plinth-cli 0.2.0__py3-none-any.whl

plinth/__init__.py

@@ -0,0 +1 @@
+"""plinth: generate ready-to-push application and GitOps repositories from one config."""

plinth/__main__.py

@@ -0,0 +1,5 @@
+import sys
+
+from plinth.cli import main
+
+sys.exit(main())

plinth/add.py

@@ -0,0 +1,97 @@
+"""`plinth add`: grow an existing project with a new service or worker.
+
+Only files that belong to the new workload are created. Existing files are never
+overwritten; ones that plinth would now generate differently are reported so the
+user can review them.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from plinth import config as defaults
+from plinth.loader import ConfigError, config_to_dict, dump_config, load_config, parse_config
+from plinth.plan import build_plan
+from plinth.render import render_plan
+from plinth.schema import AppKind, Architecture, ProjectConfig
+from plinth.write import init_repo, write_tree
+
+
+@dataclass
+class AddResult:
+    config: ProjectConfig
+    created: list[str] = field(default_factory=list)
+    kept: list[str] = field(default_factory=list)
+    new_repos: list[str] = field(default_factory=list)
+    notes: list[str] = field(default_factory=list)
+    warnings: list[str] = field(default_factory=list)
+
+
+def add_application(
+    project_dir: Path, kind: AppKind, name: str, port: int | None = None, init_git: bool = True
+) -> AddResult:
+    config_path = project_dir / defaults.CONFIG_FILENAME
+    old = load_config(config_path)
+    data = config_to_dict(old)
+    notes = []
+
+    if kind is AppKind.MODULAR_MONOLITH:
+        raise ConfigError("a project has exactly one modular-monolith; add a service or worker")
+    if old.project.architecture is Architecture.MODULAR_MONOLITH:
+        data["project"]["architecture"] = Architecture.HYBRID.value
+        notes.append("architecture changed from modular-monolith to hybrid")
+
+    app = {"name": name, "kind": kind.value}
+    if port is not None:
+        app["port"] = port
+    data["applications"].append(app)
+    new = parse_config(data, source=str(config_path))
+
+    old_plan, new_plan = build_plan(old), build_plan(new)
+    old_folders = {r.folder for r in old_plan.repos}
+    files = render_plan(new_plan)
+    result = AddResult(config=new, notes=notes)
+
+    new_repos = [r for r in new_plan.repos if r.folder not in old_folders]
+    for repo in new_repos:
+        if (project_dir / repo.folder).exists():
+            raise ConfigError(f"cannot create repository folder, it already exists: {repo.folder}")
+
+    owned = _new_workload_prefixes(new_plan, name)
+    to_write = {}
+    for rel, content in sorted(files.items()):
+        folder = rel.split("/", 1)[0]
+        dest = project_dir / rel
+        if folder not in old_folders or rel.startswith(owned):
+            if dest.exists():
+                if dest.read_bytes() != content:
+                    result.kept.append(rel)
+                continue
+            to_write[rel] = content
+            result.created.append(rel)
+        elif dest.exists() and dest.read_bytes() != content:
+            result.kept.append(rel)
+
+    write_tree(project_dir, to_write)
+    config_path.write_text(dump_config(new), encoding="utf-8")
+
+    for repo in new_repos:
+        result.new_repos.append(repo.folder)
+        if init_git:
+            warning = init_repo(project_dir / repo.folder, repo.url)
+            if warning:
+                result.warnings.append(warning)
+    return result
+
+
+def _new_workload_prefixes(plan, name: str) -> tuple[str, ...]:
+    prefixes = [
+        f"{repo.folder}/{wl.source_dir}"
+        for repo, wl in plan.workloads()
+        if wl.name == name and wl.source_dir
+    ]
+    prefixes += [
+        f"{plan.gitops.folder}/environments/{env}/{name}/" for env in plan.config.environments
+    ]
+    return tuple(prefixes)

