Crossplane Renderer & Validator

Crossplane Renderer & Validator

When This Skill Activates

This skill automatically activates when:

• Rendering Crossplane compositions for testing
• Validating composition security and policies
• Previewing resources before deployment
• User mentions "render", "crossplane", "polaris", "validate", "security"
• Testing composition changes during development
• Debugging composition issues

Relationship with KCL Validator

Standalone Use: Quick composition testing and security validation during development

Integrated Use: Part of the complete validation workflow with kcl-composition-validator skill

• Stage 1: KCL Formatting (kcl fmt)
• Stage 2: KCL Syntax Validation (kcl run)
• Stage 3: Composition Rendering (this skill)
• Stage 4: Security/​Policy Validation (this skill)

For complete pre-commit validation, use kcl-composition-validator which runs all stages.

Core Rendering Workflow

Basic Rendering

Purpose: Test that composition renders successfully and preview resources

Command Pattern:

cd infrastructure/​base/​crossplane/​configuration

crossplane render \
  examples/<claim-file>.yaml \
  <composition-file>.yaml \
  functions.yaml \
  --extra-resources examples/​environmentconfig.yaml \
  > /​tmp/​rendered.yaml

Available Compositions:

1. App Composition (app-composition.yaml)

   • Examples: app-basic.yaml, app-complete.yaml
   • Progressive complexity: minimal to production-ready
   • Features: deployment, database, cache, storage, autoscaling, HA

2. SQLInstance Composition (sql-instance-composition.yaml)

   • Examples: sqlinstance-basic.yaml, sqlinstance-complete.yaml
   • PostgreSQL via CloudNativePG
   • Features: backup, HA, migrations

3. EKS Pod Identity (epi-composition.yaml)

   • Example: epi.yaml
   • IAM roles for service accounts

Rendering Examples

Test basic App configuration:

cd infrastructure/​base/​crossplane/​configuration

crossplane render \
  examples/​app-basic.yaml \
  app-composition.yaml \
  functions.yaml \
  --extra-resources examples/​environmentconfig.yaml \
  > /​tmp/​app-basic-rendered.yaml

Test complete App configuration:

crossplane render \
  examples/​app-complete.yaml \
  app-composition.yaml \
  functions.yaml \
  --extra-resources examples/​environmentconfig.yaml \
  > /​tmp/​app-complete-rendered.yaml

Test SQLInstance:

crossplane render \
  examples/​sqlinstance-complete.yaml \
  sql-instance-composition.yaml \
  functions.yaml \
  --extra-resources examples/​environmentconfig.yaml \
  > /​tmp/​sqlinstance-rendered.yaml

Security & Policy Validation

CRITICAL: Every composition change must pass security and policy validation before committing.

Validation Targets

• Polaris: Security & best practices - Target score: 85+
• kube-linter: Kubernetes best practices - Target: No errors
• Datree: Policy enforcement - Target: No violations (warnings acceptable if documented)

Step-by-Step Validation

Step 1: Render the Composition

cd infrastructure/​base/​crossplane/​configuration
crossplane render examples/​app-complete.yaml app-composition.yaml functions.yaml \
  --extra-resources examples/​environmentconfig.yaml > /​tmp/​rendered.yaml

Step 2: Polaris Security Audit

polaris audit --audit-path /​tmp/​rendered.yaml --format=pretty

Expected output:

• Overall score: 85+ (Green/​Yellow acceptable)
• No critical security issues
• Resource limits defined
• Health checks configured

Common Polaris Issues:

• Missing resource limits → Add requests/​limits in composition
• No health checks → Add liveness/​readiness probes
• Running as root → Add securityContext with non-root user
• Privileged containers → Remove privileged: true unless required

Step 3: kube-linter Validation

kube-linter lint /​tmp/​rendered.yaml

Expected: Clean output with no errors

Common kube-linter Issues:

• Missing liveness/​readiness probes
• No resource limits
• Incorrect label schemas
• Deprecated API versions

Step 4: Datree Policy Check

datree test /​tmp/​rendered.yaml --ignore-missing-schemas

Expected: No policy violations (warnings acceptable if documented)

Common Datree Issues:

• Missing labels (app.kubernetes.io/​*)
• Incorrect image tags (using 'latest')
• Missing owner references
• Network policy gaps

Security Validation Checklist

Before committing composition changes:

• Composition renders successfully without errors
• Polaris score is 85+ with no critical issues
• kube-linter passes with no errors
• Datree policy check passes (or warnings documented)
• Resource limits are defined for all containers
• Health checks (liveness/​readiness) are configured
• Security contexts are properly set
• No privileged containers (unless justified)
• Images use specific tags (not 'latest')
• Network policies are defined (where applicable)

Rendered Output Analysis

Inspect Resources

Count resources by kind:

grep "^kind:" /​tmp/​rendered.yaml | sort | uniq -c

Extract specific resource:

# Get Deployment
yq 'select(.kind == "Deployment")' /​tmp/​rendered.yaml

# Get Service
yq 'select(.kind == "Service")' /​tmp/​rendered.yaml

# Get HTTPRoute
yq 'select(.kind == "HTTPRoute")' /​tmp/​rendered.yaml

Check readiness annotations:

# Find resources marked as ready
grep -B 5 'krm.kcl.dev/​ready: "True"' /​tmp/​rendered.yaml

Verify Resource Correctness

Deployment checks:

# Check replicas
yq 'select(.kind == "Deployment") | .spec.replicas' /​tmp/​rendered.yaml

# Check image
yq 'select(.kind == "Deployment") | .spec.template.spec.containers[0].image' /​tmp/​rendered.yaml

# Check resource limits
yq 'select(.kind == "Deployment") | .spec.template.spec.containers[0].resources' /​tmp/​rendered.yaml

Service checks:

# Check service type
yq 'select(.kind == "Service") | .spec.type' /​tmp/​rendered.yaml

# Check ports
yq 'select(.kind == "Service") | .spec.ports' /​tmp/​rendered.yaml

HTTPRoute checks:

# Check hostnames
yq 'select(.kind == "HTTPRoute") | .spec.hostnames' /​tmp/​rendered.yaml

# Check backend refs
yq 'select(.kind == "HTTPRoute") | .spec.rules[0].backendRefs' /​tmp/​rendered.yaml

Detecting Duplicate Resources

Issue: KCL mutation patterns can cause duplicate resources (see kcl-composition-validator skill)

Detection:

# Count Deployments (should match expected count)
grep -c "kind: Deployment" /​tmp/​rendered.yaml

# Count Services
grep -c "kind: Service" /​tmp/​rendered.yaml

# Find duplicate resource names
grep "name:" /​tmp/​rendered.yaml | sort | uniq -d

If duplicates found:

1. Check KCL code for mutation patterns
2. Use kcl-composition-validator skill for detailed guidance
3. Refactor to use inline conditionals
4. Re-render and verify

Development Workflow

Quick Iteration Cycle

When developing new composition features:

# 1. Make changes to KCL composition
vim infrastructure/​base/​crossplane/​configuration/​kcl/​app/​main.k

# 2. Quick render test
cd infrastructure/​base/​crossplane/​configuration
crossplane render examples/​app-complete.yaml app-composition.yaml functions.yaml \
  --extra-resources examples/​environmentconfig.yaml > /​tmp/​test.yaml

# 3. Check output
less /​tmp/​test.yaml

# 4. Iterate until correct

When changes look good:

# 5. Run security validation
polaris audit --audit-path /​tmp/​test.yaml --format=pretty
kube-linter lint /​tmp/​test.yaml
datree test /​tmp/​test.yaml --ignore-missing-schemas

# 6. Run complete validation (includes KCL formatting/​syntax)
./​scripts/​validate-kcl-compositions.sh

Testing Different Scenarios

Test with minimal configuration:

crossplane render examples/​app-basic.yaml app-composition.yaml functions.yaml \
  --extra-resources examples/​environmentconfig.yaml > /​tmp/​minimal.yaml

Test with complete configuration:

crossplane render examples/​app-complete.yaml app-composition.yaml functions.yaml \
  --extra-resources examples/​environmentconfig.yaml > /​tmp/​complete.yaml

Compare outputs:

diff -u /​tmp/​minimal.yaml /​tmp/​complete.yaml | less

Creating Custom Test Examples

Create a custom claim for testing:

# /​tmp/​my-test-app.yaml
apiVersion: cloud.ogenki.io/​v1alpha1
kind: App
metadata:
  name: test-app
  namespace: apps
spec:
  image: nginx:1.25
  replicas: 3
  database:
    enabled: true
    size: small
  autoscaling:
    enabled: true
    minReplicas: 2
    maxReplicas: 5

Render custom claim:

cd infrastructure/​base/​crossplane/​configuration
crossplane render /​tmp/​my-test-app.yaml app-composition.yaml functions.yaml \
  --extra-resources examples/​environmentconfig.yaml > /​tmp/​my-test-rendered.yaml

Troubleshooting Rendering Issues

Issue: Composition Not Found

Symptom: Error: composition not found

Fix:

• Ensure you're in infrastructure/​base/​crossplane/​configuration/ directory
• Verify composition file exists and path is correct
• Check composition file syntax with yq or kubectl

Issue: Function Not Found

Symptom: Error: function not found or unknown function

Fix:

• Verify functions.yaml exists in the same directory
• Check function images are accessible
• Ensure Docker is running (required for crossplane render)

Issue: EnvironmentConfig Missing

Symptom: References to environment config fail

Fix:

• Always include --extra-resources examples/​environmentconfig.yaml
• Verify the EnvironmentConfig file exists
• Check the EnvironmentConfig spec matches composition expectations

Issue: Render Succeeds but Resources Are Wrong

Symptom: Render completes but output doesn't match expectations

Debug steps:

1. Check the claim file matches the composition schema
2. Verify EnvironmentConfig has required fields
3. Review KCL code in infrastructure/​base/​crossplane/​configuration/​kcl/<module>/
4. Check for conditional logic that might affect output
5. Use kcl-composition-validator skill to validate KCL syntax

Issue: Docker Not Available

Symptom: Error: cannot connect to Docker daemon

Fix:

# Start Docker
sudo systemctl start docker

# Or use podman with docker alias
alias docker=podman

Integration with Complete Validation

For pre-commit validation, use the comprehensive script:

./​scripts/​validate-kcl-compositions.sh

This runs:

1. KCL formatting (kcl fmt)
2. KCL syntax validation (kcl run)
3. Crossplane rendering (this skill)

For security validation (additional step):

# After rendering
polaris audit --audit-path /​tmp/​rendered.yaml --format=pretty
kube-linter lint /​tmp/​rendered.yaml
datree test /​tmp/​rendered.yaml --ignore-missing-schemas

Common Validation Scenarios

Scenario 1: Testing New Feature in Composition

# 1. Modify composition KCL
vim infrastructure/​base/​crossplane/​configuration/​kcl/​app/​main.k

# 2. Render with feature enabled
cd infrastructure/​base/​crossplane/​configuration
crossplane render examples/​app-complete.yaml app-composition.yaml functions.yaml \
  --extra-resources examples/​environmentconfig.yaml > /​tmp/​test.yaml

# 3. Verify feature resources exist
grep "kind:" /​tmp/​test.yaml | sort | uniq -c

# 4. Security validation
polaris audit --audit-path /​tmp/​test.yaml --format=pretty

Scenario 2: Validating Database Integration

# Render SQLInstance
crossplane render examples/​sqlinstance-complete.yaml sql-instance-composition.yaml functions.yaml \
  --extra-resources examples/​environmentconfig.yaml > /​tmp/​db.yaml

# Check generated resources
yq 'select(.kind == "Cluster")' /​tmp/​db.yaml  # CloudNativePG Cluster
yq 'select(.kind == "ScheduledBackup")' /​tmp/​db.yaml  # Backup config
yq 'select(.kind == "AtlasMigration")' /​tmp/​db.yaml  # Migrations

# Validate security
polaris audit --audit-path /​tmp/​db.yaml --format=pretty

Scenario 3: Testing Environment-Specific Configuration

# Create test EnvironmentConfig
cat > /​tmp/​test-env.yaml <<EOF
apiVersion: cloud.ogenki.io/​v1alpha1
kind: EnvironmentConfig
metadata:
  name: test-env
data:
  environment: prod
  region: us-west-2
EOF

# Render with custom environment
crossplane render examples/​app-complete.yaml app-composition.yaml functions.yaml \
  --extra-resources /​tmp/​test-env.yaml > /​tmp/​prod-app.yaml

# Verify environment-specific settings
yq 'select(.kind == "Deployment") | .spec.replicas' /​tmp/​prod-app.yaml

Performance Optimization

Faster Rendering

Render specific composition only (skip others):

# Instead of running full validation script
crossplane render examples/​app-basic.yaml app-composition.yaml functions.yaml \
  --extra-resources examples/​environmentconfig.yaml

Use local function images (if available):

# Pull function images once
docker pull xpkg.upbound.io/​crossplane-contrib/​function-kcl:latest

# Subsequent renders will use cached image

Selective Validation

During development, validate only what changed:

# Skip Polaris/​kube-linter/​Datree during rapid iteration
# Only run these before commit

Before commit, run all validations:

# Complete validation
./​scripts/​validate-kcl-compositions.sh

# Security validation
polaris audit --audit-path /​tmp/​rendered.yaml --format=pretty
kube-linter lint /​tmp/​rendered.yaml
datree test /​tmp/​rendered.yaml --ignore-missing-schemas

Additional Resources

• Security validation details: See security-validation.md in this skill folder
• Rendering examples and scenarios: See examples.md in this skill folder
• Quick command reference: See quick-reference.md in this skill folder
• KCL-specific validation: Use kcl-composition-validator skill

Success Criteria

Validation is successful when:

1. ✅ Composition renders without errors
2. ✅ No duplicate resources in output
3. ✅ Polaris score is 85+ with no critical issues
4. ✅ kube-linter reports no errors
5. ✅ Datree policy check passes (or warnings documented)
6. ✅ Resources match expected count and structure
7. ✅ All required fields are populated correctly