kube_cluster 0.15.0 → 0.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29e455d15de0900af5bf1f941e9636c0e8a1d220a4e6a64dc433aac86d43e596
-  data.tar.gz: 741e89bb988a9ed630b5d1b58e1ec95dcf85acb278e4045f936ad8803e0e7d82
+  metadata.gz: 2db1b928c5cf97c3b248b5d035bf071d719cc2387c3ceab02ab999dcf45febe2
+  data.tar.gz: 85fc1a4be926b518f7e3720d58308fbf8e3915f628d5058dcbfef26799918406
 SHA512:
-  metadata.gz: 84041914a07f9bb7c21c1653d53781fefa350f54d0fe66b45e519bb6dbfbbd5788df10e49a347c33deebd779e9443348f577a36e787a7451841bd1812a7fc918
-  data.tar.gz: 1ca89cc294ed092ba68bd28086bbd81c655896cea7d84a745d9974f93d093d71fe7d76e83ae1da0080179827d8c86274d40f05ecc66b102aa9fe27ad1c514631
+  metadata.gz: f5c41a08ad784585e5fc92bdb6de5107b031e04d31d8a3d0d04e8670b44496e15244704b82a6c4c6e1027cca5fdd1c0475dc2af61df40b146b23cab611224e68
+  data.tar.gz: 68e00e0750fc326881b61cbe3a705ae7341eab8ba37b68429387e0055bc5eb26fa2bfb38f9f59d2e53ac5d0f8220e5fe2bbb5edb507c9a750e5ece721e52276f

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    kube_cluster (0.15.0)
+    kube_cluster (0.16.0)
       activesupport (~> 8.0)
       kube_kubectl (~> 2.0)
       kube_schema (~> 1.7)

data/lib/kube/cluster/middleware/set_namespace.rb

@@ -25,9 +25,25 @@ module Kube
 
               h = resource.to_h
               h[:metadata] ||= {}
-              next resource if h[:metadata][:namespace] && h[:metadata][:namespace] != 'default'
 
-              h[:metadata][:namespace] = @namespace
+              unless h[:metadata][:namespace] && h[:metadata][:namespace] != 'default'
+                h[:metadata][:namespace] = @namespace
+              end
+
+              # A RoleBinding's ServiceAccount subjects need an explicit
+              # namespace; fill in any left blank with the target namespace so
+              # same-namespace bindings (e.g. ServiceAccountWithRole) resolve.
+              if h[:kind] == 'RoleBinding' && h[:subjects].is_a?(Array)
+                h[:subjects] = h[:subjects].map { |subject|
+                  if subject[:kind] == 'ServiceAccount' &&
+                     (subject[:namespace].nil? || subject[:namespace].to_s.empty?)
+                    subject.merge(namespace: @namespace)
+                  else
+                    subject
+                  end
+                }
+              end
+
               resource.rebuild(h)
             }
           }

data/lib/kube/cluster/standard/role.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A Role with an ergonomic rules shorthand. Each rule maps a resource
+      # spec to its verbs; the spec is "resource" (core API group) or
+      # "group/resource":
+      #
+      #   Role.new(rules: [
+      #     "secrets"        => %w[get list],
+      #     "batch/cronjobs" => %w[get],
+      #   ])
+      #
+      class Role < Kube::Cluster["Role"]
+        def initialize(rules:, name: nil, &block)
+          built = self.class.build_rules(rules)
+
+          super() do
+            metadata.name = name if name
+            self.rules = built
+            instance_exec(&block) if block
+          end
+        end
+
+        def name
+          to_h.dig(:metadata, :name)
+        end
+
+        def name=(value)
+          metadata.name = value
+        end
+
+        def self.build_rules(rules)
+          entries = rules.is_a?(Hash) ? [rules] : Array(rules)
+
+          entries.flat_map do |entry|
+            entry.map do |spec, verbs|
+              group, resource = spec.include?("/") ? spec.split("/", 2) : ["", spec]
+              { apiGroups: [group], resources: [resource], verbs: Array(verbs) }
+            end
+          end
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "Role" do
+    it "expands the rules shorthand" do
+      yaml = Kube::Cluster::Standard::Role
+        .new(name: "r", rules: [
+          "secrets"        => %w[get list],
+          "batch/cronjobs" => %w[get],
+        ])
+        .to_yaml
+
+      yaml.include?("resources").should == true
+      yaml.include?("batch").should == true
+    end
+  end
+end

