Add AWS CLI and environment patch

Dockerfile

@@ -10,13 +10,12 @@ ARG GO_VERSION=1
 # architecture that we're building the function for.
 FROM --platform=${BUILDPLATFORM} golang:${GO_VERSION} AS build
 
-RUN apt-get update && apt-get install -y coreutils jq unzip zsh
-RUN mkdir /scripts && chown 2000:2000 /scripts
+RUN apt-get update && apt-get install -y coreutils jq unzip zsh less
+RUN mkdir /scripts /.aws && chown 2000:2000 /scripts /.aws
 
-# TODO: Install awscli, gcloud
-# RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip" && \
-#	unzip "/tmp/awscliv2.zip" && \
-#	./aws/install
+RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "/tmp/awscliv2.zip" && \
+	unzip "/tmp/awscliv2.zip" && \
+	./aws/install
 
 WORKDIR /fn
 
@@ -52,6 +51,7 @@ FROM gcr.io/distroless/python3-debian12 AS image
 
 WORKDIR /
 COPY --from=build --chown=2000:2000 /scripts /scripts
+COPY --from=build --chown=2000:2000 /.aws /.aws
 
 COPY --from=build /bin /bin
 COPY --from=build /etc /etc

air.toml

@@ -0,0 +1,5 @@
+# air.toml
+root = "."
+tmp_dir = "tmp"
+build_cmd = "go build -o ./tmp/main ."
+run_cmd = "./tmp/main"

env.go

@@ -2,9 +2,17 @@ package main
 
 import (
 	"encoding/json"
+	"fmt"
 	"os"
+	"regexp"
 
 	"github.com/crossplane-contrib/function-shell/input/v1alpha1"
+	"github.com/crossplane/crossplane-runtime/pkg/errors"
+	"github.com/crossplane/crossplane-runtime/pkg/fieldpath"
+	fnv1beta1 "github.com/crossplane/function-sdk-go/proto/v1beta1"
+	"github.com/crossplane/function-sdk-go/request"
+	"github.com/crossplane/function-sdk-go/resource"
+	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 )
 
 func addShellEnvVarsFromRef(envVarsRef v1alpha1.ShellEnvVarsRef, shellEnvVars map[string]string) (map[string]string, error) {
@@ -19,3 +27,34 @@ func addShellEnvVarsFromRef(envVarsRef v1alpha1.ShellEnvVarsRef, shellEnvVars ma
 	}
 	return shellEnvVars, nil
 }
+
+func fromValueRef(req *fnv1beta1.RunFunctionRequest, path string) (string, error) {
+	// Check for context key presence and capture context key and path
+	contextRegex := regexp.MustCompile(`^context\[(.+?)].(.+)$`)
+	if match := contextRegex.FindStringSubmatch(path); match != nil {
+		if v, ok := request.GetContextKey(req, match[1]); ok {
+			context := &unstructured.Unstructured{}
+			if err := resource.AsObject(v.GetStructValue(), context); err != nil {
+				return "", errors.Wrapf(err, "cannot convert context to %s", v)
+			}
+			value, err := fieldpath.Pave(context.Object).GetValue(match[2])
+			if err != nil {
+				return "", errors.Wrapf(err, "cannot get context value at %s", match[2])
+			}
+			return fmt.Sprintf("%v", value), nil
+		}
+
+	} else {
+		oxr, err := request.GetObservedCompositeResource(req)
+		if err != nil {
+			return "", errors.Wrapf(err, "cannot get observed composite resource from %T", req)
+		}
+		value, err := oxr.Resource.GetValue(path)
+		if err != nil {
+			return "", errors.Wrapf(err, "cannot get observed composite value at %s", path)
+		}
+		return fmt.Sprintf("%v", value), nil
+
+	}
+	return "", nil
+}

