runtimeexecutoropentofu

package
v0.46.7 Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Sep 25, 2026 License: Apache-2.0 Imports: 19 Imported by: 0

Documentation

Overview

Package runtimeexecutoropentofu is the standard StackKits runtime executor (ADR-0045): it realizes one module's CUE-generated OpenTofu root with the packaged tofu binary and an offline provider mirror, keeps OpenTofu state in that root, and verifies the result with the native Verify semantics of the module. The native Compose executor in runtimeexecutorlocal stays the fallback behind the compose target (S-F).

Index

Constants

View Source
const (
	// UnitRef is the render unit, and runtime target unit, this executor owns.
	UnitRef = "opentofu"
	// TerramateUnitRef is the Core unit under the terramate target: the same
	// OpenTofu root plus its Terramate stack file.
	TerramateUnitRef = "terramate"
	// ArtifactKind and ArtifactFormat identify the executable root artifact.
	ArtifactKind   = "opentofu"
	ArtifactFormat = "hcl"
	ArtifactMode   = "0640"

	// RootDirName is the per-module root directory below the module's native
	// runtime directory: .stackkit/runtime/<runtimeDir>/opentofu.
	RootDirName = "opentofu"
	// ConfigFile, StateFile, and ComposeFile are the root files the
	// executor-state checkpoint captures.
	ConfigFile  = "main.tf"
	StateFile   = "terraform.tfstate"
	ComposeFile = "compose.yaml"
	// StackFile is the Terramate stack file placed beside main.tf.
	StackFile = "stack.tm.hcl"
	// EnvFile is the private interpolation file of a workload project; the
	// workload root references it and never embeds it.
	EnvFile = ".env"
	// PlanFile is the saved plan between plan and apply; it is removed after
	// apply because it embeds the full configuration.
	PlanFile = "tfplan"
	// CLIConfigFile is the generated offline CLI configuration.
	CLIConfigFile = "stackkit.tofurc"
	// MarkerFile binds a root directory to the module that owns it.
	MarkerFile = "stackkit-root.json"
	// ObservationFile holds the last apply observation; its digest is the
	// RuntimeOutcome observation digest.
	ObservationFile = "stackkit-apply-observation.json"

	// RootMarkerSchemaVersion versions the root marker document.
	RootMarkerSchemaVersion = "stackkit.opentofu-root/v1"
)
View Source
const (
	// RootKindWorkload is the executor-materialized root of one standalone
	// workload project: .stackkit/runtime/applications/<project>/opentofu.
	RootKindWorkload = "workload"
	// RootKindModule is the executor-materialized contract root of one edge
	// or federation owner: .stackkit/runtime/modules/<moduleRef>/opentofu.
	RootKindModule = "module"

	// ApplicationsDir and ModulesDir are the runtime subtrees of the
	// executor-materialized roots (terramatestackgraph runtime roots).
	ApplicationsDir = "applications"
	ModulesDir      = "modules"
)

Root kinds. Core roots carry no kind in their marker (P1.1 layout).

Variables

This section is empty.

Functions

func ModuleRootRelativePath

func ModuleRootRelativePath(moduleRef string) (string, error)

ModuleRootRelativePath is the contract root of one edge or federation owner module, the stack graph's runtimeRoot for it.

func RenderContractRoot

func RenderContractRoot(target runtimeexecutor.RuntimeTarget, contract runtimeexecutor.Artifact) ([]byte, error)

RenderContractRoot renders the contract root of one owner: OpenTofu state records the digest of the contract artifact the owner applied, and a new contract replaces the record.

func RenderWorkloadRoot

func RenderWorkloadRoot(prepared runtimeexecutorlocal.NativeWorkloadCompose) ([]byte, error)

RenderWorkloadRoot renders the wrapper root of one prepared workload project: the byte-identical Compose payload, the native project name, and a reference to the private .env (never its content).

func RootRelativePath

func RootRelativePath(runtimeDir string) (string, error)

RootRelativePath returns the slash-separated workspace-relative root of the module whose native runtime directory is runtimeDir.

func WorkloadRootRelativePath

func WorkloadRootRelativePath(project string) (string, error)

WorkloadRootRelativePath is the root of the standalone workload project stackkit-<workloadRef>-<nodeRef>, the stack graph's runtimeRoot for it.

