kdep 0.4.6 → 0.4.8

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f292fc84fbd868827a225e5a63ec7ef74949f954216c69fd6eac1fb8d431f7ff
-  data.tar.gz: b3486a1fc6c39ed310d0cf4a138421fcbbf46b2d7b31deb59f403d5d37c62e5c
+  metadata.gz: 1ed0d8de8dfb58cc372615340a068aecb3f8092aecafdbc6d1c6480c14477d57
+  data.tar.gz: 8dde50b29b917321144fcca1d0cb83cff8b66a702442c5bf19375ae527f4cf6e
 SHA512:
-  metadata.gz: 9c5521c97e1c89ab7bd74f94967d735dca9d46e497dbeaa788274138ebe45ce6c28e4f8ecd24bfb1d2a9180ed995e3713bc488c23793b40154b7d98b38f4c71d
-  data.tar.gz: cb3a4a8b54be7f2852396207eab1971c47f2922b30878f8d26d2b4625e3cb130a5408d6eaa78e1ad06b815e9ac009c4719e992ffad9c18fc9432ee0525df4518
+  metadata.gz: 3669fafcc6315fcdb7af39bb0b31cb7314a953b3185988523af63e1d9ab1fb60a458ba141dc22e3735e00de5df8a821b862b657aaae68d36e8326e0a0f304f2b
+  data.tar.gz: 7cbb7445b6909b46e74f47245c88df5fa8d7d93617a949b14059aef3f50c2981941ed129d70f013dede5e2789ad363e55d8768698129059c412c03d631851b81

data/lib/kdep/commands/build.rb

@@ -42,6 +42,11 @@ module Kdep
         # Load config
         config = Kdep::Config.new(deploy_dir, env).load
 
+        if config["build"] == false
+          @ui.error("#{deploy_dir} declares `build: false` — its image is built elsewhere, so there is nothing to build here.")
+          exit 1
+        end
+
         # Resolve tag from state.yml — app.yml has no tag field by design;
         # state.yml is the source of truth for the last bumped version.
         tag = Kdep::State.tag(deploy_dir)

data/lib/kdep/commands/bump.rb

@@ -48,6 +48,7 @@ module Kdep
         # Feature G: preflight validators. Runs for every preset, halts on
         # first failure. --no-check skips.
         unless @command_options[:"no-check"]
+          check_duplicate_yaml_keys(deploy_dir)
           run_preflight_checks(config, deploy_dir, kdep_dir)
         end
 
@@ -59,8 +60,13 @@ module Kdep
         if preset == "helm"
           run_helm_pipeline(deploy_dir, env)
           return
-        elsif preset == "custom"
-          run_custom_pipeline(deploy_dir, config, kdep_dir, env)
+        elsif preset == "custom" || config["build"] == false
+          # `build: false` marks a target whose image is built elsewhere
+          # (upstream images: elasticsearch, fluentd, curator...). It takes the
+          # same no-docker route as `custom`, but keeps its own preset's
+          # resource list -- the point is to reuse web/worker/statefulset/etc
+          # without a Dockerfile. Its tag comes from app.yml, not state.yml.
+          run_no_build_pipeline(deploy_dir, config, kdep_dir, env)
           return
         end
 
@@ -229,8 +235,11 @@ module Kdep
         helm_install.execute
       end
 
-      # Feature E: custom-preset bump = render + apply, no docker, no state.
-      def run_custom_pipeline(deploy_dir, config, kdep_dir, env = nil)
+      # Feature E: bump with no image to build = render + apply, no docker, no
+      # state.yml. Used by the `custom` preset and by any preset with
+      # `build: false`; the only difference is which resource list is rendered,
+      # which is why this reads config["preset"] instead of hardcoding one.
+      def run_no_build_pipeline(deploy_dir, config, kdep_dir, env = nil)
         # Context guard for safety.
         begin
           Kdep::ContextGuard.new(config["context"]).validate!
@@ -246,7 +255,7 @@ module Kdep
         writer = Kdep::Writer.new(output_dir)
         writer.clean
         renderer = Kdep::Renderer.new(config, deploy_dir, env: env)
-        preset_resources = Kdep::Preset.new("custom", deploy_dir).resources
+        preset_resources = Kdep::Preset.new(config["preset"], deploy_dir).resources
 
         preset_resources.each_with_index do |resource, idx|
           content = renderer.render_resource(resource)
@@ -262,6 +271,20 @@ module Kdep
         end
       end
 
+      # Built-in preflight, unlike the user-declared check: list. The error
+      # this catches is made by whoever doesn't know the trap exists, so an
+      # opt-in guard would only protect the people who already know. Runs
+      # before docker and before the cluster; --no-check is the escape hatch.
+      def check_duplicate_yaml_keys(deploy_dir)
+        require "kdep/yaml_duplicate_keys"
+        dups = Kdep::YamlDuplicateKeys.in_dir(deploy_dir)
+        return if dups.empty?
+
+        dups.each { |dup| @ui.error(dup.to_s) }
+        @ui.error("Merge the repeated blocks into one, or re-run with --no-check to bypass.")
+        exit 1
+      end
+
       def run_preflight_checks(config, deploy_dir, kdep_dir)
         checks = config["check"]
         return if checks.nil? || checks.empty?

data/lib/kdep/commands/check.rb

@@ -35,6 +35,10 @@ module Kdep
         deploy_dir = resolve_deploy_dir(kdep_dir, deploy_name, discovery)
         exit 1 unless deploy_dir
 
+        # Built-in guard, ahead of the user-declared list: a duplicate key is
+        # resolved silently by the parser, so nothing downstream can report it.
+        check_duplicate_yaml_keys(deploy_dir)
+
         config = Kdep::Config.new(deploy_dir, env).load
         checks = config["check"]
         if checks.nil? || checks.empty?
@@ -58,6 +62,16 @@ module Kdep
 
       private
 
+      def check_duplicate_yaml_keys(deploy_dir)
+        require "kdep/yaml_duplicate_keys"
+        dups = Kdep::YamlDuplicateKeys.in_dir(deploy_dir)
+        return if dups.empty?
+
+        dups.each { |dup| @ui.error(dup.to_s) }
+        @ui.error("Merge the repeated blocks into one.")
+        exit 1
+      end
+
       def resolve_deploy_dir(kdep_dir, deploy_name, discovery)
         if deploy_name
           path = File.join(kdep_dir, deploy_name)

data/lib/kdep/commands/push.rb

@@ -41,6 +41,11 @@ module Kdep
         # Load config
         config = Kdep::Config.new(deploy_dir, env).load
 
+        if config["build"] == false
+          @ui.error("#{deploy_dir} declares `build: false` — its image lives in an upstream registry, so there is nothing to push.")
+          exit 1
+        end
+
         # Resolve tag from state.yml — app.yml has no tag field by design;
         # state.yml is the source of truth for the last bumped version.
         tag = Kdep::State.tag(deploy_dir)

data/lib/kdep/commands/restart.rb

@@ -3,16 +3,16 @@ require "optparse"
 module Kdep
   module Commands
     class Restart
-      RESTARTABLE_PRESETS = %w[web worker].freeze
-      NON_RESTARTABLE_PRESETS = %w[job cronjob].freeze
+      WORKLOAD_KINDS = %w[deployment statefulset daemonset].freeze
+      NON_RESTARTABLE_KINDS = %w[job cronjob].freeze
 
       def self.option_parser
         OptionParser.new do |opts|
           opts.banner = "Usage: kdep restart [deploy] [--type TYPE]"
           opts.separator ""
-          opts.separator "Triggers a rolling restart of a Deployment or StatefulSet."
+          opts.separator "Triggers a rolling restart of a Deployment, StatefulSet or DaemonSet."
           opts.separator ""
-          opts.on("--type TYPE", "Resource type: deployment, statefulset (overrides preset)") do |_|
+          opts.on("--type TYPE", "Resource type: deployment, statefulset, daemonset (overrides preset)") do |_|
             # parsed via into: hash
           end
         end
@@ -58,30 +58,58 @@ module Kdep
         preset = config["preset"]
 
