krane 3.9.1 → 3.9.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 43683d4bcd224e46ba5598d9a41ef99867836067620852e0f835712dd602b2a1
-  data.tar.gz: 3ac6e0f0bd6c4ec7ef5ed5e29021fd5695e3620dfcea1c14aa2e42fd83fdbb2c
+  metadata.gz: d13a5afaa821cb112292626c292ce30ffe425d807415376ae41ae7d277093122
+  data.tar.gz: a1e741ce9287d33e6f50efeea076363906e3e07e0de037984d626b4a963c9f41
 SHA512:
-  metadata.gz: 7c174786771b7b82e47fed0c6f256ac119abe4d39b038d9c7d75dda2718d490622c2c653452d7e0f8edafb026a9e932ab9583986cc6f79d845901070bcabd6ee
-  data.tar.gz: a261331f47d9d579e1282d92bd182280883ee1aa641fc18f9761743452f6ead060c4fb3900cb4ff8eb724a14df45e522f5931c879fc36ce5d9142943e99d17ed
+  metadata.gz: 48523d3a94ca3efb25b04033d187bebf4c911e14fbbe1f7608d340b6f4087d2bee36e51fdfb3d89ea7fff33d74583870cb64ac1ee96be6332212c5e3ca40a8b3
+  data.tar.gz: 663967d67f1d685c3b2f7b34e156c7b33a052b78620c8e6a2f568a1998186677dc5cf470cc3a1f4fce73856988a44b17e70315de10eaf52a53405759350e1d00

data/.github/CODEOWNERS

@@ -1 +1 @@
-* @Shopify/infrastructure-tooling @Shopify/application-infrastructure
+* @Shopify/application-infrastructure

data/CHANGELOG.md

@@ -1,5 +1,10 @@
 ## next
 
+## 3.9.2
+- Parse JSON with `JSON.parse` instead of `MultiJson.load`, and drop the `multi_json` dependency. On Ruby 3.0 and 3.1, `multi_json` 1.19.1 (the newest those versions can install) crashes with `json` 3.x
+- Pod log retrieval now uses the task's `kubeconfig` instead of falling back to `ENV['KUBECONFIG']`
+- Reject namespaces, contexts and kinds that `kubectl` would parse as flags rather than as positional arguments
+
 ## 3.9.1
 - Test against k8s 1.34
 

data/krane.gemspec

@@ -32,7 +32,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency("ejson", "~> 1.0")
   spec.add_dependency("colorize", "~> 0.8")
   spec.add_dependency("statsd-instrument", ['>= 2.8', "< 3.9"])
-  spec.add_dependency("multi_json")
   spec.add_dependency("concurrent-ruby", "~> 1.1")
   spec.add_dependency("jsonpath", "~> 1.0")
   spec.add_dependency("thor", ">= 1.0", "< 2.0")

data/lib/krane/bindings_parser.rb

@@ -54,14 +54,14 @@ module Krane
     end
 
     def parse_json(string)
-      bindings = MultiJson.load(string)
+      bindings = JSON.parse(string)
 
       unless bindings.is_a?(Hash)
         raise ArgumentError, "Expected JSON data to be a hash."
       end
 
       bindings
-    rescue MultiJson::ParseError
+    rescue JSON::ParserError
       nil
     end
 

data/lib/krane/cli/krane.rb

@@ -6,7 +6,7 @@ require 'krane/cli/render_command'
 require 'krane/cli/restart_command'
 require 'krane/cli/run_command'
 require 'krane/cli/version_command'
-require 'multi_json'
+require 'json'
 require 'thor'
 
 module Krane

data/lib/krane/cluster_resource_discovery.rb

@@ -54,7 +54,7 @@ module Krane
       @api_path_cache["/"] ||= begin
         raw_json, err, st = kubectl.run("get", "--raw", base_api_path, attempts: 5, use_namespace: false)
         paths = if st.success?
-          MultiJson.load(raw_json)["paths"]
+          JSON.parse(raw_json)["paths"]
         else
           raise FatalKubeAPIError, "Error retrieving raw path /: #{err}"
         end
@@ -66,7 +66,7 @@ module Krane
       @api_path_cache[path] ||= begin
         raw_json, err, st = kubectl.run("get", "--raw", path, attempts: 2, use_namespace: false)
         if st.success?
-          MultiJson.load(raw_json)
+          JSON.parse(raw_json)
         else
           logger.warn("Error retrieving api path: #{err}")
           {}
@@ -92,7 +92,7 @@ module Krane
       raw_json, err, st = kubectl.run("get", "CustomResourceDefinition", output: "json", attempts: 5,
         use_namespace: false)
       if st.success?
-        MultiJson.load(raw_json)["items"]
+        JSON.parse(raw_json)["items"]
       else
         raise FatalKubeAPIError, "Error retrieving CustomResourceDefinition: #{err}"
       end

