kubes 0.4.1 → 0.4.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cb9cf7b5db064114c31e2af08890c009831a4b68baf556052e672a71cf08f562
-  data.tar.gz: 70bdcad829b4cee02f69b4cf36fbac8e41023445c407f484bc171e2a67d9bd99
+  metadata.gz: 70ab0b9bdb58186064b2ba54324059ec1944811a021f158a30f219cbd4a19711
+  data.tar.gz: cdccd15d027f75f1c439d1facff1ed9d0b2ef58b4600b289d6f9d7e8e63917cb
 SHA512:
-  metadata.gz: '08dfce3916b92c0498915d0e7bf5d75608f111013eca67f5d9802f30250e0412c76afcd08f7ad2dd7d72ca413d13390a6d07b9d2c56b182fd0c04247ae1f9708'
-  data.tar.gz: dd255951bb8421f80d666492cd1e03ac363364abb441c4ded7db33562cd6450f6f2f397230c84c20a24f9b98d72e00cd3463cfde8c2ed1e93875dcd2aaa5ec58
+  metadata.gz: 23c2dddfd2608971f2d59a52f2df79cd23355e98ab1f3de1aa6611e94ea19c75d54dd744892148bbb27a0e6610fe1a952895fa0a9571cead2ef729c072f15821
+  data.tar.gz: b088738e2a3fa44157f2c340508ff1d87634550ebe63608c4b7a9c4241dd385019af03c132400381db4f4ea36057526afb832e1101860b745a8670b130b7ffa2

data/CHANGELOG.md

@@ -3,6 +3,9 @@
 All notable changes to this project will be documented in this file.
 This project *loosely tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
 
+## [0.4.2]
+- #28 base64 helper
+
 ## [0.4.1]
 - kubes init: default namespace now includes Kubes.env
 - fix kubes deploy: compile it gets called once and output folder kept

data/docs/_docs/config/hooks/ruby.md

@@ -18,7 +18,7 @@ When the Ruby object is a class with an instance method `call`, Kubes creates a
 ```ruby
 class EnvExporter
   def call
-    ENV['SECRET_FOO'] = Base64.encode64("hi").strip
+    ENV['SECRET_FOO'] = Base64.strict_encode64("hi").strip
   end
 end
 
@@ -49,6 +49,8 @@ data:
   foo: <%= ENV['SECRET_FOO'] %>
 ```
 
+Note, the example above is used to explain how Ruby can be used as the execute option. For secrets, kubes supports secrets with some helpers. See: [Secrets Pattern Docs]({% link _docs/patterns/secrets.md %})
+
 ## Ruby Object
 
 When the Ruby object, Kubes expects it to have a `call` method and will run it.  Example:
@@ -57,7 +59,7 @@ When the Ruby object, Kubes expects it to have a `call` method and will run it.
 
 ```ruby
 before("compile",
-  execute: lambda { ENV['SECRET_FOO'] = Base64.encode64("hi2").strip }
+  execute: lambda { ENV['SECRET_FOO'] = Base64.strict_encode64("hi2").strip }
 )
 ```
 

data/docs/_docs/helpers.md

@@ -7,12 +7,13 @@ Kubes provides some helper methods to help write Kubernetes YAML files.  Here's
 Helper | Description
 --- | ---
 built_image | Method refers to the latest Docker image built by Kubes. This spares you from having to update the image manually in the deployment resource.
+decode64 | Basey64d decode a string.
 dockerfile_port	| Exposed port extracted from the Dockerfile of the project.
+encode64 | Basey64 encode a string. Also available as `base64` method.
 extra | The `KUBES_EXTRA` value.
 with_extra | Appends the `KUBES_EXTRA` value to a string if it's set. It's covered in the [Extra Env Docs]({% link _docs/extra-env.md %}).
 
-Here's also the source code with the helpers: [helpers.rb](https://github.com/boltops-tools/kubes/blob/master/lib/kubes/compiler/shared/helpers.rb).
-
+Here's also the source code with most of the helpers: [helpers.rb](https://github.com/boltops-tools/kubes/blob/master/lib/kubes/compiler/shared/helpers.rb).
 
 ## DSL Specific Methods
 

data/docs/_docs/patterns.md

@@ -4,4 +4,7 @@ title: Patterns
 
 We'll cover some common deployment patterns here:
 
-* [Clock Web Worker]({% link _docs/patterns/clock-web-worker.md %})
+{% assign docs = site.docs | where: "categories","patterns" %}
+{% for doc in docs -%}
+* [{{ doc.title }}]({{ doc.url }})
+{% endfor %}

data/docs/_docs/patterns/clock-web-worker.md

@@ -1,5 +1,7 @@
 ---
 title: Clock Web Worker Pattern
+nav_text: Clock Web Worker
+categories: patterns
 ---
 
 A common pattern is to use the same code to run different types of processes like clock, web, worker. Kubes is flexible enough to support this pattern.