Types

type Authority

type Authority struct {
	ProviderContractHash string
	ModuleContractHash   string
	HealthContractHashes map[string]string
}

Authority is the factory-owned trust for one prepared target.

type ContractRootExecutor

type ContractRootExecutor struct {
	// contains filtered or unexported fields
}

ContractRootExecutor gives a native owner that has no Compose project (the Cloud public edge, the Modern federation link, and the bridge origin mTLS owner) a Terramate-visible OpenTofu root. Under the compose target it is the native executor, byte for byte. Under opentofu and terramate the native owner operation runs first, unchanged; after it succeeds the executor writes .stackkit/runtime/modules/<moduleRef>/opentofu/main.tf, a root with one terraform_data resource whose triggers_replace is the digest of the owner's contract artifact, and applies it, so OpenTofu state records the contract the owner applied. The root starts no process: StackKits has no safe CLI entrypoint that re-applies one owner from a local-exec.

func NewContractRootExecutor

func NewContractRootExecutor(native runtimeexecutor.Executor, runtime Runtime) *ContractRootExecutor

NewContractRootExecutor wraps one prepared native owner executor.

func (*ContractRootExecutor) Execute

func (e *ContractRootExecutor) Execute(ctx context.Context, request runtimeexecutor.ExecutionRequest) (runtimeexecutor.ExecutionOutcome, error)

Execute runs the native owner and, under an OpenTofu target, records its applied contract in the owner's contract root.

func (*ContractRootExecutor) Identity

func (e *ContractRootExecutor) Identity() runtimeexecutor.ExecutorIdentity

Identity is the native owner's identity: the wrapper adds no authority.

type Executor

type Executor struct {
	// contains filtered or unexported fields
}

Executor realizes exactly one module's OpenTofu root.

func NewExecutor

func NewExecutor(identity runtimeexecutor.ExecutorIdentity, binding runtimeexecutorlocal.LocalTargetBinding, authority Authority, module ModuleBinding, runtime Runtime) *Executor

NewExecutor binds one prepared target scope to the host runtime.

func (*Executor) Execute

func (e *Executor) Execute(ctx context.Context, request runtimeexecutor.ExecutionRequest) (runtimeexecutor.ExecutionOutcome, error)

Execute writes the root, runs init, plan, and apply offline, and verifies the module. It never refreshes only, never replaces, and never destroys.

func (*Executor) Identity

func (e *Executor) Identity() runtimeexecutor.ExecutorIdentity

type ModuleBinding

type ModuleBinding struct {
	ProviderRef    string
	ModuleRef      string
	WorkloadRef    string
	RuntimeDir     string
	ComposeProject string
}

ModuleBinding is one catalog module the OpenTofu executor may realize. The runtime directory and Compose project are the native executor's, so the OpenTofu root and the native fallback manage the same containers.

func DefaultModuleBindings

func DefaultModuleBindings() []ModuleBinding

DefaultModuleBindings is the closed list of modules whose OpenTofu unit is executable today. Every entry has a native Verify owner in runtimeexecutorlocal.NativeComposeRuntime. P1.2 and P1.3 extend this list when they add OpenTofu units for further modules (workload bundles, Modern sites); a module without a native Verify owner needs one first.

func (ModuleBinding) Validate

func (b ModuleBinding) Validate() error

Validate rejects incomplete or non-portable bindings.

type RootMarker

type RootMarker struct {
	SchemaVersion  string `json:"schemaVersion"`
	ModuleRef      string `json:"moduleRef"`
	InstanceRef    string `json:"instanceRef"`
	RuntimeDir     string `json:"runtimeDir"`
	ComposeProject string `json:"composeProject"`
	// Kind is empty for a Core root, else RootKindWorkload or RootKindModule.
	Kind string `json:"kind,omitempty"`
}

RootMarker is the secret-free identity of one materialized root.

func ReadRootMarker

func ReadRootMarker(rootDir string) (RootMarker, error)

ReadRootMarker reads and validates the marker of one root directory.

type Runtime

type Runtime struct {
	WorkspaceRoot string
	Native        runtimeexecutorlocal.NativeComposeRuntime
	Binary        string
	ProvidersDir  string
	// Timeout bounds each tofu command; zero keeps the wrapper default.
	Timeout time.Duration
}

Runtime is the construction-owned host capability. Binary and ProvidersDir default to the packaged tofu and provider mirror; they are resolved at Execute so a missing package fails only an OpenTofu rollout, never a Compose one.

type WorkloadOperations

type WorkloadOperations struct {
	// contains filtered or unexported fields
}

WorkloadOperations realizes the standalone workload bundles (the ten selected-PaaS applications) through their OpenTofu wrapper root when the request's generation target is opentofu or terramate, and through the native Compose owner otherwise (S-F fallback). Under an OpenTofu target the native preparation materializes the Compose project and its private .env exactly as today; the executor renders main.tf around that Compose file with RenderComposePayloadOpenTofu and runs init, plan, and apply in .stackkit/runtime/applications/<project>/opentofu instead of the native `docker compose up`; the native completion and observation run unchanged.

func NewWorkloadOperations

func NewWorkloadOperations(native runtimeexecutorlocal.NativeWorkloadComposeOperations, runtime Runtime) (*WorkloadOperations, error)

NewWorkloadOperations wraps the native standalone Compose owner. The runtime's Native field is not used: workload verification is the native owner's ObserveWorkload.

func (*WorkloadOperations) ApplyWorkload

ApplyWorkload applies one workload bundle.

func (*WorkloadOperations) ObserveWorkload

ObserveWorkload is the native readback under every target.

func (*WorkloadOperations) ValidateWorkloadObservation

ValidateWorkloadObservation keeps the native semantic readback contract.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL