kube_cluster 0.15.0 → 0.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 29e455d15de0900af5bf1f941e9636c0e8a1d220a4e6a64dc433aac86d43e596
-  data.tar.gz: 741e89bb988a9ed630b5d1b58e1ec95dcf85acb278e4045f936ad8803e0e7d82
+  metadata.gz: f7b1fa07c1c7e080961d17a281c4b2c8a6e84abc6cc9d4ae6c568415b2e989ae
+  data.tar.gz: 80994ba308efe68700f925dff182abf89908a55b1d35224c75eb577d7a42485c
 SHA512:
-  metadata.gz: 84041914a07f9bb7c21c1653d53781fefa350f54d0fe66b45e519bb6dbfbbd5788df10e49a347c33deebd779e9443348f577a36e787a7451841bd1812a7fc918
-  data.tar.gz: 1ca89cc294ed092ba68bd28086bbd81c655896cea7d84a745d9974f93d093d71fe7d76e83ae1da0080179827d8c86274d40f05ecc66b102aa9fe27ad1c514631
+  metadata.gz: ac7da1390a3fedf1973a709b0ce5547ee99590d68dfdf46686d4fcf64e237b3a37e86f27b3dfc1350ef22bd264828d4c13705b79e05e6abc1f5ac20ae2cd8364
+  data.tar.gz: 96154be98c24b04e56a49c2c6a4df93b94fe67bfa8b79c754c62e543187a7083418815049e05a47db516b16d58db91e2e9dc649a46f9d04243219c28af87df27

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    kube_cluster (0.15.0)
+    kube_cluster (0.17.0)
       activesupport (~> 8.0)
       kube_kubectl (~> 2.0)
       kube_schema (~> 1.7)

data/lib/kube/cluster/middleware/set_namespace.rb

@@ -25,9 +25,25 @@ module Kube
 
               h = resource.to_h
               h[:metadata] ||= {}
-              next resource if h[:metadata][:namespace] && h[:metadata][:namespace] != 'default'
 
-              h[:metadata][:namespace] = @namespace
+              unless h[:metadata][:namespace] && h[:metadata][:namespace] != 'default'
+                h[:metadata][:namespace] = @namespace
+              end
+
+              # A RoleBinding's ServiceAccount subjects need an explicit
+              # namespace; fill in any left blank with the target namespace so
+              # same-namespace bindings (e.g. ServiceAccountWithRole) resolve.
+              if h[:kind] == 'RoleBinding' && h[:subjects].is_a?(Array)
+                h[:subjects] = h[:subjects].map { |subject|
+                  if subject[:kind] == 'ServiceAccount' &&
+                     (subject[:namespace].nil? || subject[:namespace].to_s.empty?)
+                    subject.merge(namespace: @namespace)
+                  else
+                    subject
+                  end
+                }
+              end
+
               resource.rebuild(h)
             }
           }

data/lib/kube/cluster/standard/cron_job_with_service_account.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A CronJob plus the ServiceAccount/Role/RoleBinding it runs as, bundled
+      # into one Manifest. The RBAC rules use the Role shorthand; the CronJob's
+      # serviceAccountName is wired to the generated ServiceAccount. Everything
+      # is named after +name+.
+      #
+      #   CronJobWithServiceAccount.new(
+      #     name:     "glauth-config-builder",
+      #     image:    "nixery.dev/shell/ruby/kubectl/cacert",
+      #     schedule: "*/5 * * * *",
+      #     rules: [
+      #       "secrets"        => %w[get list],
+      #       "batch/jobs"     => %w[create],
+      #     ],
+      #     command: RubyScript(<<~'BUILD'),
+      #       ...
+      #     BUILD
+      #   )
+      #
+      class CronJobWithServiceAccount < Kube::Cluster::Manifest
+        def initialize(name:, image:, schedule:, rules:, env: {}, command: nil,
+                       backoff_limit: 3, ttl: 300, concurrency_policy: "Forbid", &block)
+          service_account_with_role = Kube::Cluster::Standard::ServiceAccountWithRole.new(
+            service_account: Kube::Cluster::Standard::ServiceAccount.new(name: name),
+            role: Kube::Cluster::Standard::Role.new(rules: rules),
+          )
+
+          cron_job = Kube::Cluster::Standard::CronJob.new(
+            name: name,
+            image: image,
+            schedule: schedule,
+            env: env,
+            command: command,
+            backoff_limit: backoff_limit,
+            ttl: ttl,
+            concurrency_policy: concurrency_policy,
+          ) do
+            spec.jobTemplate.spec.template.spec.serviceAccountName = name
+          end
+
+          super(*service_account_with_role.to_a, cron_job)
+
+          instance_exec(&block) if block
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "CronJobWithServiceAccount" do
+    it "emits the RBAC trio plus the cron job" do
+      m = Kube::Cluster::Standard::CronJobWithServiceAccount.new(
+        name: "builder",
+        image: "nixery.dev/shell/kubectl",
+        schedule: "*/5 * * * *",
+        rules: ["secrets" => %w[get list]],
+        command: ["true"],
+      )
+
+      m.map { |r| r.to_h[:kind] }.sort.should == %w[CronJob Role RoleBinding ServiceAccount]
+    end
+  end
+end

data/lib/kube/cluster/standard/job_with_service_account.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A one-shot Job plus the ServiceAccount/Role/RoleBinding it runs as,
+      # bundled into one Manifest. The RBAC rules use the Role shorthand; the
+      # Job's serviceAccountName is wired to the generated ServiceAccount.
+      # Everything is named after +name+.
+      #
+      #   JobWithServiceAccount.new(
+      #     name:  "glauth-config-seed",
+      #     image: "nixery.dev/shell/kubectl",
+      #     rules: [
+      #       "batch/cronjobs" => %w[get],
+      #       "batch/jobs"     => %w[create],
+      #     ],
+      #     command: BashScript(<<~'SEED'),
+      #       ...
+      #     SEED
+      #   )
+      #
+      class JobWithServiceAccount < Kube::Cluster::Manifest
+        def initialize(name:, image:, rules:, env: {}, command: nil,
+                       backoff_limit: 3, ttl: 300, &block)
+          service_account_with_role = Kube::Cluster::Standard::ServiceAccountWithRole.new(
+            service_account: Kube::Cluster::Standard::ServiceAccount.new(name: name),
+            role: Kube::Cluster::Standard::Role.new(rules: rules),
+          )
+
+          job = Kube::Cluster::Standard::Job.new(
+            name: name,
+            image: image,
+            env: env,
+            command: command,
+            backoff_limit: backoff_limit,
+            ttl: ttl,
+          ) do
+            spec.template.spec.serviceAccountName = name
+          end
+
+          super(*service_account_with_role.to_a, job)
+
+          instance_exec(&block) if block
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "JobWithServiceAccount" do
+    it "emits the RBAC trio plus the job" do
+      m = Kube::Cluster::Standard::JobWithServiceAccount.new(
+        name: "seed",
+        image: "nixery.dev/shell/kubectl",
+        rules: ["batch/jobs" => %w[create]],
+        command: ["true"],
+      )
+
+      m.map { |r| r.to_h[:kind] }.sort.should == %w[Job Role RoleBinding ServiceAccount]
+    end
+  end
+end

data/lib/kube/cluster/standard/role.rb

@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A Role with an ergonomic rules shorthand. Each rule maps a resource
+      # spec to its verbs; the spec is "resource" (core API group) or
+      # "group/resource":
+      #
+      #   Role.new(rules: [
+      #     "secrets"        => %w[get list],
+      #     "batch/cronjobs" => %w[get],
+      #   ])
+      #
+      class Role < Kube::Cluster["Role"]
+        # The original rules shorthand, so a named copy can be rebuilt from it
+        # (rebuild downgrades the class; reconstructing keeps it a Standard::Role).
+        attr_reader :rules_input
+
+        def initialize(rules:, name: nil, &block)
+          @rules_input = rules
+
+          super() do
+            metadata.name = name if name
+            self.rules = Role.build_rules(rules)
+            instance_exec(&block) if block
+          end
+        end
+
+        def name
+          to_h.dig(:metadata, :name)
+        end
+
+        def self.build_rules(rules)
+          entries = rules.is_a?(Hash) ? [rules] : Array(rules)
+
+          entries.flat_map do |entry|
+            entry.map do |spec, verbs|
+              group, resource = spec.include?("/") ? spec.split("/", 2) : ["", spec]
+              { apiGroups: [group], resources: [resource], verbs: Array(verbs) }
+            end
+          end
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "Role" do
+    it "expands the rules shorthand" do
+      yaml = Kube::Cluster::Standard::Role
+        .new(name: "r", rules: [
+          "secrets"        => %w[get list],
+          "batch/cronjobs" => %w[get],
+        ])
+        .to_yaml
+
+      yaml.include?("resources").should == true
+      yaml.include?("batch").should == true
+    end
+  end
+end

data/lib/kube/cluster/standard/role_binding.rb

@@ -0,0 +1,53 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A RoleBinding that wires a Role to a ServiceAccount. This is just the
+      # binding resource -- the Role and ServiceAccount are defined separately
+      # (and emitted together by ServiceAccountWithRole):
+      #
+      #   RoleBinding.new(role: MyRole, service_account: MyServiceAccount)
+      #
+      # The subject namespace is left blank when the ServiceAccount has none, so
+      # the SetNamespace middleware fills it with the target namespace.
+      class RoleBinding < Kube::Cluster["RoleBinding"]
+        def initialize(role:, service_account:, name: nil, &block)
+          name ||= role.name || service_account.name
+          role_name = role.name || name
+
+          subject = { kind: "ServiceAccount", name: service_account.name }
+          subject[:namespace] = service_account.namespace if service_account.namespace
+
+          super() do
+            metadata.name = name
+            self.roleRef = {
+              apiGroup: "rbac.authorization.k8s.io",
+              kind: "Role",
+              name: role_name,
+            }
+            self.subjects = [subject]
+            instance_exec(&block) if block
+          end
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "RoleBinding" do
+    it "references the role and service account" do
+      yaml = Kube::Cluster::Standard::RoleBinding.new(
+        role: Kube::Cluster::Standard::Role.new(name: "r", rules: ["secrets" => %w[get]]),
+        service_account: Kube::Cluster::Standard::ServiceAccount.new(name: "sa"),
+      ).to_yaml
+
+      yaml.include?("name: r").should == true
+      yaml.include?("name: sa").should == true
+    end
+  end
+end

