Skip to content

Commit 5f5c53f

Browse files
jakobmoellerdevjakobmoellerdev
authored
feat: sovereign reference scenario (open-component-model#1733)
<!-- markdownlint-disable MD041 --> #### What this PR does / why we need it This document designs a reference scenario demonstrating OCM's core value proposition: **modeling, signing, transporting, and deploying a multi-service product into an air-gapped sovereign cloud environment**. The scenario uses two genuinely interdependent services: - **sovereign-notes**: A minimal Go web service that stores notes in PostgreSQL - **PostgreSQL**: The official postgres image, deployed via manifests Both are packaged as OCM components, signed, transferred through an air-gap via CTF, and bootstrapped on a local kind cluster using the OCM Kubernetes controllers with KRO, Flux/Argo. #### Which issue(s) this PR fixes <!-- Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`. --> This gives us a new reference scenario that integrates us with Apeiro and the World. fix open-component-model/ocm-project#842 Note that this itself is not finished until fully integrated. Especially integration into Apeiro is higher level and conceptual than our OCM delivery scenario. Note also that this delivery scenario itself is not fully ready, and many APIs are pseudo-coded in by me. As I understand them more, I gain more understanding of the APIs as well so these things might change. The core delivery scenario should be rather stable however <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **New Features** * Added a sovereign conformance scenario: deployable Notes service + PostgreSQL, Helm charts, OpenAPI/ORD metadata, product orchestration, and end‑to‑end task automation for build/sign/air‑gap/import/deploy. * **Tests** * CI now exposes image tags and includes a reusable Conformance workflow/job to run the end‑to‑end scenario. * **Documentation** * Added conformance README, scenario USAGE, detailed ADR/design doc, runbooks and contribution guidance. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Jakob Möller <jakob.moeller@sap.com> Signed-off-by: Jakob Möller <contact@jakob-moeller.com>
1 parent e7f4bce commit 5f5c53f

40 files changed

+3974
-3
lines changed

‎.github/config/.markdownlint-cli2.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
#yaml-language-server: $schema=https://raw.githubusercontent.com/DavidAnson/markdownlint-cli2/refs/heads/main/schema/markdownlint-cli2-config-schema.json
2+
gitignore: true
23
config:
34
default: true
45

‎.github/config/wordlist.txt‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -338,6 +338,7 @@ ocmify
338338
ocmops
339339
ocmresourcereference
340340
ocms
341+
ocm's
341342
odg
342343
offboarding
343344
onboarded
@@ -599,4 +600,15 @@ warroom
599600
wgs
600601
kubermatic
601602
baseUrl
602-
ociimage
603+
krm
604+
kv
605+
ord
606+
openmcp
607+
resourcegraphdefinitions
608+
rgds
609+
kustomizations
610+
ecdsa
611+
integrators
612+
taskfile
613+
ociimage
614+
statefulset

‎.github/workflows/cli.yml‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,7 @@ jobs:
153153
runs-on: ubuntu-latest
154154
outputs:
155155
image_digest: ${{ steps.digest.outputs.digest }}
156+
image_tag: ${{ steps.set-tag.outputs.tag }}
156157
permissions:
157158
actions: read # Needed for artifact download
158159
packages: write # Needed for pushing OCI images and provenance layers
@@ -178,7 +179,11 @@ jobs:
178179

179180
# use discovered tag from layout
180181
- name: Set TAG
181-
run: echo "TAG=$(oras repo tags --oci-layout ${LAYOUT} | head -n 1)" >> "$GITHUB_ENV"
182+
id: set-tag
183+
run: |
184+
TAG=$(oras repo tags --oci-layout ${LAYOUT} | head -n 1)
185+
echo "TAG=$TAG" >> "$GITHUB_ENV"
186+
echo "tag=$TAG" >> "$GITHUB_OUTPUT"
182187
183188
- name: Log in to GHCR
184189
uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
@@ -207,3 +212,11 @@ jobs:
207212
subject-digest: ${{ steps.digest.outputs.digest }}
208213
subject-name: ${{ env.TARGET_REPO }}
209214
push-to-registry: true
215+
216+
conformance:
217+
name: Conformance
218+
needs: publish
219+
uses: ./.github/workflows/conformance.yml
220+
with:
221+
cli_image: "ghcr.io/open-component-model/cli:${{ needs.publish.outputs.image_tag }}@${{ needs.publish.outputs.image_digest }}"
222+
secrets: inherit

