feat(builtins): built-in runtime for apply-replacements and starlark (#4307)

Closes #4307

Implements a built-in runtime for curated KRM functions inside kpt,

allowing apply-replacements and starlark to run without pulling images

from Docker Hub, eliminating the external SDK dependency.

## Approach

Avoids circular dependency between Porch and kpt by moving the built-in

runtime concept into kpt directly using kyaml/fn/framework instead of

krm-functions-sdk.

## Architecture

A thread-safe self-registration registry (internal/builtins/registry)

allows KRM function implementations to register themselves via init().

The fnruntime runner checks this registry before falling back to Docker

or WASM, preserving existing behavior for unregistered functions.

Priority order in fnruntime/runner.go:

1. pkg-context builtin (existing)

2. Builtin registry (new, no Docker needed)

3. Docker / WASM (fallback, unchanged)

## Functions included

- apply-replacements: ghcr.io/kptdev/krm-functions-catalog/apply-replacements

- starlark: ghcr.io/kptdev/krm-functions-catalog/starlark

## Implementation notes

- Removed dependency on krm-functions-sdk/go/fn and krm-functions-catalog/starlark

- Vendored starlark runtime locally using kyaml/yaml instead of SDK

## Verified locally

[PASS] apply-replacements in 0s (no Docker)

[PASS] starlark in 0s (no Docker)

Signed-off-by: abdulrahman11a <[email protected]>

Author: Your Name

go.mod

@@ -11,17 +11,18 @@ require (
 	github.com/google/go-containerregistry v0.20.6
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
 	github.com/kptdev/krm-functions-catalog/functions/go/apply-setters v0.2.2
-	github.com/kptdev/krm-functions-catalog/functions/go/starlark v0.5.5
 	github.com/kptdev/krm-functions-sdk/go/fn v1.0.2
 	github.com/otiai10/copy v1.14.1
 	github.com/philopon/go-toposort v0.0.0-20170620085441-9be86dbd762f
 	github.com/pkg/errors v0.9.1
 	github.com/prep/wasmexec v0.0.0-20220807105708-6554945c1dec
+	github.com/qri-io/starlib v0.5.0
 	github.com/regclient/regclient v0.11.1
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
 	github.com/stretchr/testify v1.11.1
 	github.com/xlab/treeprint v1.2.0
+	go.starlark.net v0.0.0-20250417143717-f57e51f710eb
 	golang.org/x/mod v0.29.0
 	golang.org/x/text v0.31.0
 	gopkg.in/yaml.v2 v2.4.0
@@ -112,7 +113,6 @@ require (
 	github.com/prometheus/client_model v0.6.2 // indirect
 	github.com/prometheus/common v0.67.2 // indirect
 	github.com/prometheus/procfs v0.19.2 // indirect
-	github.com/qri-io/starlib v0.5.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
 	github.com/sergi/go-diff v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
@@ -122,7 +122,6 @@ require (
 	github.com/x448/float16 v0.8.4 // indirect
 	go.opentelemetry.io/otel v1.38.0 // indirect
 	go.opentelemetry.io/otel/trace v1.38.0 // indirect
-	go.starlark.net v0.0.0-20250417143717-f57e51f710eb // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
 	golang.org/x/net v0.47.0 // indirect

go.sum

@@ -153,8 +153,6 @@ github.com/klauspost/compress v1.18.2 h1:iiPHWW0YrcFgpBYhsA6D1+fqHssJscY/Tm/y2Uq
 github.com/klauspost/compress v1.18.2/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4=
 github.com/kptdev/krm-functions-catalog/functions/go/apply-setters v0.2.2 h1:PZ4TcVzgad1OFuH4gHg4j2LKC2KXTuzfsQWil2knSlk=
 github.com/kptdev/krm-functions-catalog/functions/go/apply-setters v0.2.2/go.mod h1:S8Vrp3yPDp4ga2TOPfZzoO/Y7UGF7KPHS1S0taJ0XOc=
-github.com/kptdev/krm-functions-catalog/functions/go/starlark v0.5.5 h1:2fVPRn0knqm4XoXfYN7mWt99MOevHhR8eoKvqnmhzY4=
-github.com/kptdev/krm-functions-catalog/functions/go/starlark v0.5.5/go.mod h1:PE/l25mFdKm9MibK2sh/vO1YdFvrMIc3MXwyJW/scB0=
 github.com/kptdev/krm-functions-sdk/go/fn v1.0.2 h1:g9N6SW5axEXMagUbHliH14XpfvvvwkAVDLcN3ApVh2M=
 github.com/kptdev/krm-functions-sdk/go/fn v1.0.2/go.mod h1:NSfdmtQ9AwNg5wdS9gE/H9SQs7Vomzq7E7N9hyEju1U=
 github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=

