Changes we discuessed at Zipper on 7/17

.claude/settings.json

@@ -1,13 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "Bash(cd:*)",
-      "Bash(holos:*)",
-      "Bash(cue:*)",
-      "Bash(git commit:*)",
-      "Bash(git add:*)",
-      "Bash(make:*)"
-    ],
-    "deny": []
-  }
-}

.cspell.json

@@ -5,358 +5,48 @@
     "mdx"
   ],
   "words": [
-    "acmesolver",
-    "acraccesstoken",
-    "acraccesstokens",
-    "admissionregistration",
-    "alertmanager",
-    "alertmanagers",
-    "anchore",
-    "anthos",
-    "apiextensions",
-    "apimachinery",
-    "apiobjects",
-    "apiservers",
     "applicationset",
-    "applicationsets",
-    "appproject",
-    "appprojects",
     "argoproj",
-    "argumentless",
-    "authcode",
-    "authorizationpolicies",
-    "authorizationpolicy",
     "authpolicy",
     "authproxy",
     "authroutes",
-    "autoload",
-    "automount",
-    "automounting",
-    "autoscaler",
-    "balancereader",
-    "blackbox",
     "buildplan",
-    "buildplans",
-    "Buildx",
-    "builtinpluginloadingoptions",
-    "cachedir",
-    "cadvisor",
     "cainjector",
-    "CAROOT",
-    "certificaterequest",
-    "certificaterequests",
-    "certificatesigningrequests",
-    "chartmuseum",
-    "clientset",
-    "clsx",
-    "clusterexternalsecret",
-    "clusterexternalsecrets",
     "clusterissuer",
-    "clusterissuers",
-    "clusterrole",
-    "clusterrolebinding",
-    "clustersecretstore",
-    "clustersecretstores",
-    "clusterwide",
-    "Cmds",
-    "CNCF",
-    "CODEOWNERS",
-    "compinit",
-    "componentconfig",
-    "configdir",
-    "configmap",
-    "configmapargs",
-    "connectrpc",
     "cookiesecret",
     "coredns",
-    "corev",
-    "CRD's",
     "crds",
-    "creds",
     "crossplane",
-    "crunchydata",
-    "ctxt",
-    "cuecontext",
-    "cuelang",
-    "customresourcedefinition",
-    "daemonset",
-    "deploymentruntimeconfig",
-    "destinationrule",
-    "destinationrules",
-    "devel",
-    "devicecode",
-    "distroless",
     "dnsmasq",
     "dscacheutil",
-    "ecrauthorizationtoken",
-    "ecrauthorizationtokens",
-    "edns",
-    "endpointslices",
-    "entgo",
-    "envoyfilter",
-    "envoyfilters",
-    "errdetails",
-    "errgroup",
-    "etcdsnapshotfiles",
-    "externalsecret",
-    "externalsecrets",
-    "fctr",
-    "fieldmaskpb",
-    "fieldspec",
     "flushcache",
-    "fluxcd",
-    "fsys",
-    "fullname",
-    "gatewayclass",
-    "gatewayclasses",
-    "gcraccesstoken",
-    "gcraccesstokens",
-    "gendoc",
-    "generationbehavior",
-    "generatorargs",
-    "generatoroptions",
-    "genproto",
-    "ggnpl",
-    "ghaction",
-    "githubaccesstoken",
-    "githubaccesstokens",
     "gitops",
-    "GOBIN",
-    "godoc",
-    "golangci",
-    "gomarkdoc",
-    "googleapis",
-    "goreleaser",
-    "gotypesalias",
-    "grpcreflect",
-    "grpcroute",
-    "grpcroutes",
-    "grpcurl",
-    "hcfg",
-    "healthchecks",
-    "healthz",
-    "helmchartargs",
-    "helmchartconfigs",
-    "helmcharts",
-    "Hiera",
     "holos",
-    "holoslogger",
-    "horizontalpodautoscaler",
-    "horizontalpodautoscalers",
-    "Hostaliases",
-    "Hostnames",
-    "htpasswd",
     "httpbin",
-    "httproute",
-    "httproutes",
-    "iampolicygenerator",
-    "incpatch",
     "Infima",
-    "intstr",
-    "isatty",
     "istiod",
-    "jbrx",
-    "jeffmccune",
     "jetstack",
-    "jiralert",
-    "Jsonnet",
-    "Kargo",
-    "kfbh",
     "killall",
     "kubeadm",
     "kubeconfig",
-    "kubelet",
-    "kubelogin",
-    "kubernetesobjects",
-    "kubeversion",
-    "Kustomization",
-    "Kustomizations",
     "kustomize",
-    "kustomizebuild",
-    "kvpairsources",
-    "labeldrop",
-    "labelmap",
-    "ldflags",
-    "leaderelection",
-    "ledgerwriter",
     "libnss",
-    "limitranges",
-    "livez",
     "loadbalancer",
-    "loadrestrictions",
-    "logfmt",
-    "lxnl",
-    "mattn",
-    "mccutchen",
-    "metav",
-    "mindmap",
-    "mktemp",
-    "msqbn",
-    "mtls",
-    "Multicluster",
-    "mutatingwebhookconfiguration",
-    "mutatingwebhookconfigurations",
-    "mvdan",
     "mxcl",
-    "mychart",
     "myhostname",
-    "myRegistrKeySecretName",
-    "mysecret",
-    "nameofclusterrole",
     "nameserver",
-    "namespacedname",
-    "ndots",
-    "networkpolicies",
-    "nodename",
-    "nolint",
-    "oauthproxy",
-    "objectmap",
-    "objectmeta",
-    "omitempty",
-    "organizationconnect",
-    "orgid",
-    "otelconnect",
-    "outfile",
-    "overriden",
     "Parentspanid",
-    "patchstrategicmerge",
-    "pcfg",
-    "pcjc",
-    "peerauthentication",
-    "peerauthentications",
-    "persistentvolumeclaim",
-    "persistentvolumeclaims",
-    "persistentvolumes",
-    "pflag",
-    "pgadmin",
-    "pgupgrade",
-    "pipefail",
-    "PKCE",
-    "platformconnect",
-    "pluginconfig",
-    "pluginrestrictions",
-    "podcli",
-    "poddisruptionbudget",
-    "poddisruptionbudgets",
-    "podinfo",
-    "podmonitor",
-    "portmapping",
-    "postgrescluster",
-    "privs",
-    "prometheuses",
-    "promhttp",
-    "protobuf",
-    "protojson",
-    "providerconfig",
-    "proxyconfig",
-    "proxyconfigs",
-    "Pulumi",
-    "pushgateway",
-    "pushsecret",
-    "pushsecrets",
     "putenv",
-    "qjbp",
     "quickstart",
-    "QVRFLS",
-    "readyz",
-    "referencegrant",
-    "referencegrants",
-    "Registr",
-    "replacementfield",
-    "replicasets",
-    "replicationcontrollers",
-    "requestauthentication",
-    "requestauthentications",
-    "resourcequotas",
     "retryable",
-    "rogpeppe",
-    "rolebinding",
-    "rootfs",
-    "ropc",
-    "sboms",
-    "seccomp",
-    "secretargs",
-    "SECRETKEY",
-    "secretstore",
-    "secretstores",
-    "serverlb",
-    "serverside",
-    "serviceaccount",
-    "servicebindings",
-    "serviceentries",
-    "serviceentry",
-    "servicemonitor",
-    "sigstore",
-    "somevalue",
-    "SOMEVAR",
-    "sortoptions",
     "spanid",
     "spiffe",
-    "stackdriver",
     "startupapicheck",
-    "statefulset",
-    "statefulsets",
-    "stefanprodan",
-    "storageclasses",
-    "streamwatcher",
-    "stretchr",
-    "struct",
-    "structpb",
-    "subcharts",
-    "subjectaccessreviews",
-    "svclb",
-    "sysfs",
-    "systemconnect",
-    "tablewriter",
-    "templatable",
-    "testscript",
-    "testutil",
-    "thanos",
     "Tiltfile",
-    "timestamppb",
-    "Timoni",
-    "tlsclientconfig",
-    "tokencache",
-    "Tokener",
-    "tolerations",
-    "TOPLEVEL",
     "Traceid",
     "traefik",
-    "transactionhistory",
-    "tsdb",
-    "txtar",
-    "typemeta",
-    "udev",
     "uibutton",
-    "Unmarshal",
-    "unmarshals",
-    "unshallow",
-    "unstage",
-    "untar",
-    "upbound",
-    "Upsert",
     "urandom",
-    "usecases",
-    "userconnect",
-    "userdata",
-    "userservice",
-    "validatingwebhookconfiguration",
-    "validatingwebhookconfigurations",
-    "vaultdynamicsecret",
-    "vaultdynamicsecrets",
-    "virtualservice",
-    "virtualservices",
-    "volumeattachments",
-    "wasmplugin",
-    "wasmplugins",
-    "workdir",
-    "workloadentries",
-    "workloadentry",
-    "workloadgroup",
-    "workloadgroups",
-    "yournamespace",
-    "zerolog",
-    "zitadel",
-    "ztunnel"
+    "zitadel"
   ]
 }

.envrc

@@ -1,7 +0,0 @@
-if ! use flake .#default --accept-flake-config --print-build-logs
-then
-  echo "nix flake could not be built; update flake.nix and run direnv allow/reload" >&2
-fi
-
-watch_file nix/*.nix
-watch_file flake.nix

.github/ISSUE_TEMPLATE/bug-report.md

@@ -1,131 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: NeedsInvestigation, Triage
-assignees: ''
----
-
-<!--
-Please answer these questions before submitting your issue. Thanks!
-To ask questions, see https://github.com/holos-run/holos/discussions
--->
-
-### What version of holos are you using (`holos --version`)?
-
-```
-0.0.0
-```
-
-### Does this issue reproduce with the latest release?
-
-<!--
-Get the latest release with:
-
-    brew install holos-run/tap/holos
-
-Or see https://holos.run/docs/v1alpha5/tutorial/setup/
--->
-
-### What did you do?
-
-<!--
-Please provide a testscript that should pass, but does not because of the bug.
-See the below example.
-
-You can create a txtar from a directory with:
-
-  holos txtar ./path/to/dir
-
-Refer to: https://github.com/rogpeppe/go-internal/tree/master/cmd/testscript
--->
-
-Steps to reproduce:
-
-```shell
-testscript -v -continue <<EOF
-```
-
-```txtar
-# Have: an error related to the imported Kustomize schemas.
-# Want: holos show buildplans to work.
-exec holos --version
-exec holos init platform v1alpha5 --force
-# remove the fix to trigger the bug
-rm cue.mod/pkg/sigs.k8s.io/kustomize/api/types/var.cue
-# want a BuildPlan shown
-exec holos show buildplans
-cmp stdout buildplan.yaml
-# want this error to go away
-! stderr 'cannot convert non-concrete value string'
--- buildplan.yaml --
-kind: BuildPlan
--- platform/example.cue --
-package holos
-
-Platform: Components: example: {
-	name: "example"
-	path: "components/example"
-}
--- components/example/example.cue --
-package holos
-
-import "encoding/yaml"
-
-holos: Component.BuildPlan
-
-Component: #Kustomize & {
-	KustomizeConfig: Kustomization: patches: [
-		{
-			target: kind: "CustomResourceDefinition"
-			patch: yaml.Marshal([{
-				op:    "add"
-				path:  "/metadata/annotations/example"
-				value: "example-value"
-			}])
-		},
-	]
-}
-```
-```shell
-EOF
-```
-
-### What did you expect to see?
-
-The testscript should pass.
-
-### What did you see instead?
-
-The testscript fails because of the bug.
-
-```txt
-# Have: an error related to the imported Kustomize schemas.
-# Want: holos show buildplans to work. (0.168s)
-> exec holos --version
-[stdout]
-0.100.1-2-g9b10e23-dirty
-> exec holos init platform v1alpha5 --force
-# remove the fix to trigger the bug (0.000s)
-> rm cue.mod/pkg/sigs.k8s.io/kustomize/api/types/var.cue
-# want a BuildPlan shown (0.091s)
-> exec holos show buildplans
-[stderr]
-could not run: holos.spec.artifacts.0.transformers.0.kustomize.kustomization.patches.0.target.name: cannot convert non-concrete value string at builder/v1alpha5/builder.go:218
-holos.spec.artifacts.0.transformers.0.kustomize.kustomization.patches.0.target.name: cannot convert non-concrete value string:
-    $WORK/cue.mod/gen/sigs.k8s.io/kustomize/api/types/var_go_gen.cue:33:2
-[exit status 1]
-FAIL: <stdin>:8: unexpected command failure
-> cmp stdout buildplan.yaml
-diff stdout buildplan.yaml
---- stdout
-+++ buildplan.yaml
-@@ -0,0 +1,1 @@
-+kind: BuildPlan
-
-FAIL: <stdin>:9: stdout and buildplan.yaml differ
-# want this error to go away (0.000s)
-> ! stderr 'cannot convert non-concrete value string'
-FAIL: <stdin>:11: unexpected match for `cannot convert non-concrete value string` found in stderr: cannot convert non-concrete value string
-failed run
-```

.github/workflows.disabed/test.yaml

@@ -13,7 +13,7 @@ permissions:
 
 jobs:
   test:
-    runs-on: ubuntu-latest
+    runs-on: gha-rs
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
@@ -28,16 +28,19 @@ jobs:
         with:
           go-version: stable
 
+      - name: Install Packages
+        run: sudo apt update && sudo apt -qq -y install git curl zip unzip tar bzip2 make
+
       - name: Set up Helm
         uses: azure/setup-helm@v4
-        with:
-          version: '3.17.3'
 
       - name: Set up Kubectl
-        uses: azure/setup-kubectl@v4
+        uses: azure/setup-kubectl@v3
 
-      - name: Install holos
-        run: make install
+      - name: Install Tools
+        run: |
+          set -x
+          make tools
 
       - name: Test
         run: ./scripts/test

.github/workflows/container.yaml

@@ -1,143 +0,0 @@
-name: Container
-
-# Only allow actors with write permission to the repository to trigger this
-# workflow.
-permissions:
-  contents: write
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-    inputs:
-      git_ref:
-        description: 'Git ref to build (e.g., refs/tags/v1.2.3, refs/heads/main)'
-        required: true
-        type: string
-
-jobs:
-  buildx:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      attestations: write
-      id-token: write
-    steps:
-      - name: Set tag from trigger event
-        id: opts
-        run: |
-          if [ "${{ github.event_name }}" = "workflow_dispatch" ]; then
-            echo "ref=${{ inputs.git_ref }}" >> $GITHUB_OUTPUT
-          else
-            echo "ref=${GITHUB_REF}" >> $GITHUB_OUTPUT
-          fi
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ steps.opts.outputs.ref }}
-      - name: SHA
-        id: sha
-        run: echo "sha=$(/usr/bin/git log -1 --format='%H')" >> $GITHUB_OUTPUT
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-      - name: Fetch tags
-        run: git fetch --prune --unshallow --tags
-      - name: Set Tags
-        id: tags
-        run: |
-          echo "detail=$(/usr/bin/git describe --tags HEAD)" >> $GITHUB_OUTPUT
-          echo "suffix=$(test -n "$(git status --porcelain)" && echo '-dirty' || echo '')" >> $GITHUB_OUTPUT
-          echo "tag=$(/usr/bin/git describe --tags HEAD)$(test -n "$(git status --porcelain)" && echo '-dirty' || echo '')" >> $GITHUB_OUTPUT
-
-      - name: Login to ghcr.io
-        uses: docker/login-action@v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-      - name: Build and push container images
-        id: build-and-push
-        uses: docker/build-push-action@v6
-        with:
-          context: .
-          platforms: linux/amd64,linux/arm64
-          push: true
-          tags: |
-            ghcr.io/holos-run/holos:${{ steps.tags.outputs.tag }}
-            ghcr.io/holos-run/holos:${{ steps.sha.outputs.sha }}${{ steps.tags.outputs.suffix }}
-      - name: Setup Cosign to sign container images
-        uses: sigstore/cosign-installer@v3.7.0
-      - name: Sign with GitHub OIDC Token
-        env:
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
-        run: |
-          cosign sign --yes ghcr.io/holos-run/holos:${{ steps.tags.outputs.tag }}@${DIGEST}
-          cosign sign --yes ghcr.io/holos-run/holos:${{ steps.sha.outputs.sha }}${{ steps.tags.outputs.suffix }}@${DIGEST}
-
-      - uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          owner: ${{ github.repository_owner }}
-          app-id: ${{ vars.GORELEASER_APP_ID }}
-          private-key: ${{ secrets.GORELEASER_APP_PRIVATE_KEY }}
-      - name: Get GitHub App User ID
-        id: get-user-id
-        run: echo "user-id=$(gh api "/users/${{ steps.app-token.outputs.app-slug }}[bot]" --jq .id)" >> "$GITHUB_OUTPUT"
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-      - run: |
-          git config --global user.name '${{ steps.app-token.outputs.app-slug }}[bot]'
-          git config --global user.email '${{ steps.get-user-id.outputs.user-id }}+${{ steps.app-token.outputs.app-slug }}[bot]@users.noreply.github.com'
-      - name: Update holos-run/holos-action
-        env:
-          IMAGE: ghcr.io/holos-run/holos:v0.102.1
-          VERSION: ${{ steps.tags.outputs.tag }}
-          USER_ID: ${{ steps.get-user-id.outputs.user-id }}
-          TOKEN: ${{ steps.app-token.outputs.token }}
-        run: |
-          set -euo pipefail
-          git clone "https://github.com/holos-run/holos-action"
-          cd holos-action
-          git remote set-url origin https://${USER_ID}:${TOKEN}@github.com/holos-run/holos-action
-          docker pull --quiet "${IMAGE}"
-          docker run -v $(pwd):/app --workdir /app --rm "${IMAGE}"  \
-            holos cue export --out yaml action.cue -t "version=${VERSION}" > action.yml
-          git add action.yml
-          git commit -m "ci: update holos to ${VERSION} - https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}" || (echo "No changes to commit"; exit 0)
-          git push origin HEAD:main HEAD:v0 HEAD:v1
-
-      - name: Login to quay.io
-        uses: docker/login-action@v3
-        with:
-          registry: quay.io
-          username: ${{ secrets.QUAY_USER }}
-          password: ${{ secrets.QUAY_TOKEN }}
-      - name: Push to quay.io
-        env:
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
-        run: |
-          # docker push quay.io/holos-run/holos:${{ steps.tags.outputs.tag }}
-          docker pull --quiet ghcr.io/holos-run/holos:${{ steps.tags.outputs.tag }}@${DIGEST}
-          docker tag ghcr.io/holos-run/holos:${{ steps.tags.outputs.tag }}@${DIGEST} \
-                     quay.io/holos-run/holos:${{ steps.tags.outputs.tag }}
-          docker push quay.io/holos-run/holos:${{ steps.tags.outputs.tag }}
-
-          docker pull --quiet ghcr.io/holos-run/holos:${{ steps.sha.outputs.sha }}${{ steps.tags.outputs.suffix }}@${DIGEST}
-          docker tag ghcr.io/holos-run/holos:${{ steps.sha.outputs.sha }}${{ steps.tags.outputs.suffix }}@${DIGEST} \
-                     quay.io/holos-run/holos:${{ steps.sha.outputs.sha }}${{ steps.tags.outputs.suffix }}
-          docker push quay.io/holos-run/holos:${{ steps.sha.outputs.sha }}${{ steps.tags.outputs.suffix }}
-      - name: Sign quay.io image
-        env:
-          DIGEST: ${{ steps.build-and-push.outputs.digest }}
-        run: |
-          cosign sign --yes quay.io/holos-run/holos:${{ steps.tags.outputs.tag }}@${DIGEST}
-          cosign sign --yes quay.io/holos-run/holos:${{ steps.sha.outputs.sha }}${{ steps.tags.outputs.suffix }}@${DIGEST}
-
-    outputs:
-      tag: ${{ steps.tags.outputs.tag }}
-      detail: ${{ steps.tags.outputs.detail }}

.github/workflows/dev-deploy.yaml

@@ -1,57 +0,0 @@
-name: Dev Deploy
-
-on:
-  push:
-    branches: ['dev-deploy']
-
-jobs:
-  deploy:
-    name: Deploy
-    runs-on: ubuntu-latest
-    steps:
-      ## Not needed on ubuntu-latest
-      # - name: Provide GPG and Git
-      #   run: sudo apt update && sudo apt -qq -y install gnupg git curl zip unzip tar bzip2 make jq
-
-      ## Not needed on ubuntu-latest
-      # - name: Provide Holos Dependencies
-      #   run: |
-      #     sudo mkdir -p -m 755 /etc/apt/keyrings
-      #     curl -fsSL https://pkgs.k8s.io/core:/stable:/v1.30/deb/Release.key | sudo gpg --dearmor -o /etc/apt/keyrings/kubernetes-apt-keyring.gpg
-      #     sudo chmod 644 /etc/apt/keyrings/kubernetes-apt-keyring.gpg
-      #     echo 'deb [signed-by=/etc/apt/keyrings/kubernetes-apt-keyring.gpg] https://pkgs.k8s.io/core:/stable:/v1.30/deb/ /' | sudo tee /etc/apt/sources.list.d/kubernetes.list
-      #     sudo chmod 644 /etc/apt/sources.list.d/kubernetes.list
-      #     sudo apt update
-      #     sudo apt install -qq -y kubectl
-      #     curl -fsSL -o-  https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 | bash
-
-      # Must come after git executable is provided
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - uses: actions/setup-go@v5
-        with:
-          go-version: '1.22.x'
-
-      - uses: ko-build/setup-ko@v0.7
-        env:
-          KO_DOCKER_REPO: quay.io/holos-run/holos
-
-      - name: Setup SSH
-        run: |
-          mkdir -p ~/.ssh
-          echo "${{ secrets.DEPLOY_SSH_PRIVATE_KEY }}" > ~/.ssh/id_ed25519
-          chmod 600 ~/.ssh/id_ed25519
-          ssh-keyscan github.com >> ~/.ssh/known_hosts
-          git config --global user.name "github-actions[bot]"
-          git config --global user.email "github-actions[bot]@users.noreply.github.com"
-
-      - name: make dev-deploy
-        env:
-          auth_user: holos-run+pusher
-          auth_token: ${{ secrets.QUAY_TOKEN }}
-        run: |
-          echo "${auth_token}" | ko login quay.io --username "${auth_user}" --password-stdin
-          make dev-deploy

.github/workflows/golangci-lint.yaml

@@ -1,30 +0,0 @@
-name: golangci-lint
-on:
-  push:
-    branches:
-      - main
-      - test
-  pull_request:
-    types: [opened, synchronize]
-
-permissions:
-  # Required: allow read access to the content for analysis.
-  contents: read
-  # Optional: allow read access to pull request. Use with `only-new-issues` option.
-  pull-requests: read
-  # Optional: allow write access to checks to allow the action to annotate code in the PR.
-  checks: write
-
-jobs:
-  golangci:
-    name: lint
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
-        with:
-          go-version: stable
-      - name: golangci-lint
-        uses: golangci/golangci-lint-action@v7
-        with:
-          version: v2.1.6

.github/workflows/lint.yaml

@@ -0,0 +1,45 @@
+---
+# https://github.com/golangci/golangci-lint-action?tab=readme-ov-file#how-to-use
+name: Lint
+"on":
+  push:
+    branches:
+      - main
+      - test
+  pull_request:
+    types: [opened, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  golangci:
+    name: lint
+    runs-on: gha-rs
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: 20
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: stable
+
+      - name: Install Packages
+        run: sudo apt update && sudo apt -qq -y install git curl zip unzip tar bzip2 make
+
+      - name: Install Tools
+        run: |
+          set -x
+          make tools
+
+      - name: golangci-lint
+        uses: golangci/golangci-lint-action@v4
+        with:
+          version: latest
+          skip-pkg-cache: true

.github/workflows/release.yaml

@@ -12,12 +12,11 @@ permissions:
 
 jobs:
   goreleaser:
-    runs-on: ubuntu-latest
+    runs-on: gha-rs
     steps:
-      ## Not needed on ubuntu-latest
       # Must come before Checkout, otherwise goreleaser fails
-      # - name: Provide GPG and Git
-      #   run: sudo apt update && sudo apt -qq -y install gnupg git curl zip unzip tar bzip2 make
+      - name: Provide GPG and Git
+        run: sudo apt update && sudo apt -qq -y install gnupg git curl zip unzip tar bzip2 make
 
       # Must come after git executable is provided
       - name: Checkout
@@ -35,9 +34,6 @@ jobs:
         with:
           go-version: stable
 
-      - name: Setup Syft
-        uses: anchore/sbom-action/download-syft@1ca97d9028b51809cf6d3c934c3e160716e1b605 # v0.17.5
-
       # Necessary to run these outside of goreleaser, otherwise
       # /home/runner/_work/holos/holos/internal/frontend/node_modules/.bin/protoc-gen-connect-query is not in PATH
       - name: Install Tools
@@ -57,19 +53,11 @@ jobs:
       - name: Git diff
         run: git diff
 
-      - uses: actions/create-github-app-token@v1
-        id: app-token
-        with:
-          owner: ${{ github.repository_owner }}
-          app-id: ${{ vars.GORELEASER_APP_ID }}
-          private-key: ${{ secrets.GORELEASER_APP_PRIVATE_KEY }}
-
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5
         with:
           distribution: goreleaser
-          version: '~> v2'
+          version: latest
           args: release --clean
         env:
-          HOMEBREW_TAP_GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/spelling.yaml

@@ -1,17 +0,0 @@
----
-name: Spelling
-"on":
-  push:
-    branches:
-      - main
-      - test
-  pull_request:
-    types: [opened, synchronize]
-permissions:
-  contents: read
-jobs:
-  cspell:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - run: ./hack/cspell

.gitignore

@@ -1,4 +1,5 @@
 /bin/
+vendor/
 .idea/
 coverage.out
 /dist/
@@ -6,17 +7,8 @@ coverage.out
 /deploy/
 .vscode/
 tmp/
-.DS_*
 
 # In case we run through the tutorial in this directory.
 /holos-k3d/
 /holos-infra/
 node_modules/
-.tmp/
-
-# nix
-/.direnv/
-result
-
-# claude
-/.claude/settings.local.json

.golangci.yaml

@@ -1,20 +1,2 @@
-version: "2"
-linters:
-  exclusions:
-    generated: lax
-    presets:
-      - comments
-      - common-false-positives
-      - legacy
-      - std-error-handling
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
-formatters:
-  exclusions:
-    generated: lax
-    paths:
-      - third_party$
-      - builtin$
-      - examples$
+run:
+  timeout: 5m

.goreleaser.yaml

@@ -6,7 +6,7 @@
 # yaml-language-server: $schema=https://goreleaser.com/static/schema.json
 # vim: set ts=2 sw=2 tw=0 fo=cnqoj
 
-version: 2
+version: 1
 
 before:
   hooks:
@@ -50,39 +50,3 @@ changelog:
     exclude:
       - "^docs:"
       - "^test:"
-
-source:
-  enabled: true
-  name_template: '{{ .ProjectName }}_{{ .Version }}_source_code'
-
-sboms:
-  - id: source
-    artifacts: source
-    documents:
-      - "{{ .ProjectName }}_{{ .Version }}_sbom.spdx.json"
-
-brews:
-  - name: holos
-    repository:
-      owner: holos-run
-      name: homebrew-tap
-      branch: main
-      token: "{{ .Env.HOMEBREW_TAP_GITHUB_TOKEN }}"
-    directory: Formula
-    homepage: "https://holos.run"
-    description: "Holos CLI"
-    dependencies:
-      - name: helm
-        type: optional
-      - name: kubectl
-        type: optional
-    install: |
-      bin.install "holos"
-      bash_output = Utils.safe_popen_read(bin/"holos", "completion", "bash")
-      (bash_completion/"holos").write bash_output
-      zsh_output = Utils.safe_popen_read(bin/"holos", "completion", "zsh")
-      (zsh_completion/"_holos").write zsh_output
-      fish_output = Utils.safe_popen_read(bin/"holos", "completion", "fish")
-      (fish_completion/"holos.fish").write fish_output
-    test: |
-      system "#{bin}/holos --version"

CLAUDE.md

@@ -1,115 +0,0 @@
-# CLAUDE.md
-
-This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
-
-## Project Overview
-
-Holos is a configuration management tool for Kubernetes that implements the rendered manifests pattern using CUE. It unifies Helm charts, Kustomize bases, and raw Kubernetes manifests into a single, declarative pipeline.
-
-### Core Flow
-```
-Platform → Components → BuildPlan → Generators → Transformers → Validators → Manifests
-```
-
-## Key Commands
-
-```bash
-# Development
-make build         # Build the binary
-make install       # Install binary (REQUIRED before testing holos commands)
-make test          # Run all tests
-make fmt           # Format Go code
-make lint          # Run linters
-make coverage      # Generate coverage report
-
-# Documentation
-make update-docs   # Update generated docs
-make website       # Build the documentation website
-
-# Usage (run 'make install' first to test code changes)
-holos render platform    # Render entire platform
-holos render component   # Render single component
-holos show buildplans    # Show build plans
-holos init platform      # Initialize new platform
-```
-
-## Architecture
-
-### Directory Structure
-- `/api/` - API definitions (v1alpha5 stable, v1alpha6 in development)
-- `/cmd/` - CLI entry point
-- `/internal/cli/` - Command implementations
-- `/internal/component/` - Component handling logic
-- `/internal/platform/` - Platform handling logic
-- `/internal/generate/` - Code generation
-
-### Key Files
-- `/internal/cli/render/render.go` - Core render logic
-- `/internal/component/component.go` - Component processing
-- `/api/core/v1alpha*/types.go` - API type definitions
-
-### Component Types
-1. **Helm** - Wraps Helm charts
-2. **Kustomize** - Wraps Kustomize bases  
-3. **Kubernetes** - Raw Kubernetes manifests
-
-## CUE Patterns
-
-Components are defined in CUE:
-```cue
-package holos
-
-holos: Component.BuildPlan
-
-Component: #Helm & {
-    Name: "example"
-    Chart: {
-        version: "1.0.0"
-        repository: {
-            name: "example"
-            url:  "https://charts.example.com"
-        }
-    }
-}
-```
-
-## Testing
-
-- Unit tests: `*_test.go` files colocated with source
-- Integration tests: `/cmd/holos/tests/`
-- Example platforms: `/internal/testutil/fixtures/`
-- Run single test: `go test -run TestName ./path/to/package`
-
-## Development Patterns
-
-1. Error handling: Prefer `errors.Format()` from `/internal/errors/` over `fmt.Errorf()`
-2. Logging: Use structured `slog`, get logger with `logger.FromContext(ctx)`
-3. CLI commands: Follow Cobra patterns in `/internal/cli/`
-4. CUE formatting: Always run `cue fmt` on CUE files
-5. Go formatting: Always run `go fmt` on go files
-6. Develop against v1alpha6 packages.
-7. Commits: Use the package name as the first word in the commit, lower case.  Commit without asking permission.  Always run `make lint` and `make test` before committing.
-
-## Version Management
-
-- Version files: `/version/embedded/{major,minor,patch}`
-- Bump version: `make bump`
-- API versions: v1alpha5 (stable), v1alpha6 (development)
-
-## Key Concepts
-
-- **Platform**: Top-level configuration containing all components
-- **Component**: Unit of configuration (DAG of Tasks producing deployment configs for one component)
-- **TaskSet**: DAG of Tasks (Similar to how make tasks behave)
-- **BuildPlan**: Instructions for building a component.  Deprecated in v1alpha6, use TaskSet instead.
-- **Generator**: Creates manifests (Helm, Kustomize, etc.) author schema only in v1alpha6
-- **Transformer**: Modifies generated manifests, author schema only in v1alpha6
-- **Validator**: Validates final manifests, author schema only in v1alpha6
-
-## Resources
-
-- Tutorials: `/doc/md/tutorial/`
-- Platform templates: `/internal/generate/platforms/`
-- Test fixtures: `/internal/testutil/fixtures/`
-- Core schemas: `/api/core/` (Abstraction over low level data pipeline tasks)
-- Author schemas: `/api/author/` (User facing abstractions over core Schemas)

Dockerfile

@@ -1,38 +1,8 @@
-FROM registry.k8s.io/kubectl:v1.33.4 AS kubectl
-# https://github.com/GoogleContainerTools/distroless
-FROM golang:1.24 AS build
-
-WORKDIR /go/src/app
-COPY . .
-
-RUN CGO_ENABLED=0 make install
-RUN CGO_ENABLED=0 go install sigs.k8s.io/kustomize/kustomize/v5
-
-# Install helm to /usr/local/bin/helm
-# https://helm.sh/docs/intro/install/#from-script
-# https://holos.run/docs/v1alpha5/tutorial/setup/#dependencies
-RUN curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 \
-  && chmod 700 get_helm.sh \
-  && DESIRED_VERSION=v3.16.2 ./get_helm.sh \
-  && rm -f get_helm.sh
-
-COPY --from=kubectl /bin/kubectl /usr/local/bin/
-
-# Use debian slim instead of distroless to get package management.
-FROM public.ecr.aws/docker/library/debian:13-slim AS final
-COPY --from=build \
-     /go/bin/holos \
-     /go/bin/kustomize \
-     /usr/local/bin/kubectl \
-     /usr/local/bin/helm \
-     /bin/
-
-# Extra packages
-# git - https://github.com/holos-run/holos/issues/440
-RUN apt update && \
-    apt install -y --no-install-recommends git ca-certificates && \
-    apt clean && \
-    rm -rf /var/lib/apt/lists/*
-
-# Usage: docker run -v $(pwd):/app --workdir /app --rm -it quay.io/holos-run/holos holos render platform
-CMD ["/bin/holos"]
+FROM quay.io/holos-run/debian:bullseye AS final
+USER root
+WORKDIR /app
+ADD bin bin
+RUN chown -R app: /app
+# Kubernetes requires the user to be numeric
+USER 8192
+ENTRYPOINT bin/holos server

Makefile

@@ -32,37 +32,31 @@ bump: bumppatch
 .PHONY: bumppatch
 bumppatch: ## Bump the patch version.
 	scripts/bump patch
-	HOLOS_UPDATE_SCRIPTS=1 scripts/test
 
 .PHONY: bumpminor
 bumpminor: ## Bump the minor version.
 	scripts/bump minor
 	scripts/bump patch 0
-	HOLOS_UPDATE_SCRIPTS=1 scripts/test
 
 .PHONY: bumpmajor
 bumpmajor: ## Bump the major version.
 	scripts/bump major
 	scripts/bump minor 0
 	scripts/bump patch 0
-	HOLOS_UPDATE_SCRIPTS=1 scripts/test
 
 .PHONY: show-version
 show-version: ## Print the full version.
 	@echo $(VERSION)
 
-.PHONY: tag
-tag: ## Tag a release
-	git tag v$(VERSION)
-
 .PHONY: tidy
 tidy: ## Tidy go module.
 	go mod tidy
 
 .PHONY: fmt
 fmt: ## Format code.
+	cd docs/examples && cue fmt ./...
+	cd internal/generate/platforms && cue fmt ./...
 	go fmt ./...
-	cue fmt ./...
 
 .PHONY: vet
 vet: ## Vet Go code.
@@ -78,11 +72,10 @@ build: ## Build holos executable.
 	@echo "GOPATH=${GOPATH}"
 	go build -trimpath -o bin/$(BIN_NAME) -ldflags $(LD_FLAGS) $(REPO_PATH)/cmd/$(BIN_NAME)
 
-.PHONY: debug
-debug: ## Build debug executable.
-	@echo "building ${BIN_NAME}-debug ${VERSION}"
+linux: ## Build holos executable for tilt.
+	@echo "building ${BIN_NAME}.linux ${VERSION}"
 	@echo "GOPATH=${GOPATH}"
-	go build -o bin/$(BIN_NAME)-debug $(REPO_PATH)/cmd/$(BIN_NAME)
+	GOOS=linux go build -trimpath -o bin/$(BIN_NAME).linux -ldflags $(LD_FLAGS) $(REPO_PATH)/cmd/$(BIN_NAME)
 
 .PHONY: install
 install: build ## Install holos to GOPATH/bin
@@ -96,12 +89,11 @@ clean: ## Clean executables.
 test: ## Run tests.
 	scripts/test
 
-.PHONY: golangci-lint
-golangci-lint:
-	golangci-lint run
-
 .PHONY: lint
-lint: vet golangci-lint ## Run linters.
+lint: ## Run linters.
+	buf lint
+	cd internal/frontend/holos && ng lint
+	golangci-lint run
 	./hack/cspell
 
 .PHONY: coverage
@@ -113,31 +105,42 @@ snapshot:  ## Go release snapshot
 	goreleaser release --snapshot --clean
 
 .PHONY: tools
-tools: go-deps website-deps ## install tool dependencies
+tools: go-deps frontend-deps website-deps ## install tool dependencies
 
 .PHONY: go-deps
 go-deps: ## tool versions pinned in tools.go
 	go install cuelang.org/go/cmd/cue
+	go install github.com/bufbuild/buf/cmd/buf
+	go install github.com/fullstorydev/grpcurl/cmd/grpcurl
+	go install google.golang.org/protobuf/cmd/protoc-gen-go
+	go install connectrpc.com/connect/cmd/protoc-gen-connect-go
+	go install honnef.co/go/tools/cmd/staticcheck
+	go install golang.org/x/tools/cmd/godoc
 	go install github.com/princjef/gomarkdoc/cmd/gomarkdoc
 	# curl https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | bash
 
+.PHONY: frontend-deps
+frontend-deps: ## Install Angular deps for go generate
+	cd internal/frontend/holos && npm install
+	cd internal/frontend/holos && npm install --save-dev @bufbuild/buf @connectrpc/protoc-gen-connect-es
+	cd internal/frontend/holos && npm install @connectrpc/connect @connectrpc/connect-web @bufbuild/protobuf
+	# https://github.com/connectrpc/connect-query-es/blob/1350b6f07b6aead81793917954bdb1cc3ce09df9/packages/protoc-gen-connect-query/README.md?plain=1#L23
+	cd internal/frontend/holos && npm install --save-dev @connectrpc/protoc-gen-connect-query @bufbuild/protoc-gen-es
+	cd internal/frontend/holos && npm install @connectrpc/connect-query @bufbuild/protobuf
+
 .PHONY: website-deps
 website-deps: ## Install Docusaurus deps for go generate
 	cd doc/website && npm install
 
+.PHONY: image
+image: build ## Docker image build
+	docker build . -t ${DOCKER_REPO}:v$(shell ./bin/holos --version)
+	docker push ${DOCKER_REPO}:v$(shell ./bin/holos --version)
+
 .PHONY: website
 website: ## Build website
 	./hack/build-website
 
-.PHONY: unity
-unity: ## https://cuelabs.dev/unity/
-	./scripts/unity
-
-.PHONY: update-docs
-update-docs: ## Update doc examples
-	HOLOS_UPDATE_SCRIPTS=1 go test -v ./doc/md/...
-	HOLOS_UPDATE_SCRIPTS=1 go test -v ./doc/website/versioned_docs/...
-
 .PHONY: help
 help:  ## Display this help menu.
 	@awk 'BEGIN {FS = ":.*##"; printf "\nUsage:\n  make \033[36m<target>\033[0m\n"} /^[a-zA-Z_0-9-]+:.*?##/ { printf "  \033[36m%-20s\033[0m %s\n", $$1, $$2 } /^##@/ { printf "\n\033[1m%s\033[0m\n", substr($$0, 5) } ' $(MAKEFILE_LIST)

README.md

@@ -1,130 +1,32 @@
-# Holos
+## Holos - A Holostic Development Platform
 
 <img width="50%"
 align="right"
 style="display: block; margin: 40px auto;"
 src="https://openinfrastructure.co/blog/2016/02/27/logo/logorectangle.png">
 
-[Holos] is a configuration management tool for Kubernetes implementing the
-[rendered manifests pattern]. It handles configurations ranging from single
-resources to multi-cluster platforms across regions.
+Building and maintaining a software development platform is a complex and time
+consuming endeavour.  Organizations often dedicate a team of 3-4 who need 6-12
+months to build the platform.
 
-Key components:
-- Platform schemas defining component integration
-- Building blocks unifying Helm, Kustomize and Kubernetes configs with CUE
-- BuildPlan pipeline for generating, transforming and validating manifests
+Holos is a tool and a reference platform to reduce the compexity and speed up
+the process of building a modern, cloud native software development platform.
 
-```mermaid
----
-title: Rendering Overview
----
-graph LR
-    Platform[<a href="https://holos.run/docs/v1alpha5/api/author/#Platform">Platform</a>]
-    Component[<a href="https://holos.run/docs/v1alpha5/api/author/#ComponentConfig">Components</a>]
+ - **Accelerate new projects** - Reduce time to market and operational complexity by starting your new project on top of the Holos reference platform.
+ - **Modernize existing projects** - Incrementally incorporate your existing platform services into Holos for simpler integration.
+ - **Unified configuration model** - Increase safety and reduce the risk of config changes with CUE.
+ - **First class Helm and Kustomize support** - Leverage and reuse your existing investment in existing configuration tools such as Helm and Kustomize.
+ - **Modern Authentication and Authorization** - Holos seamlessly integrates platform identity and access mangement with zero-trust beyond corp style authorization policy.
 
