$ show zarf-dev/zarf
Zarf is an air-gap native package manager for Kubernetes. It provides a CLI tool to build, sign, publish, and deploy immutable software bundles (packages) into disconnected Kubernetes clusters. The architecture consists of a Go CLI that orchestrates package lifecycle (create, deploy, remove, publish, inspect), a mutating admission webhook agent that rewrites container image references and Git URLs to point to internal Zarf services, and a set of embedded tools (Helm, K9s, Syft, Cosign, etc.). Key capabilities include OCI-based package distribution, Helm chart and manifest deployment, Git repository mirroring, SBOM generation, and Cosign-based signing/verification with both key and keyless modes. The codebase is well-structured with extensive unit and e2e tests, a clean separation between API versions (v1alpha1/v1beta1) with bidirectional conversion, and several reusable subsystems for value merging, archive extraction, template processing, and Kubernetes resource waiting. It is actively maintained with frequent releases and a large community (2000+ stars).
The LLM identified 5 files worth highlighting for reuse:
Implements a Values type that parses YAML files, performs deep merge with parent-wins semantics, and supports path-based get/set/delete operations with automatic type inference for CLI overrides. Also includes JSON Schema validation and external reference checking. This is a self-contained utility for any Go project needing robust YAML value merging and validation, demonstrable through non-obvious edge-case handling (merge order, null values, schema references).
Provides safe extraction of tar/zip archives with comprehensive security validations: symlink escape detection, hardlink traversal prevention, Windows reserved name checks, setuid bit stripping, and path normalization. Supports multiple compression formats and recursive extraction. Reusable in any project handling untrusted archive files, demonstrating deep knowledge of archive security pitfalls (ZipSlip, symlink attacks, NTFS quirks).
Implements a retry-based wait mechanism for Kubernetes resources (via conditions and kstatus) and network endpoints (TCP/HTTP). Supports configurable timeout, interval, and deadline propagation from context. The resource waiter uses a dynamic Kubernetes client to watch for readiness, while the network waiter attempts connections. This is a clean abstraction for any Go application that needs to wait for resource or network availability, demonstrating non-obvious handling of context cancellation and resource lifecycle.
A Go template engine built on text/template with Sprig functions, but with deliberate removal of unsafe functions (env, expandenv, getHostByName) and access control for state secrets via explicit permission groups. Supports nested template objects for package variables, constants, and cluster state. Reusable in any project needing a secure template engine with limited function scope, demonstrating careful security design in template execution.
Provides a builder for JSON Patch (RFC 6902) operations, supporting add, remove, replace, move, copy, and test operations with helpers for common Kubernetes resource mutations. Includes a JSON 6902 patcher for applying patches to arbitrary objects. Reusable in any admission webhook or Kubernetes controller that needs to construct patches programmatically, demonstrating clean API design for patch construction.