feat(wash): workload env/config/secrets by ricochet · Pull Request #5117 · wasmCloud/wasmCloud

ricochet · 2026-05-04T19:42:42Z

Adds a workload: section to .wash/config.yaml with environment
(inline + configFrom + secretFrom), opaque config, and outbound
allowedHosts. Top-level configs: and secrets: carry named
sources of three kinds: inline, file: (.env format), and
fromEnv:. Field shape mirrors WorkloadDeployment.localResources
so the same file can round-trip to a Kubernetes manifest later.

Resolution lives in crates/wash/src/workload.rs. Secrets get a
stricter posture: file paths canonicalized and confined to the
project dir (CVE-2025-62725 class), 0600/0400 mode required on
Unix, gitignore-aware warning when a secret file resolves inside
the repo working tree. Errors and traces reference sources by name
only - resolved values never appear in log output.

wash dev now resolves the workload before deploy and applies the
result to the dev component's LocalResources. The wasi:config
plugin is constructed with copy_environment=true, so workload env
vars surface via both wasi:cli/env and wasi:config/store::get.
workload.config is injected into the wasi:config interface entry
when at least one component in the workload imports it, sidecars
included.

create_workload is split into a thin I/O wrapper plus a pure
build_workload that the unit tests exercise end-to-end. Also fixes
a pre-existing gap by honoring dev.component_path (lets the dev
build command produce its artifact in a different folder than the
release build).

Fixes #5088
Fixes #5099

Builds on #5117 to make this example a complete walkthrough of the new `.wash/config.yaml` schema: an `app-defaults` config-source feeds non-sensitive runtime knobs from `config/defaults.env`, an `upstream-credentials` secret-source pulls `UPSTREAM_API_TOKEN` from the developer's shell via `fromEnv`, `workload.environment.{configFrom,secretFrom}` references both, and `workload.allowedHosts` constrains the outbound call. `workload.config` continues to carry the `otel.resource.*` identity attributes. - New cached `AppConfig` reads `OUTBOUND_HOST`, `request_timeout_ms`, and `UPSTREAM_API_TOKEN` from `wasi:config/store::get_all` once on the first request. Defaults (`example.com`, 5s) apply when keys are absent. - `make_outgoing_request` uses the configured URL, applies the configured timeout to first-byte and between-bytes, and attaches `Authorization: Bearer <token>` when the secret is present. Missing-token paths still work so the example is exercisable without setting `UPSTREAM_API_TOKEN`. - New `log_runtime_config_once` emits a single OTel log line at startup listing every `wasi:config` key visible to the component. Keys only since secret values land in this same map under `copy_environment = true` and the schema's contract is that values are never logged. - Outgoing HTTP span name is now low-cardinality `"outgoing http"`; the host moves to the `url.full` attribute. Signed-off-by: Bailey Hayes <bailey@cosmonic.com>

vados-cosmonic

Did a quick round of review -- I personally am OK with this landing and us iterating on it rather than being stuck in review too long!

In particular I think we can iterate a bit if we land this under flag for early experimentation (but honestly maybe that's too much extra ceremony).

Also, I kind of like the idea of workload::config::X and workload::secrets::Y for interacting with different things related to workloads

Builds on #5117 to make this example a complete walkthrough of the new `.wash/config.yaml` schema: an `app-defaults` config-source feeds non-sensitive runtime knobs from `config/defaults.env`, an `upstream-credentials` secret-source pulls `UPSTREAM_API_TOKEN` from the developer's shell via `fromEnv`, `workload.environment.{configFrom,secretFrom}` references both, and `workload.allowedHosts` constrains the outbound call. `workload.config` continues to carry the `otel.resource.*` identity attributes. - New cached `AppConfig` reads `OUTBOUND_HOST`, `request_timeout_ms`, and `UPSTREAM_API_TOKEN` from `wasi:config/store::get_all` once on the first request. Defaults (`example.com`, 5s) apply when keys are absent. - `make_outgoing_request` uses the configured URL, applies the configured timeout to first-byte and between-bytes, and attaches `Authorization: Bearer <token>` when the secret is present. Missing-token paths still work so the example is exercisable without setting `UPSTREAM_API_TOKEN`. - New `log_runtime_config_once` emits a single OTel log line at startup listing every `wasi:config` key visible to the component. Keys only since secret values land in this same map under `copy_environment = true` and the schema's contract is that values are never logged. - Outgoing HTTP span name is now low-cardinality `"outgoing http"`; the host moves to the `url.full` attribute. Signed-off-by: Bailey Hayes <bailey@cosmonic.com>

