kubes_aws 0.1.0 → 0.3.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 216f223229ec7e134e52a869f36507518c8376d768e3ae72ec5b557c7e1a31a7
-  data.tar.gz: 3fd50925b7906fe8c18f6b6e5c20065e895097aeaa57926093cf57ad1b445121
+  metadata.gz: 51843bf4cdbc25ea7fa4b3242db97e60cb064f25b6f338025978f415a89f0100
+  data.tar.gz: 118be0962ba9aff6428c8438780fe21991be278eeab0a9f5b6646fe94de74d5e
 SHA512:
-  metadata.gz: ef86d09153f32cb9bd6ae87eb905ef4de3a07ffa86abae0ed039655ee2305bae228de3d895c7d77cc3112fa2166ffa25fa4632163bd17969034947b067d30446
-  data.tar.gz: 4437ae6bdc30d96afd98b0261893d52a4c195eeb135b14b8823d6024d601743f431eaefaccf787a90cb1600c6eedc405d59c8f94f958c76ef8109be39b6b6243
+  metadata.gz: 9633e441c03d375c306a4081d4c7c71ccd0cf14c976cb1986599749d15161de0647fc2cda9e4d58916f13cc2560d9777e61f34e6b3055bbb978b54655de8aeea
+  data.tar.gz: c1b5bb8c8349e1fff848ce0dd266fc8a0db7cd60ab0625b21f81aa948f813b503d39ccc04fde23d544ff083ddb71880f0f385386e297d03fca652122f4eeaca3

data/CHANGELOG.md

@@ -3,5 +3,18 @@
 All notable changes to this project will be documented in this file.
 This project *loosely tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
 
+## [0.3.2] - 2022-02-16
+- [#5](https://github.com/boltops-tools/kubes_aws/pull/5) aws_secret_data helper
+- improve iam role infer_cluster
+
+## [0.3.1] - 2020-11-12
+- [#3](https://github.com/boltops-tools/kubes_aws/pull/3) rename secrets.base64 option
+
+## [0.3.0] - 2020-11-11
+- [#2](https://github.com/boltops-tools/kubes_aws/pull/2) Config interface and secrets.base64 setting. smarter base64 option
+
+## [0.2.0]
+- #1 helpers: aws_secret, aws_ssm
+
 ## [0.1.0]
 - Initial release.

data/kubes_aws.gemspec

@@ -23,6 +23,7 @@ Gem::Specification.new do |spec|
   spec.require_paths = ["lib"]
 
   spec.add_dependency "activesupport"
+  spec.add_dependency "aws-sdk-ecr"
   spec.add_dependency "aws-sdk-eks"
   spec.add_dependency "aws-sdk-iam"
   spec.add_dependency "aws-sdk-secretsmanager"
@@ -30,4 +31,6 @@ Gem::Specification.new do |spec|
   spec.add_dependency "aws_data"
   spec.add_dependency "memoist"
   spec.add_dependency "zeitwerk"
+
+  spec.add_development_dependency "kubes"
 end

data/lib/kubes_aws/config.rb

@@ -0,0 +1,21 @@
+module KubesAws
+  class Config
+    include Singleton
+
+    def defaults
+      c = ActiveSupport::OrderedOptions.new
+      c.secrets = ActiveSupport::OrderedOptions.new
+      c.secrets.base64 = true
+      c
+    end
+
+    @@config = nil
+    def config
+      @@config ||= defaults
+    end
+
+    def configure
+      yield(config)
+    end
+  end
+end

data/lib/kubes_aws/helpers.rb

@@ -0,0 +1,20 @@
+module KubesAws
+  module Helpers
+    extend Memoist
+    include Services
+
+    def aws_secret(name, options={})
+      fetcher = Secrets::Fetcher.new(options)
+      fetcher.fetch(name)
+    end
+
+    def aws_ssm(name, options={})
+      fetcher = SSM::Fetcher.new(options)
+      fetcher.fetch(name)
+    end
+
+    def aws_secret_data(name, options={})
+      generic_secret_data(:aws_secret, name, options)
+    end
+  end
+end

data/lib/kubes_aws/iam_role.rb

@@ -5,19 +5,20 @@ require "json"
 module KubesAws
   class IamRole
     extend Memoist
-    include AwsServices
+    include Services
     include Logging
     include Prebaked
 
     # public method to keep: role_name
     attr_reader :role_name
-    def initialize(app:, cluster:, namespace:nil, managed_policies: [], inline_policies: [], role_name: nil, ksa: nil)
+    def initialize(app:, cluster:nil, namespace:nil, managed_policies: [], inline_policies: [], role_name: nil, ksa: nil)
       @app, @cluster, @managed_policies, @inline_policies = app, cluster, managed_policies, inline_policies
 
       # conventional names
       @ksa = ksa || @app                               # convention: app
       @namespace = namespace || "#{@app}-#{Kubes.env}" # convention: app-env
       @role_name = role_name || "#{@app}-#{Kubes.env}" # convention: app-env
+      @cluster ||= infer_cluster
     end
 
     def call
@@ -27,6 +28,24 @@ module KubesAws
       add_inline_policies
     end
 
+    # Attempts to infer the EKS cluster name using kubectl
+    def infer_cluster
+      command = "kubectl config view --minify --output 'jsonpath={..contexts..context.cluster}'"
+      out = `#{command}`
+      success = $?.success?
+      name = out.split('/').last
+      if !success or name.blank?
+        logger.error <<~EOL.color(:red)
+          ERROR: unable to determine EKS cluster name. Please specify it in:
+
+              KubesAws::IamRole.new
+
+        EOL
+        exit 1
+      end
+      name
+    end
+
     def add_inline_policies
       @inline_policies.each do |policy|
         params = normalize_inline_policy(policy)

data/lib/kubes_aws/open_id.rb

@@ -5,7 +5,7 @@ require "openssl"
 module KubesAws
   class OpenId
     extend Memoist
-    include AwsServices
+    include Services
     include Logging
 
     def initialize(cluster)

data/lib/kubes_aws/secrets/fetcher.rb

@@ -0,0 +1,30 @@
+class KubesAws::Secrets
+  class Fetcher
+    include KubesAws::Logging
+    include KubesAws::Services
+
+    def initialize(options={})
+      @options = options
+      @base64 = options[:base64]
+    end
+
+    def fetch(secret_id)
+      value = fetch_value(secret_id)
+      value = Base64.strict_encode64(value).strip if base64?
+      value
+    end
+
+    def base64?
+      @base64.nil? ? KubesAws.config.secrets.base64 : @base64
+    end
+
+    def fetch_value(secret_id)
+      secret_value = secrets.get_secret_value(secret_id: secret_id)
+      secret_value.secret_string
+    rescue Aws::SecretsManager::Errors::ResourceNotFoundException => e
+      logger.info "WARN: secret_id #{secret_id} not found".color(:yellow)
+      logger.info e.message
+      "NOT FOUND #{secret_id}" # simple string so Kubernetes YAML is valid
+    end
+  end
+end

data/lib/kubes_aws/secrets.rb

@@ -2,7 +2,7 @@ require "aws-sdk-secretsmanager"
 
 module KubesAws
   class Secrets
-    include AwsServices
+    include Services
 
     def initialize(upcase: false, base64: false, prefix: nil, filters: [])
       @upcase, @base64, @filters = upcase, base64, filters

data/lib/kubes_aws/{aws_services.rb → services.rb}

@@ -1,8 +1,10 @@
 require "aws-sdk-eks"
 require "aws-sdk-iam"
+require "aws-sdk-secretsmanager"
+require "aws-sdk-ssm"
 
 module KubesAws
-  module AwsServices
+  module Services
     extend Memoist
 
     def eks

data/lib/kubes_aws/ssm/fetcher.rb

@@ -0,0 +1,35 @@
+class KubesAws::SSM
+  class Fetcher
+    include KubesAws::Logging
+    include KubesAws::Services
+
+    def initialize(options={})
+      @options = options
+      @base64 = options[:base64]
+    end
+
+    def fetch(name)
+      parameter = fetch_parameter(name)
+      value = parameter.value
+      value = Base64.strict_encode64(value).strip if base64?(parameter.type)
+      value
+    end
+
+    def base64?(type)
+      if @base64.nil?
+        type == "SecureString"
+      else
+        @base64
+      end
+    end
+
+    def fetch_parameter(name)
+      resp = ssm.get_parameter(name: name, with_decryption: true)
+      resp.parameter
+    rescue Aws::SSM::Errors::ParameterNotFound => e
+      logger.info "WARN: name #{name} not found".color(:yellow)
+      logger.info e.message
+      "NOT FOUND #{name}" # simple string so Kubernetes YAML is valid
+    end
+  end
+end

data/lib/kubes_aws/ssm.rb

@@ -1,8 +1,6 @@
-require "aws-sdk-ssm"
-
 module KubesAws
   class SSM
-    include AwsServices
+    include Services
 
     def initialize(upcase: false, base64: false, prefix: nil, filters: [])
       @upcase, @base64, @filters = upcase, base64, filters

data/lib/kubes_aws/version.rb

@@ -1,3 +1,3 @@
 module KubesAws
-  VERSION = "0.1.0"
+  VERSION = "0.3.2"
 end

data/lib/kubes_aws.rb

@@ -16,5 +16,26 @@ module KubesAws
     @@logger = v
   end
 
+  # Friendlier method configure.
+  #
+  #    .kubes/config/env/dev.rb
+  #    .kubes/config/plugins/google.rb # also works
+  #
+  # Example:
+  #
+  #     KubesGoogle.configure do |config|
+  #       config.hooks.gke_whitelist = true
+  #     end
+  #
+  def configure(&block)
+    Config.instance.configure(&block)
+  end
+
+  def config
+    Config.instance.config
+  end
+
   extend self
 end
+
+Kubes::Plugin.register(KubesAws)

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kubes_aws
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.3.2
 platform: ruby
 authors:
 - Tung Nguyen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-10-28 00:00:00.000000000 Z
+date: 2022-02-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -24,6 +24,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: aws-sdk-ecr
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: aws-sdk-eks
   requirement: !ruby/object:Gem::Requirement
@@ -122,6 +136,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: kubes
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: 
 email:
 - tung@boltops.com
@@ -139,13 +167,17 @@ files:
 - kubes_aws.gemspec
 - lib/kubes_aws.rb
 - lib/kubes_aws/autoloader.rb
-- lib/kubes_aws/aws_services.rb
+- lib/kubes_aws/config.rb
+- lib/kubes_aws/helpers.rb
 - lib/kubes_aws/iam_role.rb
 - lib/kubes_aws/iam_role/prebaked.rb
 - lib/kubes_aws/logging.rb
 - lib/kubes_aws/open_id.rb
 - lib/kubes_aws/secrets.rb
+- lib/kubes_aws/secrets/fetcher.rb
+- lib/kubes_aws/services.rb
 - lib/kubes_aws/ssm.rb
+- lib/kubes_aws/ssm/fetcher.rb
 - lib/kubes_aws/version.rb
 homepage: https://github.com/boltops-tools/kubes_aws
 licenses:
@@ -167,7 +199,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.2
+rubygems_version: 3.2.32
 signing_key: 
 specification_version: 4
 summary: Kubes AWS Helpers Library