Docs/wasm function support by SurbhiAgarwal1 · Pull Request #4419 · kptdev/kpt

SurbhiAgarwal1 · 2026-02-28T17:38:49Z

Description

WASM functions are supported in kpt but there's no documentation on how to run, develop, or deploy them. This PR adds a comprehensive guide covering the complete WASM function workflow.

Motivation

Users need documentation to understand:

How to run WASM functions with the --allow-alpha-wasm flag
How to publish WASM modules using kpt alpha wasm push/pull
How to develop WASM functions with proper build tags
The benefits and limitations of WASM functions vs container-based functions

Without this documentation, users have to dig through code or CLI help to figure out WASM support.

Changes

Added documentation/content/en/book/04-using-functions/wasm-functions.md covering:

Running WASM functions with fn render and fn eval
Publishing and pulling WASM modules to/from OCI registries
Developing Go-based WASM functions with complete code examples
Benefits (faster startup, smaller size, better security)
Limitations (alpha status, sandboxed execution, compatibility)

The code examples are based on actual WASM functions in krm-functions-catalog (set-namespace, set-labels, starlark) and follow the same pattern with separate build tags for regular and WASM builds.

Fixes #4296

netlify · 2026-02-28T17:38:54Z

✅ Deploy Preview for kptdocs ready!

Name	Link
🔨 Latest commit	`46f7f9a`
🔍 Latest deploy log	https://app.netlify.com/projects/kptdocs/deploys/69a90aa01d05b600084db938
😎 Deploy Preview	https://deploy-preview-4419--kptdocs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

Copilot

Pull request overview

This PR adds end-user documentation for running/developing/publishing WASM functions in kpt, and (in the same change set) introduces a new CEL-based condition field on Kptfile pipeline functions to enable conditional function execution.

Changes:

Adds a comprehensive “Using WASM Functions” guide (run, eval, push/pull, Go build tags, limitations).
Extends kptfile.v1.Function with a condition field and evaluates it before executing a function.
Adds a CEL evaluator implementation + unit/E2E-style tests, and updates Go module dependencies for CEL.

Reviewed changes

Copilot reviewed 7 out of 8 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
pkg/api/kptfile/v1/types.go	Adds `Function.Condition` (CEL) field to the Kptfile API.
internal/fnruntime/runner.go	Initializes and uses a CEL evaluator to skip function execution when condition is false.
internal/fnruntime/celeval.go	New CEL evaluator implementation for evaluating conditions against resource inputs.
internal/fnruntime/celeval_test.go	Unit tests for CEL evaluator behavior and errors.
internal/fnruntime/conditional_e2e_test.go	End-to-end style tests for conditional execution behavior in `FunctionRunner`.
go.mod / go.sum	Adds `github.com/google/cel-go` and related transitive dependencies.
documentation/content/en/book/04-using-functions/wasm-functions.md	New documentation page describing the WASM function workflow in kpt.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

internal/fnruntime/celeval.go

internal/fnruntime/celeval_test.go

documentation/content/en/book/04-using-functions/wasm-functions.md

Copilot · 2026-02-28T17:44:11Z

documentation/content/en/book/04-using-functions/wasm-functions.md

+1. Compresses the WASM file into a tar archive
+2. Creates an OCI image with `wasm/js` platform
+3. Pushes to the registry


Same platform string issue as above: “wasm/js” is ambiguous; prefer “OS=js, arch=wasm” (or the correct OS/arch ordering) so users can match what registries/tools display.

pkg/api/kptfile/v1/types.go

internal/fnruntime/runner.go

pkg/api/kptfile/v1/types.go

Copilot

Pull request overview

Copilot reviewed 7 out of 8 changed files in this pull request and generated 5 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

pkg/api/kptfile/v1/types.go

internal/fnruntime/celeval.go

Copilot · 2026-02-28T17:51:07Z

documentation/content/en/book/04-using-functions/wasm-functions.md

+### Security
+
+WASM functions run in a sandbox:
+- No network access
+- No filesystem access (except input/output resources)
+- Can't execute system commands


