Feat: Validate undeclared parameters in application definitions (#7075)

* Feat: Validate undeclared parameters in application definitions (#6862)

Add a new feature gate ValidateUndeclaredParameters that rejects
parameters not declared in the CUE definition schema at admission time.
When enabled, any parameter field not present in the template's parameter
stanza will cause a validation error.

Signed-off-by: majiayu000 <1835304752@qq.com>

* Fix: Handle CUE pattern constraints and improve undeclared param validation

- Detect pattern constraints ([string]: T) using LookupPath to avoid
  false positives on webservice labels/annotations fields
- Use GetSelectorLabel() for safe selector extraction
- Add klog debug logging when schema compilation fails
- Sort undeclared field names for deterministic error messages
- Add test cases for pattern constraints and sorted output

Signed-off-by: majiayu000 <1835304752@qq.com>

* Fix: go fmt alignment in validate_test.go

Signed-off-by: majiayu000 <1835304752@qq.com>

* fix: address review feedback on PR #7075

- Handle conditional parameter declarations via two-pass schema
  compilation: first without params for base fields, then with
  declared params to resolve CUE conditionals
- Return nil from findUndeclaredFields when schema.Fields() errors
  to prevent false positives from empty declared map
- Recurse into list elements containing structs using cue.AnyIndex
  so undeclared fields inside arrays are detected
- Save/restore previous feature gate state in tests instead of
  resetting to fixed values

Signed-off-by: majiayu000 <1835304752@qq.com>

---------

Signed-off-by: majiayu000 <1835304752@qq.com>

.github/CODEOWNERS

@@ -1,35 +1,35 @@
 # This file is a github code protect rule follow the codeowners https://docs.github.com/en/github/creating-cloning-and-archiving-repositories/creating-a-repository-on-github/about-code-owners#example-of-a-codeowners-file
 
-*                                  @barnettZQG @wonderflow @leejanee @Somefive @jefree-cat @FogDong @wangyikewxgm @chivalryq @anoop2811
-design/                            @barnettZQG @leejanee @wonderflow @Somefive @jefree-cat @FogDong @anoop2811
+*                                  @barnettZQG @wonderflow @leejanee @Somefive @jefree-cat @FogDong @wangyikewxgm @chivalryq @anoop2811 @briankane @jguionnet
+design/                            @barnettZQG @leejanee @wonderflow @Somefive @jefree-cat @FogDong @anoop2811 @briankane @jguionnet
 
 # Owner of Core Controllers
-pkg/controller/core.oam.dev       @Somefive @FogDong @barnettZQG @wonderflow @wangyikewxgm @chivalryq @anoop2811
+pkg/controller/core.oam.dev       @Somefive @FogDong @barnettZQG @wonderflow @wangyikewxgm @chivalryq @anoop2811 @briankane @jguionnet
 
 # Owner of Standard Controllers
-pkg/controller/standard.oam.dev   @wangyikewxgm @barnettZQG @wonderflow @Somefive @anoop2811 @FogDong
+pkg/controller/standard.oam.dev   @wangyikewxgm @barnettZQG @wonderflow @Somefive @anoop2811 @FogDong @briankane @jguionnet
 
 # Owner of CUE
-pkg/cue                            @leejanee @FogDong @Somefive @anoop2811
-pkg/stdlib                         @leejanee @FogDong @Somefive @anoop2811
+pkg/cue                            @leejanee @FogDong @Somefive @anoop2811 @briankane @jguionnet
+pkg/stdlib                         @leejanee @FogDong @Somefive @anoop2811 @briankane @jguionnet
 
 # Owner of Workflow
-pkg/workflow                       @leejanee @FogDong @Somefive @wangyikewxgm @chivalryq @anoop2811
+pkg/workflow                       @leejanee @FogDong @Somefive @wangyikewxgm @chivalryq @anoop2811 @briankane @jguionnet
 
 # Owner of vela templates
-vela-templates/                     @Somefive @barnettZQG @wonderflow @FogDong @wangyikewxgm @chivalryq @anoop2811
+vela-templates/                     @Somefive @barnettZQG @wonderflow @FogDong @wangyikewxgm @chivalryq @anoop2811 @briankane @jguionnet
 
 # Owner of vela CLI
-references/cli/                     @Somefive @StevenLeiZhang @charlie0129 @wangyikewxgm @chivalryq @anoop2811 @FogDong
+references/cli/                     @Somefive @StevenLeiZhang @charlie0129 @wangyikewxgm @chivalryq @anoop2811 @FogDong @briankane @jguionnet
 
 # Owner of vela addon framework
-pkg/addon/                         @wangyikewxgm @wonderflow @charlie0129 @anoop2811 @FogDong
+pkg/addon/                         @wangyikewxgm @wonderflow @charlie0129 @anoop2811 @FogDong @briankane @jguionnet
 
 # Owner of resource keeper and tracker
-pkg/resourcekeeper                 @Somefive @FogDong @chivalryq @anoop2811
-pkg/resourcetracker                @Somefive @FogDong @chivalryq @anoop2811
+pkg/resourcekeeper                 @Somefive @FogDong @chivalryq @anoop2811 @briankane @jguionnet
+pkg/resourcetracker                @Somefive @FogDong @chivalryq @anoop2811 @briankane @jguionnet
 
-.github/                           @chivalryq @wonderflow @Somefive @FogDong @wangyikewxgm @anoop2811
-makefiles                          @chivalryq @wonderflow @Somefive @FogDong @wangyikewxgm @anoop2811
-go.*                               @chivalryq @wonderflow @Somefive @FogDong @wangyikewxgm @anoop2811
+.github/                           @chivalryq @wonderflow @Somefive @FogDong @wangyikewxgm @anoop2811 @briankane @jguionnet
+makefiles                          @chivalryq @wonderflow @Somefive @FogDong @wangyikewxgm @anoop2811 @briankane @jguionnet
+go.*                               @chivalryq @wonderflow @Somefive @FogDong @wangyikewxgm @anoop2811 @briankane @jguionnet
 

.github/actions/e2e-test/action.yaml

@@ -19,6 +19,10 @@ runs:
     # ========================================================================
     - name: Configure environment setup
       uses: ./.github/actions/env-setup
+      with:
+        install-ginkgo: 'true'
+        install-setup-envtest: 'false'
+        install-kustomize: 'false'
 
     - name: Build project
       shell: bash

.github/actions/env-setup/action.yaml

@@ -1,11 +1,27 @@
 name: 'Kubevela Test Environment Setup'
-description: 'Sets up complete testing environment for Kubevela with Go, Kubernetes tools, and Ginkgo framework for E2E testing.'
+description: 'Sets up complete testing environment for Kubevela with Go, Kubernetes tools, and testing frameworks.'
 
 inputs:
   go-version:
     description: 'Go version to use for testing'
     required: false
     default: '1.23.8'
+  install-ginkgo:
+    description: 'Install Ginkgo testing framework'
+    required: false
+    default: 'true'
+  install-setup-envtest:
+    description: 'Install setup-envtest for integration testing'
+    required: false
+    default: 'false'
+  install-kustomize:
+    description: 'Install kustomize for manifest management'
+    required: false
+    default: 'false'
+  kustomize-version:
+    description: 'Kustomize version to install'
+    required: false
+    default: '4.5.4'
 
 
 runs:
@@ -32,20 +48,22 @@ runs:
       run: |
         # Detect architecture
         ARCH=$(uname -m | sed 's/x86_64/amd64/' | sed 's/aarch64/arm64/')
-        
-        # Install kubectl
-        echo "Installing kubectl for architecture: $ARCH"
-        curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/${ARCH}/kubectl"
+
+        # Install kubectl using a known stable version to avoid network issues
+        # The dl.k8s.io/release/stable.txt endpoint can return garbage due to CDN issues
+        KUBECTL_VERSION="v1.31.0"
+        echo "Installing kubectl version: $KUBECTL_VERSION for architecture: $ARCH"
+        curl -LO --retry 3 --fail "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/${ARCH}/kubectl"
         chmod +x kubectl
         sudo mv kubectl /usr/local/bin/
-        
-        # Install helm using the official script (more reliable)
+
+        # Install helm using the official script
         echo "Installing Helm using official script..."
-        curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
+        curl -fsSL --retry 3 -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3
         chmod 700 get_helm.sh
         ./get_helm.sh
         rm get_helm.sh
-        
+
         # Verify installations
         echo "Verifying installations..."
         kubectl version --client
@@ -66,7 +84,37 @@ runs:
         go mod verify
 
     - name: Install Ginkgo testing framework
+      if: ${{ inputs.install-ginkgo == 'true' }}
       shell: bash
       run: |
         echo "Installing Ginkgo testing framework..."
         go install github.com/onsi/ginkgo/v2/ginkgo@v2.14.0
+        echo "Ginkgo installed successfully"
+
+    - name: Install setup-envtest
+      if: ${{ inputs.install-setup-envtest == 'true' }}
+      shell: bash
+      run: |
+        echo "Installing setup-envtest for integration testing..."
+        mkdir -p ./bin
+        GOBIN=$(pwd)/bin go install sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20240522175850-2e9781e9fc60
+        echo "setup-envtest installed successfully at ./bin/setup-envtest"
+        ls -la ./bin/setup-envtest
+
+        # Download and cache the Kubernetes binaries for envtest
+        echo "Downloading Kubernetes binaries for envtest..."
+        KUBEBUILDER_ASSETS=$(./bin/setup-envtest use 1.31.0 --bin-dir ./bin -p path)
+        echo "Kubernetes binaries downloaded successfully"
+        echo "KUBEBUILDER_ASSETS=${KUBEBUILDER_ASSETS}"
+        # Export for subsequent steps
+        echo "KUBEBUILDER_ASSETS=${KUBEBUILDER_ASSETS}" >> $GITHUB_ENV
+
+    - name: Install kustomize
+      if: ${{ inputs.install-kustomize == 'true' }}
+      shell: bash
+      run: |
+        echo "Installing kustomize version ${{ inputs.kustomize-version }}..."
+        mkdir -p ./bin
+        curl -sS https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh | bash -s ${{ inputs.kustomize-version }} $(pwd)/bin
+        echo "kustomize installed successfully at ./bin/kustomize"
+        ./bin/kustomize version

.github/actions/multicluster-test/action.yaml

@@ -20,6 +20,10 @@ runs:
     # ========================================================================
     - name: Configure environment setup
       uses: ./.github/actions/env-setup
+      with:
+        install-ginkgo: 'true'
+        install-setup-envtest: 'false'
+        install-kustomize: 'false'
 
     # ========================================================================
     # E2E Test Execution

.github/actions/unit-test/action.yaml

@@ -19,6 +19,10 @@ runs:
     # ========================================================================
     - name: Configure environment setup
       uses: ./.github/actions/env-setup
+      with:
+        install-ginkgo: 'true'
+        install-setup-envtest: 'true'
+        install-kustomize: 'true'
 
     # ========================================================================
     # Unit Test Execution

.github/comment.userlist

@@ -11,4 +11,7 @@ wangyuan249
 chivalryq
 FogDong
 leejanee
-barnettZQG
+barnettZQG
+anoop2811 
+briankane 
+jguionnet

.github/workflows/go.yml

@@ -97,6 +97,21 @@ jobs:
         with:
           submodules: true
 
+      - name: Free Disk Space
+        run: |
+          echo "Disk space before cleanup:"
+          df -h
+
+          # Remove unnecessary software to free up disk space
+          sudo rm -rf /usr/share/dotnet
+          sudo rm -rf /usr/local/lib/android
+          sudo rm -rf /opt/ghc
+          sudo rm -rf /opt/hostedtoolcache/CodeQL
+          sudo docker image prune --all --force
+
+          echo "Disk space after cleanup:"
+          df -h
+
       - name: Setup Env
         uses: ./.github/actions/env-setup
         
@@ -111,6 +126,24 @@ jobs:
       - name: Run cross-build
         run: make cross-build
 
+      - name: Free Disk Space After Cross-Build
+        run: |
+          echo "Disk space before cleanup:"
+          df -h
+
+          # Remove cross-build artifacts to free up space
+          # (make build will rebuild binaries for current platform)
+          rm -rf _bin
+
+          # Clean Go build cache and test cache
+          go clean -cache -testcache
+
+          # Remove Docker build cache
+          sudo docker builder prune --all --force || true
+
+          echo "Disk space after cleanup:"
+          df -h
+
       - name: Check Diff
         run: |
           export PATH=$(pwd)/bin/:$PATH

.github/workflows/release.yml

@@ -111,16 +111,9 @@ jobs:
     steps:
       - name: Checkout
         uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608
+
       - name: Update kubectl plugin version in krew-index
         uses: rajatjindal/krew-release-bot@df3eb197549e3568be8b4767eec31c5e8e8e6ad8 # v0.0.46
-      - name: Update Homebrew formula
-        uses: dawidd6/action-homebrew-bump-formula@d3667e5ae14df19579e4414897498e3e88f2f458 # v3.10.0
-        with:
-          token: ${{ secrets.HOMEBREW_TOKEN }}
-          formula: kubevela
-          tag: ${{ github.ref }}
-          revision: ${{ github.sha }}
-          force: false
 
   provenance-vela-bins:
     name: generate provenance for binaries

.github/workflows/sync-sdk.yaml

@@ -28,10 +28,15 @@ jobs:
       - name: Install Go tools
         run: |
           make goimports
-          
+
       - name: Build CLI
         run: make vela-cli
 
+      - name: Setup KinD
+        uses: ./.github/actions/setup-kind-cluster
+        with:
+          name: sync-sdk
+
       - name: Get the version
         id: get_version
         run: echo "VERSION=${GITHUB_REF}" >> $GITHUB_OUTPUT

.gitignore

@@ -62,3 +62,5 @@ git-page/
 vela.json
 
 dist/
+.planning/
+.claude/

.golangci.yml

@@ -29,7 +29,7 @@ linters-settings:
 
   gocyclo:
     # minimal code complexity to report, 30 by default (but we recommend 10-20)
-    min-complexity: 30
+    min-complexity: 35
 
 
   dupl:
@@ -144,6 +144,14 @@ issues:
       linters:
         - gocritic
 
+    # The preferFprint suggestion (sb.WriteString(fmt.Sprintf(...)) -> fmt.Fprintf(sb, ...))
+    # is a micro-optimization. The defkit package generates CUE code infrequently,
+    # so the performance difference is negligible and the current style is more readable.
+    - path: pkg/definition/defkit/
+      text: "preferFprint"
+      linters:
+        - gocritic
+
     # Gosmopolitan complains of internationalization issues on the file that actually defines
     # the translation.
     - path: i18n\.go

CHANGELOG/CHANGELOG-1.1.md

@@ -230,7 +230,7 @@ spec:
 1. Workflow support specify Order Steps by Field Tag (#2022)
 2. support application policy (#2011)
 3. add OCM multi cluster demo (#1992)
-4. Fix(volume): seperate volume to trait (#2027)
+4. Fix(volume): separate volume to trait (#2027)
 5. allow application skip gc resource and leave workload ownerReference controlled by rollout(#2024)
 6. Store component parameters in context (#2030)
 7. Allow specify chart values for helm trait(#2033)

Makefile

@@ -64,8 +64,8 @@ lint: golangci
 	@GOLANGCILINT=$(GOLANGCILINT) ./hack/utils/golangci-lint-wrapper.sh
 
 ## reviewable: Run the reviewable
-reviewable: manifests fmt vet lint staticcheck helm-doc-gen sdk_fmt
-	go mod tidy
+## Run make build to compile vela binary before running this target to ensure all generated definitions are up to date.
+reviewable: build manifests fmt vet lint staticcheck helm-doc-gen sdk_fmt
 
 # check-diff: Execute auto-gen code commands and ensure branch is clean.
 check-diff: reviewable
@@ -103,7 +103,7 @@ manager:
 	$(GOBUILD_ENV) go build -o bin/manager -a -ldflags $(LDFLAGS) ./cmd/core/main.go
 
 ## manifests: Generate manifests e.g. CRD, RBAC etc.
-manifests: installcue kustomize
+manifests: tidy installcue kustomize sync-crds
 	go generate $(foreach t,pkg apis,./$(t)/...)
 	# TODO(yangsoon): kustomize will merge all CRD into a whole file, it may not work if we want patch more than one CRD in this way
 	$(KUSTOMIZE) build config/crd -o config/crd/base/core.oam.dev_applications.yaml

README.md

@@ -107,7 +107,7 @@ Check out [KubeVela videos](https://kubevela.io/videos/talks/en/oam-dapr) for th
 
 ## Contributing
 
-Check out [CONTRIBUTING](https://kubevela.io/docs/contributor/overview) to see how to develop with KubeVela.
+Check out [CONTRIBUTING](https://kubevela.io/docs/contributor/overview) to see how to develop with KubeVela
 
 ## Report Vulnerability
 

apis/core.oam.dev/common/types.go

@@ -26,6 +26,7 @@ import (
 	"k8s.io/apimachinery/pkg/runtime"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
+	wfTypesv1alpha1 "github.com/kubevela/pkg/apis/oam/v1alpha1"
 	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/condition"
@@ -173,12 +174,15 @@ type ApplicationComponentStatus struct {
 	Cluster   string `json:"cluster,omitempty"`
 	Env       string `json:"env,omitempty"`
 	// WorkloadDefinition is the definition of a WorkloadDefinition, such as deployments/apps.v1
-	WorkloadDefinition WorkloadGVK              `json:"workloadDefinition,omitempty"`
-	Healthy            bool                     `json:"healthy"`
-	Details            map[string]string        `json:"details,omitempty"`
-	Message            string                   `json:"message,omitempty"`
-	Traits             []ApplicationTraitStatus `json:"traits,omitempty"`
-	Scopes             []corev1.ObjectReference `json:"scopes,omitempty"`
+	WorkloadDefinition WorkloadGVK `json:"workloadDefinition,omitempty"`
+	Healthy            bool        `json:"healthy"`
+	// WorkloadHealthy indicates the workload health without considering trait health.
+	// +optional
+	WorkloadHealthy bool                     `json:"workloadHealthy,omitempty"`
+	Details         map[string]string        `json:"details,omitempty"`
+	Message         string                   `json:"message,omitempty"`
+	Traits          []ApplicationTraitStatus `json:"traits,omitempty"`
+	Scopes          []corev1.ObjectReference `json:"scopes,omitempty"`
 }
 
 // Equal check if two ApplicationComponentStatus are equal
@@ -191,6 +195,7 @@ func (in ApplicationComponentStatus) Equal(r ApplicationComponentStatus) bool {
 type ApplicationTraitStatus struct {
 	Type    string            `json:"type"`
 	Healthy bool              `json:"healthy"`
+	Pending bool              `json:"pending,omitempty"`
 	Details map[string]string `json:"details,omitempty"`
 	Message string            `json:"message,omitempty"`
 }
@@ -204,6 +209,40 @@ type Revision struct {
 	RevisionHash string `json:"revisionHash,omitempty"`
 }
 
+// AppliedApplicationPolicy records minimal status information about an Application-scoped policy.
+// This covers both global (auto-discovered) and explicit (spec-referenced) policies.
+// Full details (transforms, labels, annotations, etc.) are stored in the ConfigMap referenced
+// by ApplicationPoliciesConfigMap for persistent storage and observability.
+type AppliedApplicationPolicy struct {
+	Name      string `json:"name"`
+	Type      string `json:"type,omitempty"`
+	Namespace string `json:"namespace"`
+	Applied   bool   `json:"applied"`
+	Error     bool   `json:"error,omitempty"`
+	Message   string `json:"message,omitempty"`
+	Source    string `json:"source,omitempty"` // "global" or "explicit" - how the policy was applied
+
+	SpecModified     bool `json:"specModified,omitempty"`
+	LabelsCount      int  `json:"labelsCount,omitempty"`
+	AnnotationsCount int  `json:"annotationsCount,omitempty"`
+	HasContext       bool `json:"hasContext,omitempty"`
+
+	// Version tracking
+	// DefinitionRevisionName is the DefinitionRevision resource name if a versioned policy was used (e.g., "my-policy-v3")
+	// Empty if the policy wasn't versioned (used latest PolicyDefinition)
+	// +optional
+	DefinitionRevisionName string `json:"definitionRevisionName,omitempty"`
+
+	// Revision is the revision number from the DefinitionRevision (e.g. 3)
+	// +optional
+	Revision int64 `json:"revision,omitempty"`
+
+	// RevisionHash is the hash of the PolicyDefinition template from the DefinitionRevision
+	// This is the definitive proof of exactly what template was used
+	// +optional
+	RevisionHash string `json:"revisionHash,omitempty"`
+}
+
 // AppStatus defines the observed state of Application
 type AppStatus struct {
 	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
@@ -225,6 +264,12 @@ type AppStatus struct {
 	// Workflow record the status of workflow
 	Workflow *WorkflowStatus `json:"workflow,omitempty"`
 
+	// WorkflowRestartScheduledAt schedules a workflow restart at the specified time.
+	// This field is automatically set when the app.oam.dev/restart-workflow annotation is present,
+	// and is cleared after the restart is triggered. Use RFC3339 format or set to current time for immediate restart.
+	// +optional
+	WorkflowRestartScheduledAt *metav1.Time `json:"workflowRestartScheduledAt,omitempty"`
+
 	// LatestRevision of the application configuration it generates
 	// +optional
 	LatestRevision *Revision `json:"latestRevision,omitempty"`
@@ -232,6 +277,16 @@ type AppStatus struct {
 	// AppliedResources record the resources that the  workflow step apply.
 	AppliedResources []ClusterObjectReference `json:"appliedResources,omitempty"`
 
+	// AppliedApplicationPolicies lists Application-scoped policies (both global and explicit)
+	// that were discovered and applied (or skipped) during reconciliation.
+	// +optional
+	AppliedApplicationPolicies []AppliedApplicationPolicy `json:"appliedApplicationPolicies,omitempty"`
+
+	// ApplicationPoliciesConfigMap references the ConfigMap containing rendered policy outputs
+	// Format: "application-policies-{namespace}-{name}"
+	// +optional
+	ApplicationPoliciesConfigMap string `json:"applicationPoliciesConfigMap,omitempty"`
+
 	// PolicyStatus records the status of policy
 	// Deprecated This field is only used by EnvBinding Policy which is deprecated.
 	PolicyStatus []PolicyStatus `json:"policy,omitempty"`
@@ -301,9 +356,9 @@ type ApplicationComponent struct {
 	// +kubebuilder:pruning:PreserveUnknownFields
 	Properties *runtime.RawExtension `json:"properties,omitempty"`
 
-	DependsOn []string                     `json:"dependsOn,omitempty"`
-	Inputs    workflowv1alpha1.StepInputs  `json:"inputs,omitempty"`
-	Outputs   workflowv1alpha1.StepOutputs `json:"outputs,omitempty"`
+	DependsOn []string                    `json:"dependsOn,omitempty"`
+	Inputs    wfTypesv1alpha1.StepInputs  `json:"inputs,omitempty"`
+	Outputs   wfTypesv1alpha1.StepOutputs `json:"outputs,omitempty"`
 
 	// Traits define the trait of one component, the type must be array to keep the order.
 	Traits []ApplicationTrait `json:"traits,omitempty"`

apis/core.oam.dev/common/zz_generated.deepcopy.go

@@ -21,6 +21,7 @@ limitations under the License.
 package common
 
 import (
+	oamv1alpha1 "github.com/kubevela/pkg/apis/oam/v1alpha1"
 	"github.com/kubevela/workflow/api/v1alpha1"
 	crossplane_runtime "github.com/oam-dev/terraform-controller/api/types/crossplane-runtime"
 	v1 "k8s.io/api/core/v1"
@@ -48,6 +49,10 @@ func (in *AppStatus) DeepCopyInto(out *AppStatus) {
 		*out = new(WorkflowStatus)
 		(*in).DeepCopyInto(*out)
 	}
+	if in.WorkflowRestartScheduledAt != nil {
+		in, out := &in.WorkflowRestartScheduledAt, &out.WorkflowRestartScheduledAt
+		*out = (*in).DeepCopy()
+	}
 	if in.LatestRevision != nil {
 		in, out := &in.LatestRevision, &out.LatestRevision
 		*out = new(Revision)
@@ -58,6 +63,11 @@ func (in *AppStatus) DeepCopyInto(out *AppStatus) {
 		*out = make([]ClusterObjectReference, len(*in))
 		copy(*out, *in)
 	}
+	if in.AppliedApplicationPolicies != nil {
+		in, out := &in.AppliedApplicationPolicies, &out.AppliedApplicationPolicies
+		*out = make([]AppliedApplicationPolicy, len(*in))
+		copy(*out, *in)
+	}
 	if in.PolicyStatus != nil {
 		in, out := &in.PolicyStatus, &out.PolicyStatus
 		*out = make([]PolicyStatus, len(*in))
@@ -92,12 +102,12 @@ func (in *ApplicationComponent) DeepCopyInto(out *ApplicationComponent) {
 	}
 	if in.Inputs != nil {
 		in, out := &in.Inputs, &out.Inputs
-		*out = make(v1alpha1.StepInputs, len(*in))
+		*out = make(oamv1alpha1.StepInputs, len(*in))
 		copy(*out, *in)
 	}
 	if in.Outputs != nil {
 		in, out := &in.Outputs, &out.Outputs
-		*out = make(v1alpha1.StepOutputs, len(*in))
+		*out = make(oamv1alpha1.StepOutputs, len(*in))
 		copy(*out, *in)
 	}
 	if in.Traits != nil {
@@ -203,6 +213,21 @@ func (in *ApplicationTraitStatus) DeepCopy() *ApplicationTraitStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *AppliedApplicationPolicy) DeepCopyInto(out *AppliedApplicationPolicy) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new AppliedApplicationPolicy.
+func (in *AppliedApplicationPolicy) DeepCopy() *AppliedApplicationPolicy {
+	if in == nil {
+		return nil
+	}
+	out := new(AppliedApplicationPolicy)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *CUE) DeepCopyInto(out *CUE) {
 	*out = *in

apis/core.oam.dev/v1alpha1/register.go

@@ -21,7 +21,7 @@ import (
 	k8sscheme "k8s.io/client-go/kubernetes/scheme"
 	"sigs.k8s.io/controller-runtime/pkg/scheme"
 
-	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
+	wfTypesv1alpha1 "github.com/kubevela/pkg/apis/oam/v1alpha1"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 )
@@ -57,7 +57,7 @@ var (
 
 func init() {
 	SchemeBuilder.Register(&Policy{}, &PolicyList{})
-	SchemeBuilder.Register(&workflowv1alpha1.Workflow{}, &workflowv1alpha1.WorkflowList{})
+	SchemeBuilder.Register(&wfTypesv1alpha1.Workflow{}, &wfTypesv1alpha1.WorkflowList{})
 	_ = SchemeBuilder.AddToScheme(k8sscheme.Scheme)
 }
 

apis/core.oam.dev/v1beta1/application_types.go

@@ -23,7 +23,7 @@ import (
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
 
-	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
+	wfTypesv1alpha1 "github.com/kubevela/pkg/apis/oam/v1alpha1"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/condition"
@@ -42,9 +42,9 @@ type AppPolicy struct {
 
 // Workflow defines workflow steps and other attributes
 type Workflow struct {
-	Ref   string                                `json:"ref,omitempty"`
-	Mode  *workflowv1alpha1.WorkflowExecuteMode `json:"mode,omitempty"`
-	Steps []workflowv1alpha1.WorkflowStep       `json:"steps,omitempty"`
+	Ref   string                               `json:"ref,omitempty"`
+	Mode  *wfTypesv1alpha1.WorkflowExecuteMode `json:"mode,omitempty"`
+	Steps []wfTypesv1alpha1.WorkflowStep       `json:"steps,omitempty"`
 }
 
 // ApplicationSpec is the spec of Application

apis/core.oam.dev/v1beta1/applicationrevision_types.go

@@ -19,8 +19,8 @@ package v1beta1
 import (
 	"encoding/json"
 
+	wfTypesv1alpha1 "github.com/kubevela/pkg/apis/oam/v1alpha1"
 	"github.com/kubevela/pkg/util/compression"
-	workflowv1alpha1 "github.com/kubevela/workflow/api/v1alpha1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
@@ -56,6 +56,11 @@ type ApplicationRevisionCompressibleFields struct {
 	// PolicyDefinitions records the snapshot of the PolicyDefinitions related with the created/modified Application
 	PolicyDefinitions map[string]PolicyDefinition `json:"policyDefinitions,omitempty"`
 
+	// PolicyVersions records version metadata for each policy (which DefinitionRevision was used)
+	// Key is the policy name (same as PolicyDefinitions keys)
+	// +optional
+	PolicyVersions map[string]PolicyVersionMetadata `json:"policyVersions,omitempty"`
+
 	// WorkflowStepDefinitions records the snapshot of the WorkflowStepDefinitions related with the created/modified Application
 	WorkflowStepDefinitions map[string]*WorkflowStepDefinition `json:"workflowStepDefinitions,omitempty"`
 
@@ -63,7 +68,7 @@ type ApplicationRevisionCompressibleFields struct {
 	Policies map[string]v1alpha1.Policy `json:"policies,omitempty"`
 
 	// Workflow records the external workflow
-	Workflow *workflowv1alpha1.Workflow `json:"workflow,omitempty"`
+	Workflow *wfTypesv1alpha1.Workflow `json:"workflow,omitempty"`
 
 	// ReferredObjects records the referred objects used in the ref-object typed components
 	// +kubebuilder:pruning:PreserveUnknownFields
@@ -161,3 +166,21 @@ type ApplicationRevisionList struct {
 	metav1.ListMeta `json:"metadata,omitempty"`
 	Items           []ApplicationRevision `json:"items"`
 }
+
+// PolicyVersionMetadata records version information for a PolicyDefinition used in an ApplicationRevision
+// This helps users identify which DefinitionRevision was selected when the ApplicationRevision was created
+type PolicyVersionMetadata struct {
+	// DefinitionRevisionName is the DefinitionRevision resource name if versioned (e.g. "my-policy-v3")
+	// Empty if the policy used latest PolicyDefinition (no @version specified)
+	// +optional
+	DefinitionRevisionName string `json:"definitionRevisionName,omitempty"`
+
+	// Revision is the revision number from the DefinitionRevision (e.g. 3)
+	// +optional
+	Revision int64 `json:"revision,omitempty"`
+
+	// RevisionHash is the hash of the PolicyDefinition template
+	// This is the definitive proof of exactly what template was used
+	// +optional
+	RevisionHash string `json:"revisionHash,omitempty"`
+}

apis/core.oam.dev/v1beta1/policy_definition.go

@@ -24,6 +24,19 @@ import (
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
 )
 
+// PolicyScope defines the scope at which a policy operates
+type PolicyScope string
+
+const (
+	// DefaultScope (empty string) means standard output / builtin policy
+	DefaultScope PolicyScope = ""
+
+	// ApplicationScope means the policy transforms the Application CR before parsing
+	// These policies use the Application transforms pattern
+	// (via output.{labels|annotations|ctx|components|traits|workflow|policies}) and don't generate resources
+	ApplicationScope PolicyScope = "Application"
+)
+
 // PolicyDefinitionSpec defines the desired state of PolicyDefinition
 type PolicyDefinitionSpec struct {
 	// Reference to the CustomResourceDefinition that defines this trait kind.
@@ -40,6 +53,30 @@ type PolicyDefinitionSpec struct {
 
 	//+optional
 	Version string `json:"version,omitempty"`
+
+	// Scope defines the scope at which this policy operates.
+	// - DefaultScope (empty/omitted): Standard output-based or builtin policies (topology, override, etc.)
+	//   These can generate Kubernetes resources from CUE templates with an 'output' field or apply Go-logic in the controller
+	// - ApplicationScope: Transform-based policies that modify the Application CR before parsing.
+	//   Requires EnableApplicationScopedPolicies feature gate.
+	// +optional
+	Scope PolicyScope `json:"scope,omitempty"`
+
+	// Global indicates this policy should automatically apply to all Applications
+	// in this namespace (or all namespaces if in vela-system).
+	// Global policies cannot be explicitly referenced in Application specs.
+	// Requires EnableGlobalPolicies feature gate for discovery and
+	// EnableApplicationScopedPolicies feature gate for execution.
+	// +optional
+	Global bool `json:"global,omitempty"`
+
+	// Priority defines the order in which global policies are applied.
+	// Lower values run first (e.g. 0 runs before 100), following the same
+	// convention as Kubernetes admission webhooks. Policies with the same
+	// priority are applied in alphabetical order by name.
+	// If not specified, defaults to 0.
+	// +optional
+	Priority int32 `json:"priority,omitempty"`
 }
 
 // PolicyDefinitionStatus is the status of PolicyDefinition

apis/core.oam.dev/v1beta1/zz_generated.deepcopy.go

@@ -21,7 +21,7 @@ limitations under the License.
 package v1beta1
 
 import (
-	"github.com/kubevela/workflow/api/v1alpha1"
+	"github.com/kubevela/pkg/apis/oam/v1alpha1"
 	"k8s.io/apimachinery/pkg/runtime"
 
 	"github.com/oam-dev/kubevela/apis/core.oam.dev/common"
@@ -184,6 +184,13 @@ func (in *ApplicationRevisionCompressibleFields) DeepCopyInto(out *ApplicationRe
 			(*out)[key] = *val.DeepCopy()
 		}
 	}
+	if in.PolicyVersions != nil {
+		in, out := &in.PolicyVersions, &out.PolicyVersions
+		*out = make(map[string]PolicyVersionMetadata, len(*in))
+		for key, val := range *in {
+			(*out)[key] = val
+		}
+	}
 	if in.WorkflowStepDefinitions != nil {
 		in, out := &in.WorkflowStepDefinitions, &out.WorkflowStepDefinitions
 		*out = make(map[string]*WorkflowStepDefinition, len(*in))
@@ -691,6 +698,21 @@ func (in *PolicyDefinitionStatus) DeepCopy() *PolicyDefinitionStatus {
 	return out
 }
 
+// DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
+func (in *PolicyVersionMetadata) DeepCopyInto(out *PolicyVersionMetadata) {
+	*out = *in
+}
+
+// DeepCopy is an autogenerated deepcopy function, copying the receiver, creating a new PolicyVersionMetadata.
+func (in *PolicyVersionMetadata) DeepCopy() *PolicyVersionMetadata {
+	if in == nil {
+		return nil
+	}
+	out := new(PolicyVersionMetadata)
+	in.DeepCopyInto(out)
+	return out
+}
+
 // DeepCopyInto is an autogenerated deepcopy function, copying the receiver, writing into out. in must be non-nil.
 func (in *ResourceTracker) DeepCopyInto(out *ResourceTracker) {
 	*out = *in

apis/types/types.go

@@ -148,6 +148,15 @@ const (
 
 	// TypeLegacy defines legacy commands
 	TypeLegacy = "Legacy Commands"
+
+	// TypeDefManagement defines definition management commands
+	TypeDefManagement = "Definition Management"
+
+	// TypeDefGeneration defines definition generation commands
+	TypeDefGeneration = "Code Generation"
+
+	// TypeDefModule defines Go definition module commands
+	TypeDefModule = "Go Definition Modules"
 )
 
 // LabelArg is the argument `label` of a definition

charts/vela-core/README.md

@@ -101,6 +101,8 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 | `featureGates.enableCueValidation`                           | enable the strict cue validation for cue required parameter fields                                                                                                                                                               | `false` |
 | `featureGates.enableApplicationStatusMetrics`                | enable application status metrics and structured logging                                                                                                                                                                         | `false` |
 | `featureGates.validateResourcesExist`                        | enable webhook validation to check if resource types referenced in definition templates exist in the cluster                                                                                                                     | `false` |
+| `featureGates.enableApplicationScopedPolicies`               | enable Application-scoped PolicyDefinitions that transform Application CR before rendering (Alpha)                                                                                                                               | `false` |
+| `featureGates.enableGlobalPolicies`                          | enable automatic discovery and application of global PolicyDefinitions to all Applications (Alpha)                                                                                                                               | `false` |
 
 ### MultiCluster parameters
 
@@ -151,6 +153,7 @@ helm install --create-namespace -n vela-system kubevela kubevela/vela-core --wai
 | `devLogs`                                      | Enable formatted logging support for development purpose                                                                                                           | `false`              |
 | `logFilePath`                                  | If non-empty, write log files in this path                                                                                                                         | `""`                 |
 | `logFileMaxSize`                               | Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited.                                         | `1024`               |
+| `admissionWebhookTimeout`                      | Timeout seconds for admission webhooks                                                                                                                             | `10`                 |
 | `kubeClient.qps`                               | The qps for reconcile clients                                                                                                                                      | `400`                |
 | `kubeClient.burst`                             | The burst for reconcile clients                                                                                                                                    | `600`                |
 | `authentication.enabled`                       | Enable authentication framework for applications                                                                                                                   | `false`              |

charts/vela-core/crds/core.oam.dev_applicationrevisions.yaml

@@ -372,6 +372,66 @@ spec:
                   status:
                     description: AppStatus defines the observed state of Application
                     properties:
+                      applicationPoliciesConfigMap:
+                        description: |-
+                          ApplicationPoliciesConfigMap references the ConfigMap containing rendered policy outputs
+                          Format: "application-policies-{namespace}-{name}"
+                        type: string
+                      appliedApplicationPolicies:
+                        description: |-
+                          AppliedApplicationPolicies lists Application-scoped policies (both global and explicit)
+                          that were discovered and applied (or skipped) during reconciliation.
+                        items:
+                          description: |-
+                            AppliedApplicationPolicy records minimal status information about an Application-scoped policy.
+                            This covers both global (auto-discovered) and explicit (spec-referenced) policies.
+                            Full details (transforms, labels, annotations, etc.) are stored in the ConfigMap referenced
+                            by ApplicationPoliciesConfigMap for persistent storage and observability.
+                          properties:
+                            annotationsCount:
+                              type: integer
+                            applied:
+                              type: boolean
+                            definitionRevisionName:
+                              description: |-
+                                Version tracking
+                                DefinitionRevisionName is the DefinitionRevision resource name if a versioned policy was used (e.g., "my-policy-v3")
+                                Empty if the policy wasn't versioned (used latest PolicyDefinition)
+                              type: string
+                            error:
+                              type: boolean
+                            hasContext:
+                              type: boolean
+                            labelsCount:
+                              type: integer
+                            message:
+                              type: string
+                            name:
+                              type: string
+                            namespace:
+                              type: string
+                            revision:
+                              description: Revision is the revision number from the
+                                DefinitionRevision (e.g. 3)
+                              format: int64
+                              type: integer
+                            revisionHash:
+                              description: |-
+                                RevisionHash is the hash of the PolicyDefinition template from the DefinitionRevision
+                                This is the definitive proof of exactly what template was used
+                              type: string
+                            source:
+                              type: string
+                            specModified:
+                              type: boolean
+                            type:
+                              type: string
+                          required:
+                          - applied
+                          - name
+                          - namespace
+                          type: object
+                        type: array
                       appliedResources:
                         description: AppliedResources record the resources that the  workflow
                           step apply.
@@ -632,6 +692,8 @@ spec:
                                     type: boolean
                                   message:
                                     type: string
+                                  pending:
+                                    type: boolean
                                   type:
                                     type: string
                                 required:
@@ -651,6 +713,10 @@ spec:
                               - apiVersion
                               - kind
                               type: object
+                            workloadHealthy:
+                              description: WorkloadHealthy indicates the workload
+                                health without considering trait health.
+                              type: boolean
                           required:
                           - healthy
                           - name
@@ -817,6 +883,13 @@ spec:
                         - suspend
                         - terminated
                         type: object
+                      workflowRestartScheduledAt:
+                        description: |-
+                          WorkflowRestartScheduledAt schedules a workflow restart at the specified time.
+                          This field is automatically set when the app.oam.dev/restart-workflow annotation is present,
+                          and is cleared after the restart is triggered. Use RFC3339 format or set to current time for immediate restart.
+                        format: date-time
+                        type: string
                     type: object
                 type: object
               componentDefinitions:
@@ -1218,11 +1291,28 @@ spec:
                           required:
                           - name
                           type: object
+                        global:
+                          description: |-
+                            Global indicates this policy should automatically apply to all Applications
+                            in this namespace (or all namespaces if in vela-system).
+                            Global policies cannot be explicitly referenced in Application specs.
+                            Requires EnableGlobalPolicies feature gate for discovery and
+                            EnableApplicationScopedPolicies feature gate for execution.
+                          type: boolean
                         manageHealthCheck:
                           description: |-
                             ManageHealthCheck means the policy will handle health checking and skip application controller
                             built-in health checking.
                           type: boolean
+                        priority:
+                          description: |-
+                            Priority defines the order in which global policies are applied.
+                            Lower values run first (e.g. 0 runs before 100), following the same
+                            convention as Kubernetes admission webhooks. Policies with the same
+                            priority are applied in alphabetical order by name.
+                            If not specified, defaults to 0.
+                          format: int32
+                          type: integer
                         schematic:
                           description: |-
                             Schematic defines the data format and template of the encapsulation of the policy definition.
@@ -1319,6 +1409,14 @@ spec:
                               - configuration
                               type: object
                           type: object
+                        scope:
+                          description: |-
+                            Scope defines the scope at which this policy operates.
+                            - DefaultScope (empty/omitted): Standard output-based or builtin policies (topology, override, etc.)
+                              These can generate Kubernetes resources from CUE templates with an 'output' field or apply Go-logic in the controller
+                            - ApplicationScope: Transform-based policies that modify the Application CR before parsing.
+                              Requires EnableApplicationScopedPolicies feature gate.
+                          type: string
                         version:
                           type: string
                       type: object
@@ -1386,6 +1484,32 @@ spec:
                 description: PolicyDefinitions records the snapshot of the PolicyDefinitions
                   related with the created/modified Application
                 type: object
+              policyVersions:
+                additionalProperties:
+                  description: |-
+                    PolicyVersionMetadata records version information for a PolicyDefinition used in an ApplicationRevision
+                    This helps users identify which DefinitionRevision was selected when the ApplicationRevision was created
+                  properties:
+                    definitionRevisionName:
+                      description: |-
+                        DefinitionRevisionName is the DefinitionRevision resource name if versioned (e.g. "my-policy-v3")
+                        Empty if the policy used latest PolicyDefinition (no @version specified)
+                      type: string
+                    revision:
+                      description: Revision is the revision number from the DefinitionRevision
+                        (e.g. 3)
+                      format: int64
+                      type: integer
+                    revisionHash:
+                      description: |-
+                        RevisionHash is the hash of the PolicyDefinition template
+                        This is the definitive proof of exactly what template was used
+                      type: string
+                  type: object
+                description: |-
+                  PolicyVersions records version metadata for each policy (which DefinitionRevision was used)
+                  Key is the policy name (same as PolicyDefinitions keys)
+                type: object
               referredObjects:
                 description: ReferredObjects records the referred objects used in
                   the ref-object typed components

