verifa / horizon Goto Github PK

Objects will not just be created. They will likely be mutated afterwards.

Hence it makes a lot of sense that creating an object also uses server-side apply managed fields.

Create an Account watcher that automatically provisions default Roles and RoleBindings for that account.

This could be part of some "tutorials" or something.

In the Greetings demo, the extension link results in 404 error because the file doesn't exist.

Currently the store does not check whether an accounts exists or not when creating objects.

Something similar to Terraform's lifecycle prevent destroy, to add an extra layer of protection for critical objects.

https://developer.hashicorp.com/terraform/tutorials/state/resource-lifecycle#prevent-resource-deletion

Writing reconcile logic always requires serious head scratching. In some cases, you simply want to separate the Create from the Update from the Delete.

It would be possible to provide some basic construct for doing Create/Update/Delete operations on objects, as an alternative to a Reconciler.

How this could work requires some thought.

The greetings example does not have an HTTP handler. Add one.

nice system architecture with Cue and NATS. Kind of perfect light system

htmx or htmz based GUI would be nice. If you have a Issue / Epic for it I can take a shot at it.

htmz is an iframe hack: https://github.com/Kalabasa/htmz

Right now the reconcile loop happens in a Go routine, and there is nothing to block and wait for it to finish.

Reconcile loops do important stuff, so we should sit and wait for them to finish.

Implement something like a sync.WaitGroup in the ctlr.Stop() method, or similar.

We can get some inspiration from Kubernetes admission webhooks:

https://book.kubebuilder.io/cronjob-tutorial/webhook-implementation

Hey @jlarfors

Just had some more time to spend on this.

Getting stuck with NATS startup. Its trying to startup an embedded NATS Jetstream Server by default ?

I was wanting to point it to a NATS Cluster to try out some things.

I am latest main version btw...

horizon % go run ./cmd/ci/ci.go -generate
📝 generating files
2024/06/29 13:41:43 INFO exec cmd="/opt/homebrew/opt/go/libexec/bin/go run -mod=readonly github.com/a-h/templ/cmd/templ generate"
Processing path: /Users/apple/workspace/go/src/github.com/gedw99/horizon
Generating production code: /Users/apple/workspace/go/src/github.com/gedw99/horizon
(✓) Generated code for "/Users/apple/workspace/go/src/github.com/gedw99/horizon/pkg/hzctl/login/login.templ" in 3.007208ms
(✓) Generated code for "/Users/apple/workspace/go/src/github.com/gedw99/horizon/examples/greetings/portal.templ" in 6.532625ms
(✓) Generated code for "/Users/apple/workspace/go/src/github.com/gedw99/horizon/pkg/gateway/icons.templ" in 4.710875ms
(✓) Generated code for "/Users/apple/workspace/go/src/github.com/gedw99/horizon/pkg/gateway/gateway.templ" in 5.247709ms
(✓) Generated code for "/Users/apple/workspace/go/src/github.com/gedw99/horizon/pkg/gateway/accounts.templ" in 7.058834ms
(✓) Generated code for 5 templates with 0 errors in 9.832166ms
2024/06/29 13:41:44 INFO done cmd="/opt/homebrew/opt/go/libexec/bin/go run -mod=readonly github.com/a-h/templ/cmd/templ generate"
✅ content generated



apple@192 horizon % go run ./cmd/horizon/horizon.go
NATS DIR:  /var/folders/pj/n3sth0z55md7lydld97r8mmh0000gn/T/horizon
horizon.go:15: ERROR horizon server failed error="starting server: starting nats server: server not ready after 4s"
exit status 1

# Wish there was more info for Help :)
go run ./cmd/horizon/horizon.go -h 

If the auth package supported a Roles(...) method to get the list of roles for a user (e.g. based on groups and role bindings) this could be attached to the UserInfo and used by a web UI to hide/show elements, for example.

This is fairly straightforward to implement, but the implications on server-side apply and managed fields needs to be carefully considered.

E.g. if a user applies an object (therefore managing those fields), if the mutator then adds some fields, who owns those fields?

Return an operation result from an apply, such as: Updated, Created, NoChange, Conflict.

Currently Account sensitive information, like NATS NKeys for creating users, is stored directly in the Account.status.

Move this to a secret, a bit like Kubernetes ServiceAccounts work.