         # Determine resource type
-        resource_type = determine_resource_type(preset)
+        resource_type = determine_resource_type(preset, deploy_dir)
 
         # Execute rollout restart
-        Kdep::Kubectl.run("rollout", "restart", "#{resource_type}/#{app_name}", "-n", namespace)
+        begin
+          Kdep::Kubectl.run("rollout", "restart", "#{resource_type}/#{app_name}", "-n", namespace)
+        rescue Kdep::Kubectl::Error => e
+          @ui.error(e.message)
+          @ui.info("Hint: use --type <deployment|statefulset|daemonset> if the workload kind differs from the preset")
+          exit 1
+        end
         @ui.info("Restarted #{resource_type}/#{app_name} in #{namespace}")
       end
 
       private
 
-      def determine_resource_type(preset)
+      # The preset file lists the resources kdep applies, so the workload kind
+      # is declared there -- deriving it from the preset *name* got every
+      # non-Deployment target wrong (daemonset, statefulset, custom). Reading
+      # the list also handles `custom`, whose resources live in the deploy dir.
+      def determine_resource_type(preset, deploy_dir)
         if @command_options[:type]
           return @command_options[:type]
         end
 
-        resource_type_for_preset(preset)
+        resource_type_for_preset(preset, deploy_dir)
       end
 
-      def resource_type_for_preset(preset)
-        if NON_RESTARTABLE_PRESETS.include?(preset)
-          @ui.error("#{preset} workloads cannot be restarted (use --type to override)")
+      def resource_type_for_preset(preset, deploy_dir)
+        resources = preset_resources(preset, deploy_dir)
+
+        if (kind = resources.find { |r| NON_RESTARTABLE_KINDS.include?(r) })
+          @ui.error("#{kind} workloads cannot be restarted (use --type to override)")
           exit 1
         end
 
-        "deployment"
+        found = resources & WORKLOAD_KINDS
+
+        if found.size > 1
+          @ui.error("Multiple workloads in preset '#{preset}': #{found.join(', ')}. Use --type to pick one.")
+          exit 1
+        end
+
+        # helm charts declare no workload of their own, and a missing preset is
+        # already reported by render/apply -- keep the old guess rather than
+        # failing a command that used to work.
+        found.first || "deployment"
+      end
+
+      def preset_resources(preset, deploy_dir)
+        Kdep::Preset.new(preset, deploy_dir).resources
+      rescue StandardError
+        []
       end
 
       def resolve_deploy_dir(kdep_dir, deploy_name, discovery)

data/lib/kdep/defaults.rb

@@ -13,6 +13,9 @@ module Kdep
       "cronjob" => {},
       "statefulset" => {},
       "statefulset_svc" => {},
+      # No replicas override: a DaemonSet has no replicas field at all, so the
+      # BASE_DEFAULTS value is simply never read by daemonset.yml.erb.
+      "daemonset" => {},
       "helm"    => {},
       "custom"  => {},
     }.freeze

data/lib/kdep/doctor/check_yaml_dup_keys.rb

@@ -0,0 +1,27 @@
+require "kdep/yaml_duplicate_keys"
+
+module Kdep
+  module Doctor
+    # A duplicate key is not catchable by review -- in a 50-line file with the
+    # two blocks 30 lines apart, they are invisible. It's machine work, and
+    # kdep is the one place in the flow that sees every deploy's YAML.
+    class CheckYamlDupKeys < Check
+      ID = "yaml_dup_keys".freeze
+
+      def run
+        dups = Kdep::YamlDuplicateKeys.in_dir(deploy_dir)
+        return Result.ok(ID) if dups.empty?
+
+        Result.new(
+          id: ID,
+          severity: :error,
+          message: dups.map(&:to_s).join("; "),
+          # Deliberately not wired into --fix: merging two blocks means
+          # deciding which value survives when the inner keys conflict, and a
+          # wrong automatic merge is worse than the bug -- it looks reviewed.
+          hint: "Merge the repeated blocks into one by hand."
+        )
+      end
+    end
+  end
+end

