elpio 0.1.0__tar.gz

elpio-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,84 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+# Run Node-based actions on Node 24. Several actions we depend on (azure/setup-helm,
+# arduino/setup-task, docker/*) have no Node-24 major yet; this opts them in and
+# silences the Node 20 deprecation.
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  lint:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      - uses: arduino/setup-task@v2
+        with:
+          version: 3.x
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - run: pip install -e '.[dev]'
+      - run: task lint
+
+  test:
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: ${{ matrix.python-version }}
+      - uses: arduino/setup-task@v2
+        with:
+          version: 3.x
+          repo-token: ${{ secrets.GITHUB_TOKEN }}
+      - run: pip install -e '.[dev]'
+      - run: task unit
+
+  helm:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: azure/setup-helm@v4
+      - run: helm lint deploy/helm/elpio
+      - run: helm template elpio deploy/helm/elpio --namespace elpio-system >/dev/null
+
+  integration:
+    runs-on: ubuntu-latest
+    services:
+      redis:
+        image: redis:7
+        ports: ["6379:6379"]
+        options: >-
+          --health-cmd "redis-cli ping" --health-interval 5s
+          --health-timeout 3s --health-retries 5
+      rabbitmq:
+        image: rabbitmq:3
+        ports: ["5672:5672"]
+        options: >-
+          --health-cmd "rabbitmq-diagnostics -q ping" --health-interval 10s
+          --health-timeout 5s --health-retries 10
+    steps:
+      - uses: actions/checkout@v5
+      - uses: actions/setup-python@v6
+        with:
+          python-version: "3.12"
+      # NATS needs JetStream (-js), which service containers can't pass; run it directly.
+      - name: Start NATS with JetStream
+        run: |
+          docker run -d --name nats -p 4222:4222 nats:2 -js
+          sleep 3
+      - run: pip install -e '.[dev,dispatcher]'
+      - name: Run integration tests
+        env:
+          ELPIO_INTEGRATION: "1"
+        run: pytest -m integration

elpio-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,132 @@
+name: release
+
+# Tag a release (`git tag v0.1.0 && git push origin v0.1.0`) to validate, build,
+# and publish:
+#   * the `elpio` Python package to PyPI (CLI: `pip install elpio` → `elpio`),
+#     via Trusted Publishing (OIDC) — no API token in the repo;
+#   * the operator + dispatcher container images to GHCR.
+#
+# One-time PyPI setup: add a pending publisher at
+# https://pypi.org/manage/account/publishing/ — PyPI project `elpio`, owner
+# `altikva`, repo `elpio`, workflow `release.yml`, environment `pypi`.
+
+on:
+  push:
+    tags: ["v*.*.*"]
+
+permissions:
+  contents: read
+
+# Force Node 24 for actions that have no Node-24 major yet (docker/*,
+# azure/setup-helm, arduino/setup-task) so they don't hit the Node 20 deprecation.
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - name: Tag must match the package version
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          tag="${REF_NAME#v}"
+          pkg="$(python3 -c "import tomllib; print(tomllib.load(open('pyproject.toml','rb'))['project']['version'])")"
+          echo "tag=$tag package=$pkg"
+          if [ "$tag" != "$pkg" ]; then
+            echo "::error::tag v$tag does not match pyproject version $pkg"
+            exit 1
+          fi
+      - uses: astral-sh/setup-uv@v8.2.0
+        with:
+          enable-cache: true
+      - name: Lint + test
+        run: |
+          uv sync --locked --all-extras
+          uv run --no-sync ruff check src tests
+          uv run --no-sync pytest -m "not e2e and not integration"
+
+  build:
+    needs: validate
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v5
+      - uses: astral-sh/setup-uv@v8.2.0
+      - name: Build sdist + wheel
+        run: uv build
+      - name: Check metadata
+        run: uvx twine check dist/*
+      - name: Smoke-test the built wheel (CLI runs)
+        run: |
+          uv venv /tmp/smoke
+          uv pip install --python /tmp/smoke/bin/python dist/*.whl
+          /tmp/smoke/bin/elpio version
+      - uses: actions/upload-artifact@v5
+        with:
+          name: dist
+          path: dist/
+
+  pypi:
+    needs: build
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write # Trusted Publishing (OIDC)
+      contents: write # create the GitHub Release
+    steps:
+      - uses: actions/download-artifact@v5
+        with:
+          name: dist
+          path: dist/
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: GitHub Release
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REF_NAME: ${{ github.ref_name }}
+          GH_REPO: ${{ github.repository }}
+        run: gh release create "$REF_NAME" dist/* --repo "$GH_REPO" --title "$REF_NAME" --generate-notes
+
+  images:
+    needs: validate
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    strategy:
+      matrix:
+        include:
+          - image: ghcr.io/altikva/elpio
+            dockerfile: Dockerfile
+          - image: ghcr.io/altikva/elpio-dispatcher
+            dockerfile: Dockerfile.dispatcher
+    steps:
+      - uses: actions/checkout@v5
+
+      - uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
+
+      - uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: ${{ matrix.image }}
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=latest
+
+      - uses: docker/build-push-action@v6
+        with:
+          context: .
+          file: ${{ matrix.dockerfile }}
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}