example/aws/composition.yaml

@@ -0,0 +1,48 @@
+apiVersion: apiextensions.crossplane.io/v1
+kind: Composition
+metadata:
+  name: shell-example
+spec:
+  compositeTypeRef:
+    apiVersion: example.crossplane.io/v1
+    kind: XR
+  mode: Pipeline
+  pipeline:
+    - step: pull-extra-resources
+      functionRef:
+        name: function-extra-resources
+      input:
+        apiVersion: extra-resources.fn.crossplane.io/v1beta1
+        kind: Input
+        spec:
+          extraResources:
+            - kind: ProviderConfig
+              into: ProviderConfig
+              apiVersion: aws.upbound.io/v1beta1
+              type: Selector
+              selector:
+                maxMatch: 1
+                minMatch: 1
+                matchLabels:
+                - key: account
+                  type: Value
+                  value: demo
+    - step: shell
+      functionRef:
+        name: function-shell
+      input:
+        apiVersion: shell.fn.crossplane.io/v1alpha1
+        kind: Parameters
+        shellEnvVars:
+          - key: AWS_ROLE_ARN
+            value: arn:aws:iam::00000001:role/Crossplane
+          - key: AWS_ASSUME_ROLE_ARN
+            valueRef: "context[apiextensions.crossplane.io/extra-resources].ProviderConfig[0].spec.assumeRoleChain[0].roleARN"
+        shellCommand: |
+          ASSUME_ROLE_OUTPUT=$(aws sts assume-role --role-arn $AWS_ASSUME_ROLE_ARN --role-session-name "function-shell")
+          export AWS_ACCESS_KEY_ID=$(echo $ASSUME_ROLE_OUTPUT | grep -o '"AccessKeyId": "[^"]*"' | cut -d'"' -f4)
+          export AWS_SECRET_ACCESS_KEY=$(echo $ASSUME_ROLE_OUTPUT | grep -o '"SecretAccessKey": "[^"]*"' | cut -d'"' -f4)
+          export AWS_SESSION_TOKEN=$(echo $ASSUME_ROLE_OUTPUT | grep -o '"SessionToken": "[^"]*"' | cut -d'"' -f4)
+          aws eks list-clusters | jq -r '.clusters[0]'
+        stdoutField: status.atFunction.shell.stdout
+        stderrField: status.atFunction.shell.stderr

example/aws/extra-resources.yaml

@@ -0,0 +1,11 @@
+apiVersion: aws.upbound.io/v1beta1
+kind: ProviderConfig
+metadata:
+  labels:
+    account: demo
+  name: demo
+spec:
+  assumeRoleChain:
+    - roleARN: arn:aws:iam::00000002:role/Crossplane
+  credentials:
+    source: IRSA

example/aws/functions.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: pkg.crossplane.io/v1beta1
+kind: Function
+metadata:
+  name: function-shell
+  annotations:
+    # This tells crossplane beta render to connect to the function locally.
+    render.crossplane.io/runtime: Development
+spec:
+  # This is ignored when using the Development runtime.
+  package: function-shell
+---
+apiVersion: pkg.crossplane.io/v1beta1
+kind: Function
+metadata:
+  name: function-extra-resources
+spec:
+  package: xpkg.upbound.io/crossplane-contrib/function-extra-resources:v0.0.3

example/aws/xr.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: example.crossplane.io/v1
+kind: XR
+metadata:
+  name: example-aws
+spec: {}

fn.go

@@ -11,7 +11,6 @@ import (
 	fnv1beta1 "github.com/crossplane/function-sdk-go/proto/v1beta1"
 	"github.com/crossplane/function-sdk-go/request"
 	"github.com/crossplane/function-sdk-go/response"
-
 	"github.com/keegancsmith/shell"
 )
 
@@ -87,7 +86,16 @@ func (f *Function) RunFunction(_ context.Context, req *fnv1beta1.RunFunctionRequ
 
 	var shellEnvVars = make(map[string]string)
 	for _, envVar := range in.ShellEnvVars {
-		shellEnvVars[envVar.Key] = envVar.Value
+		if envVar.ValueRef != "" {
+			envValue, err := fromValueRef(req, envVar.ValueRef)
+			if err != nil {
+				response.Fatal(rsp, errors.Wrapf(err, "cannot process contents of valueRef %s", envVar.ValueRef))
+				return rsp, nil
+			}
+			shellEnvVars[envVar.Key] = envValue
+		} else {
+			shellEnvVars[envVar.Key] = envVar.Value
+		}
 	}
 
 	if len(in.ShellEnvVarsRef.Keys) > 0 {

input/v1alpha1/parameters.go

@@ -45,8 +45,9 @@ type Parameters struct {
 }
 
 type ShellEnvVar struct {
-	Key   string `json:"key,omitempty"`
-	Value string `json:"value,omitempty"`
+	Key      string `json:"key,omitempty"`
+	Value    string `json:"value,omitempty"`
+	ValueRef string `json:"valueRef,omitempty"`
 }
 
 type ShellEnvVarsRef struct {

package/input/template.fn.crossplane.io_parameters.yaml

@@ -52,6 +52,8 @@ spec:
                   type: string
                 value:
                   type: string
+                valueRef:
+                  type: string
               type: object
             type: array
           shellEnvVarsRef: