Files

T

Jon Chery 031887ec56 refactor(P57): contract surface redesign + rename + .yml repo-wide

Contract surface redesign:
- New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title),
  infrastructure (map keyed by module name, replaces module:)
- Drop uses: field (dead reference; version pin lives in CI workflow uses: line)
- Drop top-level module/inputs (now nested under infrastructure map)
- Per-module optional version (defaults to latest published from registry)
- Multi-module contracts: one file deploys N modules in one pipeline run,
  resource IDs namespaced with module name to avoid collisions
- stack.schema.json: add optional title field for display name

Rename:
- pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline)
- pipelines/ci.yaml → pipelines/ci.yml
- All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies)
- .acdl/contract.yaml → .acdl/contract.yml

Resolver (core/contract_resolver.py):
- Rewrite resolve() to loop infrastructure map, default version to latest,
  merge module fragments into one stack with namespaced resource IDs
- _latest_version() picks highest non-deprecated from registry
- _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module
- Single-module path: unprefixed IDs (backward compatible)

Verification:
- 494 tests pass (0 contract-shape failures)
- Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox)

---ci---
project: acdl
phase: 57
milestone: v1.10.2
status: execute
---/ci---

2026-07-27 21:37:40 +00:00

3.7 KiB

Raw Permalink Blame History

alb — Application Load Balancer (load balancer + target group + listener)

Module kind: primitive | Version: 1.0.0

An Application Load Balancer with a target group and a listener. This is a multi-resource module: it creates a load balancer, a target group, and a listener that forwards traffic to the target group. The target group is what ecs-service registers its tasks with.

Resources

Resource	Type	Purpose
load_balancer	`aws_lb`	Application load balancer in the VPC subnets
target_group	`aws_lb_target_group`	Target group for the ECS service tasks
listener	`aws_lb_listener`	Listener forwarding the LB port to the target group

Inputs

Name	Type	Required	Default	Description
`name`	string	yes	—	Name tag for the load balancer and child resources
`subnets`	string	yes	—	Comma-separated subnet ids (from `vpc`)
`security_group`	string	yes	—	Security group id for the load balancer
`port`	number	no	80	Listener port
`protocol`	string	no	`HTTP`	Listener protocol
`region`	string	yes	—	AWS region the load balancer is created in

Outputs

Name	Type	Description
`lb_arn`	arn	The load balancer ARN
`listener_arn`	arn	The listener ARN
`target_group_arn`	arn	The target group ARN

Usage

{
  "id": "alb",
  "type": "aws:elbv2:loadbalancer",
  "module": "alb@1.0.0",
  "inputs": {
    "name": "acdl-microservice",
    "subnets": "ref:vpc.subnet_ids",
    "security_group": "ref:roles.role_arn",
    "port": 8080,
    "protocol": "HTTP",
    "region": "us-east-1"
  }
}

The target_group_arn output is referenced by ecs-service as its lb_target_group_arn input to wire the service to the ALB.

Compliance extension points

TLS / HTTPS listener — add aws_acm_certificate + ssl_policy + certificate_arn for encryption in transit (SOC2 CC6.1, PCI-DSS 4.1, GDPR Art.32).
Access logs — add access_logs { bucket = ..., prefix = ... } to the load balancer (SOX, SOC2 CC7.2, DORA ICT audit trail).
Security group rules — add ingress/egress rules restricting traffic to known sources (SOC2 CC6.6, PCI-DSS 1.2).
Health check — add a health_check block to the target group (SOC2 CC7.3 monitoring, DORA operational resilience).
WAF — add aws_wafv2_web_acl_association for application-layer protection (SOC2 CC7.6, PCI-DSS 6.5, DORA ICT risk).
Deregistration delay — add deregistration_delay for graceful draining (SOC2 CC9.1 resilience).

Examples

Validated example contracts are in examples/. The platform-test pipeline validates them against schemas/contract.schema.json.

Simple

A minimal deployment:

examples/simple.yml

environment: dev
id: alb
infrastructure:
  alb:
    inputs:
      name: my-alb
      port: 80
      protocol: HTTP
      region: us-east-1
      security_group: sg-xxx
      subnets: subnet-aaa,subnet-bbb
    version: 1.0.0
name: alb-loadbalancer

Complex

A production deployment with optional inputs:

examples/complex.yml

environment: dev
id: alb
infrastructure:
  alb:
    inputs:
      name: my-production-alb
      port: 443
      protocol: HTTPS
      region: us-east-1
      security_group: sg-xxx
      subnets: subnet-aaa,subnet-bbb
    version: 1.0.0
name: alb-loadbalancer

Versioning

1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps require a new registry entry (immutable publication); old entries enter a 12-month deprecation window.

3.7 KiB Raw Permalink Blame History