kubes_google 0.3.5 → 0.3.9

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: c4940b31e1e64807b1036d0980ab6c1ebe81aa6f05581b1e2d00b3bf915d12c0
-  data.tar.gz: 6761294987f6c33fef1d9764712bab015b7b264fa8e5b84c166a633f03bc44aa
+  metadata.gz: d593aeda0613c869927cc4a394a6074f2cb0b37a65a300c34e2c1843795665fd
+  data.tar.gz: 612e010ffb671cbe6fae182be9013c0d0e0a35360ea74a3b241e31852ede785c
 SHA512:
-  metadata.gz: 4c09463d4a76e82240502a5779e90a9874b9c91d4f195f91af128fa48a134b44a9485a5c327fad74826834edd57e0137ebd9375558f4253ec0ca5242610061a7
-  data.tar.gz: a7ecffa4255c71544b92fd5df88bac16a5a06eb4e2c8e48eed9d9b1f61a12c98f18c3c6edd8f92aef51ffeb595605a9cccb578a42dbc810b89fc9eeb9a97fe02
+  metadata.gz: '03709e5092eb0d4bdee232a60a3bd7369eff75e2b58591716fdc5a9e6d4833c5529740ee488e0a1cc2c04f389bb350e78bdbfd98c3d1b8d34717edd35025be90'
+  data.tar.gz: 492c3b693b2f44db71b08dabc1a66d1a45e3b776efab24292f438be1c94da5f9caf295c0da36e8c058f3f5b4d5cfff7c3f801135d1aaa164992bda2f7053368e

data/CHANGELOG.md

@@ -3,6 +3,20 @@
 All notable changes to this project will be documented in this file.
 This project *loosely tries* to adhere to [Semantic Versioning](http://semver.org/), even before v1.0.
 
+## [0.3.9] - 2022-02-16
+- [#10](https://github.com/boltops-tools/kubes_google/pull/10) google_secret_data helper
+
+## [0.3.8] - 2022-02-07
+- fix service account creation: add condition none
+
+## [0.3.7] - 2022-02-07
+- [#9](https://github.com/boltops-tools/kubes_google/pull/9) performance improvement: cache secrets
+
+## [0.3.6] - 2022-02-04
+- [#7](https://github.com/boltops-tools/kubes_google/pull/7) Secret auto retry with gcloud strategy
+- [#8](https://github.com/boltops-tools/kubes_google/pull/8) add condition none
+- get google project number via api
+
 ## [0.3.5] - 2020-11-12
 - add KubesGoogle.cloudbuild? check
 - fetcher sdk friendly suggestion to use gcloud when vpn errors

data/kubes_google.gemspec

@@ -24,6 +24,7 @@ Gem::Specification.new do |spec|
 
   spec.add_dependency "activesupport"
   spec.add_dependency "google-cloud-container"
+  spec.add_dependency "google-cloud-resource_manager"
   spec.add_dependency "google-cloud-secret_manager"
   spec.add_dependency "memoist"
   spec.add_dependency "zeitwerk"

data/lib/kubes_google/helpers.rb

@@ -7,5 +7,9 @@ module KubesGoogle
       fetcher = Secrets::Fetcher.new(options)
       fetcher.fetch(name)
     end
+
+    def google_secret_data(name, options={})
+      generic_secret_data(:google_secret, name, options)
+    end
   end
 end

