kube_cluster 0.16.0 → 0.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2db1b928c5cf97c3b248b5d035bf071d719cc2387c3ceab02ab999dcf45febe2
-  data.tar.gz: 85fc1a4be926b518f7e3720d58308fbf8e3915f628d5058dcbfef26799918406
+  metadata.gz: f7b1fa07c1c7e080961d17a281c4b2c8a6e84abc6cc9d4ae6c568415b2e989ae
+  data.tar.gz: 80994ba308efe68700f925dff182abf89908a55b1d35224c75eb577d7a42485c
 SHA512:
-  metadata.gz: f5c41a08ad784585e5fc92bdb6de5107b031e04d31d8a3d0d04e8670b44496e15244704b82a6c4c6e1027cca5fdd1c0475dc2af61df40b146b23cab611224e68
-  data.tar.gz: 68e00e0750fc326881b61cbe3a705ae7341eab8ba37b68429387e0055bc5eb26fa2bfb38f9f59d2e53ac5d0f8220e5fe2bbb5edb507c9a750e5ece721e52276f
+  metadata.gz: ac7da1390a3fedf1973a709b0ce5547ee99590d68dfdf46686d4fcf64e237b3a37e86f27b3dfc1350ef22bd264828d4c13705b79e05e6abc1f5ac20ae2cd8364
+  data.tar.gz: 96154be98c24b04e56a49c2c6a4df93b94fe67bfa8b79c754c62e543187a7083418815049e05a47db516b16d58db91e2e9dc649a46f9d04243219c28af87df27

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    kube_cluster (0.16.0)
+    kube_cluster (0.17.0)
       activesupport (~> 8.0)
       kube_kubectl (~> 2.0)
       kube_schema (~> 1.7)

data/lib/kube/cluster/standard/cron_job_with_service_account.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A CronJob plus the ServiceAccount/Role/RoleBinding it runs as, bundled
+      # into one Manifest. The RBAC rules use the Role shorthand; the CronJob's
+      # serviceAccountName is wired to the generated ServiceAccount. Everything
+      # is named after +name+.
+      #
+      #   CronJobWithServiceAccount.new(
+      #     name:     "glauth-config-builder",
+      #     image:    "nixery.dev/shell/ruby/kubectl/cacert",
+      #     schedule: "*/5 * * * *",
+      #     rules: [
+      #       "secrets"        => %w[get list],
+      #       "batch/jobs"     => %w[create],
+      #     ],
+      #     command: RubyScript(<<~'BUILD'),
+      #       ...
+      #     BUILD
+      #   )
+      #
+      class CronJobWithServiceAccount < Kube::Cluster::Manifest
+        def initialize(name:, image:, schedule:, rules:, env: {}, command: nil,
+                       backoff_limit: 3, ttl: 300, concurrency_policy: "Forbid", &block)
+          service_account_with_role = Kube::Cluster::Standard::ServiceAccountWithRole.new(
+            service_account: Kube::Cluster::Standard::ServiceAccount.new(name: name),
+            role: Kube::Cluster::Standard::Role.new(rules: rules),
+          )
+
+          cron_job = Kube::Cluster::Standard::CronJob.new(
+            name: name,
+            image: image,
+            schedule: schedule,
+            env: env,
+            command: command,
+            backoff_limit: backoff_limit,
+            ttl: ttl,
+            concurrency_policy: concurrency_policy,
+          ) do
+            spec.jobTemplate.spec.template.spec.serviceAccountName = name
+          end
+
+          super(*service_account_with_role.to_a, cron_job)
+
+          instance_exec(&block) if block
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "CronJobWithServiceAccount" do
+    it "emits the RBAC trio plus the cron job" do
+      m = Kube::Cluster::Standard::CronJobWithServiceAccount.new(
+        name: "builder",
+        image: "nixery.dev/shell/kubectl",
+        schedule: "*/5 * * * *",
+        rules: ["secrets" => %w[get list]],
+        command: ["true"],
+      )
+
+      m.map { |r| r.to_h[:kind] }.sort.should == %w[CronJob Role RoleBinding ServiceAccount]
+    end
+  end
+end