data/lib/krane/container_logs.rb

@@ -16,8 +16,8 @@ module Krane
       @printed_latest = false
     end
 
-    def sync
-      new_logs = fetch_latest
+    def sync(kubectl)
+      new_logs = fetch_latest(kubectl)
       return unless new_logs.present?
       @lines += sort_and_deduplicate(new_logs)
     end
@@ -47,7 +47,7 @@ module Krane
 
     private
 
-    def fetch_latest
+    def fetch_latest(kubectl)
       cmd = ["logs", @parent_id, "--container=#{container_name}", "--timestamps"]
       cmd << if @last_timestamp.present?
         "--since-time=#{rfc3339_timestamp(@last_timestamp)}"
@@ -58,11 +58,6 @@ module Krane
       out.encode('UTF-8', invalid: :replace, replace: '').split("\n")
     end
 
-    def kubectl
-      task_config = TaskConfig.new(@context, @namespace, @logger)
-      @kubectl ||= Kubectl.new(task_config: task_config, log_failure_by_default: false)
-    end
-
     def rfc3339_timestamp(time)
       time.strftime("%FT%T.%N%:z")
     end

data/lib/krane/deploy_task.rb

@@ -318,7 +318,7 @@ module Krane
       @namespace_definition ||= begin
         definition, _err, st = kubectl.run("get", "namespace", @namespace, use_namespace: false,
           log_failure: true, raise_if_not_found: true, attempts: 3, output: 'json')
-        st.success? ? MultiJson.load(definition, symbolize_names: true) : nil
+        st.success? ? JSON.parse(definition, symbolize_names: true) : nil
       end
     rescue Kubectl::ResourceNotFoundError
       nil
@@ -352,7 +352,7 @@ module Krane
         unless st.success?
           raise EjsonSecretError, "Error retrieving Secret/#{EjsonSecretProvisioner::EJSON_KEYS_SECRET}: #{err}"
         end
-        MultiJson.load(out)
+        JSON.parse(out)
       end
     end
 

data/lib/krane/ejson_secret_provisioner.rb

@@ -117,8 +117,8 @@ module Krane
 
     def load_ejson_from_file
       return {} unless File.exist?(@ejson_file)
-      MultiJson.load(File.read(@ejson_file))
-    rescue MultiJson::ParseError => e
+      JSON.parse(File.read(@ejson_file))
+    rescue JSON::ParserError => e
       raise EjsonSecretError, "Failed to parse encrypted ejson:\n  #{e}"
     end
 
@@ -139,8 +139,8 @@ module Krane
         msg = err.presence || out
         raise EjsonSecretError, msg
       end
-      MultiJson.load(out)
-    rescue MultiJson::ParseError
+      JSON.parse(out)
+    rescue JSON::ParserError
       raise EjsonSecretError, "Failed to parse decrypted ejson"
     end
 

data/lib/krane/kubectl.rb

@@ -86,7 +86,7 @@ module Krane
           response, _, status = run("version", output: "json", use_namespace: false, log_failure: true, attempts: 2)
           raise KubectlError, "Could not retrieve kubectl version info" unless status.success?
 
