# Copyright 2024-2026 Defense Unicorns

# SPDX-License-Identifier: AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial

variables:

- name: FLAVOR

default: upstream

- name: LAYER

includes:

- create: ./tasks/create.yaml

- setup: ./tasks/setup.yaml

- deploy: ./tasks/deploy.yaml

- test: ./tasks/test.yaml

- lint: ./tasks/lint.yaml

- diagrams: ./tasks/diagrams.yaml

tasks:

- name: default

actions:

- description: "Build, deploy and test UDS Core"

task: test-uds-core

- name: dev-setup

description: "Create k3d cluster with istio"

inputs:

istio_components:

description: "Comma separated list of istio components to deploy"

default: ""

deploy_pepr:

description: "Deploy Pepr before Istio"

default: "false"

actions:

- description: "Create the dev cluster"

task: setup:create-k3d-cluster

- description: "Create required namespaces"

cmd: |

./uds zarf tools kubectl create ns uds-policy-exemptions

./uds zarf tools kubectl create ns istio-system

./uds zarf tools kubectl create ns pepr-system

./uds zarf tools kubectl label ns pepr-system zarf.dev/agent=ignore --overwrite

- description: "Deploy the UDS CRDs and apply all hack dev manifests"

cmd: |

./uds zarf tools kubectl apply -f src/pepr/uds-cluster-crds/templates/

./uds zarf tools kubectl apply -f hack/dev-manifests/

- description: "Deploy Pepr"

if: ${{ eq .inputs.deploy_pepr "true" }}

cmd: "npx pepr deploy --yes"

# Note: the `registry-url` flag used here requires uds 0.19.2+

- description: "Deploy the Istio source package with Zarf Dev"

cmd: "./uds zarf dev deploy src/istio --flavor upstream --registry-url docker.io --components=${{ .inputs.istio_components }}"

# Note: Since this is a dev deploy without any `--flavor` it only deploys the CRDs (other components are flavored)

- description: "Deploy the Prometheus-Stack source package with Zarf Dev to only install the CRDs"

cmd: "./uds zarf dev deploy src/prometheus-stack"

- description: "Dev instructions"

cmd: |

echo "Next steps:"

echo " - To test & develop the Pepr module, run 'npx pepr dev' from a Javascript debug terminal"

echo " - Otherwise run 'npx pepr deploy' to deploy the Pepr module to the cluster"

echo " - Additional source packages can be deployed with 'zarf dev deploy src/<package> --flavor upstream'"

- name: slim-dev

actions:

- description: "Build slim dev bundle with UDS CLI Next"

task: create:k3d-slim-dev-bundle-next

- description: "Deploy slim dev bundle with UDS CLI Next"

task: deploy:k3d-slim-dev-bundle-next

- name: slim-dev-legacy

actions:

- description: "Build slim dev Legacy bundle"

task: create:k3d-slim-dev-bundle

- description: "Deploy slim dev Legacy bundle"

task: deploy:k3d-slim-dev-bundle

- name: slim-dev-ha

description: "Build and deploy slim dev bundle with HA configuration"

actions:

- description: "Setup HA PostgreSQL"

task: setup:ha-postgres

- description: "Setup HA Redis"

task: setup:ha-redis

- description: "Build slim dev bundle"

task: create:k3d-slim-dev-bundle

- description: "Deploy slim dev bundle with HA configuration"

task: deploy:k3d-slim-dev-bundle-ha

- name: dev-identity

description: "Create k3d cluster with istio, Pepr, Keycloak, and Authservice for development"

actions:

- task: dev-setup

with:

deploy_pepr: "true"

- description: "Deploy Keycloak + Authservice"

cmd: "./uds run dev-deploy --set LAYER=identity-authorization --no-progress"

- name: dev-deploy

description: "Deploy the given core layer with Zarf Dev"

actions:

- cmd: "./uds zarf dev deploy packages/${LAYER} --flavor ${FLAVOR} --components '*'"

- name: setup-cluster

description: "Create a k3d Cluster and Initialize with Zarf"

actions:

- task: setup:k3d-test-cluster

- name: create-standard-package

description: "Create UDS Core Zarf Package, `upstream` flavor default, use --set FLAVOR={flavor} to change"

actions:

- task: create:standard-package

- name: test-single-layer

description: "Deploys k3d cluster, layer dependencies and the provided layer (based on LAYER variable)"

actions:

- task: test:layer-dependencies

- task: test:single-layer

- name: deploy-standard-bundle

actions:

- task: deploy:k3d-standard-bundle

- name: test-uds-core

description: "Build and test UDS Core"

actions:

- task: test:uds-core

- name: test-uds-core-multi-node

description: "Deploys UDS Core on a multi-node cluster"

actions:

- task: create:k3d-standard-bundle-next

with:

create_options: "--skip-sbom"

- task: deploy:k3d-standard-bundle-next

with:

configFile: bundles/k3d-standard-next/config-test-multi-node.uds.hcl

- task: test:validate-packages

- name: test-uds-core-ha

description: "Build and test UDS Core"

actions:

- task: setup:ha-postgres

- task: setup:ha-redis

- task: test:uds-core-ha

- name: test-uds-core-ha-legacy

description: "Build and test UDS Core with UDS CLI Legacy bundle workflow"

actions:

