|
| 1 | +# CIDR Entry Points |
| 2 | + |
| 3 | +The EKS API server allowlist is built from three sources, merged and |
| 4 | +deduplicated at deploy time: |
| 5 | + |
| 6 | +```python |
| 7 | +_all_cidrs = list( |
| 8 | + dict.fromkeys( |
| 9 | + get_cidrs(LANGSMITH) # 1. Built-in LangSmith IPs |
| 10 | + + tuple(_org_cidrs) # 2. Entry point plugins |
| 11 | + + cfg.extra_public_access_cidrs # 3. Manual overrides |
| 12 | + ) |
| 13 | +) |
| 14 | +``` |
| 15 | + |
| 16 | +Source 2 uses [Python entry points](https://packaging.python.org/en/latest/guides/creating-and-discovering-plugins/#using-package-metadata), |
| 17 | +the PyPA-standard plugin discovery mechanism (`importlib.metadata`). Any |
| 18 | +installed package can provide CIDRs by declaring an entry point in the |
| 19 | +`langsmith_hosting.cidrs` group. |
| 20 | + |
| 21 | +## How it works |
| 22 | + |
| 23 | +### Consumer side (langsmith-hosting) |
| 24 | + |
| 25 | +`__main__.py` discovers all registered CIDR providers at runtime: |
| 26 | + |
| 27 | +```python |
| 28 | +from importlib.metadata import entry_points |
| 29 | + |
| 30 | +_org_cidrs: list[str] = [] |
| 31 | +for _ep in entry_points(group="langsmith_hosting.cidrs"): |
| 32 | + _org_cidrs.extend(_ep.load()) |
| 33 | +``` |
| 34 | + |
| 35 | +`entry_points(group=...)` scans every installed package's metadata for |
| 36 | +entries in that group. `ep.load()` performs the import and attribute |
| 37 | +lookup, returning the CIDR tuple. |
| 38 | + |
| 39 | +### Provider side (any package) |
| 40 | + |
| 41 | +A provider declares entry points in its `pyproject.toml`: |
| 42 | + |
| 43 | +```toml |
| 44 | +[project.entry-points."langsmith_hosting.cidrs"] |
| 45 | +my-corp = "my_network.corporate:CORPORATE_CIDRS" |
| 46 | +``` |
| 47 | + |
| 48 | +Each entry follows the format `name = "module.path:ATTRIBUTE"`: |
| 49 | + |
| 50 | +| Part | Meaning | |
| 51 | +| --- | --- | |
| 52 | +| `my-corp` | Human-readable name (used for inspection, not code) | |
| 53 | +| `my_network.corporate` | Python module to import | |
| 54 | +| `CORPORATE_CIDRS` | Attribute on that module — must be an iterable of CIDR strings | |
| 55 | + |
| 56 | +### Concrete example |
| 57 | + |
| 58 | +An internal networking package could declare: |
| 59 | + |
| 60 | +```toml |
| 61 | +[project.entry-points."langsmith_hosting.cidrs"] |
| 62 | +corporate = "my_network.corporate:CORPORATE_CIDRS" |
| 63 | +``` |
| 64 | + |
| 65 | +When that package is installed (e.g., via `uv sync --all-packages`), its |
| 66 | +CIDRs are automatically discovered and included. When it is absent, |
| 67 | +`entry_points()` returns nothing and only the LangSmith IPs + manual |
| 68 | +overrides are used. |
| 69 | + |
| 70 | +## Inspecting registered entry points |
| 71 | + |
| 72 | +```bash |
| 73 | +uv run python -c " |
| 74 | +from importlib.metadata import entry_points |
| 75 | +for ep in entry_points(group='langsmith_hosting.cidrs'): |
| 76 | + print(f'{ep.name}: {ep.load()}') |
| 77 | +" |
| 78 | +``` |
| 79 | + |
| 80 | +## Adding a new CIDR provider |
| 81 | + |
| 82 | +1. Create a Python package with a module that exports a tuple of CIDR |
| 83 | + strings (e.g., `my_network/firewalls.py` with `SCANNER_IPS`). |
| 84 | +2. Add the entry point to the package's `pyproject.toml`: |
| 85 | + |
| 86 | + ```toml |
| 87 | + [project.entry-points."langsmith_hosting.cidrs"] |
| 88 | + scanner = "my_network.firewalls:SCANNER_IPS" |
| 89 | + ``` |
| 90 | + |
| 91 | +3. Install the package in the same environment as `langsmith-hosting` |
| 92 | + (or add it to the uv workspace). |
| 93 | +4. Run `uv sync --all-packages` to register the entry point. |
| 94 | +5. `pulumi preview` will now include the new CIDRs. |
0 commit comments