v0.7.15 — Artifact signing, gateway webhooks, multi-cluster, simulate --envtest, pre-reconcile gates

2 min read

Artifact signing

Sign and verify patterns via Cosign keyless signing — the OIDC token CI already issues is the credential:

ork push --sign                          # push and sign
ork pattern sign ghcr.io/org/my-op:v1   # sign after push
ork pattern verify ghcr.io/org/my-op:v1
ork push --sign-local                    # push to ttl.sh and sign for local testing

Declare signing policy in the Katalog:

publish:
  signing:
    verify: true
    expectedIdentities:
      - github.com/myorg/payments/.github/workflows/release.yaml@refs/heads/main
  tests:
    e2e: true
    simulate: true

ork pull --verify refuses unsigned artifacts when verify: true is set. Cosign resolves from $PATH, then ~/.orkestra/tools/cosign, then downloads automatically on first use.

Gateway webhook intake

Inbound push-based delivery from GitHub, GitLab, Slack, and generic webhooks — routes through the same target-mode pipeline as POST /api/v1/apply:

gateway:
  webhooks:
    github:
      - name: payments-repo
        path: /webhooks/github/payments
        branch: main
        watch: ["services/*/intent.yaml"]
        secretRef: { name: ork-payments-github-secret, key: secret }
        contentTokenRef: { name: ork-payments-github-app-token, key: token }
    slack:
      - name: platform-workspace
        path: /webhooks/slack
        signingSecretRef: { name: ork-slack-signing-secret, key: secret }
        commands: ["/deploy"]

Webhook names resolve as serve.tokens identities and are stamped as provenance annotations on every CR applied.

ork webhook list and ork webhook play let you inspect and locally test webhook entries without a running cluster or real GitHub/GitLab/Slack account.

Multi-cluster routing

gateway:
  clusters:
    prod:
      endpoint: https://prod.internal:6443
      tokenRef: { name: orkestra-prod, namespace: default, key: token }
      caRef:    { name: orkestra-prod, namespace: default, key: ca.crt }

Route CRDs or targets to named clusters via serve.cluster and serve.target.<name>.cluster. Template expressions resolve at apply time from the intent payload.

  • ork clusters validate — offline validation of cluster config
  • ork clusters check — live connectivity and CRD presence check
  • ork clusters bootstrap — provision least-privilege access on a target cluster

ork simulate --envtest

Run simulate specs against a real kube-apiserver + etcd locally — no cluster, no deployed operator:

ork simulate -f simulate.yaml --envtest

Requires crd: or crdFiles: in the spec. Envtest binaries download automatically to ~/.ork/envtest-bins on first use.

Pre-reconcile gates

Drop objects before they reach the reconciler, at two points in the pipeline:

operatorBox:
  preReconcile:
    enqueueGate:      # informer layer — no health state change
      when:
        - field: "{{ .spec.active }}"
          equals: "true"
    reconcileGate:    # kordinator layer — sets health to gated
      or:
        - field: "{{ .spec.environment }}"
          equals: "production"
        - field: "{{ .spec.environment }}"
          equals: "staging"

Both gates support external: calls and failPolicy:.

ork gate run — local gateway for Serve development

ork gate run -f katalog.yaml starts the gateway in HTTP-only mode for testing serve routing and intent apply flows locally without a cluster.

Breaking: kubeclient.KubeClient renamed to kubeclient.Interface

Update any typed operator code referencing kubeclient.KubeClient to kubeclient.Interface.