kube_cluster 0.2.0 → 0.2.1

data/lib/kube/cluster/manifest/middleware/ingress_for_service.rb

@@ -0,0 +1,89 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Manifest < Kube::Schema::Manifest
+      class Middleware
+        # Generates an Ingress for every Service whose source resource
+        # carries the +app.kubernetes.io/expose+ label.
+        #
+        # The label value is the hostname:
+        #
+        #   metadata.labels = { "app.kubernetes.io/expose": "app.example.com" }
+        #
+        # Set to +"true"+ to use the resource name as a hostname placeholder
+        # (useful when a later middleware or the manifest class resolves it).
+        #
+        # Options:
+        #   issuer:          — cert-manager ClusterIssuer name (default: "letsencrypt-prod")
+        #   ingress_class:   — IngressClassName (default: "nginx")
+        #
+        #   stack do
+        #     use Middleware::IngressForService
+        #     use Middleware::IngressForService, issuer: "letsencrypt-staging"
+        #   end
+        #
+        class IngressForService < Middleware
+          LABEL = :"app.kubernetes.io/expose"
+
+          def initialize(issuer: "letsencrypt-prod", ingress_class: "nginx")
+            @issuer = issuer
+            @ingress_class = ingress_class
+          end
+
+          def call(resource)
+            return resource unless kind(resource) == "Service"
+
+            host = label(resource, LABEL)
+            return resource unless host
+
+            h = resource.to_h
+            name      = h.dig(:metadata, :name)
+            namespace = h.dig(:metadata, :namespace)
+            labels    = h.dig(:metadata, :labels) || {}
+
+            # Find the first port on the service
+            port_name = Array(h.dig(:spec, :ports)).first&.dig(:name) || "http"
+
+            # Use resource name as hostname fallback if label is just "true"
+            host = "#{name}.local" if host == "true"
+
+            # Capture ivars as locals — the block runs via instance_exec
+            # on a BlackHoleStruct, so @ivars would resolve on the BHS.
+            issuer        = @issuer
+            ingress_class = @ingress_class
+
+            ingress = Kube::Schema["Ingress"].new {
+              metadata.name      = name
+              metadata.namespace = namespace if namespace
+              metadata.labels    = labels.reject { |k, _| k == LABEL }
+              metadata.annotations = {
+                "cert-manager.io/cluster-issuer":           issuer,
+                "nginx.ingress.kubernetes.io/ssl-redirect": "true",
+              }
+
+              spec.ingressClassName = ingress_class
+              spec.tls = [
+                { hosts: [host], secretName: "#{name}-tls" },
+              ]
+              spec.rules = [
+                {
+                  host: host,
+                  http: {
+                    paths: [{
+                      path:     "/",
+                      pathType: "Prefix",
+                      backend:  { service: { name: name, port: { name: port_name } } },
+                    }],
+                  },
+                },
+              ]
+            }
+
+            [resource, ingress]
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/manifest/middleware/labels.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Manifest < Kube::Schema::Manifest
+      class Middleware
+        # Merges labels into +metadata.labels+ on every resource.
+        # Existing labels are preserved; the supplied labels act as defaults
+        # that can be overridden per-resource.
+        #
+        #   stack do
+        #     use Middleware::Labels, app: "web-app", managed_by: "kube_cluster"
+        #   end
+        #
+        # The keyword arguments are converted to standard label keys:
+        #
+        #   app:        -> "app.kubernetes.io/name"
+        #   instance:   -> "app.kubernetes.io/instance"
+        #   version:    -> "app.kubernetes.io/version"
+        #   component:  -> "app.kubernetes.io/component"
+        #   part_of:    -> "app.kubernetes.io/part-of"
+        #   managed_by: -> "app.kubernetes.io/managed-by"
+        #
+        # Any unrecognized keys are passed through as-is (string or symbol).
