kuby-core 0.16.0 → 0.18.0

data/lib/kuby/plugins/nginx_ingress.rb

@@ -1,23 +1,25 @@
 # typed: true
+
 require 'kube-dsl'
 
 module Kuby
   module Plugins
     class NginxIngress < ::Kuby::Plugin
+      depends_on :kubernetes, '>= 1.20'
+
       class Config
         extend ::KubeDSL::ValueFields
 
         value_fields :provider
       end
 
-      VERSION = '0.27.1'.freeze
-      DEFAULT_PROVIDER = 'cloud-generic'.freeze
+      VERSION = '1.1.1'.freeze
+      DEFAULT_PROVIDER = 'cloud'.freeze
       NAMESPACE = 'ingress-nginx'.freeze
-      SERVICE_NAME = 'ingress-nginx'.freeze
+      SERVICE_NAME = 'ingress-nginx-controller'.freeze
 
       SETUP_RESOURCES = [
-        "https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-#{VERSION}/deploy/static/mandatory.yaml",
-        "https://raw.githubusercontent.com/kubernetes/ingress-nginx/nginx-#{VERSION}/deploy/static/provider/%{provider}.yaml"
+        "https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v#{VERSION}/deploy/static/provider/%{provider}/deploy.yaml"
       ].freeze
 
       def configure(&block)
@@ -54,7 +56,7 @@ module Kuby
       private
 
       def already_deployed?
-        kubernetes_cli.get_object('Service', 'ingress-nginx', 'ingress-nginx')
+        kubernetes_cli.get_object('Service', NAMESPACE, SERVICE_NAME)
         true
       rescue KubernetesCLI::GetResourceError
         return false

data/lib/kuby/plugins/rails_app/assets.rb

@@ -28,19 +28,31 @@ module Kuby
             http do
               path do
                 path spec.asset_url
+                path_type 'Prefix'
 
                 backend do
-                  service_name spec.service.metadata.name
-                  service_port spec.service.spec.ports.first.port
+                  service do
+                    name spec.service.metadata.name
+
+                    port do
+                      name spec.service.spec.ports.first.name
+                    end
+                  end
                 end
               end
 
               path do
                 path spec.packs_url
+                path_type 'Prefix'
 
                 backend do
-                  service_name spec.service.metadata.name
-                  service_port spec.service.spec.ports.first.port
+                  service do
+                    name spec.service.metadata.name
+
+                    port do
+                      name spec.service.spec.ports.first.name
+                    end
+                  end
                 end
               end
             end

data/lib/kuby/plugins/rails_app/assets_image.rb

@@ -11,35 +11,42 @@ module Kuby
         end
 
         def new_version
-          # Asset images track the base image, so return the current version
-          # here. There can be no asset image without a base image.
-          current_version
+          # asset images track the app image
+          duplicate_with_annotated_tags(
+            base_image.new_version.exists? ? base_image.new_version : base_image.current_version
+          )
         end
 
         def current_version
-          @current_version ||= duplicate_with_annotated_tags(
+          duplicate_with_annotated_tags(
             base_image.current_version
           )
         end
 
         def previous_version
-          @previous_version ||= duplicate_with_annotated_tags(
+          duplicate_with_annotated_tags(
             base_image.previous_version
           )
         end
 
-        def build(build_args = {}, docker_args = [])
-          unless ENV.fetch('RAILS_MASTER_KEY', '').empty?
-            build_args['RAILS_MASTER_KEY'] = ENV['RAILS_MASTER_KEY']
-          end
-
-          docker_cli.build(current_version, build_args: build_args, docker_args: docker_args)
+        def build(build_args = {}, docker_args = [], context: nil, cache_from: nil)
+          docker_cli.build(
+            self,
+            build_args: build_args,
+            docker_args: docker_args,
+            context: context,
+            cache_from: cache_from
+          )
         end
 
         def push(tag)
           docker_cli.push(image_url, tag)
         end
 
+        def pull(tag)
+          docker_cli.pull(image_url, tag)
+        end
+
         private
 
         def duplicate_with_annotated_tags(image)

