SpinUP

Cloud-functions platform for Spin WebAssembly components on Kubernetes

GitHub · spinup.emdzej.pl

About

Write source in the browser, hit Build & Deploy, get an HTTP endpoint backed by a SpinApp on SpinKube — or an entry in a shared wasmtime worker pool. Multi-language, multi-tenant-ready, OIDC-only auth.

Status

Alpha. Everything below is validated end-to-end; the workerpool runtime is blocked upstream on a WASI HTTP RC version mismatch.

• Create Applications with N Functions, each with its own HTTP route
• Edit source in Monaco (Go / JS / TS / Rust templates included)
• Build → OCI push → SpinApp CR apply → pod serves requests
• Invoke functions from the UI or via the control plane's /invoke endpoint
• Stream pod stderr live into the UI
• Per-Application CPU and memory panel (cAdvisor + kube-state-metrics)
• Per-Function request rate, p95 latency and 5xx rate (OTel spanmetrics)
• Helm chart deploys the whole stack: control plane, SpinAppExecutor, optional Zot registry, optional worker, optional OTel Collector

Architecture

flowchart TB
    Browser["Browser<br/>SvelteKit + Monaco"]
    CP["Control plane (Go)<br/>Applications · Functions · Builds<br/>SpinApp Apply · Log stream · PromQL"]
    Apps["spinup-functions ns<br/>SpinApp CRs + function pods"]
    Jobs["Batch Jobs (builders)<br/>spin build + push"]
    Registry[("OCI Registry<br/>Zot / external")]
    Shim["containerd-shim-spin<br/>wasmtime host"]
    OTel["OTel Collector<br/>+ spanmetrics"]
    VM[("Prometheus / VM")]

    Browser -->|/api/*| CP
    CP -->|K8s API| Apps
    CP -->|K8s API| Jobs
    CP -->|PromQL| VM
    Apps -->|pull| Registry
    Jobs -->|push| Registry
    Apps -.->|runs on| Shim
    Shim -->|OTLP| OTel
    OTel --> VM

Design decisions

Concern	Choice
Auth	OIDC-only, no local users. SPINUP_DEV_INSECURE_SKIP_AUTH=true for local dev.
State	SQLite (single-node/dev) or Postgres (HA), chosen at install time.
Ingress	Istio Gateway + VirtualService by default; disable for your own Ingress/Gateway API.
Build	Server-side, in-cluster Kubernetes Jobs run per-language builder images.
Languages	Go, JavaScript, TypeScript, Rust. V1 triggers: HTTP.
Tenancy	Single-tenant today; the schema carries tenant_id for later.
Observability	OpenTelemetry throughout. Bring your own Prometheus-compatible TSDB.
Runtimes	spinkube (default) and workerpool (alpha, blocked upstream).

Requirements

• Kubernetes 1.27+ with a containerd supporting containerd-shim-spin
• cert-manager + spin-operator
• An OCI registry (Zot bundled with the chart, or bring your own)
• An OIDC provider
• Go 1.22+, Rust 1.83+ (workerpool worker), pnpm 10+ / Node 20+ (UI and docs)

Stack: Go, Rust, SvelteKit + Svelte 5, Monaco, Helm, OpenTelemetry