internal/builtins/applyreplacements/apply_replacements.go

@@ -4,23 +4,25 @@
 // you may not use this file except in compliance with the License.
 // You may obtain a copy of the License at
 //
-//	http://www.apache.org/licenses/LICENSE-2.0
+//      http://www.apache.org/licenses/LICENSE-2.0
 //
 // Unless required by applicable law or agreed to in writing, software
 // distributed under the License is distributed on an "AS IS" BASIS,
 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 // See the License for the specific language governing permissions and
 // limitations under the License.
+
 package applyreplacements
 
 import (
 	"fmt"
 	"io"
 
 	"github.com/kptdev/kpt/internal/builtins/registry"
-	"github.com/kptdev/krm-functions-sdk/go/fn"
 	"sigs.k8s.io/kustomize/api/filters/replacement"
 	"sigs.k8s.io/kustomize/api/types"
+	"sigs.k8s.io/kustomize/kyaml/fn/framework"
+	"sigs.k8s.io/kustomize/kyaml/kio"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -41,85 +43,47 @@ type Runner struct{}
 
 func (a *Runner) ImageName() string { return ImageName }
 
-func (a *Runner) Run(r io.Reader, w io.Writer) error {
-	input, err := io.ReadAll(r)
-	if err != nil {
-		return fmt.Errorf("reading input: %w", err)
-	}
-	rl, err := fn.ParseResourceList(input)
-	if err != nil {
-		return fmt.Errorf("parsing ResourceList: %w", err)
-	}
-	if _, err := applyReplacements(rl); err != nil {
-		return err
-	}
-	out, err := rl.ToYAML()
-	if err != nil {
-		return err
-	}
-	_, err = w.Write(out)
-	return err
-}
-func applyReplacements(rl *fn.ResourceList) (bool, error) {
-	r := &Replacements{}
-	return r.Process(rl)
+func (a *Runner) Run(r io.Reader, w io.Writer, _ io.Writer) error {
+	return framework.Execute(
+		framework.ResourceListProcessorFunc(Process),
+		&kio.ByteReadWriter{
+			Reader:                r,
+			Writer:                w,
+			KeepReaderAnnotations: true,
+		},
+	)
 }
 
-type Replacements struct {
-	Replacements []types.Replacement `json:"replacements,omitempty" yaml:"replacements,omitempty"`
-}
+func Process(rl *framework.ResourceList) error {
+	rep := &Replacements{}
 
-func (r *Replacements) Config(functionConfig *fn.KubeObject) error {
-	if functionConfig.IsEmpty() {
+	if rl.FunctionConfig == nil {
 		return fmt.Errorf("FunctionConfig is missing. Expect `ApplyReplacements`")
 	}
-	if functionConfig.GetKind() != fnConfigKind || functionConfig.GetAPIVersion() != fnConfigAPIVersion {
-		return fmt.Errorf("received functionConfig of kind %s and apiVersion %s, only functionConfig of kind %s and apiVersion %s is supported",
-			functionConfig.GetKind(), functionConfig.GetAPIVersion(), fnConfigKind, fnConfigAPIVersion)
+
+	meta, err := rl.FunctionConfig.GetMeta()
+	if err != nil {
+		return fmt.Errorf("reading functionConfig metadata: %w", err)
 	}
-	r.Replacements = []types.Replacement{}
-	if err := functionConfig.As(r); err != nil {
-		return fmt.Errorf("unable to convert functionConfig to replacements:\n%w", err)
+	if meta.Kind != fnConfigKind || meta.APIVersion != fnConfigAPIVersion {
+		return fmt.Errorf("received functionConfig of kind %s and apiVersion %s, only functionConfig of kind %s and apiVersion %s is supported",
+			meta.Kind, meta.APIVersion, fnConfigKind, fnConfigAPIVersion)
 	}
-	return nil
-}
 
-func (r *Replacements) Process(rl *fn.ResourceList) (bool, error) {
-	if err := r.Config(rl.FunctionConfig); err != nil {
-		rl.LogResult(err)
-		return false, err
+	if err := yaml.Unmarshal([]byte(rl.FunctionConfig.MustString()), rep); err != nil {
+		return fmt.Errorf("unable to convert functionConfig to replacements: %w", err)
 	}
-	transformedItems, err := r.Transform(rl.Items)
+
+	transformed, err := replacement.Filter{
+		Replacements: rep.Replacements,
+	}.Filter(rl.Items)
 	if err != nil {
-		rl.LogResult(err)
-		return false, err
+		return err
 	}
-	rl.Items = transformedItems
-	return true, nil
+	rl.Items = transformed
+	return nil
 }
 
