crossplane / function-runtime-oci

WIP: A Composition function that wraps an OCI container

Crossplane is a framework for building cloud native control planes without needing to write code. It has a highly extensible backend that enables you to build a control plane that can orchestrate applications and infrastructure no matter where they run, and a highly configurable frontend that puts you in control of the schema of the declarative API it offers.

Crossplane is a Cloud Native Computing Foundation project.

Get Started

Crossplane's Get Started Docs cover install and cloud provider quickstarts.

Releases

Currently maintained releases, as well as the next few upcoming releases are listed below. For more information take a look at the Crossplane release cycle documentation.

Release	Release Date	EOL
v1.14	Nov 1, 2023	Aug 2024
v1.15	Feb 15, 2024	Nov 2024
v1.16	May 15, 2024	Feb 2025
v1.17	Early Aug '24	May 2025
v1.18	Early Nov '24	Aug 2025
v1.19	Early Feb '25	Nov 2025

You can subscribe to the community calendar to track all release dates, and find the most recent releases on the releases page.

Roadmap

The public roadmap for Crossplane is published as a GitHub project board. Issues added to the roadmap have been triaged and identified as valuable to the community, and therefore a priority for the project that we expect to invest in.

Milestones assigned to any issues in the roadmap are intended to give a sense of overall priority and the expected order of delivery. They should be considered approximate estimations and are not a strict commitment to a specific delivery timeline.

Crossplane Roadmap

Get Involved

Crossplane is a community driven project; we welcome your contribution. To file a bug, suggest an improvement, or request a new feature please open an issue against Crossplane or the relevant provider. Refer to our contributing guide for more information on how you can help.

• Discuss Crossplane on Slack or our developer mailing list.
• Follow us on Twitter or LinkedIn, or subscribe to our newsletter.
• Contact us via Email.
• Join our regular community meetings.
• Provide feedback on our roadmap and releases board.

The Crossplane community meeting takes place every 4 weeks on Thursday at 10:00am Pacific Time. You can find the up to date meeting schedule on the Community Calendar.

Anyone who wants to discuss the direction of the project, design and implementation reviews, or raise general questions with the broader community is encouraged to join.

• Meeting link: https://zoom.us/j/425148449?pwd=NEk4N0tHWGpEazhuam1yR28yWHY5QT09
• Current agenda and past meeting notes
• Past meeting recordings
• Community Calendar

Special Interest Groups (SIG)

Each SIG collaborates in Slack and some groups have regular meetings, you can find the meetings in the Community Calendar.

• #sig-composition-environments
• #sig-composition-functions
• #sig-deletion-ordering
• #sig-devex
• #sig-e2e-testing
• #sig-observability
• #sig-observe-only
• #sig-provider-families
• #sig-secret-stores
• #sig-upjet

Adopters

A list of publicly known users of the Crossplane project can be found in ADOPTERS.md. We encourage all users of Crossplane to add themselves to this list - we want to see the community's growing success!

License

Crossplane is under the Apache 2.0 license.

function-runtime-oci's Issues

XFN Runner: Show STDOUT of failed composition function (exit code >= 1)

What problem are you facing?

We've implemented a function similar to the example functions from docs. If this functions fails, it returns a exit code greater than 0 and prints the error message in STDOUT.

[..] "error": "cannot run Composition Function pipeline: cannot run function \"service-versioning\": cannot run container: rpc error: code = Unknown desc = exit status 1: xfn: error: spark.Command.Run(): OCI runtime error: exit status 1"

Currenty, I cannot debug a composition function that fails to execute. When the function in the OCI container fails, I see the exit code but no additional information printed in STDOUT.

How could Crossplane help solve your problem?

Provide a way to see the STDOUT of functions that failed. That may be behind a flag/option like verbosity level/debug mode, etc.
Perhaps, also STDERR could be used, as it would be the more appropriate place for error messages.

Cannot start function container when container user does not exist within crossplane-xfn container

What happened?

Working on crossplane/crossplane#4261 required creating a custom, but simple function image that labels all managed resources with a given label. My first idea was to use yq for that and the initial Dockerfile was just:

FROM mikefarah/yq:4.34.1

COPY labelizer.sh /bin

ENTRYPOINT ["/bin/labelizer.sh"]

with /bin/labelizer.sh being just:

#!/usr/bin/env sh

yq '(.desired.resources[] | .resource.metadata.labels) |= {"labelizer.xfn.crossplane.io/processed": "true"} + .'

