kubernetes_template_rendering 0.6.0 → 0.6.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0eb9fa164f3a7e9f58a0d0e0962fb7de3be1efb3f4f5b3fba0d3c348355f993d
-  data.tar.gz: 49c13404c0dcc1e707927139df37d00272d8872715255590d1a12168f94fbe6a
+  metadata.gz: 7c71eb502c7b52355ee6d9040a8401a6e7937477b4ffc81b725951187340e325
+  data.tar.gz: 07e31b80f5c7c2e0d95860d10a4a73390dd919eeed86000867e151faad9f7113
 SHA512:
-  metadata.gz: 0b5e80e69fff3dfa08384bcf851b63bb3af692accd1ca0dfdc825dcddeb077c181915ad95ef9b2de3061d9daf4b015fe9b7481d03f009c019cd1524d75c58240
-  data.tar.gz: 26a072a724c6828e96890386b653cf649566f363bae9085c01ae0e8fd338f2ebe350fcffc4cbf96089a67f2458430562cceee87d4e4cf682fbb0f34834b7d4f8
+  metadata.gz: 3113be1c65d2e3f356e82b0b3388f9a090fab3945dcc9c54720146f12f9f95d8c95e7dd7fae7af0c00687aa6e557cf84c7fc6de5754f16c7e831fe101b283770
+  data.tar.gz: 64b29afd0de7680e0a8c4aa57010268bc3e1e0bb6ec502c11d91e1ac518d633371d8b1b8f7fa368cb71b73f5e89754e42fecc36cbdd56e698077064269316e0a

data/CHANGELOG.md

@@ -4,6 +4,17 @@ Inspired by [Keep a Changelog](https://keepachangelog.com/en/1.0.0/).
 
 Note: this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.6.2] - 2026-07-15
+### Fixed
+- Fixed the `--reconcile` sweep root for entries whose `subdirectory:` nests more than one level deep (e.g. `subdirectory: exclude-argocd/auth`). The sweep root is now the entry's canonical base — `<region>/<cluster_type>/<color>` for non-SPP entries and `<region>/<cluster_type>/<color>/spp/SPP-PLACEHOLDER` for SPP entries — regardless of `subdirectory:` depth, rather than the immediate parent of the rendered output directory. Previously a nested `subdirectory:` pushed the sweep root one level too deep, so when a `subdirectory:` was renamed or nested deeper the files left at the old shallower path were siblings of the sweep root and were never swept.
+
+### Changed
+- Under `--reconcile`, non-SPP entries must now render within their canonical `<region>/<cluster_type>/<color>` base; an entry that renders outside it (only reachable via the deprecated `directory:` field) hard-errors before any writes. This completes the reconcile layout hard-validation deferred in ADR-0001 — SPP entries were already constrained to the `spp/SPP-PLACEHOLDER` prefix. See ADR-0001.
+
+## [0.6.1] - 2026-07-08
+### Fixed
+- Fixed `variable_overrides` and `source_repo` not being forwarded to child `Resource` instances created by `DeployGroupedResource`. Previously, `--variable-override` values (e.g. `deploySha`) were silently unavailable inside all `*-deploy.jsonnet` and `*-deploy.yaml.erb` templates, causing a `KeyError` at render time. `DeployGroupedResource#initialize` now accepts both as optional keyword arguments and passes them through to each `Resource.new` call in `#render`. `ResourceSet#grouped_resources` is updated to supply both values.
+
 ## [0.6.0] - 2026-07-06
 ### Added
 - Added `--reconcile` flag: a bounded, marker-based sweep that replaces the destructive per-entry `rm -rf` of `--prune`. It touches a marker before rendering, then after rendering deletes only files older than the marker under each scope root (`<region>/<cluster_type>/<color>/`) and removes empty directories, correctly cleaning up directories of deleted/renamed entries. `spp/` subtrees are fenced out of the base sweep, paths resolving outside their scope prefix raise a hard error, and `--reconcile` combined with `--prune` is rejected.