elpio-0.1.0/.gitignore

@@ -0,0 +1,40 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.eggs/
+build/
+dist/
+.venv/
+venv/
+.python-version
+
+# Test / tooling
+.pytest_cache/
+.ruff_cache/
+.coverage
+htmlcov/
+
+# IDE / OS
+.idea/
+.vscode/
+.DS_Store
+
+# Local
+*.local
+kubeconfig
+
+# Claude Code project memory (kept local, not tracked)
+CLAUDE.md
+
+# codegraph index
+.codegraph/
+
+# codegraph auth key (never commit)
+.codegraph/auth.key
+
+# Claude Code local config
+.claude/
+
+# Docs (kept local, not tracked)
+/docs/

elpio-0.1.0/.mcp.json

@@ -0,0 +1,14 @@
+{
+  "mcpServers": {
+    "codegraph": {
+      "command": "cgh",
+      "args": [
+        "serve",
+        "--root",
+        ".",
+        "--watch",
+        "--reindex"
+      ]
+    }
+  }
+}

elpio-0.1.0/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+All notable changes to Elpio are documented here. Format loosely follows
+[Keep a Changelog](https://keepachangelog.com/).
+
+## [Unreleased]
+
+### Added
+- Initial project scaffold (Altikva open-source product, MIT + CC).
+- `ElpioService` CRD (`elpio.io/v1alpha1`) with scale-to-zero defaults.
+- Kubernetes operator (kopf) reconciling `ElpioService` onto a serving engine.
+- Serving-engine strategy: **Knative** (default) and **KEDA**, behind one CRD.
+- Portability seams: `StateStore`, `IdentityProvider` interfaces.
+- `elpio` CLI: `install`, `deploy`, `services`, `operator`, `version`.
+- `ElpioFunction` / `ElpioTask` stub CRDs (Phase 3).
+- Unit tests (model + engine rendering) and a kind-based e2e harness stub.
+
+[Unreleased]: https://github.com/altikva/elpio

elpio-0.1.0/Dockerfile

@@ -0,0 +1,17 @@
+# Elpio image. Runs `elpio operator` (kopf) by default; the same image also
+# serves the admission webhook and the management API (the `server` extra).
+FROM python:3.12-slim
+
+WORKDIR /app
+
+# Install deps first for layer caching.
+COPY pyproject.toml README.md ./
+COPY src ./src
+RUN pip install --no-cache-dir '.[server]'
+
+# Non-root.
+RUN useradd --create-home --uid 10001 elpio
+USER 10001
+
+ENTRYPOINT ["elpio"]
+CMD ["operator"]

elpio-0.1.0/Dockerfile.dispatcher

@@ -0,0 +1,14 @@
+# Elpio task dispatcher image. Runs the worker an ElpioTask scales with KEDA:
+# pulls from the broker queue and POSTs to the handler ElpioService.
+FROM python:3.12-slim
+
+WORKDIR /app
+
+COPY pyproject.toml README.md ./
+COPY src ./src
+RUN pip install --no-cache-dir '.[dispatcher]'
+
+RUN useradd --create-home --uid 10002 elpio
+USER 10002
+
+ENTRYPOINT ["python", "-m", "elpio.dispatcher.main"]

elpio-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Altikva
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

elpio-0.1.0/LICENSE-docs

@@ -0,0 +1,10 @@
+Documentation, diagrams, and branding in this repository (the contents of
+docs/, README narrative, and the Elpio name and marks) are licensed under the
+Creative Commons Attribution 4.0 International License (CC BY 4.0).
+
+You are free to share and adapt this material for any purpose, even
+commercially, provided you give appropriate credit.
+
+Full text: https://creativecommons.org/licenses/by/4.0/legalcode
+
+The source code is licensed separately under the MIT License (see LICENSE).

elpio-0.1.0/PKG-INFO

@@ -0,0 +1,139 @@
+Metadata-Version: 2.4
+Name: elpio
+Version: 0.1.0
+Summary: Turn any Kubernetes cluster into a private serverless platform (Cloud Run / Functions / Tasks).
+Project-URL: Homepage, https://github.com/altikva/elpio
+Project-URL: Repository, https://github.com/altikva/elpio
+Author-email: Joy Ndjama <joy.ndjama@altikva.com>
+License: MIT
+License-File: LICENSE
+License-File: LICENSE-docs
+Keywords: altikva,cloud-run,keda,knative,kubernetes,operator,serverless
+Classifier: Development Status :: 3 - Alpha
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: System :: Clustering
+Requires-Python: >=3.10
+Requires-Dist: click>=8.1
+Requires-Dist: kopf>=1.37
+Requires-Dist: kubernetes>=29.0
+Requires-Dist: pydantic>=2.5
+Requires-Dist: pyyaml>=6.0
+Provides-Extra: dev
+Requires-Dist: fastapi>=0.110; extra == 'dev'
+Requires-Dist: httpx>=0.27; extra == 'dev'
+Requires-Dist: pyjwt>=2.8; extra == 'dev'
+Requires-Dist: pytest>=7.4; extra == 'dev'
+Requires-Dist: ruff>=0.4; extra == 'dev'
+Requires-Dist: uvicorn>=0.27; extra == 'dev'
+Provides-Extra: dispatcher
+Requires-Dist: httpx>=0.27; extra == 'dispatcher'
+Requires-Dist: nats-py>=2.6; extra == 'dispatcher'
+Requires-Dist: pika>=1.3; extra == 'dispatcher'
+Requires-Dist: redis>=5; extra == 'dispatcher'
+Provides-Extra: server
+Requires-Dist: fastapi>=0.110; extra == 'server'
+Requires-Dist: pyjwt>=2.8; extra == 'server'
+Requires-Dist: uvicorn>=0.27; extra == 'server'
+Description-Content-Type: text/markdown
+
+```
+ _____ _       _
+| ____| |_ __ (_) ___
+|  _| | | '_ \| |/ _ \
+| |___| | |_) | | (_) |
+|_____|_| .__/|_|\___/
+        |_|
+```
+
+**Turn any Kubernetes cluster into a private serverless platform.**
+
+---
+
+**Elpio** is an installable, self-hosted **Cloud Run / Cloud Functions / Cloud Tasks** for
+your own Kubernetes — scale-to-zero, request-driven autoscaling, simplified cluster + node
+autoscaling, and a clean multi-tenant model. GKE-first, **portable by design** (EKS / AKS / k3s).
+
+Elpio is an [Altikva](https://altikva.com) open-source product (MIT for code, CC-BY-4.0 for