data/lib/kube/cluster/standard/service_account.rb

@@ -0,0 +1,40 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      class ServiceAccount < Kube::Cluster["ServiceAccount"]
+        def initialize(name:, namespace: nil, &block)
+          super() do
+            metadata.name = name
+            metadata.namespace = namespace if namespace
+            instance_exec(&block) if block
+          end
+        end
+
+        def name
+          to_h.dig(:metadata, :name)
+        end
+
+        def namespace
+          to_h.dig(:metadata, :namespace)
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "ServiceAccount" do
+    it "initializes without error" do
+      Kube::Cluster::Standard::ServiceAccount
+        .new(name: "my-sa")
+        .to_yaml
+        .is_a?(String)
+        .should == true
+    end
+  end
+end

data/lib/kube/cluster/standard/service_account_with_role.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # Bundles a ServiceAccount, a Role, and the RoleBinding that ties them
+      # together into one Manifest. The Role and RoleBinding take the
+      # ServiceAccount's name unless a name is given explicitly:
+      #
+      #   ServiceAccountWithRole.new(
+      #     service_account: ServiceAccount.new(name: "glauth-config-builder"),
+      #     role: Role.new(rules: [
+      #       "secrets"        => %w[get list],
+      #       "batch/cronjobs" => %w[get],
+      #     ]),
+      #   )
+      #
+      class ServiceAccountWithRole < Kube::Cluster::Manifest
+        def initialize(service_account:, role:, name: nil, &block)
+          name ||= service_account.name
+
+          # Rebuild the Role with the derived name (a Standard::Role, so the
+          # binding's role.name reader works).
+          named_role = Kube::Cluster::Standard::Role.new(name: name, rules: role.rules_input)
+
+          role_binding = Kube::Cluster::Standard::RoleBinding.new(
+            role: named_role,
+            service_account: service_account,
+            name: name,
+          )
+
+          super(service_account, named_role, role_binding)
+
+          instance_exec(&block) if block
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "ServiceAccountWithRole" do
+    it "emits the service account, role, and binding" do
+      m = Kube::Cluster::Standard::ServiceAccountWithRole.new(
+        service_account: Kube::Cluster::Standard::ServiceAccount.new(name: "sa"),
+        role: Kube::Cluster::Standard::Role.new(rules: ["secrets" => %w[get list]]),
+      )
+
+      m.map { |r| r.to_h[:kind] }.sort.should == %w[Role RoleBinding ServiceAccount]
+    end
+  end
+end

data/lib/kube/cluster/version.rb

@@ -2,6 +2,6 @@
 
 module Kube
   module Cluster
-    VERSION = "0.15.0"
+    VERSION = "0.17.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kube_cluster
 version: !ruby/object:Gem::Version
-  version: 0.15.0
+  version: 0.17.0
 platform: ruby
 authors:
 - Nathan K
@@ -218,6 +218,7 @@ files:
 - lib/kube/cluster/standard/cloud_native_pg/helm.rb
 - lib/kube/cluster/standard/config_map.rb
 - lib/kube/cluster/standard/cron_job.rb
+- lib/kube/cluster/standard/cron_job_with_service_account.rb
 - lib/kube/cluster/standard/custom_resource_definition.rb
 - lib/kube/cluster/standard/daemon_set.rb
 - lib/kube/cluster/standard/deployment_with_service.rb
@@ -226,14 +227,19 @@ files:
 - lib/kube/cluster/standard/forgejo/helm.rb
 - lib/kube/cluster/standard/gateway_api/http_route.rb
 - lib/kube/cluster/standard/job.rb
+- lib/kube/cluster/standard/job_with_service_account.rb
 - lib/kube/cluster/standard/kube_virt/virtual_machine.rb
 - lib/kube/cluster/standard/meta_controller/composite_controller.rb
 - lib/kube/cluster/standard/meta_controller/decorator_controller.rb
 - lib/kube/cluster/standard/perses/perses.rb
 - lib/kube/cluster/standard/perses/perses_datasource.rb
 - lib/kube/cluster/standard/persistent_volume_claim.rb
+- lib/kube/cluster/standard/role.rb
+- lib/kube/cluster/standard/role_binding.rb
 - lib/kube/cluster/standard/secret.rb
 - lib/kube/cluster/standard/service.rb
+- lib/kube/cluster/standard/service_account.rb
+- lib/kube/cluster/standard/service_account_with_role.rb
 - lib/kube/cluster/standard/victoria_metrics/vl_agent.rb
 - lib/kube/cluster/standard/victoria_metrics/vl_single.rb
 - lib/kube/cluster/standard/victoria_metrics/vm_agent.rb