plinth/blueprints/ci/github/dot-github/workflows/ci.yaml.j2

@@ -0,0 +1,38 @@
+name: ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: {{ defaults.CHECKOUT_ACTION }}
+
+      - name: Test
+        if: github.event_name == 'pull_request'
+        uses: {{ defaults.DAGGER_GITHUB_ACTION }}
+        with:
+          version: "{{ defaults.DAGGER_VERSION }}"
+          call: test
+
+      - name: Ship
+        if: github.event_name == 'push'
+        uses: {{ defaults.DAGGER_GITHUB_ACTION }}
+        env:
+          REGISTRY_PASSWORD: {{ "${{ secrets.REGISTRY_PASSWORD || secrets.GITHUB_TOKEN }}" }}
+          GITOPS_TOKEN: {{ "${{ secrets.GITOPS_TOKEN }}" }}
+        with:
+          version: "{{ defaults.DAGGER_VERSION }}"
+          call: >-
+            ship
+            --commit={{ "${{ github.sha }}" }}
+            --registry-username={{ "${{ vars.REGISTRY_USERNAME || github.actor }}" }}
+            --registry-password=env://REGISTRY_PASSWORD
+            --git-token=env://GITOPS_TOKEN

plinth/blueprints/ci/gitlab/dot-gitlab-ci.yml.j2

@@ -0,0 +1,36 @@
+stages: [test, ship]
+
+.dagger:
+  image: {{ defaults.DOCKER_IMAGE }}
+  services:
+    - {{ defaults.DOCKER_IMAGE }}-dind
+  variables:
+    DOCKER_HOST: tcp://docker:2376
+    DOCKER_TLS_CERTDIR: /certs
+    DOCKER_TLS_VERIFY: "1"
+    DOCKER_CERT_PATH: /certs/client
+    DAGGER_VERSION: "{{ defaults.DAGGER_VERSION }}"
+  before_script:
+    - apk add --no-cache curl
+    - curl -fsSL https://dl.dagger.io/dagger/install.sh | BIN_DIR=/usr/local/bin sh
+
+test:
+  extends: .dagger
+  stage: test
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+  script:
+    - dagger call test
+
+ship:
+  extends: .dagger
+  stage: ship
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+  script:
+    - >-
+      dagger call ship
+      --commit=$CI_COMMIT_SHA
+      --registry-username=$REGISTRY_USERNAME
+      --registry-password=env://REGISTRY_PASSWORD
+      --git-token=env://GITOPS_TOKEN

plinth/blueprints/gitops/applicationset.yaml.j2

@@ -0,0 +1,46 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: {{ project.name }}-{{ environment }}
+  namespace: argocd
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+    - git:
+        repoURL: {{ repo.url }}
+        revision: HEAD
+        files:
+          - path: environments/{{ environment }}/*/release.yaml
+  template:
+    metadata:
+      name: '{{ project.name }}-{% raw %}{{ .workload }}{% endraw %}-{{ environment }}'
+    spec:
+      project: {{ project.name }}
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: {{ project.name }}-{{ environment }}
+      sources:
+        - repoURL: {{ repo.url }}
+          targetRevision: HEAD
+          path: charts/workload
+          helm:
+            releaseName: '{% raw %}{{ .workload }}{% endraw %}'
+            valueFiles:
+              - '$app/{% raw %}{{ .scorePath }}{% endraw %}'
+              - '$gitops/environments/{{ environment }}/{% raw %}{{ .workload }}{% endraw %}/values.yaml'
+            parameters:
+              - name: image
+                value: '{% raw %}{{ .image }}{% endraw %}'
+        - repoURL: '{% raw %}{{ .appRepoURL }}{% endraw %}'
+          targetRevision: '{% raw %}{{ .revision }}{% endraw %}'
+          ref: app
+        - repoURL: {{ repo.url }}
+          targetRevision: HEAD
+          ref: gitops
+      syncPolicy:
+        automated:
+          prune: false
+          selfHeal: true
+        syncOptions:
+          - CreateNamespace=true

plinth/blueprints/gitops/values.yaml.j2

@@ -0,0 +1,2 @@
+# {{ workload.name }} in {{ environment }}. Merged over the workload's score.yaml.
+replicas: {{ defaults.REPLICAS.get(environment, defaults.DEFAULT_REPLICAS) }}

plinth/blueprints/repo/app/README.md.j2

@@ -0,0 +1,63 @@
+# {{ repo.folder }}
+
+Application repository for **{{ project.name }}** ({{ project.architecture }}, {{ project.layout }}).
+Generated by [plinth](https://github.com/dfoshidero/plinth).
+
+## Workloads
+
+{% for wl in repo.workloads %}
+- `{{ wl.name }}` ({{ wl.kind }}): source in `{{ wl.source_dir or "./" }}`, workload spec in `{{ wl.score_path }}`
+{% endfor %}
+
+Each workload is described by a [Score](https://score.dev) file (`score.yaml`). The CI pipeline
+finds workloads by looking for those files, and the GitOps repo's Helm chart deploys them.
+
+## Run locally
+
+```sh
+{% for wl in repo.workloads %}
+(cd {{ wl.source_dir or "." }} && python -m app.main)   # {{ wl.name }}{% if wl.port %}, http://localhost:{{ wl.port }}{{ defaults.HEALTH_PATH }}{% endif %}
+
+{% endfor %}
+```
+
+Tests use the standard library:
+
+```sh
+{% for wl in repo.workloads %}
+(cd {{ wl.source_dir or "." }} && python -m unittest discover -s tests -t .)
+{% endfor %}
+```
+
+## CI with Dagger
+
+The pipeline lives in `.dagger/` and runs the same way locally and in CI
+(needs [Dagger](https://docs.dagger.io) {{ defaults.DAGGER_VERSION }} and Docker):
+
+```sh
+dagger call workloads           # list discovered workloads
+dagger call test                # run every workload's tests
+dagger call build --workload=NAME
+dagger call ship --commit=$(git rev-parse HEAD) \
+  --registry-username=USER --registry-password=env://REGISTRY_PASSWORD \
+  --git-token=env://GITOPS_TOKEN
+```
+
+`ship` tests, pushes `{{ project.registry }}/{{ project.name }}-<workload>:<commit>` for each workload,
+then commits `environments/{{ defaults.RELEASE_ENVIRONMENT }}/<workload>/release.yaml` to
+[{{ plan.gitops.folder }}]({{ plan.gitops.url }}). Argo CD deploys from there.
+
+{% if project.git_provider.value == "github" %}
+`.github/workflows/ci.yaml` runs `test` on pull requests and `ship` on pushes to `main`. Set these
+repository secrets:
+
+- `GITOPS_TOKEN`: a token that can push to `{{ plan.gitops.folder }}`
+- `REGISTRY_PASSWORD`: only if the registry is not `ghcr.io` (otherwise `GITHUB_TOKEN` is used)
+
+and, for registries other than `ghcr.io`, the repository variable `REGISTRY_USERNAME`.
+{% elif project.git_provider.value == "gitlab" %}
+`.gitlab-ci.yml` runs `test` on merge requests and `ship` on pushes to the default branch. Set these
+CI/CD variables (masked): `GITOPS_TOKEN`, `REGISTRY_USERNAME`, `REGISTRY_PASSWORD`.
+{% else %}
+No CI provider file was generated. Run the `dagger call` commands above from your CI system.
+{% endif %}

plinth/blueprints/repo/app/dagger.json.j2

@@ -0,0 +1,8 @@
+{
+  "name": "ci",
+  "engineVersion": "v{{ defaults.DAGGER_VERSION }}",
+  "sdk": {
+    "source": "python"
+  },
+  "source": ".dagger"
+}

plinth/blueprints/repo/app/dot-dagger/dot-gitignore

@@ -0,0 +1,3 @@
+/sdk
+/.venv
+__pycache__/

plinth/blueprints/repo/app/dot-dagger/pyproject.toml

@@ -0,0 +1,12 @@
+[project]
+name = "ci"
+version = "0.1.0"
+requires-python = ">=3.12"
+dependencies = ["dagger-io", "pyyaml>=6,<7"]
+
+[tool.uv.sources]
+dagger-io = { path = "sdk", editable = true }
+
+[build-system]
+requires = ["hatchling"]
+build-backend = "hatchling.build"

plinth/blueprints/repo/app/dot-dagger/src/ci/__init__.py

@@ -0,0 +1,3 @@
+"""CI pipeline for this repository. Run `dagger functions` to list entry points."""
+
+from .main import Ci as Ci

plinth/blueprints/repo/app/dot-dagger/src/ci/main.py.j2

@@ -0,0 +1,133 @@
+"""Test, build, publish and release every workload in this repository.
+
+Workloads are discovered from their score.yaml files, so adding one needs no change here.
+"""
+
+from __future__ import annotations
+
+import posixpath
+from typing import Annotated
+
+import dagger
+import yaml
+from dagger import DefaultPath, Doc, dag, function, object_type
+
+PROJECT = "{{ project.name }}"
+REGISTRY = "{{ project.registry }}"
+APP_REPO_URL = "{{ repo.url }}"
+GITOPS_REPO_URL = "{{ plan.gitops.url }}"
+RELEASE_ENVIRONMENT = "{{ defaults.RELEASE_ENVIRONMENT }}"
+GIT_TOKEN_USER = "{{ git_token_user }}"
+PYTHON_IMAGE = "{{ defaults.PYTHON_IMAGE }}"
+GIT_IMAGE = "{{ defaults.GIT_IMAGE }}"
+
+Source = Annotated[dagger.Directory, DefaultPath("/"), Doc("repository root")]
+
+RELEASE_SCRIPT = r"""
+set -eu
+git clone -q --depth 1 "https://${GIT_TOKEN_USER}:${GIT_TOKEN}@${GITOPS_REPO_URL#https://}" /gitops
+cp -R /release/. /gitops/
+cd /gitops
+git config user.name "${PROJECT} CI"
+git config user.email "ci@${PROJECT}.invalid"
+git add -A
+if git diff --cached --quiet; then echo "nothing to release"; exit 0; fi
+git commit -q -m "release: ${RELEASE_SUMMARY}"
+git push -q origin HEAD
+"""
+
+
+@object_type
+class Ci:
+    @function
+    async def workloads(self, source: Source) -> list[str]:
+        """List discovered workloads as name=directory."""
+        return [f"{name}={path}" for name, path in await _discover(source)]
+
+    @function
+    async def test(self, source: Source) -> str:
+        """Run every workload's unit tests."""
+        reports = []
+        for name, path in await _discover(source):
+            report = await (
+                dag.container()
+                .from_(PYTHON_IMAGE)
+                .with_directory("/src", source.directory(path))
+                .with_workdir("/src")
+                .with_exec(["python", "-m", "unittest", "discover", "-s", "tests", "-t", ".", "-v"])
+                .stderr()
+            )
+            reports.append(f"== {name}\n{report}")
+        return "\n".join(reports)
+
+    @function
+    async def build(
+        self, workload: Annotated[str, Doc("workload name")], source: Source
+    ) -> dagger.Container:
+        """Build one workload's container image."""
+        paths = dict(await _discover(source))
+        if workload not in paths:
+            raise ValueError(f"unknown workload {workload!r}; known: {', '.join(paths)}")
+        return source.directory(paths[workload]).docker_build()
+
+    @function
+    async def ship(
+        self,
+        commit: Annotated[str, Doc("commit SHA being shipped; used as image tag and app revision")],
+        registry_username: str,
+        registry_password: dagger.Secret,
+        git_token: Annotated[dagger.Secret, Doc("token that can push to the GitOps repository")],
+        source: Source,
+    ) -> str:
+        """Test, publish every image, then record the release in the GitOps repository."""
+        await self.test(source)
+        registry_host = REGISTRY.split("/", 1)[0]
+        release = dag.directory()
+        published, names = [], []
+        for name, path in await _discover(source):
+            ref = await (
+                source.directory(path)
+                .docker_build()
+                .with_registry_auth(registry_host, registry_username, registry_password)
+                .publish(f"{REGISTRY}/{PROJECT}-{name}:{commit}")
+            )
+            record = {
+                "workload": name,
+                "image": ref,
+                "revision": commit,
+                "appRepoURL": APP_REPO_URL,
+                "scorePath": "score.yaml" if path == "." else posixpath.join(path, "score.yaml"),
+            }
+            release = release.with_new_file(
+                f"environments/{RELEASE_ENVIRONMENT}/{name}/release.yaml",
+                yaml.safe_dump(record, sort_keys=False),
+            )
+            published.append(ref)
+            names.append(name)
+
+        await (
+            dag.container()
+            .from_(GIT_IMAGE)
+            .with_exec(["apk", "add", "--no-cache", "git"])
+            .with_directory("/release", release)
+            .with_env_variable("GITOPS_REPO_URL", GITOPS_REPO_URL)
+            .with_env_variable("GIT_TOKEN_USER", GIT_TOKEN_USER)
+            .with_env_variable("PROJECT", PROJECT)
+            .with_env_variable("RELEASE_SUMMARY", f"{', '.join(names)} {commit[:12]}")
+            .with_secret_variable("GIT_TOKEN", git_token)
+            .with_exec(["sh", "-c", RELEASE_SCRIPT])
+            .sync()
+        )
+        return "\n".join(published)
+
+
+async def _discover(source: dagger.Directory) -> list[tuple[str, str]]:
+    found = []
+    for path in sorted(await source.glob("**/score.yaml")):
+        if path.startswith(".dagger/"):
+            continue
+        spec = yaml.safe_load(await source.file(path).contents())
+        found.append((spec["metadata"]["name"], posixpath.dirname(path) or "."))
+    if not found:
+        raise ValueError("no score.yaml found; nothing to do")
+    return found

plinth/blueprints/repo/app/dot-gitignore

@@ -0,0 +1,4 @@
+__pycache__/
+*.pyc
+.venv/
+.env

plinth/blueprints/repo/gitops/README.md.j2

@@ -0,0 +1,53 @@
+# {{ repo.folder }}
+
+GitOps repository for **{{ project.name }}**. It holds desired deployed state only; Argo CD
+syncs it into the cluster. Generated by [plinth](https://github.com/dfoshidero/plinth).
+
+## Layout
+
+```
+bootstrap/root.yaml          app-of-apps: point Argo CD here once
+apps/project.yaml            Argo CD project scoping repos and namespaces
+apps/<env>.yaml              one ApplicationSet per environment
+charts/workload/             Helm chart that deploys a Score workload
+environments/<env>/<workload>/
+  values.yaml                per-environment overrides (replicas, ...)
+  release.yaml               written by CI: image, app revision, score path
+```
+
+Environments: {{ config.environments | join(", ") }}. Each deploys into namespace `{{ project.name }}-<env>`.
+
+An ApplicationSet creates one Argo CD Application per `release.yaml` it finds. Each Application
+renders `charts/workload` with the workload's `score.yaml` (read from its app repo at the released
+commit) plus this repo's `values.yaml`, and the released image.
+
+## Workloads
+
+{% for app_repo, wl in plan.workloads() %}
+- `{{ wl.name }}` ({{ wl.kind }}) from [{{ app_repo.folder }}]({{ app_repo.url }}), `{{ wl.score_path }}`
+{% endfor %}
+
+## Releasing and promoting
+
+CI in each app repo writes `environments/{{ defaults.RELEASE_ENVIRONMENT }}/<workload>/release.yaml` on every
+push to main, so `{{ defaults.RELEASE_ENVIRONMENT }}` always runs the latest build. To promote, copy that file to
+another environment and merge it:
+
+```sh
+cp environments/{{ defaults.RELEASE_ENVIRONMENT }}/api/release.yaml environments/production/api/release.yaml
+```
+
+Nothing deploys to an environment until its `release.yaml` exists.
+
+## Run it locally
+
+Needs Docker, [k3d](https://k3d.io), kubectl and Helm:
+
+```sh
+./scripts/bootstrap-local.sh
+```
+
+This creates a k3d cluster, installs Argo CD (chart {{ defaults.ARGO_CD_CHART_VERSION }}) and applies
+`bootstrap/root.yaml`. Push this repo and the app repos first; Argo CD reads them from
+`{{ project.git_base_url }}`. For private repositories, give Argo CD read access, e.g.
+`argocd repocreds add {{ project.git_base_url }} --username USER --password TOKEN`.

