Documentation
¶
Overview ¶
Package plugins loads Extism WASM plugins for honey (CUE transforms, custom steps, secret ref backends, and local hooks). Enable via honey config plugins.enabled.
Index ¶
- Constants
- func KVSessionFromContext(ctx context.Context) (*stepkv.Session, bool)
- func PluginsFromConfig(f *config.File) config.PluginsEffective
- func RunKVForTest(ctx context.Context, in apiv1.KVInput) apiv1.KVOutput
- func WithKVSession(ctx context.Context, sess *stepkv.Session) context.Context
- type Info
- type Manager
- func (m *Manager) Call(ctx context.Context, pluginID, export string, in, out any) error
- func (m *Manager) Close() error
- func (m *Manager) Enabled() bool
- func (m *Manager) ExecuteStep(ctx context.Context, pluginID, action string, config json.RawMessage, ...) (apiv1.ExecuteStepOutput, error)
- func (m *Manager) List() []Info
- func (m *Manager) OnStepResult(ctx context.Context, pluginID, action string, config json.RawMessage, ...) (apiv1.OnStepResultOutput, error)
- func (m *Manager) PluginIDsWithCapability(capability string) []string
- func (m *Manager) SecretRefBackends() []ref.Backend
- func (m *Manager) SecretRefPrefixes() []string
- func (m *Manager) TransformCue(ctx context.Context, cueBytes []byte, hostsCount int) ([]byte, error)
- type Manifest
- type SecretBackend
Constants ¶
const ( CapCueTransform = "cue_transform" CapCustomStep = "custom_step" CapSecret = "secret" CapStackUnwrap = "stack_unwrap" CapHook = "hook" )
Capability names registered in plugin.yaml.
Variables ¶
This section is empty.
Functions ¶
func KVSessionFromContext ¶
KVSessionFromContext returns the session bound for this plugin call, if any.
func PluginsFromConfig ¶
func PluginsFromConfig(f *config.File) config.PluginsEffective
PluginsFromConfig builds effective settings from honey config file.
func RunKVForTest ¶
RunKVForTest exposes runKV for unit tests.
Types ¶
type Info ¶
type Info struct {
ID string `json:"id"`
Version string `json:"version"`
Capabilities []string `json:"capabilities"`
Path string `json:"path"`
SecretRefPrefixes []string `json:"secret_ref_prefixes,omitempty"`
AllowHostExec bool `json:"allow_host_exec,omitempty"`
AllowKV bool `json:"allow_kv,omitempty"`
AllowedHosts []string `json:"allowed_hosts,omitempty"`
AllowedPaths map[string]string `json:"allowed_paths,omitempty"`
AllowedEnv []string `json:"allowed_env,omitempty"`
MaxHTTPResponseBytes int64 `json:"max_http_response_bytes,omitempty"`
}
Info describes a loaded plugin for listing.
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager loads Extism WASM plugins and routes capability calls.
func LoadFromDir ¶
LoadFromDir is a test helper that loads plugins from a directory without config allowlist.
func NewManager ¶
NewManager loads plugins from cfg. When plugins are disabled, returns a manager with no plugins.
func (*Manager) Call ¶
Call invokes export on pluginID with JSON input; decodes JSON output or returns plugin error string.
func (*Manager) ExecuteStep ¶
func (m *Manager) ExecuteStep(ctx context.Context, pluginID, action string, config json.RawMessage, stepIndex int, hostJSON []byte, env map[string]string, execute, secretsDry bool, kvSession *stepkv.Session) (apiv1.ExecuteStepOutput, error)
ExecuteStep runs the execute_step export for a plugin step on one host. kvSession is optional; when non-nil it is bound for allow_kv plugins via the kv host function.
func (*Manager) OnStepResult ¶
func (m *Manager) OnStepResult(ctx context.Context, pluginID, action string, config json.RawMessage, in apiv1.OnStepResultInput, kvSession *stepkv.Session) (apiv1.OnStepResultOutput, error)
OnStepResult runs the on_step_result export for a local hook plugin.
func (*Manager) PluginIDsWithCapability ¶
PluginIDsWithCapability returns plugin IDs that declare the capability.
func (*Manager) SecretRefBackends ¶
SecretRefBackends returns ref.Backend adapters for plugins with the secret capability.
func (*Manager) SecretRefPrefixes ¶
SecretRefPrefixes returns all registered secret ref prefixes from secret-capable plugins.
type Manifest ¶
type Manifest struct {
ID string `yaml:"id"`
Version string `yaml:"version"`
Capabilities []string `yaml:"capabilities"`
SecretRefPrefixes []string `yaml:"secret_ref_prefixes,omitempty"`
AllowHostExec bool `yaml:"allow_host_exec,omitempty"`
AllowKV bool `yaml:"allow_kv,omitempty"`
AllowedEnv []string `yaml:"allowed_env,omitempty"`
AllowedHosts []string `yaml:"allowed_hosts,omitempty"`
AllowedPaths map[string]string `yaml:"allowed_paths,omitempty"`
MaxHTTPResponseBytes int64 `yaml:"max_http_response_bytes,omitempty"`
Order int `yaml:"order,omitempty"`
}
Manifest describes a plugin bundle (plugin.yaml next to plugin.wasm).
type SecretBackend ¶
type SecretBackend struct {
// contains filtered or unexported fields
}
SecretBackend resolves secret refs via a WASM plugin prefix.
func (SecretBackend) Handles ¶
func (b SecretBackend) Handles(ref string) bool
Handles implements ref.Backend.
Source Files
Directories