data/lib/kuby/plugins/rails_app/crdb/plugin.rb

@@ -0,0 +1,473 @@
+# typed: ignore
+
+require 'fileutils'
+require 'kuby/crdb'
+require 'kube-dsl'
+
+module Kuby
+  module Plugins
+    module RailsApp
+      module CRDB
+        class Plugin < ::Kuby::Plugin
+          ROLE = 'web'.freeze
+          VERSION = '21.1.11'.freeze
+          BOOTSTRAP_TIMEOUT_INTERVAL = 2
+          BOOTSTRAP_TIMEOUT_TOTAL = 60
+          CLIENT_PERMISSIONS = %w(create drop select insert delete update).freeze
+
+          attr_reader :environment, :configs
+
+          def initialize(environment, configs)
+            @environment = environment
+            @configs = configs
+
+            add_client_user('root')
+            add_client_user(client_username)
+          end
+
+          def add_client_user(username, &block)
+            crdb = self
+            safe_username = slugify(username)
+
+            client_certs[username] ||= Kuby::CertManager.certificate do
+              api_version 'cert-manager.io/v1'
+
+              metadata do
+                name "#{crdb.base_name}-crdb-#{safe_username}-cert"
+                namespace crdb.kubernetes.namespace.metadata.name
+              end
+
+              spec do
+                common_name username
+                secret_name "#{crdb.base_name}-crdb-client-#{safe_username}-cert"
+
+                subject do
+                  organizations ['Kuby']
+                end
+
+                usages ['client auth']
+                duration "#{5 * 365 * 24}h"  # 5 years validity (in hours)
+
+                private_key do
+                  algorithm 'RSA'
+                  size 2048
+                end
+
+                issuer_ref do
+                  name crdb.issuer.metadata.name
+                  kind 'Issuer'
+                  group 'cert-manager.io'
+                end
+              end
+            end
+
+            client_certs[username].instance_eval(&block) if block
+            client_certs[username]
+          end
+
+          alias_method :configure_client_user, :add_client_user
+
+          def client_certs
+            @client_certs ||= {}
+          end
+
+          def name
+            :cockroachdb
+          end
+
+          def resources
+            @resources ||= [
+              database,
+              cluster_issuer, issuer,
+              ca_cert, node_cert, *client_certs.values
+            ]
+          end
+
+          def after_configuration
+            environment.docker.package_phase.add(:postgres_dev)
+            environment.docker.package_phase.add(:postgres_client)
+
+            environment.kubernetes.add_plugin(:crdb)
+            environment.kubernetes.add_plugin(:cert_manager)
+          end
+
+          def bootstrap
+            require 'pg'
+
+            config = configs[environment.name]
+            database_name = config['database']
+            start_time = Time.now
+
+            conn = loop do
+              Kuby.logger.info('Waiting for successful database connection...')
+
+              begin
+                conn = PG.connect(
+                  dbname: database_name,
+                  user: 'root',
+                  host: host,
+                  port: 26257,
+                  sslmode: 'require',
+                  sslrootcert: '/cockroach/cockroach-certs/ca.crt',
+                  sslcert: '/cockroach/cockroach-certs/client.root.crt',
+                  sslkey: '/cockroach/cockroach-certs/client.root.key',
+                  connect_timeout: BOOTSTRAP_TIMEOUT_INTERVAL
+                )
+              rescue PG::ConnectionBad => e
+                if (Time.now - start_time) > BOOTSTRAP_TIMEOUT_TOTAL
+                  Kuby.logger.fatal("Database connection failed, waited #{BOOTSTRAP_TIMEOUT_TOTAL}")
+                  raise e
+                end
+
+                sleep 1  # breathe!
+              else
+                Kuby.logger.info('Database connection succeeded')
+                break conn
+              end
+            end
+
+            existing_databases = conn.exec('show databases').to_a
+
+            if existing_databases.none? { |db| db['database_name'] == database_name }
+              conn.exec("create database #{database_name}")
+            end
+
+            existing_users = conn.exec('show users').to_a.map { |u| u['username'] }
+
+            client_certs.each do |username, _cert|
+              unless existing_users.include?(username)
+                conn.exec("create user #{username}")
+              end
+
+              conn.exec(
+                "grant #{CLIENT_PERMISSIONS.join(',')} "\
+                  "on database #{database_name} "\
+                  "to #{username}"
+              )
+            end
+          end
+
+          def kubernetes_cli
+            provider.kubernetes_cli
+          end
+
+          def provider
+            environment.kubernetes.provider
+          end
+
+          def configure_pod_spec(pod_spec)
+            crdb = self
+
+            pod_spec.containers.each do |container|
+              configure_container(container)
+            end
+
+            pod_spec.init_containers.each do |init_container|
+              configure_container(init_container)
+            end
+
+            pod_spec.volume do
+              name "#{crdb.base_name}-crdb-certs"
+
+              projected do
+                source do
+                  secret do
+                    name crdb.node_cert.spec.secret_name
+
+                    item do
+                      key 'ca.crt'
+                      path 'ca.crt'
+                    end
+                  end
+                end
+
+                crdb.client_certs.each do |username, cert|
+                  source do
+                    secret do
+                      name cert.spec.secret_name
+
+                      item do
+                        key 'tls.crt'
+                        path "client.#{username}.crt"
+                      end
+
+                      item do
+                        key 'tls.key'
+                        path "client.#{username}.key"
+                      end
+                    end
+                  end
+                end
+
+                # read-only for user
+                # http://permissions-calculator.org/decode/0400/
+                default_mode 0400
+              end
+            end
+          end
+
+          def configure_container(container)
+            crdb = self
+
+            container.volume_mount do
+              name "#{crdb.base_name}-crdb-certs"
+              mount_path '/cockroach/cockroach-certs/'
+            end
+          end
+
+          def host
+            # host is the same as the name thanks to k8s DNS
+            @host ||= "#{database.metadata.name}-public"
+          end
+
+          def rewritten_configs
+            # deep dup
+            @rewritten_configs ||= Marshal.load(Marshal.dump(configs)).tap do |new_configs|
+              new_config = new_configs[environment.name]
