feat(build): register knative Node/TanStack builder#34
Open
nicacioliveira wants to merge 4 commits into
Open
Conversation
Sibling of the cfworkers builder: creates a build Job that runs the generic Node build (DECO_TARGET=node) and uploads a self-contained dist tar to S3 (ArtifactKey), served by the generic node-runner Knative Service. Registered in the BuilderRegistry for spec.serving.type=knative. Additive — cloudflare-worker path unchanged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…pe=knative On a successful build (and idempotently on already-built reconciles), the operator now creates/updates a generic node-runner Knative Service — the net-new capability (previously admin created Knative Services). Renders serving.knative.dev Service: node-runner image, port 8000, revision per commit, env from the CR (SOURCE_ASSET_PATH=ArtifactKey, DECO_SITE_NAME, DECO_ENV_NAME, S3 config, + spec.build.envs). Deco owns the Service (cascade delete). Adds RBAC services:create;update;patch (config + chart). No-op for non-knative serving. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
nicacioliveira
marked this pull request as ready for review
July 22, 2026 18:14
…type alone
Per review: serving.type=knative is the HOSTING framework; it doesn't say the
STACK (deno vs tanstack), and the same hosting runs different stacks. Key the
BuilderRegistry on the (servingType, framework) pair with a framework-agnostic
fallback (cloudflare-worker stays agnostic). knative builds register under
('knative','tanstack'); a future ('knative','deno') is a separate builder. The
Knative Service picks its runner image by framework (RunnerImages map). Keeps
the two dimensions orthogonal instead of collapsing into a 'tanstack-knative' string.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Knative Service runs the runner under a dedicated ServiceAccount (RUNNER_SERVICE_ACCOUNT) annotated with RUNNER_ROLE_ARN (IRSA); the operator ensures that SA exists+annotated in the site namespace. Injects AWS_REGION for aws-cli; no ADMIN_S3_* keys. Read-only S3 identity, least-privilege. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
hugo-ccabral
approved these changes
Jul 23, 2026
Comment on lines
+49
to
+50
| MinScale: atoiOr(os.Getenv("NODE_RUNNER_MIN_SCALE"), 0), | ||
| MaxScale: atoiOr(os.Getenv("NODE_RUNNER_MAX_SCALE"), 5), |
Collaborator
There was a problem hiding this comment.
Lets keep our current definitions?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Register a
knativebuilder in the operator'sBuilderRegistry. Forspec.serving.type=knativeit creates a build Job that runs the generic Node build (DECO_TARGET=node) and uploads a self-containeddisttar to S3 (ArtifactKey), served by the generic node-runner (infra_applications PR #217).Part of the plan (context PR #538). Additive — the
cloudflare-workerpath is unchanged.Files
internal/build/knative.go— sibling ofcfworkers.go; builds the Node build Job (env:DECO_TARGET=node,ARTIFACT_KEY, S3 buckets/region; Pod Identity, no static keys).cmd/main.go— 2-line registration:registry.Register("knative", build.NewKnativeFactory(...)).Compiles (
go build ./internal/build/... ./cmd/...).Remaining (next PRs)
serving.type=knative(port of admincommon/knative/service.ts→ Go + knative serving client-go + RBACservices: create). Not in this PR.Draft — review only, nothing merged/deployed.
Summary by cubic
Adds a
knativeNode/TanStack builder and makes the operator create/update a genericnode-runnerKnative Service per commit to serve the S3-packeddisttar. The runner now uses IRSA via a dedicated ServiceAccount annotated withRUNNER_ROLE_ARN(no static S3 keys).New Features
internal/build/knative.goto run Node builds (DECO_TARGET=node) and upload to S3 withARTIFACT_KEY=ArtifactKey(org, site, commitSha); CR can override builder image/envs/secrets/TTL/nodeSelector/tolerations; uses Pod Identity.serving.knative.devService (genericnode-runner) on successful builds and for already-built sites. One revision per commit; env includesSOURCE_ASSET_PATH,DECO_SITE_NAME,DECO_ENV_NAME,ASSETS_BUCKET,AWS_REGION, and CR envs. Ensures the runner ServiceAccount exists and is IRSA-annotated (RUNNER_ROLE_ARN); runner image selected by framework viaRunnerImages. Deco owns the Service.NODE_RUNNER_IMAGE,S3_ARTIFACTS_BUCKET,S3_REGION,RUNNER_SERVICE_ACCOUNT,RUNNER_ROLE_ARN,NODE_RUNNER_MIN_SCALE,NODE_RUNNER_MAX_SCALE,NODE_RUNNER_PORT,DECO_ENV_NAME. RBAC allows Knative Services create/update/patch and Revisions read. Wired viaregistry.Register("cloudflare-worker", "", ...),registry.Register("knative", "tanstack", ...), andKnativeServingConfigFromEnv().Refactors
(spec.serving.type, spec.framework)with a framework-agnostic fallback; tests updated and errors include the framework.Written for commit b354fba. Summary will update on new commits.