-    Helm[<a href="https://holos.run/docs/v1alpha5/api/author/#Helm">Helm</a>]
-    Kustomize[<a href="https://holos.run/docs/v1alpha5/api/author/#Kustomize">Kustomize</a>]
-    Kubernetes[<a href="https://holos.run/docs/v1alpha5/api/author/#Kubernetes">Kubernetes</a>]
-
-    BuildPlan[<a href="https://holos.run/docs/v1alpha5/api/core/#BuildPlan">BuildPlan</a>]
-
-    ResourcesArtifact[<a href="https://holos.run/docs/v1alpha5/api/core/#Artifact">Resources<br/>Artifact</a>]
-    GitOpsArtifact[<a href="https://holos.run/docs/v1alpha5/api/core/#Artifact">GitOps<br/>Artifact</a>]
-
-    Generators[<a href="https://holos.run/docs/v1alpha5/api/core/#Generator">Generators</a>]
-    Transformers[<a href="https://holos.run/docs/v1alpha5/api/core/#Transformer">Transformers</a>]
-    Validators[<a href="https://holos.run/docs/v1alpha5/api/core/#Validator">Validators</a>]
-    Files[Manifest<br/>Files]
-
-    Platform --> Component
-    Component --> Helm --> BuildPlan
-    Component --> Kubernetes --> BuildPlan
-    Component --> Kustomize --> BuildPlan
-
-    BuildPlan --> ResourcesArtifact --> Generators
-    BuildPlan --> GitOpsArtifact --> Generators
-
-    Generators --> Transformers --> Validators --> Files
+## Quick Installation
+```console
+go install github.com/holos-run/holos/cmd/holos@latest
 ```
 
-## Setup
+## Docs and Support
+The documentation for developing and using Holos is avaialble at: https://holos.run
 
-```shell
-brew install holos-run/tap/holos
-```
-
-Refer to [setup] for other installation methods and dependencies.
-
-## Example
-
-See our [tutorial] for a complete hello world example.
-
-```cue showLineNumbers
-package holos
-
-holos: Component.BuildPlan
-
-Component: #Helm & {
-	Name: "podinfo"
-	Chart: {
-		version: "6.6.2"
-		repository: {
-			name: "podinfo"
-			url:  "https://stefanprodan.github.io/podinfo"
-		}
-	}
-	Values: ui: {
-		message: string | *"Hello World" @tag(message, type=string)
-	}
-}
-```
-
-## Organizational Role
-
-Platform engineers use Holos to generate Kubernetes manifests, both locally and
-in CI pipelines. The manifests are committed to version control and deployed via
-GitOps tools like ArgoCD or Flux.
-
-Holos integrates seamlessly with existing Helm charts, Kustomize bases, and
-other version-controlled configurations.
-
-## Advantages of Holos
-
-### Safe
-
-Holos leverages [CUE] for strong typing and validation of configuration data,
-ensuring consistent output from Helm and other tools.
-
-### Consistent
-
-A unified pipeline processes all configurations - whether from CUE, Helm, or
-Kustomize - through the same well-defined stages.
-
-### Flexible
-
-Composable building blocks for generation, transformation, validation and
-integration let teams assemble workflows that match their needs.
-
-The core is intentionally unopinionated about platform configuration patterns.
-Common needs like environments and clusters are provided as customizable
-[topics] recipes rather than enforced structures.
-
-## Getting Help
-
-Get support through our [Discord] channel or [GitHub discussions]. Configuration
-challenges arise at all experience levels - we welcome your questions and are
-here to help.
+For discussion and support, [open a discussion](https://github.com/orgs/holos-run/discussions/new/choose).
 
 ## License
-
 Holos is licensed under Apache 2.0 as found in the [LICENSE file](LICENSE).
-
-[Holos]: https://holos.run/docs/overview/
-[rendered manifests pattern]: https://akuity.io/blog/the-rendered-manifests-pattern
-[CUE]: https://cuelang.org/
-[Discord]: https://discord.gg/JgDVbNpye7
-[GitHub discussions]: https://github.com/holos-run/holos/discussions
-[Why CUE for Configuration]: https://holos.run/blog/why-cue-for-configuration/
-[tutorial]: https://holos.run/docs/overview/
-[setup]: https://holos.run/docs/setup/
-[topics]: https://holos.run/docs/topics/

Tiltfile

@@ -0,0 +1,108 @@
+# -*- mode: Python -*-
+# This Tiltfile manages a Go project with live reload in Kubernetes
+
+listen_port = 3000
+metrics_port = 9090
+
+# Use our wrapper to set the kube namespace
+if os.getenv('TILT_WRAPPER') != '1':
+    fail("could not run, ./hack/tilt/bin/tilt was not used to start tilt")
+
+# Resource ids
+holos_backend = 'Holos Backend'
+compile_id = 'Go Build'
+
+# Default Registry.
+# See: https://github.com/tilt-dev/tilt.build/blob/master/docs/choosing_clusters.md#manual-configuration
+# Note, Tilt will append the image name to the registry uri path
+# default_registry('{account}.dkr.ecr.{region}.amazonaws.com/holos-run/holos'.format(account=aws_account, region=aws_region))
+
+# Set a name prefix specific to the user.  Multiple developers share the tilt-holos namespace.
+developer = os.getenv('USER')
+holos_server = 'holos'
+
+# We always develop against the k3d-workload cluster
+os.putenv('KUBECONFIG', os.path.abspath('./hack/tilt/kubeconfig'))
+
+# Extensions are open-source, pre-packaged functions that extend Tilt
+#
+#   More info: https://github.com/tilt-dev/tilt-extensions
+#   More info: https://docs.tilt.dev/extensions.html
+load('ext://restart_process', 'docker_build_with_restart')
+load('ext://k8s_attach', 'k8s_attach')
+load('ext://git_resource', 'git_checkout')
+load('ext://uibutton', 'cmd_button')
+
+# Paths edited by the developer Tilt watches to trigger compilation.
+# Generated files should be excluded to avoid an infinite build loop.
+developer_paths = [
+    './cmd',
+    './internal/server',
+    './internal/ent/schema',
+    './frontend/package-lock.json',
+    './frontend/src',
+    './go.mod',
+    './pkg',
+    './service/holos',
+]
+
+# Builds the holos executable GOOS=linux
+local_resource(compile_id, 'make linux', deps=developer_paths)
+
+# Build Docker image
+#   Tilt will automatically associate image builds with the resource(s)
+#   that reference them (e.g. via Kubernetes or Docker Compose YAML).
+#
+#   More info: https://docs.tilt.dev/api.html#api.docker_build
+#
+docker_build_with_restart(
+    'k3d-registry.holos.localhost:5100/holos',
+    context='.',
+    entrypoint=[
+        '/app/bin/holos.linux',
+        'server',
+        '--oidc-issuer=https://login.holos.run',
+        '--oidc-audience=275571128859132936',
+    ],
+    dockerfile='./Dockerfile',
+    only=['./bin'],
+    # (Recommended) Updating a running container in-place
+    # https://docs.tilt.dev/live_update_reference.html
+    live_update=[
+        # Sync files from host to container
+        sync('./bin/', '/app/bin/'),
+    ],
+)
+
+# Troubleshooting
+def resource_name(id):
+    print('resource: {}'.format(id))
+    return id.name
+
+workload_to_resource_function(resource_name)
+
+# Customize a Kubernetes resource
+#   By default, Kubernetes resource names are automatically assigned
+#   based on objects in the YAML manifests, e.g. Deployment name.
+#
+#   Tilt strives for sane defaults, so calling k8s_resource is
+#   optional, and you only need to pass the arguments you want to
+#   override.
+#
+#   More info: https://docs.tilt.dev/api.html#api.k8s_resource
+#
+k8s_yaml(blob(str(read_file('./hack/tilt/k8s/dev-holos-app/deployment.yaml'))))
+
+# Backend server process
+k8s_resource(
+    workload=holos_server,
+    new_name=holos_backend,
+    objects=[],
+    resource_deps=[compile_id],
+    links=[
+        link('https://app.holos.localhost/ui/'.format(developer), "Holos Web UI")
+    ],
+)
+
+# Database
+print("✨ Tiltfile evaluated")

api/author/v1alpha5/definitions.go

@@ -1,155 +0,0 @@
-// Package author contains a standard set of schemas for component authors to
-// generate common [core] BuildPlans.
-//
-// Holos values stability, flexibility, and composition.  This package
-// intentionally defines only the minimal necessary set of structures.
-// Component authors are encouraged to define their own structures building on
-// our example [topics].
-//
-// The Holos Maintainers may add definitions to this package if the community
-// identifies nearly all users must define the exact same structure.  Otherwise,
-// definitions should be added as a customizable example in [topics].
-//
-// For example, structures representing a cluster and environment almost always
-// need to be defined.  Their definition varies from one organization to the
-// next.  Therefore, customizable definitions for a cluster and environment are
-// best maintained in [topics], not standardized in this package.
-//
-// [core]: https://holos.run/docs/api/core/
-// [topics]: https://holos.run/docs/topics/
-package author
-
-import core "github.com/holos-run/holos/api/core/v1alpha5"
-
-//go:generate ../../../hack/gendoc
-
-// Platform assembles a core Platform in the Resource field for the holos render
-// platform command.  Use the Components field to register components with the
-// platform.
-type Platform struct {
-	Name       string
-	Components map[NameLabel]core.Component
-	Resource   core.Platform
-}
-
-// ComponentConfig represents the configuration common to all kinds of
-// components for use with the holos render component command.  All component
-// kinds may be transformed with [kustomize] configured with the
-// [KustomizeConfig] field.
-//
-//   - [Helm] charts.
-//   - [Kubernetes] resources generated from CUE.
-//   - [Kustomize] bases.
-//
-// [kustomize]: https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/
-type ComponentConfig struct {
-	// Name represents the BuildPlan metadata.name field.  Used to construct the
-	// fully rendered manifest file path.
-	Name string
-	// Labels represent the BuildPlan metadata.labels field.
-	Labels map[string]string
-	// Annotations represent the BuildPlan metadata.annotations field.
-	Annotations map[string]string
-
-	// Path represents the path to the component producing the BuildPlan.
-	Path string
-	// Parameters are useful to reuse a component with various parameters.
-	// Injected as CUE @tag variables.  Parameters with a "holos_" prefix are
-	// reserved for use by the Holos Authors.
-	Parameters map[string]string
-	// OutputBaseDir represents the output base directory used when assembling
-	// artifacts.  Useful to organize components by clusters or other parameters.
-	// For example, holos writes resource manifests to
-	// {WriteTo}/{OutputBaseDir}/components/{Name}/{Name}.gen.yaml
-	OutputBaseDir string `cue:"string | *\"\""`
-
-	// Resources represents kubernetes resources mixed into the rendered manifest.
-	Resources core.Resources
-	// KustomizeConfig represents the kustomize configuration.
-	KustomizeConfig KustomizeConfig
-	// Validators represent checks that must pass for output to be written.
-	Validators map[NameLabel]core.Validator
-	// Artifacts represents additional artifacts to mix in.  Useful for adding
-	// GitOps resources.  Each Artifact is unified without modification into the
-	// BuildPlan.
-	Artifacts map[NameLabel]core.Artifact
-}
-
-// Helm assembles a BuildPlan rendering a helm chart.  Useful to mix in
-// additional resources from CUE and transform the helm output with kustomize.
-type Helm struct {
-	ComponentConfig `json:",inline"`
-
-	// Chart represents a Helm chart.
-	Chart core.Chart
-	// Values represents data to marshal into a values.yaml for helm.
-	Values core.Values
-	// ValueFiles represents value files for migration from helm value
-	// hierarchies.  Use Values instead.
-	ValueFiles []core.ValueFile `json:",omitempty"`
-	// EnableHooks enables helm hooks when executing the `helm template` command.
-	EnableHooks bool `cue:"true | *false"`
-	// Namespace sets the helm chart namespace flag if provided.
-	Namespace string `json:",omitempty"`
-	// APIVersions represents the helm template --api-versions flag
-	APIVersions []string `json:",omitempty"`
-	// KubeVersion represents the helm template --kube-version flag
-	KubeVersion string `json:",omitempty"`
-
-	// BuildPlan represents the derived BuildPlan produced for the holos render
-	// component command.
-	BuildPlan core.BuildPlan
-}
-
-// Kubernetes assembles a BuildPlan containing inline resources exported from
-// CUE.
-type Kubernetes struct {
-	ComponentConfig `json:",inline"`
-
-	// BuildPlan represents the derived BuildPlan produced for the holos render
-	// component command.
-	BuildPlan core.BuildPlan
-}
-
-// Kustomize assembles a BuildPlan rendering manifests from a [kustomize]
-// kustomization.
-//
-// [kustomize]: https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/
-type Kustomize struct {
-	ComponentConfig `json:",inline"`
-
-	// BuildPlan represents the derived BuildPlan produced for the holos render
-	// component command.
-	BuildPlan core.BuildPlan
-}
-
-// KustomizeConfig represents the configuration for [kustomize] post processing.
-// Use the Files field to mix in plain manifest files located in the component
-// directory.  Use the Resources field to mix in manifests from network urls.
-//
-// [kustomize]: https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/
-type KustomizeConfig struct {
-	// Kustomization represents the kustomization used to transform resources.
-	// Note the resources field is internally managed from the Files and Resources fields.
-	Kustomization map[string]any `json:",omitempty"`
-	// Files represents files to copy from the component directory for kustomization.
-	Files map[string]struct{ Source string } `cue:"{[NAME=_]: Source: NAME}"`
-	// Resources represents additional entries to included in the resources list.
-	Resources map[string]struct{ Source string } `cue:"{[NAME=_]: Source: NAME}"`
-	// CommonLabels represents common labels added without including selectors.
-	CommonLabels map[string]string
-}
-
-// NameLabel represents the common use case of converting a struct to a list
-// where the name field of each value unifies with the field name of the outer
-// struct.
-//
-// For example:
-//
-//	S: [NameLabel=string]: name: NameLabel
-//	S: jeff: _
-//	S: gary: _
-//	S: nate: _
-//	L: [for x in S {x}]
-//	// L is [{name: "jeff"}, {name: "gary"}, {name: "nate"}]
-type NameLabel string

api/author/v1alpha5/header.yaml

@@ -1,5 +0,0 @@
----
-title: Author Schemas
-description: Standardized schemas for component authors.
-sidebar_position: 200
----

api/author/v1alpha6/definitions.go

@@ -1,155 +0,0 @@
-// Package author contains a standard set of schemas for component authors to
-// generate common [core] BuildPlans.
-//
-// Holos values stability, flexibility, and composition.  This package
-// intentionally defines only the minimal necessary set of structures.
-// Component authors are encouraged to define their own structures building on
-// our example [topics].
-//
-// The Holos Maintainers may add definitions to this package if the community
-// identifies nearly all users must define the exact same structure.  Otherwise,
-// definitions should be added as a customizable example in [topics].
-//
-// For example, structures representing a cluster and environment almost always
-// need to be defined.  Their definition varies from one organization to the
-// next.  Therefore, customizable definitions for a cluster and environment are
-// best maintained in [topics], not standardized in this package.
-//
-// [core]: https://holos.run/docs/api/core/
-// [topics]: https://holos.run/docs/topics/
-package author
-
-import core "github.com/holos-run/holos/api/core/v1alpha6"
-
-//go:generate ../../../hack/gendoc
-
-// Platform assembles a core Platform in the Resource field for the holos render
-// platform command.  Use the Components field to register components with the
-// platform.
-type Platform struct {
-	Name       string                       `json:"name" yaml:"name" cue:"string | *\"default\""`
-	Components map[NameLabel]core.Component `json:"components" yaml:"components"`
-	Resource   core.Platform                `json:"resource" yaml:"resource"`
-}
-
-// ComponentConfig represents the configuration common to all kinds of
-// components for use with the holos render component command.  All component
-// kinds may be transformed with [kustomize] configured with the
-// [KustomizeConfig] field.
-//
-//   - [Helm] charts.
-//   - [Kubernetes] resources generated from CUE.
-//   - [Kustomize] bases.
-//
-// [kustomize]: https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/
-type ComponentConfig struct {
-	// Name represents the BuildPlan metadata.name field.  Used to construct the
-	// fully rendered manifest file path.
-	Name string
-	// Labels represent the BuildPlan metadata.labels field.
-	Labels map[string]string
-	// Annotations represent the BuildPlan metadata.annotations field.
-	Annotations map[string]string
-
-	// Path represents the path to the component producing the BuildPlan.
-	Path string
-	// Parameters are useful to reuse a component with various parameters.
-	// Injected as CUE @tag variables.  Parameters with a "holos_" prefix are
-	// reserved for use by the Holos Authors.
-	Parameters map[string]string
-	// OutputBaseDir represents the output base directory used when assembling
-	// artifacts.  Useful to organize components by clusters or other parameters.
-	// For example, holos writes resource manifests to
-	// {WriteTo}/{OutputBaseDir}/components/{Name}/{Name}.gen.yaml
-	OutputBaseDir string `cue:"string | *\"\""`
-
-	// Resources represents kubernetes resources mixed into the rendered manifest.
-	Resources core.Resources
-	// KustomizeConfig represents the kustomize configuration.
-	KustomizeConfig KustomizeConfig
-	// Validators represent checks that must pass for output to be written.
-	Validators map[NameLabel]core.Validator
-	// Artifacts represents additional artifacts to mix in.  Useful for adding
-	// GitOps resources.  Each Artifact is unified without modification into the
-	// BuildPlan.
-	Artifacts map[NameLabel]core.Artifact
-}
-
-// Helm assembles a BuildPlan rendering a helm chart.  Useful to mix in
-// additional resources from CUE and transform the helm output with kustomize.
-type Helm struct {
-	ComponentConfig `json:",inline"`
-
-	// Chart represents a Helm chart.
-	Chart core.Chart
-	// Values represents data to marshal into a values.yaml for helm.
-	Values core.Values
-	// ValueFiles represents value files for migration from helm value
-	// hierarchies.  Use Values instead.
-	ValueFiles []core.ValueFile `json:",omitempty"`
-	// EnableHooks enables helm hooks when executing the `helm template` command.
-	EnableHooks bool `cue:"true | *false"`
-	// Namespace sets the helm chart namespace flag if provided.
-	Namespace string `json:",omitempty"`
-	// APIVersions represents the helm template --api-versions flag
-	APIVersions []string `json:",omitempty"`
-	// KubeVersion represents the helm template --kube-version flag
-	KubeVersion string `json:",omitempty"`
-
-	// BuildPlan represents the derived BuildPlan produced for the holos render
-	// component command.
-	BuildPlan core.BuildPlan
-}
-
-// Kubernetes assembles a BuildPlan containing inline resources exported from
-// CUE.
-type Kubernetes struct {
-	ComponentConfig `json:",inline"`
-
-	// BuildPlan represents the derived BuildPlan produced for the holos render
-	// component command.
-	BuildPlan core.BuildPlan
-}
-
-// Kustomize assembles a BuildPlan rendering manifests from a [kustomize]
-// kustomization.
-//
-// [kustomize]: https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/
-type Kustomize struct {
-	ComponentConfig `json:",inline"`
-
-	// BuildPlan represents the derived BuildPlan produced for the holos render
-	// component command.
-	BuildPlan core.BuildPlan
-}
-
-// KustomizeConfig represents the configuration for [kustomize] post processing.
-// Use the Files field to mix in plain manifest files located in the component
-// directory.  Use the Resources field to mix in manifests from network urls.
-//
-// [kustomize]: https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/
-type KustomizeConfig struct {
-	// Kustomization represents the kustomization used to transform resources.
-	// Note the resources field is internally managed from the Files and Resources fields.
-	Kustomization map[string]any `json:",omitempty"`
-	// Files represents files to copy from the component directory for kustomization.
-	Files map[string]struct{ Source string } `cue:"{[NAME=_]: Source: NAME}"`
-	// Resources represents additional entries to included in the resources list.
-	Resources map[string]struct{ Source string } `cue:"{[NAME=_]: Source: NAME}"`
-	// CommonLabels represents common labels added without including selectors.
-	CommonLabels map[string]string
-}
-
-// NameLabel represents the common use case of converting a struct to a list
-// where the name field of each value unifies with the field name of the outer
-// struct.
-//
-// For example:
-//
-//	S: [NameLabel=string]: name: NameLabel
-//	S: jeff: _
-//	S: gary: _
-//	S: nate: _
-//	L: [for x in S {x}]
-//	// L is [{name: "jeff"}, {name: "gary"}, {name: "nate"}]
-type NameLabel string

api/author/v1alpha6/header.yaml

@@ -1,5 +0,0 @@
----
-title: Author Schemas
-description: Standardized schemas for component authors.
-sidebar_position: 200
----

api/core/v1alpha2/apiobjects.go

@@ -0,0 +1,44 @@
+package v1alpha2
+
+import "google.golang.org/protobuf/types/known/structpb"
+
+// Label is an arbitrary unique identifier internal to holos itself.  The holos
+// cli is expected to never write a Label value to rendered output files,
+// therefore use a [Label] then the identifier must be unique and internal.
+// Defined as a type for clarity and type checking.
+//
+// A Label is useful to convert a CUE struct to a list, for example producing a list of [APIObject] resources from an [APIObjectMap].  A CUE struct using
+// Label keys is guaranteed to not lose data when rendering output because a
+// Label is expected to never be written to the final output.
+type Label string
+
+// Kind is a kubernetes api object kind. Defined as a type for clarity and type checking.
+type Kind string
+
+// APIObject represents the most basic generic form of a single kubernetes api
+// object.  Represented as a JSON object internally for compatibility between
+// tools, for example loading from CUE.
+type APIObject structpb.Struct
+
+// APIObjectMap represents the marshalled yaml representation of kubernetes api
+// objects.  Do not produce an APIObjectMap directly, instead use [APIObjects]
+// to produce the marshalled yaml representation from CUE data, then provide the
+// result to [HolosComponent].
+type APIObjectMap map[Kind]map[Label]string
+
+// APIObjects represents Kubernetes API objects defined directly from CUE code.
+// Useful to mix in resources to any kind of [HolosComponent], for example
+// adding an ExternalSecret resource to a [HelmChart].
+//
+// [Kind] must be the resource kind, e.g. Deployment or Service.
+//
+// [Label] is an arbitrary internal identifier to uniquely identify the resource
+// within the context of a `holos` command.  Holos will never write the
+// intermediate label to rendered output.
+//
+// Refer to [HolosComponent] which accepts an [APIObjectMap] field provided by
+// [APIObjects].
+type APIObjects struct {
+	APIObjects   map[Kind]map[Label]APIObject `json:"apiObjects"`
+	APIObjectMap APIObjectMap                 `json:"apiObjectMap"`
+}

api/core/v1alpha2/buildplan.go

@@ -0,0 +1,96 @@
+package v1alpha2
+
+// FilePath represents a file path.
+type FilePath string
+
+// FileContent represents file contents.
+type FileContent string
+
+// FileContentMap represents a mapping of file paths to file contents.  Paths
+// are relative to the `holos` output "deploy" directory, and may contain
+// sub-directories.
+type FileContentMap map[FilePath]FileContent
+
+// BuildPlan represents a build plan for the holos cli to execute.  The purpose
+// of a BuildPlan is to define one or more [HolosComponent] kinds.  For example a
+// [HelmChart], [KustomizeBuild], or [KubernetesObjects].
+//
+// A BuildPlan usually has an additional empty [KubernetesObjects] for the
+// purpose of using the [HolosComponent] DeployFiles field to deploy an ArgoCD
+// or Flux gitops resource for the holos component.
+type BuildPlan struct {
+	Kind       string        `json:"kind" cue:"\"BuildPlan\""`
+	APIVersion string        `json:"apiVersion" cue:"string | *\"v1alpha2\""`
+	Spec       BuildPlanSpec `json:"spec"`
+}
+
+// BuildPlanSpec represents the specification of the build plan.
+type BuildPlanSpec struct {
+	// Disabled causes the holos cli to take no action over the [BuildPlan].
+	Disabled bool `json:"disabled,omitempty"`
+	// Components represents multiple [HolosComponent] kinds to manage.
+	Components BuildPlanComponents `json:"components,omitempty"`
+}
+
+type BuildPlanComponents struct {
+	Resources             map[Label]KubernetesObjects `json:"resources,omitempty"`
+	KubernetesObjectsList []KubernetesObjects         `json:"kubernetesObjectsList,omitempty"`
+	HelmChartList         []HelmChart                 `json:"helmChartList,omitempty"`
+	KustomizeBuildList    []KustomizeBuild            `json:"kustomizeBuildList,omitempty"`
+}
+
+// HolosComponent defines the fields common to all holos component kinds.  Every
+// holos component kind should embed HolosComponent.
+type HolosComponent struct {
+	// Kind is a string value representing the resource this object represents.
+	Kind string `json:"kind"`
+	// APIVersion represents the versioned schema of this representation of an object.
+	APIVersion string `json:"apiVersion" cue:"string | *\"v1alpha2\""`
+	// Metadata represents data about the holos component such as the Name.
+	Metadata Metadata `json:"metadata"`
+
+	// APIObjectMap holds the marshalled representation of api objects.  Useful to
+	// mix in resources to each HolosComponent type, for example adding an
+	// ExternalSecret to a HelmChart HolosComponent.  Refer to [APIObjects].
+	APIObjectMap APIObjectMap `json:"apiObjectMap,omitempty"`
+
+	// DeployFiles represents file paths relative to the cluster deploy directory
+	// with the value representing the file content.  Intended for defining the
+	// ArgoCD Application resource or Flux Kustomization resource from within CUE,
+	// but may be used to render any file related to the build plan from CUE.
+	DeployFiles FileContentMap `json:"deployFiles,omitempty"`
+
+	// Kustomize represents a kubectl kustomize build post-processing step.
+	Kustomize `json:"kustomize,omitempty"`
+
+	// Skip causes holos to take no action regarding this component.
+	Skip bool `json:"skip" cue:"bool | *false"`
+}
+
+// Metadata represents data about the holos component such as the Name.
+type Metadata struct {
+	// Name represents the name of the holos component.
+	Name string `json:"name"`
+	// Namespace is the primary namespace of the holos component.  A holos
+	// component may manage resources in multiple namespaces, in this case
+	// consider setting the component namespace to default.
+	//
+	// This field is optional because not all resources require a namespace,
+	// particularly CRD's and DeployFiles functionality.
+	// +optional
+	Namespace string `json:"namespace,omitempty"`
+}
+
+// Kustomize represents resources necessary to execute a kustomize build.
+// Intended for at least two use cases:
+//
+//  1. Process a [KustomizeBuild] [HolosComponent] which represents raw yaml
+//     file resources in a holos component directory.
+//  2. Post process a [HelmChart] [HolosComponent] to inject istio, patch jobs,
+//     add custom labels, etc...
+type Kustomize struct {
+	// KustomizeFiles holds file contents for kustomize, e.g. patch files.
+	KustomizeFiles FileContentMap `json:"kustomizeFiles,omitempty"`
+	// ResourcesFile is the file name used for api objects in kustomization.yaml
+	ResourcesFile string `json:"resourcesFile,omitempty"`
+}

api/core/v1alpha2/constants.go

@@ -0,0 +1,11 @@
+package v1alpha2
+
+const (
+	APIVersion    = "v1alpha2"
+	BuildPlanKind = "BuildPlan"
+	HelmChartKind = "HelmChart"
+	// ChartDir is the directory name created in the holos component directory to cache a chart.
+	ChartDir = "vendor"
+	// ResourcesFile is the file name used to store component output when post-processing with kustomize.
+	ResourcesFile = "resources.yaml"
+)

api/core/v1alpha2/core.go

@@ -1,52 +1,44 @@
-// Code generated by cue get go. DO NOT EDIT.
-
-//cue:generate cue get go github.com/holos-run/holos/api/core/v1alpha3
-
-package v1alpha3
+package v1alpha2
 
 import "google.golang.org/protobuf/types/known/structpb"
 
+type PlatformMetadata struct {
+	// Name represents the Platform name.
+	Name string `json:"name"`
+}
+
 // Platform represents a platform to manage.  A Platform resource informs holos
 // which components to build.  The platform resource also acts as a container
 // for the platform model form values provided by the PlatformService.  The
 // primary use case is to collect the cluster names, cluster types, platform
 // model, and holos components to build into one resource.
-#Platform: {
+type Platform struct {
 	// Kind is a string value representing the resource this object represents.
-	kind: string & "Platform" @go(Kind)
-
+	Kind string `json:"kind" cue:"\"Platform\""`
 	// APIVersion represents the versioned schema of this representation of an object.
-	apiVersion: string & (string | *"v1alpha3") @go(APIVersion)
-
+	APIVersion string `json:"apiVersion" cue:"string | *\"v1alpha2\""`
 	// Metadata represents data about the object such as the Name.
-	metadata: #PlatformMetadata @go(Metadata)
+	Metadata PlatformMetadata `json:"metadata"`
 
 	// Spec represents the specification.
-	spec: #PlatformSpec @go(Spec)
-}
-
-#PlatformMetadata: {
-	// Name represents the Platform name.
-	name: string @go(Name)
+	Spec PlatformSpec `json:"spec"`
 }
 
 // PlatformSpec represents the specification of a Platform.  Think of a platform
 // specification as a list of platform components to apply to a list of
 // kubernetes clusters combined with the user-specified Platform Model.
-#PlatformSpec: {
+type PlatformSpec struct {
 	// Model represents the platform model holos gets from from the
 	// PlatformService.GetPlatform rpc method and provides to CUE using a tag.
-	model: structpb.#Struct & {...} @go(Model)
-
+	Model structpb.Struct `json:"model"`
 	// Components represents a list of holos components to manage.
-	components: [...#PlatformSpecComponent] @go(Components,[]PlatformSpecComponent)
+	Components []PlatformSpecComponent `json:"components"`
 }
 
 // PlatformSpecComponent represents a holos component to build or render.
-#PlatformSpecComponent: {
+type PlatformSpecComponent struct {
 	// Path is the path of the component relative to the platform root.
-	path: string @go(Path)
-
+	Path string `json:"path"`
 	// Cluster is the cluster name to provide when rendering the component.
-	cluster: string @go(Cluster)
+	Cluster string `json:"cluster"`
 }

api/core/v1alpha2/doc.go

@@ -1,8 +1,4 @@
-// Code generated by cue get go. DO NOT EDIT.
-
-//cue:generate cue get go github.com/holos-run/holos/api/core/v1alpha3
-
-// Package v1alpha3 contains the core API contract between the holos cli and CUE
+// Package v1alpha2 contains the core API contract between the holos cli and CUE
 // configuration code.  Platform designers, operators, and software developers
 // use this API to write configuration in CUE which `holos` loads.  The overall
 // shape of the API defines imperative actions `holos` should carry out to
@@ -10,13 +6,13 @@
 //
 // [Platform] defines the complete configuration of a platform.  With the holos
 // reference platform this takes the shape of one management cluster and at
-// least two workload cluster.  Each cluster has multiple [Component]
+// least two workload cluster.  Each cluster has multiple [HolosComponent]
 // resources applied to it.
 //
 // Each holos component path, e.g. `components/namespaces` produces exactly one
-// [BuildPlan] which in turn contains a set of [Component] kinds.
+// [BuildPlan] which in turn contains a set of [HolosComponent] kinds.
 //
-// The primary kinds of [Component] are:
+// The primary kinds of [HolosComponent] are:
 //
 //  1. [HelmChart] to render config from a helm chart.
 //  2. [KustomizeBuild] to render config from [Kustomize]
@@ -25,4 +21,6 @@
 //
 // Note that Holos operates as a data pipeline, so the output of a [HelmChart]
 // may be provided to [Kustomize] for post-processing.
-package v1alpha3
+package v1alpha2
+
+//go:generate ../../../hack/gendoc

api/core/v1alpha2/helm.go

@@ -1,47 +1,38 @@
-// Code generated by cue get go. DO NOT EDIT.
-
-//cue:generate cue get go github.com/holos-run/holos/api/core/v1alpha3
-
-package v1alpha3
+package v1alpha2
 
 // HelmChart represents a holos component which wraps around an upstream helm
 // chart.  Holos orchestrates helm by providing values obtained from CUE,
 // renders the output using `helm template`, then post-processes the helm output
-// yaml using the general functionality provided by [Component], for
+// yaml using the general functionality provided by [HolosComponent], for
 // example [Kustomize] post-rendering and mixing in additional kubernetes api
 // objects.
-#HelmChart: {
-	#Component
-	kind: string & "HelmChart" @go(Kind)
+type HelmChart struct {
+	HolosComponent `json:",inline"`
+	Kind           string `json:"kind" cue:"\"HelmChart\""`
 
 	// Chart represents a helm chart to manage.
-	chart: #Chart @go(Chart)
-
+	Chart Chart `json:"chart"`
 	// ValuesContent represents the values.yaml file holos passes to the `helm
 	// template` command.
-	valuesContent: string @go(ValuesContent)
-
+	ValuesContent string `json:"valuesContent"`
 	// EnableHooks enables helm hooks when executing the `helm template` command.
-	enableHooks: bool & (bool | *false) @go(EnableHooks)
+	EnableHooks bool `json:"enableHooks" cue:"bool | *false"`
 }
 
 // Chart represents a helm chart.
-#Chart: {
+type Chart struct {
 	// Name represents the chart name.
-	name: string @go(Name)
-
+	Name string `json:"name"`
 	// Version represents the chart version.
-	version: string @go(Version)
-
+	Version string `json:"version"`
 	// Release represents the chart release when executing helm template.
-	release: string @go(Release)
-
+	Release string `json:"release"`
 	// Repository represents the repository to fetch the chart from.
-	repository?: #Repository @go(Repository)
+	Repository Repository `json:"repository,omitempty"`
 }
 
 // Repository represents a helm chart repository.
-#Repository: {
-	name: string @go(Name)
-	url:  string @go(URL)
+type Repository struct {
+	Name string `json:"name"`
+	URL  string `json:"url"`
 }

api/core/v1alpha2/kubernetesobjects.go

@@ -0,0 +1,10 @@
+package v1alpha2
+
+const KubernetesObjectsKind = "KubernetesObjects"
+
+// KubernetesObjects represents a [HolosComponent] composed of Kubernetes API
+// objects provided directly from CUE using [APIObjects].
+type KubernetesObjects struct {
+	HolosComponent `json:",inline"`
+	Kind           string `json:"kind" cue:"\"KubernetesObjects\""`
+}

api/core/v1alpha2/kustomizebuild.go

@@ -0,0 +1,8 @@
+package v1alpha2
+
+// KustomizeBuild represents a [HolosComponent] that renders plain yaml files in
+// the holos component directory using `kubectl kustomize build`.
+type KustomizeBuild struct {
+	HolosComponent `json:",inline"`
+	Kind           string `json:"kind" cue:"\"KustomizeBuild\""`
+}

api/core/v1alpha5/header.yaml

@@ -1,5 +0,0 @@
----
-title: Core Schemas
-description: BuildPlan defines the holos rendering pipeline.
-sidebar_position: 100
----

api/core/v1alpha5/types.go

@@ -1,388 +0,0 @@
-// Package core contains schemas for a [Platform] and [BuildPlan].  Holos takes
-// a [Platform] as input, then iterates over each [Component] to produce a
-// [BuildPlan].  Holos evaluates the [BuildPlan] to produce fully rendered
-// manifests, each an [Artifact].
-package core
-
-// BuildContextTag represents the cue tag holos render component uses to inject
-// the json representation of a [BuildContext] for use in a BuildPlan.
-const BuildContextTag string = "holos_build_context"
-
-// ComponentNameTag represents the cue tag holos uses to inject a [Component]
-// name from the holos render platform command to the holos render component
-// command.
-const ComponentNameTag string = "holos_component_name"
-
-// ComponentPathTag represents the cue tag holos uses to inject a [Component]
-// path relative to the cue module root from the holos render platform command
-// to the holos render component command.
-const ComponentPathTag string = "holos_component_path"
-
-// ComponentLabelsTag represents the cue tag holos uses to inject the json
-// representation of [Component] metadata labels from the holos render platform
-// command to the holos render component command.
-const ComponentLabelsTag string = "holos_component_labels"
-
-// ComponentAnnotationsTag represents the tag holos uses to inject the json
-// representation of [Component] metadata annotations from the holos render
-// platform command to the holos render component command.
-const ComponentAnnotationsTag = "holos_component_annotations"
-
-//go:generate ../../../hack/gendoc
-
-// BuildPlan represents an implementation of the [rendered manifest pattern].
-// Holos processes a BuildPlan to produce one or more [Artifact] output files.
-// BuildPlan artifact files usually contain Kubernetes manifests, but they may
-// have any content.
-//
-// A BuildPlan usually produces two artifacts.  One artifact contains a manifest
-// of resources.  A second artifact contains a GitOps resource to manage the
-// first, usually an ArgoCD Application resource.
-//
-// Holos uses CUE to construct a BuildPlan.  A future enhancement will support
-// user defined executables providing a BuildPlan to Holos in the style of an
-// [external credential provider].
-//
-// [rendered manifest pattern]: https://akuity.io/blog/the-rendered-manifests-pattern
-// [external credential provider]: https://github.com/kubernetes/enhancements/blob/313ad8b59c80819659e1fbf0f165230f633f2b22/keps/sig-auth/541-external-credential-providers/README.md
-type BuildPlan struct {
-	// Kind represents the type of the resource.
-	Kind string `json:"kind" yaml:"kind" cue:"\"BuildPlan\""`
-	// APIVersion represents the versioned schema of the resource.
-	APIVersion string `json:"apiVersion" yaml:"apiVersion" cue:"string | *\"v1alpha5\""`
-	// Metadata represents data about the resource such as the Name.
-	Metadata Metadata `json:"metadata" yaml:"metadata"`
-	// Spec specifies the desired state of the resource.
-	Spec BuildPlanSpec `json:"spec" yaml:"spec"`
-}
-
-// BuildPlanSpec represents the specification of the [BuildPlan].
-type BuildPlanSpec struct {
-	// Artifacts represents the artifacts for holos to build.
-	Artifacts []Artifact `json:"artifacts" yaml:"artifacts"`
-	// Disabled causes the holos cli to disregard the build plan.
-	Disabled bool `json:"disabled,omitempty" yaml:"disabled,omitempty"`
-}
-
-// Artifact represents one fully rendered manifest produced by a [Transformer]
-// sequence, which transforms a [Generator] collection.  A [BuildPlan] produces
-// an [Artifact] collection.
-//
-// Each Artifact produces one manifest file artifact.  Generator Output values
-// are used as Transformer Inputs.  The Output field of the final [Transformer]
-// should have the same value as the Artifact field.
-//
-// When there is more than one [Generator] there must be at least one
-// [Transformer] to combine outputs into one Artifact.  If there is a single
-// Generator, it may directly produce the Artifact output.
-//
-// An Artifact is processed concurrently with other artifacts in the same
-// [BuildPlan].  An Artifact should not use an output from another Artifact as
-// an input.  Each [Generator] may also run concurrently.  Each [Transformer] is
-// executed sequentially starting after all generators have completed.
-//
-// Output fields are write-once.  It is an error for multiple Generators or
-// Transformers to produce the same Output value within the context of a
-// [BuildPlan].
-type Artifact struct {
-	Artifact     FilePath      `json:"artifact,omitempty" yaml:"artifact,omitempty"`
-	Generators   []Generator   `json:"generators,omitempty" yaml:"generators,omitempty"`
-	Transformers []Transformer `json:"transformers,omitempty" yaml:"transformers,omitempty"`
-	Validators   []Validator   `json:"validators,omitempty" yaml:"validators,omitempty"`
-	Skip         bool          `json:"skip,omitempty" yaml:"skip,omitempty"`
-}
-
-// Generator generates Kubernetes resources.  [Helm] and [Resources] are the
-// most commonly used, often paired together to mix-in resources to an
-// unmodified Helm chart.  A simple [File] generator is also available for use
-// with the [Kustomize] transformer.
-//
-// Each Generator in an [Artifact] must have a distinct Output value for a
-// [Transformer] to reference.
-//
-//  1. [Resources] - Generates resources from CUE code.
-//  2. [Helm] - Generates rendered yaml from a [Chart].
-//  3. [File] - Generates data by reading a file from the component directory.
-type Generator struct {
-	// Kind represents the kind of generator.  Must be Resources, Helm, or File.
-	Kind string `json:"kind" yaml:"kind" cue:"\"Resources\" | \"Helm\" | \"File\""`
-	// Output represents a file for a Transformer or Artifact to consume.
-	Output FilePath `json:"output" yaml:"output"`
-	// Resources generator. Ignored unless kind is Resources.  Resources are
-	// stored as a two level struct.  The top level key is the Kind of resource,
-	// e.g. Namespace or Deployment.  The second level key is an arbitrary
-	// InternalLabel.  The third level is a map[string]any representing the
-	// Resource.
-	Resources Resources `json:"resources,omitempty" yaml:"resources,omitempty"`
-	// Helm generator. Ignored unless kind is Helm.
-	Helm Helm `json:"helm,omitempty" yaml:"helm,omitempty"`
-	// File generator. Ignored unless kind is File.
