kube_cluster 1.7.0 → 1.8.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c57aae5fbe1903b9bc6bd63073ed4dd9d5731102b524077c4969051593b84b86
-  data.tar.gz: 19a1be373f25d1faee87bf83072c45987ecac39cc384c932168e4afefc42a7ac
+  metadata.gz: 63bb454e7b06393a663b744754a36bbd4bf3e411a7b062e42f1a1db3cca08ec3
+  data.tar.gz: 38f4c283662fc9aab31e22efb373188ec8c9b0cf7ae1fa46c1f49e8013599edc
 SHA512:
-  metadata.gz: db92c45266952b68584a01029cd2502caa5ab1ea2e9d010e91bf70b9385227578378d36be82c3c83eb3cf3966b04b2547732d63bd706555cd3fef6e14c28c869
-  data.tar.gz: a53b5a9d8165400643e0693259940f5cf2695d97afd12a258e20dc7ecbd9bfd04aed135803e1d402ec2c3215bb5e17e64d98da8725cb45175a3d208b08c419b1
+  metadata.gz: 85b42c1eb2f29f6789af473465fbbfd45d4e21ea167a2bef10697b1d13f1801e4b88ac397523b20e1bc6dc672c439113609bdcc87fcb8d7af41df69c2bb2ca41
+  data.tar.gz: 371b122e930400db8ec2400f138902ee6fe454427955bb547ad4db318b4c908ed3953c7b4be0e6ecf6f581a9b3c8c46641564a83a8080b49136cfb44de9f3b02

data/CHANGELOG.md

@@ -5,6 +5,33 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.8.0] - 2026-09-17
+
+### Added
+- `Standard::RbacRules` — the rules-shorthand builder behind
+  `Standard::Role`, now a shared module. The spec grammar handles
+  `"resource"`, `"resource/subresource"`, `"group/resource"` and
+  `"group/resource/subresource"`: the first segment is an API group when
+  `Kube::Schema.api_groups` knows it (`batch`, `apps`, `argoproj.io`, ...) or
+  when it contains a dot (API groups are DNS subdomains, which covers CRD
+  groups no schema has registered). Verbs are stringified, so symbols work.
+- `Standard::ClusterRole` — the rules shorthand, cluster-wide.
+- `Standard::ClusterRoleBinding` — wires a ClusterRole to a ServiceAccount,
+  mirroring `Standard::RoleBinding`.
+- `Middleware::SetNamespace` now fills blank ServiceAccount subject
+  namespaces on ClusterRoleBinding as well as RoleBinding. ClusterRoleBinding
+  is cluster-scoped, so there is no metadata.namespace to copy from — the
+  middleware fills the subjects directly.
+- `ClusterRole` and `ClusterRoleBinding` pinned in the resolve table.
+
+### Changed
+- Requires kube_schema `~> 1.11.0` for `Kube::Schema.api_groups`.
+
+### Fixed
+- The rules shorthand parsed `"pods/exec"` as `apiGroups: ["pods"],
+  resources: ["exec"]` — a rule matching nothing. Core subresources now
+  render as `apiGroups: [""], resources: ["pods/exec"]`.
+
 ## [1.7.0] - 2026-09-17
 
 ### Added

data/Gemfile.lock

@@ -1,10 +1,10 @@
 PATH
   remote: .
   specs:
-    kube_cluster (1.7.0)
+    kube_cluster (1.8.0)
       activesupport (~> 8.0)
       kube_kubectl (~> 2.0)
-      kube_schema (~> 1.10.0)
+      kube_schema (~> 1.11.0)
 
 GEM
   remote: https://rubygems.org/
@@ -132,7 +132,7 @@ GEM
       rubyshell (~> 1.5)
       shellwords (~> 0.2.2)
       string_builder (~> 1.2.2)
-    kube_schema (1.10.0)
+    kube_schema (1.11.0)
       json_schemer (~> 2.5.0)
       rubyshell (~> 1.5.0)
     lefthook (2.1.10)

data/kube_cluster.gemspec

@@ -32,7 +32,7 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "scampi", "~> 1.0"
   spec.add_development_dependency "lefthook", "~> 2.1"
 
