Skip to content

Commit 1dbfe9c

Browse files
committed
Add CONTRIBUTING.md, AGENTS.md
and links to those from some tools we use, and some README updates with it Signed-off-by: Jakob Naucke <jnaucke@redhat.com>
1 parent bbd1046 commit 1dbfe9c

6 files changed

Lines changed: 109 additions & 2 deletions

File tree

.cursor/rules/project.mdc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
description: Core project conventions -- read AGENTS.md in the project root
3+
alwaysApply: true
4+
---

AGENTS.md

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# Project objective
2+
3+
See [README](./README.md#trusted-execution-cluster-operator-trusted-cluster-operator).
4+
5+
- **Success looks like**: With the operator deployed, all nodes in the cluster are attested from hardware to software.
6+
- **Non-goals**: Rely on OpenShift, see the [confidential-clusters](https://github.com/confidential-clusters/operator) downstream.
7+
8+
# Architecture
9+
10+
- Entry points: see [README](./README.md#repository-structure).
11+
- Integrations
12+
- [Trustee](https://github.com/confidential-containers/trustee)
13+
- The deployment of Trustee should be restart-stable with respect to configurations, reference values, and brokered keys
14+
- [compute-pcrs](https://github.com/trusted-execution-clusters/compute-pcrs)
15+
- [clevis-pin-trustee](https://github.com/latchset/clevis-pin-trustee)
16+
17+
# Conventions
18+
19+
- See [CONTRIBUTING](./CONTRIBUTING.md).
20+
- Never commit real credentials; use env vars and local `.env` (gitignored) with synthetic values in docs.
21+
22+
# Things that human users of agents should do
23+
24+
and agents should suggest when they detect
25+
26+
- Have a coherent goal per session
27+
- Read architecture, security-sensitive paths, performance-critical design, ambiguous product trade-offs
28+
29+
# Things agents should do, but can get wrong
30+
31+
- The operator's crate name is `operator`, test_utils's crate name is `trusted-cluster-operator-test-utils`.
32+
- Use MCPs when available
33+
- Prefer the MCP LSP over `grep`
34+
- Prefer the k8s LSP over `kubectl`.
35+
- Reuse, and check for other uses of a similar pattern. When functionality can be moved out of a function for reuse, commit the generalization before the new use.
36+
- Include lint-compatible code style when writing, not as an afterthought.

CLAUDE.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
AGENTS.md

CONTRIBUTING.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
- Use `cargo fmt`. Always perform `make lint clippy` before publishing when code is changed.
2+
- Use an extra binding if this saves more than one (formatted) LOC, e.g.
3+
```rust
4+
let svc = ATTESTATION_KEY_REGISTER_SERVICE;
5+
self.create_certificate(svc, ATT_REG_CERT, ATT_REG_SECRET, issuer_name)
6+
.await?;
7+
```
8+
over
9+
```rust
10+
self.create_certificate(
11+
ATTESTATION_KEY_REGISTER_SERVICE,
12+
ATT_REG_CERT,
13+
ATT_REG_SECRET,
14+
issuer_name,
15+
)
16+
.await?;
17+
```
18+
- Use [REUSE](https://reuse.software) comments for new files, or exclude in [REUSE.toml](./REUSE.toml) when not possible.
19+
- Follow [k8s API conventions](https://github.com/kubernetes/community/blob/main/contributors/devel/sig-architecture/api-conventions.md)
20+
- Use [reflector-backed caches](https://github.com/trusted-execution-clusters/operator/pull/267) where possible
21+
- Add design documents for large features
22+
- When functionality is changed, perform `make test`, and [integration test](./tests/README.md) at least with basic attestation.
23+
- Test with the infrastructure a test needs -- unit with mocked API server, cluster test with a cluster, and attestation test with VMs. Preferably, add a test when
24+
- adding a feature
25+
- fixing a bug, with a test that you verify isolates this bug
26+
- For members
27+
- Set membership to public so GHA runs integration tests without requiring the ok-to-test label
28+
- Merge when you have approval, passing tests, and are happy with your PR.
29+
30+
# Committing
31+
32+
- [Sign commits cryptographically](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---gpg-signkey-id)
33+
- Limit commit subjects to 50 and messages to 72 characters. Leave an empty line between subject and message.
34+
- Add small changes to larger PRs in separate commits to ease review burden, but do not add them to already open PRs
35+
- Commit subjects
36+
- Prepend your commit subject with a short focus area. Omit this when making general operator changes. Examples are `tests`, `tests/azure`, `rvs` (reference values)
37+
- Most subjects should start with a verb in infinitive form, e.g. `Add reference value removal test`
38+
- Explain what you did, and why you did it when it isn't obvious
39+
- Commit trailers
40+
- [Sign off commits](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---signoff)
41+
- Do not mark AI use in the commit trailer, but do mark it in the PR description.
42+
- Put separate changes in separate commits, but bisects should stay intact
43+
- Linting should pass, so a new definition must be used in the same commit.
44+
- When a change requires a change to a test, the changes should be in the same commit. On the contrary, a larger new test can be in a separate commit for easier review.
45+
46+
# AI use
47+
48+
- Do not raise PRs that you do not understand. Review changes with your own eyes before raising.
49+
- Do not respond to review inquiries with replies that you do not understand
50+
- Nontrivial use of AI for a PR must be included in the PR description, e.g. "This PR was written in part with the assistance of generative AI". Feel free to also include what you used AI for, however, prompts and model used are not expected due to AI's nondeterminism.

README.md

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,29 @@ within the cluster.
1010

1111
## Repository Structure
1212

13-
- `/api`: Defines the `TrustedExecutionCluster` Custom Resource Definition (CRD) and associated CRDs and RBAC definitions in Go. Also contains a program to generate a `TrustedExecutionCluster` CR and associated deployment.
13+
The operator relies on Rust crates for its functionality.
14+
15+
### Operator components
16+
1417
- `/operator`: Contains the source code for the Kubernetes operator itself.
1518
- `/register-server`: A server that provides Clevis PINs for key retrieval with random UUIDs.
1619
- `/attestation-key-register`: A server that accepts attestation key registrations from VMs and creates AttestationKey resources.
1720
- `/compute-pcrs`: A program to compute PCR reference values using the [compute-pcrs library](https://github.com/trusted-execution-clusters/compute-pcrs) and insert them into a ConfigMap, run as a Job.
21+
22+
### Other crates
23+
1824
- `/lib`: Shared Rust definitions, including translated CRDs
25+
- `/tests`: Non-unit tests; most rely on a cluster being available. Many of those also rely on a virtualization backend.
26+
- `/test_utils`: Operator setup helpers and virtualization backends
27+
28+
### Other components
29+
30+
- `/docs`, `/examples`
31+
- `/api`: Defines the `TrustedExecutionCluster` Custom Resource Definition (CRD) and associated CRDs and RBAC definitions in Go. Also contains a program to generate a `TrustedExecutionCluster` CR and associated deployment.
1932
- `/scripts`: Helper scripts for managing a local `kind` development cluster.
2033
- `/config`: The default output directory for generated manifests. This directory is not checked into source control.
34+
- `/tools`: Tracking tool versions for autoupdates
35+
- `/must-gather`: for OpenShift CI
2136

2237
## Getting Started
2338

REUSE.toml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@ version = 1
22

33
[[annotations]]
44
path = [
5-
"README.md",
5+
".cursor/rules/*.mdc",
6+
"*.md",
67
"Cargo.lock",
78
"go.sum",
89
"PROJECT",

0 commit comments

Comments
 (0)