kube_cluster 0.2.1 → 0.3.0

data/lib/kube/cluster/middleware/labels.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Middleware
+      # Merges labels into +metadata.labels+ on every resource.
+      # Existing labels are preserved; the supplied labels act as defaults
+      # that can be overridden per-resource.
+      #
+      #   stack do
+      #     use Middleware::Labels, app: "web-app", managed_by: "kube_cluster"
+      #   end
+      #
+      # The keyword arguments are converted to standard label keys:
+      #
+      #   app:        -> "app.kubernetes.io/name"
+      #   instance:   -> "app.kubernetes.io/instance"
+      #   version:    -> "app.kubernetes.io/version"
+      #   component:  -> "app.kubernetes.io/component"
+      #   part_of:    -> "app.kubernetes.io/part-of"
+      #   managed_by: -> "app.kubernetes.io/managed-by"
+      #
+      # Any unrecognized keys are passed through as-is (string or symbol).
+      #
+      class Labels < Middleware
+        STANDARD_KEYS = {
+          app:        :"app.kubernetes.io/name",
+          instance:   :"app.kubernetes.io/instance",
+          version:    :"app.kubernetes.io/version",
+          component:  :"app.kubernetes.io/component",
+          part_of:    :"app.kubernetes.io/part-of",
+          managed_by: :"app.kubernetes.io/managed-by",
+        }.freeze
+
+        def initialize(**labels)
+          @labels = normalize(labels)
+        end
+
+        def call(manifest)
+          manifest.resources.map! do |resource|
+            h = resource.to_h
+            h[:metadata] ||= {}
+            h[:metadata][:labels] = @labels.merge(h[:metadata][:labels] || {})
+            resource.rebuild(h)
+          end
+        end
+
+        private
+
+          def normalize(labels)
+            labels.each_with_object({}) do |(key, value), result|
+              normalized_key = STANDARD_KEYS.fetch(key, key)
+              result[normalized_key] = value.to_s
+            end
+          end
+      end
+    end
+  end
+end

data/lib/kube/cluster/middleware/namespace.rb

@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Middleware
+      # Sets +metadata.namespace+ on all namespace-scoped resources.
+      # Cluster-scoped kinds (Namespace, ClusterRole, etc.) are skipped.
+      #
+      #   stack do
+      #     use Middleware::Namespace, "production"
+      #   end
+      #
+      class Namespace < Middleware
+        def initialize(namespace)
+          @namespace = namespace
+        end
+
+        def call(manifest)
+          manifest.resources.map! do |resource|
+            next resource if resource.cluster_scoped?
+
+            h = resource.to_h
+            h[:metadata] ||= {}
+            h[:metadata][:namespace] = @namespace
+            resource.rebuild(h)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/middleware/pod_anti_affinity.rb

@@ -0,0 +1,61 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Middleware
+      # Injects soft pod anti-affinity on pod-bearing resources so
+      # that pods prefer to spread across nodes.
+      #
+      # The anti-affinity uses the resource's own +matchLabels+ from
+      # +spec.selector.matchLabels+ as the label selector, and
+      # +kubernetes.io/hostname+ as the topology key.
+      #
+      # Resources that already have +spec.template.spec.affinity+
+      # set are left untouched.
+      #
+      #   stack do
+      #     use Middleware::PodAntiAffinity
+      #     use Middleware::PodAntiAffinity, topology_key: "topology.kubernetes.io/zone"
+      #   end
+      #
+      class PodAntiAffinity < Middleware
+        def initialize(topology_key: "kubernetes.io/hostname", weight: 1)
+          @topology_key = topology_key
+          @weight = weight
+        end
+
+        def call(manifest)
+          manifest.resources.map! do |resource|
+            next resource unless resource.pod_bearing?
+
+            h = resource.to_h
+            pod_spec = resource.pod_template(h)
+            next resource unless pod_spec
+
+            # Don't overwrite existing affinity configuration.
+            next resource if pod_spec[:affinity]
+
+            match_labels = h.dig(:spec, :selector, :matchLabels)
+            next resource unless match_labels && !match_labels.empty?
+
+            pod_spec[:affinity] = {
+              podAntiAffinity: {
+                preferredDuringSchedulingIgnoredDuringExecution: [
+                  {
+                    weight: @weight,
+                    podAffinityTerm: {
+                      labelSelector: { matchLabels: match_labels },
+                      topologyKey: @topology_key,
+                    },
+                  },
+                ],
+              },
+            }
+
+            resource.rebuild(h)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/middleware/resource_preset.rb