charts/vela-core/crds/core.oam.dev_applications.yaml

@@ -322,6 +322,66 @@ spec:
           status:
             description: AppStatus defines the observed state of Application
             properties:
+              applicationPoliciesConfigMap:
+                description: |-
+                  ApplicationPoliciesConfigMap references the ConfigMap containing rendered policy outputs
+                  Format: "application-policies-{namespace}-{name}"
+                type: string
+              appliedApplicationPolicies:
+                description: |-
+                  AppliedApplicationPolicies lists Application-scoped policies (both global and explicit)
+                  that were discovered and applied (or skipped) during reconciliation.
+                items:
+                  description: |-
+                    AppliedApplicationPolicy records minimal status information about an Application-scoped policy.
+                    This covers both global (auto-discovered) and explicit (spec-referenced) policies.
+                    Full details (transforms, labels, annotations, etc.) are stored in the ConfigMap referenced
+                    by ApplicationPoliciesConfigMap for persistent storage and observability.
+                  properties:
+                    annotationsCount:
+                      type: integer
+                    applied:
+                      type: boolean
+                    definitionRevisionName:
+                      description: |-
+                        Version tracking
+                        DefinitionRevisionName is the DefinitionRevision resource name if a versioned policy was used (e.g., "my-policy-v3")
+                        Empty if the policy wasn't versioned (used latest PolicyDefinition)
+                      type: string
+                    error:
+                      type: boolean
+                    hasContext:
+                      type: boolean
+                    labelsCount:
+                      type: integer
+                    message:
+                      type: string
+                    name:
+                      type: string
+                    namespace:
+                      type: string
+                    revision:
+                      description: Revision is the revision number from the DefinitionRevision
+                        (e.g. 3)
+                      format: int64
+                      type: integer
+                    revisionHash:
+                      description: |-
+                        RevisionHash is the hash of the PolicyDefinition template from the DefinitionRevision
+                        This is the definitive proof of exactly what template was used
+                      type: string
+                    source:
+                      type: string
+                    specModified:
+                      type: boolean
+                    type:
+                      type: string
+                  required:
+                  - applied
+                  - name
+                  - namespace
+                  type: object
+                type: array
               appliedResources:
                 description: AppliedResources record the resources that the  workflow
                   step apply.
@@ -580,6 +640,8 @@ spec:
                             type: boolean
                           message:
                             type: string
+                          pending:
+                            type: boolean
                           type:
                             type: string
                         required:
@@ -599,6 +661,10 @@ spec:
                       - apiVersion
                       - kind
                       type: object
+                    workloadHealthy:
+                      description: WorkloadHealthy indicates the workload health without
+                        considering trait health.
+                      type: boolean
                   required:
                   - healthy
                   - name
@@ -760,6 +826,13 @@ spec:
                 - suspend
                 - terminated
                 type: object
+              workflowRestartScheduledAt:
+                description: |-
+                  WorkflowRestartScheduledAt schedules a workflow restart at the specified time.
+                  This field is automatically set when the app.oam.dev/restart-workflow annotation is present,
+                  and is cleared after the restart is triggered. Use RFC3339 format or set to current time for immediate restart.
+                format: date-time
+                type: string
             type: object
         type: object
     served: true

charts/vela-core/crds/core.oam.dev_definitionrevisions.yaml

@@ -395,11 +395,28 @@ spec:
                         required:
                         - name
                         type: object
+                      global:
+                        description: |-
+                          Global indicates this policy should automatically apply to all Applications
+                          in this namespace (or all namespaces if in vela-system).
+                          Global policies cannot be explicitly referenced in Application specs.
+                          Requires EnableGlobalPolicies feature gate for discovery and
+                          EnableApplicationScopedPolicies feature gate for execution.
+                        type: boolean
                       manageHealthCheck:
                         description: |-
                           ManageHealthCheck means the policy will handle health checking and skip application controller
                           built-in health checking.
                         type: boolean
+                      priority:
+                        description: |-
+                          Priority defines the order in which global policies are applied.
+                          Lower values run first (e.g. 0 runs before 100), following the same
+                          convention as Kubernetes admission webhooks. Policies with the same
+                          priority are applied in alphabetical order by name.
+                          If not specified, defaults to 0.
+                        format: int32
+                        type: integer
                       schematic:
                         description: |-
                           Schematic defines the data format and template of the encapsulation of the policy definition.
@@ -495,6 +512,14 @@ spec:
                             - configuration
                             type: object
                         type: object
+                      scope:
+                        description: |-
+                          Scope defines the scope at which this policy operates.
+                          - DefaultScope (empty/omitted): Standard output-based or builtin policies (topology, override, etc.)
+                            These can generate Kubernetes resources from CUE templates with an 'output' field or apply Go-logic in the controller
+                          - ApplicationScope: Transform-based policies that modify the Application CR before parsing.
+                            Requires EnableApplicationScopedPolicies feature gate.
+                        type: string
                       version:
                         type: string
                     type: object

charts/vela-core/crds/core.oam.dev_policydefinitions.yaml

@@ -58,11 +58,28 @@ spec:
                 required:
                 - name
                 type: object
+              global:
+                description: |-
+                  Global indicates this policy should automatically apply to all Applications
+                  in this namespace (or all namespaces if in vela-system).
+                  Global policies cannot be explicitly referenced in Application specs.
+                  Requires EnableGlobalPolicies feature gate for discovery and
+                  EnableApplicationScopedPolicies feature gate for execution.
+                type: boolean
               manageHealthCheck:
                 description: |-
                   ManageHealthCheck means the policy will handle health checking and skip application controller
                   built-in health checking.
                 type: boolean
+              priority:
+                description: |-
+                  Priority defines the order in which global policies are applied.
+                  Lower values run first (e.g. 0 runs before 100), following the same
+                  convention as Kubernetes admission webhooks. Policies with the same
+                  priority are applied in alphabetical order by name.
+                  If not specified, defaults to 0.
+                format: int32
+                type: integer
               schematic:
                 description: |-
                   Schematic defines the data format and template of the encapsulation of the policy definition.
@@ -156,6 +173,14 @@ spec:
                     - configuration
                     type: object
                 type: object
+              scope:
+                description: |-
+                  Scope defines the scope at which this policy operates.
+                  - DefaultScope (empty/omitted): Standard output-based or builtin policies (topology, override, etc.)
+                    These can generate Kubernetes resources from CUE templates with an 'output' field or apply Go-logic in the controller
+                  - ApplicationScope: Transform-based policies that modify the Application CR before parsing.
+                    Requires EnableApplicationScopedPolicies feature gate.
+                type: string
               version:
                 type: string
             type: object

charts/vela-core/crds/core.oam.dev_workflows.yaml

@@ -3,8 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.9.0
-  creationTimestamp: null
+    controller-gen.kubebuilder.io/version: v0.16.5
   name: workflows.core.oam.dev
 spec:
   group: core.oam.dev
@@ -23,14 +22,19 @@ spec:
         description: Workflow is the Schema for the workflow API
         properties:
           apiVersion:
-            description: 'APIVersion defines the versioned schema of this representation
-              of an object. Servers should convert recognized schemas to the latest
-              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources'
+            description: |-
+              APIVersion defines the versioned schema of this representation of an object.
+              Servers should convert recognized schemas to the latest internal value, and
+              may reject unrecognized values.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
             type: string
           kind:
-            description: 'Kind is a string value representing the REST resource this
-              object represents. Servers may infer this from the endpoint the client
-              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds'
+            description: |-
+              Kind is a string value representing the REST resource this object represents.
+              Servers may infer this from the endpoint the client submits requests to.
+              Cannot be updated.
+              In CamelCase.
+              More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
             type: string
           metadata:
             type: object
@@ -59,6 +63,7 @@ spec:
                 inputs:
                   description: Inputs is the inputs of the step
                   items:
+                    description: InputItem defines an input variable of WorkflowStep
                     properties:
                       from:
                         type: string
@@ -66,7 +71,6 @@ spec:
                         type: string
                     required:
                     - from
-                    - parameterKey
                     type: object
                   type: array
                 meta:
@@ -75,12 +79,18 @@ spec:
                     alias:
                       type: string
                   type: object
+                mode:
+                  description: Mode is only valid for sub steps, it defines the mode
+                    of the sub steps
+                  nullable: true
+                  type: string
                 name:
                   description: Name is the unique name of the workflow step.
                   type: string
                 outputs:
                   description: Outputs is the outputs of the step
                   items:
+                    description: OutputItem defines an output variable of WorkflowStep
                     properties:
                       name:
                         type: string
@@ -110,6 +120,7 @@ spec:
                       inputs:
                         description: Inputs is the inputs of the step
                         items:
+                          description: InputItem defines an input variable of WorkflowStep
                           properties:
                             from:
                               type: string
@@ -117,7 +128,6 @@ spec:
                               type: string
                           required:
                           - from
-                          - parameterKey
                           type: object
                         type: array
                       meta:
@@ -132,6 +142,7 @@ spec:
                       outputs:
                         description: Outputs is the outputs of the step
                         items:
+                          description: OutputItem defines an output variable of WorkflowStep
                           properties:
                             name:
                               type: string
@@ -153,7 +164,6 @@ spec:
                         description: Type is the type of the workflow step.
                         type: string
                     required:
-                    - name
                     - type
                     type: object
                   type: array
@@ -164,7 +174,6 @@ spec:
                   description: Type is the type of the workflow step.
                   type: string
               required:
-              - name
               - type
               type: object
             type: array

charts/vela-core/templates/admission-webhooks/mutatingWebhookConfiguration.yaml

@@ -45,6 +45,7 @@ webhooks:
           - UPDATE
         resources:
           - applications
+    timeoutSeconds: {{ .Values.admissionWebhookTimeout }}
   - clientConfig:
       caBundle: {{ default "Cg==" (get $vals "comps") }}
       service:
@@ -71,5 +72,6 @@ webhooks:
           - UPDATE
         resources:
           - componentdefinitions
+    timeoutSeconds: {{ .Values.admissionWebhookTimeout }}
 
 {{- end -}}

charts/vela-core/templates/admission-webhooks/validatingWebhookConfiguration.yaml

@@ -47,7 +47,7 @@ webhooks:
           - UPDATE
         resources:
           - traitdefinitions
-    timeoutSeconds: 5
+    timeoutSeconds: {{ .Values.admissionWebhookTimeout }}
   - clientConfig:
       caBundle: {{ default "Cg==" (get $vals "apps") }}
       service:
@@ -74,6 +74,7 @@ webhooks:
           - UPDATE
         resources:
           - applications
+    timeoutSeconds: {{ .Values.admissionWebhookTimeout }}
   - clientConfig:
       caBundle: {{ default "Cg==" (get $vals "comps") }}
       service:
@@ -100,6 +101,7 @@ webhooks:
           - UPDATE
         resources:
           - componentdefinitions
+    timeoutSeconds: {{ .Values.admissionWebhookTimeout }}
   - clientConfig:
       caBundle: {{ default "Cg==" (get $vals "policies") }}
       service:
@@ -126,6 +128,7 @@ webhooks:
           - UPDATE
         resources:
           - policydefinitions
+    timeoutSeconds: {{ .Values.admissionWebhookTimeout }}
   - clientConfig:
       caBundle: Cg==
       service:
@@ -152,4 +155,5 @@ webhooks:
           - UPDATE
         resources:
           - workflowstepdefinitions
+    timeoutSeconds: {{ .Values.admissionWebhookTimeout }}
 {{- end -}}

charts/vela-core/templates/defwithtemplate/affinity.yaml

@@ -131,20 +131,21 @@ spec:
 
         #podAffinityTerm: {
         	labelSelector?: #labelSelector
+        	namespace?:     string
         	namespaces?: [...string]
         	topologyKey:        string
         	namespaceSelector?: #labelSelector
         }
 
-        #nodeSelecor: {
+        #nodeSelector: {
         	key:      string
         	operator: *"In" | "NotIn" | "Exists" | "DoesNotExist" | "Gt" | "Lt"
         	values?: [...string]
         }
 
         #nodeSelectorTerm: {
-        	matchExpressions?: [...#nodeSelecor]
-        	matchFields?: [...#nodeSelecor]
+        	matchExpressions?: [...#nodeSelector]
+        	matchFields?: [...#nodeSelector]
         }
 
         parameter: {

charts/vela-core/templates/defwithtemplate/apply-application-in-parallel.yaml

@@ -15,9 +15,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/op"
-        )
+        import "vela/op"
 
         output: op.#ApplyApplicationInParallel & {}
 

charts/vela-core/templates/defwithtemplate/apply-application.yaml

@@ -16,9 +16,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/op"
-        )
+        import "vela/op"
 
         // apply application
         output: op.#ApplyApplication & {}

charts/vela-core/templates/defwithtemplate/apply-deployment.yaml

@@ -13,12 +13,8 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"strconv"
-        	"strings"
-        	"vela/kube"
-        	"vela/builtin"
-        )
+        import "vela/kube"
+        import "vela/builtin"
 
         output: kube.#Apply & {
         	$params: {

charts/vela-core/templates/defwithtemplate/apply-object.yaml

@@ -12,9 +12,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/kube"
-        )
+        import "vela/kube"
 
         apply: kube.#Apply & {
         	$params: parameter

charts/vela-core/templates/defwithtemplate/apply-remaining.yaml

@@ -16,9 +16,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/op"
-        )
+        import "vela/op"
 