-          version_data = MultiJson.load(response)
+          version_data = JSON.parse(response)
           client_version = platform_agnostic_version(version_data.dig("clientVersion", "gitVersion").to_s)
           server_version = platform_agnostic_version(version_data.dig("serverVersion", "gitVersion").to_s)
           unless client_version && server_version

data/lib/krane/kubernetes_resource/daemon_set.rb

@@ -30,9 +30,9 @@ module Krane
       observed_generation == current_generation
     end
 
-    def fetch_debug_logs
+    def fetch_debug_logs(kubectl)
       most_useful_pod = pods.find(&:deploy_failed?) || pods.find(&:deploy_timed_out?) || pods.first
-      most_useful_pod.fetch_debug_logs
+      most_useful_pod.fetch_debug_logs(kubectl)
     end
 
     def print_debug_logs?

data/lib/krane/kubernetes_resource/deployment.rb

@@ -29,8 +29,8 @@ module Krane
       @latest_rs.present?
     end
 
-    def fetch_debug_logs
-      @latest_rs.fetch_debug_logs
+    def fetch_debug_logs(kubectl)
+      @latest_rs.fetch_debug_logs(kubectl)
     end
 
     def deploy_succeeded?

data/lib/krane/kubernetes_resource/pod.rb

@@ -28,12 +28,12 @@ module Krane
             logger: logger, statsd_tags: statsd_tags)
     end
 
-    def sync(_cache)
+    def sync(cache)
       super
       raise_predates_deploy_error if exists? && unmanaged? && !deploy_started?
 
       if exists?
-        logs.sync if unmanaged?
+        logs.sync(cache.kubectl) if unmanaged?
         update_container_statuses(@instance_data["status"])
       else # reset
         @containers.each(&:reset_status)
@@ -93,8 +93,8 @@ module Krane
       "#{phase_failure_message} #{container_problems}".strip.presence
     end
 
-    def fetch_debug_logs
-      logs.sync
+    def fetch_debug_logs(kubectl)
+      logs.sync(kubectl)
       logs
     end
 

data/lib/krane/kubernetes_resource/pod_set_base.rb

@@ -18,7 +18,7 @@ module Krane
       own_events.merge(most_useful_pod.fetch_events(kubectl))
     end
 
-    def fetch_debug_logs
+    def fetch_debug_logs(kubectl)
       logs = Krane::RemoteLogs.new(
         logger: @logger,
         parent_id: id,
@@ -26,7 +26,7 @@ module Krane
         namespace: @namespace,
         context: @context
       )
-      logs.sync
+      logs.sync(kubectl)
       logs
     end
 

data/lib/krane/kubernetes_resource.rb

@@ -35,6 +35,11 @@ module Krane
       If you have reason to believe it will succeed, retry the deploy to continue to monitor the rollout.
       MSG
 
+    # Kubernetes kinds begin with a letter, and may contain dashes after that (the API server
+    # lowercases the kind and validates it as a DNS-1035 label). Only the first character matters
+    # here: a leading dash would make kubectl parse the kind as a flag rather than a resource kind.
+    KIND_FORMAT = /\A[A-Za-z]/
+
     ALLOWED_DEPLOY_METHOD_OVERRIDES = %w(create replace replace-force)
     DEPLOY_METHOD_OVERRIDE_ANNOTATION = "deploy-method-override"
     TIMEOUT_OVERRIDE_ANNOTATION = "timeout-override"
@@ -91,6 +96,10 @@ module Krane
           raise InvalidTemplateError.new("Template is missing required field 'kind'", content: debug_content)
         end
 
+        unless definition["kind"].match?(KIND_FORMAT)
+          raise InvalidTemplateError.new("Template's 'kind' must begin with a letter", content: debug_content)
+        end
+
         if definition.dig('metadata', 'name').blank? && definition.dig('metadata', 'generateName').blank?
           raise InvalidTemplateError.new("Template must specify one of 'metadata.name' or 'metadata.generateName'",
             content: debug_content)
@@ -250,7 +259,7 @@ module Krane
 
     def sync_debug_info(kubectl)
       @debug_events = fetch_events(kubectl) unless ENV[DISABLE_FETCHING_EVENT_INFO]
-      @debug_logs = fetch_debug_logs if print_debug_logs? && !ENV[DISABLE_FETCHING_LOG_INFO]
+      @debug_logs = fetch_debug_logs(kubectl) if print_debug_logs? && !ENV[DISABLE_FETCHING_LOG_INFO]
     end
 
     def debug_message(cause = nil, info_hash = {})

data/lib/krane/remote_logs.rb

@@ -23,8 +23,8 @@ module Krane
       @container_logs.all?(&:empty?)
     end
 
-    def sync
-      @container_logs.each(&:sync)
+    def sync(kubectl)
+      @container_logs.each { |cl| cl.sync(kubectl) }
     end
 
     def print_latest

data/lib/krane/resource_cache.rb

@@ -4,6 +4,8 @@ require 'concurrent/hash'
 
 module Krane
   class ResourceCache
+    attr_reader :kubectl
+
     delegate :namespace, :context, :logger, to: :@task_config
 
     def initialize(task_config)
@@ -64,7 +66,7 @@ module Krane
       raise KubectlError unless st.success?
 
