kube_cluster 0.20.1 → 1.0.0

data/lib/kube/cluster/middleware/resource_preset.rb

@@ -68,163 +68,163 @@ module Kube
   end
 end
 
-test do
-  Middleware = Kube::Cluster::Middleware
-
-  it "injects_small_preset_into_deployment" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      metadata.labels = { "app.kubernetes.io/size": "small" }
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.containers = [
-        { name: "web", image: "nginx:latest" },
-      ]
-    })
-
-    Middleware::ResourcePreset.new.call(m)
-    container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
-
-    container.dig(:resources, :requests, :cpu).should == "500m"
-  end
+__END__
 
-  it "injects_nano_preset" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "tiny"
-      metadata.labels = { "app.kubernetes.io/size": "nano" }
-      spec.selector.matchLabels = { app: "tiny" }
-      spec.template.metadata.labels = { app: "tiny" }
-      spec.template.spec.containers = [
-        { name: "app", image: "app:latest" },
-      ]
-    })
-
-    Middleware::ResourcePreset.new.call(m)
-    container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
-
-    container.dig(:resources, :requests, :cpu).should == "100m"
-  end
+Middleware = Kube::Cluster::Middleware
 
-  it "injects_xlarge_preset" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "big"
-      metadata.labels = { "app.kubernetes.io/size": "xlarge" }
-      spec.selector.matchLabels = { app: "big" }
-      spec.template.metadata.labels = { app: "big" }
-      spec.template.spec.containers = [
-        { name: "app", image: "app:latest" },
-      ]
-    })
-
-    Middleware::ResourcePreset.new.call(m)
-    container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
-
-    container.dig(:resources, :limits, :cpu).should == "3"
-  end
+it "injects_small_preset_into_deployment" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    metadata.labels = { "app.kubernetes.io/size": "small" }
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.containers = [
+      { name: "web", image: "nginx:latest" },
+    ]
+  })
 
-  it "applies_to_all_containers" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "multi"
-      metadata.labels = { "app.kubernetes.io/size": "micro" }
-      spec.selector.matchLabels = { app: "multi" }
-      spec.template.metadata.labels = { app: "multi" }
-      spec.template.spec.containers = [
-        { name: "app", image: "app:latest" },
-        { name: "sidecar", image: "sidecar:latest" },
-      ]
-    })
-
-    Middleware::ResourcePreset.new.call(m)
-    containers = m.resources.first.to_h.dig(:spec, :template, :spec, :containers)
-
-    containers.last.dig(:resources, :requests, :cpu).should == "250m"
-  end
+  Middleware::ResourcePreset.new.call(m)
+  container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
 
-  it "skips_non_pod_bearing_resources" do
-    resource = Kube::Cluster["ConfigMap"].new {
-      metadata.name = "config"
-      metadata.labels = { "app.kubernetes.io/size": "small" }
-    }
-    m = manifest(resource)
+  container.dig(:resources, :requests, :cpu).should == "500m"
+end
 
-    Middleware::ResourcePreset.new.call(m)
+it "injects_nano_preset" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "tiny"
+    metadata.labels = { "app.kubernetes.io/size": "nano" }
+    spec.selector.matchLabels = { app: "tiny" }
+    spec.template.metadata.labels = { app: "tiny" }
+    spec.template.spec.containers = [
+      { name: "app", image: "app:latest" },
+    ]
+  })
+
+  Middleware::ResourcePreset.new.call(m)
+  container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
+
+  container.dig(:resources, :requests, :cpu).should == "100m"
+end
 
-    m.resources.first.to_h.should == resource.to_h
-  end
+it "injects_xlarge_preset" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "big"
+    metadata.labels = { "app.kubernetes.io/size": "xlarge" }
+    spec.selector.matchLabels = { app: "big" }
+    spec.template.metadata.labels = { app: "big" }
+    spec.template.spec.containers = [
+      { name: "app", image: "app:latest" },
+    ]
+  })
+
+  Middleware::ResourcePreset.new.call(m)
+  container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
+
+  container.dig(:resources, :limits, :cpu).should == "3"
+end
 