-  spec.add_dependency "kube_schema", "~> 1.10.0"
+  spec.add_dependency "kube_schema", "~> 1.11.0"
   spec.add_dependency "kube_kubectl", "~> 2.0"
   spec.add_dependency "activesupport", "~> 8.0"
 end

data/lib/kube/cluster/middleware/set_namespace.rb

@@ -21,6 +21,29 @@ module Kube
         def call(manifest)
           manifest.resources.map! { |resource|
             filter(resource) {
+              # A binding's ServiceAccount subjects need an explicit
+              # namespace; fill in any left blank with the target namespace so
+              # same-namespace bindings (e.g. ServiceAccountWithRole) resolve.
+              # ClusterRoleBinding is cluster-scoped, so this runs before the
+              # scope check below.
+              if ['RoleBinding', 'ClusterRoleBinding'].include?(resource.kind)
+                h = resource.to_h
+                if h[:subjects].is_a?(Array)
+                  filled = h[:subjects].map { |subject|
+                    if subject[:kind] == 'ServiceAccount' &&
+                       (subject[:namespace].nil? || subject[:namespace].to_s.empty?)
+                      subject.merge(namespace: @namespace)
+                    else
+                      subject
+                    end
+                  }
+                  if filled != h[:subjects]
+                    h[:subjects] = filled
+                    resource = resource.rebuild(h)
+                  end
+                end
+              end
+
               next resource if resource.cluster_scoped?
 
               h = resource.to_h
@@ -30,20 +53,6 @@ module Kube
                 h[:metadata][:namespace] = @namespace
               end
 
-              # A RoleBinding's ServiceAccount subjects need an explicit
-              # namespace; fill in any left blank with the target namespace so
-              # same-namespace bindings (e.g. ServiceAccountWithRole) resolve.
-              if h[:kind] == 'RoleBinding' && h[:subjects].is_a?(Array)
-                h[:subjects] = h[:subjects].map { |subject|
-                  if subject[:kind] == 'ServiceAccount' &&
-                     (subject[:namespace].nil? || subject[:namespace].to_s.empty?)
-                    subject.merge(namespace: @namespace)
-                  else
-                    subject
-                  end
-                }
-              end
-
               resource.rebuild(h)
             }
           }
@@ -52,3 +61,63 @@ module Kube
     end
   end
 end
+
+__END__
+
+Middleware = Kube::Cluster::Middleware
+
+it "sets the namespace on namespaced resources" do
+  m = manifest(Kube::Cluster["ConfigMap"].new { metadata.name = "test" })
+
+  Middleware::SetNamespace.new("production").call(m)
+
+  m.resources.first.to_h.dig(:metadata, :namespace).should == "production"
+end
+
+it "fills blank ServiceAccount subject namespaces on RoleBinding" do
+  m = manifest(Kube::Cluster["RoleBinding"].new {
+    metadata.name = "rb"
+    self.roleRef  = { apiGroup: "rbac.authorization.k8s.io", kind: "Role", name: "r" }
+    self.subjects = [{ kind: "ServiceAccount", name: "sa" }]
+  })
+
+  Middleware::SetNamespace.new("production").call(m)
+  rb = m.resources.first.to_h
+
+  rb.dig(:subjects, 0, :namespace).should == "production"
+  rb.dig(:metadata, :namespace).should == "production"
+end
+
+it "fills blank ServiceAccount subject namespaces on cluster-scoped ClusterRoleBinding" do
+  m = manifest(Kube::Cluster["ClusterRoleBinding"].new {
+    metadata.name = "crb"
+    self.roleRef  = { apiGroup: "rbac.authorization.k8s.io", kind: "ClusterRole", name: "cr" }
+    self.subjects = [{ kind: "ServiceAccount", name: "sa" }]
+  })
+
+  Middleware::SetNamespace.new("production").call(m)
+  crb = m.resources.first.to_h
+
+  crb.dig(:subjects, 0, :namespace).should == "production"
+  crb.dig(:metadata, :namespace).should.be.nil
+end
+
+it "leaves pre-set subject namespaces alone" do
+  m = manifest(Kube::Cluster["ClusterRoleBinding"].new {
+    metadata.name = "crb"
+    self.roleRef  = { apiGroup: "rbac.authorization.k8s.io", kind: "ClusterRole", name: "cr" }
+    self.subjects = [{ kind: "ServiceAccount", name: "sa", namespace: "other" }]
+  })
+
+  Middleware::SetNamespace.new("production").call(m)
+
+  m.resources.first.to_h.dig(:subjects, 0, :namespace).should == "other"
+end
+
+private
+
+  def manifest(*resources)
+    m = Kube::Cluster::Manifest.new
+    resources.each { |r| m << r }
+    m
+  end

data/lib/kube/cluster/standard/cluster_role.rb

@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+require "kube/cluster/standard/rbac_rules"
+
+module Kube
+  module Cluster
+    module Standard
+      # A ClusterRole with the same rules shorthand as Role (see RbacRules):
+      #
+      #   ClusterRole.new(name: "node-reader", rules: {
+      #     "nodes"                 => %w[get list],
+      #     "nodes/proxy"           => %w[get],
+      #     "argoproj.io/workflows" => %w[get list],
+      #   })
+      #
+      class ClusterRole < Kube::Cluster["ClusterRole"]
+        # The original rules shorthand, so a named copy can be rebuilt from it
+        # (rebuild downgrades the class; reconstructing keeps it a
+        # Standard::ClusterRole).
+        attr_reader :rules_input
+
+        def initialize(rules:, name: nil, &block)
+          @rules_input = rules
+
+          super() do
+            metadata.name = name if name
+            self.rules = RbacRules.build(rules)
+            instance_exec(&block) if block
+          end
+        end
+
+        def name
+          to_h.dig(:metadata, :name)
+        end
+      end
+    end
+  end
+end
+
+__END__
+
+describe "ClusterRole" do
+  it "expands the rules shorthand" do
+    yaml = Kube::Cluster::Standard::ClusterRole
+      .new(name: "r", rules: {
+        "namespaces"              => %w[get list],
+        "pods/log"                => %w[get],
+        "argoproj.io/workflows"   => %w[get list],
+        "batch/cronjobs"          => %w[get],
+      })
+      .to_yaml
+
+    yaml.include?("kind: ClusterRole").should == true
+    yaml.include?("- namespaces").should == true
+    yaml.include?("- pods/log").should == true
+    yaml.include?("- argoproj.io").should == true
+    yaml.include?("- batch").should == true
+  end
+
+  it "renders core subresources in the core group (not as apiGroups: [pods])" do
+    rules = Kube::Cluster::Standard::ClusterRole
+      .new(name: "r", rules: { "pods/exec" => %w[create] })
+      .to_h[:rules]
+
+    rules.should == [{ apiGroups: [""], resources: ["pods/exec"], verbs: %w[create] }]
+  end
+end

data/lib/kube/cluster/standard/cluster_role_binding.rb

@@ -0,0 +1,56 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A ClusterRoleBinding that wires a ClusterRole to a ServiceAccount.
+      # Mirrors RoleBinding:
+      #
+      #   ClusterRoleBinding.new(role: MyClusterRole, service_account: MyServiceAccount)
+      #
+      # The subject namespace comes from the ServiceAccount when it has one,
+      # and is otherwise left blank for the SetNamespace middleware to fill --
+      # ClusterRoleBinding is cluster-scoped, so there is no metadata.namespace
+      # to copy from, but the middleware fills binding subjects directly.
+      class ClusterRoleBinding < Kube::Cluster["ClusterRoleBinding"]
+        def initialize(role:, service_account:, name: nil, &block)
+          name ||= role.name || service_account.name
+          role_name = role.name || name
+
+          subject = { kind: "ServiceAccount", name: service_account.name }
+          subject[:namespace] = service_account.namespace if service_account.namespace
+
+          super() do
+            metadata.name = name
+            self.roleRef = {
+              apiGroup: "rbac.authorization.k8s.io",
+              kind:     "ClusterRole",
+              name:     role_name,
+            }
+            self.subjects = [subject]
+            instance_exec(&block) if block
+          end
+        end
+      end
+    end
+  end
+end
+
+__END__
+
+describe "ClusterRoleBinding" do
+  it "references the cluster role and service account" do
+    yaml = Kube::Cluster::Standard::ClusterRoleBinding.new(
+      role: Kube::Cluster::Standard::ClusterRole.new(name: "cr", rules: { "nodes" => %w[get] }),
+      service_account: Kube::Cluster::Standard::ServiceAccount.new(name: "sa"),
+    ).to_yaml
+
+    yaml.include?("kind: ClusterRoleBinding").should == true
+    yaml.include?("kind: ClusterRole").should == true
+    yaml.include?("name: cr").should == true
+    yaml.include?("name: sa").should == true
+  end
+end

data/lib/kube/cluster/standard/rbac_rules.rb

@@ -0,0 +1,111 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # Builds Kubernetes RBAC PolicyRule arrays from a shorthand hash of
+      # resource-spec => verbs. The spec is "resource" (core API group),
+      # "resource/subresource" (core), "group/resource", or
+      # "group/resource/subresource":
+      #
+      #   RbacRules.build(
+      #     "secrets"               => %w[get list],
+      #     "pods/log"              => %w[get],
+      #     "batch/cronjobs"        => %w[get],
+      #     "argoproj.io/workflows" => %w[get list],
+      #     "subresources.kubevirt.io/virtualmachines/restart" => %w[create],
+      #   )
+      #
+      # The first path segment is an API group when the schema knows it as
+      # one (Kube::Schema.api_groups -- "batch", "apps", "argoproj.io", ...)
+      # or when it contains a dot: API groups are DNS subdomains, so a dotted
+      # segment is a group even when no schema has registered it (e.g. a CRD
+      # group local to one cluster). Anything else is a core resource,
+      # subresource included.
+      module RbacRules
+        def self.build(rules)
+          entries = rules.is_a?(Hash) ? [rules] : Array(rules)
+
+          entries.flat_map do |entry|
+            entry.map do |spec, verbs|
+              group, resource = split_spec(spec.to_s)
+              { apiGroups: [group], resources: [resource], verbs: Array(verbs).map(&:to_s) }
+            end
+          end
+        end
+
+        def self.split_spec(spec)
+          return ["", spec] unless spec.include?("/")
+
+          first, rest = spec.split("/", 2)
+          if Kube::Schema.api_groups.include?(first) || first.include?(".")
+            [first, rest]
+          else
+            ["", spec]
+          end
+        end
+      end
+    end
+  end
+end
+
+__END__
+
+describe "RbacRules" do
+  it "expands core resources into the empty group" do
+    Kube::Cluster::Standard::RbacRules
+      .build("secrets" => %w[get list])
+      .should == [{ apiGroups: [""], resources: ["secrets"], verbs: %w[get list] }]
+  end
+
+  it "keeps core subresources with their resource" do
+    Kube::Cluster::Standard::RbacRules
+      .build("pods/log" => %w[get])
+      .should == [{ apiGroups: [""], resources: ["pods/log"], verbs: %w[get] }]
+  end
+
+  it "splits groups the schema knows even without a dot (apps, batch)" do
+    Kube::Cluster::Standard::RbacRules
+      .build("batch/cronjobs" => %w[get], "apps/deployments" => %w[get])
+      .should == [
+        { apiGroups: ["batch"], resources: ["cronjobs"], verbs: %w[get] },
+        { apiGroups: ["apps"],  resources: ["deployments"], verbs: %w[get] },
+      ]
+  end
+
+  it "splits dotted groups" do
+    Kube::Cluster::Standard::RbacRules
+      .build("argoproj.io/workflows" => %w[get list])
+      .should == [{ apiGroups: ["argoproj.io"], resources: ["workflows"], verbs: %w[get list] }]
+  end
+
+  it "keeps the subresource on grouped resources" do
+    Kube::Cluster::Standard::RbacRules
+      .build("subresources.kubevirt.io/virtualmachines/restart" => %w[create])
+      .should == [{ apiGroups: ["subresources.kubevirt.io"], resources: ["virtualmachines/restart"], verbs: %w[create] }]
+  end
+
+  it "treats an unregistered dotted group as a group" do
+    Kube::Cluster::Standard::RbacRules
+      .build("tradeportal.ai/tenantvmclaims" => %w[get])
+      .should == [{ apiGroups: ["tradeportal.ai"], resources: ["tenantvmclaims"], verbs: %w[get] }]
+  end
+
+  it "stringifies symbol verbs" do
+    Kube::Cluster::Standard::RbacRules
+      .build("secrets" => [:get, :list])
+      .should == [{ apiGroups: [""], resources: ["secrets"], verbs: %w[get list] }]
+  end
+
+  it "accepts an array of hashes as well as a single hash" do
+    Kube::Cluster::Standard::RbacRules
+      .build([{ "secrets" => %w[get] }, { "pods" => %w[list] }])
+      .should == [
+        { apiGroups: [""], resources: ["secrets"], verbs: %w[get] },
+        { apiGroups: [""], resources: ["pods"],    verbs: %w[list] },
+      ]
+  end
+end

