[deckhouse-cli] Fetch plugin contracts from manifest annotation#388
Merged
Conversation
Glitchy-Sheep
force-pushed
the
feat/multiplatform-rpp-request
branch
from
fc4d5dd to
7b84a8a
Compare
Glitchy-Sheep
force-pushed
the
feat/update-using-manifests-contract
branch
from
4dec67e to
aaae09f
Compare
Glitchy-Sheep
force-pushed
the
feat/update-using-manifests-contract
branch
from
aaae09f to
177b033
Compare
Glitchy-Sheep
force-pushed
the
feat/multiplatform-rpp-request
branch
2 times, most recently
from
8e2f183 to
88f14d8
Compare
Glitchy-Sheep
force-pushed
the
feat/update-using-manifests-contract
branch
from
177b033 to
4a60385
Compare
This was referenced Jun 24, 2026
Base automatically changed from
feat/multiplatform-rpp-request
to
feat/cli-and-plugins-autoupdate
June 25, 2026 10:18
Glitchy-Sheep
changed the base branch from
feat/cli-and-plugins-autoupdate
to
main
- `Client.GetManifest` fetches the raw image manifest over `/<image>/manifests/<ref>` - one manifest fetch, no layer pull. The binary is pulled only on install. - The CLI reads the base64 `contract` annotation itself; the proxy stays generic and returns the manifest verbatim. - Multi-platform images: when the index carries no contract, the first child manifest is followed by digest, so the contract is found wherever it lives. - A missing annotation yields name+version (contract-less plugin); a malformed one is an error. `selectCompatible` hard-stops on any contract error and never silently demotes to an older installed version. Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
- A plugin dependency named after a built-in command (e.g. `delivery-kit`) is satisfied by the command's presence - no install, no registry lookup. - Version constraints on such deps are ignored: a built-in can't be upgraded, so presence alone is enough. - The planner and the pre-switch validators short-circuit on built-in deps, for both mandatory and conditional requirements. - `d8` registers `delivery-kit` as a built-in via `SetBuiltinCommands` when it builds the `plugins` command. Signed-off-by: Roman Berezkin <roman.berezkin@flant.com>
Glitchy-Sheep
force-pushed
the
feat/update-using-manifests-contract
branch
from
e9b4155 to
2177ee8
Compare
ldmonster
approved these changes
Jun 25, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Important
🧩 Stacked PR ·
d8self-update & plugins · 3 / 3 · Direct manifest downloadMerge in this order:
Proxy side: deckhouse/deckhouse#20795 · deckhouse/deckhouse#20800
Summary
Reading a plugin's contract no longer downloads the plugin image.
The contract is published as an annotation on the image manifest, and d8 fetches just that manifest.
How it works
GET /v1/images/<image>/manifests/<ref>(ref is a tag or a digest) and decodes the base64-JSONcontractannotation.Before / After
Before: every contract read pulled and untarred the plugin image to find
contract.yaml.After: every contract read is one manifest request with no layers.
Also in this PR: built-in commands can satisfy a plugin dependency
A plugin contract may depend on a capability that ships as a built-in d8 command
rather than a published plugin (currently
delivery-kit, a werf re-skin).With this pr we can setup a list of built-in commands which can resolve plugins contract dependencies.
delivery-kit)d8 plugins install delivery-kitdirectly still reports it is not published.