Unfortunately, adding this function to a composition resulted with the following error in crossplane-xfn logs:

cannot compose resources: cannot run Composition Function pipeline: cannot run function "labelizer":
cannot run container: rpc error: code = Unknown desc = exit status 1: xfn: error: spark.Command.Run(): 
cannot create OCI runtime bundle: cannot write OCI runtime spec: cannot create new spec: 
cannot apply spec option: cannot resolve user specified by OCI image config: 
cannot resolve UID of user "yq" that doesn't exist in container's /etc/passwd

Modifying the image to use root to run the script resolved the issue.

How can we reproduce it?

• deploy crossplane with enabled composition functions
• build and publish the function image using files stated above
• create a composition referring that function

What environment did it happen in?

The issue is spotted on the latest master, but I am pretty sure that versions containing composition function feature suffer from the same issue.

Expectations

Function containers should be successfully invoked independently if container user exists within crossplane-xfn container/image. We should even encourage function authors to use some arbitrary high/random UID for function.

Cannot execute OCI images that contain /bin/busybox binary

Bug Report:

When trying to run a function using an OCI Image that contains /bin/busybox, it fails.

Steps to reproduce:

1. Create a function image that contains /bin/busybox, e.g. by using python:3.11-alpine as a base image
2. Execute the function via xfn

cat functionio.yaml | docker run -v $(pwd)/auth.json:/root/.docker/config.json:ro -i --security-opt=seccomp=unconfined crossplane/xfn:v1.13.2 run -c /tmp registry.example/your/image:tag -

This will yield an error:

xfn: error: run.Command.Run(): cannot run function: exit status 1: xfn: error: spark.Command.Run(): cannot create OCI runtime bundle: cannot extract layer tarball: cannot handle tar header for "bin/tar": cannot extract tar header: cannot create symlink: symlink /bin/busybox /tmp/c/319e9a4a-f0a9-46e0-86a1-b887567124b8/rootfs/bin/busybox: file exists

Expected

It executes the function

Additional Infos

FROM python:3.11-alpine AS build
RUN python3 -m venv /venv && \
    /venv/bin/pip install --upgrade pip setuptools wheel

FROM build AS build-venv
COPY requirements.txt /requirements.txt
RUN /venv/bin/pip install --disable-pip-version-check -r /requirements.txt

FROM python:3.11-alpine
COPY --from=build-venv /venv /venv
COPY . /app
WORKDIR /app
ENTRYPOINT ["/venv/bin/python3", "function.py"]

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

• Update actions/checkout digest to a5ac7e5
• Update codecov/codecov-action digest to ab904c4
• Update debian:bookworm-slim Docker digest to 804194b
• Update docker/login-action digest to 0d4c9c5
• Update docker/setup-buildx-action digest to d70bba7
• Update fkirc/skip-duplicate-actions action to v5.3.1
• Update module github.com/cyphar/filepath-securejoin to v0.2.5
• Update module kernel.org/pub/linux/libs/security/libcap/cap to v1.2.70
• Update dependency golangci/golangci-lint to v1.59.0
• Update module github.com/alecthomas/kong to v0.9.0
• Update module github.com/crossplane/crossplane-runtime to v1.16.0
• Update module github.com/google/go-containerregistry to v0.19.1
• Update module github.com/google/uuid to v1.6.0
• Update module github.com/opencontainers/runtime-spec to v1.2.0
• Update module google.golang.org/grpc to v1.64.0
• Update actions/setup-go action to v5
• Update codecov/codecov-action action to v4
• Update golangci/golangci-lint-action action to v6
• Update zeebe-io/backport-action action to v3
• 🔐 Create all rate-limited PRs at once 🔐

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• Update module github.com/docker/docker to v24.0.9+incompatible [SECURITY]
• Update module golang.org/x/crypto to v0.17.0 [SECURITY]
• Update module google.golang.org/protobuf to v1.33.0 [SECURITY]
• Update dependency golang to v1.22.3
• Update module github.com/bufbuild/buf to v1.32.2
• Update module github.com/google/go-cmp to v0.6.0
• Update module golang.org/x/sync to v0.7.0
• Update module golang.org/x/sys to v0.20.0
• Click on this checkbox to rebase all open PRs at once