-func (r *Replacements) Transform(items []*fn.KubeObject) ([]*fn.KubeObject, error) {
-	var transformedItems []*fn.KubeObject
-	var nodes []*yaml.RNode
-	for _, obj := range items {
-		objRN, err := yaml.Parse(obj.String())
-		if err != nil {
-			return nil, err
-		}
-		nodes = append(nodes, objRN)
-	}
-	transformedNodes, err := replacement.Filter{
-		Replacements: r.Replacements,
-	}.Filter(nodes)
-	if err != nil {
-		return nil, err
-	}
-	for _, n := range transformedNodes {
-		obj, err := fn.ParseKubeObject([]byte(n.MustString()))
-		if err != nil {
-			return nil, err
-		}
-		transformedItems = append(transformedItems, obj)
-	}
-	return transformedItems, nil
+type Replacements struct {
+	Replacements []types.Replacement `json:"replacements,omitempty" yaml:"replacements,omitempty"`
 }

internal/builtins/applyreplacements/apply_replacements_test.go

@@ -16,6 +16,7 @@ package applyreplacements
 
 import (
 	"bytes"
+	"io"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -51,7 +52,7 @@ functionConfig:
 	w := &bytes.Buffer{}
 
 	runner := &Runner{}
-	err := runner.Run(r, w)
+	err := runner.Run(r, w, io.Discard)
 	assert.NoError(t, err)
 	assert.Contains(t, w.String(), "namespace: my-app")
 }
@@ -74,7 +75,7 @@ functionConfig:
 	w := &bytes.Buffer{}
 
 	runner := &Runner{}
-	err := runner.Run(r, w)
-	assert.NoError(t, err)
-	assert.Contains(t, w.String(), "only functionConfig of kind ApplyReplacements")
+	err := runner.Run(r, w, io.Discard)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "only functionConfig of kind ApplyReplacements")
 }

internal/builtins/registry/registry.go

@@ -24,7 +24,7 @@ import (
 
 type BuiltinFunction interface {
 	ImageName() string
-	Run(r io.Reader, w io.Writer) error
+	Run(r io.Reader, w io.Writer, stderr io.Writer) error
 }
 
 var (

internal/builtins/registry/registry_test.go

@@ -25,8 +25,8 @@ type fakeBuiltin struct {
 	name string
 }
 
-func (f *fakeBuiltin) ImageName() string                  { return f.name }
-func (f *fakeBuiltin) Run(_ io.Reader, _ io.Writer) error { return nil }
+func (f *fakeBuiltin) ImageName() string                               { return f.name }
+func (f *fakeBuiltin) Run(_ io.Reader, _ io.Writer, _ io.Writer) error { return nil }
 
 func TestNormalizeImage(t *testing.T) {
 	tests := []struct {

internal/builtins/starlark/config.go

@@ -17,10 +17,10 @@ package starlark
 import (
 	"fmt"
 
-	starlarkruntime "github.com/kptdev/krm-functions-catalog/functions/go/starlark/third_party/sigs.k8s.io/kustomize/kyaml/fn/runtime/starlark"
-	"github.com/kptdev/krm-functions-sdk/go/fn"
+	starlarkruntime "github.com/kptdev/kpt/internal/builtins/starlark/runtime"
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"sigs.k8s.io/kustomize/kyaml/fn/framework"
 	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
@@ -40,22 +40,29 @@ const (
 
 type Run struct {
 	yaml.ResourceMeta `json:",inline" yaml:",inline"`
-	// Source is a required field for providing a starlark script inline.
-	Source string `json:"source" yaml:"source"`
-	// Params are the parameters in key-value pairs format.
-	Params map[string]interface{} `json:"params,omitempty" yaml:"params,omitempty"`
+	Source            string                 `json:"source" yaml:"source"`
+	Params            map[string]interface{} `json:"params,omitempty" yaml:"params,omitempty"`
 }
 
