wasi/k8s: add host module for doing k8 lookups

Dockerfile.atc

@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine AS builder
+FROM golang:1.24-alpine AS builder
 
 WORKDIR /app
 

Dockerfile.yokecd

@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine
+FROM golang:1.24-alpine
 
 WORKDIR /cmp
 

Taskfile.yml

@@ -46,12 +46,12 @@ tasks:
 
   kube:
     cmds:
-      - GOOS=wasip1 GOARCH=wasm go build -o kube.wasm ./cmd/examples/kube
+      - GOOS=wasip1 GOARCH=wasm go build -o basic.wasm ./examples/basic
 
   pg:
     cmds:
-      - GOOS=wasip1 GOARCH=wasm go build -o pg.wasm ./cmd/examples/pg
+      - GOOS=wasip1 GOARCH=wasm go build -o pg.wasm ./examples/embeddedfs
 
   redis:
     cmds:
-      - GOOS=wasip1 GOARCH=wasm go build -o redis.wasm ./cmd/examples/redis
+      - GOOS=wasip1 GOARCH=wasm go build -o redis.wasm ./examples/redis

cmd/atc-installer/installer/run.go

@@ -5,6 +5,7 @@ import (
 	"crypto/sha1"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"maps"
 	"os"
@@ -23,6 +24,7 @@ import (
 
 	"github.com/yokecd/yoke/pkg/apis/airway/v1alpha1"
 	"github.com/yokecd/yoke/pkg/flight"
+	"github.com/yokecd/yoke/pkg/flight/wasi/k8s"
 	"github.com/yokecd/yoke/pkg/openapi"
 )
 
@@ -34,6 +36,7 @@ type Config struct {
 	Port               int               `json:"port"`
 	ServiceAccountName string            `json:"serviceAccountName"`
 	ImagePullPolicy    corev1.PullPolicy `json:"ImagePullPolicy"`
+	GenerateTLS        bool              `json:"generateTLS"`
 }
 
 var (
@@ -140,7 +143,34 @@ func Run(cfg Config) error {
 		},
 	}
 
-	tls, err := NewTLS(svc)
+	const (
+		keyRootCA     = "ca.crt"
+		keyServerCert = "server.crt"
+		keyServerKey  = "server.key"
+	)
+
+	tls, err := func() (*TLS, error) {
+		if cfg.GenerateTLS {
+			return NewTLS(svc)
+		}
+		secret, err := k8s.Lookup[corev1.Secret](k8s.ResourceIdentifier{
+			Name:       flight.Release() + "-tls",
+			Namespace:  flight.Namespace(),
+			Kind:       "Secret",
+			ApiVersion: "v1",
+		})
+		if err != nil && !k8s.IsErrNotFound(err) && !errors.Is(err, k8s.ErrorClusterAccessNotGranted) {
+			return nil, fmt.Errorf("failed to lookup tls secret: %T: %v", err, err)
+		}
+		if secret != nil {
+			return &TLS{
+				RootCA:     secret.Data[keyRootCA],
+				ServerCert: secret.Data[keyServerCert],
+				ServerKey:  secret.Data[keyServerKey],
+			}, nil
+		}
+		return NewTLS(svc)
+	}()
 	if err != nil {
 		return err
 	}
@@ -155,9 +185,9 @@ func Run(cfg Config) error {
 			Namespace: flight.Namespace(),
 		},
 		Data: map[string][]byte{
-			"ca.crt":     tls.RootCA,
-			"server.crt": tls.ServerCert,
-			"server.key": tls.ServerKey,
+			keyRootCA:     tls.RootCA,
+			keyServerCert: tls.ServerCert,
+			keyServerKey:  tls.ServerKey,
 		},
 	}
 

cmd/atc/internal/testing/Dockerfile.wasmcache

@@ -1,4 +1,4 @@
-FROM golang:1.23-alpine AS builder
+FROM golang:1.24-alpine AS builder
 
 WORKDIR /app
 

cmd/atc/main_test.go

@@ -382,16 +382,14 @@ func TestAirTrafficController(t *testing.T) {
 		"failed to detect new Backend version",
 	)
 
-	// ALthough we create a v1 version we will be able to fetch it as a v2  version.
+	// Although we create a v1 version we will be able to fetch it as a v2 version.
 	require.NoError(
 		t,
 		commander.Takeoff(ctx, yoke.TakeoffParams{
 			Release: "c4ts",
 			Flight: yoke.FlightParams{
 				Input: testutils.JsonReader(backendv1.Backend{
-					ObjectMeta: metav1.ObjectMeta{
-						Name: "c4ts",
-					},
+					ObjectMeta: metav1.ObjectMeta{Name: "c4ts"},
 					Spec: backendv1.BackendSpec{
 						Image:    "yokecd/c4ts:test",
 						Replicas: 1,