document. RootMarkerSchemaVersion = "stackkit.opentofu-root/v1" )
const ( // RootKindWorkload is the executor-materialized root of one standalone // workload project: .stackkit/runtime/applications/<project>/opentofu. RootKindWorkload = "workload" // RootKindModule is the executor-materialized contract root of one edge // or federation owner: .stackkit/runtime/modules/<moduleRef>/opentofu. RootKindModule = "module" // ApplicationsDir and ModulesDir are the runtime subtrees of the // executor-materialized roots (terramatestackgraph runtime roots). ApplicationsDir = "applications" ModulesDir = "modules" )
Root kinds. Core roots carry no kind in their marker (P1.1 layout).
Variables ¶
This section is empty.
Functions ¶
func ModuleRootRelativePath ¶
ModuleRootRelativePath is the contract root of one edge or federation owner module, the stack graph's runtimeRoot for it.
func RenderContractRoot ¶
func RenderContractRoot(target runtimeexecutor.RuntimeTarget, contract runtimeexecutor.Artifact) ([]byte, error)
RenderContractRoot renders the contract root of one owner: OpenTofu state records the digest of the contract artifact the owner applied, and a new contract replaces the record.
func RenderWorkloadRoot ¶
func RenderWorkloadRoot(prepared runtimeexecutorlocal.NativeWorkloadCompose) ([]byte, error)
RenderWorkloadRoot renders the wrapper root of one prepared workload project: the byte-identical Compose payload, the native project name, and a reference to the private .env (never its content).
func RootRelativePath ¶
RootRelativePath returns the slash-separated workspace-relative root of the module whose native runtime directory is runtimeDir.
func WorkloadRootRelativePath ¶
WorkloadRootRelativePath is the root of the standalone workload project stackkit-<workloadRef>-<nodeRef>, the stack graph's runtimeRoot for it.
Types ¶
type Authority ¶
type Authority struct {
ProviderContractHash string
ModuleContractHash string
HealthContractHashes map[string]string
}
Authority is the factory-owned trust for one prepared target.
type ContractRootExecutor ¶
type ContractRootExecutor struct {
// contains filtered or unexported fields
}
ContractRootExecutor gives a native owner that has no Compose project (the Cloud public edge, the Modern federation link, and the bridge origin mTLS owner) a Terramate-visible OpenTofu root. Under the compose target it is the native executor, byte for byte. Under opentofu and terramate the native owner operation runs first, unchanged; after it succeeds the executor writes .stackkit/runtime/modules/<moduleRef>/opentofu/main.tf, a root with one terraform_data resource whose triggers_replace is the digest of the owner's contract artifact, and applies it, so OpenTofu state records the contract the owner applied. The root starts no process: StackKits has no safe CLI entrypoint that re-applies one owner from a local-exec.
func NewContractRootExecutor ¶
func NewContractRootExecutor(native runtimeexecutor.Executor, runtime Runtime) *ContractRootExecutor
NewContractRootExecutor wraps one prepared native owner executor.
func (*ContractRootExecutor) Execute ¶
func (e *ContractRootExecutor) Execute(ctx context.Context, request runtimeexecutor.ExecutionRequest) (runtimeexecutor.ExecutionOutcome, error)
Execute runs the native owner and, under an OpenTofu target, records its applied contract in the owner's contract root.
func (*ContractRootExecutor) Identity ¶
func (e *ContractRootExecutor) Identity() runtimeexecutor.ExecutorIdentity
Identity is the native owner's identity: the wrapper adds no authority.
type Executor ¶
type Executor struct {
// contains filtered or unexported fields
}
Executor realizes exactly one module's OpenTofu root.
func NewExecutor ¶
func NewExecutor(identity runtimeexecutor.ExecutorIdentity, binding runtimeexecutorlocal.LocalTargetBinding, authority Authority, module ModuleBinding, runtime Runtime) *Executor
NewExecutor binds one prepared target scope to the host runtime.
func (*Executor) Execute ¶
func (e *Executor) Execute(ctx context.Context, request runtimeexecutor.ExecutionRequest) (runtimeexecutor.ExecutionOutcome, error)
Execute writes the root, runs init, plan, and apply offline, and verifies the module. It never refreshes only, never replaces, and never destroys.
type ModuleBinding ¶
type ModuleBinding struct {
ProviderRef string
ModuleRef string
WorkloadRef string
RuntimeDir string
ComposeProject string
}
ModuleBinding is one catalog module the OpenTofu executor may realize. The runtime directory and Compose project are the native executor's, so the OpenTofu root and the native fallback manage the same containers.
func DefaultModuleBindings ¶
func DefaultModuleBindings() []ModuleBinding
DefaultModuleBindings is the closed list of modules whose OpenTofu unit is executable today. Every entry has a native Verify owner in runtimeexecutorlocal.NativeComposeRuntime. P1.2 and P1.3 extend this list when they add OpenTofu units for further modules (workload bundles, Modern sites); a module without a native Verify owner needs one first.
func (ModuleBinding) Validate ¶
func (b ModuleBinding) Validate() error
Validate rejects incomplete or non-portable bindings.
type RootMarker ¶
type RootMarker struct {
SchemaVersion string `json:"schemaVersion"`
ModuleRef string `json:"moduleRef"`
InstanceRef string `json:"instanceRef"`
RuntimeDir string `json:"runtimeDir"`
ComposeProject string `json:"composeProject"`
// Kind is empty for a Core root, else RootKindWorkload or RootKindModule.
Kind string `json:"kind,omitempty"`
}
RootMarker is the secret-free identity of one materialized root.
func ReadRootMarker ¶
func ReadRootMarker(rootDir string) (RootMarker, error)
ReadRootMarker reads and validates the marker of one root directory.
type Runtime ¶
type Runtime struct {
WorkspaceRoot string
Native runtimeexecutorlocal.NativeComposeRuntime
Binary string
ProvidersDir string
// Timeout bounds each tofu command; zero keeps the wrapper default.
Timeout time.Duration
}
Runtime is the construction-owned host capability. Binary and ProvidersDir default to the packaged tofu and provider mirror; they are resolved at Execute so a missing package fails only an OpenTofu rollout, never a Compose one.
type WorkloadOperations ¶
type WorkloadOperations struct {
// contains filtered or unexported fields
}
WorkloadOperations realizes the standalone workload bundles (the ten selected-PaaS applications) through their OpenTofu wrapper root when the request's generation target is opentofu or terramate, and through the native Compose owner otherwise (S-F fallback). Under an OpenTofu target the native preparation materializes the Compose project and its private .env exactly as today; the executor renders main.tf around that Compose file with RenderComposePayloadOpenTofu and runs init, plan, and apply in .stackkit/runtime/applications/<project>/opentofu instead of the native `docker compose up`; the native completion and observation run unchanged.
func NewWorkloadOperations ¶
func NewWorkloadOperations(native runtimeexecutorlocal.NativeWorkloadComposeOperations, runtime Runtime) (*WorkloadOperations, error)
NewWorkloadOperations wraps the native standalone Compose owner. The runtime's Native field is not used: workload verification is the native owner's ObserveWorkload.
func (*WorkloadOperations) ApplyWorkload ¶
func (o *WorkloadOperations) ApplyWorkload(ctx context.Context, deployment runtimeexecutorlocal.SelectedPaaSWorkloadDeployment) (runtimeexecutorlocal.SelectedPaaSApplyReceipt, error)
ApplyWorkload applies one workload bundle.
func (*WorkloadOperations) ObserveWorkload ¶
func (o *WorkloadOperations) ObserveWorkload(ctx context.Context, deployment runtimeexecutorlocal.SelectedPaaSWorkloadDeployment) (runtimeexecutorlocal.SelectedPaaSWorkloadObservation, error)
ObserveWorkload is the native readback under every target.
func (*WorkloadOperations) ValidateWorkloadObservation ¶
func (o *WorkloadOperations) ValidateWorkloadObservation(deployment runtimeexecutorlocal.SelectedPaaSWorkloadDeployment, observation runtimeexecutorlocal.SelectedPaaSWorkloadObservation) error
ValidateWorkloadObservation keeps the native semantic readback contract.