-  it "skips_resources_without_size_label" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.containers = [
-        { name: "web", image: "nginx:latest" },
-      ]
-    })
+it "applies_to_all_containers" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "multi"
+    metadata.labels = { "app.kubernetes.io/size": "micro" }
+    spec.selector.matchLabels = { app: "multi" }
+    spec.template.metadata.labels = { app: "multi" }
+    spec.template.spec.containers = [
+      { name: "app", image: "app:latest" },
+      { name: "sidecar", image: "sidecar:latest" },
+    ]
+  })
+
+  Middleware::ResourcePreset.new.call(m)
+  containers = m.resources.first.to_h.dig(:spec, :template, :spec, :containers)
+
+  containers.last.dig(:resources, :requests, :cpu).should == "250m"
+end
 
-    Middleware::ResourcePreset.new.call(m)
-    container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
+it "skips_non_pod_bearing_resources" do
+  resource = Kube::Cluster["ConfigMap"].new {
+    metadata.name = "config"
+    metadata.labels = { "app.kubernetes.io/size": "small" }
+  }
+  m = manifest(resource)
 
-    container[:resources].should.be.nil
-  end
+  Middleware::ResourcePreset.new.call(m)
 
-  it "raises_on_unknown_size" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      metadata.labels = { "app.kubernetes.io/size": "potato" }
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.containers = [
-        { name: "web", image: "nginx:latest" },
-      ]
-    })
-
-    lambda { Middleware::ResourcePreset.new.call(m) }.should.raise ArgumentError
-  end
+  m.resources.first.to_h.should == resource.to_h
+end
 
-  it "applies_to_statefulset" do
-    m = manifest(Kube::Cluster["StatefulSet"].new {
-      metadata.name = "db"
-      metadata.labels = { "app.kubernetes.io/size": "medium" }
-      spec.selector.matchLabels = { app: "db" }
-      spec.template.metadata.labels = { app: "db" }
-      spec.template.spec.containers = [
-        { name: "postgres", image: "postgres:16" },
-      ]
-    })
-
-    Middleware::ResourcePreset.new.call(m)
-    container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
-
-    container.dig(:resources, :requests, :cpu).should == "500m"
-  end
+it "skips_resources_without_size_label" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.containers = [
+      { name: "web", image: "nginx:latest" },
+    ]
+  })
 
-  it "preserves_existing_container_resources_via_deep_merge" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      metadata.labels = { "app.kubernetes.io/size": "small" }
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.containers = [
-        {
-          name: "web", image: "nginx:latest",
-          resources: { requests: { cpu: "999m" } },
-        },
-      ]
-    })
-
-    Middleware::ResourcePreset.new.call(m)
-    container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
-
-    # The container's explicit value wins over the preset
-    container.dig(:resources, :requests, :cpu).should == "999m"
-  end
+  Middleware::ResourcePreset.new.call(m)
+  container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
+
+  container[:resources].should.be.nil
+end
 
-  private
+it "raises_on_unknown_size" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    metadata.labels = { "app.kubernetes.io/size": "potato" }
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.containers = [
+      { name: "web", image: "nginx:latest" },
+    ]
+  })
+
+  lambda { Middleware::ResourcePreset.new.call(m) }.should.raise ArgumentError
+end
 
-    def manifest(*resources)
-      m = Kube::Cluster::Manifest.new
-      resources.each { |r| m << r }
-      m
-    end
+it "applies_to_statefulset" do
+  m = manifest(Kube::Cluster["StatefulSet"].new {
+    metadata.name = "db"
+    metadata.labels = { "app.kubernetes.io/size": "medium" }
+    spec.selector.matchLabels = { app: "db" }
+    spec.template.metadata.labels = { app: "db" }
+    spec.template.spec.containers = [
+      { name: "postgres", image: "postgres:16" },
+    ]
+  })
+
+  Middleware::ResourcePreset.new.call(m)
+  container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
+
+  container.dig(:resources, :requests, :cpu).should == "500m"
 end
+
+it "preserves_existing_container_resources_via_deep_merge" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    metadata.labels = { "app.kubernetes.io/size": "small" }
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.containers = [
+      {
+        name: "web", image: "nginx:latest",
+        resources: { requests: { cpu: "999m" } },
+      },
+    ]
+  })
+
+  Middleware::ResourcePreset.new.call(m)
+  container = m.resources.first.to_h.dig(:spec, :template, :spec, :containers, 0)
+
+  # The container's explicit value wins over the preset
+  container.dig(:resources, :requests, :cpu).should == "999m"
+end
+
+private
+
+  def manifest(*resources)
+    m = Kube::Cluster::Manifest.new
+    resources.each { |r| m << r }
+    m
+  end

data/lib/kube/cluster/middleware/security_context.rb

@@ -86,142 +86,142 @@ module Kube
   end
 end
 
-test do
-  Middleware = Kube::Cluster::Middleware
-
-  it "applies_restricted_profile_by_default" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.containers = [
-        { name: "web", image: "nginx:latest" },
-      ]
-    })
-
-    Middleware::SecurityContext.new.call(m)
-    h = m.resources.first.to_h
-    pod_sc = h.dig(:spec, :template, :spec, :securityContext)
-
-    pod_sc[:runAsNonRoot].should == true
-  end
+__END__
 
-  it "applies_baseline_profile_via_label" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      metadata.labels = { "app.kubernetes.io/security": "baseline" }
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.containers = [
-        { name: "web", image: "nginx:latest" },
-      ]
-    })
-
-    Middleware::SecurityContext.new.call(m)
-    h = m.resources.first.to_h
-    pod_sc = h.dig(:spec, :template, :spec, :securityContext)
-
-    pod_sc[:runAsNonRoot].should == true
-  end
+Middleware = Kube::Cluster::Middleware
 
-  it "applies_baseline_profile_via_constructor_default" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.containers = [
-        { name: "web", image: "nginx:latest" },
-      ]
-    })
-
-    Middleware::SecurityContext.new(default: :baseline).call(m)
-    h = m.resources.first.to_h
-    pod_sc = h.dig(:spec, :template, :spec, :securityContext)
-
-    pod_sc[:seccompProfile].should.be.nil
-  end
+it "applies_restricted_profile_by_default" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.containers = [
+      { name: "web", image: "nginx:latest" },
+    ]
+  })
 
-  it "label_overrides_constructor_default" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      metadata.labels = { "app.kubernetes.io/security": "restricted" }
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.containers = [
-        { name: "web", image: "nginx:latest" },
-      ]
-    })
-
-    Middleware::SecurityContext.new(default: :baseline).call(m)
-    h = m.resources.first.to_h
-    pod_sc = h.dig(:spec, :template, :spec, :securityContext)
-
-    pod_sc[:seccompProfile].should == { type: "RuntimeDefault" }
-  end
+  Middleware::SecurityContext.new.call(m)
+  h = m.resources.first.to_h
+  pod_sc = h.dig(:spec, :template, :spec, :securityContext)
 
-  it "applies_to_all_containers" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.containers = [
-        { name: "app", image: "app:latest" },
-        { name: "sidecar", image: "sidecar:latest" },
-      ]
-    })
-
-    Middleware::SecurityContext.new.call(m)
-    containers = m.resources.first.to_h.dig(:spec, :template, :spec, :containers)
-
-    containers.last.dig(:securityContext, :allowPrivilegeEscalation).should == false
-  end
+  pod_sc[:runAsNonRoot].should == true
+end
 
-  it "skips_non_pod_bearing_resources" do
-    resource = Kube::Cluster["ConfigMap"].new { metadata.name = "config" }
-    m = manifest(resource)
+it "applies_baseline_profile_via_label" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    metadata.labels = { "app.kubernetes.io/security": "baseline" }
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.containers = [
+      { name: "web", image: "nginx:latest" },
+    ]
+  })
+
+  Middleware::SecurityContext.new.call(m)
+  h = m.resources.first.to_h
+  pod_sc = h.dig(:spec, :template, :spec, :securityContext)
+
+  pod_sc[:runAsNonRoot].should == true
+end
 