@@ -0,0 +1,64 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Middleware
+      # Reads the +app.kubernetes.io/size+ label from pod-bearing
+      # resources and injects CPU/memory requests and limits into
+      # every container.
+      #
+      # The label on the resource is the input:
+      #
+      #   Kube::Cluster["Deployment"].new {
+      #     metadata.labels = { "app.kubernetes.io/size": "small" }
+      #     ...
+      #   }
+      #
+      # Register in the stack — no arguments needed:
+      #
+      #   stack do
+      #     use Middleware::ResourcePreset
+      #   end
+      #
+      # Available sizes: nano, micro, small, medium, large, xlarge, 2xlarge.
+      # Limits are ~1.5x requests (following Bitnami conventions).
+      #
+      class ResourcePreset < Middleware
+        LABEL = :"app.kubernetes.io/size"
+
+        PRESETS = {
+          "nano"    => { requests: { cpu: "100m",  memory: "128Mi"  }, limits: { cpu: "150m",  memory: "192Mi"  } },
+          "micro"   => { requests: { cpu: "250m",  memory: "256Mi"  }, limits: { cpu: "375m",  memory: "384Mi"  } },
+          "small"   => { requests: { cpu: "500m",  memory: "512Mi"  }, limits: { cpu: "750m",  memory: "768Mi"  } },
+          "medium"  => { requests: { cpu: "500m",  memory: "1024Mi" }, limits: { cpu: "750m",  memory: "1536Mi" } },
+          "large"   => { requests: { cpu: "1",     memory: "2048Mi" }, limits: { cpu: "1.5",   memory: "3072Mi" } },
+          "xlarge"  => { requests: { cpu: "1",     memory: "3072Mi" }, limits: { cpu: "3",     memory: "6144Mi" } },
+          "2xlarge" => { requests: { cpu: "1",     memory: "3072Mi" }, limits: { cpu: "6",     memory: "12288Mi" } },
+        }.freeze
+
+        def call(manifest)
+          manifest.resources.map! do |resource|
+            size = resource.label(LABEL)
+            next resource unless size
+            next resource unless resource.pod_bearing?
+
+            preset = PRESETS.fetch(size.to_s) do
+              raise ArgumentError, "Unknown size preset: #{size.inspect}. " \
+                "Valid sizes: #{PRESETS.keys.join(', ')}"
+            end
+
+            h = resource.to_h
+            pod_spec = resource.pod_template(h)
+            next resource unless pod_spec
+
+            resource.each_container(pod_spec) do |container|
+              container[:resources] = deep_merge(preset, container[:resources] || {})
+            end
+
+            resource.rebuild(h)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/middleware/security_context.rb

