feat(cli): add export command to generate desired-state YAML from current state by rohilsurana · Pull Request #1731 · raystack/frontier

rohilsurana · 2026-07-03T02:41:54Z

What

Adds frontier export <kind>, a top-level sibling of frontier reconcile. It reads the current state of one kind from the server through the admin API and prints it as a desired-state YAML document, the same format reconcile reads. Output goes to stdout only — redirect it to save a file. YAML is the only format.

$ frontier export platformuser --host <host> -H "Authorization:Basic <base64>" > platform-users.yaml
kind: PlatformUser
spec:
    - type: user
      ref: alice@example.org
      relation: admin

The reconcile command is unchanged. The kind argument is case-insensitive and accepts a plural, so platformusers finds PlatformUser. An unknown kind lists the available ones.

Both reconcile and export are now documented in the CLI reference (reconcile was missing from it).

Why

When an environment adopts the reconcile flow, its first desired-state file must match what already exists on the server. If it does not, the first apply makes unwanted changes. Writing that file by hand from list APIs is slow and easy to get wrong.

How

New optional Exporter interface next to Reconciler in internal/reconcile. A kind that implements it can be exported. Kinds that do not implement it return a clear error.
PlatformUser implements it: one entry per principal and relation — a user or service user holding both admin and member exports as two entries. Users are referenced by email when they have one, service users by id. The bootstrap service account is skipped, the same as in reconcile.
Output is sorted, so re-running the export gives the same file and git diffs stay clean.
An empty platform exports spec: [], which reconcile accepts as an intentional empty list.
The kind registry moved to a shared helper, so new kinds register once for both reconcile and export.

Guarantees covered by tests

Feeding the export output straight back into reconcile --dry-run reports no changes, including principals that hold both relations.
Export of an empty platform round-trips the same way.
Unknown kinds and kinds without export support fail with clear errors.

vercel · 2026-07-03T02:42:00Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
frontier	Ready	Preview, Comment	Jul 3, 2026 2:44pm

coderabbitai · 2026-07-03T02:43:06Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 774117a6-49d6-4171-9dc4-453a0a039799

📥 Commits

Reviewing files that changed from the base of the PR and between 62bea17 and 4c606c0.

📒 Files selected for processing (1)

cmd/reconcile.go

🚧 Files skipped from review as they are similar to previous changes (1)

cmd/reconcile.go

📝 Walkthrough

Summary by CodeRabbit

New Features
- Added frontier export <kind> to print the current state of a supported resource kind as desired-state YAML for reuse with frontier reconcile.
- Export output is deterministic (sorted) and kind resolution is case-insensitive (accepts singular/plural forms); user references prefer email when present.
Bug Fixes
- Improved frontier reconcile report output to write to stdout for better piping/redirects.
- Export now returns clearer errors for unknown or unsupported kinds.
Documentation
- Updated the CLI reference with examples for export and reconcile (including supported PlatformUser and the --header flag).

Walkthrough

Adds export support to the reconcile framework, implements platform user export, and wires a new frontier export <kind> command with matching CLI help and reference docs.

Changes

Reconcile export feature

Layer / File(s)	Summary
Exporter interface and YAML export `internal/reconcile/reconcile.go`, `internal/reconcile/reconcile_test.go`	Adds the `Exporter` interface and the `Export(ctx, registry, kind)` function that emits a `{kind, spec}` YAML document, with error-path tests for unknown kinds and non-exporting reconcilers.
PlatformUser export implementation `internal/reconcile/platformuser_reconciler.go`, `internal/reconcile/platformuser_reconciler_test.go`	Adds `PlatformUserReconciler.Export`, which builds sorted `PlatformUserSpec` entries from fetched principals and is covered by export and dry-run reconciliation tests.
CLI export command and kind resolution `cmd/export.go`, `cmd/root.go`, `cmd/export_test.go`	Adds `frontier export <kind>`, kind resolution, stdout YAML printing, root registration, and resolve-kind tests.
Reconcile command wiring and help `cmd/reconcile.go`	Centralizes reconcile registry construction, updates the help text to mention export, and switches report output to `cmd.OutOrStdout()`.
CLI reference updates `docs/content/docs/reference/cli.mdx`	Adds reference sections for `frontier export <kind>` and `frontier reconcile [flags]` with examples and flags.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

raystack/frontier#1720: Extends the same reconcile framework with Exporter/Export support and the frontier export CLI path.

Suggested reviewers: AmanGIT07, rsbh, whoAbhishekSah

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 75607dba-a629-489d-b90a-5de555cb5f68

📥 Commits

Reviewing files that changed from the base of the PR and between 4a8d725 and 2ca9edd.

📒 Files selected for processing (5)

cmd/reconcile.go
internal/reconcile/platformuser_reconciler.go
internal/reconcile/platformuser_reconciler_test.go
internal/reconcile/reconcile.go
internal/reconcile/reconcile_test.go

coveralls · 2026-07-03T02:48:23Z

Coverage Report for CI Build 28667590558

Coverage increased (+0.09%) to 44.957%

Details

Coverage increased (+0.09%) from the base build.
Patch coverage: 35 uncovered changes across 4 files (76 of 111 lines covered, 68.47%).
No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
cmd/export.go	48	33	68.75%
cmd/reconcile.go	16	2	12.5%
internal/reconcile/reconcile.go	21	17	80.95%
internal/reconcile/platformuser_reconciler.go	25	23	92.0%
Total (5 files)	111	76	68.47%

Coverage Regressions

No coverage regressions found.

Coverage Stats


Relevant Lines:	37712
Covered Lines:	16954
Line Coverage:	44.96%
Coverage Strength:	12.59 hits per line

💛 - Coveralls

coderabbitai

Actionable comments posted: 1

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 025c0faa-f5bc-4b12-bf33-7bcc3ee2fbaa

📥 Commits

Reviewing files that changed from the base of the PR and between 2ca9edd and d553b7f.

📒 Files selected for processing (7)

cmd/apply.go
cmd/get.go
cmd/root.go
internal/reconcile/platformuser_reconciler.go
internal/reconcile/platformuser_reconciler_test.go
internal/reconcile/reconcile.go
internal/reconcile/reconcile_test.go

✅ Files skipped from review due to trivial changes (1)

internal/reconcile/reconcile.go

🚧 Files skipped from review as they are similar to previous changes (3)

internal/reconcile/platformuser_reconciler.go
internal/reconcile/platformuser_reconciler_test.go
internal/reconcile/reconcile_test.go

coderabbitai

♻️ Duplicate comments (1)

cmd/export.go (1)
51-56: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Narrow output file permissions for exported PII.

The exported document contains per-principal emails; writing with 0o644 leaves it world-readable. Matches an already-flagged concern on a prior commit of this file.
🔒 Proposed fix
-			return os.WriteFile(output, out, 0o644)
+			return os.WriteFile(output, out, 0o600)

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 4ef1ccea-dab3-45ac-8fb9-8f03784960e8

📥 Commits

Reviewing files that changed from the base of the PR and between d553b7f and 987ae62.

📒 Files selected for processing (7)

cmd/export.go
cmd/reconcile.go
cmd/root.go
internal/reconcile/platformuser_reconciler.go
internal/reconcile/platformuser_reconciler_test.go
internal/reconcile/reconcile.go
internal/reconcile/reconcile_test.go

🚧 Files skipped from review as they are similar to previous changes (4)

internal/reconcile/reconcile_test.go
internal/reconcile/reconcile.go
internal/reconcile/platformuser_reconciler.go
internal/reconcile/platformuser_reconciler_test.go

…rent state

…xport in CLI reference

…tderr

coderabbitai

🧹 Nitpick comments (1)

cmd/export.go (1)
47-50: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value

Skip the byte→string conversion.

string(out) allocates a copy just to hand it back to Fprint. Writing the bytes directly avoids the extra allocation.
♻️ Proposed simplification
-			// cobra's cmd.Print falls back to stderr; the document must go to
-			// stdout so redirecting to a file works.
-			_, err = fmt.Fprint(cmd.OutOrStdout(), string(out))
-			return err
+			// cobra's cmd.Print falls back to stderr; the document must go to
+			// stdout so redirecting to a file works.
+			_, err = cmd.OutOrStdout().Write(out)
+			return err

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: a3d55fcb-3ab0-46c1-9eb0-a4adceb02a73

📥 Commits

Reviewing files that changed from the base of the PR and between 987ae62 and 62bea17.

📒 Files selected for processing (9)

cmd/export.go
cmd/export_test.go
cmd/reconcile.go
cmd/root.go
docs/content/docs/reference/cli.mdx
internal/reconcile/platformuser_reconciler.go
internal/reconcile/platformuser_reconciler_test.go
internal/reconcile/reconcile.go
internal/reconcile/reconcile_test.go

🚧 Files skipped from review as they are similar to previous changes (4)

internal/reconcile/reconcile_test.go
internal/reconcile/platformuser_reconciler_test.go
internal/reconcile/platformuser_reconciler.go
internal/reconcile/reconcile.go

vercel Bot deployed to Preview July 3, 2026 02:42 View deployment

coderabbitai Bot reviewed Jul 3, 2026

View reviewed changes

Comment thread cmd/reconcile.go Outdated

rohilsurana force-pushed the feat/reconcile-export branch from 2ca9edd to d553b7f Compare July 3, 2026 09:29

rohilsurana changed the title ~~feat(reconcile): add export command to generate desired-state YAML from current state~~ feat(cli): add 'get' command to export desired-state YAML and rename 'reconcile' to 'apply' Jul 3, 2026

vercel Bot deployed to Preview July 3, 2026 09:30 View deployment

coderabbitai Bot reviewed Jul 3, 2026

View reviewed changes

Comment thread cmd/get.go Outdated

rohilsurana force-pushed the feat/reconcile-export branch from d553b7f to 987ae62 Compare July 3, 2026 09:38

rohilsurana changed the title ~~feat(cli): add 'get' command to export desired-state YAML and rename 'reconcile' to 'apply'~~ feat(cli): add export command to generate desired-state YAML from current state Jul 3, 2026

vercel Bot deployed to Preview July 3, 2026 09:38 View deployment

coderabbitai Bot reviewed Jul 3, 2026

View reviewed changes

feat(cli): add export command to generate desired-state YAML from cur…

12fc9a5

…rent state

rohilsurana force-pushed the feat/reconcile-export branch from 987ae62 to 12fc9a5 Compare July 3, 2026 10:12

vercel Bot deployed to Preview July 3, 2026 10:12 View deployment

refactor(cli): export prints to stdout only, document reconcile and e…

5502e7c

…xport in CLI reference

vercel Bot deployed to Preview July 3, 2026 10:26 View deployment

rohilsurana mentioned this pull request Jul 3, 2026

feat(reconcile): add Permission and Role kinds, bootstrap only creates missing roles #1737

Open

fix(cli): write export document and reconcile report to stdout, not s…

62bea17

…tderr

vercel Bot deployed to Preview July 3, 2026 14:40 View deployment

fix(cli): skip the empty report a failed reconcile document produces

4c606c0

coderabbitai Bot reviewed Jul 3, 2026

View reviewed changes

vercel Bot deployed to Preview July 3, 2026 14:44 View deployment

rohilsurana requested a review from whoAbhishekSah July 4, 2026 14:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(cli): add export command to generate desired-state YAML from current state#1731

feat(cli): add export command to generate desired-state YAML from current state#1731
rohilsurana wants to merge 4 commits into
mainfrom
feat/reconcile-export

rohilsurana commented Jul 3, 2026 •

edited

Loading

Uh oh!

vercel Bot commented Jul 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

Reviews paused

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coveralls commented Jul 3, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

rohilsurana commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What

Why

How

Guarantees covered by tests

Uh oh!

vercel Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coderabbitai Bot commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Summary by CodeRabbit

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coveralls commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Coverage Report for CI Build 28667590558

Coverage increased (+0.09%) to 44.957%

Details

Uncovered Changes

Coverage Regressions

Coverage Stats

💛 - Coveralls

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

rohilsurana commented Jul 3, 2026 •

edited

Loading

vercel Bot commented Jul 3, 2026 •

edited

Loading

coderabbitai Bot commented Jul 3, 2026 •

edited

Loading

coveralls commented Jul 3, 2026 •

edited

Loading