-	File File `json:"file,omitempty" yaml:"file,omitempty"`
-}
-
-// Resource represents one kubernetes api object.
-type Resource map[string]any
-
-// Resources represents Kubernetes resources.  Most commonly used to mix
-// resources into the [BuildPlan] generated from CUE, but may be generated from
-// elsewhere.
-type Resources map[Kind]map[InternalLabel]Resource
-
-// File represents a simple single file copy [Generator].  Useful with a
-// [Kustomize] [Transformer] to process plain manifest files stored in the
-// component directory.  Multiple File generators may be used to transform
-// multiple resources.
-type File struct {
-	// Source represents a file sub-path relative to the component path.
-	Source FilePath `json:"source" yaml:"source"`
-}
-
-// Helm represents a [Chart] manifest [Generator].
-type Helm struct {
-	// Chart represents a helm chart to manage.
-	Chart Chart `json:"chart" yaml:"chart"`
-	// Values represents values for holos to marshal into values.yaml when
-	// rendering the chart.  Values follow ValueFiles when both are provided.
-	Values Values `json:"values" yaml:"values"`
-	// ValueFiles represents hierarchial value files passed in order to the helm
-	// template -f flag.  Useful for migration from an ApplicationSet.  Use Values
-	// instead.  ValueFiles precede Values when both are provided.
-	ValueFiles []ValueFile `json:"valueFiles,omitempty" yaml:"valueFiles,omitempty"`
-	// EnableHooks enables helm hooks when executing the `helm template` command.
-	EnableHooks bool `json:"enableHooks,omitempty" yaml:"enableHooks,omitempty"`
-	// Namespace represents the helm namespace flag
-	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
-	// APIVersions represents the helm template --api-versions flag
-	APIVersions []string `json:"apiVersions,omitempty" yaml:"apiVersions,omitempty"`
-	// KubeVersion represents the helm template --kube-version flag
-	KubeVersion string `json:"kubeVersion,omitempty" yaml:"kubeVersion,omitempty"`
-}
-
-// ValueFile represents one Helm value file produced from CUE.
-type ValueFile struct {
-	// Name represents the file name, e.g. "region-values.yaml"
-	Name string `json:"name" yaml:"name"`
-	// Kind is a discriminator.
-	Kind string `json:"kind" yaml:"kind" cue:"\"Values\""`
-	// Values represents values for holos to marshal into the file name specified
-	// by Name when rendering the chart.
-	Values Values `json:"values,omitempty" yaml:"values,omitempty"`
-}
-
-// Values represents [Helm] Chart values generated from CUE.
-type Values map[string]any
-
-// Chart represents a [Helm] Chart.
-type Chart struct {
-	// Name represents the chart name.
-	Name string `json:"name" yaml:"name"`
-	// Version represents the chart version.
-	Version string `json:"version" yaml:"version"`
-	// Release represents the chart release when executing helm template.
-	Release string `json:"release" yaml:"release"`
-	// Repository represents the repository to fetch the chart from.
-	Repository Repository `json:"repository,omitempty" yaml:"repository,omitempty"`
-}
-
-// Repository represents a [Helm] [Chart] repository.
-//
-// The Auth field is useful to configure http basic authentication to the Helm
-// repository.  Holos gets the username and password from the environment
-// variables represented by the Auth field.
-type Repository struct {
-	Name string `json:"name" yaml:"name"`
-	URL  string `json:"url" yaml:"url"`
-	Auth Auth   `json:"auth,omitempty" yaml:"auth,omitempty"`
-}
-
-// Auth represents environment variable names containing auth credentials.
-type Auth struct {
-	Username AuthSource `json:"username" yaml:"username"`
-	Password AuthSource `json:"password" yaml:"password"`
-}
-
-// AuthSource represents a source for the value of an [Auth] field.
-type AuthSource struct {
-	Value   string `json:"value,omitempty" yaml:"value,omitempty"`
-	FromEnv string `json:"fromEnv,omitempty" yaml:"fromEnv,omitempty"`
-}
-
-// Transformer combines multiple inputs from prior [Generator] or [Transformer]
-// outputs into one output.  [Kustomize] is the most commonly used transformer.
-// A simple [Join] is also supported for use with plain manifest files.
-//
-//  1. [Kustomize] - Patch and transform the output from prior generators or
-//     transformers.  See [Introduction to Kustomize].
-//  2. [Join] - Concatenate multiple prior outputs into one output.
-//
-// [Introduction to Kustomize]: https://kubectl.docs.kubernetes.io/guides/config_management/introduction/
-type Transformer struct {
-	// Kind represents the kind of transformer. Must be Kustomize, or Join.
-	Kind string `json:"kind" yaml:"kind" cue:"\"Kustomize\" | \"Join\""`
-	// Inputs represents the files to transform. The Output of prior Generators
-	// and Transformers.
-	Inputs []FilePath `json:"inputs" yaml:"inputs"`
-	// Output represents a file for a subsequent Transformer or Artifact to
-	// consume.
-	Output FilePath `json:"output" yaml:"output"`
-	// Kustomize transformer. Ignored unless kind is Kustomize.
-	Kustomize Kustomize `json:"kustomize,omitempty" yaml:"kustomize,omitempty"`
-	// Join transformer. Ignored unless kind is Join.
-	Join Join `json:"join,omitempty" yaml:"join,omitempty"`
-}
-
-// Join represents a [Transformer] using [bytes.Join] to concatenate multiple
-// inputs into one output with a separator.  Useful for combining output from
-// [Helm] and [Resources] together into one [Artifact] when [Kustomize] is
-// otherwise unnecessary.
-//
-// [bytes.Join]: https://pkg.go.dev/bytes#Join
-type Join struct {
-	Separator string `json:"separator,omitempty" yaml:"separator,omitempty"`
-}
-
-// Kustomize represents a kustomization [Transformer].
-type Kustomize struct {
-	// Kustomization represents the decoded kustomization.yaml file
-	Kustomization Kustomization `json:"kustomization" yaml:"kustomization"`
-	// Files holds file contents for kustomize, e.g. patch files.
-	Files FileContentMap `json:"files,omitempty" yaml:"files,omitempty"`
-}
-
-// Kustomization represents a kustomization.yaml file for use with the
-// [Kustomize] [Transformer].  Untyped to avoid tightly coupling holos to
-// kubectl versions which was a problem for the Flux maintainers.  Type checking
-// is expected to happen in CUE against the kubectl version the user prefers.
-type Kustomization map[string]any
-
-// FileContentMap represents a mapping of file paths to file contents.
-type FileContentMap map[FilePath]FileContent
-
-// FilePath represents a file path.
-type FilePath string
-
-// FileContent represents file contents.
-type FileContent string
-
-// Validator validates files.  Useful to validate an [Artifact] prior to writing
-// it out to the final destination.  Holos may execute validators concurrently.
-// See the [validators] tutorial for an end to end example.
-//
-// [validators]: https://holos.run/docs/v1alpha5/tutorial/validators/
-type Validator struct {
-	// Kind represents the kind of transformer. Must be Kustomize, or Join.
-	Kind string `json:"kind" yaml:"kind" cue:"\"Command\""`
-	// Inputs represents the files to validate.  Usually the final Artifact.
-	Inputs []FilePath `json:"inputs" yaml:"inputs"`
-	// Command represents a validation command.  Ignored unless kind is Command.
-	Command Command `json:"command,omitempty" yaml:"command,omitempty"`
-}
-
-// Command represents a command vetting one or more artifacts.  Holos appends
-// fully qualified input file paths to the end of the args list, then executes
-// the command.  Inputs are written into a temporary directory prior to
-// executing the command and removed afterwards.
-type Command struct {
-	Args []string `json:"args,omitempty" yaml:"args,omitempty"`
-}
-
-// InternalLabel is an arbitrary unique identifier internal to holos itself.
-// The holos cli is expected to never write a InternalLabel value to rendered
-// output files, therefore use a InternalLabel when the identifier must be
-// unique and internal.  Defined as a type for clarity and type checking.
-type InternalLabel string
-
-// Kind is a discriminator. Defined as a type for clarity and type checking.
-type Kind string
-
-// Metadata represents data about the resource such as the Name.
-type Metadata struct {
-	// Name represents the resource name.
-	Name string `json:"name" yaml:"name"`
-	// Labels represents a resource selector.
-	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
-	// Annotations represents arbitrary non-identifying metadata.  For example
-	// holos uses the `app.holos.run/description` annotation to log resources in a
-	// user customized way.
-	Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
-}
-
-// Platform represents a platform to manage.  A Platform specifies a [Component]
-// collection and integrates the components together into a holistic platform.
-// Holos iterates over the [Component] collection producing a [BuildPlan] for
-// each, which holos then executes to render manifests.
-//
-// Inspect a Platform resource holos would process by executing:
-//
-//	cue export --out yaml ./platform
-type Platform struct {
-	// Kind is a string value representing the resource.
-	Kind string `json:"kind" yaml:"kind" cue:"\"Platform\""`
-	// APIVersion represents the versioned schema of this resource.
-	APIVersion string `json:"apiVersion" yaml:"apiVersion" cue:"string | *\"v1alpha5\""`
-	// Metadata represents data about the resource such as the Name.
-	Metadata Metadata `json:"metadata" yaml:"metadata"`
-
-	// Spec represents the platform specification.
-	Spec PlatformSpec `json:"spec" yaml:"spec"`
-}
-
-// PlatformSpec represents the platform specification.
-type PlatformSpec struct {
-	// Components represents a collection of holos components to manage.
-	Components []Component `json:"components" yaml:"components"`
-}
-
-// Component represents the complete context necessary to produce a [BuildPlan]
-// from a path containing parameterized CUE configuration.
-type Component struct {
-	// Name represents the name of the component. Injected as the tag variable
-	// "holos_component_name".
-	Name string `json:"name" yaml:"name"`
-	// Path represents the path of the component relative to the platform root.
-	// Injected as the tag variable "holos_component_path".
-	Path string `json:"path" yaml:"path"`
-	// Instances represents additional cue instance paths to unify with Path.
-	// Useful to unify data files into a component BuildPlan.  Added in holos
-	// 0.101.7.
-	Instances []Instance `json:"instances,omitempty" yaml:"instances,omitempty"`
-	// WriteTo represents the holos render component --write-to flag.  If empty,
-	// the default value for the --write-to flag is used.
-	WriteTo string `json:"writeTo,omitempty" yaml:"writeTo,omitempty"`
-	// Parameters represent user defined input variables to produce various
-	// [BuildPlan] resources from one component path.  Injected as CUE @tag
-	// variables.  Parameters with a "holos_" prefix are reserved for use by the
-	// Holos Authors.  Multiple environments are a prime example of an input
-	// parameter that should always be user defined, never defined by Holos.
-	Parameters map[string]string `json:"parameters,omitempty" yaml:"parameters,omitempty"`
-	// Labels represent selector labels for the component.  Copied to the
-	// resulting BuildPlan.
-	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
-	// Annotations represents arbitrary non-identifying metadata.  Use the
-	// `app.holos.run/description` to customize the log message of each BuildPlan.
-	Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
-}
-
-// Instance represents a data instance to unify with the configuration.
-//
-// Useful to unify json and yaml files with cue configuration files for
-// integration with other tools.  For example, executing holos render platform
-// from a pull request workflow after [Kargo] executes the [yaml update] and
-// [git wait for pr] promotion steps.
-//
-// [Kargo]: https://docs.kargo.io/
-// [yaml update]: https://docs.kargo.io/references/promotion-steps#yaml-update
-// [git wait for pr]: https://docs.kargo.io/references/promotion-steps#git-wait-for-pr
-type Instance struct {
-	// Kind is a discriminator.
-	Kind string `json:"kind" yaml:"kind" cue:"\"ExtractYAML\""`
-	// Ignored unless kind is ExtractYAML.
-	ExtractYAML ExtractYAML `json:"extractYAML,omitempty" yaml:"extractYAML,omitempty"`
-}
-
-// ExtractYAML represents a cue data instance encoded as yaml or json. If Path
-// refers to a directory all files in the directory are extracted
-// non-recursively.  Otherwise, path must refer to a file.
-type ExtractYAML struct {
-	Path string `json:"path" yaml:"path"`
-}

api/core/v1alpha6/header.yaml

@@ -1,5 +0,0 @@
----
-title: Core Schemas
-description: BuildPlan defines the holos rendering pipeline.
-sidebar_position: 100
----

api/core/v1alpha6/types.go

@@ -1,453 +0,0 @@
-// Package core contains schemas for a [Platform] and [BuildPlan].  Holos takes
-// a [Platform] as input, then iterates over each [Component] to produce a
-// [BuildPlan].  Holos processes the [BuildPlan] to produce fully rendered
-// manifests, each an [Artifact].
-package core
-
-// BuildContextTag represents the cue tag holos render component uses to inject
-// the json representation of a [BuildContext] for use in a BuildPlan.
-const BuildContextTag string = "holos_build_context"
-
-// ComponentNameTag represents the cue tag holos uses to inject a [Component]
-// name from the holos render platform command to the holos render component
-// command.
-const ComponentNameTag string = "holos_component_name"
-
-// ComponentPathTag represents the cue tag holos uses to inject a [Component]
-// path relative to the cue module root from the holos render platform command
-// to the holos render component command.
-const ComponentPathTag string = "holos_component_path"
-
-// ComponentLabelsTag represents the cue tag holos uses to inject the json
-// representation of [Component] metadata labels from the holos render platform
-// command to the holos render component command.
-const ComponentLabelsTag string = "holos_component_labels"
-
-// ComponentAnnotationsTag represents the tag holos uses to inject the json
-// representation of [Component] metadata annotations from the holos render
-// platform command to the holos render component command.
-const ComponentAnnotationsTag = "holos_component_annotations"
-
-//go:generate ../../../hack/gendoc
-
-// BuildPlan represents an implementation of the [rendered manifest pattern].
-// Holos processes a BuildPlan to produce one or more [Artifact] output files.
-// BuildPlan artifact files usually contain Kubernetes manifests, but they may
-// have any content.
-//
-// A BuildPlan usually produces two artifacts.  One artifact contains a manifest
-// of resources.  A second artifact contains a GitOps resource to manage the
-// first, usually an ArgoCD Application resource.
-//
-// Holos uses CUE to construct a BuildPlan.  Holos injects late binding values
-// such as the build temp dir using the [BuildContext].
-//
-// [rendered manifest pattern]: https://akuity.io/blog/the-rendered-manifests-pattern
-//
-// [external credential provider]: https://github.com/kubernetes/enhancements/blob/313ad8b59c80819659e1fbf0f165230f633f2b22/keps/sig-auth/541-external-credential-providers/README.md
-type BuildPlan struct {
-	// APIVersion represents the versioned schema of the resource.
-	APIVersion string `json:"apiVersion" yaml:"apiVersion" cue:"\"v1alpha6\""`
-	// Kind represents the type of the resource.
-	Kind string `json:"kind" yaml:"kind" cue:"\"BuildPlan\""`
-	// Metadata represents data about the resource such as the Name.
-	Metadata Metadata `json:"metadata" yaml:"metadata"`
-	// Spec specifies the desired state of the resource.
-	Spec BuildPlanSpec `json:"spec" yaml:"spec"`
-	// BuildContext represents values injected by holos just before evaluating a
-	// BuildPlan, for example the tempDir used for the build.
-	BuildContext BuildContext `json:"buildContext" yaml:"buildContext"`
-}
-
-// BuildContext represents build context values owned by the holos render
-// component command.  End users should not manage context field values.  End
-// users may reference fields from within CUE to refer to late binding
-// concrete values defined just before holos executes a [BuildPlan].
-//
-// Holos injects build context values by marshalling this struct to json through
-// the holos_build_context cue tag.
-//
-// Example usage from cue to produce a [BuildPlan]:
-//
-//	package holos
-//
-//	import (
-//	  "encoding/json"
-//	  "github.com/holos-run/holos/api/core/v1alpha6:core"
-//	)
-//
-//	_BuildContextJSON: string | *"{}" @tag(holos_build_context, type=string)
-//	BuildContext: core.#BuildContext & json.Unmarshal(_BuildContextJSON)
-//
-//	holos: core.#BuildPlan & {
-//	  buildContext: BuildContext
-//	  "spec": {
-//	    "artifacts": [
-//	      {
-//	        artifact: "components/slice",
-//	        "transformers": [
-//	          {
-//	            "kind": "Command"
-//	            "inputs": ["resources.gen.yaml"]
-//	            "output": artifact
-//	            "command": {
-//	              "args": [
-//	                "kubectl-slice",
-//	                "-f",
-//	                "\(buildContext.tempDir)/resources.gen.yaml",
-//	                "-o",
-//	                "\(buildContext.tempDir)/\(artifact)",
-//	              ]
-//	            }
-//	          }
-//	        ]
-//	      }
-//	    ]
-//	  }
-//	}
-type BuildContext struct {
-	// TempDir represents the temporary directory managed and owned by the holos
-	// render component command for the execution of one BuildPlan.  Multiple
-	// tasks in the build plan share this temporary directory and therefore should
-	// avoid reading and writing into the same sub-directories as one another.
-	TempDir string `json:"tempDir" yaml:"tempDir" cue:"string | *\"${TEMP_DIR_PLACEHOLDER}\""`
-	// RootDir represents the fully qualified path to the platform root directory.
-	// Useful to construct arguments for commands in BuildPlan tasks.
-	RootDir string `json:"rootDir" yaml:"rootDir" cue:"string | *\"${ROOT_DIR_PLACEHOLDER}\""`
-	// LeafDir represents the cleaned path to the holos component relative to the
-	// platform root.  Useful to construct arguments for commands in BuildPlan
-	// tasks.
-	LeafDir string `json:"leafDir" yaml:"leafDir" cue:"string | *\"${LEAF_DIR_PLACEHOLDER}\""`
-	// HolosExecutable represents the fully qualified path to the holos
-	// executable.  Useful to execute tools embedded as subcommands such as holos
-	// cue vet.
-	HolosExecutable string `json:"holosExecutable" yaml:"holosExecutable" cue:"string | *\"holos\""`
-}
-
-// TODO(jjm): Decide if RootDir and LeafDir are useful.  We have
-// [Component.Path] and [Command] executes with the platform root as the current
-// working directory.
-
-// BuildPlanSpec represents the specification of the [BuildPlan].
-type BuildPlanSpec struct {
-	// Artifacts represents the artifacts for holos to build.
-	Artifacts []Artifact `json:"artifacts" yaml:"artifacts"`
-	// Disabled causes the holos render platform command to skip the BuildPlan.
-	Disabled bool `json:"disabled,omitempty" yaml:"disabled,omitempty"`
-}
-
-// Artifact represents one fully rendered manifest produced by a [Transformer]
-// sequence, which transforms a [Generator] collection.  A [BuildPlan] produces
-// an [Artifact] collection.
-//
-// Each Artifact produces one manifest file or directory artifact.  Generator
-// Output values are used as Transformer Inputs.  The Output field of the final
-// [Transformer] should have the same value as the Artifact field.
-//
-// When there is more than one [Generator] there should be at least one
-// [Transformer] to combine outputs into one Artifact file, or the final
-// artifact should be a directory containing the outputs of the generators.  If
-// there is a single Generator, it may directly produce the Artifact output.
-//
-// An Artifact is processed concurrently with other artifacts in the same
-// [BuildPlan].  One Artifact must not use an output of another Artifact as an
-// input.  Each [Generator] within an artifact also runs concurrently with
-// generators of the same artifact.  Each [Transformer] is executed sequentially
-// starting after all generators have completed.
-//
-// Output fields are write-once.  It is an error for multiple Generators or
-// Transformers to produce the same Output value within the context of a
-// [BuildPlan].
-//
-// When directories are used as inputs or outputs, they behave similar to how
-// `git` works with directories.  When the output field references a directory,
-// all files within the directory are recursively stored using their relative
-// path as a key.  Similar to git add .  When the input field references an
-// absent file, a / is appended and the resulting value is used as a prefix
-// match against all previous task outputs.
-type Artifact struct {
-	Artifact     FileOrDirectoryPath `json:"artifact,omitempty" yaml:"artifact,omitempty"`
-	Generators   []Generator         `json:"generators,omitempty" yaml:"generators,omitempty"`
-	Transformers []Transformer       `json:"transformers,omitempty" yaml:"transformers,omitempty"`
-	Validators   []Validator         `json:"validators,omitempty" yaml:"validators,omitempty"`
-	Skip         bool                `json:"skip,omitempty" yaml:"skip,omitempty"`
-}
-
-// Generator generates Kubernetes resources.  [Helm] and [Resources] are the
-// most commonly used, often paired together to mix-in resources to an
-// unmodified Helm chart.  A simple [File] generator is also available for use
-// with the [Kustomize] transformer.
-//
-// Each Generator in an [Artifact] must have a distinct Output value for a
-// [Transformer] to reference.
-//
-//  1. [Resources] - Generates resources from CUE code.
-//  2. [Helm] - Generates rendered yaml from a [Chart].
-//  3. [File] - Generates data by reading a file from the component directory.
-//  4. [Command] - Generates data by executing an user defined command.
-type Generator struct {
-	// Kind represents the kind of generator.  Must be Resources, Helm, or File.
-	Kind string `json:"kind" yaml:"kind" cue:"\"Resources\" | \"Helm\" | \"File\" | \"Command\""`
-	// Output represents a file for a Transformer or Artifact to consume.
-	Output FileOrDirectoryPath `json:"output" yaml:"output"`
-	// Resources generator. Ignored unless kind is Resources.  Resources are
-	// stored as a two level struct.  The top level key is the Kind of resource,
-	// e.g. Namespace or Deployment.  The second level key is an arbitrary
-	// InternalLabel.  The third level is a map[string]any representing the
-	// Resource.
-	Resources Resources `json:"resources,omitempty" yaml:"resources,omitempty"`
-	// Helm generator. Ignored unless kind is Helm.
-	Helm Helm `json:"helm,omitempty" yaml:"helm,omitempty"`
-	// File generator. Ignored unless kind is File.
-	File File `json:"file,omitempty" yaml:"file,omitempty"`
-	// Command generator. Ignored unless kind is Command.
-	Command Command `json:"command,omitempty" yaml:"command,omitempty"`
-}
-
-// Resource represents one kubernetes api object.
-type Resource map[string]any
-
-// Resources represents Kubernetes resources.  Most commonly used to mix
-// resources into the [BuildPlan] generated from CUE, but may be generated from
-// elsewhere.
-type Resources map[Kind]map[InternalLabel]Resource
-
-// File represents a simple single file copy [Generator].  Useful with a
-// [Kustomize] [Transformer] to process plain manifest files stored in the
-// component directory.  Multiple File generators may be used to transform
-// multiple resources.
-type File struct {
-	// Source represents a file sub-path relative to the component path.
-	Source FilePath `json:"source" yaml:"source"`
-}
-
-// Helm represents a [Chart] manifest [Generator].
-type Helm struct {
-	// Chart represents a helm chart to manage.
-	Chart Chart `json:"chart" yaml:"chart"`
-	// Values represents values for holos to marshal into values.yaml when
-	// rendering the chart.  Values follow ValueFiles when both are provided.
-	Values Values `json:"values" yaml:"values"`
-	// ValueFiles represents hierarchial value files passed in order to the helm
-	// template -f flag.  Useful for migration from an ApplicationSet.  Use Values
-	// instead.  ValueFiles precede Values when both are provided.
-	ValueFiles []ValueFile `json:"valueFiles,omitempty" yaml:"valueFiles,omitempty"`
-	// EnableHooks enables helm hooks when executing the `helm template` command.
-	EnableHooks bool `json:"enableHooks,omitempty" yaml:"enableHooks,omitempty"`
-	// Namespace represents the helm namespace flag
-	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
-	// APIVersions represents the helm template --api-versions flag
-	APIVersions []string `json:"apiVersions,omitempty" yaml:"apiVersions,omitempty"`
-	// KubeVersion represents the helm template --kube-version flag
-	KubeVersion string `json:"kubeVersion,omitempty" yaml:"kubeVersion,omitempty"`
-}
-
-// ValueFile represents one Helm value file produced from CUE.
-type ValueFile struct {
-	// Name represents the file name, e.g. "region-values.yaml"
-	Name string `json:"name" yaml:"name"`
-	// Kind is a discriminator.
-	Kind string `json:"kind" yaml:"kind" cue:"\"Values\""`
-	// Values represents values for holos to marshal into the file name specified
-	// by Name when rendering the chart.
-	Values Values `json:"values,omitempty" yaml:"values,omitempty"`
-}
-
-// Values represents [Helm] Chart values generated from CUE.
-type Values map[string]any
-
-// Chart represents a [Helm] Chart.
-type Chart struct {
-	// Name represents the chart name.
-	Name string `json:"name" yaml:"name"`
-	// Version represents the chart version.
-	Version string `json:"version" yaml:"version"`
-	// Release represents the chart release when executing helm template.
-	Release string `json:"release" yaml:"release"`
-	// Repository represents the repository to fetch the chart from.
-	Repository Repository `json:"repository,omitempty" yaml:"repository,omitempty"`
-}
-
-// Repository represents a [Helm] [Chart] repository.
-//
-// The Auth field is useful to configure http basic authentication to the Helm
-// repository.  Holos gets the username and password from the environment
-// variables represented by the Auth field.
-type Repository struct {
-	Name string `json:"name" yaml:"name"`
-	URL  string `json:"url" yaml:"url"`
-	Auth Auth   `json:"auth,omitempty" yaml:"auth,omitempty"`
-}
-
-// Auth represents environment variable names containing auth credentials.
-type Auth struct {
-	Username AuthSource `json:"username" yaml:"username"`
-	Password AuthSource `json:"password" yaml:"password"`
-}
-
-// AuthSource represents a source for the value of an [Auth] field.
-type AuthSource struct {
-	Value   string `json:"value,omitempty" yaml:"value,omitempty"`
-	FromEnv string `json:"fromEnv,omitempty" yaml:"fromEnv,omitempty"`
-}
-
-// Transformer combines multiple inputs from prior [Generator] or [Transformer]
-// outputs into one output.  [Kustomize] is the most commonly used transformer.
-// A simple [Join] is also supported for use with plain manifest files.
-//
-//  1. [Kustomize] - Patch and transform the output from prior generators or
-//     transformers.  See [Introduction to Kustomize].
-//  2. [Join] - Concatenate multiple prior outputs into one output.
-//  3. [Command] - Transforms data by executing an user defined command.
-//
-// [Introduction to Kustomize]: https://kubectl.docs.kubernetes.io/guides/config_management/introduction/
-type Transformer struct {
-	// Kind represents the kind of transformer. Must be Kustomize, or Join.
-	Kind string `json:"kind" yaml:"kind" cue:"\"Kustomize\" | \"Join\" | \"Command\""`
-	// Inputs represents the files to transform. The Output of prior Generators
-	// and Transformers.
-	Inputs []FileOrDirectoryPath `json:"inputs" yaml:"inputs"`
-	// Output represents a file or directory for a subsequent Transformer or
-	// Artifact to consume.
-	Output FileOrDirectoryPath `json:"output" yaml:"output"`
-	// Kustomize transformer. Ignored unless kind is Kustomize.
-	Kustomize Kustomize `json:"kustomize,omitempty" yaml:"kustomize,omitempty"`
-	// Join transformer. Ignored unless kind is Join.
-	Join Join `json:"join,omitempty" yaml:"join,omitempty"`
-	// Command transformer. Ignored unless kind is Command.
-	Command Command `json:"command,omitempty" yaml:"command,omitempty"`
-}
-
-// Join represents a [Transformer] using [bytes.Join] to concatenate multiple
-// inputs into one output with a separator.  Useful for combining output from
-// [Helm] and [Resources] together into one [Artifact] when [Kustomize] is
-// otherwise unnecessary.
-//
-// [bytes.Join]: https://pkg.go.dev/bytes#Join
-type Join struct {
-	Separator string `json:"separator,omitempty" yaml:"separator,omitempty"`
-}
-
-// Kustomize represents a kustomization [Transformer].
-type Kustomize struct {
-	// Kustomization represents the decoded kustomization.yaml file
-	Kustomization Kustomization `json:"kustomization" yaml:"kustomization"`
-	// Files holds file contents for kustomize, e.g. patch files.
-	Files FileContentMap `json:"files,omitempty" yaml:"files,omitempty"`
-}
-
-// Kustomization represents a kustomization.yaml file for use with the
-// [Kustomize] [Transformer].  Untyped to avoid tightly coupling holos to
-// kubectl versions which was a problem for the Flux maintainers.  Type checking
-// is expected to happen in CUE against the kubectl version the user prefers.
-type Kustomization map[string]any
-
-// FileContentMap represents a mapping of file paths to file contents.
-type FileContentMap map[FilePath]FileContent
-
-// FilePath represents a file path.
-type FilePath string
-
-// FileOrDirectoryPath represents a file or a directory path.
-type FileOrDirectoryPath string
-
-// FileContent represents file contents.
-type FileContent string
-
-// Validator validates files.  Useful to validate an [Artifact] prior to writing
-// it out to the final destination.  Holos may execute validators concurrently.
-// See the [validators] tutorial for an end to end example.
-//
-// [validators]: https://holos.run/docs/v1alpha6/tutorial/validators/
-type Validator struct {
-	// Kind represents the kind of transformer. Must be Kustomize, or Join.
-	Kind string `json:"kind" yaml:"kind" cue:"\"Command\""`
-	// Inputs represents the files to validate.  Usually the final Artifact.
-	Inputs []FileOrDirectoryPath `json:"inputs" yaml:"inputs"`
-	// Command validator.  Ignored unless kind is Command.
-	Command Command `json:"command,omitempty" yaml:"command,omitempty"`
-}
-
-// Command represents a [BuildPlan] task implemented by executing an user
-// defined system command.  A task is defined as a [Generator], [Transformer],
-// or [Validator].  Commands are executed with the working directory set to the
-// platform root.
-type Command struct {
-	// DisplayName of the command.  The basename of args[0] is used if empty.
-	DisplayName string `json:"displayName,omitempty" yaml:"displayName,omitempty"`
-	// Args represents the argument vector passed to the os. to execute the
-	// command.
-	Args []string `json:"args,omitempty" yaml:"args,omitempty"`
-	// IsStdoutOutput captures the command stdout as the task output if true.
-	IsStdoutOutput bool `json:"isStdoutOutput,omitempty" yaml:"isStdoutOutput,omitempty"`
-}
-
-// InternalLabel is an arbitrary unique identifier internal to holos itself.
-// The holos cli is expected to never write a InternalLabel value to rendered
-// output files, therefore use a InternalLabel when the identifier must be
-// unique and internal.  Defined as a type for clarity and type checking.
-type InternalLabel string
-
-// Kind is a discriminator. Defined as a type for clarity and type checking.
-type Kind string
-
-// Metadata represents data about the resource such as the Name.
-type Metadata struct {
-	// Name represents the resource name.
-	Name string `json:"name" yaml:"name"`
-	// Labels represents a resource selector.
-	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
-	// Annotations represents arbitrary non-identifying metadata.  For example
-	// holos uses the `app.holos.run/description` annotation to log resources in a
-	// user customized way.
-	Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
-}
-
-// Platform represents a platform to manage.  A Platform specifies a [Component]
-// collection and integrates the components together into a holistic platform.
-// Holos iterates over the [Component] collection producing a [BuildPlan] for
-// each, which holos then executes to render manifests.
-//
-// Inspect a Platform resource holos would process by executing:
-//
-//	cue export --out yaml ./platform
-type Platform struct {
-	// APIVersion represents the versioned schema of this resource.
-	APIVersion string `json:"apiVersion" yaml:"apiVersion" cue:"string | *\"v1alpha6\""`
-	// Kind is a string value representing the resource.
-	Kind string `json:"kind" yaml:"kind" cue:"\"Platform\""`
-	// Metadata represents data about the resource such as the Name.
-	Metadata Metadata `json:"metadata" yaml:"metadata"`
-
-	// Spec represents the platform specification.
-	Spec PlatformSpec `json:"spec" yaml:"spec"`
-}
-
-// PlatformSpec represents the platform specification.
-type PlatformSpec struct {
-	// Components represents a collection of holos components to manage.
-	Components []Component `json:"components" yaml:"components"`
-}
-
-// Component represents the complete context necessary to produce a [BuildPlan]
-// from a path containing parameterized CUE configuration.
-type Component struct {
-	// Name represents the name of the component. Injected as the tag variable
-	// "holos_component_name".
-	Name string `json:"name" yaml:"name"`
-	// Path represents the path of the component relative to the platform root.
-	// Injected as the tag variable "holos_component_path".
-	Path string `json:"path" yaml:"path"`
-	// Parameters represent user defined input variables to produce various
-	// [BuildPlan] resources from one component path.  Injected as CUE @tag
-	// variables.  Parameters with a "holos_" prefix are reserved for use by the
-	// Holos Authors.  Multiple environments are a prime example of an input
-	// parameter that should always be user defined, never defined by Holos.
-	Parameters map[string]string `json:"parameters,omitempty" yaml:"parameters,omitempty"`
-	// Labels represent selector labels for the component.  Holos copies Labels
-	// from the Component to the resulting BuildPlan.
-	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
-	// Annotations represents arbitrary non-identifying metadata.  Use the
-	// `app.holos.run/description` to customize the log message of each BuildPlan.
-	Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
-}

api/meta/v1alpha2/meta.go

@@ -0,0 +1,37 @@
+package v1alpha2
+
+// TypeMeta describes an individual object in an API response or request with
+// strings representing the type of the object and its API schema version.
+// Structures that are versioned or persisted should inline TypeMeta.
+type TypeMeta struct {
+	// Kind is a string value representing the resource this object represents.
+	Kind string `json:"kind"`
+	// APIVersion defines the versioned schema of this representation of an object.
+	APIVersion string `json:"apiVersion" cue:"string | *\"v1alpha2\""`
+}
+
+func (tm *TypeMeta) GetKind() string {
+	return tm.Kind
+}
+
+func (tm *TypeMeta) GetAPIVersion() string {
+	return tm.APIVersion
+}
+
+// Discriminator discriminates the kind of an api object.
+type Discriminator interface {
+	// GetKind returns Kind.
+	GetKind() string
+	// GetAPIVersion returns APIVersion.
+	GetAPIVersion() string
+}
+
+// ObjectMeta represents metadata of a holos component object. The fields are a
+// copy of upstream kubernetes api machinery but are holos objects distinct from
+// kubernetes api objects.
+type ObjectMeta struct {
+	// Name uniquely identifies the holos component instance and must be suitable as a file name.
+	Name string `json:"name,omitempty"`
+	// Namespace confines a holos component to a single namespace via kustomize if set.
+	Namespace string `json:"namespace,omitempty"`
+}

api/v1alpha1/buildplan.go

@@ -0,0 +1,55 @@
+package v1alpha1
+
+import (
+	"fmt"
+	"strings"
+)
+
+// BuildPlan is the primary interface between CUE and the Holos cli.
+type BuildPlan struct {
+	TypeMeta `json:",inline" yaml:",inline"`
+	// Metadata represents the holos component name
+	Metadata ObjectMeta    `json:"metadata,omitempty" yaml:"metadata,omitempty"`
+	Spec     BuildPlanSpec `json:"spec,omitempty" yaml:"spec,omitempty"`
+}
+
+type BuildPlanSpec struct {
+	Disabled   bool                `json:"disabled,omitempty" yaml:"disabled,omitempty"`
+	Components BuildPlanComponents `json:"components,omitempty" yaml:"components,omitempty"`
+	// DeployFiles keys represent file paths relative to the cluster deploy
+	// directory.  Map values represent the string encoded file contents.  Used to
+	// write the argocd Application, but may be used to render any file from CUE.
+	DeployFiles FileContentMap `json:"deployFiles,omitempty" yaml:"deployFiles,omitempty"`
+}
+
+type BuildPlanComponents struct {
+	HelmChartList         []HelmChart                  `json:"helmChartList,omitempty" yaml:"helmChartList,omitempty"`
+	KubernetesObjectsList []KubernetesObjects          `json:"kubernetesObjectsList,omitempty" yaml:"kubernetesObjectsList,omitempty"`
+	KustomizeBuildList    []KustomizeBuild             `json:"kustomizeBuildList,omitempty" yaml:"kustomizeBuildList,omitempty"`
+	Resources             map[string]KubernetesObjects `json:"resources,omitempty" yaml:"resources,omitempty"`
+}
+
+func (bp *BuildPlan) Validate() error {
+	errs := make([]string, 0, 2)
+	if bp.Kind != BuildPlanKind {
+		errs = append(errs, fmt.Sprintf("kind invalid: want: %s have: %s", BuildPlanKind, bp.Kind))
+	}
+	if bp.APIVersion != APIVersion {
+		errs = append(errs, fmt.Sprintf("apiVersion invalid: want: %s have: %s", APIVersion, bp.APIVersion))
+	}
+	if len(errs) > 0 {
+		return fmt.Errorf("invalid BuildPlan: " + strings.Join(errs, ", "))
+	}
+	return nil
+}
+
+func (bp *BuildPlan) ResultCapacity() (count int) {
+	if bp == nil {
+		return 0
+	}
+	count = len(bp.Spec.Components.HelmChartList) +
+		len(bp.Spec.Components.KubernetesObjectsList) +
+		len(bp.Spec.Components.KustomizeBuildList) +
+		len(bp.Spec.Components.Resources)
+	return count
+}

api/v1alpha1/component.go

@@ -0,0 +1,30 @@
+package v1alpha1
+
+// HolosComponent defines the fields common to all holos component kinds including the Render Result.
+type HolosComponent struct {
+	TypeMeta `json:",inline" yaml:",inline"`
+	// Metadata represents the holos component name
+	Metadata ObjectMeta `json:"metadata,omitempty" yaml:"metadata,omitempty"`
+	// APIObjectMap holds the marshalled representation of api objects. Think of
+	// these as resources overlaid at the back of the render pipeline.
+	APIObjectMap APIObjectMap `json:"apiObjectMap,omitempty" yaml:"apiObjectMap,omitempty"`
+	// Kustomization holds the marshalled representation of the flux kustomization
+	// which reconciles resources in git with the api server.
+	Kustomization `json:",inline" yaml:",inline"`
+	// Kustomize represents a kubectl kustomize build post-processing step.
+	Kustomize `json:",inline" yaml:",inline"`
+	// Skip causes holos to take no action regarding the component.
+	Skip bool
+}
+
+func (hc *HolosComponent) NewResult() *Result {
+	return &Result{HolosComponent: *hc}
+}
+
+func (hc *HolosComponent) GetAPIVersion() string {
+	return hc.APIVersion
+}
+
+func (hc *HolosComponent) GetKind() string {
+	return hc.Kind
+}

api/v1alpha1/constants.go

@@ -0,0 +1,11 @@
+package v1alpha1
+
+const (
+	APIVersion    = "holos.run/v1alpha1"
+	BuildPlanKind = "BuildPlan"
+	HelmChartKind = "HelmChart"
+	// ChartDir is the directory name created in the holos component directory to cache a chart.
+	ChartDir = "vendor"
+	// ResourcesFile is the file name used to store component output when post-processing with kustomize.
+	ResourcesFile = "resources.yaml"
+)

api/v1alpha1/doc.go

@@ -0,0 +1,2 @@
+// Package v1alpha1 defines the api boundary between CUE and Holos.
+package v1alpha1

api/v1alpha1/form.go

@@ -0,0 +1,13 @@
+package v1alpha1
+
+import object "github.com/holos-run/holos/service/gen/holos/object/v1alpha1"
+
+// Form represents a collection of Formly json powered form.
+type Form struct {
+	TypeMeta `json:",inline" yaml:",inline"`
+	Spec     FormSpec `json:"spec" yaml:"spec"`
+}
+
+type FormSpec struct {
+	Form object.Form `json:"form" yaml:"form"`
+}

api/v1alpha1/helm.go

@@ -0,0 +1,184 @@
+package v1alpha1
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"syscall"
+
+	"github.com/holos-run/holos"
+	"github.com/holos-run/holos/internal/errors"
+	"github.com/holos-run/holos/internal/logger"
+	"github.com/holos-run/holos/internal/util"
+)
+
+// A HelmChart represents a helm command to provide chart values in order to render kubernetes api objects.
+type HelmChart struct {
+	HolosComponent `json:",inline" yaml:",inline"`
+	// Namespace is the namespace to install into.  TODO: Use metadata.namespace instead.
+	Namespace     string `json:"namespace"`
+	Chart         Chart  `json:"chart"`
+	ValuesContent string `json:"valuesContent"`
+	EnableHooks   bool   `json:"enableHooks"`
+}
+
+type Chart struct {
+	Name       string     `json:"name"`
+	Version    string     `json:"version"`
+	Release    string     `json:"release"`
+	Repository Repository `json:"repository,omitempty"`
+}
+
+type Repository struct {
+	Name string `json:"name"`
+	URL  string `json:"url"`
+}
+
+func (hc *HelmChart) Render(ctx context.Context, path holos.InstancePath) (*Result, error) {
