KEP-4944: Kustomize Wasm Plugin #4946

koba1t · 2024-11-04T18:09:12Z

One-line PR description: Kustomize Wasm Plugin

Issue link: Kustomize Wasm Plugin #4944

Other comments:

k8s-ci-robot · 2024-11-04T18:09:15Z

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

k8s-triage-robot · 2025-03-11T16:47:01Z

The Kubernetes project currently lacks enough contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle stale
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

k8s-triage-robot · 2025-04-10T16:47:33Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Mark this PR as fresh with /remove-lifecycle rotten
Close this PR with /close
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

k8s-triage-robot · 2025-05-10T17:37:20Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Reopen this PR with /reopen
Mark this PR as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

k8s-ci-robot · 2025-05-10T17:37:25Z

@k8s-triage-robot: Closed this PR.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Reopen this PR with /reopen

Mark this PR as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

koba1t · 2025-05-11T15:43:52Z

/reopen

k8s-ci-robot · 2025-05-11T15:43:57Z

@koba1t: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

k8s-ci-robot · 2025-05-11T15:44:03Z

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: koba1t
Once this PR has been reviewed and has the lgtm label, please assign ardaguclu for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

keps/sig-cli/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-triage-robot · 2025-06-10T15:49:14Z

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied
After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Reopen this PR with /reopen
Mark this PR as fresh with /remove-lifecycle rotten
Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

k8s-ci-robot · 2025-06-10T15:49:20Z

@k8s-triage-robot: Closed this PR.

In response to this:

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages PRs according to the following rules:

After 90d of inactivity, lifecycle/stale is applied

After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied

After 30d of inactivity since lifecycle/rotten was applied, the PR is closed

You can:

Reopen this PR with /reopen

Mark this PR as fresh with /remove-lifecycle rotten

Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

koba1t · 2025-06-16T00:46:11Z

/reopen

k8s-ci-robot · 2025-06-16T00:46:17Z

@koba1t: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

soltysh · 2025-06-26T08:53:06Z

keps/sig-cli/4944-kustomize-wasm-plugin/README.md

+isolation.
+
+And promote kustomize KRM plugins to GA with the addition and stability of Wasm
+KRM Function.


There's #2953 which was targetting krm graduation. I think, it's best to split the graduation from wasm plugins.

The one question I have is how you're planning to handle the relationship between wasm plugins and krm plugins? Wasm will be alpha and KRM GA?

keps/sig-cli/4944-kustomize-wasm-plugin/README.md

soltysh · 2025-06-26T08:58:42Z

keps/sig-cli/4944-kustomize-wasm-plugin/README.md

+1. The Wasm OCI Artifact specification is a relatively new standard in the OCI
+   ecosystem. Maybe not mature enough.
+1. Containaized KRM function is alpha feature but that used some user.
+   - Provide container to exec conversion tools.


Not sure I understand how this is a risk. I believe you've mentioned earlier (and I also suggested to split this out) to promote KRM functions to GA, so the only risk is that we haven't done it yet and we have users relying on it, right?

keps/sig-cli/4944-kustomize-wasm-plugin/README.md

soltysh · 2025-06-26T09:05:59Z

keps/sig-cli/4944-kustomize-wasm-plugin/README.md

+        image: ghcr.io/koba1t/krm-fn-app:v0.0.3-wasm
+spec:
+  port: 8080
+```


I'm not sure I follow, what the above files are meant for.

soltysh · 2025-06-26T09:10:29Z

keps/sig-cli/4944-kustomize-wasm-plugin/README.md

+implementing this enhancement to ensure the enhancements have also solid foundations.
+-->
+
+##### Unit tests


For kustomize, I'm certain we can just skip interrogation and e2e tests, but listing units would be reasonable.
Something like:

- sigs.k8s.io/kustomize/kustomize/v5/commands/build - 2025-06-01 - 79.4 - sigs.k8s.io/kustomize/kustomize/v5/commands/create - 2025-06-26 - 84.9 etc...

Just make sure to list only the directories you'll be modifying as part of this functionality. There's no need to list all of them 😉

soltysh · 2025-06-26T09:11:59Z

keps/sig-cli/4944-kustomize-wasm-plugin/README.md

+
+Below are some examples to consider, in addition to the aforementioned [maturity levels][maturity-levels].
+
+#### Alpha


Clear graduation criteria will be needed. In the risks section you've mentioned that WASI is still not fully stable, is there a plan when it will be? Should we block GA promotion of this functionality until it does?

soltysh · 2025-06-26T09:12:58Z

keps/sig-cli/4944-kustomize-wasm-plugin/kep.yaml

+  stable: TBD
+# # The following PRR answers are required at alpha release
+# # List the feature gate name and the components for which it must be enabled
+# feature-gates:


Are you planning on gating the access to this functionality through an environment variable, like we do with kubectl or in any other way?

soltysh · 2025-06-26T09:14:20Z

keps/sig-cli/4944-kustomize-wasm-plugin/README.md

+1. Implement Wasm plugin support in the Kustomize KRM framework
+1. Provide a secure sandboxed environment for executing custom transformations
+1. Improve portability of custom transformers across different platforms
+1. Enhance performance of resource transformations through WebAssembly


Nowhere in this document there's a clear information how this new mechanism will affect the kustomize version that is available in kubectl? IIRC the KRM functions are NOT available in kubectl, so I believe this one is also not going to be available, is that right assumption?

