docs: Add RFC for mounting ConfigMaps and Secrets into instances#128
Open
scotwells wants to merge 5 commits into
Open
docs: Add RFC for mounting ConfigMaps and Secrets into instances#128scotwells wants to merge 5 commits into
scotwells wants to merge 5 commits into
Conversation
Design proposal for letting compute Workloads reference ConfigMaps and Secrets so their data reaches instances across federated POP cells. Covers env injection (buildable on the Unikraft provider today) and file mounts (blocked on an upstream Unikraft Cloud capability), and introduces the foundational referenced-data delivery path that image pull credentials will later consume. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Trim the proposal substantially and add a Mermaid sequence diagram showing the full propagation flow from a user creating a Workload through to the compute provider deploying the instance with config/secret data applied. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Remove file/line and code-path references throughout; describe components by role and the user-facing API contract instead, keeping the proposal at a product and architecture altitude. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The Unikraft runtime's kubelet integration consumes Pod specs with native ConfigMap/Secret references as env vars and volume mounts, so file mounts are not vendor-blocked. Remove the env-now/files-later phasing and upstream dependency, and reframe the proposal around its real scope: delivering the referenced data across planes to the cell. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add a Platform direction section: build delivery behind a capability-shaped seam in compute now, keep it separable from consumption, and promote it to a platform-owned, policy-driven capability when a second consumer appears. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
ecv
approved these changes
May 31, 2026
ecv
left a comment
ecv
left a comment
There was a problem hiding this comment.
oh so friday night is not for claude but sunday is for claude. i see how it is
savme
approved these changes
May 31, 2026
mattdjenkinson
approved these changes
May 31, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Today a compute Workload can only set literal environment variables — users can't point an instance at a ConfigMap or Secret they manage, so app config, API keys, and TLS material end up baked into images or pasted as plaintext. This RFC proposes letting users reference ConfigMaps and Secrets from a Workload template and have that data delivered securely to their instances in every POP cell the workload runs in, without the user ever knowing federation exists.
It splits the work along what's actually achievable:
Secret values never enter the Workload or Instance spec; they travel only as Secret objects, resolved in the management plane and delivered to the edge. This RFC also establishes the foundational referenced-data delivery path (resolver, scoped project-plane client, scheduling gate, provider gate honoring) that image pull credentials will later consume rather than rebuild.
The document is the deliverable here — it records the design, the two architecture decisions made (management-plane companion delivery; no auto-roll plus an explicit restart path), the alternatives weighed, and what two rounds of adversarial review changed.
Review plan
🤖 Generated with Claude Code