+docs). The name is a coined mark rooted in Greek *elpis* ("hope") — part of the Altikva family
+lineage *ha-tikva* (Hebrew) → *Spero* (Latin) → *Elpio*.
+
+> **Status: alpha (v0.1.0).** All four reconcilers ship: `ElpioService` (Knative/KEDA serving),
+> `ElpioFunction` (Tekton + Buildpacks), `ElpioTask` (KEDA + broker), and `ElpioTenant` (namespace,
+> RBAC, quotas, network isolation). Alongside them: OIDC auth, an admission webhook, a multi-cluster
+> management API, a Helm chart, and CI. CRs emit `status.conditions`, so the sibling agent
+> [Spero](https://github.com/altikva/spero) can supervise and heal them. The kind-based e2e harness
+> is wired and gated behind `ELPIO_E2E=1`.
+
+## Why
+
+Elpio does **not** reimplement a serverless runtime. It's the opinionated, enterprise control
+plane that assembles proven CNCF primitives — **Knative**, **KEDA**, **Tekton**, **cert-manager**,
+**Karpenter** — behind a declarative CRD/operator model. Its value is the enterprise wrapper the
+public clouds don't give you: on-prem security integration, hard multi-tenancy, golden-path
+config, fleet management, and a one-command installer.
+
+## How it works
+
+You declare an `ElpioService`; the **operator** reconciles it onto a serving engine. No SSH, no
+imperative `kubectl apply` scripts — just Kubernetes-native reconciliation.
+
+```yaml
+apiVersion: elpio.io/v1alpha1
+kind: ElpioService
+metadata:
+  name: hello
+spec:
+  image: ghcr.io/knative/helloworld-go:latest
+  scaling: { minScale: 0, maxScale: 10, target: 100, metric: concurrency }
+```
+
+| CRD | Equivalent | Engine |
+|-----|-----------|--------|
+| `ElpioService` | Cloud Run | Knative Serving (default) or KEDA |
+| `ElpioFunction` | Cloud Functions | Tekton + Buildpacks → `ElpioService` |
+| `ElpioTask` | Cloud Tasks | KEDA + broker + dispatcher |
+
+The serving engine is a **strategy** (`ELPIO_ENGINE=knative|keda`) behind one stable CRD —
+Knative for the highest Cloud Run parity, KEDA for a lighter footprint.
+
+## Quickstart
+
+```bash
+pip install elpio                  # the elpio CLI
+
+# point kubectl at any cluster (kind, minikube, GKE, EKS, ...) that has a
+# serving engine installed — Knative Serving (default) or KEDA.
+elpio install                      # applies the CRDs + operator
+elpio deploy -f hello.yaml         # the ElpioService shown above
+elpio services
+```
+
+Working from a clone instead? `task e2e-up` provisions kind + Knative/KEDA, and
+`task operator-run` runs the operator locally (`kopf run -m elpio.operator.handlers`).
+
+## Development
+
+```bash
+task dev      # editable install + dev deps
+task unit     # unit tests (no cluster)
+task lint     # ruff
+task e2e      # end-to-end (needs a kind cluster + Knative/KEDA)
+```
+
+## Layout
+
+```
+src/elpio/
+  models/      ElpioService spec (Pydantic mirror of the CRD)
+  engines/     serving-engine strategy: base + knative + keda
+  providers/   portability seams: StateStore, IdentityProvider
+  operator/    kopf reconciler
+  cli.py       the `elpio` command
+deploy/        CRDs + operator manifests (+ Helm)
+docs/          architecture & guides
+```
+
+## License
+
+Code: [MIT](LICENSE). Docs & branding: [CC-BY-4.0](LICENSE-docs).

