matsuri 0.1.0 → 0.3.0

data/lib/matsuri/core_ext.rb

@@ -0,0 +1,107 @@
+# frozen_string_literal: true
+
+# Vendored replacements for the ActiveSupport core_ext methods matsuri
+# depends on. These are monkeypatches rather than refinements because
+# definition files in downstream matsuri repos evaluate inside this
+# process and call these methods ambiently; refinements would not reach
+# them.
+
+module Matsuri
+  module CoreExt
+    module_function
+
+    def deep_transform_keys(object, &block)
+      case object
+      when Hash  then object.each_with_object({}) { |(k, v), h| h[yield(k)] = deep_transform_keys(v, &block) }
+      when Array then object.map { |e| deep_transform_keys(e, &block) }
+      else object
+      end
+    end
+  end
+end
+
+class Hash
+  def symbolize_keys
+    transform_keys { |key| key.to_sym rescue key }
+  end
+
+  def stringify_keys
+    transform_keys(&:to_s)
+  end
+
+  def deep_symbolize_keys
+    deep_transform_keys { |key| key.to_sym rescue key }
+  end
+
+  def deep_stringify_keys
+    deep_transform_keys(&:to_s)
+  end
+
+  def deep_transform_keys(&block)
+    Matsuri::CoreExt.deep_transform_keys(self, &block)
+  end
+end
+
+class Object
+  def try(method_name = nil, *args, &block)
+    if method_name.nil? && block
+      block.arity.zero? ? instance_eval(&block) : yield(self)
+    elsif respond_to?(method_name)
+      public_send(method_name, *args, &block)
+    end
+  end
+
+  def blank?
+    respond_to?(:empty?) ? !!empty? : !self
+  end
+
+  def present?
+    !blank?
+  end
+
+  def presence
+    self if present?
+  end
+end
+
+class NilClass
+  def try(*)
+    nil
+  end
+end
+
+class String
+  BLANK_RE = /\A[[:space:]]*\z/
+
+  def blank?
+    empty? || BLANK_RE.match?(self)
+  end
+
+  def camelize
+    sub(/^[a-z\d]*/) { |match| match.capitalize }
+      .gsub(%r{(?:_|(/))([a-z\d]*)}i) { "#{Regexp.last_match(1)}#{Regexp.last_match(2).capitalize}" }
+      .gsub('/', '::')
+  end
+end
+
+class Class
+  def class_attribute(*names)
+    names.each do |name|
+      ivar = :"@#{name}"
+
+      define_singleton_method(name) do
+        if instance_variable_defined?(ivar)
+          instance_variable_get(ivar)
+        elsif superclass.respond_to?(name)
+          superclass.public_send(name)
+        end
+      end
+
+      define_singleton_method("#{name}=") do |value|
+        instance_variable_set(ivar, value)
+      end
+
+      define_method(name) { self.class.public_send(name) }
+    end
+  end
+end