plinth/blueprints/repo/gitops/apps/project.yaml.j2

@@ -0,0 +1,15 @@
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: {{ project.name }}
+  namespace: argocd
+spec:
+  description: Workloads for {{ project.name }}
+  sourceRepos:
+    - "{{ project.git_base_url }}/{{ project.name }}-*"
+  destinations:
+    - server: https://kubernetes.default.svc
+      namespace: "{{ project.name }}-*"
+  clusterResourceWhitelist:
+    - group: ""
+      kind: Namespace

plinth/blueprints/repo/gitops/bootstrap/root.yaml.j2

@@ -0,0 +1,20 @@
+# Apply once: kubectl apply -n argocd -f bootstrap/root.yaml
+# Argo CD then manages everything under apps/.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ project.name }}-root
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: {{ repo.url }}
+    targetRevision: HEAD
+    path: apps
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true

plinth/blueprints/repo/gitops/charts/workload/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v2
+name: workload
+description: Deploys one workload described by a Score file (score.dev/v1b1).
+type: application
+version: 0.1.0

plinth/blueprints/repo/gitops/charts/workload/templates/_helpers.tpl

@@ -0,0 +1,13 @@
+{{- define "workload.name" -}}
+{{- required "metadata.name is required: pass the workload's score.yaml as values" (.Values.metadata | default dict).name -}}
+{{- end -}}
+
+{{- define "workload.selector" -}}
+app.kubernetes.io/name: {{ include "workload.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}
+
+{{- define "workload.labels" -}}
+{{ include "workload.selector" . }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}

plinth/blueprints/repo/gitops/charts/workload/templates/deployment.yaml

@@ -0,0 +1,61 @@
+{{- $main := required "containers.main is required in score.yaml" (index (.Values.containers | default dict) "main") -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "workload.name" . }}
+  labels:
+    {{- include "workload.labels" . | nindent 4 }}
+spec:
+  replicas: {{ .Values.replicas }}
+  selector:
+    matchLabels:
+      {{- include "workload.selector" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "workload.selector" . | nindent 8 }}
+    spec:
+      securityContext:
+        runAsNonRoot: true
+      containers:
+        - name: main
+          image: {{ required "image is required" .Values.image | quote }}
+          {{- with $main.command }}
+          command:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $main.args }}
+          args:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $main.variables }}
+          env:
+            {{- range $name, $value := . }}
+            - name: {{ $name }}
+              value: {{ $value | quote }}
+            {{- end }}
+          {{- end }}
+          {{- with .Values.service }}
+          {{- with .ports }}
+          ports:
+            {{- range $name, $port := . }}
+            - name: {{ $name }}
+              containerPort: {{ $port.targetPort | default $port.port }}
+              protocol: {{ $port.protocol | default "TCP" }}
+            {{- end }}
+          {{- end }}
+          {{- end }}
+          {{- with $main.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $main.livenessProbe }}
+          livenessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with $main.readinessProbe }}
+          readinessProbe:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          securityContext:
+            allowPrivilegeEscalation: false

plinth/blueprints/repo/gitops/charts/workload/templates/service.yaml

@@ -0,0 +1,20 @@
+{{- with .Values.service }}
+{{- with .ports }}
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "workload.name" $ }}
+  labels:
+    {{- include "workload.labels" $ | nindent 4 }}
+spec:
+  selector:
+    {{- include "workload.selector" $ | nindent 4 }}
+  ports:
+    {{- range $name, $port := . }}
+    - name: {{ $name }}
+      port: {{ $port.port }}
+      targetPort: {{ $port.targetPort | default $port.port }}
+      protocol: {{ $port.protocol | default "TCP" }}
+    {{- end }}
+{{- end }}
+{{- end }}

plinth/blueprints/repo/gitops/charts/workload/values.yaml

@@ -0,0 +1,9 @@
+# Each release passes, in order:
+#   1. the workload's score.yaml (metadata, containers.main, service)
+#   2. environments/<env>/<workload>/values.yaml (replicas, ...)
+#   3. image, set from release.yaml
+# Supported Score fields: metadata.name, containers.main (command, args, variables,
+# resources, livenessProbe, readinessProbe) and service.ports. Score `resources`
+# (databases, queues, ...) are not provisioned by this chart.
+image: ""
+replicas: 1