+        #
+        class Labels < Middleware
+          STANDARD_KEYS = {
+            app:        :"app.kubernetes.io/name",
+            instance:   :"app.kubernetes.io/instance",
+            version:    :"app.kubernetes.io/version",
+            component:  :"app.kubernetes.io/component",
+            part_of:    :"app.kubernetes.io/part-of",
+            managed_by: :"app.kubernetes.io/managed-by",
+          }.freeze
+
+          def initialize(**labels)
+            @labels = normalize(labels)
+          end
+
+          def call(resource)
+            h = resource.to_h
+            h[:metadata] ||= {}
+            h[:metadata][:labels] = @labels.merge(h[:metadata][:labels] || {})
+            rebuild(resource, h)
+          end
+
+          private
+
+            def normalize(labels)
+              labels.each_with_object({}) do |(key, value), result|
+                normalized_key = STANDARD_KEYS.fetch(key, key)
+                result[normalized_key] = value.to_s
+              end
+            end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/manifest/middleware/namespace.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Manifest < Kube::Schema::Manifest
+      class Middleware
+        # Sets +metadata.namespace+ on all namespace-scoped resources.
+        # Cluster-scoped kinds (Namespace, ClusterRole, etc.) are skipped.
+        #
+        #   stack do
+        #     use Middleware::Namespace, "production"
+        #   end
+        #
+        class Namespace < Middleware
+          def initialize(namespace)
+            @namespace = namespace
+          end
+
+          def call(resource)
+            return resource if cluster_scoped?(resource)
+
+            h = resource.to_h
+            h[:metadata] ||= {}
+            h[:metadata][:namespace] = @namespace
+            rebuild(resource, h)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/manifest/middleware/pod_anti_affinity.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Manifest < Kube::Schema::Manifest
+      class Middleware
+        # Injects soft pod anti-affinity on pod-bearing resources so
+        # that pods prefer to spread across nodes.
+        #
+        # The anti-affinity uses the resource's own +matchLabels+ from
+        # +spec.selector.matchLabels+ as the label selector, and
+        # +kubernetes.io/hostname+ as the topology key.
+        #
+        # Resources that already have +spec.template.spec.affinity+
+        # set are left untouched.
+        #
+        #   stack do
+        #     use Middleware::PodAntiAffinity
+        #     use Middleware::PodAntiAffinity, topology_key: "topology.kubernetes.io/zone"
+        #   end
+        #
+        class PodAntiAffinity < Middleware
+          def initialize(topology_key: "kubernetes.io/hostname", weight: 1)
+            @topology_key = topology_key
+            @weight = weight
+          end
+
+          def call(resource)
+            return resource unless pod_bearing?(resource)
+
+            h = resource.to_h
+            pod_spec = pod_template(h)
+            return resource unless pod_spec
+
+            # Don't overwrite existing affinity configuration.
+            return resource if pod_spec[:affinity]
+
+            match_labels = h.dig(:spec, :selector, :matchLabels)
+            return resource unless match_labels && !match_labels.empty?
+
+            pod_spec[:affinity] = {
+              podAntiAffinity: {
+                preferredDuringSchedulingIgnoredDuringExecution: [
+                  {
+                    weight: @weight,
+                    podAffinityTerm: {
+                      labelSelector: { matchLabels: match_labels },
+                      topologyKey: @topology_key,
+                    },
+                  },
+                ],
+              },
+            }
+
+            rebuild(resource, h)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/manifest/middleware/resource_preset.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Manifest < Kube::Schema::Manifest
+      class Middleware
+        # Reads the +app.kubernetes.io/size+ label from pod-bearing
+        # resources and injects CPU/memory requests and limits into
+        # every container.
+        #
+        # The label on the resource is the input:
+        #
+        #   Kube::Schema["Deployment"].new {
+        #     metadata.labels = { "app.kubernetes.io/size": "small" }
+        #     ...
+        #   }
+        #
+        # Register in the stack — no arguments needed:
+        #
+        #   stack do
+        #     use Middleware::ResourcePreset
+        #   end
+        #
+        # Available sizes: nano, micro, small, medium, large, xlarge, 2xlarge.
+        # Limits are ~1.5x requests (following Bitnami conventions).
