Skip to content

Commit 625e1a8

Browse files
kate-goldenringkate-goldenring
committed
feat(crd): add multi-platform fetchStrategy with per-node artifact resolution
Extend the Shim CRD's fetchStrategy to support multi-platform artifact fetching. A single Shim resource can now target mixed-architecture clusters (e.g., amd64 + arm64) by specifying per-OS/arch artifact URLs with optional SHA-256 verification. Changes: - Add `platforms[]` field to fetchStrategy with os, arch, location, and optional sha256 per entry - Add CRD enum validation for os (linux) and arch (amd64, arm64, x86_64, aarch64) - Add `resolveArtifactForNode()` controller logic to select the correct artifact per node based on node.Status.NodeInfo - Support both Go-style (amd64) and uname-style (x86_64) arch names via normalizeArch() - Add SHA-256 verification to the downloader init container script - Retain deprecated `type` and optional `anonHttp` fields for backward compatibility with existing manifests - Consolidate per-arch sample Shim files into single multi-platform CRs - Add design proposal document Inspired by the Krew plugin manager's per-platform artifact pattern. Co-authored with Copilot using Opus 4.6. Signed-off-by: Kate Goldenring <kate.goldenring@fermyon.com>
1 parent 8d4efc8 commit 625e1a8

19 files changed

Lines changed: 842 additions & 109 deletions

‎.github/workflows/helm-chart-node-scaling-test.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -108,9 +108,6 @@ jobs:
108108
109109
- name: apply Spin shim
110110
run: |
111-
# Ensure shim binary is compatible with runner arch
112-
yq -i '.spec.fetchStrategy.anonHttp.location = "https://github.com/spinkube/containerd-shim-spin/releases/download/${{ env.SHIM_SPIN_VERSION }}/containerd-shim-spin-v2-linux-x86_64.tar.gz"' \
113-
config/samples/test_shim_spin.yaml
114111
kubectl apply -f config/samples/test_shim_spin.yaml
115112
116113
- name: verify shim is installed into one node

‎.github/workflows/helm-chart-smoketest.yml‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -163,9 +163,6 @@ jobs:
163163
# as there is a known bug that MicroK8s containerd does not pass the options
164164
yq -i 'del(.spec.containerdRuntimeOptions)' $shim_file
165165
fi
166-
# Ensure shim binary is compatible with runner arch
167-
yq -i '.spec.fetchStrategy.anonHttp.location = "https://github.com/spinframework/containerd-shim-spin/releases/download/${{ env.SHIM_SPIN_VERSION }}/containerd-shim-spin-v2-linux-x86_64.tar.gz"' \
168-
$shim_file
169166
kubectl apply -f $shim_file
170167
171168
- name: label nodes

‎api/v1alpha1/shim_types.go‎

Lines changed: 37 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,14 +32,49 @@ type ShimSpec struct {
3232
}
3333

3434
type FetchStrategy struct {
35-
Type string `json:"type"`
36-
AnonHTTP AnonHTTPSpec `json:"anonHttp"`
35+
// Type is the fetch strategy type.
36+
//
37+
// Deprecated: this field is ignored by the controller and exists only
38+
// for backward compatibility with existing manifests that specify it.
39+
//
40+
// +optional
41+
Type string `json:"type,omitempty"`
42+
43+
// AnonHTTP fetches a binary from a public HTTP(S) URL.
44+
// For backward compatibility with single-architecture deployments.
45+
// When Platforms is also specified, Platforms takes precedence.
46+
// +optional
47+
AnonHTTP *AnonHTTPSpec `json:"anonHttp,omitempty"`
48+
49+
// Platforms lists per-OS/architecture artifact sources.
50+
// The controller selects the matching entry for each target node.
51+
// When specified, this takes precedence over AnonHTTP.
52+
// +optional
53+
Platforms []PlatformArtifact `json:"platforms,omitempty"`
3754
}
3855

56+
// AnonHTTPSpec defines a simple anonymous HTTP fetch (single URL, single architecture).
3957
type AnonHTTPSpec struct {
58+
// Location is the direct URL to the artifact archive.
4059
Location string `json:"location"`
4160
}
4261

62+
// PlatformArtifact maps a specific OS/Arch pair to an artifact URL.
63+
type PlatformArtifact struct {
64+
// OS is the operating system. Currently only "Linux" is supported.
65+
// +kubebuilder:validation:Enum=linux
66+
OS string `json:"os"`
67+
// Arch is the CPU architecture.
68+
// Accepts Go-style ("amd64", "arm64") or uname-style ("x86_64", "aarch64").
69+
// +kubebuilder:validation:Enum=amd64;arm64;x86_64;aarch64
70+
Arch string `json:"arch"`
71+
// Location is the URL to the artifact archive for this platform. Must be publicly accessible.
72+
Location string `json:"location"`
73+
// SHA256 is the optional hex-encoded SHA-256 digest for verification.
74+
// +optional
75+
SHA256 string `json:"sha256,omitempty"`
76+
}
77+
4378
type RuntimeClassSpec struct {
4479
Name string `json:"name"`
4580
Handler string `json:"handler"`