data/docs/_docs/patterns/migrations.md

@@ -1,5 +1,7 @@
 ---
 title: Database Migrations
+nav_text: Database Migrations
+categories: patterns
 ---
 
 A common task is to run database migrations. You can use Kubes hooks to achieve this as part of the `kubes deploy` process.

data/docs/_docs/patterns/secrets.md

@@ -0,0 +1,82 @@
+---
+title: Secrets
+nav_text: Secrets
+categories: patterns
+---
+
+A Google Secrets helper is currently supported.
+
+## Set Up Kubes Hook
+
+Set up a [Kubes hook]({% link _docs/config/hooks/kubes.md %}).
+
+.kubes/config/hooks/kubes.rb
+
+```ruby
+before("compile",
+  execute: KubesGoogle::Secrets.new(upcase: true, prefix: 'projects/686010496118/secrets/demo-dev-')
+)
+```
+
+Then set the secrets in the YAML:
+
+.kubes/resources/shared/secret.yaml
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: demo
+  labels:
+    app: demo
+data:
+<% KubesGoogle::Secrets.data.each do |k,v| -%>
+  <%= k %>: <%= base64(v) %>
+<% end -%>
+```
+
+This results in Google secrets with the prefix the `demo-dev-` being added to the Kubernetes secret data.  The values are base64 encoded.
+
+For example if you have these secret values:
+
+    $ gcloud secrets versions access latest --secret demo-dev-db_user
+    test1
+    $ gcloud secrets versions access latest --secret demo-dev-db_pass
+    test2
+    $
+
+The compiled secrets.yaml looks like this:
+
+.kubes/output/shared/secret.yaml
+
+```yaml
+metadata:
+  namespace: demo
+  name: demo-2a78a13682
+  labels:
+    app: demo
+apiVersion: v1
+kind: Secret
+data:
+  db_pass: dGVzdDEK
+  db_user: dGVzdDIK
+```
+
+These environment variables can be set:
+
+Name | Description
+---|---
+GCP_SECRET_PREFIX | Prefixed used to list and filter Google secrets. IE: `projects/686010496118/secrets/demo-dev-`.
+GOOGLE_PROJECT | Google project id.
+
+Secrets#initialize options:
+
+Variable | Description | Default
+---|---|---
+base64 | Automatically base64 encode the values. | false
+upcase | Automatically upcase the Kubernetes secret data keys. | false
+prefix | Prefixed used to list and filter Google secrets. IE: `projects/686010496118/secrets/demo-dev-`. Can also be set with the `GCP_SECRET_PREFIX` env variable. The env variable takes the highest precedence. | nil
+
+Note, Kubernetes secrets are only base64 encoded. So users who have access to read Kubernetes secrets will be able to decode and get the value trivially. Depending on your security posture requirements, this may or may not suffice.
+
+The Google helpers are provided by the [boltops-tools/kubes_google](https://github.com/boltops-tools/kubes_google) library. For more details, check out its README.

data/docs/_includes/sidebar.html

@@ -100,8 +100,10 @@
       <li><a href="{% link _docs/helpers.md %}">Helpers</a></li>
       <li><a href="{% link _docs/patterns.md %}">Patterns</a>
         <ul>
-          <li><a href="{% link _docs/patterns/migrations.md %}">Database Migrations</a></li>
-          <li><a href="{% link _docs/patterns/clock-web-worker.md %}">Clock Web Worker</a></li>
+          {% assign docs = site.docs | where: "categories","patterns" %}
+          {% for doc in docs -%}
+            <li><a href="{{ doc.url }}">{{ doc.nav_text }}</a></li>
+          {% endfor %}
         </ul>
       </li>
       <li><a href="{% link _docs/extra-env.md %}">Extra Env</a>

data/lib/kubes/compiler/shared/helpers.rb

@@ -24,8 +24,13 @@ module Kubes::Compiler::Shared
       extra&.strip&.empty? ? nil : extra # if blank string then also return nil
     end
 
-    def base64(v)
-      Base64.encode64(v).strip
+    def encode64(v)
+      Base64.strict_encode64(v).strip
+    end
+    alias_method :base64, :encode64
+
+    def decode64(v)
+      Base64.strict_decode64(v)
     end
   end
 end

data/lib/kubes/version.rb

@@ -1,3 +1,3 @@
 module Kubes
-  VERSION = "0.4.1"
+  VERSION = "0.4.2"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kubes
 version: !ruby/object:Gem::Version
-  version: 0.4.1
+  version: 0.4.2
 platform: ruby
 authors:
 - Tung Nguyen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-10-13 00:00:00.000000000 Z
+date: 2020-10-14 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -323,6 +323,7 @@ files:
 - docs/_docs/patterns.md
 - docs/_docs/patterns/clock-web-worker.md
 - docs/_docs/patterns/migrations.md
+- docs/_docs/patterns/secrets.md
 - docs/_docs/resources.md
 - docs/_docs/resources/base.md
 - docs/_docs/resources/role.md