‎.github/workflows/conformance.yml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
name: Conformance
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
cli_image:
7+
description: "CLI Docker image reference"
8+
type: string
9+
required: false
10+
default: ""
11+
toolkit_image:
12+
description: "OCI reference to the controller Helm chart (with optional :version tag)"
13+
type: string
14+
required: false
15+
default: ""
16+
push:
17+
branches:
18+
- main
19+
paths:
20+
- conformance/**
21+
- .github/workflows/conformance.yml
22+
pull_request:
23+
branches:
24+
- main
25+
paths:
26+
- conformance/**
27+
- .github/workflows/conformance.yml
28+
29+
permissions:
30+
contents: read
31+
32+
concurrency:
33+
group: conformance-${{ github.workflow }}-${{ github.ref }}-${{ inputs.cli_image || 'default-cli' }}-${{ inputs.toolkit_image || 'default-toolkit' }}
34+
cancel-in-progress: true
35+
36+
env:
37+
CLI_IMAGE: ${{ inputs.cli_image || 'ghcr.io/open-component-model/cli:main' }}
38+
TOOLKIT_IMAGE: ${{ inputs.toolkit_image || 'ghcr.io/open-component-model/kubernetes/controller/chart:0.0.0-c837a09' }}
39+
40+
jobs:
41+
conformance:
42+
name: Sovereign Scenario
43+
runs-on: ubuntu-latest
44+
timeout-minutes: 30
45+
steps:
46+
- name: Checkout
47+
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
48+
with:
49+
sparse-checkout: conformance/scenarios/sovereign
50+
- uses: actions/setup-go@v6
51+
with:
52+
go-version-file: conformance/scenarios/sovereign/components/notes/go.mod
53+
- name: Install Task
54+
uses: arduino/setup-task@b91d5d2c96a56797b48ac1e0e89220bf64044611 # v2
55+
with:
56+
version: 3.x
57+
repo-token: ${{ secrets.GITHUB_TOKEN }}
58+
- name: Set up Docker Buildx
59+
uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
60+
- name: Install Helm
61+
uses: azure/setup-helm@v4.3.0
62+
with:
63+
version: v4.0.0
64+
- name: Setup Flux CLI
65+
uses: fluxcd/flux2/action@8454b02a32e48d775b9f563cb51fdcb1787b5b93 # v2.7.5
66+
67+
- name: Install kind
68+
run: go install sigs.k8s.io/kind@v0.31.0
69+
- name: Check dependencies
70+
working-directory: conformance/scenarios/sovereign
71+
run: task check
72+
- name: Run conformance scenario
73+
working-directory: conformance/scenarios/sovereign
74+
run: >-
75+
task run CLI_IMAGE='${{ env.CLI_IMAGE }}' TOOLKIT_IMAGE='${{ env.TOOLKIT_IMAGE }}'
76+
- name: Run upgrade scenario
77+
working-directory: conformance/scenarios/sovereign
78+
run: >-
79+
task upgrade CLI_IMAGE='${{ env.CLI_IMAGE }}' TOOLKIT_IMAGE='${{ env.TOOLKIT_IMAGE }}'
80+
- name: Verify upgrade
81+
working-directory: conformance/scenarios/sovereign
82+
run: >-
83+
task verify:deployment
84+
- name: Show status
85+
if: always()
86+
working-directory: conformance/scenarios/sovereign
87+
run: task status
88+
- name: Cleanup
89+
if: always()
90+
working-directory: conformance/scenarios/sovereign
91+
run: task clean

‎.github/workflows/kubernetes-controller.yml‎

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,6 +107,8 @@ jobs:
107107
name: "Publish Latest Image"
108108
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
109109
runs-on: ubuntu-latest
110+
outputs:
111+
chart_version: ${{ steps.version.outputs.version }}
110112
permissions:
111113
# Needed to push the image to GitHub Packages.
112114
# this token is the repo token, not the user token
@@ -161,4 +163,12 @@ jobs:
161163
- name: Cleanup unused cache
162164
shell: bash
163165
run: |
164-
docker system prune --force
166+
docker system prune --force
167+
168+
conformance:
169+
name: Conformance
170+
needs: publish_latest
171+
uses: ./.github/workflows/conformance.yml
172+
with:
173+
toolkit_image: "ghcr.io/open-component-model/kubernetes/controller/chart:${{ needs.publish_latest.outputs.chart_version }}"
174+
secrets: inherit

‎conformance/README.md‎

Lines changed: 45 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
# OCM Conformance Testing
2+
3+
This directory contains conformance tests and reference scenarios that validate OCM's core capabilities and design principles.
4+
5+
## Purpose
6+
7+
Conformance testing ensures that OCM implementations correctly handle:
8+
9+
- Component modeling and construction
10+
- Signing and verification workflows
11+
- Cross-registry transport and localization
12+
- Air-gap deployment scenarios
13+
- Integration with cloud-native ecosystem tools
14+
15+
## Structure
16+
17+
- `scenarios/` - Reference implementation scenarios that demonstrate end-to-end OCM workflows
18+
- Each scenario includes:
19+
- Complete working implementation
20+
- Conformance test suite
21+
- Documentation and setup instructions
22+
- CI/CD automation
23+
24+
## Current Scenarios
25+
26+
- [`sovereign/`](./scenarios/sovereign) - Demonstrates modeling, signing, transporting, and deploying a multi-service product into an air-gapped sovereign cloud environment (ADR-0013)
27+
28+
## Running Conformance Tests based on a scenario
29+
30+
```bash
31+
cd scenarios/sovereign
32+
task run
33+
```
34+
35+
## Contributing
36+
37+
When adding new conformance scenarios:
38+
39+
1. Create scenario directory under `scenarios/`
40+
2. Include complete working implementation
41+
3. Add conformance test suite in `tests/conformance/`
42+
4. Document setup and validation steps
43+
5. Update this README
44+
45+
Each scenario should validate specific OCM capabilities and serve as a reference implementation for users adopting OCM.

‎conformance/scenarios/sovereign/.gitignore‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
# Build artifacts
2+
transport-archive/
3+
airgap-archive/
4+
*.tar
5+
*.ctf
6+
deploy/notes-oci/
7+
deploy/notes.tar.gz
8+
9+
# Go artifacts
10+
vendor/
11+
*.mod.backup
12+
13+
# Testing artifacts
14+
tests/tmp/
15+
coverage.out
16+
*.test
17+
18+
# IDE files
19+
.vscode/
20+
.idea/
21+
*.swp
22+
*.swo
23+
*~
24+
25+
# OS files
26+
.DS_Store
27+
Thumbs.db
28+
29+
# Temporary files
30+
/tmp/
31+
kind-config.yaml

0 commit comments

Comments
 (0)