kube_cluster 0.16.0 → 0.17.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2db1b928c5cf97c3b248b5d035bf071d719cc2387c3ceab02ab999dcf45febe2
-  data.tar.gz: 85fc1a4be926b518f7e3720d58308fbf8e3915f628d5058dcbfef26799918406
+  metadata.gz: 928086733f7475611aa69193643f88719d926b70bb4aa3ed9d8a1c8f27efdec7
+  data.tar.gz: 3cc456aa515c6ca51fd87f26d35b2fcc740d984f8d907385a9f4b46bfc273a1c
 SHA512:
-  metadata.gz: f5c41a08ad784585e5fc92bdb6de5107b031e04d31d8a3d0d04e8670b44496e15244704b82a6c4c6e1027cca5fdd1c0475dc2af61df40b146b23cab611224e68
-  data.tar.gz: 68e00e0750fc326881b61cbe3a705ae7341eab8ba37b68429387e0055bc5eb26fa2bfb38f9f59d2e53ac5d0f8220e5fe2bbb5edb507c9a750e5ece721e52276f
+  metadata.gz: 9fb588b0b214cad46930473827384993fb0577d9997ae1a60a2a5e808eb23a792697d95e877d31e959661322b7adf1c2c31ecaf41cc7a910e132ad728f31bab4
+  data.tar.gz: 240eb7a87911cb284cd6fc2526608f843dadfee100f25b7b9611e6a27531d440604ae9c7b1d8586b26b5b926292c01f98ffd97e64c51659c0bad983629322e41

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    kube_cluster (0.16.0)
+    kube_cluster (0.17.1)
       activesupport (~> 8.0)
       kube_kubectl (~> 2.0)
       kube_schema (~> 1.7)

data/lib/kube/cluster/standard/cron_job_with_service_account.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A CronJob plus the ServiceAccount/Role/RoleBinding it runs as, bundled
+      # into one Manifest. The RBAC rules use the Role shorthand; the CronJob's
+      # serviceAccountName is wired to the generated ServiceAccount. Everything
+      # is named after +name+.
+      #
+      #   CronJobWithServiceAccount.new(
+      #     name:     "glauth-config-builder",
+      #     image:    "nixery.dev/shell/ruby/kubectl/cacert",
+      #     schedule: "*/5 * * * *",
+      #     rules: [
+      #       "secrets"        => %w[get list],
+      #       "batch/jobs"     => %w[create],
+      #     ],
+      #     command: RubyScript(<<~'BUILD'),
+      #       ...
+      #     BUILD
+      #   )
+      #
+      class CronJobWithServiceAccount < Kube::Cluster::Manifest
+        def initialize(name:, image:, schedule:, rules:, env: {}, command: nil,
+                       backoff_limit: 3, ttl: 300, concurrency_policy: "Forbid", &block)
+          service_account_with_role = Kube::Cluster::Standard::ServiceAccountWithRole.new(
+            service_account: Kube::Cluster::Standard::ServiceAccount.new(name: name),
+            role: Kube::Cluster::Standard::Role.new(rules: rules),
+          )
+
+          cron_job = Kube::Cluster::Standard::CronJob.new(
+            name: name,
+            image: image,
+            schedule: schedule,
+            env: env,
+            command: command,
+            backoff_limit: backoff_limit,
+            ttl: ttl,
+            concurrency_policy: concurrency_policy,
+          ) do
+            spec.jobTemplate.spec.template.spec.serviceAccountName = name
+          end
+
+          super(*service_account_with_role.to_a, cron_job)
+
+          instance_exec(&block) if block
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "CronJobWithServiceAccount" do
+    it "emits the RBAC trio plus the cron job" do
+      m = Kube::Cluster::Standard::CronJobWithServiceAccount.new(
+        name: "builder",
+        image: "nixery.dev/shell/kubectl",
+        schedule: "*/5 * * * *",
+        rules: ["secrets" => %w[get list]],
+        command: ["true"],
+      )
+
+      m.map { |r| r.to_h[:kind] }.sort.should == %w[CronJob Role RoleBinding ServiceAccount]
+    end
+  end
+end

data/lib/kube/cluster/standard/deployment_with_service.rb

@@ -73,7 +73,7 @@ module Kube
 
           instance_exec(&block) if block
 
-          _apply_limits(deployment)
+          deployment = _apply_limits(deployment)
           _apply_probes(deployment)
         end
 
@@ -88,7 +88,7 @@ module Kube
         private
 
         def _apply_limits(deployment)
-          return if @_limits.empty?
+          return deployment if @_limits.empty?
 
           container = deployment.to_h[:spec][:template][:spec][:containers][0]
           resources = {}
@@ -108,12 +108,12 @@ module Kube
           container[:resources] = resources
           h = deployment.to_h
           h[:spec][:template][:spec][:containers][0] = container
-          deployment.rebuild(h)
+          _replace(deployment, deployment.rebuild(h))
         end
 
         def _apply_probes(deployment)
-          return if @_probes.empty?
-          return unless @_probes[:url]
+          return deployment if @_probes.empty?
+          return deployment unless @_probes[:url]
 
           container = deployment.to_h[:spec][:template][:spec][:containers][0]
           url = @_probes[:url]
@@ -140,7 +140,14 @@ module Kube
 
           h = deployment.to_h
           h[:spec][:template][:spec][:containers][0] = container
-          deployment.rebuild(h)
+          _replace(deployment, deployment.rebuild(h))
+        end
+
+        # rebuild returns a new resource; swap it into this manifest so the
+        # change actually lands in the rendered output.
+        def _replace(old, rebuilt)
+          @resources[@resources.index(old)] = rebuilt
+          rebuilt
         end
       end
     end
@@ -175,5 +182,63 @@ test do
       yaml.include?("stdin: true").should == true
       yaml.include?("tty: true").should == true
     end
+
+    it "renders limits from the block DSL" do
+      yaml = Kube::Cluster::Standard::DeploymentWithService
+        .new(
+          name: "limited",
+          image: "ruby/ruby",
+          port: 3000,
+        ) {
+          limits.cpu    = { "500m" => Float::INFINITY }
+          limits.memory = { "1Gi" => "2Gi" }
+        }
+        .to_yaml
+
+      yaml.include?("cpu: 500m").should == true
+      yaml.include?("memory: 1Gi").should == true
+      yaml.include?("memory: 2Gi").should == true
+      # Infinity means request-only — no cpu limit is emitted.
+      yaml.scan(/cpu:/).length.should == 1
+    end
+
+    it "renders probes from the block DSL" do
+      yaml = Kube::Cluster::Standard::DeploymentWithService
+        .new(
+          name: "probed",
+          image: "ruby/ruby",
+          port: 3000,
+        ) {
+          probes.url       = { path: "/healthz", port: "http" }
+          probes.liveness  = { 120 => 30 }
+          probes.readiness = { 60 => 10 }
+        }
+        .to_yaml
+
+      yaml.include?("livenessProbe").should == true
+      yaml.include?("readinessProbe").should == true
+      yaml.include?("path: \"/healthz\"").should == true
+      yaml.include?("initialDelaySeconds: 120").should == true
+      yaml.include?("initialDelaySeconds: 60").should == true
+    end
+
+    it "renders limits and probes together" do
+      yaml = Kube::Cluster::Standard::DeploymentWithService
+        .new(
+          name: "both",
+          image: "ruby/ruby",
+          port: 3000,
+        ) {
+          limits.memory    = { "1Gi" => "2Gi" }
+          probes.url       = { path: "/healthz", port: "http" }
+          probes.readiness = { 5 => 5 }
+        }
+        .to_yaml
+
+      # The probe pass must not clobber the limits pass (each rebuilds the
+      # deployment; the second must start from the first's result).
+      yaml.include?("memory: 2Gi").should == true
+      yaml.include?("readinessProbe").should == true
+    end
   end
 end