data/lib/kubes_google/secrets/fetcher/sdk.rb

@@ -16,32 +16,28 @@ class KubesGoogle::Secrets::Fetcher
       logger.info "WARN: secret #{name} not found".color(:yellow)
       logger.info e.message
       "NOT FOUND #{name}" # simple string so Kubernetes YAML is valid
-    end
-
-    # TODO: Get the project from the list project api instead. Unsure where the docs are for this.
-    # If someone knows, let me know.
-    # Right now grabbing the first secret to then be able to get the google project number
-    @@project_number = nil
-    def project_number
-      return @@project_number if @@project_number
-
-      parent = "projects/#{@project_id}"
-      resp = secret_manager_service.list_secrets(parent: parent) # note: page_size doesnt seem to get respected
-      name = resp.first.name # IE: projects/686010496118/secrets/demo-dev-db_host
-      @@project_number = name.split('/')[1]
     rescue Google::Cloud::UnavailableError => e
       logger.error "ERROR: #{e.message}"
       if e.message.include?("failed to connect")
         logger.info <<~EOL
-          SSL Handshake failed. This error seems to happen with some VPN setups.
-          Please try the gcloud fetcher instead. To set up see:
+          WARNING: SSL Handshake failed. This error seems to happen with some VPN setups.
+          You can turn off this warning by setting the gcloud fetcher instead.
+          To set up see:
 
             https://kubes.guru/docs/helpers/google/secrets/#fetcher-strategy
         EOL
-        exit 1
+        raise KubesGoogle::VpnSslError
       else
         raise
       end
     end
+
+  private
+    @@project_number = nil
+    def project_number
+      return @@project_number if @@project_number
+      project = resource_manager.project(@project_id)
+      @@project_number = project.project_number
+    end
   end
 end

data/lib/kubes_google/secrets/fetcher.rb

@@ -1,12 +1,20 @@
 class KubesGoogle::Secrets
   class Fetcher
+    include KubesGoogle::Logging
     extend Memoist
 
     def initialize(options={})
       @options = options
     end
 
+    @@cache = {}
     def fetch(short_name)
+      return @@cache[short_name] if @@cache[short_name]
+      logger.debug "Fetching secret: #{short_name}"
+      @@cache[short_name] = fetcher.fetch(short_name)
+    rescue KubesGoogle::VpnSslError
+      logger.info "Retry fetching secret with the gcloud strategy"
+      fetcher = Gcloud.new(@options)
       fetcher.fetch(short_name)
     end
 

data/lib/kubes_google/service_account.rb

@@ -40,6 +40,7 @@ module KubesGoogle
       sh "gcloud iam service-accounts add-iam-policy-binding \
                 --role roles/iam.workloadIdentityUser \
                 --member #{member} \
+                --condition=None \
                 #{@service_account}".squish
     end
 
@@ -70,6 +71,7 @@ module KubesGoogle
 
       sh "gcloud projects add-iam-policy-binding #{@google_project} \
           --member=serviceAccount:#{@service_account} \
+          --condition=None \
           --role=#{role} > /dev/null".squish
     end
   end

data/lib/kubes_google/services.rb

@@ -1,3 +1,4 @@
+require "google-cloud-resource_manager"
 require "google-cloud-secret_manager"
 require "google/cloud/container"
 
@@ -14,6 +15,11 @@ module KubesGoogle
       Google::Cloud::SecretManager.secret_manager_service
     end
     memoize :secret_manager_service
+
+    def resource_manager
+      Google::Cloud.new.resource_manager
+    end
+    memoize :resource_manager
   end
 end
 

data/lib/kubes_google/version.rb

@@ -1,3 +1,3 @@
 module KubesGoogle
-  VERSION = "0.3.5"
+  VERSION = "0.3.9"
 end

data/lib/kubes_google.rb

@@ -6,6 +6,7 @@ KubesGoogle::Autoloader.setup
 
 module KubesGoogle
   class Error < StandardError; end
+  class VpnSslError < StandardError; end
 
   @@logger = nil
   def logger

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: kubes_google
 version: !ruby/object:Gem::Version
-  version: 0.3.5
+  version: 0.3.9
 platform: ruby
 authors:
 - Tung Nguyen
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-11-12 00:00:00.000000000 Z
+date: 2022-02-16 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport
@@ -38,6 +38,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '0'
+- !ruby/object:Gem::Dependency
+  name: google-cloud-resource_manager
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 - !ruby/object:Gem::Dependency
   name: google-cloud-secret_manager
   requirement: !ruby/object:Gem::Requirement
@@ -146,7 +160,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.1.4
+rubygems_version: 3.2.32
 signing_key: 
 specification_version: 4
 summary: Kubes Google Helpers Library