       instances = {}
-      MultiJson.load(raw_json)["items"].each do |resource|
+      JSON.parse(raw_json)["items"].each do |resource|
         resource_name = resource.dig("metadata", "name")
         instances[resource_name] = resource
       end

data/lib/krane/resource_deployer.rb

@@ -251,7 +251,7 @@ module Krane
       # For resources that rely on a generateName attribute, we get the `name` from the result of the call to `create`
       # We must explicitly set this name value so that the `apply` step for pruning can run successfully
       if status.success? && resource.uses_generate_name?
-        resource.use_generated_name(MultiJson.load(out))
+        resource.use_generated_name(JSON.parse(out))
       end
 
       [err, status]

data/lib/krane/rollout_conditions.rb

@@ -11,7 +11,7 @@ module Krane
       def from_annotation(conditions_string)
         return new(default_conditions) if conditions_string.downcase.strip == "true"
 
-        conditions = MultiJson.load(conditions_string).slice('success_conditions', 'failure_conditions')
+        conditions = JSON.parse(conditions_string).slice('success_conditions', 'failure_conditions')
         conditions.deep_symbolize_keys!
 
         # Create JsonPath objects
@@ -26,7 +26,7 @@ module Krane
         end
 
         new(conditions)
-      rescue MultiJson::ParseError => e
+      rescue JSON::ParserError => e
         raise RolloutConditionsError, "Rollout conditions are not valid JSON: #{e}"
       rescue StandardError => e
         raise RolloutConditionsError,

data/lib/krane/task_config_validator.rb

@@ -9,6 +9,10 @@ module Krane
       validate_namespace_exists
     ).freeze
 
+    # Kubernetes namespaces are DNS-1123 labels. Anything else, in particular a value starting with
+    # a dash, would be parsed by kubectl as a flag rather than as a resource name.
+    NAMESPACE_FORMAT = /\A[a-z0-9]([-a-z0-9]{0,61}[a-z0-9])?\z/
+
     delegate :context, :namespace, :logger, to: :@task_config
 
     def initialize(task_config, kubectl, kubeclient_builder, only: nil)
@@ -44,6 +48,12 @@ module Krane
         return @errors << "Context can not be blank"
       end
 
+      # A context is passed to kubectl as a bare positional argument; a leading dash would make
+      # kubectl parse it as a flag. Context names are otherwise too varied to constrain further.
+      if context.start_with?("-")
+        return @errors << "Context can not start with a dash"
+      end
+
       _, err, st = @kubectl.run("config", "get-contexts", context, "-o", "name",
         use_namespace: false, use_context: false, log_failure: false, attempts: 2)
 
@@ -70,6 +80,10 @@ module Krane
         return @errors << "Namespace can not be blank"
       end
 
+      unless namespace.match?(NAMESPACE_FORMAT)
+        return @errors << "Namespace is not a valid Kubernetes namespace name"
+      end
+
       _, err, st = @kubectl.run("get", "namespace", "-o", "name", namespace,
         use_namespace: false, log_failure: false, attempts: 3)
 

data/lib/krane/version.rb

@@ -1,4 +1,4 @@
 # frozen_string_literal: true
 module Krane
-  VERSION = "3.9.1"
+  VERSION = "3.9.2"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: krane
 version: !ruby/object:Gem::Version
-  version: 3.9.1
+  version: 3.9.2
 platform: ruby
 authors:
 - Katrina Verey
@@ -101,20 +101,6 @@ dependencies:
     - - "<"
       - !ruby/object:Gem::Version
         version: '3.9'
-- !ruby/object:Gem::Dependency
-  name: multi_json
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
-  type: :runtime
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - ">="
-      - !ruby/object:Gem::Version
-        version: '0'
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
   requirement: !ruby/object:Gem::Requirement
@@ -525,7 +511,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.7.2
+rubygems_version: 4.0.21
 specification_version: 4
 summary: A command line tool that helps you ship changes to a Kubernetes namespace
   and understand the result