data/lib/kube/cluster/standard/role.rb

@@ -2,16 +2,18 @@
 
 require "bundler/setup"
 require "kube/cluster"
+require "kube/cluster/standard/rbac_rules"
 
 module Kube
   module Cluster
     module Standard
       # A Role with an ergonomic rules shorthand. Each rule maps a resource
-      # spec to its verbs; the spec is "resource" (core API group) or
-      # "group/resource":
+      # spec to its verbs; the spec grammar ("resource", "resource/subresource",
+      # "group/resource", "group/resource/subresource") is RbacRules':
       #
       #   Role.new(rules: [
       #     "secrets"        => %w[get list],
+      #     "pods/log"       => %w[get],
       #     "batch/cronjobs" => %w[get],
       #   ])
       #
@@ -25,7 +27,7 @@ module Kube
 
           super() do
             metadata.name = name if name
-            self.rules = Role.build_rules(rules)
+            self.rules = RbacRules.build(rules)
             instance_exec(&block) if block
           end
         end
@@ -35,14 +37,7 @@ module Kube
         end
 
         def self.build_rules(rules)
-          entries = rules.is_a?(Hash) ? [rules] : Array(rules)
-
-          entries.flat_map do |entry|
-            entry.map do |spec, verbs|
-              group, resource = spec.include?("/") ? spec.split("/", 2) : ["", spec]
-              { apiGroups: [group], resources: [resource], verbs: Array(verbs) }
-            end
-          end
+          RbacRules.build(rules)
         end
       end
     end

data/lib/kube/cluster/version.rb

@@ -2,6 +2,6 @@
 
 module Kube
   module Cluster
-    VERSION = "1.7.0"
+    VERSION = "1.8.0"
   end
 end

data/lib/kube/cluster.rb

@@ -103,6 +103,8 @@ Kube::Cluster.config do
   resolve "Job",                      to: "batch/v1/Job"
   resolve "Role",                     to: "rbac.authorization.k8s.io/v1/Role"
   resolve "RoleBinding",              to: "rbac.authorization.k8s.io/v1/RoleBinding"
+  resolve "ClusterRole",              to: "rbac.authorization.k8s.io/v1/ClusterRole"
+  resolve "ClusterRoleBinding",       to: "rbac.authorization.k8s.io/v1/ClusterRoleBinding"
   resolve "CustomResourceDefinition", to: "apiextensions.k8s.io/v1/CustomResourceDefinition"
 
   # Metacontroller.

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kube_cluster
 version: !ruby/object:Gem::Version
-  version: 1.7.0
+  version: 1.8.0
 platform: ruby
 authors:
 - Nathan K
@@ -57,14 +57,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.0
+        version: 1.11.0
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 1.10.0
+        version: 1.11.0
 - !ruby/object:Gem::Dependency
   name: kube_kubectl
   requirement: !ruby/object:Gem::Requirement
@@ -219,6 +219,8 @@ files:
 - lib/kube/cluster/standard/cloud_native_pg/database_with_external_secret.rb
 - lib/kube/cluster/standard/cloud_native_pg/external_secret.rb
 - lib/kube/cluster/standard/cloud_native_pg/helm.rb
+- lib/kube/cluster/standard/cluster_role.rb
+- lib/kube/cluster/standard/cluster_role_binding.rb
 - lib/kube/cluster/standard/config_map.rb
 - lib/kube/cluster/standard/cron_job.rb
 - lib/kube/cluster/standard/cron_job_with_service_account.rb
@@ -239,6 +241,7 @@ files:
 - lib/kube/cluster/standard/perses/perses.rb
 - lib/kube/cluster/standard/perses/perses_datasource.rb
 - lib/kube/cluster/standard/persistent_volume_claim.rb
+- lib/kube/cluster/standard/rbac_rules.rb
 - lib/kube/cluster/standard/role.rb
 - lib/kube/cluster/standard/role_binding.rb
 - lib/kube/cluster/standard/secret.rb