Adds a `workload:` section to .wash/config.yaml with `environment` (inline + configFrom + secretFrom), opaque `config`, and outbound `allowedHosts`. Top-level `configs:` and `secrets:` carry named sources of three kinds: `inline`, `file:` (.env format), and `fromEnv:`. Field shape mirrors WorkloadDeployment.localResources so the same file can round-trip to a Kubernetes manifest later. Resolution lives in `crates/wash/src/workload.rs`. Secrets get a stricter posture: file paths canonicalized and confined to the project dir (CVE-2025-62725 class), 0600/0400 mode required on Unix, gitignore-aware warning when a secret file resolves inside the repo working tree. Errors and traces reference sources by name only - resolved values never appear in log output. `wash dev` now resolves the workload before deploy and applies the result to the dev component's LocalResources. The wasi:config plugin is constructed with copy_environment=true, so workload env vars surface via both wasi:cli/env and wasi:config/store::get. `workload.config` is injected into the wasi:config interface entry when at least one component in the workload imports it, sidecars included. create_workload is split into a thin I/O wrapper plus a pure build_workload that the unit tests exercise end-to-end. Also fixes a pre-existing gap by honoring `dev.component_path` (lets the dev build command produce its artifact in a different folder than the release build). Fixes #5088 Fixes #5099 Signed-off-by: Bailey Hayes <bailey@cosmonic.com>

Add a `dev.environment` map that wash dev exports into its own process before constructing the host, so plugins and runtime crates that read from std::env (RUST_LOG, OTEL_*, libpq's PG*, ...) pick the values up. Distinct from workload.environment, which is delivered to the component via wasi:cli/env. It is awkward that we have to add it very early in the main process, since otel is initialized before we have a chance to read the config. Also add the first schema tests for the Config struct, pinning the camelCase contract on WorkloadConfig / EnvironmentLayer / ConfigSource so a future refactor that drops a `rename_all` doesn't silently drop user-configured fields. Signed-off-by: Bailey Hayes <bailey@cosmonic.com>

Replace `Vec<String>` / `Arc<[String]>` for `allowed_hosts` with a typed `AllowedHost` enum so the runtime hot path matches against parsed variants. The wire format stays as `[String]` on both wash YAML and the proto API; parsing happens once at the conversion boundary. The enum has four variants: `Any` (`*`), `Authority(host[:port])`, `Url(scheme://host[:port][/])`, and `SuffixWildcard(*.host)`. Wildcards require a leading dot (`*.foo`, not `*foo`) so `*com` matching every .com is a parse error. URL form rejects paths beyond bare `/`, query strings, and fragments `allowed_hosts` is a host policy, not a URL policy. Runtime semantics change to fail-closed: empty `allowed_hosts` now denies all outgoing requests (was: allow all). The wash config layer substitutes `[Any]` when `allowedHosts` is omitted from YAML via a serde default, so `wash dev` stays ergonomic for users who haven't thought about egress. Explicit `allowedHosts: []` in YAML stays empty and denies. `DevRouter` now calls `check_allowed_hosts` instead of shortcutting so the same policy is applied across both routers. Split `ConfigSource` and `SecretSource` into distinct types with `resolve` methods so the stricter secret-handling posture (Unix mode `0600`/`0400`, `O_NOFOLLOW` open + `fstat` perm check, in-repo-tree warning) can only be applied to secrets. Drops the `secret: bool` parameter from internal resolution helpers. Secret-file open is now TOCTOU-safe via `O_NOFOLLOW` (final-component symlink swap rejected) + `File::metadata()` (`fstat` on Unix, can't be raced by path-based mode swap between check and read). DynamicConfig and WasiOtelConfig adopt `bon::Builder` for forward-compatible construction. Signed-off-by: Bailey Hayes <bailey@cosmonic.com>

Annotate the AllowedHosts field on LocalResources with a regex matching the four accepted forms (`*`, `host[:port]`, `scheme://host[:port][/]`, `*.suffix[:port]`, `scheme://*.suffix[:port][/]`) so K8s admission rejects bad entries before they reach the runtime. Document that empty or absent allowedHosts denies all outgoing requests (fail-closed), matching the runtime's new behavior; users opt into allow-all with `allowedHosts: ["*"]`. Final validation still runs in the runtime. This regex is an admission-time guard, not the source of truth. Regenerated CRDs via `make manifests`. Signed-off-by: Bailey Hayes <bailey@cosmonic.com>

- `integration_http_allowed_hosts`: cover the four AllowedHost shapes end-to-end. Add `test_star_any_permits_all` (literal `*` allows everything), `test_url_policy_pins_scheme` (URL form rejects wrong scheme), and flip `test_empty_allowed_hosts_permits_all` → `test_empty_allowed_hosts_denies_all`. - `integration_http_counter` / `integration_http_tls` / `tests/common`: populate `LocalResources.allowed_hosts` with `["example.com"]` since the http-counter fixture makes outgoing calls to example.com and the empty-list default now denies. Encoding the actual target host documents the test's intent precisely. Signed-off-by: Bailey Hayes <bailey@cosmonic.com>