data/lib/matsuri/dsl/cluster/aggregated_cluster_role.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+module Matsuri
+  module DSL
+    module Cluster
+      # Cluster resources here in Matsuri are a bit different as the are meant to
+      # be driven by the cluster dsl
+      class AggregatedClusterRole < Matsuri::DSL::Cluster::Role
+        attr_accessor :aggregation_selectors
+
+        let(:kind)        { 'ClusterRole' }
+
+        let(:manifest) do
+          {
+            apiVersion:  api_version,
+            kind:        kind,
+            metadata:    final_metadata,
+            aggregationRule: { clusterRoleSelectors: aggregation_selectors }
+          }
+        end
+
+        # Cluster Roles are not namespaced. Override from MetadataDsl concern
+        let(:default_metadata) { { name: name, labels: final_labels, annotations: final_annotations } }
+
+        def initialize(options = {}, &block)
+          self.aggregation_selectors = []
+          super
+        end
+
+        ### DSL Helper
+
+        # Match helper for creating selectors for aggregated cluster roles
+        # Examples:
+        #   match 'example.com/aggregate-to-monitor' => true
+        #   match 'example.com/aggregate-to-monitor', 
+        def match(*args)
+          case
+          when args[0].is_a?(Hash)        then match_labels(args[0])
+          when args.length.between?(2, 3) then match_expression(*args)
+          else
+            fail ArgumentError, <<-EOT
+              match helper requires one of the following formats
+
+              match key: value, key: value
+              match key, operator
+              match key, operator, value
+
+              Arguments received: #{args.inspect}
+              EOT
+          end
+        end
+
+        def match_labels(selectors = {})
+          aggregation_selectors << selectors
+        end
+
+        def match_expression(key, operator, value = nil)
+          aggregation_selectors << { key: key, operator: map_match_operator(operator), value: value }.compact
+        end
+
+        def map_match_operator(operator)
+          case operator
+          when 'In', 'in', :in                                   then 'In'
+          when 'NotIn', 'not_in', :not_in                        then 'NotIn'
+          when 'Exists', 'exists', :exists                       then 'Exists'
+          when 'DoesNotExist', 'does_not_exist', :does_not_exist then 'DoesNotExist'
+          else
+            fail ArgumentError, "Invalid match expression operator: #{operator}"
+          end
+        end
+      end
+    end
+  end
+end
+

data/lib/matsuri/dsl/cluster/binding.rb

@@ -0,0 +1,118 @@
+# frozen_string_literal: true
+
+require 'rlet'
+
+module Matsuri
+  module DSL
+    module Cluster
+      # This DSL covers both RoleBinding and ClusterRoleBinding
+      # Defaults:
+      #   - binding_type determines default for role_ref.kind unless overridden
+      #   - role ref name defaults to the name of this binding
+      #   - role ref kind defaults to equivalent kind for this binding
+      #   - role ref api_group defaults to rbac.authorization.kubernetes.io
+      #   - subject namespace defaults to namespace for this binding
+      #   - subject api_group defaults to rbac.authorization.kubernetes.io for User and Group
+      #   - subject api_group defaults to "" (core) for other kinds (ServiceAccounts)
+      class Binding
+        include Let
+        include Matsuri::Concerns::ExportManifest
+        include Matsuri::DSL::Concerns::Metadata
+        include Matsuri::DSL::Concerns::ManifestSet
+
+        attr_accessor :role_ref, :subjects
+
+        ### Parameters
+        let(:binding_type)   { options[:type] }
+
+        ### Manifest Set
+        let(:rbac_manifests) { subjects.any? ? manifest : nil } # Return manifest only if there are subjects defined for binding
+
+        ### Manifest
+        let(:api_version)    { Matsuri::Config.rbac_api_version }
+        let(:final_role_ref) { role_ref || default_role_ref }
+        let(:manifest) do
+          {
+            apiVersion:  api_version,
+            kind:        kind,
+            metadata:    final_metadata,
+            roleRef:     final_role_ref,
+            subjects:    subjects
+          }
+        end
+
+        let(:kind) do
+          case binding_type
+          when :role, 'Role', 'role'                        then 'RoleBinding'
+          when :cluster_role, 'ClusterRole', 'cluster_role' then 'ClusterRoleBinding'
+          else
+            fail ArgumentError, "binding_type must be one of :role or :cluster_role, is: #{binding_type.inspect}"
+          end
+        end
+
+        let(:default_role_ref)           { { kind: default_role_ref_kind, name: default_role_ref_name, apiGroup: default_role_ref_api_group } }
+        let(:default_role_ref_name)      { name }
+        let(:default_role_ref_api_group) { 'rbac.authorization.k8s.io' }
+        let(:default_role_ref_kind)      { map_binding_type_to_kind(binding_type) }
+
+        def initialize(options = {}, &block)
+          initialize_metadata_dsl(options)
+          self.subjects = []
+
+          configure(&block) if block
+        end
+
+        def configure(&block)
+          instance_eval(&block)
+        end
+
+        ### DSL Helpers
+        def reference(type, name = default_role_ref_name, api_group: default_role_ref_api_group)
+          self.role_ref = {
+            kind:     map_binding_type_to_kind(type),
+            name:     name,
+            apiGroup: api_group
+          }
+        end
+
+        def subject(name, kind:, namespace: nil, api_group: nil)
+          self.subjects << {
+            name:      name,
+            kind:      map_subject_type_to_kind(kind),
+            namespace: namespace,
+            apiGroup:  api_group || default_subject_api_group(kind)
+          }.compact
+        end
+
+        ### Helpers
+        def map_binding_type_to_kind(type)
+          case type
+          when :role, 'Role', 'role'                        then 'Role'
+          when :cluster_role, 'ClusterRole', 'cluster_role' then 'ClusterRole'
+          else
+            fail ArgumentError, "binding type must be one of :role or :cluster_role, is: #{type.inspect}"
+          end
+        end
+
+        def map_subject_type_to_kind(type)
+          case type
+          when :user then 'User'
+          when :group then 'Group'
+          when :service_account then 'ServiceAccount'
+          else
+            fail ArgumentError, "subject type must be one of :user, :group, :service_account, is: #{type.inspect}"
+          end
+        end
+
+        def default_subject_api_group(type)
+          case type
+          when :user, :group then 'rbac.authorization.k8s.io'
+          when :service_account then ''
+          else
+            fail ArgumentError, "subject type must be one of :user, :group, :service_account, is: #{type.inspect}"
+          end
+        end
+      end
+    end
+  end
+end