data/lib/kdep/doctor.rb

@@ -5,6 +5,7 @@ require "kdep/doctor/check_state_parseable"
 require "kdep/doctor/check_state_tag_format"
 require "kdep/doctor/check_state_gitignored"
 require "kdep/doctor/check_gitignore_canonical"
+require "kdep/doctor/check_yaml_dup_keys"
 
 module Kdep
   module Doctor
@@ -14,6 +15,7 @@ module Kdep
       CheckStateTagFormat,
       CheckStateGitignored,
       CheckGitignoreCanonical,
+      CheckYamlDupKeys,
     ].freeze
   end
 end

data/lib/kdep/preset.rb

@@ -1,6 +1,6 @@
 module Kdep
   class Preset
-    BUILT_IN = %w[web worker job cronjob statefulset statefulset_svc helm custom].freeze
+    BUILT_IN = %w[web worker job cronjob statefulset statefulset_svc daemonset helm custom].freeze
 
     def initialize(preset_name, deploy_dir)
       raise "preset: is required in app.yml" if preset_name.to_s.strip.empty?

data/lib/kdep/state.rb

@@ -27,15 +27,47 @@ module Kdep
       loaded && loaded["tag"]
     end
 
+    # Rewrites only the `tag:` line, keeping everything else byte-for-byte.
+    # The header says "do not edit by hand", but state.yml is the one place a
+    # warning sits next to the data it guards -- e.g. a target that shares an
+    # image repo with another and must never be re-seeded with --init-state.
+    # Rebuilding the file from scratch silently ate those comments on every
+    # bump, and a YAML round-trip would too (the parser doesn't carry them).
     def self.write(deploy_dir, tag:)
       path = File.join(deploy_dir, FILENAME)
       tmp  = "#{path}.tmp"
-      content = "#{HEADER}tag: \"#{tag}\"\n"
+
+      content = if File.exist?(path)
+                  with_header(replace_tag_line(File.read(path), tag))
+                else
+                  "#{HEADER}tag: \"#{tag}\"\n"
+                end
+
       File.write(tmp, content)
       File.rename(tmp, path)
       path
     end
 
+    # Appends when the key is absent (state hand-edited into a corrupt shape)
+    # rather than discarding what was there -- `load` already raises on that,
+    # so the right move here is to not destroy the evidence.
+    def self.replace_tag_line(current, tag)
+      line = "tag: \"#{tag}\""
+      return current.sub(/^tag:.*$/, line) if current.match?(/^tag:.*$/)
+
+      "#{current.chomp}\n#{line}\n"
+    end
+    private_class_method :replace_tag_line
+
+    # A state.yml committed by hand (bump suggests exactly that when none
+    # exists) has no banner; give it one instead of leaving it unmarked.
+    def self.with_header(content)
+      return content if content.include?(HEADER.lines.first.chomp)
+
+      "#{HEADER}#{content}"
+    end
+    private_class_method :with_header
+
     def self.exists?(deploy_dir)
       File.exist?(File.join(deploy_dir, FILENAME))
     end