‎api/v1alpha1/zz_generated.deepcopy.go‎

Lines changed: 26 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎config/crd/bases/runtime.spinkube.dev_shims.yaml‎

Lines changed: 47 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -59,17 +59,61 @@ spec:
5959
fetchStrategy:
6060
properties:
6161
anonHttp:
62+
description: |-
63+
AnonHTTP fetches a binary from a public HTTP(S) URL.
64+
For backward compatibility with single-architecture deployments.
65+
When Platforms is also specified, Platforms takes precedence.
6266
properties:
6367
location:
68+
description: Location is the direct URL to the artifact archive.
6469
type: string
6570
required:
6671
- location
6772
type: object
73+
platforms:
74+
description: |-
75+
Platforms lists per-OS/architecture artifact sources.
76+
The controller selects the matching entry for each target node.
77+
When specified, this takes precedence over AnonHTTP.
78+
items:
79+
description: PlatformArtifact maps a specific OS/Arch pair to
80+
an artifact URL.
81+
properties:
82+
arch:
83+
description: |-
84+
Arch is the CPU architecture.
85+
Accepts Go-style ("amd64", "arm64") or uname-style ("x86_64", "aarch64").
86+
enum:
87+
- amd64
88+
- arm64
89+
- x86_64
90+
- aarch64
91+
type: string
92+
location:
93+
description: Location is the URL to the artifact archive
94+
for this platform.
95+
type: string
96+
os:
97+
description: OS is the operating system.
98+
enum:
99+
- linux
100+
type: string
101+
sha256:
102+
description: SHA256 is the optional hex-encoded SHA-256
103+
digest for verification.
104+
type: string
105+
required:
106+
- arch
107+
- location
108+
- os
109+
type: object
110+
type: array
68111
type:
112+
description: |-
113+
Type is the fetch strategy type.
114+
Deprecated: this field is ignored by the controller and exists only
115+
for backward compatibility with existing manifests that specify it.
69116
type: string
70-
required:
71-
- anonHttp
72-
- type
73117
type: object
74118
nodeSelector:
75119
additionalProperties:

‎config/samples/kustomization.yaml‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,6 @@ resources:
44
- test_shim_slight.yaml
55
- test_shim_spin.yaml
66
- test_shim_wws.yaml
7-
- sample_shim_spin_x86_64.yaml
8-
- sample_shim_spin_aarch64.yaml
9-
- sample_shim_wasmtime_x86_64.yaml
10-
- sample_shim_wasmtime_aarch64.yaml
7+
- sample_shim_spin.yaml
8+
- sample_shim_wasmtime.yaml
119
#+kubebuilder:scaffold:manifestskustomizesamples

config/samples/sample_shim_spin_aarch64.yaml renamed to config/samples/sample_shim_spin.yaml

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,15 @@ spec:
1313
spin: "true"
1414

1515
fetchStrategy:
16-
type: anonymousHttp
17-
anonHttp:
18-
location: "https://github.com/spinframework/containerd-shim-spin/releases/download/v0.22.0/containerd-shim-spin-v2-linux-aarch64.tar.gz"
16+
platforms:
17+
- os: linux
18+
arch: aarch64
19+
location: "https://github.com/spinframework/containerd-shim-spin/releases/download/v0.22.0/containerd-shim-spin-v2-linux-aarch64.tar.gz"
20+
sha256: "5fde86c310b8b8ef4c1b19a04eece203f4c308f6fb42bfae3babd99d4c04006b"
21+
- os: linux
22+
arch: x86_64
23+
location: "https://github.com/spinframework/containerd-shim-spin/releases/download/v0.22.0/containerd-shim-spin-v2-linux-x86_64.tar.gz"
24+
sha256: "adeb94339c673f09cffe8c45c04f9b18d410f9375d1570b6d1939758b507d257"
1925

2026
# Each runtime can provide a set of containerd runtime options to be set in the containerd
2127
# configuration file.

‎config/samples/sample_shim_spin_x86_64.yaml‎

Lines changed: 0 additions & 34 deletions
This file was deleted.

config/samples/sample_shim_wasmtime_aarch64.yaml renamed to config/samples/sample_shim_wasmtime.yaml

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -13,9 +13,13 @@ spec:
1313
wasmtime: "true"
1414

1515
fetchStrategy:
16-
type: anonymousHttp
17-
anonHttp:
18-
location: "https://github.com/containerd/runwasi/releases/download/containerd-shim-wasmtime%2Fv0.6.0/containerd-shim-wasmtime-aarch64-linux-musl.tar.gz"
16+
platforms:
17+
- os: linux
18+
arch: aarch64
19+
location: "https://github.com/containerd/runwasi/releases/download/containerd-shim-wasmtime%2Fv0.6.0/containerd-shim-wasmtime-aarch64-linux-musl.tar.gz"
20+
- os: linux
21+
arch: x86_64
22+
location: "https://github.com/containerd/runwasi/releases/download/containerd-shim-wasmtime%2Fv0.6.0/containerd-shim-wasmtime-x86_64-linux-musl.tar.gz"
1923

2024
runtimeClass:
2125
name: wasmtime-v1

‎config/samples/sample_shim_wasmtime_x86_64.yaml‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

0 commit comments

Comments
 (0)