+	result := Result{HolosComponent: hc.HolosComponent}
+	if err := hc.helm(ctx, &result, path); err != nil {
+		return nil, err
+	}
+	result.addObjectMap(ctx, hc.APIObjectMap)
+	if err := result.kustomize(ctx); err != nil {
+		return nil, errors.Wrap(fmt.Errorf("could not kustomize: %w", err))
+	}
+	return &result, nil
+}
+
+// runHelm provides the values produced by CUE to helm template and returns
+// the rendered kubernetes api objects in the result.
+func (hc *HelmChart) helm(ctx context.Context, r *Result, path holos.InstancePath) error {
+	log := logger.FromContext(ctx).With("chart", hc.Chart.Name)
+	if hc.Chart.Name == "" {
+		log.WarnContext(ctx, "skipping helm: no chart name specified, use a different component type")
+		return nil
+	}
+
+	cachedChartPath := filepath.Join(string(path), ChartDir, filepath.Base(hc.Chart.Name))
+	if isNotExist(cachedChartPath) {
+		// Add repositories
+		repo := hc.Chart.Repository
+		if repo.URL != "" {
+			out, err := util.RunCmd(ctx, "helm", "repo", "add", repo.Name, repo.URL)
+			if err != nil {
+				log.ErrorContext(ctx, "could not run helm", "stderr", out.Stderr.String(), "stdout", out.Stdout.String())
+				return errors.Wrap(fmt.Errorf("could not run helm repo add: %w", err))
+			}
+			// Update repository
+			out, err = util.RunCmd(ctx, "helm", "repo", "update", repo.Name)
+			if err != nil {
+				log.ErrorContext(ctx, "could not run helm", "stderr", out.Stderr.String(), "stdout", out.Stdout.String())
+				return errors.Wrap(fmt.Errorf("could not run helm repo update: %w", err))
+			}
+		} else {
+			log.DebugContext(ctx, "no chart repository url proceeding assuming oci chart")
+		}
+
+		// Cache the chart
+		if err := cacheChart(ctx, path, ChartDir, hc.Chart); err != nil {
+			return fmt.Errorf("could not cache chart: %w", err)
+		}
+	}
+
+	// Write values file
+	tempDir, err := os.MkdirTemp("", "holos")
+	if err != nil {
+		return errors.Wrap(fmt.Errorf("could not make temp dir: %w", err))
+	}
+	defer util.Remove(ctx, tempDir)
+
+	valuesPath := filepath.Join(tempDir, "values.yaml")
+	if err := os.WriteFile(valuesPath, []byte(hc.ValuesContent), 0644); err != nil {
+		return errors.Wrap(fmt.Errorf("could not write values: %w", err))
+	}
+	log.DebugContext(ctx, "helm: wrote values", "path", valuesPath, "bytes", len(hc.ValuesContent))
+
+	// Run charts
+	chart := hc.Chart
+	args := []string{"template"}
+	if !hc.EnableHooks {
+		args = append(args, "--no-hooks")
+	}
+	namespace := hc.Namespace
+	args = append(args, "--include-crds", "--values", valuesPath, "--namespace", namespace, "--kubeconfig", "/dev/null", "--version", chart.Version, chart.Release, cachedChartPath)
+	helmOut, err := util.RunCmd(ctx, "helm", args...)
+	if err != nil {
+		stderr := helmOut.Stderr.String()
+		lines := strings.Split(stderr, "\n")
+		for _, line := range lines {
+			if strings.HasPrefix(line, "Error:") {
+				err = fmt.Errorf("%s: %w", line, err)
+			}
+		}
+		return errors.Wrap(fmt.Errorf("could not run helm template: %w", err))
+	}
+
+	r.accumulatedOutput = helmOut.Stdout.String()
+
+	return nil
+}
+
+// cacheChart stores a cached copy of Chart in the chart subdirectory of path.
+//
+// It is assumed that the only method responsible for writing to chartDir is
+// cacheChart itself.
+//
+// This relies on the atomicity of moving temporary directories into place on
+// the same filesystem via os.Rename. If a syscall.EEXIST error occurs during
+// renaming, it indicates that the cached chart already exists, which is an
+// expected scenario when this function is called concurrently.
+func cacheChart(ctx context.Context, path holos.InstancePath, chartDir string, chart Chart) error {
+	log := logger.FromContext(ctx)
+
+	cacheTemp, err := os.MkdirTemp(string(path), chartDir)
+	if err != nil {
+		return errors.Wrap(fmt.Errorf("could not make temp dir: %w", err))
+	}
+	defer util.Remove(ctx, cacheTemp)
+
+	chartName := chart.Name
+	if chart.Repository.Name != "" {
+		chartName = fmt.Sprintf("%s/%s", chart.Repository.Name, chart.Name)
+	}
+	helmOut, err := util.RunCmd(ctx, "helm", "pull", "--destination", cacheTemp, "--untar=true", "--version", chart.Version, chartName)
+	if err != nil {
+		return errors.Wrap(fmt.Errorf("could not run helm pull: %w", err))
+	}
+	log.Debug("helm pull", "stdout", helmOut.Stdout, "stderr", helmOut.Stderr)
+
+	cachePath := filepath.Join(string(path), chartDir)
+
+	if err := os.MkdirAll(cachePath, 0777); err != nil {
+		return errors.Wrap(fmt.Errorf("could not mkdir: %w", err))
+	}
+
+	items, err := os.ReadDir(cacheTemp)
+	if err != nil {
+		return errors.Wrap(fmt.Errorf("could not read directory: %w", err))
+	}
+
+	for _, item := range items {
+		src := filepath.Join(cacheTemp, item.Name())
+		dst := filepath.Join(cachePath, item.Name())
+		log.DebugContext(ctx, "rename", "src", src, "dst", dst)
+		if err := os.Rename(src, dst); err != nil {
+			var linkErr *os.LinkError
+			if errors.As(err, &linkErr) && errors.Is(linkErr.Err, syscall.EEXIST) {
+				log.DebugContext(ctx, "cache already exists", "chart", chart.Name, "chart_version", chart.Version, "path", cachePath)
+			} else {
+				return errors.Wrap(fmt.Errorf("could not rename: %w", err))
+			}
+		}
+	}
+
+	log.InfoContext(ctx, "cached", "chart", chart.Name, "chart_version", chart.Version, "path", cachePath)
+
+	return nil
+}
+func isNotExist(path string) bool {
+	_, err := os.Stat(path)
+	return os.IsNotExist(err)
+}

api/v1alpha1/kubernetesobjects.go

@@ -0,0 +1,21 @@
+package v1alpha1
+
+import (
+	"context"
+
+	"github.com/holos-run/holos"
+)
+
+const KubernetesObjectsKind = "KubernetesObjects"
+
+// KubernetesObjects represents CUE output which directly provides Kubernetes api objects to holos.
+type KubernetesObjects struct {
+	HolosComponent `json:",inline" yaml:",inline"`
+}
+
+// Render produces kubernetes api objects from the APIObjectMap
+func (o *KubernetesObjects) Render(ctx context.Context, path holos.InstancePath) (*Result, error) {
+	result := Result{HolosComponent: o.HolosComponent}
+	result.addObjectMap(ctx, o.APIObjectMap)
+	return &result, nil
+}

api/v1alpha1/kustomization.go

@@ -0,0 +1,7 @@
+package v1alpha1
+
+// Kustomization holds the rendered flux kustomization api object content for git ops.
+type Kustomization struct {
+	// KsContent is the yaml representation of the flux kustomization for gitops.
+	KsContent string `json:"ksContent,omitempty" yaml:"ksContent,omitempty"`
+}

api/v1alpha1/kustomize.go

@@ -0,0 +1,47 @@
+package v1alpha1
+
+import (
+	"context"
+
+	"github.com/holos-run/holos"
+	"github.com/holos-run/holos/internal/errors"
+	"github.com/holos-run/holos/internal/logger"
+	"github.com/holos-run/holos/internal/util"
+)
+
+const KustomizeBuildKind = "KustomizeBuild"
+
+// Kustomize represents resources necessary to execute a kustomize build.
+// Intended for at least two use cases:
+//
+//  1. Process raw yaml file resources in a holos component directory.
+//  2. Post process a HelmChart to inject istio, add custom labels, etc...
+type Kustomize struct {
+	// KustomizeFiles holds file contents for kustomize, e.g. patch files.
+	KustomizeFiles FileContentMap `json:"kustomizeFiles,omitempty" yaml:"kustomizeFiles,omitempty"`
+	// ResourcesFile is the file name used for api objects in kustomization.yaml
+	ResourcesFile string `json:"resourcesFile,omitempty" yaml:"resourcesFile,omitempty"`
+}
+
+// KustomizeBuild renders plain yaml files in the holos component directory using kubectl kustomize build.
+type KustomizeBuild struct {
+	HolosComponent `json:",inline" yaml:",inline"`
+}
+
+// Render produces a Result by executing kubectl kustomize on the holos
+// component path. Useful for processing raw yaml files.
+func (kb *KustomizeBuild) Render(ctx context.Context, path holos.InstancePath) (*Result, error) {
+	log := logger.FromContext(ctx)
+	result := Result{HolosComponent: kb.HolosComponent}
+	// Run kustomize.
+	kOut, err := util.RunCmd(ctx, "kubectl", "kustomize", string(path))
+	if err != nil {
+		log.ErrorContext(ctx, kOut.Stderr.String())
+		return nil, errors.Wrap(err)
+	}
+	// Replace the accumulated output
+	result.accumulatedOutput = kOut.Stdout.String()
+	// Add CUE based api objects.
+	result.addObjectMap(ctx, kb.APIObjectMap)
+	return &result, nil
+}

api/v1alpha1/objectmap.go

@@ -0,0 +1,14 @@
+package v1alpha1
+
+// Label is an arbitrary unique identifier.  Defined as a type for clarity and type checking.
+type Label string
+
+// Kind is a kubernetes api object kind. Defined as a type for clarity and type checking.
+type Kind string
+
+// APIObjectMap is the shape of marshalled api objects returned from cue to the
+// holos cli. A map is used to improve the clarity of error messages from cue.
+type APIObjectMap map[Kind]map[Label]string
+
+// FileContentMap is a map of file names to file contents.
+type FileContentMap map[string]string

api/v1alpha1/objectmeta.go

@@ -0,0 +1,15 @@
+package v1alpha1
+
+// ObjectMeta represents metadata of a holos component object. The fields are a
+// copy of upstream kubernetes api machinery but are by holos objects distinct
+// from kubernetes api objects.
+type ObjectMeta struct {
+	// Name uniquely identifies the holos component instance and must be suitable as a file name.
+	Name string `json:"name,omitempty" yaml:"name,omitempty"`
+	// Namespace confines a holos component to a single namespace via kustomize if set.
+	Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
+	// Labels are not used but are copied from api machinery ObjectMeta for completeness.
+	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
+	// Annotations are not used but are copied from api machinery ObjectMeta for completeness.
+	Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
+}

api/v1alpha1/platform.go

@@ -0,0 +1,32 @@
+package v1alpha1
+
+import "google.golang.org/protobuf/types/known/structpb"
+
+// Platform represents a platform to manage.  A Platform resource informs holos
+// which components to build.  The platform resource also acts as a container
+// for the platform model form values provided by the PlatformService.  The
+// primary use case is to collect the cluster names, cluster types, platform
+// model, and holos components to build into one resource.
+type Platform struct {
+	TypeMeta `json:",inline" yaml:",inline"`
+	Metadata ObjectMeta   `json:"metadata" yaml:"metadata"`
+	Spec     PlatformSpec `json:"spec" yaml:"spec"`
+}
+
+// PlatformSpec represents the platform build plan specification.
+type PlatformSpec struct {
+	// Model represents the platform model holos gets from from the
+	// holos.platform.v1alpha1.PlatformService.GetPlatform method and provides to
+	// CUE using a tag.
+	Model      structpb.Struct         `json:"model" yaml:"model"`
+	Components []PlatformSpecComponent `json:"components" yaml:"components"`
+}
+
+// PlatformSpecComponent represents a component to build or render with flags to
+// pass, for example the cluster name.
+type PlatformSpecComponent struct {
+	// Path is the path of the component relative to the platform root.
+	Path string `json:"path" yaml:"path"`
+	// Cluster is the cluster name to use when building the component.
+	Cluster string `json:"cluster" yaml:"cluster"`
+}

api/v1alpha1/render.go

@@ -0,0 +1,22 @@
+package v1alpha1
+
+import (
+	"context"
+
+	"github.com/holos-run/holos"
+)
+
+type Renderer interface {
+	GetKind() string
+	Render(ctx context.Context, path holos.InstancePath) (*Result, error)
+}
+
+// Render produces a Result representing the kubernetes api objects to
+// configure. Each of the various holos component types, e.g. Helm, Kustomize,
+// et al, should implement the Renderer interface. This process is best
+// conceptualized as a data pipeline, for example a component may render a
+// result by first calling helm template, then passing the result through
+// kustomize, then mixing in overlay api objects.
+func Render(ctx context.Context, r Renderer, path holos.InstancePath) (*Result, error) {
+	return r.Render(ctx, path)
+}

api/v1alpha1/result.go

@@ -0,0 +1,165 @@
+package v1alpha1
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"slices"
+
+	"github.com/holos-run/holos/internal/errors"
+	"github.com/holos-run/holos/internal/logger"
+	"github.com/holos-run/holos/internal/util"
+)
+
+// Result is the build result for display or writing.  Holos components Render the Result as a data pipeline.
+type Result struct {
+	HolosComponent
+	// accumulatedOutput accumulates rendered api objects.
+	accumulatedOutput string
+	// DeployFiles keys represent file paths relative to the cluster deploy
+	// directory.  Map values represent the string encoded file contents.  Used to
+	// write the argocd Application, but may be used to render any file from CUE.
+	DeployFiles FileContentMap `json:"deployFiles,omitempty" yaml:"deployFiles,omitempty"`
+}
+
+// Continue returns true if Skip is true indicating the result is to be skipped over.
+func (r *Result) Continue() bool {
+	if r == nil {
+		return false
+	}
+	return r.Skip
+}
+
+func (r *Result) Name() string {
+	return r.Metadata.Name
+}
+
+func (r *Result) Filename(writeTo string, cluster string) string {
+	name := r.Metadata.Name
+	return filepath.Join(writeTo, "clusters", cluster, "components", name, name+".gen.yaml")
+}
+
+func (r *Result) KustomizationFilename(writeTo string, cluster string) string {
+	return filepath.Join(writeTo, "clusters", cluster, "holos", "components", r.Metadata.Name+"-kustomization.gen.yaml")
+}
+
+// AccumulatedOutput returns the accumulated rendered output.
+func (r *Result) AccumulatedOutput() string {
+	return r.accumulatedOutput
+}
+
+// addObjectMap renders the provided APIObjectMap into the accumulated output.
+func (r *Result) addObjectMap(ctx context.Context, objectMap APIObjectMap) {
+	log := logger.FromContext(ctx)
+	b := []byte(r.AccumulatedOutput())
+	kinds := make([]Kind, 0, len(objectMap))
+	// Sort the keys
+	for kind := range objectMap {
+		kinds = append(kinds, kind)
+	}
+	slices.Sort(kinds)
+
+	for _, kind := range kinds {
+		v := objectMap[kind]
+		// Sort the keys
+		names := make([]Label, 0, len(v))
+		for name := range v {
+			names = append(names, name)
+		}
+		slices.Sort(names)
+
+		for _, name := range names {
+			yamlString := v[name]
+			log.Debug(fmt.Sprintf("%s/%s", kind, name), "kind", kind, "name", name)
+			b = util.EnsureNewline(b)
+			header := fmt.Sprintf("---\n# Source: CUE apiObjects.%s.%s\n", kind, name)
+			b = append(b, []byte(header+yamlString)...)
+			b = util.EnsureNewline(b)
+		}
+	}
+	r.accumulatedOutput = string(b)
+}
+
+// kustomize replaces the accumulated output with the output of kustomize build
+func (r *Result) kustomize(ctx context.Context) error {
+	log := logger.FromContext(ctx)
+	if r.ResourcesFile == "" {
+		log.DebugContext(ctx, "skipping kustomize: no resourcesFile")
+		return nil
+	}
+	if len(r.KustomizeFiles) < 1 {
+		log.DebugContext(ctx, "skipping kustomize: no kustomizeFiles")
+		return nil
+	}
+	tempDir, err := os.MkdirTemp("", "holos.kustomize")
+	if err != nil {
+		return errors.Wrap(err)
+	}
+	defer util.Remove(ctx, tempDir)
+
+	// Write the main api object resources file for kustomize.
+	target := filepath.Join(tempDir, r.ResourcesFile)
+	b := []byte(r.AccumulatedOutput())
+	b = util.EnsureNewline(b)
+	if err := os.WriteFile(target, b, 0644); err != nil {
+		return errors.Wrap(fmt.Errorf("could not write resources: %w", err))
+	}
+	log.DebugContext(ctx, "wrote: "+target, "op", "write", "path", target, "bytes", len(b))
+
+	// Write the kustomization tree, kustomization.yaml must be in this map for kustomize to work.
+	for file, content := range r.KustomizeFiles {
+		target := filepath.Join(tempDir, file)
+		if err := os.MkdirAll(filepath.Dir(target), 0755); err != nil {
+			return errors.Wrap(err)
+		}
+		b := []byte(content)
+		b = util.EnsureNewline(b)
+		if err := os.WriteFile(target, b, 0644); err != nil {
+			return errors.Wrap(fmt.Errorf("could not write: %w", err))
+		}
+		log.DebugContext(ctx, "wrote: "+target, "op", "write", "path", target, "bytes", len(b))
+	}
+
+	// Run kustomize.
+	kOut, err := util.RunCmd(ctx, "kubectl", "kustomize", tempDir)
+	if err != nil {
+		log.ErrorContext(ctx, kOut.Stderr.String())
+		return errors.Wrap(err)
+	}
+	// Replace the accumulated output
+	r.accumulatedOutput = kOut.Stdout.String()
+	return nil
+}
+
+func (r *Result) WriteDeployFiles(ctx context.Context, path string) error {
+	log := logger.FromContext(ctx)
+	if len(r.DeployFiles) == 0 {
+		return nil
+	}
+	for k, content := range r.DeployFiles {
+		path := filepath.Join(path, k)
+		if err := r.Save(ctx, path, content); err != nil {
+			return errors.Wrap(err)
+		}
+		log.InfoContext(ctx, "wrote deploy file", "path", path, "bytes", len(content))
+	}
+	return nil
+}
+
+// Save writes the content to the filesystem for git ops.
+func (r *Result) Save(ctx context.Context, path string, content string) error {
+	log := logger.FromContext(ctx)
+	dir := filepath.Dir(path)
+	if err := os.MkdirAll(dir, os.FileMode(0775)); err != nil {
+		log.WarnContext(ctx, "could not mkdir", "path", dir, "err", err)
+		return errors.Wrap(err)
+	}
+	// Write the file content
+	if err := os.WriteFile(path, []byte(content), os.FileMode(0644)); err != nil {
+		log.WarnContext(ctx, "could not write", "path", path, "err", err)
+		return errors.Wrap(err)
+	}
+	log.DebugContext(ctx, "out: wrote "+path, "action", "write", "path", path, "status", "ok")
+	return nil
+}

api/v1alpha1/typemeta.go

@@ -0,0 +1,20 @@
+package v1alpha1
+
+type TypeMeta struct {
+	Kind       string `json:"kind,omitempty" yaml:"kind,omitempty"`
+	APIVersion string `json:"apiVersion,omitempty" yaml:"apiVersion,omitempty"`
+}
+
+func (tm *TypeMeta) GetKind() string {
+	return tm.Kind
+}
+
+func (tm *TypeMeta) GetAPIVersion() string {
+	return tm.APIVersion
+}
+
+// Discriminator is an interface to discriminate the kind api object.
+type Discriminator interface {
+	GetKind() string
+	GetAPIVersion() string
+}

buf.gen.yaml

@@ -0,0 +1,20 @@
+# Generates gRPC and ConnectRPC bindings for Go and TypeScript
+#
+# Note: protoc-gen-connect-query is the primary method of wiring up the React
+# frontend.
+version: v1
+plugins:
+  - plugin: go
+    out: service/gen
+    opt: paths=source_relative
+  - plugin: connect-go
+    out: service/gen
+    opt: paths=source_relative
+  - plugin: es
+    out: internal/frontend/holos/src/app/gen
+    opt:
+      - target=ts
+  - plugin: connect-es
+    out: internal/frontend/holos/src/app/gen
+    opt:
+      - target=ts

buf.lock

@@ -0,0 +1,8 @@
+# Generated by buf. DO NOT EDIT.
+version: v1
+deps:
+  - remote: buf.build
+    owner: bufbuild
+    repository: protovalidate
+    commit: b983156c5e994cc9892e0ce3e64e17e0
+    digest: shake256:fb47a62989d38c2529bcc5cd86ded43d800eb84cee82b42b9e8a9e815d4ee8134a0fb9d0ce8299b27c2d2bbb7d6ade0c4ad5a8a4d467e1e2c7ca619ae9f634e2

buf.work.yaml

@@ -0,0 +1,3 @@
+version: v1
+directories:
+  - service

cmd/cmd.go

@@ -1,34 +0,0 @@
-package cmd
-
-import (
-	"context"
-	"fmt"
-	"log/slog"
-	"os"
-
-	"github.com/holos-run/holos/internal/cli"
-	"github.com/holos-run/holos/internal/holos"
-	"github.com/holos-run/holos/version"
-)
-
-// MakeMain makes a main function for the cli or tests.
-func MakeMain(options ...holos.Option) func() int {
-	return func() (exitCode int) {
-		// TODO(jjm): check HOLOS_CHDIR and chdir if set for tests.
-		if len(os.Args) >= 2 && os.Args[1] == "version" {
-			if _, err := fmt.Println(version.GetVersion()); err != nil {
-				panic(err)
-			}
-			return 0
-		}
-		cfg := holos.New(options...)
-		slog.SetDefault(cfg.Logger())
-		ctx := context.Background()
-		cmd := cli.New(cfg)
-
-		if err := cmd.ExecuteContext(ctx); err != nil {
-			return cli.HandleError(ctx, err, cfg)
-		}
-		return 0
-	}
-}

cmd/holos/main.go

@@ -3,9 +3,9 @@ package main
 import (
 	"os"
 
-	"github.com/holos-run/holos/cmd"
+	"github.com/holos-run/holos/internal/cli"
 )
 
 func main() {
-	os.Exit(cmd.MakeMain()())
+	os.Exit(cli.MakeMain()())
 }

cmd/holos/main_test.go

@@ -2,51 +2,20 @@ package main
 
 import (
 	"os"
-	"path/filepath"
 	"testing"
 
-	cue "cuelang.org/go/cmd/cue/cmd"
-	"github.com/holos-run/holos/cmd"
+	"github.com/holos-run/holos/internal/cli"
 	"github.com/rogpeppe/go-internal/testscript"
 )
 
 func TestMain(m *testing.M) {
-	holosMain := cmd.MakeMain()
-	testscript.Main(m, map[string]func(){
-		"holos": func() { os.Exit(holosMain()) },
-		"cue":   func() { os.Exit(cue.Main()) },
+	os.Exit(testscript.RunMain(m, map[string]func() int{
+		"holos": cli.MakeMain(),
+	}))
+}
+
+func TestGetSecrets(t *testing.T) {
+	testscript.Run(t, testscript.Params{
+		Dir: "testdata",
 	})
 }
-
-func TestGuides_v1alpha5(t *testing.T) {
-	testscript.Run(t, params(filepath.Join("v1alpha5", "guides")))
-}
-
-func TestSchemas_v1alpha5(t *testing.T) {
-	testscript.Run(t, params(filepath.Join("v1alpha5", "schemas")))
-}
-
-func TestIssues_v1alpha5(t *testing.T) {
-	testscript.Run(t, params(filepath.Join("v1alpha5", "issues")))
-}
-
-func TestCLI(t *testing.T) {
-	testscript.Run(t, params("cli"))
-}
-
-func params(dir string) testscript.Params {
-	return testscript.Params{
-		Dir:                 filepath.Join("tests", dir),
-		RequireExplicitExec: true,
-		RequireUniqueNames:  os.Getenv("HOLOS_WORKDIR_ROOT") == "",
-		WorkdirRoot:         os.Getenv("HOLOS_WORKDIR_ROOT"),
-		UpdateScripts:       os.Getenv("HOLOS_UPDATE_SCRIPTS") != "",
-		Setup: func(env *testscript.Env) error {
-			// Just like cmd/cue/cmd.TestScript, set up separate cache and config dirs per test.
-			env.Setenv("CUE_CACHE_DIR", filepath.Join(env.WorkDir, "tmp/cachedir"))
-			configDir := filepath.Join(env.WorkDir, "tmp/configdir")
-			env.Setenv("CUE_CONFIG_DIR", configDir)
-			return nil
-		},
-	}
-}

cmd/holos/testdata/constraints.txt

@@ -0,0 +1,34 @@
+# Want support for intermediary constraints
+exec holos build ./foo/... --log-level debug
+stdout '^bf2bc7f9-9ba0-4f9e-9bd2-9a205627eb0b$'
+
+-- platform.config.json --
+{}
+-- cue.mod --
+package holos
+-- foo/constraints.cue --
+package holos
+
+metadata: name: "jeff"
+-- foo/bar/bar.cue --
+package holos
+
+spec: components: KubernetesObjectsList: [
+  #KubernetesObjects & {
+    apiObjectMap: foo: bar: "bf2bc7f9-9ba0-4f9e-9bd2-9a205627eb0b"
+  }
+]
+-- schema.cue --
+package holos
+
+_cluster: string @tag(cluster, string)
+_platform_config: string @tag(platform_config, string)
+
+#KubernetesObjects: {
+	apiVersion: "holos.run/v1alpha1"
+	kind: "KubernetesObjects"
+	apiObjectMap: {...}
+}
+
+apiVersion: "holos.run/v1alpha1"
+kind: "BuildPlan"

cmd/holos/testdata/issue15_cue_errors.txt

@@ -0,0 +1,20 @@
+# Want cue errors to show files and lines
+! exec holos build .
+stderr 'apiObjectMap.foo.bar: cannot convert incomplete value'
+stderr '/component.cue:\d+:\d+$'
+
+-- platform.config.json --
+{}
+-- cue.mod --
+package holos
+-- component.cue --
+package holos
+
+_cluster: string @tag(cluster, string)
+_platform_config: string @tag(platform_config, string)
+
+apiVersion: "holos.run/v1alpha1"
+kind: "BuildPlan"
+spec: components: KubernetesObjectsList: [{apiObjectMap: foo: bar: _baz}]
+
+_baz: string

cmd/holos/testdata/issue25_apiobjects_cue.txt

@@ -0,0 +1,61 @@
+# Want kube api objects in the apiObjects output.
+exec holos build .
+stdout '^kind: SecretStore$'
+stdout '# Source: CUE apiObjects.SecretStore.default'
+
+-- platform.config.json --
+{}
+-- cue.mod --
+package holos
+-- component.cue --
+package holos
+
+apiVersion: "holos.run/v1alpha1"
+kind: "BuildPlan"
+spec: components: KubernetesObjectsList: [{apiObjectMap: #APIObjects.apiObjectMap}]
+
+_cluster: string @tag(cluster, string)
+_platform_config: string @tag(platform_config, string)
+
+#SecretStore: {
+    kind: string
+    metadata: name: string
+}
+
+#APIObjects: {
+  apiObjects: {
+    SecretStore: {
+      default: #SecretStore & { metadata: name: "default" }
+    }
+  }
+}
+
+
+-- schema.cue --
+package holos
+
+// #APIObjects is the output type for api objects produced by cue.  A map is used to aid debugging and clarity.
+import "encoding/yaml"
+
+#APIObjects: {
+	// apiObjects holds each the api objects produced by cue.
+	apiObjects: {
+		[Kind=_]: {
+			[Name=_]: {
+				kind: Kind
+				metadata: name: Name
+			}
+		}
+	}
+
+	// apiObjectsContent holds the marshalled representation of apiObjects
+	apiObjectMap: {
+		for kind, v in apiObjects {
+			"\(kind)": {
+				for name, obj in v {
+				  "\(name)": yaml.Marshal(obj)
+			  }
+			}
+		}
+	}
+}

cmd/holos/testdata/issue25_apiobjects_helm.txt

@@ -0,0 +1,62 @@
+# Want kube api objects in the apiObjects output.
+exec holos build .
+stdout '^kind: SecretStore$'
+stdout '# Source: CUE apiObjects.SecretStore.default'
+stderr 'skipping helm: no chart name specified'
+
+-- platform.config.json --
+{}
+-- cue.mod --
+package holos
+-- component.cue --
+package holos
+
+apiVersion: "holos.run/v1alpha1"
+kind: "BuildPlan"
+spec: components: HelmChartList: [{apiObjectMap: #APIObjects.apiObjectMap}]
+
+_cluster: string @tag(cluster, string)
+_platform_config: string @tag(platform_config, string)
+
+#SecretStore: {
+    kind: string
+    metadata: name: string
+}
+
+#APIObjects: {
+  apiObjects: {
+    SecretStore: {
+      default: #SecretStore & { metadata: name: "default" }
+    }
+  }
+}
+
+
+-- schema.cue --
+package holos
+
+// #APIObjects is the output type for api objects produced by cue.  A map is used to aid debugging and clarity.
+import "encoding/yaml"
+
+#APIObjects: {
+	// apiObjects holds each the api objects produced by cue.
+	apiObjects: {
+		[Kind=_]: {
+			[Name=_]: {
+				kind: Kind
+				metadata: name: Name
+			}
+		}
+	}
+
+	// apiObjectsContent holds the marshalled representation of apiObjects
+	apiObjectMap: {
+		for kind, v in apiObjects {
+			"\(kind)": {
+				for name, obj in v {
+				  "\(name)": yaml.Marshal(obj)
+			  }
+			}
+		}
+	}
+}

cmd/holos/testdata/issue25_show_object_names.txt

@@ -0,0 +1,25 @@
+# Want api object kind and name in errors
+! exec holos build .
+stderr 'apiObjects.secretstore.default.foo: field not allowed'
+
+-- platform.config.json --
+{}
+-- cue.mod --
+package holos
+-- component.cue --
+package holos
+
+apiVersion: "holos.run/v1alpha1"
+kind: "KubernetesObjects"
+cluster: string @tag(cluster, string)
+_platform_config: string @tag(platform_config, string)
+
+#SecretStore: {
+    metadata: name: string
+}
+
+apiObjects: {
+  secretstore: {
+    default: #SecretStore & { foo: "not allowed" }
+  }
+}

cmd/holos/testdata/issue33_helm_stderr.txt

@@ -0,0 +1,289 @@
+# Want helm errors to show up
+! exec holos build .
+stderr 'Error: execution error at \(zitadel/templates/secret_zitadel-masterkey.yaml:2:4\): Either set .Values.zitadel.masterkey xor .Values.zitadel.masterkeySecretName'
+
+-- platform.config.json --
+{}
+-- cue.mod --
+package holos
+-- zitadel.cue --
+package holos
+
+apiVersion: "holos.run/v1alpha1"
+kind: "BuildPlan"
+spec: components: HelmChartList: [_HelmChart]
+
+_cluster: string @tag(cluster, string)
+_platform_config: string @tag(platform_config, string)
+
+_HelmChart: {
+  apiVersion: "holos.run/v1alpha1"
+  kind: "HelmChart"
+  metadata: name: "zitadel"
+  namespace: "zitadel"
+  chart: {
+    name:    "zitadel"
+    version: "7.9.0"
+    release: name
+    repository: {
+      name: "zitadel"
+      url:  "https://charts.zitadel.com"
+    }
+  }
+}
+
+-- vendor/zitadel/templates/secret_zitadel-masterkey.yaml --
+{{- if (or (and .Values.zitadel.masterkey .Values.zitadel.masterkeySecretName) (and (not .Values.zitadel.masterkey) (not .Values.zitadel.masterkeySecretName)) ) }}
+{{- fail "Either set .Values.zitadel.masterkey xor .Values.zitadel.masterkeySecretName" }}
+{{- end }}
+{{- if .Values.zitadel.masterkey -}}
+apiVersion: v1
+kind: Secret
+type: Opaque
+metadata:
+  name: zitadel-masterkey
+  {{- with .Values.zitadel.masterkeyAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+  labels:
+    {{- include "zitadel.labels" . | nindent 4 }}
+stringData:
+  masterkey: {{ .Values.zitadel.masterkey }}
+{{- end -}}
+-- vendor/zitadel/Chart.yaml --
+apiVersion: v2
+appVersion: v2.46.0
+description: A Helm chart for ZITADEL
+icon: https://zitadel.com/zitadel-logo-dark.svg
+kubeVersion: '>= 1.21.0-0'
+maintainers:
+- email: support@zitadel.com
+  name: zitadel
+  url: https://zitadel.com
+name: zitadel
+type: application
+version: 7.9.0
+-- vendor/zitadel/values.yaml --
+# Default values for zitadel.
+zitadel:
+  # The ZITADEL config under configmapConfig is written to a Kubernetes ConfigMap
+  # See all defaults here:
+  # https://github.com/zitadel/zitadel/blob/main/cmd/defaults.yaml
+  configmapConfig:
+    ExternalSecure: true
+    Machine:
+      Identification:
+        Hostname:
+          Enabled: true
+        Webhook:
+          Enabled: false
+
+  # The ZITADEL config under secretConfig is written to a Kubernetes Secret
+  # See all defaults here:
+  # https://github.com/zitadel/zitadel/blob/main/cmd/defaults.yaml
+  secretConfig:
+
+  # Annotations set on secretConfig secret
+  secretConfigAnnotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "0"
+
+  # Reference the name of a secret that contains ZITADEL configuration.
+  configSecretName:
+  # The key under which the ZITADEL configuration is located in the secret.
+  configSecretKey: config-yaml
+
+  # ZITADEL uses the masterkey for symmetric encryption.
+  # You can generate it for example with tr -dc A-Za-z0-9 </dev/urandom | head -c 32
+  masterkey: ""
+  # Reference the name of the secret that contains the masterkey. The key should be named "masterkey".
+  # Note: Either zitadel.masterkey or zitadel.masterkeySecretName must be set
+  masterkeySecretName: ""
+
+  # Annotations set on masterkey secret
+  masterkeyAnnotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "0"
+
+  # The CA Certificate needed for establishing secure database connections
+  dbSslCaCrt: ""
+
+  # The Secret containing the CA certificate at key ca.crt needed for establishing secure database connections
+  dbSslCaCrtSecret: ""
+
+  # The db admins secret containing the client certificate and key at tls.crt and tls.key needed for establishing secure database connections
+  dbSslAdminCrtSecret: ""
+
+  # The db users secret containing the client certificate and key at tls.crt and tls.key needed for establishing secure database connections
+  dbSslUserCrtSecret: ""
+
+  # Generate a self-signed certificate using an init container
+  # This will also mount the generated files to /etc/tls/ so that you can reference them in the pod.
+  # E.G. KeyPath: /etc/tls/tls.key CertPath: /etc/tls/tls.crt
+  # By default, the SAN DNS names include, localhost, the POD IP address and the POD name. You may include one more by using additionalDnsName like "my.zitadel.fqdn".
+  selfSignedCert:
+    enabled: false
+    additionalDnsName:
+
+replicaCount: 3
+
+image:
+  repository: ghcr.io/zitadel/zitadel
+  pullPolicy: IfNotPresent
+  # Overrides the image tag whose default is the chart appVersion.
+  tag: ""
+
+chownImage:
+  repository: alpine
+  pullPolicy: IfNotPresent
+  tag: "3.19"
+
+imagePullSecrets: []
+nameOverride: ""
+fullnameOverride: ""
+
+# Annotations to add to the deployment
+annotations: {}
+
+# Annotations to add to the configMap
+configMap:
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "0"
+
+serviceAccount:
+  # Specifies whether a service account should be created
+  create: true
+  # Annotations to add to the service account
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "0"
+  # The name of the service account to use.
+  # If not set and create is true, a name is generated using the fullname template
+  name: ""
+
+podAnnotations: {}
+
+podAdditionalLabels: {}
+
+podSecurityContext:
+  runAsNonRoot: true
+  runAsUser: 1000
+
+securityContext: {}
+
+# Additional environment variables
+env:
+  []
+  # - name: ZITADEL_DATABASE_POSTGRES_HOST
+  #   valueFrom:
+  #     secretKeyRef:
+  #       name: postgres-pguser-postgres
+  #       key: host
+
+service:
+  type: ClusterIP
+  # If service type is "ClusterIP", this can optionally be set to a fixed IP address.
+  clusterIP: ""
+  port: 8080
+  protocol: http2
+  annotations: {}
+  scheme: HTTP
+
+ingress:
+  enabled: false
+  className: ""
+  annotations: {}
+  hosts:
+    - host: localhost
+      paths:
+        - path: /
+          pathType: Prefix
+  tls: []
+
+resources: {}
+
+nodeSelector: {}
+
+tolerations: []
+
+affinity: {}
+
+topologySpreadConstraints: []
+
+initJob:
+  # Once ZITADEL is installed, the initJob can be disabled.
+  enabled: true
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "1"
+  resources: {}
+  backoffLimit: 5
+  activeDeadlineSeconds: 300
+  extraContainers: []
+  podAnnotations: {}
+  # Available init commands :
+  # "": initialize ZITADEL instance (without skip anything)
+  # database: initialize only the database
+  # grant: set ALL grant to user
+  # user: initialize only the database user
+  # zitadel: initialize ZITADEL internals (skip "create user" and "create database")
+  command: ""
+
+setupJob:
+  annotations:
+    helm.sh/hook: pre-install,pre-upgrade
+    helm.sh/hook-delete-policy: before-hook-creation
+    helm.sh/hook-weight: "2"
+  resources: {}
+  activeDeadlineSeconds: 300
+  extraContainers: []
+  podAnnotations: {}
+  additionalArgs:
+    - "--init-projections=true"
+  machinekeyWriter:
+    image:
+      repository: bitnami/kubectl
+      tag: ""
+    resources: {}
+
+readinessProbe:
+  enabled: true
+  initialDelaySeconds: 0
+  periodSeconds: 5
+  failureThreshold: 3
+
+livenessProbe:
+  enabled: true
+  initialDelaySeconds: 0
+  periodSeconds: 5
+  failureThreshold: 3
+
+startupProbe:
+  enabled: true
+  periodSeconds: 1
+  failureThreshold: 30
+
+metrics:
+  enabled: false
+  serviceMonitor:
+    # If true, the chart creates a ServiceMonitor that is compatible with Prometheus Operator
+    # https://github.com/prometheus-operator/prometheus-operator/blob/main/Documentation/api.md#monitoring.coreos.com/v1.ServiceMonitor.
+    # The Prometheus community Helm chart installs this operator
+    # https://github.com/prometheus-community/helm-charts/tree/main/charts/kube-prometheus-stack#kube-prometheus-stack
+    enabled: false
+    honorLabels: false
+    honorTimestamps: true
+
+pdb:
+  enabled: false
+  # these values are used for the PDB and are mutally exclusive
+  minAvailable: 1
+  # maxUnavailable: 1
+  annotations: {}

cmd/holos/testdata/issue42_kustomize_build_kind.txt

@@ -0,0 +1,39 @@
+# Kustomize is a supported holos component kind
+exec holos render component --cluster-name=mycluster . --log-level=debug
+
+# Want generated output
+cmp want.yaml deploy/clusters/mycluster/components/kstest/kstest.gen.yaml
+
+-- platform.config.json --
+{}
+-- cue.mod --
+package holos
+-- component.cue --
+package holos
+
+_cluster: string @tag(cluster, string)
+_platform_config: string @tag(platform_config, string)
+
+apiVersion: "holos.run/v1alpha1"
+kind: "BuildPlan"
+spec: components: KustomizeBuildList: [{metadata: name: "kstest"}]
+
+-- kustomization.yaml --
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: mynamespace
+resources:
+- serviceaccount.yaml
+
+-- serviceaccount.yaml --
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+
+-- want.yaml --
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: test
+  namespace: mynamespace

cmd/holos/testdata/issue72_disallow_unknown_fields.txt

@@ -0,0 +1,17 @@
+# https://github.com/holos-run/holos/issues/72
+# Want holos to fail on unknown fields to catch typos and aid refactors
+! exec holos build .
+stderr 'unknown field \\"TypoKubernetesObjectsList\\"'
+
+-- platform.config.json --
+{}
+-- cue.mod --
+package holos
+-- component.cue --
+package holos
+_cluster: string @tag(cluster, string)
+_platform_config: string @tag(platform_config, string)
+
+apiVersion: "holos.run/v1alpha1"
+kind: "BuildPlan"
+spec: components: TypoKubernetesObjectsList: []

cmd/holos/tests/cli/cue-vet.txt

@@ -1,12 +0,0 @@
-# https://github.com/holos-run/holos/issues/358
-# holos cue vet should fail verifications with exit code 1
-! exec holos cue vet ./policy --path strings.ToLower(kind) ./data/secret.yaml
-# holos cue vet should report validation errors to stderr
-stderr 'Forbidden. Use an ExternalSecret instead.'
-
--- data/secret.yaml --
-kind: Secret
--- policy/validators.cue --
-package policy
-
-secret: kind: "Forbidden. Use an ExternalSecret instead."

cmd/holos/tests/cli/first-impression.txt

@@ -1,7 +0,0 @@
-# https://github.com/holos-run/holos/issues/334
-exec holos
-stdout Usage
-exec holos --version
-stdout \d+\.\d+\.\d+
-exec holos version
-stdout \d+\.\d+\.\d+

cmd/holos/tests/v1alpha5/issues/issue348-kustomize-patch-name.txt

@@ -1,65 +0,0 @@
-# https://github.com/holos-run/holos/issues/348
-# when the optional kustomize patch name field is omitted
-exec holos init platform v1alpha5 --force
-# want a buildplan shown
-exec holos show buildplans
-cp stdout buildplan-output.yaml
-exec holos compare yaml buildplan-output.yaml buildplan.yaml
-# want this error to go away
-! stderr 'cannot convert non-concrete value string'
--- platform/example.cue --
-package holos
-
-Platform: Components: example: {
-	name: "example"
-	path: "components/example"
-}
--- components/example/example.cue --
-package holos
-
-import "encoding/yaml"
-
-holos: Component.BuildPlan
-
-Component: #Kustomize & {
-	KustomizeConfig: Kustomization: patches: [
-		{
-			target: kind: "CustomResourceDefinition"
-			patch: yaml.Marshal([{
-				op:    "add"
-				path:  "/metadata/annotations/example"
-				value: "example-value"
-			}])
-		},
-	]
-}
--- buildplan.yaml --
-kind: BuildPlan
-apiVersion: v1alpha5
-metadata:
-  name: example
-spec:
-  artifacts:
-    - artifact: components/example/example.gen.yaml
-      generators:
-        - kind: Resources
-          output: resources.gen.yaml
-      transformers:
-        - kind: Kustomize
-          inputs:
-            - resources.gen.yaml
-          output: components/example/example.gen.yaml
-          kustomize:
-            kustomization:
-              apiVersion: kustomize.config.k8s.io/v1beta1
-              kind: Kustomization
-              patches:
-                - patch: |
-                    - op: add
-                      path: /metadata/annotations/example
-                      value: example-value
-                  target:
-                    kind: CustomResourceDefinition
-                    name: ""
-              resources:
-                - resources.gen.yaml

cmd/holos/tests/v1alpha5/issues/issue366-cue-build-tags.txt

@@ -1,52 +0,0 @@
-# https://github.com/holos-run/holos/issues/366
-# Build tags conditionally include CUE files.
-env HOME=$WORK
-
-exec holos init platform v1alpha5 --force
-exec holos show platform
-cp stdout empty.yaml
-exec holos compare yaml empty.yaml want/empty.yaml
-
-exec holos show platform -t foo
-cp stdout foo.yaml
-exec holos compare yaml foo.yaml want/foo.yaml
-
--- platform/empty.cue --
-@if(foo)
-package holos
-
-Platform: Components: foo: _
--- platform/metadata.cue --
-package holos
-
-Platform: Components: [NAME=string]: {
-  name: NAME
-  path: "components/empty"
-  labels: "app.holos.run/name": NAME
-  annotations: "app.holos.run/description": "\(NAME) empty test case"
-}
--- components/empty/empty.cue --
-package holos
-
-Component: #Kubernetes & {}
-holos: Component.BuildPlan
--- want/empty.yaml --
-kind: Platform
-apiVersion: v1alpha5
-metadata:
-  name: default
-spec:
-  components: []
--- want/foo.yaml --
-kind: Platform
-apiVersion: v1alpha5
-metadata:
-  name: default
-spec:
-  components:
-    - name: foo
-      path: components/empty
-      labels:
-        app.holos.run/name: foo
-      annotations:
-        app.holos.run/description: foo empty test case

cmd/holos/tests/v1alpha5/schemas/capabilities.txt

@@ -1,147 +0,0 @@
-# https://github.com/holos-run/holos/issues/330
-# take care to install helm 3.17.3 otherwise kube versions may not align
-exec holos init platform v1alpha5 --force
-# Make sure the helm chart works with plain helm
-exec helm template ./components/capabilities/vendor/0.1.0/capabilities
-stdout 'name: has-foo-v1beta1'
-stdout 'kubeVersion: v'
-exec holos render platform ./platform
-# When no capabilities are specified
-exec holos compare yaml deploy/components/capabilities/capabilities.gen.yaml want/when-no-capabilities-specified.yaml
-# With APIVersions specified
-exec holos compare yaml deploy/components/specified/specified.gen.yaml want/with-capabilities-specified.yaml
-# With KubeVersion specified
-exec holos compare yaml deploy/components/kubeversion1/kubeversion1.gen.yaml want/with-kubeversion-specified.yaml
-# With both APIVersions and KubeVersion specified
-exec holos compare yaml deploy/components/kubeversion2/kubeversion2.gen.yaml want/with-both-specified.yaml
--- want/with-both-specified.yaml --
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    kubeVersion: v1.20.0
-  name: has-foo-v1
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: http
--- want/with-kubeversion-specified.yaml --
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    kubeVersion: v1.20.0
-  name: has-foo-v1beta1
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: http
--- want/when-no-capabilities-specified.yaml --
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    kubeVersion: v1.99.0
-  name: has-foo-v1beta1
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: http
--- want/with-capabilities-specified.yaml --
-apiVersion: v1
-kind: Service
-metadata:
-  annotations:
-    kubeVersion: v1.99.0
-  name: has-foo-v1
-spec:
-  ports:
-  - name: http
-    port: 80
-    protocol: TCP
-    targetPort: http
--- platform/capabilities.cue --
-package holos
-
-import "encoding/json"
-
-Platform: Components: capabilities: {
-        name: "capabilities"