data/lib/kdep/version.rb

@@ -1,3 +1,3 @@
 module Kdep
-  VERSION = "0.4.6"
+  VERSION = "0.4.8"
 end

data/lib/kdep/yaml_duplicate_keys.rb

@@ -0,0 +1,72 @@
+require "psych"
+
+module Kdep
+  # Finds keys declared twice in the same mapping, at any depth.
+  #
+  # YAML resolves a repeated key by keeping the LAST one and discarding the
+  # earlier block ENTIRELY, in silence. Nothing in the pipeline warns: helm
+  # template, helm upgrade and kdep all receive the hash already collapsed by
+  # the parser. In repleadfy/llm-api2#1 a redis values.yaml declared `metrics:`
+  # twice; the first block -- the one redirecting the exporter registry to
+  # bitnamilegacy, after Bitnami closed the free repo -- was dropped at parse
+  # time, and the wrong image ran in production for 73 days, surviving only on
+  # a node's image cache.
+  #
+  # This walks the Psych AST rather than calling Psych.load, because load has
+  # already applied last-one-wins and destroyed the evidence. The AST also
+  # gives real line numbers on both sides, works at any depth, and knows that
+  # `key: value` text inside a block scalar is data, not a key -- which a grep
+  # over the raw file cannot.
+  module YamlDuplicateKeys
+    Duplicate = Struct.new(:file, :key_path, :first_line, :repeat_line) do
+      def to_s
+        "#{file}:#{repeat_line} duplicate key '#{key_path}' (first declared at line " \
+          "#{first_line}) -- YAML keeps the last block and discards the earlier one"
+      end
+    end
+
+    def self.in_file(path)
+      ast = Psych.parse_stream(File.read(path))
+      scan(ast).map do |dup|
+        Duplicate.new(File.basename(path), dup[:path], dup[:first], dup[:repeat])
+      end
+    rescue Psych::SyntaxError
+      # A file that doesn't parse is a different problem, reported elsewhere
+      # with better context (Config#load, helm). Silently collapsing is the
+      # failure this scanner exists for; don't turn it into a crash here.
+      []
+    end
+
+    # Top-level only: everything kdep reads as input lives in the deploy dir
+    # root (app.yml, app.<env>.yml, secrets.yml, values.yaml), while nested
+    # dirs hold rendered output and templates.
+    def self.in_dir(dir)
+      Dir.glob(File.join(dir, "*.{yml,yaml}")).sort.flat_map { |f| in_file(f) }
+    end
+
+    def self.scan(node, path = [])
+      found = []
+
+      case node
+      when Psych::Nodes::Mapping
+        seen = {}
+        node.children.each_slice(2) do |key, value|
+          name = key.respond_to?(:value) ? key.value : key.to_s
+          if seen.key?(name)
+            found << {
+              :path   => (path + [name]).join("."),
+              :first  => seen[name],
+              :repeat => key.start_line + 1,
+            }
+          end
+          seen[name] = key.start_line + 1
+          found.concat(scan(value, path + [name]))
+        end
+      when Psych::Nodes::Sequence, Psych::Nodes::Document, Psych::Nodes::Stream
+        node.children.each { |child| found.concat(scan(child, path)) }
+      end
+
+      found
+    end
+  end
+end

data/templates/presets/daemonset

@@ -0,0 +1,5 @@
+# daemonset preset: one pod per node (log shippers, node exporters, agents)
+# Order determines kubectl apply sequence
+configmap
+secret
+daemonset