-func (sr *Run) Config(fnCfg *fn.KubeObject) error {
-	switch {
-	case fnCfg.IsEmpty():
+func (sr *Run) Config(fnCfg *yaml.RNode) error {
+	if fnCfg == nil {
 		return fmt.Errorf("FunctionConfig is missing. Expect `ConfigMap`, `StarlarkRun`, or `Run`")
-	case fnCfg.IsGVK("", configMapAPIVersion, configMapKind):
+	}
+
+	meta, err := fnCfg.GetMeta()
+	if err != nil {
+		return fmt.Errorf("reading functionConfig metadata: %w", err)
+	}
+
+	apiVersion := meta.APIVersion
+	kind := meta.Kind
+
+	switch {
+	case apiVersion == configMapAPIVersion && kind == configMapKind:
 		cm := &corev1.ConfigMap{}
-		if err := fnCfg.As(cm); err != nil {
+		if err := fnCfg.YNode().Decode(cm); err != nil {
 			return err
 		}
-		// Convert ConfigMap to StarlarkRun
 		sr.Name = cm.Name
 		sr.Namespace = cm.Namespace
 		sr.Params = map[string]interface{}{}
@@ -65,63 +72,34 @@ func (sr *Run) Config(fnCfg *fn.KubeObject) error {
 			}
 			sr.Params[k] = v
 		}
-	case fnCfg.IsGVK(starlarkRunGroup, starlarkRunVersion, starlarkRunKind),
-		fnCfg.IsGVK(starlarkRunGroup, starlarkRunVersion, "Run"):
-		if err := fnCfg.As(sr); err != nil {
+
+	case (apiVersion == starlarkRunAPIVersion && kind == starlarkRunKind) ||
+		(apiVersion == starlarkRunAPIVersion && kind == "Run"):
+		if err := fnCfg.YNode().Decode(sr); err != nil {
 			return err
 		}
+
 	default:
 		return fmt.Errorf("`functionConfig` must be either %v, %v, or %v but we got: %v",
 			schema.FromAPIVersionAndKind(configMapAPIVersion, configMapKind).String(),
 			schema.FromAPIVersionAndKind(starlarkRunAPIVersion, starlarkRunKind).String(),
 			schema.FromAPIVersionAndKind(starlarkRunAPIVersion, "Run").String(),
-			schema.FromAPIVersionAndKind(fnCfg.GetAPIVersion(), fnCfg.GetKind()).String())
+			schema.FromAPIVersionAndKind(apiVersion, kind).String())
 	}
 
-	// Defaulting
 	if sr.Name == "" {
 		sr.Name = defaultProgramName
 	}
-	// Validation
 	if sr.Source == "" {
 		return fmt.Errorf("`source` must not be empty")
 	}
 	return nil
 }
 
-func (sr *Run) Transform(rl *fn.ResourceList) error {
-	var transformedObjects []*fn.KubeObject
-	var nodes []*yaml.RNode
-
-	fcRN, err := yaml.Parse(rl.FunctionConfig.String())
-	if err != nil {
-		return err
-	}
-	for _, obj := range rl.Items {
-		objRN, err := yaml.Parse(obj.String())
-		if err != nil {
-			return err
-		}
-		nodes = append(nodes, objRN)
-	}
-
-	starFltr := &starlarkruntime.SimpleFilter{
-		Name:           sr.Name,
-		Program:        sr.Source,
-		FunctionConfig: fcRN,
-	}
-	transformedNodes, err := starFltr.Filter(nodes)
-	if err != nil {
-		return err
-	}
-
-	for _, n := range transformedNodes {
-		obj, err := fn.ParseKubeObject([]byte(n.MustString()))
-		if err != nil {
-			return err
-		}
-		transformedObjects = append(transformedObjects, obj)
+func (sr *Run) Transform(rl *framework.ResourceList) error {
+	starFltr := &starlarkruntime.Filter{
+		Name:    sr.Name,
+		Program: sr.Source,
 	}
-	rl.Items = transformedObjects
-	return nil
+	return rl.Filter(starFltr)
 }

internal/builtins/starlark/config_test.go

@@ -16,8 +16,8 @@ package starlark
 import (
 	"testing"
 
-	"github.com/kptdev/krm-functions-sdk/go/fn"
 	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/kyaml/yaml"
 )
 
 func TestStarlarkConfig(t *testing.T) {
@@ -84,12 +84,14 @@ data:
 			expectErrMsg: "`source` must not be empty",
 		},
 	}
+
 	for _, tc := range testcases {
 		t.Run(tc.name, func(t *testing.T) {
 			sr := &Run{}
-			ko, err := fn.ParseKubeObject([]byte(tc.config))
+			node, err := yaml.Parse(tc.config)
 			assert.NoError(t, err)
-			err = sr.Config(ko)
+
+			err = sr.Config(node)
 			if tc.expectErrMsg == "" {
 				assert.NoError(t, err)
 			} else {