+        #
+        class ResourcePreset < Middleware
+          LABEL = :"app.kubernetes.io/size"
+
+          PRESETS = {
+            "nano"    => { requests: { cpu: "100m",  memory: "128Mi"  }, limits: { cpu: "150m",  memory: "192Mi"  } },
+            "micro"   => { requests: { cpu: "250m",  memory: "256Mi"  }, limits: { cpu: "375m",  memory: "384Mi"  } },
+            "small"   => { requests: { cpu: "500m",  memory: "512Mi"  }, limits: { cpu: "750m",  memory: "768Mi"  } },
+            "medium"  => { requests: { cpu: "500m",  memory: "1024Mi" }, limits: { cpu: "750m",  memory: "1536Mi" } },
+            "large"   => { requests: { cpu: "1",     memory: "2048Mi" }, limits: { cpu: "1.5",   memory: "3072Mi" } },
+            "xlarge"  => { requests: { cpu: "1",     memory: "3072Mi" }, limits: { cpu: "3",     memory: "6144Mi" } },
+            "2xlarge" => { requests: { cpu: "1",     memory: "3072Mi" }, limits: { cpu: "6",     memory: "12288Mi" } },
+          }.freeze
+
+          def call(resource)
+            size = label(resource, LABEL)
+            return resource unless size
+            return resource unless pod_bearing?(resource)
+
+            preset = PRESETS.fetch(size.to_s) do
+              raise ArgumentError, "Unknown size preset: #{size.inspect}. " \
+                "Valid sizes: #{PRESETS.keys.join(', ')}"
+            end
+
+            h = resource.to_h
+            pod_spec = pod_template(h)
+            return resource unless pod_spec
+
+            each_container(pod_spec) do |container|
+              container[:resources] = deep_merge(preset, container[:resources] || {})
+            end
+
+            rebuild(resource, h)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/manifest/middleware/security_context.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Manifest < Kube::Schema::Manifest
+      class Middleware
+        # Injects pod and container security contexts on pod-bearing resources.
+        #
+        # Reads the +app.kubernetes.io/security+ label. When the label
+        # is absent, the middleware applies the default profile.
+        #
+        #   Kube::Schema["Deployment"].new {
+        #     metadata.labels = { "app.kubernetes.io/security": "restricted" }
+        #     ...
+        #   }
+        #
+        # Available profiles: +restricted+ (default), +baseline+.
+        #
+        #   stack do
+        #     use Middleware::SecurityContext                      # default: restricted
+        #     use Middleware::SecurityContext, default: :baseline  # change default
+        #   end
+        #
+        class SecurityContext < Middleware
+          LABEL = :"app.kubernetes.io/security"
+
+          PROFILES = {
+            "restricted" => {
+              pod: {
+                runAsNonRoot: true,
+                runAsUser:    1000,
+                runAsGroup:   1000,
+                fsGroup:      1000,
+                seccompProfile: { type: "RuntimeDefault" },
+              },
+              container: {
+                allowPrivilegeEscalation: false,
+                readOnlyRootFilesystem:   true,
+                capabilities:             { drop: ["ALL"] },
+              },
+            },
+            "baseline" => {
+              pod: {
+                runAsNonRoot: true,
+                runAsUser:    1000,
+                runAsGroup:   1000,
+                fsGroup:      1000,
+              },
+              container: {
+                allowPrivilegeEscalation: false,
+              },
+            },
+          }.freeze
+
+          def initialize(default: :restricted)
+            @default = default.to_s
+          end
+
+          def call(resource)
+            return resource unless pod_bearing?(resource)
+
+            profile_name = label(resource, LABEL) || @default
+            profile = PROFILES.fetch(profile_name.to_s) do
+              raise ArgumentError, "Unknown security profile: #{profile_name.inspect}. " \
+                "Valid profiles: #{PROFILES.keys.join(', ')}"
+            end
+
+            h = resource.to_h
+            pod_spec = pod_template(h)
+            return resource unless pod_spec
+
+            pod_spec[:securityContext] = deep_merge(profile[:pod], pod_spec[:securityContext] || {})
+
+            each_container(pod_spec) do |container|
+              container[:securityContext] = deep_merge(profile[:container], container[:securityContext] || {})
+            end
+
+            rebuild(resource, h)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/manifest/middleware/service_for_deployment.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Manifest < Kube::Schema::Manifest
+      class Middleware
+        # Generates a Service for every pod-bearing resource that has
+        # containers with named ports.
+        #
+        # The generated Service uses +spec.selector.matchLabels+ from
+        # the source resource and maps each named container port.
+        #
+        # Labels and namespace are copied from the source resource, so
+        # subsequent middleware (Labels, Namespace, etc.) will also
+        # apply to the generated Service.
+        #
+        #   stack do
+        #     use Middleware::ServiceForDeployment
+        #   end
+        #
+        class ServiceForDeployment < Middleware
+          def call(resource)
+            return resource unless pod_bearing?(resource)
+
+            h = resource.to_h
+            ports = extract_ports(h)
+            return resource if ports.empty?
