v0.7.14 — Serve aliases, provenance, OIDC tokens, and local intent testing

2 min read

Serve aliases

A CRD can expose multiple named entry points with independent token scopes and response configs:

serve:
  target:
    primary:
      primary: true
    preview:
      tokens:
        preview-team:
          permissions:
            global: ["apply"]

Each alias accepts the same apply API. Once a CR is created via an alias, only that alias can update it — pass ?override=true to switch surfaces.

Intent provenance annotations

Every gateway-applied CR is stamped with:

  • orkestra.orkspace.io/serve-target — primary target name
  • orkestra.orkspace.io/serve-alias — alias name, or "" for primary
  • orkestra.orkspace.io/serve-source — verified OIDC sub claim, or "" for static token

Seven built-in notes expose these in template expressions and when: conditions: getServeTarget, getServeAlias, getServeSource, hasServeTarget, hasServeAlias, hasServeSource, isDirectApply.

OIDC token authentication

Short-lived tokens from GitHub Actions, GitLab CI, HashiCorp Vault, or any OIDC provider:

gateway:
  api:
    auth:
      tokens:
        - name: gh-ci
          githubOIDC:
            allow:
              repository: myorg/payments
              ref: refs/heads/main

ork token list / ork token verify / ork token probe inspect and test token entries locally without a running gateway.

ork serve play / ork gate / ork serve apply

  • ork serve play — runs the full apply chain locally from an intent file (target resolution, token check, CR construction, admission, response). Add --simulate to test the result end-to-end.
  • ork gate -f katalog.yaml --cr cr.yaml — evaluates admission rules locally against a CR.
  • ork serve apply -f intent.yaml --api https://gateway.myorg.io — sends intent to a live gateway.

Serve field translation

Transform caller input before it reaches the CR:

serve:
  fields:
    schedule:
      values:
        schedule.minute:     '{{ cronMinute .value }}'
        schedule.hour:       '{{ cronHour   .value }}'
        schedule.dayOfMonth: '{{ cronDom    .value }}'

.value is the raw submitted value. .request is the full intent payload and available in all expression contexts.

fires.reconcile: false

Marks a validation or mutation rule as admission-only — skipped on every reconcile. Use for rules that reference .request.*, which is only present at admission time.

Deprecation timelines and accept gates

lifecycle:
  deprecation:
    timeline:
      from: "2026-01-01"
      to:   "2027-01-01"
    accept:
      beforeEol: true
      eol: true

ork run blocks on deprecated operators until the consuming Komposer explicitly acknowledges them.