+              new_config.delete('password')
+              new_config.merge!(
+                'username' => client_username,
+                'host' => host,
+                'port' => 26257,
+                'sslmode' => 'require',
+                'sslrootcert' => '/cockroach/cockroach-certs/ca.crt',
+                'sslcert' => "/cockroach/cockroach-certs/client.#{client_username}.crt",
+                'sslkey' => "/cockroach/cockroach-certs/client.#{client_username}.key"
+              )
+            end
+          end
+
+          def storage(amount)
+            database do
+              spec do
+                data_store do
+                  pvc do
+                    spec do
+                      resources do
+                        requests do
+                          set :storage, amount
+                        end
+                      end
+                    end
+                  end
+                end
+              end
+            end
+          end
+
+          def database(&block)
+            crdb = self
+
+            @database ||= Kuby::CRDB.crdb_cluster do
+              metadata do
+                # this translates to the name of the statefulset that is created
+                name "#{crdb.base_name}-crdb"
+                namespace crdb.kubernetes.namespace.metadata.name
+              end
+
+              spec do
+                data_store do
+                  pvc do
+                    spec do
+                      access_modes ['ReadWriteOnce']
+                      resources do
+                        requests do
+                          add :storage, '10Gi'
+                        end
+                      end
+
+                      volume_mode 'Filesystem'
+                    end
+                  end
+                end
+
+                resources do
+                  requests do
+                    add :cpu, '200m'
+                    add :memory, '1Gi'
+                  end
+
+                  limits do
+                    add :cpu, '200m'
+                    add :memory, '1Gi'
+                  end
+                end
+
+                tls_enabled true
+                client_tls_secret crdb.client_certs['root'].spec.secret_name
+                node_tls_secret crdb.node_cert.spec.secret_name
+
+                image do
+                  name "cockroachdb/cockroach:v#{VERSION}"
+                end
+
+                # this is unfortunately the minimum
+                nodes 3
+              end
+            end
+          end
+
+          def cluster_issuer
+            crdb = self
+
+            @cluster_issuer ||= Kuby::CertManager.cluster_issuer do
+              api_version 'cert-manager.io/v1'
+
+              metadata do
+                name "#{crdb.base_name}-crdb-ca-issuer"
+              end
+
+              spec do
+                self_signed
+              end
+            end
+          end
+
+          def issuer
+            crdb = self
+
+            @issuer ||= Kuby::CertManager.issuer do
+              api_version 'cert-manager.io/v1'
+
+              metadata do
+                name "#{crdb.base_name}-crdb-issuer"
+                namespace crdb.kubernetes.namespace.metadata.name
+              end
+
+              spec do
+                ca do
+                  secret_name crdb.ca_cert.spec.secret_name
+                end
+              end
+            end
+          end
+
+          def ca_cert
+            crdb = self
+
+            @ca_cert ||= Kuby::CertManager.certificate do
+              api_version 'cert-manager.io/v1'
+
+              metadata do
+                name "#{crdb.base_name}-crdb-ca-cert"
+                namespace crdb.kubernetes.namespace.metadata.name
+              end
+
+              spec do
+                is_ca true
+                common_name 'ca'
+                secret_name "#{crdb.base_name}-crdb-ca-cert"
+
+                subject do
+                  organizations ['Kuby']
+                end
+
+                usages ['digital signature', 'key encipherment', 'cert sign', 'crl sign']
+                duration "#{5 * 365 * 24}h"  # 5 years validity (in hours)
+
+                private_key do
+                  algorithm 'RSA'
+                  size 2048
+                end
+
+                issuer_ref do
+                  name crdb.cluster_issuer.metadata.name
+                  kind 'ClusterIssuer'
+                  group 'cert-manager.io'
+                end
+              end
+            end
+          end
+
+          def node_cert
+            crdb = self
+            ns = kubernetes.namespace.metadata.name
+
+            @node_cert ||= Kuby::CertManager.certificate do
+              api_version 'cert-manager.io/v1'
+
+              metadata do
+                name "#{crdb.base_name}-crdb-node-cert"
+                namespace ns
+              end
+
+              spec do
+                common_name 'node'
+                secret_name "#{crdb.base_name}-crdb-node-cert"
+
+                subject do
+                  organizations ['Kuby']
+                end
+
+                usages ['client auth', 'server auth']
+                duration "#{5 * 365 * 24}h"  # 5 years validity (in hours)
+
+                svc_name = "#{crdb.base_name}-crdb"
+
+                dns_names [
+                  'localhost',
+                  "#{svc_name}-public",
+                  "#{svc_name}-public.#{ns}",
+                  "#{svc_name}-public.#{ns}.svc.cluster.local",
+                  "*.#{svc_name}",
+                  "*.#{svc_name}.#{ns}",
+                  "*.#{svc_name}.#{ns}.svc.cluster.local",
+                ]
+
+                ip_addresses ['127.0.0.1']
+
+                private_key do
+                  algorithm 'RSA'
+                  size 2048
+                end
+
+                issuer_ref do
+                  name crdb.issuer.metadata.name
+                  kind 'Issuer'
+                  group 'cert-manager.io'
+                end
+              end
+            end
+          end
+
+          def client_username
+            @client_username ||= slugify(kubernetes.selector_app)
+          end
+
+          # replaces all non-ascii characters with an underscore
+          def slugify(str)
+            str.gsub(/\W/, '_')
+          end
+
+          def base_name
+            @base_name ||= "#{kubernetes.selector_app}-#{ROLE}"
+          end
+
+          def kubernetes
+            environment.kubernetes
+          end
+
+          def rails_app
+            kubernetes.plugin(:rails_app)
+          end
+
+          private
+
+          def config
+            configs[environment.name]
+          end
+        end
+      end
+    end
+  end
+end
+
+Kuby.register_package(:postgres_dev,
+  debian: 'postgresql-client',
+  alpine: 'postgresql-dev'
+)
+
+Kuby.register_package(:postgres_client,
+  debian: 'postgresql-client',
+  alpine: 'postgresql-client'
+)