-        path: "components/capabilities"
-}
-Platform: Components: specified: {
-        name: "specified"
-        path: "components/capabilities"
-        parameters: apiVersions: json.Marshal(["foo/v1","bar/v1"])
-}
-Platform: Components: kubeversion1: {
-        name: "kubeversion1"
-        path: "components/capabilities"
-        parameters: kubeVersion: "v1.20.0"
-}
-Platform: Components: kubeversion2: {
-        name: "kubeversion2"
-        path: "components/capabilities"
-        parameters: kubeVersion: "v1.20.0"
-        parameters: apiVersions: json.Marshal(["foo/v1","bar/v1"])
-}
--- components/capabilities/capabilities.cue --
-package holos
-
-import "encoding/json"
-
-holos: Component.BuildPlan
-
-Component: #Helm & {
-        Name: string @tag(holos_component_name, type=string)
-        Chart: name: "capabilities"
-        Chart: version: "0.1.0"
-        _APIVersions: string | *"[]" @tag(apiVersions, type=string)
-        APIVersions: json.Unmarshal(_APIVersions)
-        KubeVersion: string | *"v1.99.0" @tag(kubeVersion, type=string)
-}
--- components/capabilities/vendor/0.1.0/capabilities/Chart.yaml --
-apiVersion: v2
-name: capabilities
-description: A Helm chart for Kubernetes
-type: application
-version: 0.1.0
-appVersion: "1.16.0"
--- components/capabilities/vendor/0.1.0/capabilities/templates/service.yaml --
-apiVersion: v1
-kind: Service
-metadata:
-{{- if .Capabilities.APIVersions.Has "foo/v1" }}
-  name: has-foo-v1
-{{- else }}
-  name: has-foo-v1beta1
-{{- end }}
-  annotations:
-    kubeVersion: {{ .Capabilities.KubeVersion }}
-spec:
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http
--- want/helm-template.yaml --
----
-# Source: capabilities/templates/service.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: has-foo-v1beta1
-  annotations:
-    kubeVersion: v1.99.0
-spec:
-  ports:
-    - port: 80
-      targetPort: http
-      protocol: TCP
-      name: http

cmd/holos/tests/v1alpha5/schemas/kubernetes.txt

@@ -1,46 +0,0 @@
-# author.#Kubernetes
-
-# Start in an empty directory.
-cd $WORK
-
-# Generate the directory structure we're going to work in.
-exec holos init platform v1alpha5 --force
-
-# Platforms are empty by default.
-exec holos render platform
-stderr -count=1 '^rendered platform'
-
-# When author.#Kubernetes is empty
-exec holos cue export --expression holos --out=yaml ./components/empty
-cp stdout empty.yaml
-exec holos compare yaml empty.yaml want.txt
-
--- components/empty/empty.cue --
-package holos
-
-Kubernetes: #Kubernetes & {}
-holos: Kubernetes.BuildPlan
--- want.txt --
-kind: BuildPlan
-apiVersion: v1alpha5
-metadata:
-  name: no-name
-spec:
-  artifacts:
-    - artifact: components/no-name/no-name.gen.yaml
-      generators:
-        - kind: Resources
-          output: resources.gen.yaml
-          resources: {}
-      transformers:
-        - kind: Kustomize
-          inputs:
-            - resources.gen.yaml
-          output: components/no-name/no-name.gen.yaml
-          kustomize:
-            kustomization:
-              apiVersion: kustomize.config.k8s.io/v1beta1
-              kind: Kustomization
-              resources:
-                - resources.gen.yaml
-      validators: []

cmd/holos/tests/v1alpha5/schemas/validators.txt

@@ -1,37 +0,0 @@
-# https://github.com/holos-run/holos/issues/357
-exec holos init platform v1alpha5 --force
-! exec holos render platform
-stderr 'secret.kind: conflicting values "Forbidden. Use an ExternalSecret instead." and "Secret"'
-
--- validators.cue --
-package holos
-
-import "github.com/holos-run/holos/api/author/v1alpha5:author"
-
-#ComponentConfig: author.#ComponentConfig & {
-	Validators: cue: {
-		kind: "Command"
-		command: args: ["holos", "cue", "vet", "./policy", "--path", "strings.ToLower(kind)"]
-	}
-}
--- policy/validations.cue --
-package validations
-
-secret: kind: "Forbidden. Use an ExternalSecret instead."
--- platform/example.cue --
-package holos
-
-Platform: Components: example: {
-	name: "example"
-	path: "components/example"
-}
--- components/example/secret.cue --
-package holos
-
-holos: Component.BuildPlan
-
-Component: #Kubernetes & {
-	Resources: Secret: test: {
-		metadata: name: "test"
-	}
-}

cue.mod/module.cue

@@ -0,0 +1 @@
+module: "github.com/holos-run/holos"

doc/md/api.mdx

@@ -1,10 +0,0 @@
----
-slug: api
-description: Schema Reference
----
-
-import DocCardList from '@theme/DocCardList';
-
-# Schema Reference
-
-<DocCardList />

doc/md/api/author.md

@@ -1,189 +0,0 @@
----
-title: Author Schemas
-description: Standardized schemas for component authors.
-sidebar_position: 200
----
-<!-- Code generated by gomarkdoc. DO NOT EDIT -->
-
-
-```go
-import "github.com/holos-run/holos/api/author/v1alpha6"
-```
-
-Package author contains a standard set of schemas for component authors to generate common [core](<https://holos.run/docs/api/core/>) BuildPlans.
-
-Holos values stability, flexibility, and composition. This package intentionally defines only the minimal necessary set of structures. Component authors are encouraged to define their own structures building on our example [topics](<https://holos.run/docs/topics/>).
-
-The Holos Maintainers may add definitions to this package if the community identifies nearly all users must define the exact same structure. Otherwise, definitions should be added as a customizable example in [topics](<https://holos.run/docs/topics/>).
-
-For example, structures representing a cluster and environment almost always need to be defined. Their definition varies from one organization to the next. Therefore, customizable definitions for a cluster and environment are best maintained in [topics](<https://holos.run/docs/topics/>), not standardized in this package.
-
-## Index
-
-- [type ComponentConfig](<#ComponentConfig>)
-- [type Helm](<#Helm>)
-- [type Kubernetes](<#Kubernetes>)
-- [type Kustomize](<#Kustomize>)
-- [type KustomizeConfig](<#KustomizeConfig>)
-- [type NameLabel](<#NameLabel>)
-- [type Platform](<#Platform>)
-
-
-<a name="ComponentConfig"></a>
-## type ComponentConfig {#ComponentConfig}
-
-ComponentConfig represents the configuration common to all kinds of components for use with the holos render component command. All component kinds may be transformed with [kustomize](<https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/>) configured with the [KustomizeConfig](<#KustomizeConfig>) field.
-
-- [Helm](<#Helm>) charts.
-- [Kubernetes](<#Kubernetes>) resources generated from CUE.
-- [Kustomize](<#Kustomize>) bases.
-
-```go
-type ComponentConfig struct {
-    // Name represents the BuildPlan metadata.name field.  Used to construct the
-    // fully rendered manifest file path.
-    Name string
-    // Labels represent the BuildPlan metadata.labels field.
-    Labels map[string]string
-    // Annotations represent the BuildPlan metadata.annotations field.
-    Annotations map[string]string
-
-    // Path represents the path to the component producing the BuildPlan.
-    Path string
-    // Parameters are useful to reuse a component with various parameters.
-    // Injected as CUE @tag variables.  Parameters with a "holos_" prefix are
-    // reserved for use by the Holos Authors.
-    Parameters map[string]string
-    // OutputBaseDir represents the output base directory used when assembling
-    // artifacts.  Useful to organize components by clusters or other parameters.
-    // For example, holos writes resource manifests to
-    // {WriteTo}/{OutputBaseDir}/components/{Name}/{Name}.gen.yaml
-    OutputBaseDir string `cue:"string | *\"\""`
-
-    // Resources represents kubernetes resources mixed into the rendered manifest.
-    Resources core.Resources
-    // KustomizeConfig represents the kustomize configuration.
-    KustomizeConfig KustomizeConfig
-    // Validators represent checks that must pass for output to be written.
-    Validators map[NameLabel]core.Validator
-    // Artifacts represents additional artifacts to mix in.  Useful for adding
-    // GitOps resources.  Each Artifact is unified without modification into the
-    // BuildPlan.
-    Artifacts map[NameLabel]core.Artifact
-}
-```
-
-<a name="Helm"></a>
-## type Helm {#Helm}
-
-Helm assembles a BuildPlan rendering a helm chart. Useful to mix in additional resources from CUE and transform the helm output with kustomize.
-
-```go
-type Helm struct {
-    ComponentConfig `json:",inline"`
-
-    // Chart represents a Helm chart.
-    Chart core.Chart
-    // Values represents data to marshal into a values.yaml for helm.
-    Values core.Values
-    // ValueFiles represents value files for migration from helm value
-    // hierarchies.  Use Values instead.
-    ValueFiles []core.ValueFile `json:",omitempty"`
-    // EnableHooks enables helm hooks when executing the `helm template` command.
-    EnableHooks bool `cue:"true | *false"`
-    // Namespace sets the helm chart namespace flag if provided.
-    Namespace string `json:",omitempty"`
-    // APIVersions represents the helm template --api-versions flag
-    APIVersions []string `json:",omitempty"`
-    // KubeVersion represents the helm template --kube-version flag
-    KubeVersion string `json:",omitempty"`
-
-    // BuildPlan represents the derived BuildPlan produced for the holos render
-    // component command.
-    BuildPlan core.BuildPlan
-}
-```
-
-<a name="Kubernetes"></a>
-## type Kubernetes {#Kubernetes}
-
-Kubernetes assembles a BuildPlan containing inline resources exported from CUE.
-
-```go
-type Kubernetes struct {
-    ComponentConfig `json:",inline"`
-
-    // BuildPlan represents the derived BuildPlan produced for the holos render
-    // component command.
-    BuildPlan core.BuildPlan
-}
-```
-
-<a name="Kustomize"></a>
-## type Kustomize {#Kustomize}
-
-Kustomize assembles a BuildPlan rendering manifests from a [kustomize](<https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/>) kustomization.
-
-```go
-type Kustomize struct {
-    ComponentConfig `json:",inline"`
-
-    // BuildPlan represents the derived BuildPlan produced for the holos render
-    // component command.
-    BuildPlan core.BuildPlan
-}
-```
-
-<a name="KustomizeConfig"></a>
-## type KustomizeConfig {#KustomizeConfig}
-
-KustomizeConfig represents the configuration for [kustomize](<https://kubectl.docs.kubernetes.io/references/kustomize/kustomization/>) post processing. Use the Files field to mix in plain manifest files located in the component directory. Use the Resources field to mix in manifests from network urls.
-
-```go
-type KustomizeConfig struct {
-    // Kustomization represents the kustomization used to transform resources.
-    // Note the resources field is internally managed from the Files and Resources fields.
-    Kustomization map[string]any `json:",omitempty"`
-    // Files represents files to copy from the component directory for kustomization.
-    Files map[string]struct{ Source string } `cue:"{[NAME=_]: Source: NAME}"`
-    // Resources represents additional entries to included in the resources list.
-    Resources map[string]struct{ Source string } `cue:"{[NAME=_]: Source: NAME}"`
-    // CommonLabels represents common labels added without including selectors.
-    CommonLabels map[string]string
-}
-```
-
-<a name="NameLabel"></a>
-## type NameLabel {#NameLabel}
-
-NameLabel represents the common use case of converting a struct to a list where the name field of each value unifies with the field name of the outer struct.
-
-For example:
-
-```
-S: [NameLabel=string]: name: NameLabel
-S: jeff: _
-S: gary: _
-S: nate: _
-L: [for x in S {x}]
-// L is [{name: "jeff"}, {name: "gary"}, {name: "nate"}]
-```
-
-```go
-type NameLabel string
-```
-
-<a name="Platform"></a>
-## type Platform {#Platform}
-
-Platform assembles a core Platform in the Resource field for the holos render platform command. Use the Components field to register components with the platform.
-
-```go
-type Platform struct {
-    Name       string                       `json:"name" yaml:"name" cue:"string | *\"default\""`
-    Components map[NameLabel]core.Component `json:"components" yaml:"components"`
-    Resource   core.Platform                `json:"resource" yaml:"resource"`
-}
-```
-
-Generated by [gomarkdoc](<https://github.com/princjef/gomarkdoc>)

doc/md/api/core.md

@@ -1,621 +0,0 @@
----
-title: Core Schemas
-description: BuildPlan defines the holos rendering pipeline.
-sidebar_position: 100
----
-<!-- Code generated by gomarkdoc. DO NOT EDIT -->
-
-
-```go
-import "github.com/holos-run/holos/api/core/v1alpha6"
-```
-
-Package core contains schemas for a [Platform](<#Platform>) and [BuildPlan](<#BuildPlan>). Holos takes a [Platform](<#Platform>) as input, then iterates over each [Component](<#Component>) to produce a [BuildPlan](<#BuildPlan>). Holos processes the [BuildPlan](<#BuildPlan>) to produce fully rendered manifests, each an [Artifact](<#Artifact>).
-
-## Index
-
-- [Constants](<#constants>)
-- [type Artifact](<#Artifact>)
-- [type Auth](<#Auth>)
-- [type AuthSource](<#AuthSource>)
-- [type BuildContext](<#BuildContext>)
-- [type BuildPlan](<#BuildPlan>)
-- [type BuildPlanSpec](<#BuildPlanSpec>)
-- [type Chart](<#Chart>)
-- [type Command](<#Command>)
-- [type Component](<#Component>)
-- [type File](<#File>)
-- [type FileContent](<#FileContent>)
-- [type FileContentMap](<#FileContentMap>)
-- [type FileOrDirectoryPath](<#FileOrDirectoryPath>)
-- [type FilePath](<#FilePath>)
-- [type Generator](<#Generator>)
-- [type Helm](<#Helm>)
-- [type InternalLabel](<#InternalLabel>)
-- [type Join](<#Join>)
-- [type Kind](<#Kind>)
-- [type Kustomization](<#Kustomization>)
-- [type Kustomize](<#Kustomize>)
-- [type Metadata](<#Metadata>)
-- [type Platform](<#Platform>)
-- [type PlatformSpec](<#PlatformSpec>)
-- [type Repository](<#Repository>)
-- [type Resource](<#Resource>)
-- [type Resources](<#Resources>)
-- [type Transformer](<#Transformer>)
-- [type Validator](<#Validator>)
-- [type ValueFile](<#ValueFile>)
-- [type Values](<#Values>)
-
-
-## Constants
-
-<a name="BuildContextTag"></a>BuildContextTag represents the cue tag holos render component uses to inject the json representation of a [BuildContext](<#BuildContext>) for use in a BuildPlan.
-
-```go
-const BuildContextTag string = "holos_build_context"
-```
-
-<a name="ComponentAnnotationsTag"></a>ComponentAnnotationsTag represents the tag holos uses to inject the json representation of [Component](<#Component>) metadata annotations from the holos render platform command to the holos render component command.
-
-```go
-const ComponentAnnotationsTag = "holos_component_annotations"
-```
-
-<a name="ComponentLabelsTag"></a>ComponentLabelsTag represents the cue tag holos uses to inject the json representation of [Component](<#Component>) metadata labels from the holos render platform command to the holos render component command.
-
-```go
-const ComponentLabelsTag string = "holos_component_labels"
-```
-
-<a name="ComponentNameTag"></a>ComponentNameTag represents the cue tag holos uses to inject a [Component](<#Component>) name from the holos render platform command to the holos render component command.
-
-```go
-const ComponentNameTag string = "holos_component_name"
-```
-
-<a name="ComponentPathTag"></a>ComponentPathTag represents the cue tag holos uses to inject a [Component](<#Component>) path relative to the cue module root from the holos render platform command to the holos render component command.
-
-```go
-const ComponentPathTag string = "holos_component_path"
-```
-
-<a name="Artifact"></a>
-## type Artifact {#Artifact}
-
-Artifact represents one fully rendered manifest produced by a [Transformer](<#Transformer>) sequence, which transforms a [Generator](<#Generator>) collection. A [BuildPlan](<#BuildPlan>) produces an [Artifact](<#Artifact>) collection.
-
-Each Artifact produces one manifest file or directory artifact. Generator Output values are used as Transformer Inputs. The Output field of the final [Transformer](<#Transformer>) should have the same value as the Artifact field.
-
-When there is more than one [Generator](<#Generator>) there should be at least one [Transformer](<#Transformer>) to combine outputs into one Artifact file, or the final artifact should be a directory containing the outputs of the generators. If there is a single Generator, it may directly produce the Artifact output.
-
-An Artifact is processed concurrently with other artifacts in the same [BuildPlan](<#BuildPlan>). One Artifact must not use an output of another Artifact as an input. Each [Generator](<#Generator>) within an artifact also runs concurrently with generators of the same artifact. Each [Transformer](<#Transformer>) is executed sequentially starting after all generators have completed.
-
-Output fields are write\-once. It is an error for multiple Generators or Transformers to produce the same Output value within the context of a [BuildPlan](<#BuildPlan>).
-
-When directories are used as inputs or outputs, they behave similar to how \`git\` works with directories. When the output field references a directory, all files within the directory are recursively stored using their relative path as a key. Similar to git add . When the input field references an absent file, a / is appended and the resulting value is used as a prefix match against all previous task outputs.
-
-```go
-type Artifact struct {
-    Artifact     FileOrDirectoryPath `json:"artifact,omitempty" yaml:"artifact,omitempty"`
-    Generators   []Generator         `json:"generators,omitempty" yaml:"generators,omitempty"`
-    Transformers []Transformer       `json:"transformers,omitempty" yaml:"transformers,omitempty"`
-    Validators   []Validator         `json:"validators,omitempty" yaml:"validators,omitempty"`
-    Skip         bool                `json:"skip,omitempty" yaml:"skip,omitempty"`
-}
-```
-
-<a name="Auth"></a>
-## type Auth {#Auth}
-
-Auth represents environment variable names containing auth credentials.
-
-```go
-type Auth struct {
-    Username AuthSource `json:"username" yaml:"username"`
-    Password AuthSource `json:"password" yaml:"password"`
-}
-```
-
-<a name="AuthSource"></a>
-## type AuthSource {#AuthSource}
-
-AuthSource represents a source for the value of an [Auth](<#Auth>) field.
-
-```go
-type AuthSource struct {
-    Value   string `json:"value,omitempty" yaml:"value,omitempty"`
-    FromEnv string `json:"fromEnv,omitempty" yaml:"fromEnv,omitempty"`
-}
-```
-
-<a name="BuildContext"></a>
-## type BuildContext {#BuildContext}
-
-BuildContext represents build context values owned by the holos render component command. End users should not manage context field values. End users may reference fields from within CUE to refer to late binding concrete values defined just before holos executes a [BuildPlan](<#BuildPlan>).
-
-Holos injects build context values by marshalling this struct to json through the holos\_build\_context cue tag.
-
-Example usage from cue to produce a [BuildPlan](<#BuildPlan>):
-
-```
-package holos
-
-import (
-  "encoding/json"
-  "github.com/holos-run/holos/api/core/v1alpha6:core"
-)
-
-_BuildContextJSON: string | *"{}" @tag(holos_build_context, type=string)
-BuildContext: core.#BuildContext & json.Unmarshal(_BuildContextJSON)
-
-holos: core.#BuildPlan & {
-  buildContext: BuildContext
-  "spec": {
-    "artifacts": [
-      {
-        artifact: "components/slice",
-        "transformers": [
-          {
-            "kind": "Command"
-            "inputs": ["resources.gen.yaml"]
-            "output": artifact
-            "command": {
-              "args": [
-                "kubectl-slice",
-                "-f",
-                "\(buildContext.tempDir)/resources.gen.yaml",
-                "-o",
-                "\(buildContext.tempDir)/\(artifact)",
-              ]
-            }
-          }
-        ]
-      }
-    ]
-  }
-}
-```
-
-```go
-type BuildContext struct {
-    // TempDir represents the temporary directory managed and owned by the holos
-    // render component command for the execution of one BuildPlan.  Multiple
-    // tasks in the build plan share this temporary directory and therefore should
-    // avoid reading and writing into the same sub-directories as one another.
-    TempDir string `json:"tempDir" yaml:"tempDir" cue:"string | *\"${TEMP_DIR_PLACEHOLDER}\""`
-    // RootDir represents the fully qualified path to the platform root directory.
-    // Useful to construct arguments for commands in BuildPlan tasks.
-    RootDir string `json:"rootDir" yaml:"rootDir" cue:"string | *\"${ROOT_DIR_PLACEHOLDER}\""`
-    // LeafDir represents the cleaned path to the holos component relative to the
-    // platform root.  Useful to construct arguments for commands in BuildPlan
-    // tasks.
-    LeafDir string `json:"leafDir" yaml:"leafDir" cue:"string | *\"${LEAF_DIR_PLACEHOLDER}\""`
-    // HolosExecutable represents the fully qualified path to the holos
-    // executable.  Useful to execute tools embedded as subcommands such as holos
-    // cue vet.
-    HolosExecutable string `json:"holosExecutable" yaml:"holosExecutable" cue:"string | *\"holos\""`
-}
-```
-
-<a name="BuildPlan"></a>
-## type BuildPlan {#BuildPlan}
-
-BuildPlan represents an implementation of the [rendered manifest pattern](<https://akuity.io/blog/the-rendered-manifests-pattern>). Holos processes a BuildPlan to produce one or more [Artifact](<#Artifact>) output files. BuildPlan artifact files usually contain Kubernetes manifests, but they may have any content.
-
-A BuildPlan usually produces two artifacts. One artifact contains a manifest of resources. A second artifact contains a GitOps resource to manage the first, usually an ArgoCD Application resource.
-
-Holos uses CUE to construct a BuildPlan. Holos injects late binding values such as the build temp dir using the [BuildContext](<#BuildContext>).
-
-```go
-type BuildPlan struct {
-    // APIVersion represents the versioned schema of the resource.
-    APIVersion string `json:"apiVersion" yaml:"apiVersion" cue:"\"v1alpha6\""`
-    // Kind represents the type of the resource.
-    Kind string `json:"kind" yaml:"kind" cue:"\"BuildPlan\""`
-    // Metadata represents data about the resource such as the Name.
-    Metadata Metadata `json:"metadata" yaml:"metadata"`
-    // Spec specifies the desired state of the resource.
-    Spec BuildPlanSpec `json:"spec" yaml:"spec"`
-    // BuildContext represents values injected by holos just before evaluating a
-    // BuildPlan, for example the tempDir used for the build.
-    BuildContext BuildContext `json:"buildContext" yaml:"buildContext"`
-}
-```
-
-<a name="BuildPlanSpec"></a>
-## type BuildPlanSpec {#BuildPlanSpec}
-
-BuildPlanSpec represents the specification of the [BuildPlan](<#BuildPlan>).
-
-```go
-type BuildPlanSpec struct {
-    // Artifacts represents the artifacts for holos to build.
-    Artifacts []Artifact `json:"artifacts" yaml:"artifacts"`
-    // Disabled causes the holos render platform command to skip the BuildPlan.
-    Disabled bool `json:"disabled,omitempty" yaml:"disabled,omitempty"`
-}
-```
-
-<a name="Chart"></a>
-## type Chart {#Chart}
-
-Chart represents a [Helm](<#Helm>) Chart.
-
-```go
-type Chart struct {
-    // Name represents the chart name.
-    Name string `json:"name" yaml:"name"`
-    // Version represents the chart version.
-    Version string `json:"version" yaml:"version"`
-    // Release represents the chart release when executing helm template.
-    Release string `json:"release" yaml:"release"`
-    // Repository represents the repository to fetch the chart from.
-    Repository Repository `json:"repository,omitempty" yaml:"repository,omitempty"`
-}
-```
-
-<a name="Command"></a>
-## type Command {#Command}
-
-Command represents a [BuildPlan](<#BuildPlan>) task implemented by executing an user defined system command. A task is defined as a [Generator](<#Generator>), [Transformer](<#Transformer>), or [Validator](<#Validator>). Commands are executed with the working directory set to the platform root.
-
-```go
-type Command struct {
-    // DisplayName of the command.  The basename of args[0] is used if empty.
-    DisplayName string `json:"displayName,omitempty" yaml:"displayName,omitempty"`
-    // Args represents the argument vector passed to the os. to execute the
-    // command.
-    Args []string `json:"args,omitempty" yaml:"args,omitempty"`
-    // IsStdoutOutput captures the command stdout as the task output if true.
-    IsStdoutOutput bool `json:"isStdoutOutput,omitempty" yaml:"isStdoutOutput,omitempty"`
-}
-```
-
-<a name="Component"></a>
-## type Component {#Component}
-
-Component represents the complete context necessary to produce a [BuildPlan](<#BuildPlan>) from a path containing parameterized CUE configuration.
-
-```go
-type Component struct {
-    // Name represents the name of the component. Injected as the tag variable
-    // "holos_component_name".
-    Name string `json:"name" yaml:"name"`
-    // Path represents the path of the component relative to the platform root.
-    // Injected as the tag variable "holos_component_path".
-    Path string `json:"path" yaml:"path"`
-    // Parameters represent user defined input variables to produce various
-    // [BuildPlan] resources from one component path.  Injected as CUE @tag
-    // variables.  Parameters with a "holos_" prefix are reserved for use by the
-    // Holos Authors.  Multiple environments are a prime example of an input
-    // parameter that should always be user defined, never defined by Holos.
-    Parameters map[string]string `json:"parameters,omitempty" yaml:"parameters,omitempty"`
-    // Labels represent selector labels for the component.  Holos copies Labels
-    // from the Component to the resulting BuildPlan.
-    Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
-    // Annotations represents arbitrary non-identifying metadata.  Use the
-    // `app.holos.run/description` to customize the log message of each BuildPlan.
-    Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
-}
-```
-
-<a name="File"></a>
-## type File {#File}
-
-File represents a simple single file copy [Generator](<#Generator>). Useful with a [Kustomize](<#Kustomize>) [Transformer](<#Transformer>) to process plain manifest files stored in the component directory. Multiple File generators may be used to transform multiple resources.
-
-```go
-type File struct {
-    // Source represents a file sub-path relative to the component path.
-    Source FilePath `json:"source" yaml:"source"`
-}
-```
-
-<a name="FileContent"></a>
-## type FileContent {#FileContent}
-
-FileContent represents file contents.
-
-```go
-type FileContent string
-```
-
-<a name="FileContentMap"></a>
-## type FileContentMap {#FileContentMap}
-
-FileContentMap represents a mapping of file paths to file contents.
-
-```go
-type FileContentMap map[FilePath]FileContent
-```
-
-<a name="FileOrDirectoryPath"></a>
-## type FileOrDirectoryPath {#FileOrDirectoryPath}
-
-FileOrDirectoryPath represents a file or a directory path.
-
-```go
-type FileOrDirectoryPath string
-```
-
-<a name="FilePath"></a>
-## type FilePath {#FilePath}
-
-FilePath represents a file path.
-
-```go
-type FilePath string
-```
-
-<a name="Generator"></a>
-## type Generator {#Generator}
-
-Generator generates Kubernetes resources. [Helm](<#Helm>) and [Resources](<#Resources>) are the most commonly used, often paired together to mix\-in resources to an unmodified Helm chart. A simple [File](<#File>) generator is also available for use with the [Kustomize](<#Kustomize>) transformer.
-
-Each Generator in an [Artifact](<#Artifact>) must have a distinct Output value for a [Transformer](<#Transformer>) to reference.
-
-1. [Resources](<#Resources>) \- Generates resources from CUE code.
-2. [Helm](<#Helm>) \- Generates rendered yaml from a [Chart](<#Chart>).
-3. [File](<#File>) \- Generates data by reading a file from the component directory.
-4. [Command](<#Command>) \- Generates data by executing an user defined command.
-
-```go
-type Generator struct {
-    // Kind represents the kind of generator.  Must be Resources, Helm, or File.
-    Kind string `json:"kind" yaml:"kind" cue:"\"Resources\" | \"Helm\" | \"File\" | \"Command\""`
-    // Output represents a file for a Transformer or Artifact to consume.
-    Output FileOrDirectoryPath `json:"output" yaml:"output"`
-    // Resources generator. Ignored unless kind is Resources.  Resources are
-    // stored as a two level struct.  The top level key is the Kind of resource,
-    // e.g. Namespace or Deployment.  The second level key is an arbitrary
-    // InternalLabel.  The third level is a map[string]any representing the
-    // Resource.
-    Resources Resources `json:"resources,omitempty" yaml:"resources,omitempty"`
-    // Helm generator. Ignored unless kind is Helm.
-    Helm Helm `json:"helm,omitempty" yaml:"helm,omitempty"`
-    // File generator. Ignored unless kind is File.
-    File File `json:"file,omitempty" yaml:"file,omitempty"`
-    // Command generator. Ignored unless kind is Command.
-    Command Command `json:"command,omitempty" yaml:"command,omitempty"`
-}
-```
-
-<a name="Helm"></a>
-## type Helm {#Helm}
-
-Helm represents a [Chart](<#Chart>) manifest [Generator](<#Generator>).
-
-```go
-type Helm struct {
-    // Chart represents a helm chart to manage.
-    Chart Chart `json:"chart" yaml:"chart"`
-    // Values represents values for holos to marshal into values.yaml when
-    // rendering the chart.  Values follow ValueFiles when both are provided.
-    Values Values `json:"values" yaml:"values"`
-    // ValueFiles represents hierarchial value files passed in order to the helm
-    // template -f flag.  Useful for migration from an ApplicationSet.  Use Values
-    // instead.  ValueFiles precede Values when both are provided.
-    ValueFiles []ValueFile `json:"valueFiles,omitempty" yaml:"valueFiles,omitempty"`
-    // EnableHooks enables helm hooks when executing the `helm template` command.
-    EnableHooks bool `json:"enableHooks,omitempty" yaml:"enableHooks,omitempty"`
-    // Namespace represents the helm namespace flag
-    Namespace string `json:"namespace,omitempty" yaml:"namespace,omitempty"`
-    // APIVersions represents the helm template --api-versions flag
-    APIVersions []string `json:"apiVersions,omitempty" yaml:"apiVersions,omitempty"`
-    // KubeVersion represents the helm template --kube-version flag
-    KubeVersion string `json:"kubeVersion,omitempty" yaml:"kubeVersion,omitempty"`
-}
-```
-
-<a name="InternalLabel"></a>
-## type InternalLabel {#InternalLabel}
-
-InternalLabel is an arbitrary unique identifier internal to holos itself. The holos cli is expected to never write a InternalLabel value to rendered output files, therefore use a InternalLabel when the identifier must be unique and internal. Defined as a type for clarity and type checking.
-
-```go
-type InternalLabel string
-```
-
-<a name="Join"></a>
-## type Join {#Join}
-
-Join represents a [Transformer](<#Transformer>) using [bytes.Join](<https://pkg.go.dev/bytes#Join>) to concatenate multiple inputs into one output with a separator. Useful for combining output from [Helm](<#Helm>) and [Resources](<#Resources>) together into one [Artifact](<#Artifact>) when [Kustomize](<#Kustomize>) is otherwise unnecessary.
-
-```go
-type Join struct {
-    Separator string `json:"separator,omitempty" yaml:"separator,omitempty"`
-}
-```
-
-<a name="Kind"></a>
-## type Kind {#Kind}
-
-Kind is a discriminator. Defined as a type for clarity and type checking.
-
-```go
-type Kind string
-```
-
-<a name="Kustomization"></a>
-## type Kustomization {#Kustomization}
-
-Kustomization represents a kustomization.yaml file for use with the [Kustomize](<#Kustomize>) [Transformer](<#Transformer>). Untyped to avoid tightly coupling holos to kubectl versions which was a problem for the Flux maintainers. Type checking is expected to happen in CUE against the kubectl version the user prefers.
-
-```go
-type Kustomization map[string]any
-```
-
-<a name="Kustomize"></a>
-## type Kustomize {#Kustomize}
-
-Kustomize represents a kustomization [Transformer](<#Transformer>).
-
-```go
-type Kustomize struct {
-    // Kustomization represents the decoded kustomization.yaml file
-    Kustomization Kustomization `json:"kustomization" yaml:"kustomization"`
-    // Files holds file contents for kustomize, e.g. patch files.
-    Files FileContentMap `json:"files,omitempty" yaml:"files,omitempty"`
-}
-```
-
-<a name="Metadata"></a>
-## type Metadata {#Metadata}
-
-Metadata represents data about the resource such as the Name.
-
-```go
-type Metadata struct {
-    // Name represents the resource name.
-    Name string `json:"name" yaml:"name"`
-    // Labels represents a resource selector.
-    Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
-    // Annotations represents arbitrary non-identifying metadata.  For example
-    // holos uses the `app.holos.run/description` annotation to log resources in a
-    // user customized way.
-    Annotations map[string]string `json:"annotations,omitempty" yaml:"annotations,omitempty"`
-}
-```
-
-<a name="Platform"></a>
-## type Platform {#Platform}
-
-Platform represents a platform to manage. A Platform specifies a [Component](<#Component>) collection and integrates the components together into a holistic platform. Holos iterates over the [Component](<#Component>) collection producing a [BuildPlan](<#BuildPlan>) for each, which holos then executes to render manifests.
-
-Inspect a Platform resource holos would process by executing:
-
-```
-cue export --out yaml ./platform
-```
-
-```go
-type Platform struct {
-    // APIVersion represents the versioned schema of this resource.
-    APIVersion string `json:"apiVersion" yaml:"apiVersion" cue:"string | *\"v1alpha6\""`
-    // Kind is a string value representing the resource.
-    Kind string `json:"kind" yaml:"kind" cue:"\"Platform\""`
-    // Metadata represents data about the resource such as the Name.
-    Metadata Metadata `json:"metadata" yaml:"metadata"`
-
-    // Spec represents the platform specification.
-    Spec PlatformSpec `json:"spec" yaml:"spec"`
-}
-```
-
-<a name="PlatformSpec"></a>
-## type PlatformSpec {#PlatformSpec}
-
-PlatformSpec represents the platform specification.
-
-```go
-type PlatformSpec struct {
-    // Components represents a collection of holos components to manage.
-    Components []Component `json:"components" yaml:"components"`
-}
-```
-
-<a name="Repository"></a>
-## type Repository {#Repository}
-
-Repository represents a [Helm](<#Helm>) [Chart](<#Chart>) repository.
-
-The Auth field is useful to configure http basic authentication to the Helm repository. Holos gets the username and password from the environment variables represented by the Auth field.
-
-```go
-type Repository struct {
-    Name string `json:"name" yaml:"name"`
-    URL  string `json:"url" yaml:"url"`
-    Auth Auth   `json:"auth,omitempty" yaml:"auth,omitempty"`
-}
-```
-
-<a name="Resource"></a>
-## type Resource {#Resource}
-
-Resource represents one kubernetes api object.
-
-```go
-type Resource map[string]any
-```
-
-<a name="Resources"></a>
-## type Resources {#Resources}
-
-Resources represents Kubernetes resources. Most commonly used to mix resources into the [BuildPlan](<#BuildPlan>) generated from CUE, but may be generated from elsewhere.
-
-```go
-type Resources map[Kind]map[InternalLabel]Resource
-```
-
-<a name="Transformer"></a>
-## type Transformer {#Transformer}
-
-Transformer combines multiple inputs from prior [Generator](<#Generator>) or [Transformer](<#Transformer>) outputs into one output. [Kustomize](<#Kustomize>) is the most commonly used transformer. A simple [Join](<#Join>) is also supported for use with plain manifest files.
-
-1. [Kustomize](<#Kustomize>) \- Patch and transform the output from prior generators or transformers. See [Introduction to Kustomize](<https://kubectl.docs.kubernetes.io/guides/config_management/introduction/>).
-2. [Join](<#Join>) \- Concatenate multiple prior outputs into one output.
-3. [Command](<#Command>) \- Transforms data by executing an user defined command.
-
-```go
-type Transformer struct {
-    // Kind represents the kind of transformer. Must be Kustomize, or Join.
-    Kind string `json:"kind" yaml:"kind" cue:"\"Kustomize\" | \"Join\" | \"Command\""`
-    // Inputs represents the files to transform. The Output of prior Generators
-    // and Transformers.
-    Inputs []FileOrDirectoryPath `json:"inputs" yaml:"inputs"`
-    // Output represents a file or directory for a subsequent Transformer or
-    // Artifact to consume.
-    Output FileOrDirectoryPath `json:"output" yaml:"output"`
-    // Kustomize transformer. Ignored unless kind is Kustomize.
-    Kustomize Kustomize `json:"kustomize,omitempty" yaml:"kustomize,omitempty"`
-    // Join transformer. Ignored unless kind is Join.
-    Join Join `json:"join,omitempty" yaml:"join,omitempty"`
-    // Command transformer. Ignored unless kind is Command.
-    Command Command `json:"command,omitempty" yaml:"command,omitempty"`
-}
-```
-
-<a name="Validator"></a>
-## type Validator {#Validator}
-
-Validator validates files. Useful to validate an [Artifact](<#Artifact>) prior to writing it out to the final destination. Holos may execute validators concurrently. See the [validators](<https://holos.run/docs/v1alpha6/tutorial/validators/>) tutorial for an end to end example.
-
-```go
-type Validator struct {
-    // Kind represents the kind of transformer. Must be Kustomize, or Join.
-    Kind string `json:"kind" yaml:"kind" cue:"\"Command\""`
-    // Inputs represents the files to validate.  Usually the final Artifact.
-    Inputs []FileOrDirectoryPath `json:"inputs" yaml:"inputs"`
-    // Command validator.  Ignored unless kind is Command.
-    Command Command `json:"command,omitempty" yaml:"command,omitempty"`
-}
-```
-
-<a name="ValueFile"></a>
-## type ValueFile {#ValueFile}
-
-ValueFile represents one Helm value file produced from CUE.
-
-```go
-type ValueFile struct {
-    // Name represents the file name, e.g. "region-values.yaml"
-    Name string `json:"name" yaml:"name"`
-    // Kind is a discriminator.
-    Kind string `json:"kind" yaml:"kind" cue:"\"Values\""`
-    // Values represents values for holos to marshal into the file name specified
-    // by Name when rendering the chart.
-    Values Values `json:"values,omitempty" yaml:"values,omitempty"`
-}
-```
-
-<a name="Values"></a>
-## type Values {#Values}
-
-Values represents [Helm](<#Helm>) Chart values generated from CUE.
-
-```go
-type Values map[string]any
-```
-
-Generated by [gomarkdoc](<https://github.com/princjef/gomarkdoc>)

doc/md/api/core/v1alpha2.md

@@ -0,0 +1,403 @@
+<!-- Code generated by gomarkdoc. DO NOT EDIT -->
+
+# v1alpha2
+
+```go
+import "github.com/holos-run/holos/api/core/v1alpha2"
+```
+
+Package v1alpha2 contains the core API contract between the holos cli and CUE configuration code. Platform designers, operators, and software developers use this API to write configuration in CUE which \`holos\` loads. The overall shape of the API defines imperative actions \`holos\` should carry out to render the complete yaml that represents a Platform.
+
+[Platform](<#Platform>) defines the complete configuration of a platform. With the holos reference platform this takes the shape of one management cluster and at least two workload cluster. Each cluster has multiple [HolosComponent](<#HolosComponent>) resources applied to it.
+
+Each holos component path, e.g. \`components/namespaces\` produces exactly one [BuildPlan](<#BuildPlan>) which in turn contains a set of [HolosComponent](<#HolosComponent>) kinds.
+
+The primary kinds of [HolosComponent](<#HolosComponent>) are:
+
+1. [HelmChart](<#HelmChart>) to render config from a helm chart.
+2. [KustomizeBuild](<#KustomizeBuild>) to render config from [Kustomize](<#Kustomize>)
+3. [KubernetesObjects](<#KubernetesObjects>) to render [APIObjects](<#APIObjects>) defined directly in CUE configuration.
+
+Note that Holos operates as a data pipeline, so the output of a [HelmChart](<#HelmChart>) may be provided to [Kustomize](<#Kustomize>) for post\-processing.
+
+## Index
+
+- [Constants](<#constants>)
+- [type APIObject](<#APIObject>)
+- [type APIObjectMap](<#APIObjectMap>)
+- [type APIObjects](<#APIObjects>)
+- [type BuildPlan](<#BuildPlan>)
+- [type BuildPlanComponents](<#BuildPlanComponents>)
+- [type BuildPlanSpec](<#BuildPlanSpec>)
+- [type Chart](<#Chart>)
+- [type FileContent](<#FileContent>)
+- [type FileContentMap](<#FileContentMap>)
+- [type FilePath](<#FilePath>)
+- [type HelmChart](<#HelmChart>)
+- [type HolosComponent](<#HolosComponent>)
+- [type Kind](<#Kind>)
+- [type KubernetesObjects](<#KubernetesObjects>)
+- [type Kustomize](<#Kustomize>)
+- [type KustomizeBuild](<#KustomizeBuild>)
+- [type Label](<#Label>)
+- [type Metadata](<#Metadata>)
+- [type Platform](<#Platform>)
+- [type PlatformMetadata](<#PlatformMetadata>)
+- [type PlatformSpec](<#PlatformSpec>)
+- [type PlatformSpecComponent](<#PlatformSpecComponent>)
+- [type Repository](<#Repository>)
+
+
+## Constants
+
+<a name="APIVersion"></a>
+
+```go
+const (
+    APIVersion    = "v1alpha2"
+    BuildPlanKind = "BuildPlan"
+    HelmChartKind = "HelmChart"
+    // ChartDir is the directory name created in the holos component directory to cache a chart.
+    ChartDir = "vendor"
+    // ResourcesFile is the file name used to store component output when post-processing with kustomize.
+    ResourcesFile = "resources.yaml"
+)
+```
+
+<a name="KubernetesObjectsKind"></a>
+
+```go
+const KubernetesObjectsKind = "KubernetesObjects"
+```
+
+<a name="APIObject"></a>
+## type APIObject {#APIObject}
+
+APIObject represents the most basic generic form of a single kubernetes api object. Represented as a JSON object internally for compatibility between tools, for example loading from CUE.