Honesty, Exec KRM functions is disabled by kubectl, but the Container KRM functions is available for kustomize in kubectl now.
(We can use with kubectl kustomize --enable-alpha-plugins ...)
kubernetes-sigs/kustomize#4556 (comment)

According to my understanding, the Exec KRM functions mechanism, which directly executes binaries, raises security concerns and was disabled in kubectl. With the Wasm Plugin, since the execution environment is sandboxed, I thought it seemed reasonable to make it available in the same way as current Container functions.

Co-authored-by: Maciej Szulik <[email protected]>

k8s-ci-robot · 2025-06-26T21:20:36Z

@koba1t: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
pull-enhancements-test	`662e1a8`	link	true	`/test pull-enhancements-test`
pull-enhancements-verify	`662e1a8`	link	true	`/test pull-enhancements-verify`

Full PR test history. Your PR dashboard. Please help us cut down on flakes by linking to an open issue when you hit one in your PR.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.

k8s-ci-robot added do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Nov 4, 2024

k8s-ci-robot requested review from ardaguclu and soltysh November 4, 2024 18:09

k8s-ci-robot added kind/kep Categorizes KEP tracking issues and PRs modifying the KEP directory sig/cli Categorizes an issue or PR as relevant to SIG CLI. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Nov 4, 2024

koba1t mentioned this pull request Nov 4, 2024

Kustomize Wasm Plugin #4944

Open

4 tasks

koba1t force-pushed the kep/kustomize_add_wasm_plugin branch 4 times, most recently from 936ebc5 to 82b898a Compare November 12, 2024 01:08

proposal/kustomize_wasm_plugin

fb77246

koba1t force-pushed the kep/kustomize_add_wasm_plugin branch from 82b898a to fb77246 Compare November 12, 2024 01:13

add design details

55d257e

koba1t marked this pull request as ready for review December 11, 2024 16:24

k8s-ci-robot removed the do-not-merge/work-in-progress Indicates that a PR should not merge because it is a work in progress. label Dec 11, 2024

k8s-ci-robot requested a review from mpuckett159 December 11, 2024 16:24

k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Mar 11, 2025

k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Apr 10, 2025

k8s-ci-robot closed this May 10, 2025

github-project-automation bot moved this from Needs Triage to Closed in SIG CLI May 10, 2025

k8s-ci-robot reopened this May 11, 2025

github-project-automation bot moved this from Closed to In Progress in SIG CLI May 11, 2025

k8s-ci-robot closed this Jun 10, 2025

github-project-automation bot moved this from In Progress to Closed in SIG CLI Jun 10, 2025

k8s-ci-robot reopened this Jun 16, 2025

github-project-automation bot moved this from Closed to In Progress in SIG CLI Jun 16, 2025

soltysh mentioned this pull request Jun 26, 2025

Kustomize Plugin Graduation #2953

Closed

4 tasks

soltysh reviewed Jun 26, 2025

View reviewed changes

koba1t and others added 3 commits June 27, 2025 06:16

Update keps/sig-cli/4944-kustomize-wasm-plugin/README.md

29938e9

Co-authored-by: Maciej Szulik <[email protected]>

Update keps/sig-cli/4944-kustomize-wasm-plugin/README.md

6c70331

Co-authored-by: Maciej Szulik <[email protected]>

Update keps/sig-cli/4944-kustomize-wasm-plugin/README.md

662e1a8

Co-authored-by: Maciej Szulik <[email protected]>


		Below are some examples to consider, in addition to the aforementioned [maturity levels][maturity-levels].

		#### Alpha

KEP-4944: Kustomize Wasm Plugin #4946

Are you sure you want to change the base?

KEP-4944: Kustomize Wasm Plugin #4946

Uh oh!

Conversation

koba1t commented Nov 4, 2024

Uh oh!

k8s-ci-robot commented Nov 4, 2024

Uh oh!

k8s-triage-robot commented Mar 11, 2025

Uh oh!

k8s-triage-robot commented Apr 10, 2025

Uh oh!

k8s-triage-robot commented May 10, 2025

Uh oh!

k8s-ci-robot commented May 10, 2025

Uh oh!

koba1t commented May 11, 2025

Uh oh!

k8s-ci-robot commented May 11, 2025

Uh oh!

k8s-ci-robot commented May 11, 2025

Uh oh!

k8s-triage-robot commented Jun 10, 2025

Uh oh!

k8s-ci-robot commented Jun 10, 2025

Uh oh!

koba1t commented Jun 16, 2025

Uh oh!

k8s-ci-robot commented Jun 16, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

k8s-ci-robot commented Jun 26, 2025

Uh oh!

Uh oh!