- task: setup:ha-postgres

- task: setup:ha-redis

- task: test:uds-core-ha-legacy

- name: test-uds-core-ha-upgrade

description: "Test an upgrade from the latest released UDS Core package with HA to current branch with HA"

actions:

- task: setup:ha-postgres

- task: setup:ha-redis

- task: test:uds-core-ha-upgrade

- name: test-uds-core-ha-upgrade-legacy

description: "Test an upgrade from the latest released UDS Core package with HA to current branch with HA and UDS CLI Legacy"

actions:

- task: setup:ha-postgres

- task: setup:ha-redis

- task: test:uds-core-ha-upgrade-legacy

- name: test-uds-core-upgrade

description: "Test an upgrade from the latest released UDS Core package to current branch"

actions:

- task: test:uds-core-upgrade

- name: test-uds-core-upgrade-legacy

description: "Test an upgrade from the latest released UDS Core package to current branch with UDS CLI Legacy bundle workflow"

actions:

- task: test:uds-core-upgrade-legacy

- name: lint-check

description: "Run linting checks"

actions:

- task: lint:check

- name: k8s-version-check

description: "Verify documented k8s version matches CI config"

actions:

- task: lint:k8s-version-check

- name: lint-fix

description: "Fix linting issues"

actions:

- task: lint:fix

# This task does not clone in/manage docs outside of the core repo so you may hit some 404s during development

# This task does not run the integration-script in the uds-docs repo, the sidebar will not be the same as the live docs

- name: dev-docs

description: "Start the dev docs server"

actions:

- description: "Cleanup previous runs"

cmd: |

rm -rf uds-docs

- description: "Clone the docs repo and symlink the reference docs"

cmd: |

git clone https://github.com/defenseunicorns/uds-docs.git uds-docs

channel=$(./uds zarf tools yq -r '.[] | select(.repo == "defenseunicorns/uds-core") | .branch // ""' uds-docs/src/products.json)

docs_root="uds-docs/src/content/docs/core${channel:+/$channel}"

mkdir -p "$docs_root"

# Symlink only dirs listed in sidebarOrder (mirrors integration-script cleanup logic)

allowed=$(./uds zarf tools yq -r '.sidebarOrder[] | (.dir // .)' docs/docs.config.json)

for dir in $(pwd)/docs/*/; do

name="$(basename "$dir")"

echo "$allowed" | grep -qx "$name" && ln -s "$dir" "$docs_root/"

done

# Also symlink the top-level index page if present

[ -f "$(pwd)/docs/index.mdx" ] && ln -s "$(pwd)/docs/index.mdx" "$docs_root/"

ln -s $(pwd)/docs/.c4 uds-docs/src/content/docs/.c4

ln -s $(pwd)/docs/.images "$docs_root/.images"

- description: "Create product config for dev server"

cmd: |

mkdir -p uds-docs/.product-configs

./uds zarf tools yq -o=json '. + {"repo": "defenseunicorns/uds-core"}' docs/docs.config.json \

> uds-docs/.product-configs/uds-core.json

channel=$(./uds zarf tools yq -r '.[] | select(.repo == "defenseunicorns/uds-core") | .branch // ""' uds-docs/src/products.json)

if [ -n "$channel" ]; then

printf '{\n "/core": "/core/%s/"\n}\n' "$channel" \

> uds-docs/.product-configs/redirects.json

fi

- description: "Start the docs server with npm (this will run until you stop it)"

cmd: |

# Actual startup takes up to a minute because of the npm install

cd uds-docs && npm i && npm run dev

- name: uds-docs-validate

description: "Validate and build uds-docs with latest uds-core docs"

actions:

- description: "Cleanup previous runs"

cmd: |

rm -rf uds-docs

- description: "Clone the docs repo"

cmd: git clone https://github.com/defenseunicorns/uds-docs.git uds-docs

- description: "UDS Docs Integration Script"

cmd: cd uds-docs && npm i && DOCS_OVERRIDES="uds-core=$(pwd)/.." npm run build

- name: update-diagrams

description: "Regenerate C4 and D2 Diagrams"

actions:

- description: "Regenerate C4 Diagrams"

task: diagrams:c4-update

- name: check-ca-certs

description: "Checks CA certificates for updates"

actions:

- cmd: npm --prefix scripts/root-ca-retriever exec -- tsx --tsconfig scripts/root-ca-retriever/tsconfig.json scripts/root-ca-retriever/index.ts --check

- name: update-ca-certs

description: "Updates CA certificates"

actions:

- cmd: npm --prefix scripts/root-ca-retriever exec -- tsx --tsconfig scripts/root-ca-retriever/tsconfig.json scripts/root-ca-retriever/index.ts

- description: "Add license headers to generated CA configmap"

shell:

darwin: bash

linux: bash

cmd: |

if command -v addlicense >/dev/null 2>&1; then

echo "addlicense installed"

else

echo "Error: addlicense is not installed" >&2

exit 1

fi

addlicense -l "AGPL-3.0-or-later OR LicenseRef-Defense-Unicorns-Commercial" -s=only -v -c "Defense Unicorns" src/pepr/uds-operator-config/templates/uds-ca-certs.yaml