The “Security” section states WASM functions have no network/filesystem access and no host access by default. kpt supports both wasmtime (default) and node.js-based runtimes (selectable via KPT_FN_WASM_RUNTIME), and the node.js runtime can expose broader host capabilities to Go WASM via syscall/js. Please qualify these claims (e.g., “with wasmtime runtime…”) to avoid overstating the sandbox guarantees.

pkg/api/kptfile/v1/types.go

go.mod

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 3 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

Copilot · 2026-03-04T19:04:22Z

documentation/content/en/book/04-using-functions/wasm-functions.md

+
+What this does:
+1. Compresses the WASM file into a tar archive
+2. Creates an OCI image with `wasm/js` platform


The same incorrect wasm/js platform identifier is used here. It should be js/wasm to match the OCI convention of OS/Architecture, consistent with the code in pkg/wasm/client.go:122-124 where OS: "js" and Architecture: "wasm".

documentation/content/en/book/04-using-functions/wasm-functions.md

Copilot · 2026-03-04T19:04:23Z

documentation/content/en/book/04-using-functions/wasm-functions.md

+Here's how to build a Go KRM function for WASM. You need two files - one for regular builds and one for WASM:
+
+`main.go` (regular build):
+
+```go
+//go:build !(js && wasm)
+
+package main
+
+import (
+    "os"
+
+    "github.com/kptdev/krm-functions-sdk/go/fn"
+)
+
+func main() {
+    if err := fn.AsMain(fn.ResourceListProcessorFunc(process)); err != nil {
+        os.Exit(1)
+    }
+}
+
+func process(rl *fn.ResourceList) (bool, error) {
+    for i := range rl.Items {
+        // Your transformation logic
+        rl.Items[i].SetAnnotation("processed-by", "my-fn")
+    }
+    return true, nil
+}
+```


The code example has a compilation issue: main.go defines the process function with the build tag //go:build !(js && wasm), meaning it is excluded during WASM builds. However, main_js.go (with build tag //go:build js && wasm) references process on line 184 via fn.ResourceListProcessorFunc(process). Since process is not available during WASM builds, this code will fail to compile with GOOS=js GOARCH=wasm.

The process function should be placed in a third file (e.g., process.go) without any build tags, so it's available for both regular and WASM builds. This is the typical pattern used in the referenced krm-functions-catalog.

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-04T19:33:15Z

documentation/content/en/book/04-using-functions/wasm-functions.md

+2. Creates an OCI image with `wasm/js` platform
+3. Pushes to the registry


The platform format wasm/js here is inconsistent with OCI conventions. The OCI platform format is OS/Architecture, and looking at pkg/wasm/client.go:122-125, the platform is {OS: "js", Architecture: "wasm"}. This should be written as js/wasm to match the standard OCI platform format.

documentation/content/en/book/04-using-functions/wasm-functions.md

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-05T04:16:42Z

documentation/content/en/book/04-using-functions/wasm-functions.md

+    // TODO: copy the implementation from main.go so behavior is consistent.
+    return false, nil


This example process function in the WASM build file has a TODO comment and returns false, nil without implementing any transformation logic. A user copying this documentation example would get a WASM function that does nothing (and returns false indicating no changes). The main.go version adds an annotation, but this version doesn't.

For a documentation example, the implementation should be consistent between the two files. Either duplicate the logic (adding the annotation) here, or refactor the example to show the recommended pattern of extracting shared logic into a separate file (e.g., processor.go) with no build tags, so both builds share the same process function. The latter pattern avoids the exact problem this code demonstrates — divergent implementations in WASM and non-WASM builds.

Suggested change

// TODO: copy the implementation from main.go so behavior is consistent.

return false, nil

changed := false

const annotationKey = "example.com/wasm"

const annotationValue = "processed"

for _, obj := range rl.Items {

if obj == nil {

continue

}

annotations := obj.GetAnnotations()

if existing, ok := annotations[annotationKey]; ok && existing == annotationValue {

continue

}

obj.SetAnnotation(annotationKey, annotationValue)

changed = true

}

return changed, nil

Add comprehensive documentation for WASM function support in kpt, covering how to run, develop, and deploy WASM functions. Closes kptdev#4296 Signed-off-by: Surbhi <agarwalsurbhi1807@gmail.com>

…s.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Surbhi <agarwalsurbhi1807@gmail.com>

Copilot

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot AI review requested due to automatic review settings February 28, 2026 17:38

SurbhiAgarwal1 requested review from efiacor, kispaljr, liamfallon and mozesl-nokia as code owners February 28, 2026 17:38

dosubot bot added size:XL This PR changes 500-999 lines, ignoring generated files. documentation Improvements or additions to documentation labels Feb 28, 2026

Copilot started reviewing on behalf of SurbhiAgarwal1 February 28, 2026 17:39 View session

Copilot AI reviewed Feb 28, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings February 28, 2026 17:45

Copilot started reviewing on behalf of SurbhiAgarwal1 February 28, 2026 17:45 View session

Copilot AI reviewed Feb 28, 2026

View reviewed changes

SurbhiAgarwal1 force-pushed the docs/wasm-function-support branch from e979fbb to 1abf41f Compare February 28, 2026 18:03

dosubot bot added size:L This PR changes 100-499 lines, ignoring generated files. and removed size:XL This PR changes 500-999 lines, ignoring generated files. labels Feb 28, 2026

liamfallon requested a review from Copilot March 4, 2026 18:58

Copilot started reviewing on behalf of liamfallon March 4, 2026 18:58 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 4, 2026 19:25

Copilot started reviewing on behalf of SurbhiAgarwal1 March 4, 2026 19:26 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

Copilot AI review requested due to automatic review settings March 5, 2026 04:11

Copilot started reviewing on behalf of SurbhiAgarwal1 March 5, 2026 04:12 View session

Copilot AI reviewed Mar 5, 2026

View reviewed changes

SurbhiAgarwal1 and others added 3 commits March 5, 2026 10:15

docs: Add WASM function support documentation

1f4c7c5

Add comprehensive documentation for WASM function support in kpt, covering how to run, develop, and deploy WASM functions. Closes kptdev#4296 Signed-off-by: Surbhi <agarwalsurbhi1807@gmail.com>

Update documentation/content/en/book/04-using-functions/wasm-function…

5501431

…s.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Surbhi <agarwalsurbhi1807@gmail.com>

Update documentation/content/en/book/04-using-functions/wasm-function…

46f7f9a

…s.md Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com> Signed-off-by: Surbhi <agarwalsurbhi1807@gmail.com>

SurbhiAgarwal1 force-pushed the docs/wasm-function-support branch from 5b119ee to 46f7f9a Compare March 5, 2026 04:46

SurbhiAgarwal1 requested a review from Copilot March 5, 2026 04:48

Copilot started reviewing on behalf of SurbhiAgarwal1 March 5, 2026 04:49 View session

Copilot AI reviewed Mar 5, 2026

View reviewed changes

		2. Creates an OCI image with `wasm/js` platform
		3. Pushes to the registry

		// TODO: copy the implementation from main.go so behavior is consistent.
		return false, nil

-    // TODO: copy the implementation from main.go so behavior is consistent.
-    return false, nil
+    changed := false
+    const annotationKey = "example.com/wasm"
+    const annotationValue = "processed"
+    for _, obj := range rl.Items {
+        if obj == nil {
+            continue
+        }
+        annotations := obj.GetAnnotations()
+        if existing, ok := annotations[annotationKey]; ok && existing == annotationValue {
+            continue
+        }
+        obj.SetAnnotation(annotationKey, annotationValue)
+        changed = true
+    }
+    return changed, nil

Conversation

SurbhiAgarwal1 commented Feb 28, 2026

Description

Motivation

Changes

Uh oh!

netlify bot commented Feb 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for kptdocs ready!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI Feb 28, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 5, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

netlify bot commented Feb 28, 2026 •

edited

Loading