kube_cluster 1.5.0 → 1.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1e6e0a31873f5a706d272e0ff37b06a8f3565b0e8d8629b92915f24c572825d1
-  data.tar.gz: '08b20a4bb972d5b52eddd66577c79462a59611c8f84e692d092720c09bced0da'
+  metadata.gz: c57aae5fbe1903b9bc6bd63073ed4dd9d5731102b524077c4969051593b84b86
+  data.tar.gz: 19a1be373f25d1faee87bf83072c45987ecac39cc384c932168e4afefc42a7ac
 SHA512:
-  metadata.gz: 676e83947ff878d10e2ff3e46e9dd880120e856f480e5ed9b26d27046f7d901d07d5d044d0a3358fa99c927768f4c0c54e8af1e13fa5ef96b5806caeefa476d2
-  data.tar.gz: e8ade4344a74dd80bfaf8abec1bb43c5b0531b1130ab0c8584c4a0edb08e0a8d339dead8c35012cf517847d19cf066516717af9937890b70df744611f0809d5a
+  metadata.gz: db92c45266952b68584a01029cd2502caa5ab1ea2e9d010e91bf70b9385227578378d36be82c3c83eb3cf3966b04b2547732d63bd706555cd3fef6e14c28c869
+  data.tar.gz: a53b5a9d8165400643e0693259940f5cf2695d97afd12a258e20dc7ecbd9bfd04aed135803e1d402ec2c3215bb5e17e64d98da8725cb45175a3d208b08c419b1

data/CHANGELOG.md

@@ -5,6 +5,38 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.7.0] - 2026-09-17
+
+### Added
+- `Standard::EnvProcessing` now maps `ESO::ExternalSecret::KeyRef` (the struct
+  returned by `ExternalSecret#key`) to a `secretKeyRef` env var, mirroring the
+  support `VolumeProcessing` has always had. Unlike `.template`, `.key`
+  registers nothing on the ExternalSecret — it references a key the secret
+  already materialises (declared via `keys:` at construction, or by a
+  `.template` call elsewhere). This makes `Custom::PassboltSecret`-style
+  secrets — whose template is fully built at construction — usable from env
+  hashes, where previously the only option was a raw `valueFrom` hash or a
+  whole-secret `envFrom`.
+
+## [1.6.0] - 2026-08-03
+
+### Added
+- `Standard::JuiceFS::Sync` — a wrapper for the juicefs-operator's `Sync` CRD
+  (pinned to `juicefs.io/v1`). `from`/`to` are the CRD's sink hashes, passed
+  through as-is. Documents two operator behaviours worth knowing before use: the
+  unquoted metadata-URL export that breaks `juicefsCE` sinks whose metaurl
+  contains `&`, and the `ttlSecondsAfterFinished` deletion that makes a
+  reconciler-managed Sync re-run forever.
+- `Standard::JuiceFS::PersistentVolume` — a statically-provisioned JuiceFS PV,
+  the only way to give a volume an exact, readable directory name (`subPath`)
+  rather than the `pvc-<uuid>` a StorageClass would assign.
+- `PersistentVolume` pinned to `v1/PersistentVolume` in the resolve table.
+
+### Changed
+- Requires kube_schema `~> 1.10.0`, which ships the `juicefs.io/v1` schemas.
+  These wrappers previously needed a local CRD-registration shim that downloaded
+  `dist/crd.yaml` at load time; that is no longer necessary.
+
 ## [1.4.0] - 2026-07-13
 
 ### Added

data/Gemfile.lock

@@ -1,10 +1,10 @@
 PATH
   remote: .
   specs:
-    kube_cluster (1.5.0)
+    kube_cluster (1.7.0)
       activesupport (~> 8.0)
       kube_kubectl (~> 2.0)
-      kube_schema (~> 1.9.2)
+      kube_schema (~> 1.10.0)
 