data/lib/kube/cluster/standard/job_with_service_account.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+require "bundler/setup"
+require "kube/cluster"
+
+module Kube
+  module Cluster
+    module Standard
+      # A one-shot Job plus the ServiceAccount/Role/RoleBinding it runs as,
+      # bundled into one Manifest. The RBAC rules use the Role shorthand; the
+      # Job's serviceAccountName is wired to the generated ServiceAccount.
+      # Everything is named after +name+.
+      #
+      #   JobWithServiceAccount.new(
+      #     name:  "glauth-config-seed",
+      #     image: "nixery.dev/shell/kubectl",
+      #     rules: [
+      #       "batch/cronjobs" => %w[get],
+      #       "batch/jobs"     => %w[create],
+      #     ],
+      #     command: BashScript(<<~'SEED'),
+      #       ...
+      #     SEED
+      #   )
+      #
+      class JobWithServiceAccount < Kube::Cluster::Manifest
+        def initialize(name:, image:, rules:, env: {}, command: nil,
+                       backoff_limit: 3, ttl: 300, &block)
+          service_account_with_role = Kube::Cluster::Standard::ServiceAccountWithRole.new(
+            service_account: Kube::Cluster::Standard::ServiceAccount.new(name: name),
+            role: Kube::Cluster::Standard::Role.new(rules: rules),
+          )
+
+          job = Kube::Cluster::Standard::Job.new(
+            name: name,
+            image: image,
+            env: env,
+            command: command,
+            backoff_limit: backoff_limit,
+            ttl: ttl,
+          ) do
+            spec.template.spec.serviceAccountName = name
+          end
+
+          super(*service_account_with_role.to_a, job)
+
+          instance_exec(&block) if block
+        end
+      end
+    end
+  end
+end
+
+test do
+  describe "JobWithServiceAccount" do
+    it "emits the RBAC trio plus the job" do
+      m = Kube::Cluster::Standard::JobWithServiceAccount.new(
+        name: "seed",
+        image: "nixery.dev/shell/kubectl",
+        rules: ["batch/jobs" => %w[create]],
+        command: ["true"],
+      )
+
+      m.map { |r| r.to_h[:kind] }.sort.should == %w[Job Role RoleBinding ServiceAccount]
+    end
+  end
+end

data/lib/kube/cluster/standard/role.rb

@@ -16,12 +16,16 @@ module Kube
       #   ])
       #
       class Role < Kube::Cluster["Role"]
+        # The original rules shorthand, so a named copy can be rebuilt from it
+        # (rebuild downgrades the class; reconstructing keeps it a Standard::Role).
+        attr_reader :rules_input
+
         def initialize(rules:, name: nil, &block)
-          built = self.class.build_rules(rules)
+          @rules_input = rules
 
           super() do
             metadata.name = name if name
-            self.rules = built
+            self.rules = Role.build_rules(rules)
             instance_exec(&block) if block
           end
         end
@@ -30,10 +34,6 @@ module Kube
           to_h.dig(:metadata, :name)
         end
 
-        def name=(value)
-          metadata.name = value
-        end
-
         def self.build_rules(rules)
           entries = rules.is_a?(Hash) ? [rules] : Array(rules)
 

data/lib/kube/cluster/standard/service_account_with_role.rb

@@ -21,15 +21,18 @@ module Kube
       class ServiceAccountWithRole < Kube::Cluster::Manifest
         def initialize(service_account:, role:, name: nil, &block)
           name ||= service_account.name
-          role.name = name
+
+          # Rebuild the Role with the derived name (a Standard::Role, so the
+          # binding's role.name reader works).
+          named_role = Kube::Cluster::Standard::Role.new(name: name, rules: role.rules_input)
 
           role_binding = Kube::Cluster::Standard::RoleBinding.new(
-            role: role,
+            role: named_role,
             service_account: service_account,
             name: name,
           )
 
-          super(service_account, role, role_binding)
+          super(service_account, named_role, role_binding)
 
           instance_exec(&block) if block
         end

data/lib/kube/cluster/version.rb

@@ -2,6 +2,6 @@
 
 module Kube
   module Cluster
-    VERSION = "0.16.0"
+    VERSION = "0.17.0"
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: kube_cluster
 version: !ruby/object:Gem::Version
-  version: 0.16.0
+  version: 0.17.0
 platform: ruby
 authors:
 - Nathan K
@@ -218,6 +218,7 @@ files:
 - lib/kube/cluster/standard/cloud_native_pg/helm.rb
 - lib/kube/cluster/standard/config_map.rb
 - lib/kube/cluster/standard/cron_job.rb
+- lib/kube/cluster/standard/cron_job_with_service_account.rb
 - lib/kube/cluster/standard/custom_resource_definition.rb
 - lib/kube/cluster/standard/daemon_set.rb
 - lib/kube/cluster/standard/deployment_with_service.rb
@@ -226,6 +227,7 @@ files:
 - lib/kube/cluster/standard/forgejo/helm.rb
 - lib/kube/cluster/standard/gateway_api/http_route.rb
 - lib/kube/cluster/standard/job.rb
+- lib/kube/cluster/standard/job_with_service_account.rb
 - lib/kube/cluster/standard/kube_virt/virtual_machine.rb
 - lib/kube/cluster/standard/meta_controller/composite_controller.rb
 - lib/kube/cluster/standard/meta_controller/decorator_controller.rb