         // apply remaining components and traits
         apply: op.#ApplyRemaining & {

charts/vela-core/templates/defwithtemplate/apply-terraform-config.yaml

@@ -13,10 +13,8 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/kube"
-        	"vela/builtin"
-        )
+        import "vela/kube"
+        import "vela/builtin"
 
         apply: kube.#Apply & {
         	$params: value: {

charts/vela-core/templates/defwithtemplate/apply-terraform-provider.yaml

@@ -13,12 +13,9 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/config"
-        	"vela/kube"
-        	"vela/builtin"
-        	"strings"
-        )
+        import "vela/config"
+        import "vela/kube"
+        import "vela/builtin"
 
         cfg: config.#CreateConfig & {
         	$params: {
@@ -87,9 +84,9 @@ spec:
         	}
         }
         providerBasic: {
-        	accessKey: string
-        	secretKey: string
-        	region:    string
+        	accessKey!: string
+        	secretKey!: string
+        	region!:    string
         }
         #AlibabaProvider: {
         	providerBasic
@@ -141,5 +138,5 @@ spec:
         	type:       "ucloud"
         	name:       *"ucloud-provider" | string
         }
-        parameter: *#AlibabaProvider | #AWSProvider | #AzureProvider | #BaiduProvider | #ECProvider | #GCPProvider | #TencentProvider | #UCloudProvider
+        parameter: #AlibabaProvider | #AWSProvider | #AzureProvider | #BaiduProvider | #ECProvider | #GCPProvider | #TencentProvider | #UCloudProvider
 

charts/vela-core/templates/defwithtemplate/build-push-image.yaml

@@ -13,13 +13,10 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/builtin"
-        	"vela/kube"
-        	"vela/util"
-        	"encoding/json"
-        	"strings"
-        )
+        import "vela/builtin"
+        import "vela/kube"
+        import "vela/util"
+        import "strings"
 
         url: {
         	if parameter.context.git != _|_ {

charts/vela-core/templates/defwithtemplate/check-metrics.yaml

@@ -14,17 +14,14 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/metrics"
-        	"vela/builtin"
-        )
+        import "vela/metrics"
+        import "vela/builtin"
 
         check: metrics.#PromCheck & {
         	$params: {
         		query:          parameter.query
         		metricEndpoint: parameter.metricEndpoint
         		condition:      parameter.condition
-        		stepID:         context.stepSessionID
         		duration:       parameter.duration
         		failDuration:   parameter.failDuration
         	}

charts/vela-core/templates/defwithtemplate/clean-jobs.yaml

@@ -12,9 +12,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/kube"
-        )
+        import "vela/kube"
 
         parameter: {
         	labelselector?: {...}

charts/vela-core/templates/defwithtemplate/collect-service-endpoints.yaml

@@ -12,11 +12,9 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/builtin"
-        	"vela/query"
-        	"strconv"
-        )
+        import "vela/builtin"
+        import "vela/query"
+        import "strconv"
 
         collect: query.#CollectServiceEndpoints & {
         	$params: app: {

charts/vela-core/templates/defwithtemplate/command.yaml

@@ -16,6 +16,8 @@ spec:
   schematic:
     cue:
       template: |
+        import "list"
+
         #PatchParams: {
         	// +usage=Specify the name of the target container, if not set, use the component name
         	containerName: *"" | string
@@ -73,7 +75,7 @@ spec:
         		}
 
         		// +patchStrategy=replace
-        		args: [for a in _args if _delArgs[a] == _|_ {a}] + [for a in _addArgs if _delArgs[a] == _|_ && _argsMap[a] == _|_ {a}]
+        		args: list.Concat([[for a in _args if _delArgs[a] == _|_ {a}], [for a in _addArgs if _delArgs[a] == _|_ && _argsMap[a] == _|_ {a}]])
         	}
         }
         // +patchStrategy=open

charts/vela-core/templates/defwithtemplate/container-ports.yaml

@@ -17,10 +17,9 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"strconv"
-        	"strings"
-        )
+        import "strconv"
+        import "strings"
+        import "list"
 
         #PatchParams: {
         	// +usage=Specify the name of the target container, if not set, use the component name
@@ -67,7 +66,7 @@ spec:
         			_basePortsMap: {for _basePort in _basePorts {(strings.ToLower(_basePort.protocol) + strconv.FormatInt(_basePort.containerPort, 10)): _basePort}}
         			_portsMap: {for port in _params.ports {(strings.ToLower(port.protocol) + strconv.FormatInt(port.containerPort, 10)): port}}
         			// +patchStrategy=replace
-        			ports: [for portVar in _basePorts {
+        			ports: list.Concat([[for portVar in _basePorts {
         				containerPort: portVar.containerPort
         				protocol:      portVar.protocol
         				name:          portVar.name
@@ -80,7 +79,7 @@ spec:
         						hostIP: _portsMap[_uniqueKey].hostIP
         					}
         				}
-        			}] + [for port in _params.ports if _basePortsMap[strings.ToLower(port.protocol)+strconv.FormatInt(port.containerPort, 10)] == _|_ {
+        			}], [for port in _params.ports if _basePortsMap[strings.ToLower(port.protocol)+strconv.FormatInt(port.containerPort, 10)] == _|_ {
         				if port.containerPort != _|_ {
         					containerPort: port.containerPort
         				}
@@ -93,7 +92,7 @@ spec:
         				if port.hostIP != _|_ {
         					hostIP: port.hostIP
         				}
-        			}]
+        			}]])
         		}
         	}
         }

charts/vela-core/templates/defwithtemplate/create-config.yaml

@@ -12,9 +12,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/config"
-        )
+        import "vela/config"
 
         deploy: config.#CreateConfig & {
         	$params: parameter

charts/vela-core/templates/defwithtemplate/cron-task.yaml

@@ -11,6 +11,8 @@ spec:
   schematic:
     cue:
       template: |
+        import "list"
+
         mountsArray: {
         	pvc: *[
         		for v in parameter.volumeMounts.pvc {
@@ -130,7 +132,7 @@ spec:
         		},
         	] | []
         }
-        volumesList: volumesArray.pvc + volumesArray.configMap + volumesArray.secret + volumesArray.emptyDir + volumesArray.hostPath
+        volumesList: list.Concat([volumesArray.pvc, volumesArray.configMap, volumesArray.secret, volumesArray.emptyDir, volumesArray.hostPath])
         deDupVolumesArray: [
         	for val in [
         		for i, vi in volumesList {

charts/vela-core/templates/defwithtemplate/daemon.yaml

@@ -11,9 +11,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"strconv"
-        )
+        import "strconv"
 
         mountsArray: [
         	if parameter.volumeMounts != _|_ && parameter.volumeMounts.pvc != _|_ for v in parameter.volumeMounts.pvc {

charts/vela-core/templates/defwithtemplate/delete-config.yaml

@@ -12,9 +12,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/config"
-        )
+        import "vela/config"
 
         deploy: config.#DeleteConfig & {
         	$params: parameter

charts/vela-core/templates/defwithtemplate/depends-on-app.yaml

@@ -12,11 +12,9 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/kube"
-        	"vela/builtin"
-        	"encoding/yaml"
-        )
+        import "vela/kube"
+        import "vela/builtin"
+        import "encoding/yaml"
 
         dependsOn: kube.#Read & {
         	$params: value: {

charts/vela-core/templates/defwithtemplate/deploy-cloud-resource.yaml

@@ -14,9 +14,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/op"
-        )
+        import "vela/op"
 
         app: op.#DeployCloudResource & {
         	env:    parameter.env

charts/vela-core/templates/defwithtemplate/deploy.yaml

@@ -14,10 +14,9 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/multicluster"
-        	"vela/builtin"
-        )
+        import "vela/multicluster"
+        import "vela/builtin"
+
 
         if parameter.auto == false {
         	suspend: builtin.#Suspend & {$params: message: "Waiting approval to the deploy step \"\(context.stepName)\""}

charts/vela-core/templates/defwithtemplate/deploy2env.yaml

@@ -15,9 +15,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/op"
-        )
+        import "vela/op"
 
         app: op.#ApplyEnvBindApp & {
         	env:      parameter.env

charts/vela-core/templates/defwithtemplate/deploy2runtime.yaml

@@ -15,9 +15,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/op"
-        )
+        import "vela/op"
 
         app: op.#Steps & {
         	load: op.#Load

charts/vela-core/templates/defwithtemplate/env.yaml

@@ -16,6 +16,8 @@ spec:
   schematic:
     cue:
       template: |
+        import "list"
+
         #PatchParams: {
         	// +usage=Specify the name of the target container, if not set, use the component name
         	containerName: *"" | string
@@ -49,7 +51,7 @@ spec:
         		if _baseEnv != _|_ {
         			_baseEnvMap: {for envVar in _baseEnv {(envVar.name): envVar}}
         			// +patchStrategy=replace
-        			env: [for envVar in _baseEnv if _delKeys[envVar.name] == _|_ && !_params.replace {
+        			env: list.Concat([[for envVar in _baseEnv if _delKeys[envVar.name] == _|_ && !_params.replace {
         				name: envVar.name
         				if _params.env[envVar.name] != _|_ {
         					value: _params.env[envVar.name]
@@ -62,10 +64,10 @@ spec:
         						valueFrom: envVar.valueFrom
         					}
         				}
-        			}] + [for k, v in _params.env if _delKeys[k] == _|_ && (_params.replace || _baseEnvMap[k] == _|_) {
+        			}], [for k, v in _params.env if _delKeys[k] == _|_ && (_params.replace || _baseEnvMap[k] == _|_) {
         				name:  k
         				value: v
-        			}]
+        			}]])
         		}
         	}
         }

charts/vela-core/templates/defwithtemplate/export-data.yaml

@@ -14,10 +14,8 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/op"
-        	"vela/kube"
-        )
+        import "vela/op"
+        import "vela/kube"
 
         object: {
         	apiVersion: "v1"

charts/vela-core/templates/defwithtemplate/export-service.yaml

@@ -14,10 +14,8 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/op"
-        	"vela/kube"
-        )
+        import "vela/op"
+        import "vela/kube"
 
         meta: {
         	name:      *context.name | string

charts/vela-core/templates/defwithtemplate/export2config.yaml

@@ -12,9 +12,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/kube"
-        )
+        import "vela/kube"
 
         apply: kube.#Apply & {
         	$params: {

charts/vela-core/templates/defwithtemplate/export2secret.yaml

@@ -12,11 +12,9 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/kube"
-        	"encoding/base64"
-        	"encoding/json"
-        )
+        import "vela/kube"
+        import "encoding/base64"
+        import "encoding/json"
 
         secret: {
         	data: *parameter.data | {}

charts/vela-core/templates/defwithtemplate/expose.yaml

@@ -15,10 +15,8 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"strconv"
-        	"strings"
-        )
+        import "strconv"
+        import "strings"
 
         outputs: service: {
         	apiVersion: "v1"
@@ -96,21 +94,17 @@ spec:
   stage: PostDispatch
   status:
     customStatus: |-
-      message: *"" | string
       service: context.outputs.service
+      message: *"" | string
       if service.spec.type == "ClusterIP" {
       	message: "ClusterIP: \(service.spec.clusterIP)"
       }
       if service.spec.type == "LoadBalancer" {
       	status: service.status
       	isHealth: *false | bool
+      	message: *"ExternalIP: Pending" | string
       	if status != _|_ if status.loadBalancer != _|_ if status.loadBalancer.ingress != _|_ if len(status.loadBalancer.ingress) > 0 if status.loadBalancer.ingress[0].ip != _|_ {
       		isHealth: true
-      	}
-      	if !isHealth {
-      		message: "ExternalIP: Pending"
-      	}
-      	if isHealth {
       		message: "ExternalIP: \(status.loadBalancer.ingress[0].ip)"
       	}
       }

charts/vela-core/templates/defwithtemplate/gateway.yaml

@@ -17,6 +17,7 @@ spec:
       template: |
         import "strconv"
 
+
         let nameSuffix = {
         	if parameter.name != _|_ {"-" + parameter.name}
         	if parameter.name == _|_ {""}
@@ -160,13 +161,17 @@ spec:
         if parameter.name == _|_ { "" }
       }
       let ingressMetaName = context.name + nameSuffix
-      let ig  = [for i in context.outputs if (i.kind == "Ingress") && (i.metadata.name == ingressMetaName) {i}][0]
+      let igList = [for i in context.outputs if (i.kind == "Ingress") && (i.metadata.name == ingressMetaName) {i}]
+      ig: *_|_ | _
+      if len(igList) > 0 {
+        ig: igList[0]
+      }
       igs: *{} | {}
-      if ig != _|_ if ig.status != _|_ if ig.status.loadbalancer != _|_ {
+      if ig != _|_ if ig.status != _|_ if ig.status.loadbalancer != _|_ if len(ig.status.loadbalancer.ingress) > 0 {
         igs: ig.status.loadbalancer.ingress[0]
       }
       igr: *{} | {}
-      if ig != _|_ if ig.spec != _|_  {
+      if ig != _|_ if ig.spec != _|_ if len(ig.spec.rules) > 0 {
         igr: ig.spec.rules[0]
       }
       if igs == _|_ {

charts/vela-core/templates/defwithtemplate/generate-jdbc-connection.yaml

@@ -12,11 +12,9 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/kube"
-        	"vela/util"
-        	"encoding/base64"
-        )
+        import "vela/kube"
+        import "vela/util"
+        import "encoding/base64"
 
         output: kube.#Read & {
         	$params: value: {

charts/vela-core/templates/defwithtemplate/ingress-1-20.yaml

@@ -69,11 +69,16 @@ spec:
         message: "No loadBalancer found, visiting by using 'vela port-forward " + context.appName + "'\n"
       }
       if len(igs) > 0 {
+        let rules = context.outputs.ingress.spec.rules
+        host: *"" | string
+        if rules != _|_ if len(rules) > 0 if rules[0].host != _|_ {
+      	  host: rules[0].host
+        }
         if igs[0].ip != _|_ {
-      	  message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host + ", IP: " + igs[0].ip
+      	  message: "Visiting URL: " + host + ", IP: " + igs[0].ip
         }
         if igs[0].ip == _|_ {
-      	  message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host
+      	  message: "Visiting URL: " + host
         }
       }
     healthPolicy: 'isHealth: len(context.outputs.service.spec.clusterIP) > 0'

charts/vela-core/templates/defwithtemplate/ingress.yaml

@@ -62,11 +62,16 @@ spec:
       	message: "No loadBalancer found, visiting by using 'vela port-forward " + context.appName + "'\n"
       }
       if len(igs) > 0 {
+      	let rules = context.outputs.ingress.spec.rules
+      	host: *"" | string
+      	if rules != _|_ if len(rules) > 0 if rules[0].host != _|_ {
+      		host: rules[0].host
+      	}
       	if igs[0].ip != _|_ {
-      		message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host + ", IP: " + igs[0].ip
+      		message: "Visiting URL: " + host + ", IP: " + igs[0].ip
       	}
       	if igs[0].ip == _|_ {
-      		message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host
+      		message: "Visiting URL: " + host
       	}
       }
     healthPolicy: 'isHealth: len(context.outputs.service.spec.clusterIP) > 0'

charts/vela-core/templates/defwithtemplate/init-container.yaml

@@ -17,6 +17,8 @@ spec:
   schematic:
     cue:
       template: |
+        import "list"
+
         patch: spec: template: spec: {
         	// +patchKey=name
         	containers: [{
@@ -43,10 +45,10 @@ spec:
         		}
 
