kube_cluster 1.6.0 → 1.7.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c8a1a110a7fc51055c3b0b6c7bed9c90ef99a7f5d3270aada0f9b89b7fba5eb0
-  data.tar.gz: 07a7eb71bc8a0d9e9197fb24a76729764de4e237c68110fc1a486d0df38eec74
+  metadata.gz: c57aae5fbe1903b9bc6bd63073ed4dd9d5731102b524077c4969051593b84b86
+  data.tar.gz: 19a1be373f25d1faee87bf83072c45987ecac39cc384c932168e4afefc42a7ac
 SHA512:
-  metadata.gz: 8bc59ca6435b4f4b9096bb7925605211289ee6a337015fc3eba64d747d673adce333a391585b5235c961f5a681f23474588d8391d88c12e51af5c5d5026fed06
-  data.tar.gz: 73c07cf7c0c85c0f998dc2b406da0d385502d24e414194eeb5f2e2dfbecbef3bedcef8401678e73a0b53665bc1d62465a6cd9ef77b962e07c761ecdca09b8620
+  metadata.gz: db92c45266952b68584a01029cd2502caa5ab1ea2e9d010e91bf70b9385227578378d36be82c3c83eb3cf3966b04b2547732d63bd706555cd3fef6e14c28c869
+  data.tar.gz: a53b5a9d8165400643e0693259940f5cf2695d97afd12a258e20dc7ecbd9bfd04aed135803e1d402ec2c3215bb5e17e64d98da8725cb45175a3d208b08c419b1

data/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.7.0] - 2026-09-17
+
+### Added
+- `Standard::EnvProcessing` now maps `ESO::ExternalSecret::KeyRef` (the struct
+  returned by `ExternalSecret#key`) to a `secretKeyRef` env var, mirroring the
+  support `VolumeProcessing` has always had. Unlike `.template`, `.key`
+  registers nothing on the ExternalSecret — it references a key the secret
+  already materialises (declared via `keys:` at construction, or by a
+  `.template` call elsewhere). This makes `Custom::PassboltSecret`-style
+  secrets — whose template is fully built at construction — usable from env
+  hashes, where previously the only option was a raw `valueFrom` hash or a
+  whole-secret `envFrom`.
+
 ## [1.6.0] - 2026-08-03
 
 ### Added

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    kube_cluster (1.6.0)
+    kube_cluster (1.7.0)
       activesupport (~> 8.0)
       kube_kubectl (~> 2.0)
       kube_schema (~> 1.10.0)

data/lib/kube/cluster/standard/env_processing.rb

@@ -22,6 +22,14 @@ module Kube
         #   "FOO" => Secret.new(name: "creds").key("bar")
         #     =>  { name: "FOO", valueFrom: { secretKeyRef: { name: "creds", key: "bar" } } }
         #
+        # ExternalSecret::KeyRef values reference a key the ExternalSecret
+        # already materialises (declared via keys: at construction, or by a
+        # .template call elsewhere) -- unlike .template, .key registers
+        # NOTHING on the ExternalSecret. Reference a key that never lands in
+        # the target Secret and the pod sits in CreateContainerConfigError.
+        #   "FOO" => ExternalSecret::Creds.key("bar")
+        #     =>  { name: "FOO", valueFrom: { secretKeyRef: { name: "creds", key: "bar" } } }
+        #
         def self.process(env)
           return env if env.is_a?(Array)
           return [] if env.nil?
@@ -33,7 +41,7 @@ module Kube
             when ESO::ExternalSecret::TemplateRef
               value.secret.register_template!(key, value.template_value)
               { name: key, valueFrom: { secretKeyRef: { name: value.secret.secret_name, key: key } } }
-            when Kube::Cluster::Standard::Secret::KeyRef
+            when ESO::ExternalSecret::KeyRef, Kube::Cluster::Standard::Secret::KeyRef
               { name: key, valueFrom: { secretKeyRef: { name: value.secret.secret_name, key: value.key_name } } }
             else
               { name: key, value: value.to_s }
@@ -58,6 +66,23 @@ describe "EnvProcessing" do
       ]
   end
 
+  it "maps an ExternalSecret::KeyRef to a secretKeyRef env var without registering anything" do
+    secret = Kube::Cluster::Standard::ESO::ExternalSecret.new(
+      name: "svix-jwt", store: "passbolt", remote_key: "svix-jwt",
+      keys: { "SVIX_JWT_SECRET" => "SVIX_JWT_SECRET" }
+    )
+
+    Kube::Cluster::Standard::EnvProcessing
+      .process("SVIX_JWT_SECRET" => secret.key("SVIX_JWT_SECRET"))
+      .should == [
+        { name: "SVIX_JWT_SECRET", valueFrom: { secretKeyRef: { name: "svix-jwt", key: "SVIX_JWT_SECRET" } } }
+      ]
+
+    # Unlike .template, .key must not touch the ExternalSecret's spec.
+    secret.to_h.dig(:spec, :target, :template).should.be.nil
+    secret.to_h.dig(:spec, :data).length.should == 1
+  end
+
   it "still maps plain string values to value env vars" do
     Kube::Cluster::Standard::EnvProcessing
       .process("FOO" => "bar")

data/lib/kube/cluster/version.rb

@@ -2,6 +2,6 @@
 
 module Kube
   module Cluster
-    VERSION = "1.6.0"
+    VERSION = "1.7.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kube_cluster
 version: !ruby/object:Gem::Version
-  version: 1.6.0
+  version: 1.7.0
 platform: ruby
 authors:
 - Nathan K