data/templates/resources/daemonset.yml.erb

@@ -0,0 +1,120 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: <%= @config["daemonset_name"] || name %>
+  namespace: <%= namespace %>
+  labels:
+    app: <%= name %>
+spec:
+  selector:
+    matchLabels:
+      app: <%= name %>
+  template:
+    metadata:
+      labels:
+        app: <%= name %>
+<% if @config["pod_labels"] -%>
+<% @config["pod_labels"].each do |k, v| -%>
+        <%= k %>: "<%= v %>"
+<% end -%>
+<% end -%>
+    spec:
+<% if @config["service_account_name"] -%>
+      serviceAccountName: <%= @config["service_account_name"] %>
+<% end -%>
+<% if @config["host_network"] -%>
+      hostNetwork: <%= @config["host_network"] %>
+<% end -%>
+<% if @config["termination_grace_period"] -%>
+      terminationGracePeriodSeconds: <%= @config["termination_grace_period"] %>
+<% end -%>
+<% if @config["node_selector"] -%>
+      nodeSelector:
+<%= @config["node_selector"].to_yaml.sub("---\n", "").gsub(/^/, "        ").rstrip %>
+<% end -%>
+<% if @config["tolerations"] -%>
+<%# DaemonSets routinely need to land on control-plane/tainted nodes. -%>
+      tolerations:
+<%= @config["tolerations"].to_yaml.sub("---\n", "").gsub(/^/, "        ").rstrip %>
+<% end -%>
+<% if @config["image_pull_secrets"] -%>
+      imagePullSecrets:
+        - name: <%= @config["image_pull_secrets"] %>
+<% end -%>
+<% if @config["init_containers"] -%>
+      initContainers:
+<%= @config["init_containers"].to_yaml.sub("---\n", "").gsub(/^/, "        ").rstrip %>
+<% end -%>
+      containers:
+        - name: <%= @config["container_name"] || name %>
+          image: <%= image_ref %>
+<% if @config["image_pull_policy"] -%>
+          imagePullPolicy: <%= @config["image_pull_policy"] %>
+<% end -%>
+<% if @config["command"] -%>
+          command: <%= @config["command"].is_a?(Array) ? @config["command"].inspect : "[\"#{@config["command"]}\"]" %>
+<% end -%>
+<% if @config["args"] -%>
+          args: <%= @config["args"].is_a?(Array) ? @config["args"].inspect : "[\"#{@config["args"]}\"]" %>
+<% end -%>
+<% if @config["port"] -%>
+          ports:
+            - containerPort: <%= port %>
+<% if @config["container_port_protocol"] -%>
+              protocol: <%= @config["container_port_protocol"] %>
+<% end -%>
+<% end -%>
+<% if @config["security_context"] -%>
+          securityContext:
+<%= @config["security_context"].to_yaml.sub("---\n", "").gsub(/^/, "            ").rstrip %>
+<% end -%>
+<% if @config["resources"] -%>
+          resources:
+<% if @config["resources"]["requests"] -%>
+            requests:
+<% @config["resources"]["requests"].each do |k, v| -%>
+              <%= k %>: <%= v.is_a?(Numeric) ? v : "\"#{v}\"" %>
+<% end -%>
+<% end -%>
+<% if @config["resources"]["limits"] -%>
+            limits:
+<% @config["resources"]["limits"].each do |k, v| -%>
+              <%= k %>: <%= v.is_a?(Numeric) ? v : "\"#{v}\"" %>
+<% end -%>
+<% end -%>
+<% end -%>
+<% if @config["volume_mounts"] -%>
+          volumeMounts:
+<% @config["volume_mounts"].each do |vm| -%>
+            - name: <%= vm["name"] %>
+              mountPath: <%= vm["mountPath"] %>
+<% if vm["readOnly"] -%>
+              readOnly: <%= vm["readOnly"] %>
+<% end -%>
+<% if vm["subPath"] -%>
+              subPath: <%= vm["subPath"] %>
+<% end -%>
+<% end -%>
+<% end -%>
+<% if @config["container_env"] -%>
+<%# Named container_env, not env: `env:` is a backward-compat alias for -%>
+<%# `configmap:` (see Config#apply_defaults), so it never reaches a template. -%>
+          env:
+<%= @config["container_env"].to_yaml.sub("---\n", "").gsub(/^/, "            ").rstrip %>
+<% end -%>
+          envFrom:
+<% env_from_list = @config["env_from"] || ["configmap/config-#{name}", "secret/secret-#{name}"] -%>
+<% env_from_list.each do |ref| -%>
+<%   type, ref_name = ref.split("/", 2) -%>
+<% if type == "configmap" -%>
+            - configMapRef:
+                name: <%= ref_name %>
+<% elsif type == "secret" -%>
+            - secretRef:
+                name: <%= ref_name %>
+<% end -%>
+<% end -%>
+<% if @config["volumes"] -%>
+      volumes:
+<%= @config["volumes"].to_yaml.sub("---\n", "").gsub(/^/, "        ").rstrip %>
+<% end -%>