+
+            match_labels = h.dig(:spec, :selector, :matchLabels)
+            return resource unless match_labels && !match_labels.empty?
+
+            service = Kube::Schema["Service"].new {
+              metadata.name      = h.dig(:metadata, :name)
+              metadata.namespace = h.dig(:metadata, :namespace) if h.dig(:metadata, :namespace)
+              metadata.labels    = h.dig(:metadata, :labels) || {}
+
+              spec.selector = match_labels
+              spec.ports = ports.map { |p|
+                {
+                  name:       p[:name],
+                  port:       p[:containerPort],
+                  targetPort: p[:name],
+                  protocol:   p.fetch(:protocol, "TCP"),
+                }
+              }
+            }
+
+            [resource, service]
+          end
+
+          private
+
+            def extract_ports(hash)
+              pod_spec = pod_template(hash)
+              return [] unless pod_spec
+
+              ports = []
+              each_container(pod_spec) do |container|
+                Array(container[:ports]).each do |port|
+                  ports << port if port[:name]
+                end
+              end
+              ports
+            end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/manifest/middleware.rb

@@ -0,0 +1,178 @@
+# frozen_string_literal: true
+
+# Patch BlackHoleStruct to handle arrays consistently.
+#
+# The upstream gem does not recurse into arrays — hashes inside arrays
+# are not converted to BlackHoleStruct on construction, and are not
+# converted back to plain Hash on #to_h.  This causes key-type
+# inconsistencies after a Resource round-trip (symbol keys become
+# string keys inside arrays).
+#
+# These two patches fix both directions:
+#   initialize — converts hashes inside arrays to BlackHoleStruct
+#   to_h       — converts BlackHoleStruct/arrays back to plain objects
+class BlackHoleStruct
+  def initialize(hash = {})
+    raise ArgumentError, "Argument should be a Hash" unless hash.is_a?(Hash)
+
+    @table = {}
+    hash.each do |key, value|
+      @table[key.to_sym] = deep_wrap(value)
+    end
+  end
+
+  def to_h
+    hash = {}
+    @table.each do |key, value|
+      hash[key] = deep_unwrap(value)
+    end
+    hash
+  end
+
+  private
+
+  def deep_wrap(value)
+    case value
+    when Hash  then self.class.new(value)
+    when Array then value.map { |v| deep_wrap(v) }
+    else       value
+    end
+  end
+
+  def deep_unwrap(value)
+    case value
+    when self.class then value.to_h
+    when Array      then value.map { |v| deep_unwrap(v) }
+    else            value
+    end
+  end
+end
+
+module Kube
+  module Cluster
+    class Manifest < Kube::Schema::Manifest
+      # Base class for manifest middleware.
+      #
+      # Middleware receives a single resource and returns either:
+      #   - A single resource (transform)
+      #   - An array of resources (generative — e.g. Deployment in, [Deployment, Service] out)
+      #
+      # The stack processes the full manifest at each stage, so resources
+      # generated by one middleware flow through all subsequent stages.
+      #
+      # Transform example:
+      #
+      #   class AddTeamLabel < Middleware
+      #     def call(resource)
+      #       h = resource.to_h
+      #       h[:metadata][:labels][:"app.kubernetes.io/team"] = "platform"
+      #       rebuild(resource, h)
+      #     end
+      #   end
+      #
+      # Generative example:
+      #
+      #   class ServiceForDeployment < Middleware
+      #     def call(resource)
+      #       return resource unless pod_bearing?(resource)
+      #       service = build_service_from(resource)
+      #       [resource, service]
+      #     end
+      #   end
+      #
+      class Middleware
+        POD_BEARING_KINDS = %w[Deployment StatefulSet DaemonSet Job CronJob ReplicaSet].freeze
+
+        CLUSTER_SCOPED_KINDS = %w[
+          Namespace ClusterRole ClusterRoleBinding
+          PersistentVolume StorageClass IngressClass
+          CustomResourceDefinition PriorityClass
+          RuntimeClass VolumeAttachment
+          CSIDriver CSINode
+        ].freeze
+
+        def initialize(**opts)
+          @opts = opts
+        end
+
+        # Override in subclasses. Receives a single Resource, returns
+        # a single Resource (transform) or an array of Resources
+        # (generative).