data/catalog-info.yaml

@@ -32,5 +32,6 @@ spec:
   type: library
   lifecycle: production
   owner: octothorpe
+  system: kubernetes-platform
   dependsOn:
   - component:invoca-utils-gem

data/lib/kubernetes_template_rendering/deploy_grouped_resource.rb

@@ -8,7 +8,7 @@ module KubernetesTemplateRendering
 
     attr_reader :groups_to_render, :variables, :template_path, :output_directory, :template_path_exclusions, :group_variable_name
 
-    def initialize(template_path:, definitions_path:, variables:, output_directory:, groups_to_render:, template_path_exclusions:, group_variable_name: nil)
+    def initialize(template_path:, definitions_path:, variables:, output_directory:, groups_to_render:, template_path_exclusions:, group_variable_name: nil, variable_overrides: {}, source_repo: nil)
       @template_path    = template_path
       @definitions_path = definitions_path
       @variables        = variables
@@ -16,6 +16,8 @@ module KubernetesTemplateRendering
       @groups_to_render = groups_to_render
       @template_path_exclusions = template_path_exclusions || {}
       @group_variable_name = group_variable_name || DEFAULT_GROUP_VARIABLE_NAME
+      @variable_overrides = variable_overrides
+      @source_repo        = source_repo
     end
 
     def render(args)
@@ -28,7 +30,7 @@ module KubernetesTemplateRendering
           else
             vars     = variables.merge(group_variable_name => deploy_group)
             filename = filename_for_deploy_group(deploy_group)
-            Resource.new(template_path: template_path, definitions_path: @definitions_path, variables: vars, output_directory: output_directory, output_filename: filename).tap do |resource|
+            Resource.new(template_path: template_path, definitions_path: @definitions_path, variables: vars, output_directory: output_directory, output_filename: filename, variable_overrides: @variable_overrides, source_repo: @source_repo).tap do |resource|
               resource.render(args) if args.render_files?
             end
           end

data/lib/kubernetes_template_rendering/resource_set.rb

@@ -74,12 +74,13 @@ module KubernetesTemplateRendering
 
     # Bounded reconcile scope roots for this entry, one per region × color.
     #
-    # The sweep root is the parent directory of the entry's rendered `output_directory`, derived
-    # from the actual `directory:` pattern rather than assuming a fixed layout. For a
-    # `.../<service>` pattern that parent is the `<region>/<cluster_type>/<color>` base; for a
-    # `<region>/<service>` pattern it is `<region>`. The parent is shared with sibling entries, so
-    # leftovers from a deleted/renamed entry under it are swept. The renderer validates each
-    # `base_root` stays within `rendered_directory` (out-of-prefix, full or relative, is a hard error).
+    # The sweep root is the entry's canonical base — `<region>/<cluster_type>/<color>` for a non-SPP
+    # entry, or `<region>/<cluster_type>/<color>/spp/SPP-PLACEHOLDER` for an SPP one — independent of
+    # how deep the `subdirectory:` nests. Anchoring at the canonical base (rather than the rendered
+    # `output_directory`'s parent) keeps the sweep root fixed when a `subdirectory:` is renamed or
+    # nested deeper, so leftovers at the old shallower path are still swept. The renderer validates
+    # that the `output_directory` actually falls within this root before sweeping (an entry that
+    # renders elsewhere — only reachable via the deprecated `directory:` field — is a hard error).
     #
     # Each scope also carries `spp:` (whether this entry is an SPP definition) and `spp_base_root:`
     # (the canonical `<region>/<cluster_type>/<color>/spp/SPP-PLACEHOLDER` prefix for that region ×
@@ -88,8 +89,10 @@ module KubernetesTemplateRendering
       @regions.flat_map do |plain_region|
         @colors.map do |c|
           output_directory = File.join(@rendered_directory, format(@target_output_directory, plain_region: plain_region, color: c, type: @kubernetes_cluster_type))
+          base_path        = File.join(@rendered_directory, format(BASE_OUTPUT_DIRECTORY, plain_region: plain_region, color: c, type: @kubernetes_cluster_type))
           spp_base_root    = File.join(@rendered_directory, format(SPP_BASE_OUTPUT_DIRECTORY, plain_region: plain_region, color: c, type: @kubernetes_cluster_type))
-          { base_root: File.dirname(output_directory), output_directory: output_directory, spp: @spp, spp_base_root: spp_base_root }
+          base_root        = @spp ? spp_base_root : base_path
+          { base_root: base_root, output_directory: output_directory, spp: @spp, spp_base_root: spp_base_root }
         end
       end
     end
@@ -293,7 +296,9 @@ module KubernetesTemplateRendering
           output_directory: output_directory,
           groups_to_render: deploy_groups_to_render,
           template_path_exclusions: deploy_group_config["exclude_files"],
-          group_variable_name: deploy_group_config["variable_name"]
+          group_variable_name: deploy_group_config["variable_name"],
+          variable_overrides: variable_overrides,
+          source_repo: source_repo
         )
       end
     end