data/templates/resources/statefulset.yml.erb

@@ -27,6 +27,10 @@ spec:
 <% if @config["image_pull_secrets"] -%>
       imagePullSecrets:
         - name: <%= @config["image_pull_secrets"] %>
+<% end -%>
+<% if @config["init_containers"] -%>
+      initContainers:
+<%= @config["init_containers"].to_yaml.sub("---\n", "").gsub(/^/, "        ").rstrip %>
 <% end -%>
       containers:
         - name: <%= @config["container_name"] || name %>
@@ -106,6 +110,12 @@ spec:
               subPath: <%= vm["subPath"] %>
 <% end -%>
 <% end -%>
+<% end -%>
+<% if @config["container_env"] -%>
+<%# Named container_env, not env: `env:` is a backward-compat alias for -%>
+<%# `configmap:` (see Config#apply_defaults), so it never reaches a template. -%>
+          env:
+<%= @config["container_env"].to_yaml.sub("---\n", "").gsub(/^/, "            ").rstrip %>
 <% end -%>
           envFrom:
 <% env_from_list = @config["env_from"] || ["configmap/config-#{name}", "secret/secret-#{name}"] -%>
@@ -123,3 +133,9 @@ spec:
       volumes:
 <%= @config["volumes"].to_yaml.sub("---\n", "").gsub(/^/, "        ").rstrip %>
 <% end -%>
+<% if @config["volume_claim_templates"] -%>
+<%# Sibling of `template:`, not part of the pod spec -- this is the one field -%>
+<%# that makes a StatefulSet a StatefulSet, so it belongs in the built-in. -%>
+  volumeClaimTemplates:
+<%= @config["volume_claim_templates"].to_yaml.sub("---\n", "").gsub(/^/, "    ").rstrip %>
+<% end -%>

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kdep
 version: !ruby/object:Gem::Version
-  version: 0.4.6
+  version: 0.4.8
 platform: ruby
 authors:
 - Leadfy
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-26 00:00:00.000000000 Z
+date: 2026-08-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: envspec
@@ -42,14 +42,14 @@ dependencies:
   name: minitest
   requirement: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.0'
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
-    - - "~>"
+    - - ">="
       - !ruby/object:Gem::Version
         version: '5.0'
 - !ruby/object:Gem::Dependency
@@ -125,6 +125,7 @@ files:
 - lib/kdep/doctor/check_state_parseable.rb
 - lib/kdep/doctor/check_state_present.rb
 - lib/kdep/doctor/check_state_tag_format.rb
+- lib/kdep/doctor/check_yaml_dup_keys.rb
 - lib/kdep/doctor/result.rb
 - lib/kdep/helm.rb
 - lib/kdep/kubectl.rb
@@ -144,12 +145,14 @@ files:
 - lib/kdep/version_tagger.rb
 - lib/kdep/writer.rb
 - lib/kdep/yaml_compat.rb
+- lib/kdep/yaml_duplicate_keys.rb
 - templates/init/app.yml.erb
 - templates/init/env.spec
 - templates/init/gitignore
 - templates/init/secrets.yml
 - templates/presets/cronjob
 - templates/presets/custom
+- templates/presets/daemonset
 - templates/presets/helm
 - templates/presets/job
 - templates/presets/statefulset
@@ -158,6 +161,7 @@ files:
 - templates/presets/worker
 - templates/resources/configmap.yml.erb
 - templates/resources/cronjob.yml.erb
+- templates/resources/daemonset.yml.erb
 - templates/resources/deployment.yml.erb
 - templates/resources/helm_ingress.yml.erb
 - templates/resources/infisical_secret.yml.erb