@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Middleware
+      # Injects pod and container security contexts on pod-bearing resources.
+      #
+      # Reads the +app.kubernetes.io/security+ label. When the label
+      # is absent, the middleware applies the default profile.
+      #
+      #   Kube::Cluster["Deployment"].new {
+      #     metadata.labels = { "app.kubernetes.io/security": "restricted" }
+      #     ...
+      #   }
+      #
+      # Available profiles: +restricted+ (default), +baseline+.
+      #
+      #   stack do
+      #     use Middleware::SecurityContext                      # default: restricted
+      #     use Middleware::SecurityContext, default: :baseline  # change default
+      #   end
+      #
+      class SecurityContext < Middleware
+        LABEL = :"app.kubernetes.io/security"
+
+        PROFILES = {
+          "restricted" => {
+            pod: {
+              runAsNonRoot: true,
+              runAsUser:    1000,
+              runAsGroup:   1000,
+              fsGroup:      1000,
+              seccompProfile: { type: "RuntimeDefault" },
+            },
+            container: {
+              allowPrivilegeEscalation: false,
+              readOnlyRootFilesystem:   true,
+              capabilities:             { drop: ["ALL"] },
+            },
+          },
+          "baseline" => {
+            pod: {
+              runAsNonRoot: true,
+              runAsUser:    1000,
+              runAsGroup:   1000,
+              fsGroup:      1000,
+            },
+            container: {
+              allowPrivilegeEscalation: false,
+            },
+          },
+        }.freeze
+
+        def initialize(default: :restricted)
+          @default = default.to_s
+        end
+
+        def call(manifest)
+          manifest.resources.map! do |resource|
+            next resource unless resource.pod_bearing?
+
+            profile_name = resource.label(LABEL) || @default
+            profile = PROFILES.fetch(profile_name.to_s) do
+              raise ArgumentError, "Unknown security profile: #{profile_name.inspect}. " \
+                "Valid profiles: #{PROFILES.keys.join(', ')}"
+            end
+
+            h = resource.to_h
+            pod_spec = resource.pod_template(h)
+            next resource unless pod_spec
+
+            pod_spec[:securityContext] = deep_merge(profile[:pod], pod_spec[:securityContext] || {})
+
+            resource.each_container(pod_spec) do |container|
+              container[:securityContext] = deep_merge(profile[:container], container[:securityContext] || {})
+            end
+
+            resource.rebuild(h)
+          end
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/middleware/service_for_deployment.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Middleware
+      # Generates a Service for every pod-bearing resource that has
+      # containers with named ports.
+      #
+      # The generated Service uses +spec.selector.matchLabels+ from
+      # the source resource and maps each named container port.
+      #
+      # Labels and namespace are copied from the source resource, so
+      # subsequent middleware (Labels, Namespace, etc.) will also
+      # apply to the generated Service.
+      #
+      #   stack do
+      #     use Middleware::ServiceForDeployment
+      #   end
+      #
+      class ServiceForDeployment < Middleware
+        def call(manifest)
+          generated = []
+
+          manifest.resources.each do |resource|
+            next unless resource.pod_bearing?
+
+            h = resource.to_h
+            ports = extract_ports(resource, h)
+            next if ports.empty?
+
+            match_labels = h.dig(:spec, :selector, :matchLabels)
+            next unless match_labels && !match_labels.empty?
+
+            generated << Kube::Cluster["Service"].new {
+              metadata.name      = h.dig(:metadata, :name)
+              metadata.namespace = h.dig(:metadata, :namespace) if h.dig(:metadata, :namespace)
+              metadata.labels    = h.dig(:metadata, :labels) || {}
+
+              spec.selector = match_labels
+              spec.ports = ports.map { |p|
+                {
+                  name:       p[:name],
+                  port:       p[:containerPort],
+                  targetPort: p[:name],
+                  protocol:   p.fetch(:protocol, "TCP"),
+                }
+              }
+            }
+          end
+
+          manifest.resources.concat(generated)
+        end
+
+        private
+
+          def extract_ports(resource, hash)
+            pod_spec = resource.pod_template(hash)
+            return [] unless pod_spec
+
+            ports = []
+            resource.each_container(pod_spec) do |container|
+              Array(container[:ports]).each do |port|
+                ports << port if port[:name]
+              end
+            end
+            ports
+          end
+      end
+    end
+  end
+end

data/lib/kube/cluster/middleware/stack.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+module Kube
+  module Cluster
+    class Middleware
+      # An ordered pipeline of middleware that processes a manifest.
+      # Each middleware receives the manifest and mutates it in place.
+      #
+      #   stack = Kube::Cluster::Middleware::Stack.new do
+      #     use Middleware::ServiceForDeployment
+      #     use Middleware::Labels, app: "web"
+      #     use Middleware::Namespace, "production"
+      #   end
+      #
+      #   stack.call(manifest)
+      #
+      class Stack
+        def initialize(&block)
+          @middleware = []
+          instance_eval(&block) if block
+        end
+
+        # Register a middleware class with optional positional and keyword arguments.
+        def use(klass, *args, **kwargs)
+          @middleware << [klass, args, kwargs]
+        end
+
+        # Run the manifest through every middleware in order.
+        # Each middleware mutates the manifest in place.
+        def call(manifest)
+          @middleware.each do |klass, args, kwargs|
+            klass.new(*args, **kwargs).call(manifest)
+          end
+        end
+
+        # True when no middleware has been registered.
+        def empty?
+          @middleware.empty?
+        end
+      end
+    end
+  end
+end

data/lib/kube/cluster/middleware.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require_relative "middleware/stack"
+require_relative "middleware/namespace"
+require_relative "middleware/labels"
+require_relative "middleware/annotations"
+require_relative "middleware/resource_preset"
+require_relative "middleware/security_context"
+require_relative "middleware/pod_anti_affinity"
+require_relative "middleware/service_for_deployment"
+require_relative "middleware/ingress_for_service"
+require_relative "middleware/hpa_for_deployment"
+
+module Kube
+  module Cluster
+    # Base class for manifest middleware.
+    #
+    # Middleware receives the full manifest and mutates it in place.
+    # Each middleware is responsible for iterating resources as needed.
+    #
+    # Transform example:
+    #
+    #   class AddTeamLabel < Middleware
+    #     def call(manifest)
+    #       manifest.resources.map! do |resource|
+    #         h = resource.to_h
+    #         h[:metadata][:labels][:"app.kubernetes.io/team"] = "platform"
+    #         resource.rebuild(h)
+    #       end
+    #     end
+    #   end
+    #
+    # Generative example:
+    #
+    #   class ServiceForDeployment < Middleware
+    #     def call(manifest)
+    #       generated = []
+    #       manifest.resources.each do |resource|
+    #         next unless resource.pod_bearing?
+    #         generated << build_service_from(resource)
+    #       end
+    #       manifest.resources.concat(generated)
+    #     end
+    #   end
+    #
+    class Middleware
+      def initialize(**opts)
+        @opts = opts
+      end
+
+      # Override in subclasses. Receives the full manifest,
+      # mutates it in place.
+      def call(manifest)
+      end
+
+      private
+
+        def deep_merge(base, overlay)
+          base.merge(overlay) do |_key, old_val, new_val|
+            if old_val.is_a?(Hash) && new_val.is_a?(Hash)
+              deep_merge(old_val, new_val)
+            else
+              new_val
+            end
+          end
+        end
+    end
+  end
+end

data/lib/kube/cluster/resource.rb

@@ -11,11 +11,89 @@ module Kube
 
       attr_accessor :cluster
 
+      POD_BEARING_KINDS = %w[
+        Deployment
+        StatefulSet
+        DaemonSet
+        Job
+        CronJob
+        ReplicaSet
+      ].freeze
+
+      CLUSTER_SCOPED_KINDS = %w[
+        Namespace
+        ClusterRole
+        ClusterRoleBinding
+        PersistentVolume
+        StorageClass
+        IngressClass
+        CustomResourceDefinition
+        PriorityClass
+        RuntimeClass
+        VolumeAttachment
+        CSIDriver
+        CSINode
+      ].freeze
+
       def initialize(hash = {}, &block)
         @cluster = hash.delete(:cluster)
         super
         snapshot!
       end
+
+      # Build a new resource of the same schema subclass from a hash.
+      def rebuild(hash)
+        self.class.new(hash)
+      end
+
+      # Read a label value from the resource.
+      def label(key)
+        labels = to_h.dig(:metadata, :labels) || {}
+        labels[key.to_sym] || labels[key.to_s]
+      end
+
+      # Read an annotation value from the resource.
+      def annotation(key)
+        annotations = to_h.dig(:metadata, :annotations) || {}
+        annotations[key.to_sym] || annotations[key.to_s]
+      end
+
+      # The resource kind as a String (e.g. "Deployment").
+      def kind
+        h = to_h
+        (h[:kind] || h["kind"]).to_s
+      end
+
+      # Is this a resource that contains a pod template?
+      def pod_bearing?
+        POD_BEARING_KINDS.include?(kind)
+      end
+
+      # Is this a cluster-scoped resource (no namespace)?
+      def cluster_scoped?
+        CLUSTER_SCOPED_KINDS.include?(kind)
+      end
+
+      # Returns the pod template spec path from a resource hash,
+      # accounting for CronJob's extra nesting.
+      def pod_template(hash)
+        if (hash[:kind] || hash["kind"]).to_s == "CronJob"
+          hash.dig(:spec, :jobTemplate, :spec, :template, :spec)
+        else
+          hash.dig(:spec, :template, :spec)
+        end
+      end
+
+      # Walk every container list in a pod spec (containers,
+      # initContainers) and yield each container hash.
+      def each_container(pod_spec, &block)
+        return unless pod_spec
+
+        [:containers, :initContainers].each do |key|
+          Array(pod_spec[key]).each(&block)
+        end
+      end
+
     end
   end
 end

data/lib/kube/cluster/version.rb

@@ -2,6 +2,6 @@
 
 module Kube
   module Cluster
-    VERSION = "0.2.1"
+    VERSION = "0.3.0"
   end
 end

