v0.7.12 — Gateway API, serve, hook args, SSA, and codebase restructure

1 min read

Gateway API

Three endpoints when gateway.api.enabled: true:

  • POST /api/v1/apply — apply a CR or flat intent; returns accepted, pollUrl
  • GET /api/v1/resources/{kind}/{ns}[/{name}] — read or list CRs without kubeconfig
  • DELETE /api/v1/resources/{kind}/{ns}/{name} — delete a CR

All routes require a bearer token declared in gateway.api.auth.tokens.

Serve layer — developer self-service

serve.enabled: true surfaces a [+ Create] form in the Control Center. Fields, labels, and hints come from serve.fields. serve.name and serve.namespace resolve server-side from the intent — callers never supply them directly.

Target mode: callers can submit {"target": "myoperator", ...fields} instead of a full CR. The gateway builds the CR.

Hook and constructor args

Per-CRD configuration passed to hooks and constructors at reconcile time, with full template support:

operatorBox:
  reconciler:
    hooks:
      args:
        region: '{{ default "us-east-1" .spec.region }}'

Read via kube.Args().

Notes in validation and mutation rules

User-defined notes resolve as template expressions inside validation.rules and mutation.rules, at reconcile time and at admission time.

Conditional validation and mutation rules

when: and or: on validation.rules and mutation.rules entries. Non-matching rules are skipped entirely — at reconcile time and admission time.

Server-Side Apply

All reconcilable resource types now use SSA (fieldManager: orkestra-runtime). Eliminates false-positive drift from Kubernetes-injected defaults.