The fixture now reports the host's policy decision via its own status (200 allowed, 403 denied, 502 connect/DNS error) rather than forwarding the remote server's status. Forwarding made policy denials look identical to remote 4xx responses — wikipedia returning 403 to anonymous clients was failing `test_star_any_permits_all` whenever egress worked. Swap the test targets to IANA-reserved `example.com`, `example.org`, and `www.example.com` so the three match outcomes (exact, unrelated, subdomain) each have a dedicated route and no third-party rate limits or bot detection are in the loop. Signed-off-by: Bailey Hayes <bailey@cosmonic.com>

Builds on #5117 to make this example a complete walkthrough of the new `.wash/config.yaml` schema: an `app-defaults` config-source feeds non-sensitive runtime knobs from `config/defaults.env`, an `upstream-credentials` secret-source pulls `UPSTREAM_API_TOKEN` from the developer's shell via `fromEnv`, `workload.environment.{configFrom,secretFrom}` references both, and `workload.allowedHosts` constrains the outbound call. `workload.config` continues to carry the `otel.resource.*` identity attributes. - New cached `AppConfig` reads `OUTBOUND_HOST`, `request_timeout_ms`, and `UPSTREAM_API_TOKEN` from `wasi:config/store::get_all` once on the first request. Defaults (`example.com`, 5s) apply when keys are absent. - `make_outgoing_request` uses the configured URL, applies the configured timeout to first-byte and between-bytes, and attaches `Authorization: Bearer <token>` when the secret is present. Missing-token paths still work so the example is exercisable without setting `UPSTREAM_API_TOKEN`. - New `log_runtime_config_once` emits a single OTel log line at startup listing every `wasi:config` key visible to the component. Keys only since secret values land in this same map under `copy_environment = true` and the schema's contract is that values are never logged. - Outgoing HTTP span name is now low-cardinality `"outgoing http"`; the host moves to the `url.full` attribute. Signed-off-by: Bailey Hayes <bailey@cosmonic.com>

ricochet requested a review from a team as a code owner May 4, 2026 19:42

ricochet force-pushed the env-secrets branch from 3d0fb7d to ccf3dc0 Compare May 4, 2026 20:26

ricochet mentioned this pull request May 6, 2026

feat(examples/otel-config): demo workload env/config/secrets #5127

Merged

ricochet force-pushed the env-secrets branch 3 times, most recently from 9175614 to 7339efb Compare May 6, 2026 15:34

ricochet force-pushed the env-secrets branch 2 times, most recently from 2e83733 to 045bb71 Compare May 7, 2026 02:30

This was referenced May 11, 2026

feat(wash): extend config command with init formats, cleanup, and validation #5140

Merged

fix: preserve wash dev postgres config #5080

Open

ricochet requested a review from vados-cosmonic May 13, 2026 20:58

vados-cosmonic reviewed May 14, 2026

View reviewed changes

ricochet force-pushed the env-secrets branch from 045bb71 to 95b5097 Compare May 18, 2026 19:43

ricochet requested a review from a team as a code owner May 18, 2026 19:43

ricochet force-pushed the env-secrets branch 2 times, most recently from e4238a7 to f980925 Compare May 18, 2026 20:17

jfleitz previously approved these changes May 18, 2026

View reviewed changes

ricochet dismissed jfleitz’s stale review via c3cc5ff May 19, 2026 01:01

ricochet force-pushed the env-secrets branch 2 times, most recently from c3cc5ff to 9f38978 Compare May 19, 2026 01:21

vados-cosmonic self-requested a review May 19, 2026 15:06

vados-cosmonic previously approved these changes May 19, 2026

View reviewed changes

ricochet dismissed vados-cosmonic’s stale review via 554d069 May 19, 2026 18:37

ricochet force-pushed the env-secrets branch from 554d069 to 4b4f498 Compare May 19, 2026 18:52

ricochet added 3 commits May 20, 2026 20:49

ricochet force-pushed the env-secrets branch from 4b4f498 to d634cf7 Compare May 21, 2026 00:50

ricochet merged commit f7f97ad into main May 21, 2026
57 checks passed

ricochet deleted the env-secrets branch May 21, 2026 22:02

ericgregory mentioned this pull request Jun 8, 2026

docs: cover wasmCloud 2.3.0 features wasmCloud/wasmcloud.com#1189

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(wash): workload env/config/secrets#5117

feat(wash): workload env/config/secrets#5117
ricochet merged 6 commits into
mainfrom
env-secrets

ricochet commented May 4, 2026 •

edited

Loading

Uh oh!

vados-cosmonic left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

ricochet commented May 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

vados-cosmonic left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ricochet commented May 4, 2026 •

edited

Loading