elpio-0.1.0/README.md

@@ -0,0 +1,100 @@
+```
+ _____ _       _
+| ____| |_ __ (_) ___
+|  _| | | '_ \| |/ _ \
+| |___| | |_) | | (_) |
+|_____|_| .__/|_|\___/
+        |_|
+```
+
+**Turn any Kubernetes cluster into a private serverless platform.**
+
+---
+
+**Elpio** is an installable, self-hosted **Cloud Run / Cloud Functions / Cloud Tasks** for
+your own Kubernetes — scale-to-zero, request-driven autoscaling, simplified cluster + node
+autoscaling, and a clean multi-tenant model. GKE-first, **portable by design** (EKS / AKS / k3s).
+
+Elpio is an [Altikva](https://altikva.com) open-source product (MIT for code, CC-BY-4.0 for
+docs). The name is a coined mark rooted in Greek *elpis* ("hope") — part of the Altikva family
+lineage *ha-tikva* (Hebrew) → *Spero* (Latin) → *Elpio*.
+
+> **Status: alpha (v0.1.0).** All four reconcilers ship: `ElpioService` (Knative/KEDA serving),
+> `ElpioFunction` (Tekton + Buildpacks), `ElpioTask` (KEDA + broker), and `ElpioTenant` (namespace,
+> RBAC, quotas, network isolation). Alongside them: OIDC auth, an admission webhook, a multi-cluster
+> management API, a Helm chart, and CI. CRs emit `status.conditions`, so the sibling agent
+> [Spero](https://github.com/altikva/spero) can supervise and heal them. The kind-based e2e harness
+> is wired and gated behind `ELPIO_E2E=1`.
+
+## Why
+
+Elpio does **not** reimplement a serverless runtime. It's the opinionated, enterprise control
+plane that assembles proven CNCF primitives — **Knative**, **KEDA**, **Tekton**, **cert-manager**,
+**Karpenter** — behind a declarative CRD/operator model. Its value is the enterprise wrapper the
+public clouds don't give you: on-prem security integration, hard multi-tenancy, golden-path
+config, fleet management, and a one-command installer.
+
+## How it works
+
+You declare an `ElpioService`; the **operator** reconciles it onto a serving engine. No SSH, no
+imperative `kubectl apply` scripts — just Kubernetes-native reconciliation.
+
+```yaml
+apiVersion: elpio.io/v1alpha1
+kind: ElpioService
+metadata:
+  name: hello
+spec:
+  image: ghcr.io/knative/helloworld-go:latest
+  scaling: { minScale: 0, maxScale: 10, target: 100, metric: concurrency }
+```
+
+| CRD | Equivalent | Engine |
+|-----|-----------|--------|
+| `ElpioService` | Cloud Run | Knative Serving (default) or KEDA |
+| `ElpioFunction` | Cloud Functions | Tekton + Buildpacks → `ElpioService` |
+| `ElpioTask` | Cloud Tasks | KEDA + broker + dispatcher |
+
+The serving engine is a **strategy** (`ELPIO_ENGINE=knative|keda`) behind one stable CRD —
+Knative for the highest Cloud Run parity, KEDA for a lighter footprint.
+
+## Quickstart
+
+```bash
+pip install elpio                  # the elpio CLI
+
+# point kubectl at any cluster (kind, minikube, GKE, EKS, ...) that has a
+# serving engine installed — Knative Serving (default) or KEDA.
+elpio install                      # applies the CRDs + operator
+elpio deploy -f hello.yaml         # the ElpioService shown above
+elpio services
+```
+
+Working from a clone instead? `task e2e-up` provisions kind + Knative/KEDA, and
+`task operator-run` runs the operator locally (`kopf run -m elpio.operator.handlers`).
+
+## Development
+
+```bash
+task dev      # editable install + dev deps
+task unit     # unit tests (no cluster)
+task lint     # ruff
+task e2e      # end-to-end (needs a kind cluster + Knative/KEDA)
+```
+
+## Layout
+
+```
+src/elpio/
+  models/      ElpioService spec (Pydantic mirror of the CRD)
+  engines/     serving-engine strategy: base + knative + keda
+  providers/   portability seams: StateStore, IdentityProvider
+  operator/    kopf reconciler
+  cli.py       the `elpio` command
+deploy/        CRDs + operator manifests (+ Helm)
+docs/          architecture & guides
+```
+
+## License
+
+Code: [MIT](LICENSE). Docs & branding: [CC-BY-4.0](LICENSE-docs).