-    Middleware::SecurityContext.new.call(m)
+it "applies_baseline_profile_via_constructor_default" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.containers = [
+      { name: "web", image: "nginx:latest" },
+    ]
+  })
+
+  Middleware::SecurityContext.new(default: :baseline).call(m)
+  h = m.resources.first.to_h
+  pod_sc = h.dig(:spec, :template, :spec, :securityContext)
+
+  pod_sc[:seccompProfile].should.be.nil
+end
 
-    m.resources.first.to_h.should == resource.to_h
-  end
+it "label_overrides_constructor_default" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    metadata.labels = { "app.kubernetes.io/security": "restricted" }
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.containers = [
+      { name: "web", image: "nginx:latest" },
+    ]
+  })
+
+  Middleware::SecurityContext.new(default: :baseline).call(m)
+  h = m.resources.first.to_h
+  pod_sc = h.dig(:spec, :template, :spec, :securityContext)
+
+  pod_sc[:seccompProfile].should == { type: "RuntimeDefault" }
+end
 
-  it "raises_on_unknown_profile" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      metadata.labels = { "app.kubernetes.io/security": "yolo" }
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.containers = [
-        { name: "web", image: "nginx:latest" },
-      ]
-    })
-
-    lambda { Middleware::SecurityContext.new.call(m) }.should.raise ArgumentError
-  end
+it "applies_to_all_containers" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.containers = [
+      { name: "app", image: "app:latest" },
+      { name: "sidecar", image: "sidecar:latest" },
+    ]
+  })
+
+  Middleware::SecurityContext.new.call(m)
+  containers = m.resources.first.to_h.dig(:spec, :template, :spec, :containers)
+
+  containers.last.dig(:securityContext, :allowPrivilegeEscalation).should == false
+end
 
-  it "preserves_existing_pod_security_context" do
-    m = manifest(Kube::Cluster["Deployment"].new {
-      metadata.name = "web"
-      spec.selector.matchLabels = { app: "web" }
-      spec.template.metadata.labels = { app: "web" }
-      spec.template.spec.securityContext = { runAsUser: 9999 }
-      spec.template.spec.containers = [
-        { name: "web", image: "nginx:latest" },
-      ]
-    })
-
-    Middleware::SecurityContext.new.call(m)
-    pod_sc = m.resources.first.to_h.dig(:spec, :template, :spec, :securityContext)
-
-    # Existing value wins
-    pod_sc[:runAsUser].should == 9999
-  end
+it "skips_non_pod_bearing_resources" do
+  resource = Kube::Cluster["ConfigMap"].new { metadata.name = "config" }
+  m = manifest(resource)
 
-  private
+  Middleware::SecurityContext.new.call(m)
 
-    def manifest(*resources)
-      m = Kube::Cluster::Manifest.new
-      resources.each { |r| m << r }
-      m
-    end
+  m.resources.first.to_h.should == resource.to_h
+end
+
+it "raises_on_unknown_profile" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    metadata.labels = { "app.kubernetes.io/security": "yolo" }
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.containers = [
+      { name: "web", image: "nginx:latest" },
+    ]
+  })
+
+  lambda { Middleware::SecurityContext.new.call(m) }.should.raise ArgumentError
 end
+
+it "preserves_existing_pod_security_context" do
+  m = manifest(Kube::Cluster["Deployment"].new {
+    metadata.name = "web"
+    spec.selector.matchLabels = { app: "web" }
+    spec.template.metadata.labels = { app: "web" }
+    spec.template.spec.securityContext = { runAsUser: 9999 }
+    spec.template.spec.containers = [
+      { name: "web", image: "nginx:latest" },
+    ]
+  })
+
+  Middleware::SecurityContext.new.call(m)
+  pod_sc = m.resources.first.to_h.dig(:spec, :template, :spec, :securityContext)
+
+  # Existing value wins
+  pod_sc[:runAsUser].should == 9999
+end
+
+private
+
+  def manifest(*resources)
+    m = Kube::Cluster::Manifest.new
+    resources.each { |r| m << r }
+    m
+  end