data/lib/kubernetes_template_rendering/template_directory_renderer.rb

@@ -92,6 +92,11 @@ module KubernetesTemplateRendering
       scopes.each do |scope|
         validate_within_scope!(scope[:base_root], @rendered_directory)
         validate_spp_layout!(scope)
+        # Every entry must render within its canonical root so reconcile owns exactly what it sweeps.
+        # SPP entries are already constrained to the spp/SPP-PLACEHOLDER prefix by validate_spp_layout!;
+        # a non-SPP entry can only escape its base via the deprecated `directory:` field, which reconcile
+        # cannot own — so reject it before any writes rather than sweep a tree it does not render into.
+        validate_within_scope!(scope[:output_directory], scope[:base_root]) unless scope[:spp]
       end
 
       base_roots = []
@@ -142,7 +147,8 @@ module KubernetesTemplateRendering
     # is always re-rendered (it is the expansion source) and each target is freshly expanded from it,
     # so both are marker-safe. Unrequested SPP siblings are not re-rendered this run and stay excluded.
     def spp_reconcile_roots(scope)
-      root = spp_sweep_root(scope)
+      # base_root is the canonical `.../spp/SPP-PLACEHOLDER` prefix for SPP entries.
+      root = scope[:base_root]
       return [root] if @spps.empty?
       return [root] unless root.include?(ResourceSet::SPP_PLACEHOLDER)
 
@@ -153,13 +159,6 @@ module KubernetesTemplateRendering
       Pathname.new(root).relative_path_from(Pathname.new(@rendered_directory)).each_filename.include?(SPP_FENCE_DIRNAME)
     end
 
-    # When the directory pattern has no service subdirectory (e.g. `.../spp/SPP-PLACEHOLDER`),
-    # base_root lands at the `spp/` level itself — sweeping that would touch all SPP siblings.
-    # Use output_directory (= `spp/<spp-name>`) in that case instead.
-    def spp_sweep_root(scope)
-      File.basename(scope[:base_root]) == SPP_FENCE_DIRNAME ? scope[:output_directory] : scope[:base_root]
-    end
-
     def reconcile_sweep(reconciler, scopes)
       scopes[:base_roots].each { |r| reconciler.sweep!(root: r, fences: [File.join(r, SPP_FENCE_DIRNAME)]) }
       scopes[:spp_roots].each  { |r| reconciler.sweep!(root: r) }

data/lib/kubernetes_template_rendering/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module KubernetesTemplateRendering
-  VERSION = "0.6.0"
+  VERSION = "0.6.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kubernetes_template_rendering
 version: !ruby/object:Gem::Version
-  version: 0.6.0
+  version: 0.6.2
 platform: ruby
 authors:
 - Octothorpe
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-07-07 00:00:00.000000000 Z
+date: 2026-07-15 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport