Skip to main content

CloudForge Plugin System

CloudForge supports two plugin types for extending application deployment and compliance validation:

Plugin Types​

Plugin TypePurposeInterfaceExamples
Application PluginsDeploy custom applicationsApplicationSpecVault, GitLab, Grafana, Mattermost
Compliance PluginsAdd compliance frameworksFrameworkRules<SystemContext> + @ComplianceFrameworkNIST 800-53, custom policies

Application Plugins​

Purpose: Deploy any application on AWS using CloudForge infrastructure patterns.

Key Features:

  • Docker/ECS (Fargate) and EC2 deployment hooks
  • VPC, ALB, EFS, and monitoring configuration
  • Optional OIDC integration
  • Health check configuration
  • CloudWatch logging

Quick Example:

public class VaultApplicationSpec implements ApplicationSpec {
    @Override
    public String applicationId() {
        return "vault";
    }

    @Override
    public String defaultContainerImage() {
        return "hashicorp/vault:latest";
    }

    @Override
    public int applicationPort() {
        return 8200;
    }

    // ... more configuration
}

Register:

META-INF/services/com.cloudforge.core.interfaces.ApplicationSpec

📖 Full Guide: APPLICATION-PLUGIN-GUIDE.md

Compliance Framework Plugins​

Purpose: Add custom compliance validation for industry standards or internal policies.

Key Features:

  • ✅ Priority-based execution order
  • ✅ Always-load vs conditional frameworks
  • ✅ Infrastructure vs organizational control distinction
  • ✅ Support for Docker/ECS and EC2 runtime-specific validation
  • ✅ Integration with compliance reporting

Quick Example:

@ComplianceFramework(
    value = "NIST-800-53",
    priority = 25,
    displayName = "NIST 800-53 Rev 5",
    description = "Validates NIST 800-53 security controls"
)
public class Nist80053Rules implements FrameworkRules<SystemContext> {
    @Override
    public void install(SystemContext ctx) {
        ctx.getNode().addValidation(() -> {
            List<ComplianceRule> rules = new ArrayList<>();
            rules.addAll(validateAccessControl(ctx));
            rules.addAll(validateAuditLogging(ctx));
            return rules;
        });
    }
}

Register:

META-INF/services/com.cloudforge.core.interfaces.FrameworkRules

📖 Full Guide: COMPLIANCE-PLUGIN-GUIDE.md

Plugin Architecture​

Both plugin systems use Java's ServiceLoader pattern for automatic discovery:

your-plugin.jar
├── META-INF/
│   └── services/
│       ├── com.cloudforge.core.interfaces.ApplicationSpec       (for apps)
│       └── com.cloudforge.core.interfaces.FrameworkRules        (for compliance)
├── com/example/
│   ├── VaultApplicationSpec.class
│   └── Nist80053Rules.class

How It Works​

  1. Discovery: CloudForge scans classpath using ServiceLoader
  2. Registration: Plugins register via META-INF/services files
  3. Loading: Plugins are instantiated automatically at runtime
  4. Execution:
    • Applications: Deployed via ApplicationFactory
    • Compliance: Validated via FrameworkLoader.discover()

Priority System (Compliance Only)​

Compliance frameworks use priorities to control execution order:

PriorityTypeExamples
-10 to -5Always-Load FoundationKeyManagement (-10), DatabaseSecurity (-5)
0Always-Load GeneralThreatProtection (0), IncidentResponse (0)
10-50Conditional FrameworksHIPAA (10), PCI-DSS (20), GDPR (30), SOC2 (40), ISO-27001 (50)
60-90Custom InternalOrganization-specific policies
100+ExperimentalBeta frameworks

Built-in Plugins​

Included Applications​

CI/CD​

ApplicationStatusDocker/ECSEC2OIDC
Jenkins✅ Built-in✅✅✅
GitLab✅ Built-in✅✅✅
Drone✅ Built-in✅✅❌

Version Control​

ApplicationStatusDocker/ECSEC2OIDC
Gitea✅ Built-in✅✅✅

Monitoring​

ApplicationStatusDocker/ECSEC2OIDC
Grafana✅ Built-in✅✅✅
Prometheus✅ Built-in✅✅❌

Analytics​

ApplicationStatusDocker/ECSEC2OIDC
Metabase✅ Built-in✅✅❌
Apache Superset✅ Built-in✅✅❌

Databases​

ApplicationStatusDocker/ECSEC2OIDC
PostgreSQL✅ Built-in✅✅❌
Redis✅ Built-in✅✅❌

Artifact Registries​

ApplicationStatusDocker/ECSEC2OIDC
Nexus Repository✅ Built-in✅✅❌
Harbor✅ Built-in✅✅❌

Secrets Management​

ApplicationStatusDocker/ECSEC2OIDC
HashiCorp Vault✅ Built-in✅✅❌

Collaboration​

ApplicationStatusDocker/ECSEC2OIDC
Mattermost✅ Built-in✅✅❌

Included Compliance Frameworks​

FrameworkPriorityAlways-LoadStatus
KeyManagement-10✅✅ Built-in
DatabaseSecurity-5✅✅ Built-in
AdvancedMonitoring-5✅✅ Built-in
ThreatProtection0✅✅ Built-in
IncidentResponse0✅✅ Built-in
HIPAA10❌✅ Built-in
HIPAA-Organizational15❌✅ Built-in
PCI-DSS20❌✅ Built-in
GDPR30❌✅ Built-in
GDPR-Organizational35❌✅ Built-in
SOC240❌✅ Built-in
ISO-2700150❌✅ Built-in
NIST 800-5325❌🚧 Plugin

Development Workflow​

1. Create Plugin Project​

mvn archetype:generate \
  -DgroupId=com.example \
  -DartifactId=my-plugin \
  -DarchetypeArtifactId=maven-archetype-quickstart

2. Add CloudForge Dependencies​

<dependency>
    <groupId>com.cloudforgeci</groupId>
    <artifactId>cloudforge-core</artifactId>
    <version>3.1.0</version>
    <scope>provided</scope>
</dependency>

3. Implement Interface​

  • Application: Implement ApplicationSpec
  • Compliance: Implement FrameworkRules<SystemContext> + add @ComplianceFramework

4. Register via ServiceLoader​

Create META-INF/services/ file with your implementation class name.

5. Build and Test​

mvn clean package
mvn test

6. Distribute​

  • Maven Central
  • GitHub Packages
  • Direct JAR download

Documentation​

Community​

Plugin Uses​

For Application Developers​

  • Reuse application infrastructure configuration
  • Configure monitoring and backups through the host project
  • Support container and VM deployment implementations
  • Integrate OIDC where the application supports it

For Compliance Teams​

  • Codify internal infrastructure policies
  • Run validation at deployment time
  • Reject configurations that fail plugin validation
  • Add findings to compliance reports

For Organizations​

  • Standardize application deployment configuration
  • Share validation rules across projects
  • Distribute organization-specific patterns as plugins
  • Reduce duplicated infrastructure code

Next Steps​