KCLRun OCI Source downloaded every iteration

[markphillips100]

What happened?

Not sure if this has always been happening but just noticed that my local registry is being hammered by function-kcl to download oci packages for the function-kcl's KCLRun. This happens every reconciliation loop.

Something like this composition using an OCI will show repeated downloading logs (and I can see the requests in the registry log too):

apiVersion: apiextensions.crossplane.io/v1
kind: Composition
metadata:
  name: workloadidentity-composite
  labels:
    version: "0.0.1"
spec:
  compositeTypeRef:
    apiVersion: example.com/v1alpha1
    kind: WorkloadIdentityComposite
  writeConnectionSecretsToNamespace: crossplane-system
  mode: Pipeline
  pipeline:
  - step: normal
    functionRef:
      name: kcl-function
    input:
      apiVersion: krm.kcl.dev/v1alpha1
      kind: KCLRun
      metadata:
        name: basic
        annotations:
          krm.kcl.dev/allow-insecure-source: "true"
      spec:
        source: oci://host.docker.internal:7900/example/workloadidentity-default-composition-kcl:0.0.1
  - step: automatically-detect-ready-composed-resources
    functionRef:
      name: function-auto-ready

downloading 'example/workloadidentity-default-composition-kcl:0.0.1:0.0.1' from 'host.docker.internal:7900/example/workloadidentity-default-composition-kcl:0.0.1:0.0.1'
{"level":"info","ts":1748866533.3905637,"caller":"fn/fn.go:250","msg":"Successfully processed crossplane KCL function resources","tag":"71f4485b88307f560ae2aae420936e8ed3050ab8b8affe78d5c5f42b2c40d419","xr-ver{"level":"info","ts":1748866538.7413683,"caller":"fn/fn.go:38","msg":"Running Function","tag":"40b349010e688fefd6272e8d921b5e7f9b84b084209f2d10eda3d3a351e6cd32"}
the latest version '0.0.1' will be downloaded

I would have expected the function to cache the oci somewhere?

How can we reproduce it?

Create some KCL code to create a resource and package it into an OCI and push to a local registry:2. Write a composition that makes use of the OCI source and deploy to a crossplane cluster.

What environment did it happen in?

Function version: xpkg.crossplane.io/crossplane-contrib/function-kcl:v0.11.2
Crossplane: v1.20.0
KinD: 0.29.0
Kubernetes: 1.32.0

[markphillips100]

Is it possible for the function to cache the OCIs (somewhere) and maybe clear the cache on start/restart of the function, and use the cached versions for the lifetime of the function?

[tng-daniel-haehnke]

Seems like this is an upstream problem in KCL itself. Running kcl run oci://ghcr.io/kcl-lang/helloworld temporarily creates three directories with random numbers. Even if those directories are not deleted (which is what happens in function-kcl v0.11.x), KCL would probably not "look" for its previous cache dirs.

[markphillips100]

In the kpm I believe but could be wrong.

[kptranum]

I have done some testing locally and found that when executing remote OCI-hosted KCL packages directly using kcl run oci:///:, KCL downloads the package on every invocation. Unlike dependencies declared in a kcl.mod file (which are cached by KPM), the main package itself is treated as ephemeral. I even tried to wrap the remote package in a local project by adding the oci package into the dependencies of the local project. Then it only downloads the remote package on the first run. But of course this is not a solution for this use-case.

I have created an issue in kcl-lang project: kcl-lang/kcl#1992