Repository: GoogleContainerTools/kpt
Pull request #4006 (2023-07-14 21:20:50)

update kpt installation instructions and homebrew for kpt v1.0.0-beta.38
<!--  Thanks for sending a pull request!  Here are some tips for you:

In your PR, please ensure that you include the following information:
* a description of the change
* the motivation for the change
* what issue it fixes, if any, in GitHub syntax (e.g. Fixes #XYZ)

Both the description and motivation may reference other issues and PRs,
but should be mostly understandable without following the links (e.g. when
reading the git commit log).

If you are updating the documentation, please do it in separate PRs from
code changes and the commit message should start with `Docs:`.

**PLEASE REMOVE THIS COMMENT BLOCK BEFORE SUBMITTING THE PR** (the bits
between the arrows)

-->



Patch:
diff --git a/Formula/kpt.rb b/Formula/kpt.rb
index 5ad7571f..62e02a60 100644
--- a/Formula/kpt.rb
+++ b/Formula/kpt.rb
@@ -15,8 +15,8 @@
 class Kpt < Formula
   desc "Toolkit to manage,and apply Kubernetes Resource config data files"
   homepage "https://googlecontainertools.github.io/kpt"
-  url "https://github.com/GoogleContainerTools/kpt/archive/v1.0.0-beta.34.tar.gz"
-  sha256 "e818076405b8c79c653aa63f009908bb3568e235c837f4614c0c1fb2084b8ed5"
+  url "https://github.com/GoogleContainerTools/kpt/archive/v1.0.0-beta.38.tar.gz"
+  sha256 "db22d3f5356d690f5cb29e0583c9a170905fe2d6604f8d13ffab976579213040"
 
   depends_on "go" => :build
 
diff --git a/commands/fn/render/cmdrender.go b/commands/fn/render/cmdrender.go
index 64a7fe0b..646e6315 100644
--- a/commands/fn/render/cmdrender.go
+++ b/commands/fn/render/cmdrender.go
@@ -59,6 +59,8 @@ func NewRunner(ctx context.Context, parent string) *Runner {
 
 	c.Flags().BoolVar(&r.RunnerOptions.AllowExec, "allow-exec", r.RunnerOptions.AllowExec,
 		"allow binary executable to be run during pipeline execution.")
+	c.Flags().BoolVar(&r.RunnerOptions.AllowNetwork, "allow-network", false,
+		"allow functions to access network during pipeline execution.")
 	c.Flags().BoolVar(&r.RunnerOptions.AllowWasm, "allow-alpha-wasm", r.RunnerOptions.AllowWasm,
 		"allow wasm to be used during pipeline execution.")
 	cmdutil.FixDocs("kpt", parent, c)
diff --git a/internal/docs/generated/fndocs/docs.go b/internal/docs/generated/fndocs/docs.go
index 1bfa6bb5..202f47ff 100644
--- a/internal/docs/generated/fndocs/docs.go
+++ b/internal/docs/generated/fndocs/docs.go
@@ -274,6 +274,9 @@ Flags:
     can perform privileged operations on your system, so ensure that binaries
     referred in the pipeline are trusted and safe to execute.
   
+  --allow-network:
+    Allow functions to access network during pipeline execution. Default: ` + "`" + `false` + "`" + `. Note that this is applicable to container based functions only.
+  
   --image-pull-policy:
     If the image should be pulled before rendering the package(s). It can be set
     to one of always, ifNotPresent, never. If unspecified, always will be the
@@ -324,6 +327,9 @@ var RenderExamples = `
 
   # Render my-package-dir with podman as runtime for functions
   $ KPT_FN_RUNTIME=podman kpt fn render my-package-dir
+
+  # Render my-package-dir with network access enabled for functions
+  $ kpt fn render --allow-network
 `
 
 var SinkShort = `Write resources to a local directory`
diff --git a/internal/fnruntime/runner.go b/internal/fnruntime/runner.go
index 7053e78a..902d3c21 100644
--- a/internal/fnruntime/runner.go
+++ b/internal/fnruntime/runner.go
@@ -61,6 +61,12 @@ type RunnerOptions struct {
 	// privileged operation, so explicit permission is required.
 	AllowExec bool
 
+	// AllowNetwork specifies if container based functions are allowed
+	// to access network during pipeline execution. Accessing network is
+	// considered a privileged operation (and makes render operation non-hermetic),
+	// so explicit permission is desired.
+	AllowNetwork bool
+
 	// allowWasm determines if function wasm are allowed to be run during pipeline
 	// execution. Running wasm function is an alpha feature, so it needs to be
 	// enabled explicitly.
@@ -143,8 +149,14 @@ func NewRunner(
 					cfn := &ContainerFn{
 						Image:           f.Image,
 						ImagePullPolicy: opts.ImagePullPolicy,
-						Ctx:             ctx,
-						FnResult:        fnResult,
+						Perm: ContainerFnPermission{
+							AllowNetwork: opts.AllowNetwork,
+							// mounts are disabled for render operations (currently)
+							// but it may change in the future.
+							// AllowMount: true,
+						},
+						Ctx:      ctx,
+						FnResult: fnResult,
 					}
 					fltr.Run = cfn.Run
 				}
diff --git a/porch/docs/running-locally.md b/porch/docs/running-locally.md
index b813b720..505277e1 100644
--- a/porch/docs/running-locally.md
+++ b/porch/docs/running-locally.md
@@ -10,6 +10,7 @@ To run Porch locally, you will need:
 * [go 1.20](https://go.dev/dl/) or newer
 * [docker](https://docs.docker.com/get-docker/)
 * [git](https://git-scm.com/)
+* [kubectl](https://kubernetes.io/docs/tasks/tools/install-kubectl-linux/)
 * `make`
 
 ## Getting Started
diff --git a/site/installation/kpt-cli.md b/site/installation/kpt-cli.md
index 2f64a775..dc197a0b 100644
--- a/site/installation/kpt-cli.md
+++ b/site/installation/kpt-cli.md
@@ -103,7 +103,7 @@ Use one of the kpt docker images.
 ### `kpt`
 
 ```shell
-$ docker run gcr.io/kpt-dev/kpt:v1.0.0-beta.34 version
+$ docker run gcr.io/kpt-dev/kpt:v1.0.0-beta.38 version
 ```
 
 ### `kpt-gcloud`
@@ -111,7 +111,7 @@ $ docker run gcr.io/kpt-dev/kpt:v1.0.0-beta.34 version
 An image which includes kpt based upon the Google [cloud-sdk] alpine image.
 
 ```shell
-$ docker run gcr.io/kpt-dev/kpt-gcloud:v1.0.0-beta.34 version
+$ docker run gcr.io/kpt-dev/kpt-gcloud:v1.0.0-beta.38 version
 ```
 