 GEM
   remote: https://rubygems.org/
@@ -132,7 +132,7 @@ GEM
       rubyshell (~> 1.5)
       shellwords (~> 0.2.2)
       string_builder (~> 1.2.2)
-    kube_schema (1.9.2)
+    kube_schema (1.10.0)
       json_schemer (~> 2.5.0)
       rubyshell (~> 1.5.0)
     lefthook (2.1.10)

data/kube_cluster.gemspec

@@ -32,7 +32,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "scampi", "~> 1.0"
   spec.add_development_dependency "lefthook", "~> 2.1"
 
-  spec.add_dependency "kube_schema", "~> 1.9.2"
+  spec.add_dependency "kube_schema", "~> 1.10.0"
   spec.add_dependency "kube_kubectl", "~> 2.0"
   spec.add_dependency "activesupport", "~> 8.0"
 end

data/lib/kube/cluster/standard/env_processing.rb

@@ -22,6 +22,14 @@ module Kube
         #   "FOO" => Secret.new(name: "creds").key("bar")
         #     =>  { name: "FOO", valueFrom: { secretKeyRef: { name: "creds", key: "bar" } } }
         #
+        # ExternalSecret::KeyRef values reference a key the ExternalSecret
+        # already materialises (declared via keys: at construction, or by a
+        # .template call elsewhere) -- unlike .template, .key registers
+        # NOTHING on the ExternalSecret. Reference a key that never lands in
+        # the target Secret and the pod sits in CreateContainerConfigError.
+        #   "FOO" => ExternalSecret::Creds.key("bar")
+        #     =>  { name: "FOO", valueFrom: { secretKeyRef: { name: "creds", key: "bar" } } }
+        #
         def self.process(env)
           return env if env.is_a?(Array)
           return [] if env.nil?
@@ -33,7 +41,7 @@ module Kube
             when ESO::ExternalSecret::TemplateRef
               value.secret.register_template!(key, value.template_value)
               { name: key, valueFrom: { secretKeyRef: { name: value.secret.secret_name, key: key } } }
-            when Kube::Cluster::Standard::Secret::KeyRef
+            when ESO::ExternalSecret::KeyRef, Kube::Cluster::Standard::Secret::KeyRef
               { name: key, valueFrom: { secretKeyRef: { name: value.secret.secret_name, key: value.key_name } } }
             else
               { name: key, value: value.to_s }
@@ -58,6 +66,23 @@ describe "EnvProcessing" do
       ]
   end
 
+  it "maps an ExternalSecret::KeyRef to a secretKeyRef env var without registering anything" do
+    secret = Kube::Cluster::Standard::ESO::ExternalSecret.new(
+      name: "svix-jwt", store: "passbolt", remote_key: "svix-jwt",
+      keys: { "SVIX_JWT_SECRET" => "SVIX_JWT_SECRET" }
+    )
+
+    Kube::Cluster::Standard::EnvProcessing
+      .process("SVIX_JWT_SECRET" => secret.key("SVIX_JWT_SECRET"))
+      .should == [
+        { name: "SVIX_JWT_SECRET", valueFrom: { secretKeyRef: { name: "svix-jwt", key: "SVIX_JWT_SECRET" } } }
+      ]
+
+    # Unlike .template, .key must not touch the ExternalSecret's spec.
+    secret.to_h.dig(:spec, :target, :template).should.be.nil
+    secret.to_h.dig(:spec, :data).length.should == 1
+  end
+
   it "still maps plain string values to value env vars" do
     Kube::Cluster::Standard::EnvProcessing
       .process("FOO" => "bar")