data/lib/kube/cluster/standard/job_with_service_account.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A one-shot Job plus the ServiceAccount/Role/RoleBinding it runs as,
+      # bundled into one Manifest. The RBAC rules use the Role shorthand; the
+      # Job's serviceAccountName is wired to the generated ServiceAccount.
+      # Everything is named after +name+.
+      #
+      #   JobWithServiceAccount.new(
+      #     name:  "glauth-config-seed",
+      #     image: "nixery.dev/shell/kubectl",
+      #     rules: [
+      #       "batch/cronjobs" => %w[get],
+      #       "batch/jobs"     => %w[create],
+      #     ],
+      #     command: BashScript(<<~'SEED'),
+      #       ...
+      #     SEED
+      #   )
+      #
+      class JobWithServiceAccount < Kube::Cluster::Manifest
+        def initialize(name:, image:, rules:, env: {}, command: nil,
+                       backoff_limit: 3, ttl: 300, &block)
+          service_account_with_role = Kube::Cluster::Standard::ServiceAccountWithRole.new(
+            service_account: Kube::Cluster::Standard::ServiceAccount.new(name: name),
+            role: Kube::Cluster::Standard::Role.new(rules: rules),
+          )
+
+          job = Kube::Cluster::Standard::Job.new(
+            name: name,
+            image: image,
+            env: env,
+            command: command,
+            backoff_limit: backoff_limit,
+            ttl: ttl,
+          ) do
+            spec.template.spec.serviceAccountName = name
+          end
+
+          super(*service_account_with_role.to_a, job)
+
+          instance_exec(&block) if block
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "JobWithServiceAccount" do
+    it "emits the RBAC trio plus the job" do
+      m = Kube::Cluster::Standard::JobWithServiceAccount.new(
+        name: "seed",
+        image: "nixery.dev/shell/kubectl",
+        rules: ["batch/jobs" => %w[create]],
+        command: ["true"],
+      )
+
+      m.map { |r| r.to_h[:kind] }.sort.should == %w[Job Role RoleBinding ServiceAccount]
+    end
+  end
+end

data/lib/kube/cluster/standard/role.rb

@@ -16,12 +16,16 @@ module Kube
       #   ])
       #
       class Role < Kube::Cluster["Role"]
+        # The original rules shorthand, so a named copy can be rebuilt from it
+        # (rebuild downgrades the class; reconstructing keeps it a Standard::Role).
+        attr_reader :rules_input
+
         def initialize(rules:, name: nil, &block)
-          built = self.class.build_rules(rules)
+          @rules_input = rules
 
           super() do
             metadata.name = name if name
-            self.rules = built
+            self.rules = Role.build_rules(rules)
             instance_exec(&block) if block
           end
         end
@@ -30,10 +34,6 @@ module Kube
           to_h.dig(:metadata, :name)
         end
 
-        def name=(value)
-          metadata.name = value
-        end
-
         def self.build_rules(rules)
           entries = rules.is_a?(Hash) ? [rules] : Array(rules)
 

data/lib/kube/cluster/standard/service_account_with_role.rb

@@ -21,15 +21,18 @@ module Kube
       class ServiceAccountWithRole < Kube::Cluster::Manifest
         def initialize(service_account:, role:, name: nil, &block)
           name ||= service_account.name
-          role.name = name
+
+          # Rebuild the Role with the derived name (a Standard::Role, so the
+          # binding's role.name reader works).
+          named_role = Kube::Cluster::Standard::Role.new(name: name, rules: role.rules_input)
 
           role_binding = Kube::Cluster::Standard::RoleBinding.new(
-            role: role,
+            role: named_role,
             service_account: service_account,
             name: name,
           )
 
-          super(service_account, role, role_binding)
+          super(service_account, named_role, role_binding)
 
           instance_exec(&block) if block
         end

data/lib/kube/cluster/version.rb

@@ -2,6 +2,6 @@
 
 module Kube
   module Cluster
-    VERSION = "0.16.0"
+    VERSION = "0.17.1"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kube_cluster
 version: !ruby/object:Gem::Version
-  version: 0.16.0
+  version: 0.17.1
 platform: ruby
 authors:
 - Nathan K
@@ -218,6 +218,7 @@ files:
 - lib/kube/cluster/standard/cloud_native_pg/helm.rb
 - lib/kube/cluster/standard/config_map.rb
 - lib/kube/cluster/standard/cron_job.rb
+- lib/kube/cluster/standard/cron_job_with_service_account.rb
 - lib/kube/cluster/standard/custom_resource_definition.rb
 - lib/kube/cluster/standard/daemon_set.rb
 - lib/kube/cluster/standard/deployment_with_service.rb
@@ -226,6 +227,7 @@ files:
 - lib/kube/cluster/standard/forgejo/helm.rb
 - lib/kube/cluster/standard/gateway_api/http_route.rb
 - lib/kube/cluster/standard/job.rb
+- lib/kube/cluster/standard/job_with_service_account.rb
 - lib/kube/cluster/standard/kube_virt/virtual_machine.rb
 - lib/kube/cluster/standard/meta_controller/composite_controller.rb
 - lib/kube/cluster/standard/meta_controller/decorator_controller.rb