         		// +patchKey=name
-        		volumeMounts: [{
+        		volumeMounts: list.Concat([[{
         			name:      parameter.mountName
         			mountPath: parameter.initMountPath
-        		}] + parameter.extraVolumeMounts
+        		}], parameter.extraVolumeMounts])
         	}]
         	// +patchKey=name
         	volumes: [{

charts/vela-core/templates/defwithtemplate/k8s-objects.yaml

@@ -11,7 +11,12 @@ spec:
   schematic:
     cue:
       template: |
-        output: parameter.objects[0]
+        output: {
+        	if len(parameter.objects) > 0 {
+        		parameter.objects[0]
+        	}
+        	...
+        }
 
         outputs: {
         	for i, v in parameter.objects {

charts/vela-core/templates/defwithtemplate/list-config.yaml

@@ -12,9 +12,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/config"
-        )
+        import "vela/config"
 
         output: config.#ListConfig & {
         	$params: parameter

charts/vela-core/templates/defwithtemplate/nocalhost.yaml

@@ -19,9 +19,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"encoding/json"
-        )
+        import "encoding/json"
 
         outputs: nocalhostService: {
         	apiVersion: "v1"

charts/vela-core/templates/defwithtemplate/notification.yaml

@@ -12,14 +12,12 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/http"
-        	"vela/email"
-        	"vela/kube"
-        	"vela/util"
-        	"encoding/base64"
-        	"encoding/json"
-        )
+        import "vela/http"
+        import "vela/email"
+        import "vela/kube"
+        import "vela/util"
+        import "encoding/base64"
+        import "encoding/json"
 
         parameter: {
         	// +usage=Please fulfill its url and message if you want to send Lark messages
@@ -216,7 +214,7 @@ spec:
         ding: {
         	if parameter.dingding != _|_ {
         		if parameter.dingding.url.value != _|_ {
-        			ding1: http.#Do & {
+        			ding1: http.#HTTPDo & {
         				$params: {
         					method: "POST"
         					url:    parameter.dingding.url.value
@@ -240,7 +238,7 @@ spec:
         			}
 
         			stringValue: util.#ConvertString & {$params: bt: base64.Decode(null, read.$returns.value.data[parameter.dingding.url.secretRef.key])}
-        			ding2: http.#Do & {
+        			ding2: http.#HTTPDo & {
         				$params: {
         					method: "POST"
         					url:    stringValue.$returns.str
@@ -257,10 +255,10 @@ spec:
         lark: {
         	if parameter.lark != _|_ {
         		if parameter.lark.url.value != _|_ {
-        			lark1: http.#Do & {
+        			lark1: http.#HTTPDo & {
         				$params: {
         					method: "POST"
-        					url:    parameter.lark.message
+        					url:    parameter.lark.url.value
         					request: {
         						body: json.Marshal(parameter.lark.message)
         						header: "Content-Type": "application/json"
@@ -281,7 +279,7 @@ spec:
         			}
 
         			stringValue: util.#ConvertString & {$params: bt: base64.Decode(null, read.$returns.value.data[parameter.lark.url.secretRef.key])}
-        			lark2: http.#Do & {
+        			lark2: http.#HTTPDo & {
         				$params: {
         					method: "POST"
         					url:    stringValue.$returns.str
@@ -299,7 +297,7 @@ spec:
         slack: {
         	if parameter.slack != _|_ {
         		if parameter.slack.url.value != _|_ {
-        			slack1: http.#Do & {
+        			slack1: http.#HTTPDo & {
         				$params: {
         					method: "POST"
         					url:    parameter.slack.url.value
@@ -323,7 +321,7 @@ spec:
         			}
 
         			stringValue: util.#ConvertString & {$params: bt: base64.Decode(null, read.$returns.value.data[parameter.slack.url.secretRef.key])}
-        			slack2: http.#Do & {
+        			slack2: http.#HTTPDo & {
         				$params: {
         					method: "POST"
         					url:    stringValue.$returns.str

charts/vela-core/templates/defwithtemplate/print-message-in-status.yaml

@@ -12,9 +12,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/builtin"
-        )
+        import "vela/builtin"
 
         parameter: message: string
 

charts/vela-core/templates/defwithtemplate/pure-ingress.yaml

@@ -49,11 +49,16 @@ spec:
       	message: "No loadBalancer found, visiting by using 'vela port-forward " + context.appName + " --route'\n"
       }
       if len(igs) > 0 {
+      	let rules = context.outputs.ingress.spec.rules
+      	host: *"" | string
+      	if rules != _|_ if len(rules) > 0 if rules[0].host != _|_ {
+      		host: rules[0].host
+      	}
       	if igs[0].ip != _|_ {
-      		message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host + ", IP: " + igs[0].ip
+      		message: "Visiting URL: " + host + ", IP: " + igs[0].ip
       	}
       	if igs[0].ip == _|_ {
-      		message: "Visiting URL: " + context.outputs.ingress.spec.rules[0].host
+      		message: "Visiting URL: " + host
       	}
       }
   workloadRefPath: ""

charts/vela-core/templates/defwithtemplate/read-config.yaml

@@ -12,9 +12,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/config"
-        )
+        import "vela/config"
 
         output: config.#ReadConfig & {
         	$params: parameter

charts/vela-core/templates/defwithtemplate/read-object.yaml

@@ -12,9 +12,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/kube"
-        )
+        import "vela/kube"
 
         output: kube.#Read & {
         	$params: {

charts/vela-core/templates/defwithtemplate/request.yaml

@@ -13,11 +13,9 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/op"
-        	"vela/http"
-        	"encoding/json"
-        )
+        import "vela/op"
+        import "vela/http"
+        import "encoding/json"
 
         req: http.#HTTPDo & {
         	$params: {

charts/vela-core/templates/defwithtemplate/restart-workflow.yaml

@@ -0,0 +1,117 @@
+# Code generated by KubeVela templates. DO NOT EDIT. Please edit the original cue file.
+# Definition source cue file: vela-templates/definitions/internal/restart-workflow.cue
+apiVersion: core.oam.dev/v1beta1
+kind: WorkflowStepDefinition
+metadata:
+  annotations:
+    custom.definition.oam.dev/category: Workflow Control
+    definition.oam.dev/description: Schedule the current Application's workflow to restart at a specific time, after a duration, or at recurring intervals
+  labels:
+    custom.definition.oam.dev/scope: Application
+  name: restart-workflow
+  namespace: {{ include "systemDefinitionNamespace" . }}
+spec:
+  schematic:
+    cue:
+      template: |
+        import "vela/kube"
+        import "vela/builtin"
+
+        // Count how many parameters are provided
+        _paramCount: len([
+        	if parameter.at != _|_ {1},
+        	if parameter.after != _|_ {1},
+        	if parameter.every != _|_ {1},
+        ])
+
+        // Fail if not exactly one parameter is provided
+        if _paramCount != 1 {
+        	validateParams: builtin.#Fail & {
+        		$params: message: "Exactly one of 'at', 'after', or 'every' parameters must be specified (found \(_paramCount))"
+        	}
+        }
+
+        // Build the bash script to calculate annotation value
+        _script: string
+        if parameter.at != _|_ {
+        	// Fixed timestamp mode - use as-is
+        	_script: """
+        			VALUE="\(parameter.at)"
+        			kubectl annotate application \(context.name) -n \(context.namespace) app.oam.dev/restart-workflow="$VALUE" --overwrite
+        			"""
+        }
+        if parameter.after != _|_ {
+        	// Relative time mode - calculate timestamp using date
+        	// Convert duration format (5m, 1h, 2d) to seconds, then calculate
+        	_script: """
+        			DURATION="\(parameter.after)"
+
+        			# Convert duration to seconds
+        			SECONDS=0
+        			if [[ "$DURATION" =~ ^([0-9]+)s$ ]]; then
+        				SECONDS=${BASH_REMATCH[1]}
+        			elif [[ "$DURATION" =~ ^([0-9]+)m$ ]]; then
+        				SECONDS=$((${BASH_REMATCH[1]} * 60))
+        			elif [[ "$DURATION" =~ ^([0-9]+)h$ ]]; then
+        				SECONDS=$((${BASH_REMATCH[1]} * 3600))
+        			elif [[ "$DURATION" =~ ^([0-9]+)d$ ]]; then
+        				SECONDS=$((${BASH_REMATCH[1]} * 86400))
+        			else
+        				echo "ERROR: Invalid duration format: $DURATION (expected format: 30s, 5m, 1h, or 2d)"
+        				exit 1
+        			fi
+
+        			# Calculate future timestamp using seconds offset
+        			VALUE=$(date -u -d "@$(($(date +%s) + SECONDS))" +%Y-%m-%dT%H:%M:%SZ)
+        			echo "Calculated timestamp for after '$DURATION' ($SECONDS seconds): $VALUE"
+        			kubectl annotate application \(context.name) -n \(context.namespace) app.oam.dev/restart-workflow="$VALUE" --overwrite
+        			"""
+        }
+        if parameter.every != _|_ {
+        	// Recurring interval mode - pass duration directly
+        	_script: """
+        			VALUE="\(parameter.every)"
+        			kubectl annotate application \(context.name) -n \(context.namespace) app.oam.dev/restart-workflow="$VALUE" --overwrite
+        			"""
+        }
+
+        // Run kubectl to annotate the Application
+        job: kube.#Apply & {
+        	$params: value: {
+        		apiVersion: "batch/v1"
+        		kind:       "Job"
+        		metadata: {
+        			name:      "\(context.name)-restart-workflow-\(context.stepSessionID)"
+        			namespace: "vela-system"
+        		}
+        		spec: {
+        			backoffLimit: 3
+        			template: spec: {
+        				containers: [{
+        					name:  "kubectl-annotate"
+        					image: "bitnami/kubectl:latest"
+        					command: ["/bin/sh", "-c"]
+        					args: [_script]
+        				}]
+        				restartPolicy:      "Never"
+        				serviceAccountName: "kubevela-vela-core"
+        			}
+        		}
+        	}
+        }
+
+        wait: builtin.#ConditionalWait & {
+        	if job.$returns.value.status != _|_ if job.$returns.value.status.succeeded != _|_ {
+        		$params: continue: job.$returns.value.status.succeeded > 0
+        	}
+        }
+
+        parameter: {
+        	// +usage=Schedule restart at a specific RFC3339 timestamp (e.g., "2025-01-15T14:30:00Z")
+        	at?: string & =~"^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\\.[0-9]+)?(Z|[+-][0-9]{2}:[0-9]{2})$"
+        	// +usage=Schedule restart after a relative duration from now (e.g., "5m", "1h", "2d")
+        	after?: string & =~"^[0-9]+(s|m|h|d)$"
+        	// +usage=Schedule recurring restarts every specified duration (e.g., "5m", "1h", "24h")
+        	every?: string & =~"^[0-9]+(s|m|h|d)$"
+        }
+

charts/vela-core/templates/defwithtemplate/share-cloud-resource.yaml

@@ -14,9 +14,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/op"
-        )
+        import "vela/op"
 
         app: op.#ShareCloudResource & {
         	env:        parameter.env

charts/vela-core/templates/defwithtemplate/statefulset.yaml

@@ -11,10 +11,8 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"strconv"
-        	"strings"
-        )
+        import "strconv"
+        import "strings"
 
         mountsArray: [
         	if parameter.volumeMounts != _|_ if parameter.volumeMounts.pvc != _|_ for v in parameter.volumeMounts.pvc {

charts/vela-core/templates/defwithtemplate/suspend.yaml

@@ -12,9 +12,7 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/builtin"
-        )
+        import "vela/builtin"
 
         suspend: builtin.#Suspend & {
         	$params: parameter

charts/vela-core/templates/defwithtemplate/vela-cli.yaml

@@ -12,11 +12,9 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/kube"
-        	"vela/builtin"
-        	"vela/util"
-        )
+        import "vela/kube"
+        import "vela/builtin"
+        import "vela/util"
 
         mountsArray: [
         	if parameter.storage != _|_ && parameter.storage.secret != _|_ for v in parameter.storage.secret {
@@ -126,8 +124,6 @@ spec:
         }
 
         parameter: {
-        	// +usage=Specify the name of the addon.
-        	addonName: string
         	// +usage=Specify the vela command
         	command: [...string]
         	// +usage=Specify the image

charts/vela-core/templates/defwithtemplate/webhook.yaml

@@ -12,13 +12,11 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"vela/http"
-        	"vela/kube"
-        	"vela/util"
-        	"encoding/json"
-        	"encoding/base64"
-        )
+        import "vela/http"
+        import "vela/kube"
+        import "vela/util"
+        import "encoding/json"
+        import "encoding/base64"
 
         data: {
         	if parameter.data == _|_ {
@@ -40,9 +38,10 @@ spec:
         }
         webhook: {
         	if parameter.url.value != _|_ {
-        		req: http.#HTTPPost & {
+        		req: http.#HTTPDo & {
         			$params: {
-        				url: parameter.url.value
+        				method: "POST"
+        				url:    parameter.url.value
         				request: {
         					body: data.value
         					header: "Content-Type": "application/json"
@@ -63,9 +62,10 @@ spec:
         		}
 
         		stringValue: util.#ConvertString & {$params: bt: base64.Decode(null, read.$returns.value.data[parameter.url.secretRef.key])}
-        		req: http.#HTTPPost & {
+        		req: http.#HTTPDo & {
         			$params: {
-        				url: stringValue.$returns.str
+        				method: "POST"
+        				url:    stringValue.$returns.str
         				request: {
         					body: data.value
         					header: "Content-Type": "application/json"

charts/vela-core/templates/defwithtemplate/webservice.yaml

@@ -11,10 +11,8 @@ spec:
   schematic:
     cue:
       template: |
-        import (
-        	"strconv"
-        	"strings"
-        )
+        import "strconv"
+        import "strings"
 
         mountsArray: [
         	if parameter.volumeMounts != _|_ && parameter.volumeMounts.pvc != _|_ for v in parameter.volumeMounts.pvc {

charts/vela-core/templates/kubevela-controller.yaml

@@ -314,6 +314,8 @@ spec:
             - "--feature-gates=EnableCueValidation={{- .Values.featureGates.enableCueValidation | toString -}}"
             - "--feature-gates=EnableApplicationStatusMetrics={{- .Values.featureGates.enableApplicationStatusMetrics | toString -}}"
             - "--feature-gates=ValidateResourcesExist={{- .Values.featureGates.validateResourcesExist | toString -}}"
+            - "--feature-gates=EnableApplicationScopedPolicies={{- .Values.featureGates.enableApplicationScopedPolicies | toString -}}"
+            - "--feature-gates=EnableGlobalPolicies={{- .Values.featureGates.enableGlobalPolicies | toString -}}"
             - "--feature-gates=ValidateDefinitionPermissions={{ .Values.authorization.definitionValidationEnabled | toString -}}"
             {{ if .Values.authentication.enabled }}
             {{ if .Values.authentication.withUser }}

charts/vela-core/values.yaml

@@ -126,6 +126,8 @@ optimize:
 ##@param featureGates.enableCueValidation enable the strict cue validation for cue required parameter fields
 ##@param featureGates.enableApplicationStatusMetrics enable application status metrics and structured logging
 ##@param featureGates.validateResourcesExist enable webhook validation to check if resource types referenced in definition templates exist in the cluster
+##@param featureGates.enableApplicationScopedPolicies enable Application-scoped PolicyDefinitions that transform Application CR before rendering (Alpha)
+##@param featureGates.enableGlobalPolicies enable automatic discovery and application of global PolicyDefinitions to all Applications (Alpha)
 ##@param
 featureGates:
   gzipResourceTracker: false
@@ -144,6 +146,8 @@ featureGates:
   enableCueValidation: false
   enableApplicationStatusMetrics: false
   validateResourcesExist: false
+  enableApplicationScopedPolicies: false
+  enableGlobalPolicies: false
 
 ## @section MultiCluster parameters
 
@@ -267,6 +271,9 @@ logFilePath: ""
 ## @param logFileMaxSize Defines the maximum size a log file can grow to. Unit is megabytes. If the value is 0, the maximum file size is unlimited.
 logFileMaxSize: 1024
 
+## @param admissionWebhookTimeout Timeout seconds for admission webhooks
+admissionWebhookTimeout: 10
+
 ## @skip admissionWebhooks
 admissionWebhooks:
   enabled: true

cmd/core/app/bootstrap.go

@@ -0,0 +1,51 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package app
+
+import (
+	"k8s.io/klog/v2"
+)
+
+// bootstrapProviderRegistry registers framework-level providers that need
+// to be available globally. This is called early in prepareRun before
+// controllers are initialized.
+//
+// The provider registry is a fallback mechanism for breaking import cycles
+// that block development. Providers registered here enable immediate feature
+// work while longer-term refactoring efforts can be planned.
+//
+// Best practices when adding a provider:
+// 1. Document which packages have the cycle (in comments below)
+// 2. Define narrow, focused interfaces (< 5 methods)
+// 3. Consider opportunities for future refactoring to eliminate the cycle
+// 4. Prefer constructor injection for new code without cycles
+//
+// See pkg/registry/README.md for feature overview and pkg/registry package docs for guidelines.
+func bootstrapProviderRegistry() {
+	klog.V(2).InfoS("Bootstrapping provider registry")
+
+	// ────────────────────────────────────────────────────────────────────
+	// Add providers below following this pattern:
+	// ────────────────────────────────────────────────────────────────────
+	//
+	// ProviderInterface - Brief description
+	// Cycle: pkg/foo ↔ pkg/bar (explain the circular dependency)
+	// Note: Consider refactoring to extract shared interfaces
+	// registry.RegisterAs[ProviderInterface](implementation)
+
+	klog.V(2).InfoS("Provider registry bootstrap complete")
+}

cmd/core/app/config/admission.go

@@ -0,0 +1,38 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/spf13/pflag"
+
+	standardcontroller "github.com/oam-dev/kubevela/pkg/controller"
+)
+
+// AdmissionConfig contains admission control configuration.
+type AdmissionConfig struct {
+	// Fields will be populated based on what standardcontroller.AddAdmissionFlags sets
+}
+
+// NewAdmissionConfig creates a new AdmissionConfig with defaults.
+func NewAdmissionConfig() *AdmissionConfig {
+	return &AdmissionConfig{}
+}
+
+// AddFlags registers admission configuration flags.
+func (c *AdmissionConfig) AddFlags(fs *pflag.FlagSet) {
+	standardcontroller.AddAdmissionFlags(fs)
+}

cmd/core/app/config/application.go

@@ -0,0 +1,56 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"time"
+
+	"github.com/spf13/pflag"
+
+	commonconfig "github.com/oam-dev/kubevela/pkg/controller/common"
+)
+
+// ApplicationConfig contains application-specific configuration.
+type ApplicationConfig struct {
+	ReSyncPeriod time.Duration
+}
+
+// NewApplicationConfig creates a new ApplicationConfig with defaults.
+func NewApplicationConfig() *ApplicationConfig {
+	return &ApplicationConfig{
+		ReSyncPeriod: commonconfig.ApplicationReSyncPeriod,
+	}
+}
+
+// AddFlags registers application configuration flags.
+func (c *ApplicationConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.DurationVar(&c.ReSyncPeriod,
+		"application-re-sync-period",
+		c.ReSyncPeriod,
+		"Re-sync period for application to re-sync, also known as the state-keep interval.")
+}
+
+// SyncToApplicationGlobals syncs the parsed configuration values to application package global variables.
+// This should be called after flag parsing to ensure the application controller uses the configured values.
+//
+// NOTE: This method exists for backward compatibility with legacy code that depends on global
+// variables in the commonconfig package. Ideally, configuration should be injected rather than using globals.
+//
+// The flow is: CLI flags -> ApplicationConfig struct fields -> commonconfig globals (via this method)
+func (c *ApplicationConfig) SyncToApplicationGlobals() {
+	commonconfig.ApplicationReSyncPeriod = c.ReSyncPeriod
+}

cmd/core/app/config/client.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	pkgclient "github.com/kubevela/pkg/controller/client"
+	"github.com/spf13/pflag"
+)
+
+// ClientConfig contains controller client configuration.
+// This wraps the external package's client configuration flags.
+type ClientConfig struct {
+	// Note: The actual configuration is managed by the pkgclient package
+	// This is a wrapper to maintain consistency with our config pattern
+}
+
+// NewClientConfig creates a new ClientConfig with defaults.
+func NewClientConfig() *ClientConfig {
+	return &ClientConfig{}
+}
+
+// AddFlags registers client configuration flags.
+// Delegates to the external package's flag registration.
+func (c *ClientConfig) AddFlags(fs *pflag.FlagSet) {
+	pkgclient.AddTimeoutControllerClientFlags(fs)
+}

cmd/core/app/config/controller.go

@@ -0,0 +1,67 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/spf13/pflag"
+
+	oamcontroller "github.com/oam-dev/kubevela/pkg/controller/core.oam.dev"
+)
+
+// ControllerConfig wraps the oamcontroller.Args configuration.
+// While this appears to duplicate the Args struct, it serves as the new home for
+// controller flag registration after the AddFlags method was moved here from
+// the oamcontroller package during refactoring.
+type ControllerConfig struct {
+	// Embed the existing Args struct to reuse its fields
+	oamcontroller.Args
+}
+
+// NewControllerConfig creates a new ControllerConfig with defaults.
+func NewControllerConfig() *ControllerConfig {
+	return &ControllerConfig{
+		Args: oamcontroller.Args{
+			RevisionLimit:                                50,
+			AppRevisionLimit:                             10,
+			DefRevisionLimit:                             20,
+			AutoGenWorkloadDefinition:                    true,
+			ConcurrentReconciles:                         4,
+			IgnoreAppWithoutControllerRequirement:        false,
+			IgnoreDefinitionWithoutControllerRequirement: false,
+		},
+	}
+}
+
+// AddFlags registers controller configuration flags.
+// This method was moved here from oamcontroller.Args during refactoring
+// to centralize configuration management.
+func (c *ControllerConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.IntVar(&c.RevisionLimit, "revision-limit", c.RevisionLimit,
+		"RevisionLimit is the maximum number of revisions that will be maintained. The default value is 50.")
+	fs.IntVar(&c.AppRevisionLimit, "application-revision-limit", c.AppRevisionLimit,
+		"application-revision-limit is the maximum number of application useless revisions that will be maintained, if the useless revisions exceed this number, older ones will be GCed first.The default value is 10.")
+	fs.IntVar(&c.DefRevisionLimit, "definition-revision-limit", c.DefRevisionLimit,
+		"definition-revision-limit is the maximum number of component/trait definition useless revisions that will be maintained, if the useless revisions exceed this number, older ones will be GCed first.The default value is 20.")
+	fs.BoolVar(&c.AutoGenWorkloadDefinition, "autogen-workload-definition", c.AutoGenWorkloadDefinition,
+		"Automatic generated workloadDefinition which componentDefinition refers to.")
+	fs.IntVar(&c.ConcurrentReconciles, "concurrent-reconciles", c.ConcurrentReconciles,
+		"concurrent-reconciles is the concurrent reconcile number of the controller. The default value is 4")
+	fs.BoolVar(&c.IgnoreAppWithoutControllerRequirement, "ignore-app-without-controller-version", c.IgnoreAppWithoutControllerRequirement,
+		"If true, application controller will not process the app without 'app.oam.dev/controller-version-require' annotation")
+	fs.BoolVar(&c.IgnoreDefinitionWithoutControllerRequirement, "ignore-definition-without-controller-version", c.IgnoreDefinitionWithoutControllerRequirement,
+		"If true, trait/component/workflowstep definition controller will not process the definition without 'definition.oam.dev/controller-version-require' annotation")
+}

cmd/core/app/config/cue.go

@@ -0,0 +1,61 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/kubevela/pkg/cue/cuex"
+	"github.com/spf13/pflag"
+)
+
+// CUEConfig contains CUE language configuration.
+type CUEConfig struct {
+	EnableExternalPackage      bool
+	EnableExternalPackageWatch bool
+}
+
+// NewCUEConfig creates a new CUEConfig with defaults.
+func NewCUEConfig() *CUEConfig {
+	return &CUEConfig{
+		EnableExternalPackage:      cuex.EnableExternalPackageForDefaultCompiler,
+		EnableExternalPackageWatch: cuex.EnableExternalPackageWatchForDefaultCompiler,
+	}
+}
+
+// AddFlags registers CUE configuration flags.
+func (c *CUEConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.BoolVar(&c.EnableExternalPackage,
+		"enable-external-package-for-default-compiler",
+		c.EnableExternalPackage,
+		"Enable loading third-party CUE packages into the default CUE compiler. When enabled, external CUE packages can be imported and used in CUE templates.")
+	fs.BoolVar(&c.EnableExternalPackageWatch,
+		"enable-external-package-watch-for-default-compiler",
+		c.EnableExternalPackageWatch,
+		"Enable watching for changes in external CUE packages and automatically reload them when modified. Requires enable-external-package-for-default-compiler to be enabled.")
+}
+
+// SyncToCUEGlobals syncs the parsed configuration values to CUE package global variables.
+// This should be called after flag parsing to ensure the CUE compiler uses the configured values.
+//
+// NOTE: This method exists for backward compatibility with legacy code that depends on global
+// variables in the cuex package. Ideally, the CUE compiler configuration should be injected
+// rather than relying on globals.
+//
+// The flow is: CLI flags -> CUEConfig struct fields -> cuex globals (via this method)
+func (c *CUEConfig) SyncToCUEGlobals() {
+	cuex.EnableExternalPackageForDefaultCompiler = c.EnableExternalPackage
+	cuex.EnableExternalPackageWatchForDefaultCompiler = c.EnableExternalPackageWatch
+}

cmd/core/app/config/feature.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/spf13/pflag"
+	utilfeature "k8s.io/apiserver/pkg/util/feature"
+)
+
+// FeatureConfig contains feature gate configuration.
+// This wraps the Kubernetes feature gate system.
+type FeatureConfig struct {
+	// Note: The actual configuration is managed by the utilfeature package
+	// This is a wrapper to maintain consistency with our config pattern
+}
+
+// NewFeatureConfig creates a new FeatureConfig with defaults.
+func NewFeatureConfig() *FeatureConfig {
+	return &FeatureConfig{}
+}
+
+// AddFlags registers feature gate configuration flags.
+// Delegates to the Kubernetes feature gate system.
+func (c *FeatureConfig) AddFlags(fs *pflag.FlagSet) {
+	utilfeature.DefaultMutableFeatureGate.AddFlag(fs)
+}

cmd/core/app/config/klog.go

@@ -0,0 +1,42 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	utillog "github.com/kubevela/pkg/util/log"
+	"github.com/spf13/pflag"
+)
+
+// KLogConfig contains klog configuration.
+// This wraps the Kubernetes logging configuration.
+type KLogConfig struct {
+	// Reference to observability config for log settings
+	observability *ObservabilityConfig
+}
+
+// NewKLogConfig creates a new KLogConfig.
+func NewKLogConfig(observability *ObservabilityConfig) *KLogConfig {
+	return &KLogConfig{
+		observability: observability,
+	}
+}
+
+// AddFlags registers klog configuration flags.
+func (c *KLogConfig) AddFlags(fs *pflag.FlagSet) {
+	// Add base klog flags
+	utillog.AddFlags(fs)
+}

cmd/core/app/config/kubernetes.go

@@ -0,0 +1,49 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"time"
+
+	"github.com/spf13/pflag"
+)
+
+// KubernetesConfig contains Kubernetes API client configuration.
+type KubernetesConfig struct {
+	QPS                float64
+	Burst              int
+	InformerSyncPeriod time.Duration
+}
+
+// NewKubernetesConfig creates a new KubernetesConfig with defaults.
+func NewKubernetesConfig() *KubernetesConfig {
+	return &KubernetesConfig{
+		QPS:                50,
+		Burst:              100,
+		InformerSyncPeriod: 10 * time.Hour,
+	}
+}
+
+// AddFlags registers Kubernetes configuration flags.
+func (c *KubernetesConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.Float64Var(&c.QPS, "kube-api-qps", c.QPS,
+		"the qps for reconcile clients. Low qps may lead to low throughput. High qps may give stress to api-server. Raise this value if concurrent-reconciles is set to be high.")
+	fs.IntVar(&c.Burst, "kube-api-burst", c.Burst,
+		"the burst for reconcile clients. Recommend setting it qps*2.")
+	fs.DurationVar(&c.InformerSyncPeriod, "informer-sync-period", c.InformerSyncPeriod,
+		"The re-sync period for informer in controller-runtime. This is a system-level configuration.")
+}

cmd/core/app/config/multicluster.go

@@ -0,0 +1,53 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"time"
+
+	pkgmulticluster "github.com/kubevela/pkg/multicluster"
+	"github.com/spf13/pflag"
+)
+
+// MultiClusterConfig contains multi-cluster configuration.
+type MultiClusterConfig struct {
+	EnableClusterGateway   bool
+	EnableClusterMetrics   bool
+	ClusterMetricsInterval time.Duration
+}
+
+// NewMultiClusterConfig creates a new MultiClusterConfig with defaults.
+func NewMultiClusterConfig() *MultiClusterConfig {
+	return &MultiClusterConfig{
+		EnableClusterGateway:   false,
+		EnableClusterMetrics:   false,
+		ClusterMetricsInterval: 15 * time.Second,
+	}
+}
+
+// AddFlags registers multi-cluster configuration flags.
+func (c *MultiClusterConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.BoolVar(&c.EnableClusterGateway, "enable-cluster-gateway", c.EnableClusterGateway,
+		"Enable cluster-gateway to use multicluster, disabled by default.")
+	fs.BoolVar(&c.EnableClusterMetrics, "enable-cluster-metrics", c.EnableClusterMetrics,
+		"Enable cluster-metrics-management to collect metrics from clusters with cluster-gateway, disabled by default. When this param is enabled, enable-cluster-gateway should be enabled")
+	fs.DurationVar(&c.ClusterMetricsInterval, "cluster-metrics-interval", c.ClusterMetricsInterval,
+		"The interval that ClusterMetricsMgr will collect metrics from clusters, default value is 15 seconds.")
+
+	// Also register additional multicluster flags from external package
+	pkgmulticluster.AddFlags(fs)
+}

cmd/core/app/config/oam.go

@@ -0,0 +1,54 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/spf13/pflag"
+
+	"github.com/oam-dev/kubevela/pkg/oam"
+)
+
+// OAMConfig contains OAM-specific configuration.
+type OAMConfig struct {
+	SystemDefinitionNamespace string
+}
+
+// NewOAMConfig creates a new OAMConfig with defaults.
+func NewOAMConfig() *OAMConfig {
+	return &OAMConfig{
+		SystemDefinitionNamespace: "vela-system",
+	}
+}
+
+// AddFlags registers OAM configuration flags.
+func (c *OAMConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&c.SystemDefinitionNamespace,
+		"system-definition-namespace",
+		c.SystemDefinitionNamespace,
+		"Define the namespace of the system-level definition")
+}
+
+// SyncToOAMGlobals syncs the parsed configuration values to OAM package global variables.
+// This should be called after flag parsing to ensure the OAM runtime uses the configured values.
+//
+// NOTE: This method exists for backward compatibility with legacy code that depends on global
+// variables in the oam package. Ideally, configuration should be injected rather than using globals.
+//
+// The flow is: CLI flags -> OAMConfig struct fields -> oam globals (via this method)
+func (c *OAMConfig) SyncToOAMGlobals() {
+	oam.SystemDefinitionNamespace = c.SystemDefinitionNamespace
+}

cmd/core/app/config/observability.go

@@ -0,0 +1,55 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/spf13/pflag"
+)
+
+// ObservabilityConfig contains metrics and logging configuration.
+type ObservabilityConfig struct {
+	MetricsAddr    string
+	LogFilePath    string
+	LogFileMaxSize uint64
+	LogDebug       bool
+	DevLogs        bool
+}
+
+// NewObservabilityConfig creates a new ObservabilityConfig with defaults.
+func NewObservabilityConfig() *ObservabilityConfig {
+	return &ObservabilityConfig{
+		MetricsAddr:    ":8080",
+		LogFilePath:    "",
+		LogFileMaxSize: 1024,
+		LogDebug:       false,
+		DevLogs:        false,
+	}
+}
+
+// AddFlags registers observability configuration flags.
+func (c *ObservabilityConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&c.MetricsAddr, "metrics-addr", c.MetricsAddr,
+		"The address the metric endpoint binds to.")
+	fs.StringVar(&c.LogFilePath, "log-file-path", c.LogFilePath,
+		"The file to write logs to.")
+	fs.Uint64Var(&c.LogFileMaxSize, "log-file-max-size", c.LogFileMaxSize,
+		"Defines the maximum size a log file can grow to, Unit is megabytes.")
+	fs.BoolVar(&c.LogDebug, "log-debug", c.LogDebug,
+		"Enable debug logs for development purpose")
+	fs.BoolVar(&c.DevLogs, "dev-logs", c.DevLogs,
+		"Enable ANSI color formatting for console logs (ignored when log-file-path is set)")
+}

cmd/core/app/config/performance.go

@@ -0,0 +1,58 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/spf13/pflag"
+
+	standardcontroller "github.com/oam-dev/kubevela/pkg/controller"
+	commonconfig "github.com/oam-dev/kubevela/pkg/controller/common"
+)
+
+// PerformanceConfig contains performance and optimization configuration.
+type PerformanceConfig struct {
+	PerfEnabled bool
+}
+
+// NewPerformanceConfig creates a new PerformanceConfig with defaults.
+func NewPerformanceConfig() *PerformanceConfig {
+	return &PerformanceConfig{
+		PerfEnabled: commonconfig.PerfEnabled,
+	}
+}
+
+// AddFlags registers performance configuration flags.
+func (c *PerformanceConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.BoolVar(&c.PerfEnabled,
+		"perf-enabled",
+		c.PerfEnabled,
+		"Enable performance logging for controllers, disabled by default.")
+
+	// Add optimization flags from the standard controller
+	standardcontroller.AddOptimizeFlags(fs)
+}
+
+// SyncToPerformanceGlobals syncs the parsed configuration values to performance package global variables.
+// This should be called after flag parsing to ensure the performance monitoring uses the configured values.
+//
+// NOTE: This method exists for backward compatibility with legacy code that depends on global
+// variables in the commonconfig package. Ideally, configuration should be injected rather than using globals.
+//
+// The flow is: CLI flags -> PerformanceConfig struct fields -> commonconfig globals (via this method)
+func (c *PerformanceConfig) SyncToPerformanceGlobals() {
+	commonconfig.PerfEnabled = c.PerfEnabled
+}

cmd/core/app/config/profiling.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/kubevela/pkg/util/profiling"
+	"github.com/spf13/pflag"
+)
+
+// ProfilingConfig contains profiling configuration.
+// This wraps the external package's profiling configuration flags.
+type ProfilingConfig struct {
+	// Note: The actual configuration is managed by the profiling package
+	// This is a wrapper to maintain consistency with our config pattern
+}
+
+// NewProfilingConfig creates a new ProfilingConfig with defaults.
+func NewProfilingConfig() *ProfilingConfig {
+	return &ProfilingConfig{}
+}
+
+// AddFlags registers profiling configuration flags.
+// Delegates to the external package's flag registration.
+func (c *ProfilingConfig) AddFlags(fs *pflag.FlagSet) {
+	profiling.AddFlags(fs)
+}

cmd/core/app/config/reconcile.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	ctrlrec "github.com/kubevela/pkg/controller/reconciler"
+	"github.com/spf13/pflag"
+)
+
+// ReconcileConfig contains controller reconciliation configuration.
+// This wraps the external package's reconciler configuration flags.
+type ReconcileConfig struct {
+	// Note: The actual configuration is managed by the ctrlrec package
+	// This is a wrapper to maintain consistency with our config pattern
+}
+
+// NewReconcileConfig creates a new ReconcileConfig with defaults.
+func NewReconcileConfig() *ReconcileConfig {
+	return &ReconcileConfig{}
+}
+
+// AddFlags registers reconcile configuration flags.
+// Delegates to the external package's flag registration.
+func (c *ReconcileConfig) AddFlags(fs *pflag.FlagSet) {
+	ctrlrec.AddFlags(fs)
+}

cmd/core/app/config/resource.go

@@ -0,0 +1,55 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/spf13/pflag"
+
+	"github.com/oam-dev/kubevela/pkg/resourcekeeper"
+)
+
+// ResourceConfig contains resource management configuration.
+type ResourceConfig struct {
+	MaxDispatchConcurrent int
+}
+
+// NewResourceConfig creates a new ResourceConfig with defaults.
+func NewResourceConfig() *ResourceConfig {
+	return &ResourceConfig{
+		MaxDispatchConcurrent: 10,
+	}
+}
+
+// AddFlags registers resource configuration flags.
+func (c *ResourceConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.IntVar(&c.MaxDispatchConcurrent,
+		"max-dispatch-concurrent",
+		c.MaxDispatchConcurrent,
+		"Set the max dispatch concurrent number, default is 10")
+}
+
+// SyncToResourceGlobals syncs the parsed configuration values to resource package global variables.
+// This should be called after flag parsing to ensure the resource keeper uses the configured values.
+//
+// NOTE: This method exists for backward compatibility with legacy code that depends on global
+// variables in the resourcekeeper package. The long-term goal should be to refactor to use
+// dependency injection rather than globals.
+//
+// The flow is: CLI flags -> ResourceConfig struct fields -> resourcekeeper globals (via this method)
+func (c *ResourceConfig) SyncToResourceGlobals() {
+	resourcekeeper.MaxDispatchConcurrent = c.MaxDispatchConcurrent
+}

cmd/core/app/config/server.go

@@ -0,0 +1,65 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"time"
+
+	"github.com/spf13/pflag"
+)
+
+// ServerConfig contains server-level configuration.
+type ServerConfig struct {
+	HealthAddr              string
+	StorageDriver           string
+	EnableLeaderElection    bool
+	LeaderElectionNamespace string
+	LeaseDuration           time.Duration
+	RenewDeadline           time.Duration
+	RetryPeriod             time.Duration
+}
+
+// NewServerConfig creates a new ServerConfig with defaults.
+func NewServerConfig() *ServerConfig {
+	return &ServerConfig{
+		HealthAddr:              ":9440",
+		StorageDriver:           "Local",
+		EnableLeaderElection:    false,
+		LeaderElectionNamespace: "",
+		LeaseDuration:           15 * time.Second,
+		RenewDeadline:           10 * time.Second,
+		RetryPeriod:             2 * time.Second,
+	}
+}
+
+// AddFlags registers server configuration flags.
+func (c *ServerConfig) AddFlags(fs *pflag.FlagSet) {
+	fs.StringVar(&c.HealthAddr, "health-addr", c.HealthAddr,
+		"The address the health endpoint binds to.")
+	fs.StringVar(&c.StorageDriver, "storage-driver", c.StorageDriver,
+		"Application storage driver.")
+	fs.BoolVar(&c.EnableLeaderElection, "enable-leader-election", c.EnableLeaderElection,
+		"Enable leader election for controller manager. Enabling this will ensure there is only one active controller manager.")
+	fs.StringVar(&c.LeaderElectionNamespace, "leader-election-namespace", c.LeaderElectionNamespace,
+		"Determines the namespace in which the leader election configmap will be created.")
+	fs.DurationVar(&c.LeaseDuration, "leader-election-lease-duration", c.LeaseDuration,
+		"The duration that non-leader candidates will wait to force acquire leadership")
+	fs.DurationVar(&c.RenewDeadline, "leader-election-renew-deadline", c.RenewDeadline,
+		"The duration that the acting controlplane will retry refreshing leadership before giving up")
+	fs.DurationVar(&c.RetryPeriod, "leader-election-retry-period", c.RetryPeriod,
+		"The duration the LeaderElector clients should wait between tries of actions")
+}

cmd/core/app/config/sharding.go

@@ -0,0 +1,40 @@
+/*
+Copyright 2025 The KubeVela Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+	http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package config
+
+import (
+	"github.com/kubevela/pkg/controller/sharding"
+	"github.com/spf13/pflag"
+)
+
+// ShardingConfig contains controller sharding configuration.
+// This wraps the external package's sharding configuration flags.
+type ShardingConfig struct {
+	// Note: The actual configuration is managed by the sharding package
+	// This is a wrapper to maintain consistency with our config pattern
+}
+
+// NewShardingConfig creates a new ShardingConfig with defaults.
+func NewShardingConfig() *ShardingConfig {
+	return &ShardingConfig{}
+}
+
+// AddFlags registers sharding configuration flags.
+// Delegates to the external package's flag registration.
+func (c *ShardingConfig) AddFlags(fs *pflag.FlagSet) {
+	sharding.AddFlags(fs)
+}