 ## Source
@@ -134,12 +134,12 @@ $ kpt version
   https://console.cloud.google.com/gcr/images/kpt-dev/GLOBAL/kpt-gcloud?gcrImageListsize=30
 [cloud-sdk]: https://github.com/GoogleCloudPlatform/cloud-sdk-docker
 [linux-amd64]:
-  https://github.com/GoogleContainerTools/kpt/releases/download/v1.0.0-beta.34/kpt_linux_amd64
+  https://github.com/GoogleContainerTools/kpt/releases/download/v1.0.0-beta.38/kpt_linux_amd64
 [linux-arm64]:
-  https://github.com/GoogleContainerTools/kpt/releases/download/v1.0.0-beta.34/kpt_linux_arm64
+  https://github.com/GoogleContainerTools/kpt/releases/download/v1.0.0-beta.38/kpt_linux_arm64
 [darwin-amd64]:
-  https://github.com/GoogleContainerTools/kpt/releases/download/v1.0.0-beta.34/kpt_darwin_amd64
+  https://github.com/GoogleContainerTools/kpt/releases/download/v1.0.0-beta.38/kpt_darwin_amd64
 [darwin-arm64]:
-  https://github.com/GoogleContainerTools/kpt/releases/download/v1.0.0-beta.34/kpt_darwin_arm64
+  https://github.com/GoogleContainerTools/kpt/releases/download/v1.0.0-beta.38/kpt_darwin_arm64
 [migration guide]: /installation/migration
 [bash-completion]: https://github.com/scop/bash-completion#installation
diff --git a/site/package-lock.json b/site/package-lock.json
index 0e4fefa6..bb03ee84 100644
--- a/site/package-lock.json
+++ b/site/package-lock.json
@@ -6870,9 +6870,9 @@
       }
     },
     "node_modules/word-wrap": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz",
-      "integrity": "sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ==",
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.4.tgz",
+      "integrity": "sha512-2V81OA4ugVo5pRo46hAoD2ivUJx8jXmWXfUkY4KFNw0hEptvN0QfH3K4nHiwzGeKl5rFKedV48QVoqYavy4YpA==",
       "dev": true,
       "engines": {
         "node": ">=0.10.0"
@@ -12242,9 +12242,9 @@
       }
     },
     "word-wrap": {
-      "version": "1.2.3",
-      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz",
-      "integrity": "sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ==",
+      "version": "1.2.4",
+      "resolved": "https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.4.tgz",
+      "integrity": "sha512-2V81OA4ugVo5pRo46hAoD2ivUJx8jXmWXfUkY4KFNw0hEptvN0QfH3K4nHiwzGeKl5rFKedV48QVoqYavy4YpA==",
       "dev": true
     },
     "wrap-ansi": {
diff --git a/site/reference/cli/fn/render/README.md b/site/reference/cli/fn/render/README.md
index d04026a9..0fe2cd38 100644
--- a/site/reference/cli/fn/render/README.md
+++ b/site/reference/cli/fn/render/README.md
@@ -50,6 +50,9 @@ PKG_PATH:
   can perform privileged operations on your system, so ensure that binaries
   referred in the pipeline are trusted and safe to execute.
 
+--allow-network:
+  Allow functions to access network during pipeline execution. Default: `false`. Note that this is applicable to container based functions only.
+
 --image-pull-policy:
   If the image should be pulled before rendering the package(s). It can be set
   to one of always, ifNotPresent, never. If unspecified, always will be the
@@ -123,6 +126,11 @@ $ kpt fn render -o stdout \
 $ KPT_FN_RUNTIME=podman kpt fn render my-package-dir
 ```
 
+```shell
+# Render my-package-dir with network access enabled for functions
+$ kpt fn render --allow-network
+```
+
 <!--mdtogo-->
 
 [declarative functions execution]:


Test patch:
diff --git a/e2e/testdata/fn-render/basicpipeline/.expected/config.yaml b/e2e/testdata/fn-render/basicpipeline/.expected/config.yaml
new file mode 100644
index 00000000..325550be
--- /dev/null
+++ b/e2e/testdata/fn-render/basicpipeline/.expected/config.yaml
@@ -0,0 +1,15 @@
+# Copyright 2023 The kpt Authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+allowNetwork: true
\ No newline at end of file
diff --git a/pkg/test/runner/config.go b/pkg/test/runner/config.go
index 9ed6d298..f37ae824 100644
--- a/pkg/test/runner/config.go
+++ b/pkg/test/runner/config.go
@@ -81,6 +81,9 @@ type TestCaseConfig struct {
 	// AllowExec determines if `fn render` needs to be invoked with `--allow-exec` flag
 	AllowExec bool `json:"allowExec,omitempty" yaml:"allowExec,omitempty"`
 
+	// AllowExec determines if `fn render` needs to be invoked with `--allow-network` flag
+	AllowNetwork bool `json:"allowNetwork,omitempty" yaml:"allowNetwork,omitempty"`
+
 	// AllowWasm determines if `fn render` needs to be invoked with `--allow-alpha-wasm` flag
 	AllowWasm bool `json:"allowWasm,omitempty" yaml:"allowWasm,omitempty"`