compiler: claude can we have a kubernetes reporter #3

pro-wh · 2026-01-22T00:58:15Z

new --kubernetes <output dir> writes a directory of kubernetes config files and a kustomization.yaml. use kubectl apply -k <ouptut_dir> to put up the scenario
adds serde_yaml crate, although that's said to be unmaintained. for comparison, docker compose reporter does its own yaml stunts using string operations
adds a 'resources.rs' file with structures divined by LLM knowledge of kubernetes 😬
for "runtime" values in top level config, it gives you a root-config.env file, e.g.
```
# Root config values - fill in values before deploying
AMBER_CONFIG_API_KEY=
```
and kustomize generates an amber-root-config ConfigMap out of it
deployments put those amber-root-config values into places OR use the amber-compose-helper to exec a program with string interpolations using those values
amber-helper mounted into containers similar to docker-compose, an initContainer copies it from an image to a volume
now that amber-compose-helper is used in multiple reporters, it's renamed to amber-helper
bindings are encoded into NetworkPolicy objects, so other connections are not allowed
on startup, a special set of deployments + services + network policy check that NetworkPolicy can actually block
the actual scenario deployments use an initContainer to check if the network policy test succeeded

pro-wh · 2026-01-22T19:14:16Z

ERROR: failed to build: invalid tag "ghcr.io/RDI-Foundation/amber-cli:ca7393a147b96a61d9dd136b1892056fc4d7daf8-amd64": repository name must be lowercase

holy

pro-wh · 2026-01-22T19:18:12Z

cli/src/main.rs

+    // Clean and recreate the output directory.
+    if root.exists() {
+        if root.is_dir() {
+            std::fs::remove_dir_all(root)


not sure if want

like it's not too bad in theory, but the .env files kind of invite you to edit them so

yeah, maybe let's make people rm -rf <whatever> && amber --k8s <whatever>. not that bad compared to overwriting a .env, which can be really annoying

cli/src/main.rs

compiler/src/reporter/kubernetes/mod.rs

nhynes

looks mostly reasonable. we should strongly consider whether it makes sense to include the cni checker which is more weighty than anticipated. an ignored rust test that exercises the new reporter in KinD and runs in CI would be cool. also a hoisting and cleanup pass. I'll run this through codex for completeness

nhynes · 2026-01-24T06:21:43Z

cli/src/main.rs

+    #[arg(long = "disable-networkpolicy-check", requires = "kubernetes")]
+    disable_networkpolicy_check: bool,


Interesting. So far I haven't had a good answer for how to add reporter-specific args. Thanks for making a movement on that.

thanks claude

nhynes · 2026-01-24T06:26:29Z

cli/src/main.rs

+    // Clean and recreate the output directory.
+    if root.exists() {
+        if root.is_dir() {
+            std::fs::remove_dir_all(root)


yeah, maybe let's make people rm -rf <whatever> && amber --k8s <whatever>. not that bad compared to overwriting a .env, which can be really annoying

nhynes · 2026-01-24T06:29:56Z

compiler/src/reporter/kubernetes/mod.rs

+            .collect::<Vec<_>>()
+            .join(" -> ");
+        return Err(ReporterError::new(format!(
+            "kubernetes reporter requires an acyclic dependency graph (ignoring weak bindings). \


I wonder if this error shouldn't be some non-string error or something since the compose reporter also prefers acyclic. I also wonder if not all scenarios should be required to be acyclic, hoisting the check to scenario construction (linking) time.

give specific error variant: ok;
non-string: 🤷 ;
hoist check: in favor;
hoist check to link time: maybe, if all possible amber use cases need it;
are all amber scenarios acyclic: can't commit to this, although workaround if you need a cycle is to deploy a socket wrapper to connect in the opposite direction in your containers

compiler/src/reporter/kubernetes/mod.rs

nhynes · 2026-01-24T07:20:58Z

compiler/src/reporter/kubernetes/mod.rs

+    Ok(endpoint.port)
+}
+
+fn compose_templates_dfs(


blatant plagiarism

gonna add you as Co-authored-by

nhynes · 2026-01-24T07:21:48Z

compiler/src/reporter/kubernetes/mod.rs

+
+/// Try to resolve a config query against a composed template.
+/// Returns Static if the value is fully resolved, Runtime if it contains config refs.
+fn resolve_config_query_for_program(