+
+```go
+type APIObject structpb.Struct
+```
+
+<a name="APIObjectMap"></a>
+## type APIObjectMap {#APIObjectMap}
+
+APIObjectMap represents the marshalled yaml representation of kubernetes api objects. Do not produce an APIObjectMap directly, instead use [APIObjects](<#APIObjects>) to produce the marshalled yaml representation from CUE data, then provide the result to [HolosComponent](<#HolosComponent>).
+
+```go
+type APIObjectMap map[Kind]map[Label]string
+```
+
+<a name="APIObjects"></a>
+## type APIObjects {#APIObjects}
+
+APIObjects represents Kubernetes API objects defined directly from CUE code. Useful to mix in resources to any kind of [HolosComponent](<#HolosComponent>), for example adding an ExternalSecret resource to a [HelmChart](<#HelmChart>).
+
+[Kind](<#Kind>) must be the resource kind, e.g. Deployment or Service.
+
+[Label](<#Label>) is an arbitrary internal identifier to uniquely identify the resource within the context of a \`holos\` command. Holos will never write the intermediate label to rendered output.
+
+Refer to [HolosComponent](<#HolosComponent>) which accepts an [APIObjectMap](<#APIObjectMap>) field provided by [APIObjects](<#APIObjects>).
+
+```go
+type APIObjects struct {
+    APIObjects   map[Kind]map[Label]APIObject `json:"apiObjects"`
+    APIObjectMap APIObjectMap                 `json:"apiObjectMap"`
+}
+```
+
+<a name="BuildPlan"></a>
+## type BuildPlan {#BuildPlan}
+
+BuildPlan represents a build plan for the holos cli to execute. The purpose of a BuildPlan is to define one or more [HolosComponent](<#HolosComponent>) kinds. For example a [HelmChart](<#HelmChart>), [KustomizeBuild](<#KustomizeBuild>), or [KubernetesObjects](<#KubernetesObjects>).
+
+A BuildPlan usually has an additional empty [KubernetesObjects](<#KubernetesObjects>) for the purpose of using the [HolosComponent](<#HolosComponent>) DeployFiles field to deploy an ArgoCD or Flux gitops resource for the holos component.
+
+```go
+type BuildPlan struct {
+    Kind       string        `json:"kind" cue:"\"BuildPlan\""`
+    APIVersion string        `json:"apiVersion" cue:"string | *\"v1alpha2\""`
+    Spec       BuildPlanSpec `json:"spec"`
+}
+```
+
+<a name="BuildPlanComponents"></a>
+## type BuildPlanComponents {#BuildPlanComponents}
+
+
+
+```go
+type BuildPlanComponents struct {
+    Resources             map[Label]KubernetesObjects `json:"resources,omitempty"`
+    KubernetesObjectsList []KubernetesObjects         `json:"kubernetesObjectsList,omitempty"`
+    HelmChartList         []HelmChart                 `json:"helmChartList,omitempty"`
+    KustomizeBuildList    []KustomizeBuild            `json:"kustomizeBuildList,omitempty"`
+}
+```
+
+<a name="BuildPlanSpec"></a>
+## type BuildPlanSpec {#BuildPlanSpec}
+
+BuildPlanSpec represents the specification of the build plan.
+
+```go
+type BuildPlanSpec struct {
+    // Disabled causes the holos cli to take no action over the [BuildPlan].
+    Disabled bool `json:"disabled,omitempty"`
+    // Components represents multiple [HolosComponent] kinds to manage.
+    Components BuildPlanComponents `json:"components,omitempty"`
+}
+```
+
+<a name="Chart"></a>
+## type Chart {#Chart}
+
+Chart represents a helm chart.
+
+```go
+type Chart struct {
+    // Name represents the chart name.
+    Name string `json:"name"`
+    // Version represents the chart version.
+    Version string `json:"version"`
+    // Release represents the chart release when executing helm template.
+    Release string `json:"release"`
+    // Repository represents the repository to fetch the chart from.
+    Repository Repository `json:"repository,omitempty"`
+}
+```
+
+<a name="FileContent"></a>
+## type FileContent {#FileContent}
+
+FileContent represents file contents.
+
+```go
+type FileContent string
+```
+
+<a name="FileContentMap"></a>
+## type FileContentMap {#FileContentMap}
+
+FileContentMap represents a mapping of file paths to file contents. Paths are relative to the \`holos\` output "deploy" directory, and may contain sub\-directories.
+
+```go
+type FileContentMap map[FilePath]FileContent
+```
+
+<a name="FilePath"></a>
+## type FilePath {#FilePath}
+
+FilePath represents a file path.
+
+```go
+type FilePath string
+```
+
+<a name="HelmChart"></a>
+## type HelmChart {#HelmChart}
+
+HelmChart represents a holos component which wraps around an upstream helm chart. Holos orchestrates helm by providing values obtained from CUE, renders the output using \`helm template\`, then post\-processes the helm output yaml using the general functionality provided by [HolosComponent](<#HolosComponent>), for example [Kustomize](<#Kustomize>) post\-rendering and mixing in additional kubernetes api objects.
+
+```go
+type HelmChart struct {
+    HolosComponent `json:",inline"`
+    Kind           string `json:"kind" cue:"\"HelmChart\""`
+
+    // Chart represents a helm chart to manage.
+    Chart Chart `json:"chart"`
+    // ValuesContent represents the values.yaml file holos passes to the `helm
+    // template` command.
+    ValuesContent string `json:"valuesContent"`
+    // EnableHooks enables helm hooks when executing the `helm template` command.
+    EnableHooks bool `json:"enableHooks" cue:"bool | *false"`
+}
+```
+
+<a name="HolosComponent"></a>
+## type HolosComponent {#HolosComponent}
+
+HolosComponent defines the fields common to all holos component kinds. Every holos component kind should embed HolosComponent.
+
+```go
+type HolosComponent struct {
+    // Kind is a string value representing the resource this object represents.
+    Kind string `json:"kind"`
+    // APIVersion represents the versioned schema of this representation of an object.
+    APIVersion string `json:"apiVersion" cue:"string | *\"v1alpha2\""`
+    // Metadata represents data about the holos component such as the Name.
+    Metadata Metadata `json:"metadata"`
+
+    // APIObjectMap holds the marshalled representation of api objects.  Useful to
+    // mix in resources to each HolosComponent type, for example adding an
+    // ExternalSecret to a HelmChart HolosComponent.  Refer to [APIObjects].
+    APIObjectMap APIObjectMap `json:"apiObjectMap,omitempty"`
+
+    // DeployFiles represents file paths relative to the cluster deploy directory
+    // with the value representing the file content.  Intended for defining the
+    // ArgoCD Application resource or Flux Kustomization resource from within CUE,
+    // but may be used to render any file related to the build plan from CUE.
+    DeployFiles FileContentMap `json:"deployFiles,omitempty"`
+
+    // Kustomize represents a kubectl kustomize build post-processing step.
+    Kustomize `json:"kustomize,omitempty"`
+
+    // Skip causes holos to take no action regarding this component.
+    Skip bool `json:"skip" cue:"bool | *false"`
+}
+```
+
+<a name="Kind"></a>
+## type Kind {#Kind}
+
+Kind is a kubernetes api object kind. Defined as a type for clarity and type checking.
+
+```go
+type Kind string
+```
+
+<a name="KubernetesObjects"></a>
+## type KubernetesObjects {#KubernetesObjects}
+
+KubernetesObjects represents a [HolosComponent](<#HolosComponent>) composed of Kubernetes API objects provided directly from CUE using [APIObjects](<#APIObjects>).
+
+```go
+type KubernetesObjects struct {
+    HolosComponent `json:",inline"`
+    Kind           string `json:"kind" cue:"\"KubernetesObjects\""`
+}
+```
+
+<a name="Kustomize"></a>
+## type Kustomize {#Kustomize}
+
+Kustomize represents resources necessary to execute a kustomize build. Intended for at least two use cases:
+
+1. Process a [KustomizeBuild](<#KustomizeBuild>) [HolosComponent](<#HolosComponent>) which represents raw yaml file resources in a holos component directory.
+2. Post process a [HelmChart](<#HelmChart>) [HolosComponent](<#HolosComponent>) to inject istio, patch jobs, add custom labels, etc...
+
+```go
+type Kustomize struct {
+    // KustomizeFiles holds file contents for kustomize, e.g. patch files.
+    KustomizeFiles FileContentMap `json:"kustomizeFiles,omitempty"`
+    // ResourcesFile is the file name used for api objects in kustomization.yaml
+    ResourcesFile string `json:"resourcesFile,omitempty"`
+}
+```
+
+<a name="KustomizeBuild"></a>
+## type KustomizeBuild {#KustomizeBuild}
+
+KustomizeBuild represents a [HolosComponent](<#HolosComponent>) that renders plain yaml files in the holos component directory using \`kubectl kustomize build\`.
+
+```go
+type KustomizeBuild struct {
+    HolosComponent `json:",inline"`
+    Kind           string `json:"kind" cue:"\"KustomizeBuild\""`
+}
+```
+
+<a name="Label"></a>
+## type Label {#Label}
+
+Label is an arbitrary unique identifier internal to holos itself. The holos cli is expected to never write a Label value to rendered output files, therefore use a [Label](<#Label>) then the identifier must be unique and internal. Defined as a type for clarity and type checking.
+
+A Label is useful to convert a CUE struct to a list, for example producing a list of [APIObject](<#APIObject>) resources from an [APIObjectMap](<#APIObjectMap>). A CUE struct using Label keys is guaranteed to not lose data when rendering output because a Label is expected to never be written to the final output.
+
+```go
+type Label string
+```
+
+<a name="Metadata"></a>
+## type Metadata {#Metadata}
+
+Metadata represents data about the holos component such as the Name.
+
+```go
+type Metadata struct {
+    // Name represents the name of the holos component.
+    Name string `json:"name"`
+    // Namespace is the primary namespace of the holos component.  A holos
+    // component may manage resources in multiple namespaces, in this case
+    // consider setting the component namespace to default.
+    //
+    // This field is optional because not all resources require a namespace,
+    // particularly CRD's and DeployFiles functionality.
+    // +optional
+    Namespace string `json:"namespace,omitempty"`
+}
+```
+
+<a name="Platform"></a>
+## type Platform {#Platform}
+
+Platform represents a platform to manage. A Platform resource informs holos which components to build. The platform resource also acts as a container for the platform model form values provided by the PlatformService. The primary use case is to collect the cluster names, cluster types, platform model, and holos components to build into one resource.
+
+```go
+type Platform struct {
+    // Kind is a string value representing the resource this object represents.
+    Kind string `json:"kind" cue:"\"Platform\""`
+    // APIVersion represents the versioned schema of this representation of an object.
+    APIVersion string `json:"apiVersion" cue:"string | *\"v1alpha2\""`
+    // Metadata represents data about the object such as the Name.
+    Metadata PlatformMetadata `json:"metadata"`
+
+    // Spec represents the specification.
+    Spec PlatformSpec `json:"spec"`
+}
+```
+
+<a name="PlatformMetadata"></a>
+## type PlatformMetadata {#PlatformMetadata}
+
+
+
+```go
+type PlatformMetadata struct {
+    // Name represents the Platform name.
+    Name string `json:"name"`
+}
+```
+
+<a name="PlatformSpec"></a>
+## type PlatformSpec {#PlatformSpec}
+
+PlatformSpec represents the specification of a Platform. Think of a platform specification as a list of platform components to apply to a list of kubernetes clusters combined with the user\-specified Platform Model.
+
+```go
+type PlatformSpec struct {
+    // Model represents the platform model holos gets from from the
+    // PlatformService.GetPlatform rpc method and provides to CUE using a tag.
+    Model structpb.Struct `json:"model"`
+    // Components represents a list of holos components to manage.
+    Components []PlatformSpecComponent `json:"components"`
+}
+```
+
+<a name="PlatformSpecComponent"></a>
+## type PlatformSpecComponent {#PlatformSpecComponent}
+
+PlatformSpecComponent represents a holos component to build or render.
+
+```go
+type PlatformSpecComponent struct {
+    // Path is the path of the component relative to the platform root.
+    Path string `json:"path"`
+    // Cluster is the cluster name to provide when rendering the component.
+    Cluster string `json:"cluster"`
+}
+```
+
+<a name="Repository"></a>
+## type Repository {#Repository}
+
+Repository represents a helm chart repository.
+
+```go
+type Repository struct {
+    Name string `json:"name"`
+    URL  string `json:"url"`
+}
+```
+
+Generated by [gomarkdoc](<https://github.com/princjef/gomarkdoc>)

doc/md/cli.md

@@ -0,0 +1,3 @@
+# CLI
+
+Use the `holos` command line interface (CLI) to render individual platform components, entire platforms, and push/pull the platform model.

doc/md/common/example-component-integrate.mdx

@@ -1,16 +0,0 @@
-Integrate the `podinfo` component into the platform.
-
-```bash
-cat <<EOF >platform/podinfo.cue
-```
-```cue showLineNumbers
-package holos
-
-Platform: Components: podinfo: {
-	name: "podinfo"
-	path: "components/podinfo"
-}
-```
-```bash
-EOF
-```

doc/md/common/example-component.mdx

@@ -1,34 +0,0 @@
-Create a directory for the example `podinfo` component we'll use to render
-platform manifests.
-
-```bash
-mkdir -p components/podinfo
-```
-
-Create the CUE configuration for the example `podinfo` component.
-
-```bash
-cat <<EOF >components/podinfo/podinfo.cue
-```
-```cue showLineNumbers
-package holos
-
-holos: Component.BuildPlan
-
-Component: #Helm & {
-	Name: "podinfo"
-	Chart: {
-		version: "6.6.2"
-		repository: {
-			name: "podinfo"
-			url:  "https://stefanprodan.github.io/podinfo"
-		}
-	}
-	Values: ui: {
-		message: string | *"Hello World" @tag(message, type=string)
-	}
-}
-```
-```bash
-EOF
-```

doc/md/glossary.md

@@ -0,0 +1,17 @@
+# Glossary
+
+This page describes the terms used within the context of Holos.
+
+## Management Cluster
+
+## Workload Cluster
+
+## Platform Form
+
+## Platform Model
+
+## Secret Store
+
+## Service Mesh
+
+## Zero Trust

doc/md/glossary.mdx

@@ -1,88 +0,0 @@
-# Glossary
-
-This page describes the terms used within the context of Holos.
-
-## Platform
-
-In Holos, a Platform is a comprehensive environment configured using the
-Kubernetes resource model. It extends beyond traditional Kubernetes
-functionality by integrating cloud resources through Crossplane, allowing for a
-unified management approach across both Kubernetes and cloud infrastructure. A
-Platform typically consists of one Management Cluster, which handles control and
-secret management, and one or more Workload Clusters, where application
-workloads are deployed and run. This architecture enables a consistent and
-scalable approach to managing diverse resources and services within the
-cloud-native ecosystem.
-
-## Management Cluster
-
-In the context of Holos, a Management Cluster is a special Kubernetes cluster
-that hosts Kubernetes controllers.  For example, cert-manager, Cluster api, and
-Crossplane.  A management cluster manages a single platform.  The primary
-function of this cluster is to securely store and manage secrets, ensuring the
-secure handling of sensitive information such as credentials, API keys, and
-other confidential data. The Management Cluster serves as a centralized and
-secure control plane for the platform, facilitating the orchestration and
-management of other components.
-
-## Workload Cluster
-
-In Holos, a Workload Cluster is a Kubernetes cluster designed to host and run
-application workloads. Unlike the Management Cluster, which focuses on control
-and secret management, Workload Clusters are dedicated to executing the actual
-applications and services. These clusters can vary in size and configuration
-based on the specific needs of the applications they support. Workload Clusters
-leverage Kubernetes' orchestration capabilities to manage the deployment,
-scaling, and operation of containerized applications, providing a flexible and
-scalable environment for running production workloads within the platform.
-
-## Platform Form
-
-In Holos, a Platform Form is a customizable web form defined by JSON data. Each
-platform within Holos has a unique Platform Form, which serves as an interface
-for configuring and managing the platform's settings and resources. Platform
-engineers can customize the Platform Form by modifying the underlying CUE
-(Configuration Unified Engine) code, allowing for tailored configurations that
-meet specific requirements. This flexibility enables platform engineers to
-create a user-friendly and specific interface for managing the platform's
-components and operations.
-
-## Platform Model
-
-In Holos, the Platform Model represents the collection of values submitted
-through the Platform Form. It encapsulates the specific configuration details
-and settings defined by the platform engineers, serving as the blueprint for the
-platform's setup and operation. The Platform Model is essential for translating
-the customized options and parameters from the Platform Form into actionable
-configurations within the Holos ecosystem, ensuring that the platform operates
-according to the specified requirements and guidelines.
-
-## Secret Store
-
-In Holos, a SecretStore is a repository for securely storing and managing
-sensitive data such as passwords, API keys, and other confidential information.
-It is compatible with any secret store supported by the External Secrets
-Operator. By default, the management cluster serves as the SecretStore to
-minimize dependencies and simplify the architecture. This setup ensures that
-secrets are managed in a secure and centralized manner, aligning with the
-overall security framework of the platform.
-
-## Service Mesh
-
-In Holos, a Service Mesh is a dedicated infrastructure layer for managing,
-observing, and securing service-to-service communications within a microservices
-architecture. It typically includes features such as load balancing, traffic
-routing, service discovery, and security policies like mutual TLS and access
-control. The Service Mesh abstracts these functionalities away from the
-application code, providing a centralized control plane for managing the
-interactions between microservices. This facilitates better observability,
-resilience, and security in complex, distributed environments.
-
-## Zero Trust
-
-In the context of Holos and broader security practices, Zero Trust is a security
-model that assumes no implicit trust is granted to any user, system, or
-component inside or outside the network. Instead, every request for access is
-treated as potentially malicious, and verification is required at every stage.
-This model enforces strict identity verification, continuous monitoring, and
-least-privilege access policies.

doc/md/intro.md

@@ -0,0 +1,64 @@
+# Introduction
+
+⚡️ Holos will help you build your **software development platform in no time.**
+
+💸 Building a software development platform is **time consuming and expensive**.  Spend more time building features for your customers and less time managing your development platform.
+
+💥 Already have a platform?  Add new features and services to your platform easily with Holos.
+
+🧐 Holos is a platform builder. It builds a hollistic software development platform composed of best-of-breed cloud native open source projects.  Holos is also a tool to make it easier to manage cloud infrastructure by providing a typed alternative to yaml templates.
+
+## Features
+
+Holos was built to solve two main problems:
+
+ 1. Building a platform usually takes 3 engineers 6-9 months of effort.  Holos provides a reference platform that enables you to deploy and customize your platform in a fraction of the time.
+ 2. Configuration changes often cause outages.  Existing tools like Helm make it difficult to understand the impact a configuration change will have.  Holos provides a unique, unified configuration model powered by CUE that makes it safer and easier to roll out configuration changes.
+
+A core principle of Holos is that organizations gain value from owning the the platform they build on.  Avoid vendor lock-in, future price hikes, and expensive licensing changes by building on a solid foundation of open source, cloud native computing foundation backed projects.
+
+The following features are built into the Holos reference platform.
+
+:::tip
+
+Don't see your preferred technology in the stack?  Holos is designed to enable you to swap out components of the platform tech stack.
+
+:::
+
+- **Continuous Delivery**
+  - Holos builds a GitOps workflow for each application running in the platform.
+  - Developers push changes which are automatically deployed.
+  - Powered by [ArgoCD](https://argo-cd.readthedocs.io/en/stable/)
+- **Identity and Access Management** (IAM)
+  - Holos builds a standard OIDC identity provider for you.
+  - Integrates with your exisitng IAM and SSO system, or works independently.
+  - Powerful customer identity and access management features.
+  - Role based access control.
+  - Powered by [ZITADEL](https://zitadel.com/)
+- **Zero Trust**
+  - Authenticate and Authorize users at the platform layer instead of or in addition to the application layer.
+  - Integrated with observability to measure and alert about problems before customers complain.
+  - Powered by [Istio](https://istio.io/)
+- **Observability**
+  - Holos collects performance and availability metrics automatically, without requiring application changes.
+  - Optional, deeper integration into the application layer.
+  - Distributed Tracing
+  - Logging
+  - Powered by Prometheus, Grafana, Loki, and OpenTelemetry.
+- **Data Platform**
+  - Integrated management of PostgreSQL
+  - Automatic backups
+  - Automatic restore from backup
+  - Quickly fail over across multiple regions
+- **Multi-Region**
+  - Holos is designed to operate in multiple regions and multiple clouds.
+  - Keep customer data in the region that makes the most sense for your business.
+  - Easily cut over from one region to another for redundancy and business continuity.
+
+## Development Status
+
+Holos is being actively developed by [Open Infrastructure Services](https://openinfrastructure.co).  Release can be found [here](https://github.com/holos-run/holos/releases).
+
+## Adoption
+
+Organizations who have officially adopted Holos can be found [here](https://github.com/holos-run/holos/blob/main/ADOPTERS.md).

doc/md/local-development.md

@@ -0,0 +1,28 @@
+# Local Development
+
+This document captures notes on locally developing Holos.
+
+Follow the steps in [Try Holos Locally](/docs/tutorial/local/k3d), but take
+care to select `Develop` tabs when creating the k3d cluster so you have a local
+registry to push to.
+
+## Apply Resources
+
+Work will be done in the `dev-holos` namespace.
+
+Apply the infrastructure, which should persist when tilt is started / stopped.
+
+```bash
+kubectl apply --server-side=true -f ./hack/tilt/k8s/dev-holos-infra
+```
+
+This creates the PostgresCluster, service account, etc...
+
+## Start tilt
+
+Tilt will build the go executable, build the container, then push it to the
+local repository associated with k3d.
+
+```bash
+./hack/tilt/bin/tilt up
+```

doc/md/reference-platform/architecture.md

@@ -0,0 +1,81 @@
+# Architecture
+
+This page describes the architecture of the Holos reference platform.
+
+## Overview
+
+The reference platform manages three kubernetes clusters by default.  One management cluster and two workload clusters.
+
+```mermaid
+graph TB
+   subgraph "Management"
+       secrets(Secrets)
+       c1(Controllers)
+   end
+
+   subgraph "Primary"
+       s1p(Service 1)
+       s2p(Service 2)
+   end
+
+   subgraph "Standby"
+       s1s(Service 1)
+       s2s(Service 2)
+   end
+ 
+   classDef plain fill:#ddd,stroke:#fff,stroke-width:4px,color:#000;
+   classDef k8s fill:#326ce5,stroke:#fff,stroke-width:4px,color:#fff;
+   classDef cluster fill:#fff,stroke:#bbb,stroke-width:2px,color:#326ce5;
+   class c1,s1p,s2p,s1s,s2s,secrets k8s;
+   class Management,Primary,Standby cluster;
+
+```
+
+
+The services in each cluster type are:
+
+:::tip
+The management cluster is designed to operate reliably on spot instances.  A highly available management cluster typically costs less than a cup of coffee per month to operate.
+:::
+
+1. Management Cluster
+   - **SecretStore** to provide namespace scoped secrets to workload clusters.
+   - **CertManager** to provision TLS certificates and make them available to workload clusters.
+   - **ClusterAPI** to provision and manage workload clusters via GitOps.  For example, EKS or GKE clusters.
+   - **Crossplane** to provision and manage cloud resources via GitOps.  For example, buckets, managed databases, any other cloud resource.
+   - **CronJobs** to refresh short lived credentials.  For example image pull credentials.
+   - **ArgoCD** to manage resources within the management cluster via GitOps.
+2. Primary Workload Cluster
+   - **ArgoCD** to continuously deploy your applications and services via GitOps.
+   - **External Secrets Operator** to synchronize namespace scoped secrets.
+   - **Istio** to provide a Gateway to expose services.
+   - **ZITADEL** to provide SSO login for all other services (e.g. ArgoCD, Grafana, Backstage, etc...)
+   - **PostgreSQL** for in-cluster databases.
+   - **Backstage** to provide your developer portal into the whole platform.
+   - **Observability** implemented by Prometheus, Grafana, and Loki to provide monitoring and logging.
+   - **AuthorizationPolicy** to provide role based access control to all services in the cluster.
+3. Standby Workload Cluster
+   - Identical configuration to the primary cluster.
+   - May be scaled down to zero to reduce expenses.
+   - Intended to take the primary cluster role quickly, within minutes, for disaster recovery or regular maintenance purposes.
+
+## Security
+
+### Namespaces
+
+Namespaces are security boundaries in the reference platform.  A given namespace is treated as the same security context across multiple clusters following the [SIG Multi-cluster Position](https://github.com/kubernetes/community/blob/dd4c8b704ef1c9c3bfd928c6fa9234276d61ad18/sig-multicluster/namespace-sameness-position-statement.md).
+
+The namespace sameness principle makes role based access control straightforward to manage and comprehend.  For example, granting a developer the ability to create secrets in namespace `example` means the developer has the ability to do so in the secret store in the management cluster and also synchronize the secret to the services they own in the workload clusters.
+
+## Data Platform
+
+Holos is designed to work with two distinct types of databases by default:
+
+ 1. In-cluster PostgresSQL databases for lower cost and rapid development and testing.
+ 2. Out-of-cluster SQL databases for production services, e.g. RDS, CloudSQL, Aurora, Redshift, etc...
+
+:::tip
+To simplify maintenance the holos reference platform provisions databases from the most recent backup by default.
+:::
+
+In-cluster databases in the holos reference platform automatically save backups to an S3 or GCS bucket.  For regular maintenance and disaster recovery, the standby cluster automatically restores databases from the most recent backup in the bucket.  This capability makes  maintenance much simpler, most maintenance tasks are carried out on the standby cluster which is then promoted to the primary.  Software upgrades in particular are intended to be carried out against the standby, verified, then promoted to primary.  Once live traffic shifts to the upgraded services in the new primary the previous cluster can be spun down to save cost or upgraded safely in place.

doc/md/support.mdx

@@ -1,26 +0,0 @@
----
-description: Get Support for Holos
-slug: support
-sidebar_position: 2000
----
-
-# Support
-
-## Community Support
-
-You can ask questions in our community forums in [GitHub
-Discussions](https://github.com/holos-run/holos/discussions),
-[Discord](https://discord.gg/JgDVbNpye7), or [Google
-Groups](https://groups.google.com/g/holos-discuss).
-
-## Commercial Support and Services
-
-### Open Infrastructure Services
-
-[Open Infrastructure Services] are the primary stewards of Holos.  Contact Open
-Infrastructure Services for training, support, and services related to Holos,
-platform engineering, and cloud infrastructure automation.
-
-Please email holos-support@openinfrastructure.co for more information.
-
-[Open Infrastructure Services]: https://openinfrastructure.co/

doc/md/topics.mdx

@@ -1,15 +0,0 @@
----
-slug: /topics
-title: Topics
-description: Stand alone topics that often come up when using Holos.
----
-import DocCardList from '@theme/DocCardList';
-
-# Topics
-
-This section has self-contained articles related to various topics that come up
-when writing platform configuration code with Holos.
-
----
-
-<DocCardList />

doc/md/topics/architecture.mdx

@@ -1,18 +0,0 @@
----
-description: Architecture diagrams.
-slug: architecture
-sidebar_position: 100
----
-
-import RenderPlatformDiagram from '@site/src/diagrams/render-platform-sequence.mdx';
-import RenderComponentDiagram from '@site/src/diagrams/render-component-sequence.mdx';
-
-# Architecture
-
-## Platform Rendering Sequence
-
-<RenderPlatformDiagram />
-
-## Component Rendering Sequence
-
-<RenderComponentDiagram />

doc/md/topics/comparison.mdx

@@ -1,57 +0,0 @@
----
-description: Holos compared to other tools
-sidebar_label: Comparison
-slug: comparison
-sidebar_position: 40
----
-
-{/* cspell:ignore Prodan, rollouts */}
-
-# Holos compared to other tools
-
-## Timoni
-
-Holos and Timoni both aim to solve similar problems but approach them at
-different levels of the stack.
-
-Timoni focuses on managing applications by evaluating [CUE] stored in OCI
-containers. Its creator, Stefan Prodan, envisions a controller that applies the
-resulting manifests. In this process, Timoni defers to [Flux] for managing Helm
-charts within the cluster.
-
-In contrast, Holos implements the [Rendered Manifests Pattern] and takes a
-different approach, particularly in how it handles [Helm] charts. Like
-[ArgoCD], Holos renders Helm charts into manifests using the `helm template`
-command in its rendering pipeline. Holos differs from Timoni in several important
-ways:
-
-1. **Separation of Responsibilities:**  Holos stops short of applying
-rendered manifests to a cluster, leaving that task to existing tools like
-[ArgoCD], [Flux], or even basic `kubectl apply` commands.
-
-2. **Ecosystem Integration:**  By focusing solely on rendering Kubernetes
-manifests, Holos creates space for other tools to handle deployment and
-management. For instance, Holos integrates seamlessly with [Kargo] for
-progressive rollouts, as [Kargo] operates between Holos and the Kubernetes API.
-This approach ensures that you're not locked into any specific tool and can
-choose the best solution for each task.
-
-3. **Platform Integration:** Holos focuses on integrating multiple Components
-into a larger Platform. In Holos terminology, a Component refers to a wrapper
-for [Helm] charts, [Kustomize] bases, or raw YAML files, integrated into the
-rendering pipeline through [CUE].  A Platform represents the full combination of
-these components.
-
-4. **Explicit Rendering Pipeline:** Holos emphasizes flexibility in its
-rendering pipeline. The system allows any tool that generates Kubernetes
-manifests to be wrapped in a Generator, which can then feed into existing
-transformers like [Kustomize]. This explicit separation makes Holos highly
-adaptable for different workflows.
-
-[Kargo]: https://kargo.io/
-[Flux]: https://fluxcd.io
-[Helm]: https://helm.sh
-[ArgoCD]: https://argoproj.github.io/cd/
-[Kustomize]: https://kustomize.io/
-[CUE]: https://cuelang.org/
-[Rendered Manifests Pattern]: https://akuity.io/blog/the-rendered-manifests-pattern

doc/md/topics/gitops/argocd-application.mdx

@@ -1,223 +0,0 @@
----
-slug: argocd-application
-title: ArgoCD Application
-description: Configuring an Application for each Component.
-sidebar_position: 110
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-import CommonComponent from '../../common/example-component.mdx';
-import CommonComponentIntegrate from '../../common/example-component-integrate.mdx';
-
-# ArgoCD Application
-
-## Overview
-
-This topic covers how to mix in an ArgoCD Application to all components.  We'll
-use the `Artifacts` field of [ComponentConfig] defined by the author schema.
-
-## The Code
-
-### Generating the structure
-
-Use `holos` to generate a minimal platform directory structure.  Start by
-creating a blank directory to hold the platform configuration.
-
-```shell
-mkdir holos-argocd-application && cd holos-argocd-application
-```
-
-```shell
-holos init platform v1alpha5
-```
-
-### Creating an example Component
-
-<CommonComponent />
-<CommonComponentIntegrate />
-
-## Adding ArgoCD Application
-
-Configure Holos to render an [Application] by defining an [Artifact] for it in
-every BuildPlan holos produces.  We're unifying our custom configuration with
-the existing `#ComponentConfig` defined in `schema.cue`.
-
-```bash
-cat <<EOF >argocd-application.cue
-```
-```cue showLineNumbers
-package holos
-
-import (
-	"path"
-	app "argoproj.io/application/v1alpha1"
-)
-
-#ComponentConfig: {
-	Name:          _
-	OutputBaseDir: _
-
-	let ArtifactPath = path.Join([OutputBaseDir, "gitops", "\(Name).application.gen.yaml"], path.Unix)
-	let ResourcesPath = path.Join(["deploy", OutputBaseDir, "components", Name], path.Unix)
-
-	Artifacts: "\(Name)-application": {
-		artifact: ArtifactPath
-		generators: [{
-			kind:   "Resources"
-			output: artifact
-			resources: Application: (Name): app.#Application & {
-				metadata: name:      Name
-				metadata: namespace: "argocd"
-				spec: {
-					destination: server: "https://kubernetes.default.svc"
-					project: "default"
-					source: {
-						path:           ResourcesPath
-						repoURL:        "https://example.com/example.git"
-						targetRevision: "main"
-					}
-				}
-			}
-		}]
-	}
-}
-```
-```bash
-EOF
-```
-
-## Inspecting the BuildPlan
-
-Our customized `#ComponentConfig` results in the following `BuildPlan`.
-
-:::note
-The second artifact around line 40 contains the configured `Application`
-resource.
-:::
-
-<Tabs groupId="55075C71-02E8-4222-88C0-2D52C82D18FC">
-  <TabItem value="command" label="Command">
-```bash
-holos cue export --expression holos --out=yaml ./components/podinfo
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```yaml showLineNumbers
-kind: BuildPlan
-apiVersion: v1alpha5
-metadata:
-  name: podinfo
-spec:
-  artifacts:
-    - artifact: components/podinfo/podinfo.gen.yaml
-      generators:
-        - kind: Helm
-          output: helm.gen.yaml
-          helm:
-            chart:
-              name: podinfo
-              version: 6.6.2
-              release: podinfo
-              repository:
-                name: podinfo
-                url: https://stefanprodan.github.io/podinfo
-            values: {}
-            enableHooks: false
-        - kind: Resources
-          output: resources.gen.yaml
-          resources: {}
-      transformers:
-        - kind: Kustomize
-          inputs:
-            - helm.gen.yaml
-            - resources.gen.yaml
-          output: components/podinfo/podinfo.gen.yaml
-          kustomize:
-            kustomization:
-              labels:
-                - includeSelectors: false
-                  pairs: {}
-              resources:
-                - helm.gen.yaml
-                - resources.gen.yaml
-              kind: Kustomization
-              apiVersion: kustomize.config.k8s.io/v1beta1
-    - artifact: gitops/podinfo.application.gen.yaml
-      generators:
-        - kind: Resources
-          output: gitops/podinfo.application.gen.yaml
-          resources:
-            Application:
-              podinfo:
-                apiVersion: argoproj.io/v1alpha1
-                kind: Application
-                metadata:
-                  name: podinfo
-                  namespace: argocd
-                spec:
-                  destination:
-                    server: https://kubernetes.default.svc
-                  project: default
-                  source:
-                    path: deploy/components/podinfo
-                    repoURL: https://example.com/example.git
-                    targetRevision: main
-source:
-  component:
-    name: podinfo
-    path: no-path
-    parameters: {}
-```
-  </TabItem>
-</Tabs>
-
-## Rendering manifests
-
-<Tabs groupId="E150C802-7162-4FBF-82A7-77D9ADAEE847">
-  <TabItem value="command" label="Command">
-```bash
-holos render platform
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```
-cached podinfo 6.6.2
-rendered podinfo in 1.938665041s
-rendered platform in 1.938759417s
-```
-  </TabItem>
-</Tabs>
-
-## Reviewing the Application
-
-The Artifact we added to `#ComponentConfig` will produce an ArgoCD Application
-resource for every component in the platform.  The output in this example is
-located at:
-
-```txt
-deploy/gitops/podinfo.application.gen.yaml
-```
-```yaml showLineNumbers
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-    name: podinfo
-    namespace: argocd
-spec:
-    destination:
-        server: https://kubernetes.default.svc
-    project: default
-    source:
-        path: deploy/components/podinfo
-        repoURL: https://example.com/example.git
-        targetRevision: main
-```
-
-[podinfo]: https://github.com/stefanprodan/podinfo
-[CUE Module]: https://cuelang.org/docs/reference/modules/
-[CUE Tags]: https://cuelang.org/docs/howto/inject-value-into-evaluation-using-tag-attribute/
-[Application]: https://argo-cd.readthedocs.io/en/stable/user-guide/application-specification/
-[Platform]: ../../api/author.md#Platform
-[ComponentConfig]: ../../api/author.md#ComponentConfig
-[Artifact]: ../../api/core.md#Artifact

doc/md/topics/gitops/flux-kustomization.mdx

@@ -1,218 +0,0 @@
----
-slug: flux-kustomization
-title: Flux Kustomization
-description: Configuring a Kustomization for each Component.
-sidebar_position: 120
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-import CommonComponent from '../../common/example-component.mdx';
-import CommonComponentIntegrate from '../../common/example-component-integrate.mdx';
-
-# Flux Kustomization
-
-## Overview
-
-This topic covers how to mix in a Flux Kustomization to all components.  We'll
-use the `Artifacts` field of [ComponentConfig] defined by the author schema.
-
-## The Code
-
-### Generating the structure
-
-Use `holos` to generate a minimal platform directory structure.  Start by
-creating a blank directory to hold the platform configuration.
-
-```shell
-mkdir holos-flux-kustomization && cd holos-flux-kustomization
-```
-
-```shell
-holos init platform v1alpha5
-```
-
-### Creating an example Component
-
-<CommonComponent />
-<CommonComponentIntegrate />
-
-## Adding Flux Kustomizations
-
-Configure Holos to render a [Kustomization] by defining an [Artifact] for it in
-every BuildPlan holos produces.  We're unifying our custom configuration with
-the existing `#ComponentConfig` defined in `schema.cue`.
-
-```bash
-cat <<EOF >flux-kustomization.cue
-```
-```cue showLineNumbers
-package holos
-
-import (
-	"path"
-	flux "kustomize.toolkit.fluxcd.io/kustomization/v1"
-)
-
-#ComponentConfig: {
-	Name:          _
-	OutputBaseDir: _
-
-	let ArtifactPath = path.Join([OutputBaseDir, "gitops", "\(Name).kustomization.gen.yaml"], path.Unix)
-	let ResourcesPath = path.Join(["deploy", OutputBaseDir, "components", Name], path.Unix)
-
-	Artifacts: "\(Name)-kustomization": {
-		artifact: ArtifactPath
-		generators: [{
-			kind:   "Resources"
-			output: artifact
-			resources: Kustomization: (Name): flux.#Kustomization & {
-				metadata: name:      Name
-				metadata: namespace: "default"
-				spec: {
-					interval: "5m"
-					timeout:  "1m"
-					prune:    true
-					path:     ResourcesPath
-					sourceRef: {
-						kind: "GitRepository"
-						name: "webapp"
-					}
-				}
-			}
-		}]
-	}
-}
-```
-```bash
-EOF
-```
-
-## Inspecting the BuildPlan
-
-Our customized `#ComponentConfig` results in the following `BuildPlan`.
-
-:::note
-The second artifact around line 40 contains the configured `Kustomization`
-resource.
-:::
-
-<Tabs groupId="55075C71-02E8-4222-88C0-2D52C82D18FC">
-  <TabItem value="command" label="Command">
-```bash
-holos cue export --expression holos --out=yaml ./components/podinfo
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```yaml showLineNumbers
-kind: BuildPlan
-apiVersion: v1alpha5
-metadata:
-  name: podinfo
-spec:
-  artifacts:
-    - artifact: components/podinfo/podinfo.gen.yaml
-      generators:
-        - kind: Helm
-          output: helm.gen.yaml
-          helm:
-            chart:
-              name: podinfo
-              version: 6.6.2
-              release: podinfo
-              repository:
-                name: podinfo
-                url: https://stefanprodan.github.io/podinfo
-            values:
-              ui:
-                message: Hello World
-            enableHooks: false
-        - kind: Resources
-          output: resources.gen.yaml
-          resources: {}
-      validators: []
-      transformers:
-        - kind: Kustomize
-          inputs:
-            - helm.gen.yaml
-            - resources.gen.yaml
-          output: components/podinfo/podinfo.gen.yaml
-          kustomize:
-            kustomization:
-              resources:
-                - helm.gen.yaml
-                - resources.gen.yaml
-              kind: Kustomization
-              apiVersion: kustomize.config.k8s.io/v1beta1
-    - artifact: gitops/podinfo.kustomization.gen.yaml
-      generators:
-        - kind: Resources
-          output: gitops/podinfo.kustomization.gen.yaml