Detected dependencies

dockerfile

cluster/images/function-runtime-oci/Dockerfile

• debian bookworm-slim@sha256:24c92a69df28b21676d721fe18c0bf64138bfc69b486746ad935b49cc31b0b91

github-actions

.github/workflows/backport.yml

• actions/checkout v4@8ade135a41bc03ea155e62e844d188df1ea18608
• zeebe-io/backport-action v1.4.0@bd68141f079bd036e45ea8149bc9d174d5a04703
• ubuntu 22.04

.github/workflows/ci.yml

• fkirc/skip-duplicate-actions v5.3.0@12aca0a884f6137d619d6a8a09fcc3406ced5281
• actions/checkout v4@8ade135a41bc03ea155e62e844d188df1ea18608
• actions/setup-go v4@93397bea11091df50f3d7e59dc26a7711a8bcfbe
• golangci/golangci-lint-action v3@3a919529898de77ec3da873e3063ca4b10e7f5cc
• actions/checkout v4@8ade135a41bc03ea155e62e844d188df1ea18608
• actions/setup-go v4@93397bea11091df50f3d7e59dc26a7711a8bcfbe
• actions/checkout v4@8ade135a41bc03ea155e62e844d188df1ea18608
• actions/setup-go v4@93397bea11091df50f3d7e59dc26a7711a8bcfbe
• actions/checkout v4@8ade135a41bc03ea155e62e844d188df1ea18608
• actions/setup-go v4@93397bea11091df50f3d7e59dc26a7711a8bcfbe
• codecov/codecov-action v3@eaaf4bedf32dbdc6b720b63067d99c4d77d6047d
• docker/setup-qemu-action v3@68827325e0b33c7199eb31dd4e31fbe9023e06e3
• docker/setup-buildx-action v3@f95db51fddba0c2d1ec667646a06c2ce06100226
• actions/checkout v4@8ade135a41bc03ea155e62e844d188df1ea18608
• actions/setup-go v4@93397bea11091df50f3d7e59dc26a7711a8bcfbe
• docker/login-action v3@343f7c4344506bcbf9b4de18042ae17996df046d
• ubuntu 22.04
• ubuntu 22.04
• ubuntu 22.04
• ubuntu 22.04
• ubuntu 22.04
• ubuntu 22.04

.github/workflows/tag.yml

• actions/checkout v4@8ade135a41bc03ea155e62e844d188df1ea18608
• negz/create-tag v1@39bae1e0932567a58c20dea5a1a0d18358503320
• ubuntu 22.04

gomod

go.mod

• go 1.20
• github.com/Masterminds/semver v1.5.0
• github.com/alecthomas/kong v0.8.0
• github.com/bufbuild/buf v1.26.1
• github.com/crossplane/crossplane-runtime v1.13.0
• github.com/cyphar/filepath-securejoin v0.2.4
• github.com/google/go-cmp v0.5.9
• github.com/google/go-containerregistry v0.16.1
• github.com/google/uuid v1.3.1
• github.com/opencontainers/runtime-spec v1.1.0
• golang.org/x/sync v0.3.0
• golang.org/x/sys v0.12.0
• google.golang.org/grpc v1.58.3
• google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.3.0
• google.golang.org/protobuf v1.31.0
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.69
• github.com/docker/docker v24.0.5+incompatible
• golang.org/x/crypto v0.12.0

regex

.github/workflows/ci.yml

• golang 1.21.2

.github/workflows/ci.yml

• golangci/golangci-lint 1.54.2

Makefile

• golangci/golangci-lint 1.54.2

---

• Check this box to trigger a request for Renovate to run again on this repository

Improve rootless container Function debugging

What problem are you facing?

We've heard from a few folks that it's hard to determine what's going wrong when their Composition Functions don't work. This is an open-ended issue to capture ideas to improve the situation.

How could Crossplane help solve your problem?

Some things to start with:

• Document how to use xfn run and/or docker run to debug a Composition Function in isolation.
• Have Crossplane or xfn print the FunctionIO objects it sees to debug logs.
• Improve the error message returned when the OCI runtime can't run the function binary for some reason (e.g. wrong architecture)

Expose function metrics

Can the functions runtime expose metrics for time spent in function run, and if obtainable memory or cpu used by function run?
If so it would be great if the metrics can be scraped at the crossplane pod port 8080/metrics endpoint.

Knowing this information can help provide a signal for day-2 operations teams about potential performance problems related to custom function code.