This PR could use a pass to collect all of the shared code into one place. I can nominate myself for that

yes, wanna try?

nhynes · 2026-01-24T07:23:28Z

compiler/src/reporter/kubernetes/mod.rs

+/// - Phase 1: Try to connect to allowed server. If this fails, networking is broken - exit with error.
+/// - Phase 2: Try to connect to blocked server. If this succeeds, NetworkPolicy isn't enforced - exit with error.
+/// - Success: Both checks pass, stay alive.
+fn generate_netpol_enforcement_check(


I wonder if we really care that much that we would add 300 lines of code for it. This should be replaced at some point by L7 enforcement, so maybe we don't bother

ya shall we just get rid of all this

nhynes · 2026-01-24T07:26:36Z

compiler/Cargo.toml

 miette = { workspace = true, features = ["derive"] }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
+serde_yaml = { workspace = true }


controversial opinion: yaml is a superset of json. write out json instead of bringing in yaml

nhynes · 2026-01-24T07:26:54Z

compiler/README.md

 - `linker`: schema validation, binding resolution, and export verification.
 - `passes`: graph rewrites that must preserve scenario invariants.
- `reporter`: transforms `CompileOutput` into artifacts (e.g., scenario IR JSON, DOT, Docker Compose YAML).
+- `reporter`: transforms `CompileOutput` into artifacts (e.g., scenario IR JSON, DOT, Docker Compose YAML, Kubernetes YAML).


and then leave it described as kubernetes YAML to mess with people

nah on labeling it as yaml 😆

nhynes · 2026-01-24T07:36:46Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: da969e8784

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

compiler/src/reporter/kubernetes/mod.rs

nhynes · 2026-01-25T06:08:33Z

Vague suggestion: docker-compose and k8s work in much the same way with programs and sidecars being turned into a "workload" and then rendered. There's a lot of duplicated code to prove this point. Would it be valuable to move the shared logic into one or more compose+k8s passes so that they can both be thin renderers on top of the same postprocessed IR? If you don't think that makes sense to put in this PR, I'm happy to try a refactoring pass after it's in.

pro-wh · 2026-01-26T20:06:58Z

ya leme try to get this stuff settled before drying

Co-authored-by: Nick Hynes <nhynes@nhynes.com>

pro-wh · 2026-01-26T22:33:39Z

big things not yet undertaken by myself:

hoist/dry against docker compose reporter
json output instead of yaml
remove network policy check
error variant for cyclic component-binding graph

pro-wh · 2026-01-27T23:35:52Z

can I merge this

nhynes · 2026-01-28T05:58:08Z

can I merge this

does it work?

an ignored rust test that exercises the new reporter in KinD and runs in CI would be cool

s/would be cool/is a prerequisite for merging/. that's on me

pro-wh · 2026-01-28T07:47:23Z

oh yeah gotta add that

…

On Tue, Jan 27, 2026, 9:58 PM Nick Hynes ***@***.***> wrote: *nhynes* left a comment (RDI-Foundation/amber#3) <#3 (comment)> can I merge this does it work? I can't find a KinD test — Reply to this email directly, view it on GitHub <#3 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJDVILW3IIUQMLSD2BFT7RT4JBFYNAVCNFSM6AAAAACSPFYLO2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZTQMBZGE3DCOJVGE> . You are receiving this because you authored the thread.Message ID: ***@***.***>

-- Disclaimer: This e-mail and any attachments may contain confidential information. If you are not the intended recipient, any disclosure, copying, distribution or use of any information contained herein is strictly prohibited. If you have received this transmission in error, please immediately notify the sender and destroy the original transmission and any attachments without reading or saving.

pro-wh · 2026-01-28T20:53:26Z

adding e2e test for kubernetes reporter with KinD. dunno how to do it as a rust test

pro-wh · 2026-01-28T21:29:25Z

passes on ci, can I merge this

pro-wh · 2026-01-29T02:26:27Z

thanks, "squash and merge" ing