data/lib/kuby/plugins/rails_app/crdb.rb

@@ -0,0 +1,9 @@
+module Kuby
+  module Plugins
+    module RailsApp
+      module CRDB
+        autoload :Plugin, 'kuby/plugins/rails_app/crdb/plugin'
+      end
+    end
+  end
+end

data/lib/kuby/plugins/rails_app/database.rb

@@ -1,4 +1,5 @@
-# typed: false
+# typed: ignore
+
 require 'yaml'
 
 module Kuby
@@ -7,11 +8,8 @@ module Kuby
       class UnsupportedDatabaseError < StandardError; end
 
       class Database
-        ADAPTER_MAP = {
-          sqlite3: Sqlite,
-          mysql2: MySQL,
-          postgresql: Postgres
-        }.freeze
+        # only support cockroach for now
+        ADAPTER_MAP = { cockroachdb: CRDB::Plugin, sqlite3: Sqlite }.freeze
 
         def self.get(rails_app)
           if rails_app.manage_database?
@@ -21,7 +19,7 @@ module Kuby
 
         def self.get_adapter(adapter_name)
           ADAPTER_MAP.fetch(adapter_name) do
-            raise UnsupportedDatabaseError, "Kuby does not support the '#{adapter}' "\
+            raise UnsupportedDatabaseError, "Kuby does not support the '#{adapter_name}' "\
               'database adapter'
           end
         end
@@ -51,7 +49,13 @@ module Kuby
         end
 
         def db_configs
-          @db_configs ||= YAML.load(File.read(db_config_path))
+          @db_configs ||= begin
+            if Psych::VERSION > '4'
+              YAML.load(File.read(db_config_path), aliases: true)
+            else ArgumentError
+              YAML.load(File.read(db_config_path))
+            end
+          end
         end
 
         def db_config_path