-          resources:
-            Kustomization:
-              podinfo:
-                apiVersion: kustomize.toolkit.fluxcd.io/v1
-                kind: Kustomization
-                metadata:
-                  name: podinfo
-                  namespace: default
-                spec:
-                  interval: 5m
-                  path: deploy/components/podinfo
-                  prune: true
-                  sourceRef:
-                    kind: GitRepository
-                    name: webapp
-                  timeout: 1m
-```
-  </TabItem>
-</Tabs>
-
-## Rendering manifests
-
-<Tabs groupId="E150C802-7162-4FBF-82A7-77D9ADAEE847">
-  <TabItem value="command" label="Command">
-```bash
-holos render platform
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```
-rendered podinfo in 140.341417ms
-rendered platform in 140.441333ms
-```
-  </TabItem>
-</Tabs>
-
-## Reviewing the Kustomization
-
-The Artifact we added to `#ComponentConfig` will produce a Flux Kustomization
-resource for every component in the platform.  The output in this example is
-located at:
-
-```txt
-deploy/gitops/podinfo.kustomization.gen.yaml
-```
-```yaml showLineNumbers
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-    name: podinfo
-    namespace: default
-spec:
-    interval: 5m
-    path: deploy/components/podinfo
-    prune: true
-    sourceRef:
-        kind: GitRepository
-        name: webapp
-    timeout: 1m
-```
-
-[podinfo]: https://github.com/stefanprodan/podinfo
-[CUE Module]: https://cuelang.org/docs/reference/modules/
-[CUE Tags]: https://cuelang.org/docs/howto/inject-value-into-evaluation-using-tag-attribute/
-[Kustomization]: https://fluxcd.io/flux/components/kustomize/kustomizations/
-[Platform]: ../../api/author.md#Platform
-[ComponentConfig]: ../../api/author.md#ComponentConfig
-[Artifact]: ../../api/core.md#Artifact

doc/md/topics/gitops/index.mdx

@@ -1,19 +0,0 @@
----
-slug: .
-title: GitOps
-description: Managing resources with GitOps.
-sidebar_position: 120
----
-import DocCardList from '@theme/DocCardList';
-
-# GitOps
-
-This section has self contained articles covering how to manage resources using
-GitOps tooling like [ArgoCD] and [Flux].
-
----
-
-<DocCardList />
-
-[ArgoCD]: https://argo-cd.readthedocs.io/en/stable/
-[Flux]: https://fluxcd.io/

doc/md/topics/kargo.mdx

@@ -1,20 +0,0 @@
----
-description: Kargo
-slug: kargo
-sidebar_position: 110
----
-
-# Kargo
-
-Holos pairs nicely with [Kargo], offering a holistic solution for code
-promotion across stages.
-
-Watch this space for a more detailed write up of the integration being
-developed.
-
-If you're interested in this topic, please thumbs up the [Kargo
-Topic](https://github.com/holos-run/holos/issues/378) issue, or drop into
-[Discord] and let us know about your use case.
-
-[Kargo]: https://kargo.io/
-[Discord]: https://discord.gg/JgDVbNpye7

doc/md/topics/local-cluster.mdx

@@ -1,279 +0,0 @@
----
-description: Build a local cluster for use with Holos.
-slug: local-cluster
-sidebar_position: 50
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-import Admonition from '@theme/Admonition';
-
-# Local Cluster
-
-In this guide we'll set up a local k3d cluster to apply and explore the
-configuration described in our other guides.  After completing this guide you'll
-have a standard Kubernetes API server with proper DNS and TLS certificates.
-You'll be able to easily reset the cluster to a known good state to iterate on
-your own Platform.
-
-The [Glossary] page defines capitalized terms such as Platform and Component.
-
-## Reset the Cluster
-
-If you've already followed this guide, reset the cluster by running the
-following commands.  Skip this section if you're creating a cluster for the
-first time.
-
-First, delete the cluster.
-
-<Tabs groupId="k3d-cluster-delete">
-  <TabItem value="command" label="Command">
-```bash
-k3d cluster delete workload
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```txt showLineNumbers
-INFO[0000] Deleting cluster 'workload'
-INFO[0000] Deleting cluster network 'k3d-workload'
-INFO[0000] Deleting 1 attached volumes...
-INFO[0000] Removing cluster details from default kubeconfig...
-INFO[0000] Removing standalone kubeconfig file (if there is one)...
-INFO[0000] Successfully deleted cluster workload!
-```
-  </TabItem>
-</Tabs>
-
-Then create the cluster again.
-
-<Tabs groupId="k3d-cluster-create">
-  <TabItem value="command" label="Command">
-```bash
-k3d cluster create workload \
-  --registry-use k3d-registry.holos.localhost:5100 \
-  --port "443:443@loadbalancer" \
-  --k3s-arg "--disable=traefik@server:0"
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```txt showLineNumbers
-INFO[0000] portmapping '443:443' targets the loadbalancer: defaulting to [servers:*:proxy agents:*:proxy]
-INFO[0000] Prep: Network
-INFO[0000] Created network 'k3d-workload'
-INFO[0000] Created image volume k3d-workload-images
-INFO[0000] Starting new tools node...
-INFO[0000] Starting node 'k3d-workload-tools'
-INFO[0001] Creating node 'k3d-workload-server-0'
-INFO[0001] Creating LoadBalancer 'k3d-workload-serverlb'
-INFO[0001] Using the k3d-tools node to gather environment information
-INFO[0001] HostIP: using network gateway 172.17.0.1 address
-INFO[0001] Starting cluster 'workload'
-INFO[0001] Starting servers...
-INFO[0001] Starting node 'k3d-workload-server-0'
-INFO[0003] All agents already running.
-INFO[0003] Starting helpers...
-INFO[0003] Starting node 'k3d-workload-serverlb'
-INFO[0009] Injecting records for hostAliases (incl. host.k3d.internal) and for 3 network members into CoreDNS configmap...
-INFO[0012] Cluster 'workload' created successfully!
-INFO[0012] You can now use it like this:
-kubectl cluster-info
-```
-  </TabItem>
-</Tabs>
-
-Finally, add your trusted certificate authority.
-
-<Tabs groupId="apply-local-ca">
-  <TabItem value="command" label="Command">
-```bash
-kubectl apply --server-side=true -f "$(mkcert -CAROOT)/namespace.yaml"
-kubectl apply --server-side=true -n cert-manager -f "$(mkcert -CAROOT)/local-ca.yaml"
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```txt showLineNumbers
-namespace/cert-manager serverside-applied
-secret/local-ca serverside-applied
-```
-  </TabItem>
-</Tabs>
-
-You're back to the same state as the first time you completed this guide.
-
-## What you'll need {#requirements}
-
-You'll need the following tools installed to complete this guide.
-
-1. [holos](../tutorial/setup.mdx) - to build the platform.
-2. [helm](https://helm.sh/docs/intro/install/) - to render Holos components that wrap upstream Helm charts.
-3. [k3d](https://k3d.io/#installation) - to provide a k8s api server.
-4. [OrbStack](https://docs.orbstack.dev/install) or [Docker](https://docs.docker.com/get-docker/) - to use k3d.
-5. [kubectl](https://kubernetes.io/docs/tasks/tools/) - to interact with the k8s api server.
-6. [mkcert](https://github.com/FiloSottile/mkcert?tab=readme-ov-file#installation) - to make trusted TLS certificates.
-7. [jq](https://jqlang.github.io/jq/download/) - to fiddle with JSON output.
-
-## Configure DNS {#configure-dns}
-
-Configure your machine to resolve `*.holos.localhost` to your loopback
-interface.  This is necessary for requests to reach the workload cluster.  Save
-this script to a file and execute it.
-
-```bash showLineNumbers
-#! /bin/bash
-#
-
-set -euo pipefail
-
-tmpdir="$(mktemp -d)"
-finish() {
-  [[ -d "$tmpdir" ]] && rm -rf "$tmpdir"
-}
-trap finish EXIT
-cd "$tmpdir"
-
-brew install dnsmasq
-
-cat <<EOF >"$(brew --prefix)/etc/dnsmasq.d/holos.localhost.conf"
-# Refer to https://holos.run/docs/tutorial/local/k3d/
-address=/holos.localhost/127.0.0.1
-EOF
-
-if [[ -r /Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist ]]; then
-  echo "dnsmasq already configured"
-else
-  sudo cp "$(brew list dnsmasq | grep 'dnsmasq.plist$')" \
-    /Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist
-  sudo launchctl unload /Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist
-  sudo launchctl load /Library/LaunchDaemons/homebrew.mxcl.dnsmasq.plist
-  dscacheutil -flushcache
-  echo "dnsmasq configured"
-fi
-
-sudo mkdir -p /etc/resolver
-sudo tee /etc/resolver/holos.localhost <<EOF
-domain holos.localhost
-nameserver 127.0.0.1
-EOF
-sudo killall -HUP mDNSResponder
-
-echo "all done."
-```
-
-## Create the Cluster {#create-the-cluster}
-
-The Workload Cluster is where your applications and services will be deployed.
-In production this is usually an EKS, GKE, or AKS cluster.
-
-:::tip
-
-Holos supports all compliant Kubernetes clusters. Holos was developed and tested
-on GKE, EKS, Talos, k3s, and Kubeadm clusters.
-
-:::
-
-Create a local registry to speed up image builds and pulls.
-
-```bash
-k3d registry create registry.holos.localhost --port 5100
-```
-
-Create the workload cluster configured to use the local registry.
-
-```bash
-k3d cluster create workload \
-  --registry-use k3d-registry.holos.localhost:5100 \
-  --port "443:443@loadbalancer" \
-  --k3s-arg "--disable=traefik@server:0"
-```
-
-Traefik is disabled because Istio provides the same functionality.
-
-## Setup Root CA {#setup-root-ca}
-
-Platforms most often use cert-manager to issue tls certificates.  The browser
-and tools we're using need to trust these certificates to work together.
-Generate a local, trusted root certificate authority with the following script.
-
-Admin access is necessary for `mkcert` to manage the certificate into your trust
-stores.
-
-```bash
-sudo -v
-```
-
-Manage the local CA and copy the CA key to the workload cluster so that cert
-manager can manage trusted certificates.
-
-Save this script to a file and execute it to configure a trusted certificate
-authority.
-
-```bash showLineNumbers
-#! /bin/bash
-#
-
-set -euo pipefail
-
-mkcert --install
-
-tmpdir="$(mktemp -d)"
-finish() {
-  [[ -d "$tmpdir" ]] && rm -rf "$tmpdir"
-}
-trap finish EXIT
-cd "$tmpdir"
-
-# Create the local CA Secret with ca.crt, tls.crt, tls.key
-
-mkdir local-ca
-cd local-ca
-CAROOT="$(mkcert -CAROOT)"
-cp -p "${CAROOT}/rootCA.pem" ca.crt
-cp -p "${CAROOT}/rootCA.pem" tls.crt
-cp -p "${CAROOT}/rootCA-key.pem" tls.key
-kubectl create secret generic --from-file=.  --dry-run=client -o yaml local-ca > ../local-ca.yaml
-echo 'type: kubernetes.io/tls' >> ../local-ca.yaml
-
-cd ..
-
-cat <<EOF > namespace.yaml
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    kubernetes.io/metadata.name: cert-manager
-  name: cert-manager
-spec:
-  finalizers:
-  - kubernetes
-EOF
-kubectl apply --server-side=true -f namespace.yaml
-kubectl apply -n cert-manager --server-side=true -f local-ca.yaml
-
-# Save the Secret to easily reset the cluster later.
-install -m 0644 namespace.yaml "${CAROOT}/namespace.yaml"
-install -m 0600 local-ca.yaml "${CAROOT}/local-ca.yaml"
-```
-
-:::warning
-
-Take care to run the local-ca script each time you create the workload cluster
-so that Certificates are issued correctly.
-
-:::
-
-## Clean Up {#clean-up}
-
-If you'd like to clean up the resources you created in this guide, remove them
-with:
-
-```bash
-k3d cluster delete workload
-```
-
-## Next Steps
-
-Now that you have a real cluster, apply and explore the manifests Holos renders
-in the [Tutorial].
-
-[Glossary]: ../glossary.mdx
-[Tutorial]: ../tutorial.mdx

doc/md/topics/oci-helm-charts.mdx

@@ -1,65 +0,0 @@
----
-description: OCI Helm Charts
-slug: oci-helm-charts
-sidebar_position: 710
----
-
-# OCI Helm Charts
-
-Holos supports OCI Helm charts.  Use the following example to get started.
-
-```bash
-mkdir -p oci-helm && cd oci-helm
-holos init platform v1alpha5
-```
-
-```bash
-mkdir -p components/podinfo-oci
-cat <<EOF > components/podinfo-oci/podinfo-oci.cue
-```
-```cue showLineNumbers
-package holos
-
-holos: Component.BuildPlan
-
-Component: #Helm & {
-	Chart: {
-		name:    "oci://ghcr.io/stefanprodan/charts/podinfo"
-		release: "podinfo"
-		version: "6.6.2"
-	}
-}
-```
-```bash
-EOF
-```
-
-Register the component with the platform.
-
-```bash
-cat <<EOF >platform/podinfo-oci.cue
-```
-```cue showLineNumbers
-package holos
-
-Platform: Components: podinfo: {
-	name: "podinfo-oci"
-	path: "components/podinfo-oci"
-}
-```
-```bash
-EOF
-```
-
-The OCI chart is cached in the vendor directory and rendered.
-
-```bash
-holos render platform
-```
-
-```txt
-Pulled: ghcr.io/stefanprodan/charts/podinfo:6.6.2
-Digest: sha256:83295d47de6d6ca634ed4b952a7572fc176bcc38854d0c11ca0fa197bc5f1154
-rendered podinfo-oci in 7.21581325s
-rendered platform in 7.216199167s
-```

doc/md/topics/private-helm.mdx

@@ -1,183 +0,0 @@
----
-description: Private Helm Repositories
-slug: private-helm
-sidebar_position: 700
----
-
-# Private Helm
-
-Holos supports private Helm repositories accessed with http basic authentication
-since `v0.101.4`.  Use the following command to update your author and core
-schemas to support this configuration.
-
-```bash
-holos init platform v1alpha5 --force
-```
-
-## Configuration
-
-Holos uses the Helm SDK and defers to it for authentication to private
-repositories.  Each Helm Generator supports providing http basic authentication
-credentials from environment variables.
-
-For example, the following BuildPlan causes `holos` to get the admin username
-password from the `HOLOS_TEST_PASS` environment variable.
-
-```bash
-mkdir -p projects/holos/components/private-chart
-cat <<EOF > projects/holos/components/private-chart/private-chart.cue
-```
-```cue showLineNumbers
-package holos
-
-holos: Component.BuildPlan
-
-// Test holos can access a private repository with basic auth.
-// https://github.com/holos-run/holos/issues/370
-Component: #Helm & {
-	Chart: {
-		name:    "mychart"
-		version: "0.1.0"
-		repository: {
-			name: "holos-test"
-			url:  "https://charts.holos.localhost"
-			// auth: username: fromEnv:   "HOLOS_TEST_USER"
-			auth: username: value:   "admin"
-			auth: password: fromEnv: "HOLOS_TEST_PASS"
-		}
-	}
-}
-```
-```bash
-EOF
-```
-
-## Verification
-
-Verify `holos` can access a private Helm repository by setting [ChartMuseum] up
-on a [Local Cluster].  We'll use https with basic auth to authenticate to the
-chart repository.
-
-Using the [bank of holos] repository, deploy chart museum:
-
-```bash
-holos render platform -t ChartMuseum
-```
-
-Apply the manifests:
-
-```bash
-kubectl apply --server-side=true -f deploy/clusters/workload/projects/holos/components/chart-museum
-kubectl apply --server-side=true -f deploy/clusters/workload/projects/network/components/httproutes
-```
-
-Get the admin password:
-
-```bash
-kubectl get secret -n holos chartmuseum-auth -o json \
-  | jq --exit-status -r '.data.password | @base64d'
-```
-
-Add a local repo:
-
-```bash
-helm repo add holos-test https://charts.holos.localhost --username admin
-```
-```txt
-Password:
-"holos-test" has been added to your repositories
-```
-
-:::note
-Helm by default stores this password in `~/Library/Preferences/helm/repositories.yaml`
-:::
-
-Create a chart:
-
-```bash
-helm create mychart
-```
-```txt
-Creating mychart
-```
-
-Package it up.
-
-```bash
-helm package mychart
-```
-```txt
-Successfully packaged chart and saved it to: mychart-0.1.0.tgz
-```
-
-Publish it.
-
-```bash
-curl --user "admin:$(pbpaste)" --data-binary "@mychart-0.1.0.tgz" https://charts.holos.localhost/api/charts
-```
-```json
-{"saved":true}
-```
-
-Remove all cached charts:
-
-```bash
-find . -name vendor | xargs rm -rf
-```
-
-Render the chart:
-
-```bash
-cat <<EOF > test-private-repo.cue
-```
-```cue showLineNumbers
-@if(TestPrivateRepo)
-package holos
-
-// Test holos can access a private repository with basic auth.
-// https://github.com/holos-run/holos/issues/370
-Projects: holos: #ProjectBuilder & {
-        team: "holos-authors"
-
-        namespaces: holos:            _
-        _components: "private-chart": _
-}
-```
-```bash
-EOF
-```
-
-```
-time holos render platform -t TestPrivateRepo
-```
-
-Check the chart was pulled and cached:
-
-```shell
-tree ./projects/holos/components/private-chart/vendor
-```
-```txt
-./projects/holos/components/private-chart/vendor
-└── 0.1.0
-    ├── mychart
-    │   ├── Chart.yaml
-    │   ├── mychart-0.1.0.tgz
-    │   ├── templates
-    │   │   ├── NOTES.txt
-    │   │   ├── _helpers.tpl
-    │   │   ├── deployment.yaml
-    │   │   ├── hpa.yaml
-    │   │   ├── ingress.yaml
-    │   │   ├── service.yaml
-    │   │   ├── serviceaccount.yaml
-    │   │   └── tests
-    │   │       └── test-connection.yaml
-    │   └── values.yaml
-    └── mychart-0.1.0.tgz
-
-6 directories, 11 files
-```
-
-[Local Cluster]: ./local-cluster.mdx
-[ChartMuseum]: https://chartmuseum.com/docs/
-[bank of holos]: https://github.com/holos-run/bank-of-holos

doc/md/topics/structures/clusters.mdx

@@ -1,425 +0,0 @@
----
-slug: clusters
-title: Clusters
-description: Managing clusters - management and workload sets.
-sidebar_position: 100
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-import CommonComponent from '../../common/example-component.mdx';
-
-# Clusters
-
-## Overview
-
-This topic covers one common method to manage multiple clusters with Holos.  We'll
-define two schemas to hold cluster attributes.  First, a single `#Cluster` then
-a `#Clusters` collection.  We'll use a `Clusters: #Clusters` struct to look up
-configuration data using a key.  We'll use the cluster name as the lookup key
-identifying the cluster.
-
-We'll also organize sets of similar clusters by defining `#ClusterSet` and
-`#ClusterSets`.  We'll use a `ClusterSets:
-#ClusterSets` struct to configure a management cluster and iterate over all
-workload clusters.
-
-## The Code
-
-### Initializing the structure
-
-Use `holos` to generate a minimal platform directory structure.  Start by
-creating a blank directory to hold the platform configuration.
-
-```shell
-mkdir holos-multiple-clusters && cd holos-multiple-clusters
-```
-
-```shell
-holos init platform v1alpha5
-```
-
-### Using an example Component
-
-<CommonComponent />
-
-We'll integrate the component with the platform after we define the
-configuration structures.
-
-## Defining Clusters
-
-We'll define a `#Cluster` schema and a `#Clusters` collection in this section.
-We'll use these schemas to define a `Clusters` structure we use to manage
-multiple clusters.
-
-### Assumptions
-
-We'll make the following assumptions, which hold true for many real world
-environments.
-
-1. There are two sets of clusters, workload clusters and management clusters.
-2. There is one management cluster.
-3. There are multiple workload clusters.
-4. Each workload cluster is configured similarly, but not identically, to the
-others.
-
-### Prototyping the data
-
-Before we define the schema, let's prototype the data structure we want to work
-with.  We want a structure that makes it easy to iterate over each cluster in
-two distinct sets of clusters, management clusters and workload clusters.  The
-following `ClusterSets` struct accomplishes this goal.
-
-```yaml showLineNumbers
-management:
-  name: management
-  clusters:
-    management:
-      name: management
-      region: us-central1
-      set: management
-workload:
-  name: workload
-  clusters:
-    e1:
-      name: e1
-      region: us-east1
-      set: workload
-    w1:
-      name: w1
-      region: us-west1
-      set: workload
-```
-
-:::tip
-The `ClusterSets` data structure supports iterating over each cluster in each
-cluster set.
-:::
-
-:::important
-You're free to define your own fields and structures like we define `region` in
-this topic.
-:::
-
-### Defining the schema
-
-Armed with a concrete example of the structure, we can write a schema to define
-and validate the data.
-
-In CUE, schema definitions are usually defined at the root so they're accessible
-in all subdirectories.  The following is one example schema, you're free to
-modify it to your situation.  Holos is flexible, supporting schemas that match
-your unique use case.
-
-```bash
-cat <<EOF > clusters.schema.cue
-```
-```cue showLineNumbers
-package holos
-
-import "strings"
-
-// #Cluster represents one cluster
-#Cluster: {
-	// name represents the cluster name.
-	name: string & =~"[a-z][a-z0-9]+" & strings.MinRunes(2) & strings.MaxRunes(63)
-	// Constrain the regions.  No default, the region must be specified.
-	region: "us-east1" | "us-central1" | "us-west1"
-	// Each cluster must be in only one set of clusters.  All but one cluster are
-	// workload clusters, so make it the default.
-	set: "management" | *"workload"
-}
-
-// #Clusters represents a cluster collection structure
-#Clusters: {
-	// name is the lookup key for the collection.
-	[NAME=string]: #Cluster & {
-		// name must match the struct field name.
-		name: NAME
-	}
-}
-
-// #ClusterSet represents a set of clusters.
-#ClusterSet: {
-	// name represents the cluster set name.
-	name: string & =~"[a-z][a-z0-9]+" & strings.MinRunes(2) & strings.MaxRunes(63)
-	clusters: #Clusters & {
-		// Constrain the cluster set to clusters having the same set.  Ensures
-		// clusters are never mis-categorized.
-		[_]: set: name
-	}
-}
-
-// #ClusterSets represents a cluster set collection.
-#ClusterSets: {
-	// name is the lookup key for the collection.
-	[NAME=string]: #ClusterSet & {
-		// name must match the struct field name.
-		name: NAME
-	}
-}
-```
-```bash
-EOF
-```
-
-### Defining the data
-
-With a schema defined, we also define the data close to the root so it's
-accessible through the unified configuration tree.
-
-```bash
-cat <<EOF > clusters.cue
-```
-```cue showLineNumbers
-package holos
-
-Clusters: #Clusters & {
-	// Management Cluster
-	management: region: "us-central1"
-	management: set:    "management"
-	// Local Cluster
-	local: region: "us-west1"
-	// Some example clusters.  Add new clusters to the Clusters struct like this.
-	e1: region: "us-east1"
-	e2: region: "us-east1"
-	e3: region: "us-east1"
-	w1: region: "us-west1"
-	w2: region: "us-west1"
-	w3: region: "us-west1"
-}
-
-// ClusterSets is dynamically built from the Clusters structure.
-ClusterSets: #ClusterSets & {
-	// Map every cluster into the correct set.
-	for CLUSTER in Clusters {
-		(CLUSTER.set): clusters: (CLUSTER.name): CLUSTER
-	}
-}
-```
-```bash
-EOF
-```
-
-### Inspecting the data
-
-We'll use the `holos cue` command to inspect the `ClusterSets` data structure we
-just defined.
-
-<Tabs groupId="9190BDAD-B4C5-4386-9C94-8E178AA6178A">
-  <TabItem value="command" label="Command">
-```bash
-holos cue export --expression ClusterSets --out=yaml ./
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```yaml showLineNumbers
-management:
-  name: management
-  clusters:
-    management:
-      name: management
-      region: us-central1
-      set: management
-workload:
-  name: workload
-  clusters:
-    local:
-      name: local
-      region: us-west1
-      set: workload
-    e1:
-      name: e1
-      region: us-east1
-      set: workload
-    e2:
-      name: e2
-      region: us-east1
-      set: workload
-    e3:
-      name: e3
-      region: us-east1
-      set: workload
-    w1:
-      name: w1
-      region: us-west1
-      set: workload
-    w2:
-      name: w2
-      region: us-west1
-      set: workload
-    w3:
-      name: w3
-      region: us-west1
-      set: workload
-```
-  </TabItem>
-</Tabs>
-
-This looks like our prototype, we're confident we can iterate over each cluster
-in each set.
-
-## Integrating Components
-
-The `ClusterSets` data structure unlocks the capability to iterate over each
-cluster in each cluster set.  We'll use this capability to integrate the
-`podinfo` component with each cluster in the platform.
-
-### Configuring the Output directory
-
-We need to configure `holos` to write output manifests into a cluster specific
-output directory.  We'll use the [ComponentConfig] `OutputBaseDir` field for
-this purpose.  We'll pass the value of this field as a component parameter.
-
-```bash
-cat <<EOF > componentconfig.cue
-```
-```cue showLineNumbers
-package holos
-
-#ComponentConfig: {
-	// Inject the output base directory from platform component parameters.
-	OutputBaseDir: string @tag(outputBaseDir, type=string)
-}
-```
-```bash
-EOF
-```
-
-### Integrating Podinfo
-
-```bash
-cat <<EOF >platform/podinfo.cue
-```
-```cue showLineNumbers
-package holos
-
-// Manage podinfo on all workload clusters.
-for CLUSTER in ClusterSets.workload.clusters {
-	// We use the cluster name to disambiguate different podinfo build plans.
-	Platform: Components: "\(CLUSTER.name)-podinfo": {
-		name: "podinfo"
-		// Reuse the same component across multiple workload clusters.
-		path: "components/podinfo"
-		// Configure a cluster-unique message in the podinfo UI.
-		parameters: message: "Hello, I am cluster \(CLUSTER.name) in region \(CLUSTER.region)"
-		// Write to deploy/{outputBaseDir}/components/{name}/{name}.gen.yaml
-		parameters: outputBaseDir: "clusters/\(CLUSTER.name)"
-	}
-}
-```
-```bash
-EOF
-```
-
-## Rendering manifests
-
-### Rendering the Platform
-
-Render the platform to configure `podinfo` on each cluster.
-
-<Tabs groupId="34A2D80B-0E86-4142-B65B-7DF70C47E1D2">
-  <TabItem value="command" label="Command">
-```bash
-holos render platform
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```txt
-cached podinfo 6.6.2
-rendered podinfo in 164.278583ms
-rendered podinfo in 165.48525ms
-rendered podinfo in 165.186208ms
-rendered podinfo in 165.831792ms
-rendered podinfo in 166.845208ms
-rendered podinfo in 167.000208ms
-rendered podinfo in 167.012208ms
-rendered platform in 167.06525ms
-```
-  </TabItem>
-</Tabs>
-
-### Inspecting the Tree
-
-Rendering the platform produces the following rendered manifests.
-
-```bash
-tree deploy
-```
-```txt showLineNumbers
-deploy
-└── clusters
-    ├── e1
-    │   └── components
-    │       └── podinfo
-    │           └── podinfo.gen.yaml
-    ├── e2
-    │   └── components
-    │       └── podinfo
-    │           └── podinfo.gen.yaml
-    ├── e3
-    │   └── components
-    │       └── podinfo
-    │           └── podinfo.gen.yaml
-    ├── local
-    │   └── components
-    │       └── podinfo
-    │           └── podinfo.gen.yaml
-    ├── w1
-    │   └── components
-    │       └── podinfo
-    │           └── podinfo.gen.yaml
-    ├── w2
-    │   └── components
-    │       └── podinfo
-    │           └── podinfo.gen.yaml
-    └── w3
-        └── components
-            └── podinfo
-                └── podinfo.gen.yaml
-
-23 directories, 7 files
-```
-
-### Inspecting the Variation
-
-Note how each component has slight variation using the component parameters.
-
-```bash
-diff -U2 deploy/clusters/{e,w}1/components/podinfo/podinfo.gen.yaml
-```
-
-```diff
---- deploy/clusters/e1/components/podinfo/podinfo.gen.yaml	2024-11-17 14:20:17
-+++ deploy/clusters/w1/components/podinfo/podinfo.gen.yaml	2024-11-17 14:20:17
-@@ -61,5 +61,5 @@
-         env:
-         - name: PODINFO_UI_MESSAGE
--          value: Hello, I am cluster e1 in region us-east1
-+          value: Hello, I am cluster w1 in region us-west1
-         - name: PODINFO_UI_COLOR
-           value: '#34577c'
-
-```
-
-## Concluding Remarks
-
-In this topic we covered how to use CUE structures to organize multiple clusters
-into various sets.
-
-1. Clusters are defined in one place at the root of the configuration.
-2. Clusters may be organized into sets by their purpose.
-3. Most organizations have at least two sets, a set of workload clusters and a
-set of management clusters.
-4. Holos uses CUE, a super set of JSON.  New clusters may be added by dropping a
-JSON file into the root of the repository.
-5. The pattern of defining a `#Cluster` and a `#Clusters` collection is a
-general pattern.  We'll see the same pattern for environments, projects, owners,
-and more.
-6. Component parameters are a flexible way to inject user defined configuration
-from the platform level into a reusable component.
-
-[ClusterSet]: https://multicluster.sigs.k8s.io/api-types/cluster-set/
-[Environments]: ./environments.mdx
-[Namespace Sameness - SIG Multicluster Position Statement]: https://github.com/kubernetes/community/blob/master/sig-multicluster/namespace-sameness-position-statement.md
-[ComponentConfig]: ../../api/author.md#ComponentConfig

doc/md/topics/structures/environments.mdx

@@ -1,521 +0,0 @@
----
-slug: environments
-title: Environments
-description: Managing Environments - dev, test, stage, prod.
-sidebar_position: 130
----
-
-import Tabs from '@theme/Tabs';
-import TabItem from '@theme/TabItem';
-import CommonComponent from '../../common/example-component.mdx';
-
-# Environments
-
-## Overview
-
-This topic covers how to model environments in Holos. We'll define schemas for
-`#Environment` and `#Environments` to represent one environment and a
-collection. The `Environments: #Environments` struct maps environment names to
-configurations.
-
-:::note
-This approach unifies the component definition with the overall platform
-configuration, creating a tight coupling between the two.
-:::
-
-This tight coupling is appropriate when you're configuring your own platform.
-For example:
-
-1. When you're integrating third party software into your own platform.
-2. When you're configuring first party in-house software into your own platform.
-
-This approach is not well suited to writing a component to share outside of your
-own organization, which we can think of as configuring someone else's platform.
-
-## The Code
-
-### Generating the structure
-
-Use `holos init platform` to generate a minimal platform structure:
-
-```shell
-mkdir holos-environments-tutorial && cd holos-environments-tutorial
-holos init platform v1alpha5
-```
-
-### Using an example Component
-
-Create a directory for the example `podinfo` component we'll use to render
-platform manifests.
-
-```bash
-mkdir -p components/podinfo
-```
-
-Create the CUE configuration for the example `podinfo` component.
-
-```bash
-cat <<EOF >components/podinfo/podinfo.cue
-```
-```cue showLineNumbers
-package holos
-
-holos: Component.BuildPlan
-
-Component: #Helm & {
-	Chart: {
-		name:    "podinfo"
-		version: "6.6.2"
-		repository: {
-			name: "podinfo"
-			url:  "https://stefanprodan.github.io/podinfo"
-		}
-	}
-	Values: ui: {
-		message: string | *"Hello World" @tag(message, type=string)
-	}
-}
-```
-```bash
-EOF
-```
-
-We'll integrate the component with the platform after we define the
-configuration structures.
-
-## Defining Environments
-
-We'll define an `#Environment` schema `#Environments` collection.  We'll use
-these schemas to define an `Environments` struct of concrete configuration
-values.
-
-### Assumptions
-
-There are two tiers of environments, prod and nonprod.  Prod environments
-organized along broad jurisdictions, for example US and EU.  Nonprod
-environments are organized by purpose, dev, test, and stage.
-
-### Prototyping the data
-
-Before we define the schema, let's prototype the data structure we want to work
-with from the perspective of each component.
-
-Let's imagine we're configuring `podinfo` to comply with regulations.  When
-podinfo is deployed to production in the EU, we'll configure opt-in behavior.
-In the US we'll configure opt-out behavior.
-
-We'll pass the environment name as a component parameter.  The component
-definition can then look up the jurisdiction to determine the appropriate
-configuration values.
-
-```shell
-holos cue export --out=yaml --expression Environments
-```
-
-```yaml showLineNumbers
-prod-pdx:
-  name: prod-pdx
-  tier: prod
-  jurisdiction: us
-  state: oregon
-prod-cmh:
-  name: prod-cmh
-  tier: prod
-  jurisdiction: us
-  state: ohio
-prod-ams:
-  name: prod-ams
-  tier: prod
-  jurisdiction: eu
-  state: netherlands
-dev:
-  name: dev
-  tier: nonprod
-  jurisdiction: us
-  state: oregon
-test:
-  name: test
-  tier: nonprod
-  jurisdiction: us
-  state: oregon
-stage:
-  name: stage
-  tier: nonprod
-  jurisdiction: us
-  state: oregon
-```
-
-### Defining the schema
-
-Given the example structure, we can write a schema to define and validate the
-data.
-
-```shell
-cat <<EOF > environments.schema.cue
-```
-```cue showLineNumbers
-package holos
-
-#Environment: {
-	name:         string
-	tier:         "prod" | "nonprod"
-	jurisdiction: "us" | "eu" | "uk" | "global"
-	state:        "oregon" | "ohio" | "germany" | "netherlands" | "england" | "global"
-
-	// Prod environment names must be prefixed with prod for clarity.
-	if tier == "prod" {
-		name: "prod" | =~"^prod-"
-	}
-}
-
-#Environments: {
-	[NAME=string]: #Environment & {
-		name: NAME
-	}
-}
-```
-```shell
-EOF
-```
-
-### Adding configuration
-
-With a schema defined, we can fill in the concrete values.
-
-```shell
-cat <<EOF > environments.cue
-```
-```cue showLineNumbers
-package holos
-
-// Injected from Platform.spec.components.parameters.EnvironmentName
-EnvironmentName: string @tag(EnvironmentName)
-
-Environments: #Environments & {
-	"prod-pdx": {
-		tier:         "prod"
-		jurisdiction: "us"
-		state:        "oregon"
-	}
-	"prod-cmh": {
-		tier:         "prod"
-		jurisdiction: "us"
-		state:        "ohio"
-	}
-	"prod-ams": {
-		tier:         "prod"
-		jurisdiction: "eu"
-		state:        "netherlands"
-	}
-	// Nonprod environments are colocated together.
-	_nonprod: {
-		tier:         "nonprod"
-		jurisdiction: "us"
-		state:        "oregon"
-	}
-	dev:   _nonprod
-	test:  _nonprod
-	stage: _nonprod
-}
-```
-```shell
-EOF
-```
-
-### Inspecting the configuration
-
-Inspect the `Environments` data structure to verify the schema and concrete
-values are what we want.
-
-<Tabs groupId="FF820F5A-A85F-464D-B299-39CAAFFCE5C6">
-  <TabItem value="command" label="Command">
-```bash
-holos cue export --out=yaml --expression Environments
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```yaml showLineNumbers
-prod-pdx:
-  name: prod-pdx
-  tier: prod
-  jurisdiction: us
-  state: oregon
-prod-cmh:
-  name: prod-cmh
-  tier: prod
-  jurisdiction: us
-  state: ohio
-prod-ams:
-  name: prod-ams
-  tier: prod
-  jurisdiction: eu
-  state: netherlands
-dev:
-  name: dev
-  tier: nonprod
-  jurisdiction: us
-  state: oregon
-test:
-  name: test
-  tier: nonprod
-  jurisdiction: us
-  state: oregon
-stage:
-  name: stage
-  tier: nonprod
-  jurisdiction: us
-  state: oregon
-```
-  </TabItem>
-</Tabs>
-
-This looks like our prototype, we're confident we can iterate over each
-environment and get a handle on the configuration values we need.
-
-## Integrating components
-
-The `Environments` data structure unlocks the capability to look up concrete
-values specific to a named environment.  We'll use this capability to configure
-the `podinfo` component in compliance with the regulations of the jurisdiction.
-
-### Configuring the environment
-
-Inject the environment name when we integrate `podinfo` with the platform.
-
-```shell
-cat <<EOF > platform/podinfo.cue
-```
-```cue showLineNumbers
-package holos
-
-Platform: Components: {
-	podinfoPDX: ProdPodinfo & {_city: "pdx"}
-	podinfoCMH: ProdPodinfo & {_city: "cmh"}
-	podinfoAMS: ProdPodinfo & {_city: "ams"}
-	podinfoDEV: {
-		name: "podinfo-dev"
-		path: "components/podinfo"
-		labels: "app.holos.run/component": "podinfo"
-		parameters: EnvironmentName:       "dev"
-	}
-}
-
-let ProdPodinfo = {
-	_city: string
-	name:  "podinfo-\(_city)"
-	path:  "components/podinfo"
-	labels: "app.holos.run/component": "podinfo"
-	labels: "app.holos.run/tier":      "prod"
-	labels: "app.holos.run/city":      _city
-	parameters: EnvironmentName:       "prod-\(_city)"
-}
-```
-```
-EOF
-```
-
-### Using the environment
-
-Now we can configure `podinfo` based on the jurisdiction of the environment.
-
-```shell
-cat <<EOF > components/podinfo/cookie-consent.cue
-```
-```cue showLineNumbers
-package holos
-
-// Schema definition for our configuration.
-#Values: {
-	ui: enableCookieConsent: *true | false
-	ui: message:             string
-}
-
-// Map jurisdiction to helm values
-JurisdictionValues: {
-	// Enable cookie consent by default in any jurisdiction.
-	[_]: #Values
-	// Disable in the US.
-	us: ui: enableCookieConsent: false
-	eu: ui: enableCookieConsent: true
-}
-
-// Look up the configuration values associated with the environment name.
-Component: Values: JurisdictionValues[Environments[EnvironmentName].jurisdiction]
-```
-```shell
-EOF
-```
-
-### Inspecting the BuildPlans
-
-With the above configuration, we can inspect the buildplans for this component.
-The prod environment in Amsterdam has cookie consent enabled on line 26.
-
-<Tabs groupId="6EC991F3-F78C-43F1-8A6D-E68D8BDAF58B">
-  <TabItem value="command" label="Command">
-```bash
-holos show buildplans --selector app.holos.run/city=ams
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```yaml showLineNumbers
-kind: BuildPlan
-apiVersion: v1alpha5
-metadata:
-  name: podinfo-ams
-  labels:
-    app.holos.run/city: ams
-    app.holos.run/component: podinfo
-    app.holos.run/name: podinfo-ams
-    app.holos.run/tier: prod
-spec:
-  artifacts:
-    - artifact: components/podinfo-ams/podinfo-ams.gen.yaml
-      generators:
-        - kind: Helm
-          output: helm.gen.yaml
-          helm:
-            chart:
-              name: podinfo
-              version: 6.6.2
-              release: podinfo
-              repository:
-                name: podinfo
-                url: https://stefanprodan.github.io/podinfo
-            values:
-              ui:
-                # highlight-next-line
-                enableCookieConsent: true
-                message: Hello World
-        - kind: Resources
-          output: resources.gen.yaml
-      transformers:
-        - kind: Kustomize
-          inputs:
-            - helm.gen.yaml
-            - resources.gen.yaml
-          output: components/podinfo-ams/podinfo-ams.gen.yaml
-          kustomize:
-            kustomization:
-              apiVersion: kustomize.config.k8s.io/v1beta1
-              kind: Kustomization
-              labels:
-                - includeSelectors: false
-                  pairs: {}
-              resources:
-                - helm.gen.yaml
-                - resources.gen.yaml
-    - artifact: gitops/podinfo-ams.application.gen.yaml
-      generators:
-        - kind: Resources
-          output: gitops/podinfo-ams.application.gen.yaml
-          resources:
-            Application:
-              podinfo-ams:
-                apiVersion: argoproj.io/v1alpha1
-                kind: Application
-                metadata:
-                  name: podinfo-ams
-                  namespace: argocd
-                spec:
-                  destination:
-                    server: https://kubernetes.default.svc
-                  project: default
-                  source:
-                    path: deploy/components/podinfo-ams
-                    repoURL: https://github.com/brenix/holos-demo.git
-                    targetRevision: main
-```
-  </TabItem>
-</Tabs>
-
-In Portland cookie consent is disabled.
-
-<Tabs groupId="3438335B-1FFC-4838-B8DE-C54B8346CDB4">
-  <TabItem value="command" label="Command">
-```bash
-holos show buildplans --selector app.holos.run/city=pdx
-```
-  </TabItem>
-  <TabItem value="output" label="Output">
-```yaml showLineNumbers
-kind: BuildPlan
-apiVersion: v1alpha5
-metadata:
-  name: podinfo-pdx
-  labels:
-    app.holos.run/city: pdx
-    app.holos.run/component: podinfo
-    app.holos.run/name: podinfo-pdx
-    app.holos.run/tier: prod
-spec:
-  artifacts:
-    - artifact: components/podinfo-pdx/podinfo-pdx.gen.yaml
-      generators:
-        - kind: Helm
-          output: helm.gen.yaml
-          helm:
-            chart:
-              name: podinfo
-              version: 6.6.2
-              release: podinfo
-              repository:
-                name: podinfo
-                url: https://stefanprodan.github.io/podinfo
-            values:
-              ui:
-                # highlight-next-line
-                enableCookieConsent: false
-                message: Hello World
-        - kind: Resources
-          output: resources.gen.yaml
-      transformers:
-        - kind: Kustomize
-          inputs:
-            - helm.gen.yaml
-            - resources.gen.yaml
-          output: components/podinfo-pdx/podinfo-pdx.gen.yaml
-          kustomize:
-            kustomization:
-              apiVersion: kustomize.config.k8s.io/v1beta1
-              kind: Kustomization
-              labels:
-                - includeSelectors: false
-                  pairs: {}
-              resources:
-                - helm.gen.yaml
-                - resources.gen.yaml
-    - artifact: gitops/podinfo-pdx.application.gen.yaml
-      generators:
-        - kind: Resources
-          output: gitops/podinfo-pdx.application.gen.yaml
-          resources:
-            Application:
-              podinfo-pdx:
-                apiVersion: argoproj.io/v1alpha1
-                kind: Application
-                metadata:
-                  name: podinfo-pdx
-                  namespace: argocd
-                spec:
-                  destination:
-                    server: https://kubernetes.default.svc
-                  project: default
-                  source:
-                    path: deploy/components/podinfo-pdx
-                    repoURL: https://github.com/brenix/holos-demo.git
-                    targetRevision: main
-```
-  </TabItem>
-</Tabs>
-
-## Concluding Remarks
-
-In this topic we covered how to use a CUE structure to define attributes of prod
-and nonprod environments.
-
-1. We passed the environment name as a parameter to each component using a CUE `@tag`.
-2. The component definition uses the environment name as a key to get a handle
-on attributes. For example, the jurisdiction a service operates within.
-3. The example podinfo component uses an additional structure to map
-jurisdictions to concrete configuration values.