data/lib/kube/cluster/standard/role_binding.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A RoleBinding that wires a Role to a ServiceAccount. This is just the
+      # binding resource -- the Role and ServiceAccount are defined separately
+      # (and emitted together by ServiceAccountWithRole):
+      #
+      #   RoleBinding.new(role: MyRole, service_account: MyServiceAccount)
+      #
+      # The subject namespace is left blank when the ServiceAccount has none, so
+      # the SetNamespace middleware fills it with the target namespace.
+      class RoleBinding < Kube::Cluster["RoleBinding"]
+        def initialize(role:, service_account:, name: nil, &block)
+          name ||= role.name || service_account.name
+          role_name = role.name || name
+
+          subject = { kind: "ServiceAccount", name: service_account.name }
+          subject[:namespace] = service_account.namespace if service_account.namespace
+
+          super() do
+            metadata.name = name
+            self.roleRef = {
+              apiGroup: "rbac.authorization.k8s.io",
+              kind: "Role",
+              name: role_name,
+            }
+            self.subjects = [subject]
+            instance_exec(&block) if block
+          end
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "RoleBinding" do
+    it "references the role and service account" do
+      yaml = Kube::Cluster::Standard::RoleBinding.new(
+        role: Kube::Cluster::Standard::Role.new(name: "r", rules: ["secrets" => %w[get]]),
+        service_account: Kube::Cluster::Standard::ServiceAccount.new(name: "sa"),
+      ).to_yaml
+
+      yaml.include?("name: r").should == true
+      yaml.include?("name: sa").should == true
+    end
+  end
+end

data/lib/kube/cluster/standard/service_account.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      class ServiceAccount < Kube::Cluster["ServiceAccount"]
+        def initialize(name:, namespace: nil, &block)
+          super() do
+            metadata.name = name
+            metadata.namespace = namespace if namespace
+            instance_exec(&block) if block
+          end
+        end
+
+        def name
+          to_h.dig(:metadata, :name)
+        end
+
+        def namespace
+          to_h.dig(:metadata, :namespace)
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "ServiceAccount" do
+    it "initializes without error" do
+      Kube::Cluster::Standard::ServiceAccount
+        .new(name: "my-sa")
+        .to_yaml
+        .is_a?(String)
+        .should == true
+    end
+  end
+end

data/lib/kube/cluster/standard/service_account_with_role.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # Bundles a ServiceAccount, a Role, and the RoleBinding that ties them
+      # together into one Manifest. The Role and RoleBinding take the
+      # ServiceAccount's name unless a name is given explicitly:
+      #
+      #   ServiceAccountWithRole.new(
+      #     service_account: ServiceAccount.new(name: "glauth-config-builder"),
+      #     role: Role.new(rules: [
+      #       "secrets"        => %w[get list],
+      #       "batch/cronjobs" => %w[get],
+      #     ]),
+      #   )
+      #
+      class ServiceAccountWithRole < Kube::Cluster::Manifest
+        def initialize(service_account:, role:, name: nil, &block)
+          name ||= service_account.name
+          role.name = name
+
+          role_binding = Kube::Cluster::Standard::RoleBinding.new(
+            role: role,
+            service_account: service_account,
+            name: name,
+          )
+
+          super(service_account, role, role_binding)
+
+          instance_exec(&block) if block
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "ServiceAccountWithRole" do
+    it "emits the service account, role, and binding" do
+      m = Kube::Cluster::Standard::ServiceAccountWithRole.new(
+        service_account: Kube::Cluster::Standard::ServiceAccount.new(name: "sa"),
+        role: Kube::Cluster::Standard::Role.new(rules: ["secrets" => %w[get list]]),
+      )
+
+      m.map { |r| r.to_h[:kind] }.sort.should == %w[Role RoleBinding ServiceAccount]
+    end
+  end
+end

data/lib/kube/cluster/version.rb

@@ -2,6 +2,6 @@
 
 module Kube
   module Cluster
-    VERSION = "0.15.0"
+    VERSION = "0.16.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kube_cluster
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.16.0
 platform: ruby
 authors:
 - Nathan K
@@ -232,8 +232,12 @@ files:
 - lib/kube/cluster/standard/perses/perses.rb
 - lib/kube/cluster/standard/perses/perses_datasource.rb
 - lib/kube/cluster/standard/persistent_volume_claim.rb
+- lib/kube/cluster/standard/role.rb
+- lib/kube/cluster/standard/role_binding.rb
 - lib/kube/cluster/standard/secret.rb
 - lib/kube/cluster/standard/service.rb
+- lib/kube/cluster/standard/service_account.rb
+- lib/kube/cluster/standard/service_account_with_role.rb
 - lib/kube/cluster/standard/victoria_metrics/vl_agent.rb
 - lib/kube/cluster/standard/victoria_metrics/vl_single.rb
 - lib/kube/cluster/standard/victoria_metrics/vm_agent.rb