data/lib/kube/cluster.rb

@@ -7,6 +7,7 @@ require_relative "cluster/connection"
 require_relative "cluster/instance"
 require_relative "cluster/resource"
 require_relative "cluster/manifest"
+require_relative "cluster/middleware"
 require 'kube/ctl'
 
 module Kube
@@ -18,5 +19,25 @@ module Kube
     def self.connect(kubeconfig:)
       Instance.new(kubeconfig: kubeconfig)
     end
+
+    # Returns an anonymous subclass of Kube::Cluster::Resource for the
+    # given Kubernetes kind, mirroring Kube::Schema[kind] but with
+    # dirty tracking, persistence, and resource helper methods.
+    #
+    #   Kube::Cluster["Deployment"].new { metadata.name = "web" }
+    #
+    def self.[](kind)
+      @resource_classes ||= {}
+      @resource_classes[kind] ||= begin
+        schema_class = Kube::Schema[kind]
+        Class.new(Resource) do
+          @schema   = schema_class.schema
+          @defaults = schema_class.defaults
+
+          def self.schema   = @schema   || superclass.schema
+          def self.defaults = @defaults || superclass.defaults
+        end
+      end
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kube_cluster
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.3.0
 platform: ruby
 authors:
 - Nathan K
@@ -121,13 +121,19 @@ files:
 - bin/test
 - docker-compose.yml
 - examples/01-basic-redis-pod/manifest.rb
-- examples/database/manifest.rb
-- examples/version2/demo.rb
-- examples/version2/helpers.rb
-- examples/version2/my_app.rb
-- examples/version2/postgresql.rb
-- examples/version2/ruby_on_rails.rb
-- examples/web-app/manifest.rb
+- examples/02-manifest-with-middleware/manifest.rb
+- examples/02-manifest-with-middleware/middleware/labels.rb
+- examples/02-manifest-with-middleware/middleware/namespace.rb
+- examples/02-manifest-with-middleware/templates/config_map.rb
+- examples/02-manifest-with-middleware/templates/deployment.rb
+- examples/02-manifest-with-middleware/templates/horizontal_pod_autoscaler.rb
+- examples/02-manifest-with-middleware/templates/ingress.rb
+- examples/02-manifest-with-middleware/templates/service.rb
+- examples/03-app-with-database/demo.rb
+- examples/03-app-with-database/helpers.rb
+- examples/03-app-with-database/my_app.rb
+- examples/03-app-with-database/postgresql.rb
+- examples/03-app-with-database/ruby_on_rails.rb
 - flake.lock
 - flake.nix
 - kube_cluster.gemspec
@@ -136,17 +142,17 @@ files:
 - lib/kube/cluster/connection.rb
 - lib/kube/cluster/instance.rb
 - lib/kube/cluster/manifest.rb
-- lib/kube/cluster/manifest/middleware.rb
-- lib/kube/cluster/manifest/middleware/annotations.rb
-- lib/kube/cluster/manifest/middleware/hpa_for_deployment.rb
-- lib/kube/cluster/manifest/middleware/ingress_for_service.rb
-- lib/kube/cluster/manifest/middleware/labels.rb
-- lib/kube/cluster/manifest/middleware/namespace.rb
-- lib/kube/cluster/manifest/middleware/pod_anti_affinity.rb
-- lib/kube/cluster/manifest/middleware/resource_preset.rb
-- lib/kube/cluster/manifest/middleware/security_context.rb
-- lib/kube/cluster/manifest/middleware/service_for_deployment.rb
-- lib/kube/cluster/manifest/stack.rb
+- lib/kube/cluster/middleware.rb
+- lib/kube/cluster/middleware/annotations.rb
+- lib/kube/cluster/middleware/hpa_for_deployment.rb
+- lib/kube/cluster/middleware/ingress_for_service.rb
+- lib/kube/cluster/middleware/labels.rb
+- lib/kube/cluster/middleware/namespace.rb
+- lib/kube/cluster/middleware/pod_anti_affinity.rb
+- lib/kube/cluster/middleware/resource_preset.rb
+- lib/kube/cluster/middleware/security_context.rb
+- lib/kube/cluster/middleware/service_for_deployment.rb
+- lib/kube/cluster/middleware/stack.rb
 - lib/kube/cluster/resource.rb
 - lib/kube/cluster/resource/dirty_tracking.rb
 - lib/kube/cluster/resource/persistence.rb