crossplane-cuefn

crossplane-cuefn

Define a Crossplane platform API as a single CUE module — its schema and the Kubernetes resources it renders — and crossplane-cuefn gives you both halves of running it:

• the cuefn CLI generates the XRD and packages an installable Crossplane Configuration from that module, and
• a Crossplane v2 composition function pulls the same module from an OCI registry at runtime and renders your resources against each composite resource (XR).

One source of truth, in CUE, for both the API you install and the resources it produces — no Go, no patch-and-transform pipelines.

Status: early development. Every surface works end to end and is covered by CI, but expect them to change.

Install

Homebrew (macOS/Linux):

brew install meigma/tap/cuefn

Scoop (Windows):

scoop bucket add meigma https://github.com/meigma/scoop-bucket && scoop install meigma/cuefn

mise (installs from GitHub releases, verifying their attestations):

mise use -g "github:meigma/crossplane-cuefn[bin=cuefn]"

Nix:

nix profile install github:meigma/crossplane-cuefn

Shell (Linux/macOS — verifies checksums, and SLSA provenance when gh is present):

curl -fsSL https://raw.githubusercontent.com/meigma/crossplane-cuefn/master/install.sh | bash

Go:

go install github.com/meigma/crossplane-cuefn/cmd/cuefn@latest

See installing the CLI for prebuilt archives and provenance verification. The composition function is published as a signed Crossplane Function package at ghcr.io/meigma/function-cuefn, which Crossplane pulls automatically when you install a generated Configuration.

Example

One module is the whole platform API — the schema and the transform that renders its resources:

// app.cue
package app

// #API and #Spec are the API: its identity, and a closed, defaulted spec schema.
#API: {
	group:   "platform.example.com"
	version: "v1alpha1"
	kind:    "XApp"
	plural:  "xapps"
}
#Spec: {
	image:    string
	replicas: *1 | int & >=1 & <=10 // defaults to 1, bounded 1–10
}

// out.* is the transform: the engine fills `out.input` from each XR, and reads
// back the resources you return.
out: {
	input: {
		spec: #Spec
		metadata: name: string | *"app"
	}
	resources: deployment: object: {
		apiVersion: "apps/v1"
		kind:       "Deployment"
		metadata: name: input.metadata.name
		spec: {
			replicas: input.spec.replicas
			selector: matchLabels: app: input.metadata.name
			template: {
				metadata: labels: app: input.metadata.name
				spec: containers: [{name: "app", image: input.spec.image}]
			}
		}
	}
}

Render it against an XR locally — no cluster, no registry:

cuefn render example.com/app@v0 --dir . --xr xr.yaml

Then package it as an installable Configuration — the XRD, a Composition wired to the function, and the function as a dependency — in one command:

cuefn publish example.com/app@v0.1.0 \
  --dir . --publish-module \
  --metadata org.opencontainers.image.source=https://github.com/example/platform-modules \
  --package registry.example.com/xapp:v0.1.0

kubectl apply that package as a Crossplane Configuration and the XApp API is live on your cluster. The Quickstart walks the whole loop — module to a running XR — step by step.

Commands

See the CLI reference for every flag.

Documentation

Full documentation: https://meigma.github.io/crossplane-cuefn

• Quickstart — write a module, publish it, install a Configuration, and watch an XR render.
• How-to guides — one task at a time: render locally, generate an XRD, validate, publish, serve the function, and configure the runtime.
• Reference — the module contract, the CLI, configuration & environment, and the Input CRD.
• Explanation — the design: one module / two outputs, the digest lock-step, and the lean runtime image.

Contributing

See CONTRIBUTING.md for local setup, the toolchain, and the release process. Security issues go through SECURITY.md.

License

Licensed under either of Apache License, Version 2.0 or MIT license at your option (SPDX: Apache-2.0 OR MIT). Unless you state otherwise, any contribution you submit for inclusion in this project shall be dual licensed as above, without any additional terms or conditions.