+        def call(resource)
+          resource
+        end
+
+        private
+
+          # Build a new resource of the same schema subclass from a hash.
+          def rebuild(resource, hash)
+            resource.class.new(hash)
+          end
+
+          # Read a label value from the resource.
+          def label(resource, key)
+            labels = resource.to_h.dig(:metadata, :labels) || {}
+            labels[key.to_sym] || labels[key.to_s]
+          end
+
+          # Read an annotation value from the resource.
+          def annotation(resource, key)
+            annotations = resource.to_h.dig(:metadata, :annotations) || {}
+            annotations[key.to_sym] || annotations[key.to_s]
+          end
+
+          # The resource kind as a String (e.g. "Deployment").
+          def kind(resource)
+            h = resource.to_h
+            (h[:kind] || h["kind"]).to_s
+          end
+
+          # Is this a resource that contains a pod template?
+          def pod_bearing?(resource)
+            POD_BEARING_KINDS.include?(kind(resource))
+          end
+
+          # Is this a cluster-scoped resource (no namespace)?
+          def cluster_scoped?(resource)
+            CLUSTER_SCOPED_KINDS.include?(kind(resource))
+          end
+
+          # Returns the pod template spec path from a resource hash,
+          # accounting for CronJob's extra nesting.
+          def pod_template(hash)
+            if kind_from_hash(hash) == "CronJob"
+              hash.dig(:spec, :jobTemplate, :spec, :template, :spec)
+            else
+              hash.dig(:spec, :template, :spec)
+            end
+          end
+
+          # Walk every container list in a pod spec (containers,
+          # initContainers) and yield each container hash.
+          def each_container(pod_spec, &block)
+            return unless pod_spec
+
+            [:containers, :initContainers].each do |key|
+              Array(pod_spec[key]).each(&block)
+            end
+          end
+
+          # Extract kind from a hash (symbol or string keys).
+          def kind_from_hash(hash)
+            (hash[:kind] || hash["kind"]).to_s
+          end
+
+          # Deep-merge two hashes (right wins on conflict).
+          def deep_merge(base, overlay)
+            base.merge(overlay) do |_key, old_val, new_val|
+              if old_val.is_a?(Hash) && new_val.is_a?(Hash)
+                deep_merge(old_val, new_val)
+              else
+                new_val
+              end
+            end
+          end
+      end
+    end
+  end
+end

data/lib/kube/cluster/manifest/stack.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Manifest < Kube::Schema::Manifest
+      # An ordered pipeline of middleware that processes the full manifest
+      # at each stage. Each stage flat_maps individual resources through
+      # a single middleware — so generative middleware can introduce new
+      # resources that subsequent stages will see and process.
+      #
+      #   stack = Kube::Cluster::Manifest::Stack.new do
+      #     use Middleware::ServiceForDeployment   # generates Services
+      #     use Middleware::Labels, app: "web"      # labels everything, including generated Services
+      #     use Middleware::ResourcePreset          # sizes everything
+      #   end
+      #
+      #   processed = stack.call(resources)
+      #
+      class Stack
+        def initialize(&block)
+          @middleware = []
+          instance_eval(&block) if block
+        end
+
+        # Register a middleware class with optional positional and keyword arguments.
+        #
+        # @param klass [Class] a Middleware subclass
+        # @param args  [Array] positional arguments forwarded to klass.new
+        # @param kwargs [Hash] keyword arguments forwarded to klass.new
+        def use(klass, *args, **kwargs)
+          @middleware << [klass, args, kwargs]
+        end
+
+        # Run the full resource array through every middleware stage in order.
+        # At each stage, every resource is passed individually through the
+        # middleware. Middleware can return a single resource (transform) or
+        # an array of resources (generative). The results are collected into
+        # the array for the next stage.
+        #
+        # @param resources [Array<Kube::Schema::Resource>]
+        # @return [Array<Kube::Schema::Resource>]
+        def call(resources)
+          @middleware.reduce(resources) do |current, (klass, args, kwargs)|
+            middleware = klass.new(*args, **kwargs)
+            current.flat_map { |r| Array(middleware.call(r)) }
+          end
+        end
+
+        # True when no middleware has been registered.
+        def empty?
+          @middleware.empty?
+        end
+      end
+    end
+  end
+end