Skip to content

Commit 8acf943

Browse files
authored
Merge pull request #299 from Jakob-Naucke/agents
Add CONTRIBUTING.md, AGENTS.md
2 parents 73fdc7a + d7cbc0d commit 8acf943

6 files changed

Lines changed: 110 additions & 2 deletions

File tree

.cursor/rules/project.mdc

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
---
2+
description: Core project conventions -- read AGENTS.md in the project root
3+
alwaysApply: true
4+
---

AGENTS.md

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# Project objective
2+
3+
See [README](./README.md#trusted-execution-cluster-operator-trusted-cluster-operator).
4+
5+
- **Success looks like**: With the operator deployed, all nodes in the cluster are attested from hardware to software.
6+
- **Non-goals**: Rely on OpenShift, see the [confidential-clusters](https://github.com/confidential-clusters/operator) downstream.
7+
8+
# Architecture
9+
10+
- Entry points: see [README](./README.md#repository-structure).
11+
- Integrations
12+
- [Trustee](https://github.com/confidential-containers/trustee)
13+
- The deployment of Trustee should be restart-stable with respect to configurations, reference values, and brokered keys
14+
- [compute-pcrs](https://github.com/trusted-execution-clusters/compute-pcrs)
15+
- [clevis-pin-trustee](https://github.com/latchset/clevis-pin-trustee)
16+
17+
# Conventions
18+
19+
- See [CONTRIBUTING](./CONTRIBUTING.md).
20+
- Use ASCII characters, except where needed for proper nouns
21+
- Never commit real credentials; use env vars and local `.env` (gitignored) with synthetic values in docs.
22+
23+
# Things that human users of agents should do
24+
25+
and agents should suggest when they detect
26+
27+
- Have a coherent goal per session
28+
- Read architecture, security-sensitive paths, performance-critical design, ambiguous product trade-offs
29+
30+
# Things agents should do, but can get wrong
31+
32+
- The operator's crate name is `operator`, test_utils's crate name is `trusted-cluster-operator-test-utils`.
33+
- Use MCPs when available
34+
- Prefer the MCP LSP over `grep`
35+
- Prefer the k8s LSP over `kubectl`.
36+
- Reuse, and check for other uses of a similar pattern. When functionality can be moved out of a function for reuse, commit the generalization before the new use.
37+
- Include lint-compatible code style when writing, not as an afterthought.

CLAUDE.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
AGENTS.md

CONTRIBUTING.md

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
- Use `cargo fmt`. Always perform `make lint clippy` before publishing when code is changed.
2+
- Use an extra binding if this saves more than one (formatted) LOC, e.g.
3+
```rust
4+
let svc = ATTESTATION_KEY_REGISTER_SERVICE;
5+
self.create_certificate(svc, ATT_REG_CERT, ATT_REG_SECRET, issuer_name)
6+
.await?;
7+
```
8+
over
9+
```rust
10+
self.create_certificate(
11+
ATTESTATION_KEY_REGISTER_SERVICE,
12+
ATT_REG_CERT,
13+
ATT_REG_SECRET,
14+
issuer_name,
15+
)
16+
.await?;
17+
```
18+
- Use [REUSE](https://reuse.software) comments for new files, or exclude in [REUSE.toml](./REUSE.toml) when not possible.
19+
- Follow [k8s API conventions](https://github.com/kubernetes/community/blob/main/contributors/devel/sig-architecture/api-conventions.md)
20+
- Use [reflector-backed caches](https://github.com/trusted-execution-clusters/operator/pull/267) where possible
21+
- Add design documents for large features
22+
- When functionality is changed, perform `make test`, and [integration test](./tests/README.md) at least with basic attestation.
23+
- Test with the infrastructure a test needs -- unit with mocked API server, cluster test with a cluster, and attestation test with VMs. Preferably, add a test when
24+
- adding a feature
25+
- fixing a bug, with a test that you verify isolates this bug
26+
- For members
27+
- Set membership to public so GHA runs integration tests without requiring the ok-to-test label
28+
- Merge when you have approval, passing tests, and are happy with your PR.
29+
30+
# Committing
31+
32+
- [Sign commits cryptographically](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---gpg-signkey-id)
33+
- Limit commit subjects to 50 and messages to 72 characters. Leave an empty line between subject and message.
34+
- Add small changes to larger PRs in separate commits to ease review burden, but do not add them to already open PRs
35+
- Commit subjects
36+
- Prepend your commit subject with a short focus area. Omit this when making general operator changes. Examples are `tests`, `tests/azure`, `rvs` (reference values)
37+
- Most subjects should start with a verb in infinitive form, e.g. `Add reference value removal test`
38+
- Explain what you did, and why you did it when it isn't obvious
39+
- Commit trailers
40+
- [Sign off commits](https://git-scm.com/docs/git-commit#Documentation/git-commit.txt---signoff)
41+
- Mark AI use in the commit trailer, such as `Assisted-by: AI`
42+
- Put separate changes in separate commits, but bisects should stay intact
43+
- Linting should pass, so a new definition must be used in the same commit.
44+
- When a change requires a change to a test, the changes should be in the same commit. On the contrary, a larger new test can be in a separate commit for easier review.
45+
46+
# AI use
47+
48+
- Do not raise PRs that you do not understand. Review changes with your own eyes before raising.
49+
- Do not respond to review inquiries with replies that you do not understand
50+
- Nontrivial use of AI must be included in the commit message trailer

README.md

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,14 +10,29 @@ within the cluster.
1010

1111
## Repository Structure
1212

13-
- `/api`: Defines the `TrustedExecutionCluster` Custom Resource Definition (CRD) and associated CRDs and RBAC definitions in Go. Also contains a program to generate a `TrustedExecutionCluster` CR and associated deployment.
13+
The operator relies on Rust crates for its functionality.
14+
15+
### Operator components
16+
1417
- `/operator`: Contains the source code for the Kubernetes operator itself.
1518
- `/register-server`: A server that provides Clevis PINs for key retrieval with random UUIDs.
1619
- `/attestation-key-register`: A server that accepts attestation key registrations from VMs and creates AttestationKey resources.
1720
- `/compute-pcrs`: A program to compute PCR reference values using the [compute-pcrs library](https://github.com/trusted-execution-clusters/compute-pcrs) and insert them into a ConfigMap, run as a Job.
21+
22+
### Other crates
23+
1824
- `/lib`: Shared Rust definitions, including translated CRDs
25+
- `/tests`: Non-unit tests; most rely on a cluster being available. Many of those also rely on a virtualization backend.
26+
- `/test_utils`: Operator setup helpers and virtualization backends
27+
28+
### Other components
29+
30+
- `/docs`, `/examples`
31+
- `/api`: Defines the `TrustedExecutionCluster` Custom Resource Definition (CRD) and associated CRDs and RBAC definitions in Go. Also contains a program to generate a `TrustedExecutionCluster` CR and associated deployment.
1932
- `/scripts`: Helper scripts for managing a local `kind` development cluster.
2033
- `/config`: The default output directory for generated manifests. This directory is not checked into source control.
34+
- `/tools`: Tracking tool versions for autoupdates
35+
- `/must-gather`: for OpenShift CI
2136

2237
## Getting Started
2338

REUSE.toml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,8 @@ version = 1
22

33
[[annotations]]
44
path = [
5-
"README.md",
5+
".cursor/rules/*.mdc",
6+
"*.md",
67
"Cargo.lock",
78
"go.sum",
89
"PROJECT",

0 commit comments

Comments
 (0)