data/lib/kube/cluster/standard/juice_fs/persistent_volume.rb

@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+#
+# A statically-provisioned JuiceFS PersistentVolume.
+#
+# Dynamic provisioning (a `juicefs-sc` StorageClass) names each volume's
+# directory `pvc-<uuid>` at the root of the filesystem. Static provisioning lets
+# the directory be named explicitly via the `subPath` volume attribute — the
+# only way to get an exact, readable folder name.
+#
+# `secret`/`secret_namespace` point at the JuiceFS "volume credentials" Secret
+# (name / metaurl / storage / bucket / keys / encrypt_rsa_key). PersistentVolume
+# is cluster-scoped and nodePublishSecretRef carries its own namespace, so the
+# PV, its PVC, and that Secret may all live in different namespaces. The mount
+# pod always runs in the CSI driver's namespace regardless.
+#
+# `storage` is a label only — JuiceFS enforces no quota through this field.
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      module JuiceFS
+        class PersistentVolume < Kube::Cluster["PersistentVolume"]
+          def initialize(name:, storage:, sub_path:, secret:, secret_namespace:,
+                         access_modes: ["ReadWriteMany"], reclaim_policy: "Retain", &block)
+            super() {
+              metadata.name = name
+
+              spec.capacity                      = { storage: storage }
+              spec.accessModes                   = access_modes
+              spec.persistentVolumeReclaimPolicy = reclaim_policy
+              # Empty (not absent) so no StorageClass can claim this PV and the
+              # matching PVC binds by volumeName alone.
+              spec.storageClassName              = ""
+              spec.csi = {
+                driver:               "csi.juicefs.com",
+                volumeHandle:         name,
+                fsType:               "juicefs",
+                nodePublishSecretRef: { name: secret, namespace: secret_namespace },
+                volumeAttributes:     { subPath: sub_path },
+              }
+
+              instance_exec(&block) if block
+            }
+          end
+        end
+      end
+    end
+  end
+end
+
+__END__
+
+describe "JuiceFS::PersistentVolume" do
+  pv = Kube::Cluster::Standard::JuiceFS::PersistentVolume
+
+  volume = pv.new(
+    name:             "media",
+    storage:          "1Ti",
+    sub_path:         "media",
+    secret:           "juicefs-secret",
+    secret_namespace: "kube-system",
+  )
+
+  it "mounts the named subPath through the JuiceFS CSI driver" do
+    yaml = volume.to_yaml
+
+    yaml.include?("driver: csi.juicefs.com").should == true
+    yaml.include?("subPath: media").should       == true
+  end
+
+  it "defaults to a retained, ReadWriteMany volume with no StorageClass" do
+    yaml = volume.to_yaml
+
+    yaml.include?("persistentVolumeReclaimPolicy: Retain").should == true
+    yaml.include?("ReadWriteMany").should                        == true
+    yaml.include?("storageClassName: ''").should                 == true
+  end
+end

data/lib/kube/cluster/standard/juice_fs/sync.rb

@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+#
+# juicefs.io/v1 Sync — a one-shot `juicefs sync` job run by the juicefs-operator
+# (https://juicefs.com/docs/csi/guide/juicefs-operator/).
+#
+# The operator builds a manager pod (plus `replicas - 1` worker pods) from
+# `image`, parses each sink into a URI, and runs
+# `juicefs sync [--<options>] <from> <to>`.
+#
+# `from`/`to` are the CRD's sink hashes and are passed through as-is — they are
+# the meaningful configuration, so wrapping them in a mini-DSL would only hide
+# the CRD. Exactly one of these keys per sink:
+#
+#   external:  { uri:, accessKey:, secretKey:, extraVolumes: }  any object store,
+#              a `file://` path, or a mounted PVC/hostPath
+#   juicefs:   { volumeName:, token:, ... }                     enterprise edition
+#   juicefsCE: { metaURL:, metaPassWord:, path: }               community edition
+#
+# NOTE ON juicefsCE: the operator emits its metadata-URL export UNQUOTED
+# (pkg/utils/sync.go, `export %s=%s`). A metaurl containing a literal `&` (e.g.
+# `?sslmode=require&search_path=juicefs`) is split by the pod's `sh -c`
+# entrypoint — the export runs in a background subshell and the variable is
+# empty in the shell that runs the sync. Use an `external` sink with a `pvc`
+# extraVolume instead, and let the CSI mount pod do the JuiceFS work.
+#
+# NOTE ON ttlSecondsAfterFinished: DO NOT SET IT when the Sync is managed by a
+# reconciler such as Flux or Argo CD. The controller DELETES the Sync object
+# when the TTL expires (internal/controller/sync_controller.go); the reconciler
+# then sees drift, recreates it, and the sync runs again — forever. Without a
+# TTL the object simply stays `Completed`. To re-run, delete the object by hand
+# or switch to a CronSync.
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      module JuiceFS
+        class Sync < Kube::Cluster["juicefs.io/v1/Sync"]
+          def initialize(name:, image:, from:, to:, replicas: 1, options: [], &block)
+            super() {
+              metadata.name = name
+              spec.image    = image
+              spec.replicas = replicas
+              spec.options  = options if options.any?
+              spec.from     = from
+              spec.to       = to
+
+              instance_exec(&block) if block
+            }
+          end
+        end
+      end
+    end
+  end
+end
+
+__END__
+
+describe "JuiceFS::Sync" do
+  sync = Kube::Cluster::Standard::JuiceFS::Sync
+
+  it "emits the juicefs.io/v1 apiVersion" do
+    sync
+      .new(
+        name:  "media-backup",
+        image: "juicedata/mount:latest",
+        from:  { external: { uri: "file:///mnt/media/" } },
+        to:    { external: { uri: "s3://backup.example.com/media/" } },
+      )
+      .to_yaml
+      .include?("apiVersion: juicefs.io/v1")
+      .should == true
+  end
+
+  it "omits options when none are given" do
+    sync
+      .new(
+        name:  "plain",
+        image: "juicedata/mount:latest",
+        from:  { external: { uri: "file:///a/" } },
+        to:    { external: { uri: "file:///b/" } },
+      )
+      .to_yaml
+      .include?("options:")
+      .should == false
+  end
+
+  it "carries options and replicas through" do
+    yaml = sync.new(
+      name:     "parallel",
+      image:    "juicedata/mount:latest",
+      from:     { external: { uri: "file:///a/" } },
+      to:       { external: { uri: "file:///b/" } },
+      replicas: 3,
+      options:  ["--update"],
+    ).to_yaml
+
+    yaml.include?("replicas: 3").should == true
+    yaml.include?("--update").should  == true
+  end
+end

data/lib/kube/cluster/version.rb

@@ -2,6 +2,6 @@
 
 module Kube
   module Cluster
-    VERSION = "1.5.0"
+    VERSION = "1.7.0"
   end
 end

data/lib/kube/cluster.rb

@@ -92,6 +92,7 @@ require "kube/cluster/resource/persistence"
 Kube::Cluster.config do
   # Built-in Kubernetes kinds.
   resolve "ConfigMap",                to: "v1/ConfigMap"
+  resolve "PersistentVolume",         to: "v1/PersistentVolume"
   resolve "PersistentVolumeClaim",    to: "v1/PersistentVolumeClaim"
   resolve "Secret",                   to: "v1/Secret"
   resolve "Service",                  to: "v1/Service"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kube_cluster
 version: !ruby/object:Gem::Version
-  version: 1.5.0
+  version: 1.7.0
 platform: ruby
 authors:
 - Nathan K
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: 1.10.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.9.2
+        version: 1.10.0
 - !ruby/object:Gem::Dependency
   name: kube_kubectl
   requirement: !ruby/object:Gem::Requirement
@@ -231,6 +231,8 @@ files:
 - lib/kube/cluster/standard/gateway_api/http_route.rb
 - lib/kube/cluster/standard/job.rb
 - lib/kube/cluster/standard/job_with_service_account.rb
+- lib/kube/cluster/standard/juice_fs/persistent_volume.rb
+- lib/kube/cluster/standard/juice_fs/sync.rb
 - lib/kube/cluster/standard/kube_virt/virtual_machine.rb
 - lib/kube/cluster/standard/meta_controller/composite_controller.rb
 - lib/kube/cluster/standard/meta_controller/decorator_controller.rb