data/lib/matsuri/dsl/cluster/cluster_role.rb

@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+module Matsuri
+  module DSL
+    module Cluster
+      # Cluster resources here in Matsuri are a bit different as the are meant to
+      # be driven by the cluster dsl
+      class ClusterRole < Matsuri::DSL::Cluster::Role
+        let(:kind)        { 'ClusterRole' }
+
+        let(:manifest) do
+          {
+            apiVersion:  api_version,
+            kind:        kind,
+            metadata:    final_metadata,
+            rules:       rules
+          }
+        end
+
+        # Cluster Roles are not namespaced. Override from MetadataDsl concern
+        let(:default_metadata) { { name: name, labels: final_labels, annotations: final_annotations } }
+
+        ### DSL Helper
+
+        # Use these to add urls to the rules
+        # nonResourceURLs apply only to ClusterRoles
+        def urls(urls, verbs: nil, api_groups: nil)
+          rule api_groups: api_groups, urls: urls, verbs: verbs
+        end
+
+        # Helper to aggregate cluster role to admin, edit, view, and other similar tags
+        def aggregate_to(*tags)
+          tags.flatten.each do |tag|
+            label "rbac.authorization.k8s.io/aggregate-to-#{tag}", 'true'
+          end
+        end
+      end
+    end
+  end
+end
+

data/lib/matsuri/dsl/cluster/role.rb

@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+require 'rlet'
+
+module Matsuri
+  module DSL
+    module Cluster
+      # Cluster resources here in Matsuri are a bit different as the are meant to
+      # be driven by the cluster dsl
+      class Role
+        include Let
+        include Matsuri::Concerns::ExportManifest
+        include Matsuri::DSL::Concerns::Metadata
+        include Matsuri::DSL::Concerns::RbacRules
+        include Matsuri::DSL::Concerns::DefaultBinding
+        include Matsuri::DSL::Concerns::ManifestSet
+
+        let(:api_version) { Matsuri::Config.rbac_api_version }
+        let(:kind)        { 'Role' }
+
+        ### Manifest Set
+        let(:rbac_manifests) { [manifest, default_binding.rbac_manifests].compact }
+
+        ### Manifest
+
+        let(:manifest) do
+          {
+            apiVersion:  api_version,
+            kind:        kind,
+            metadata:    final_metadata,
+            rules:       rules
+          }
+        end
+
+        def initialize(options = {}, &block)
+          initialize_metadata_dsl(options)
+          initialize_rbac_rules_dsl
+
+          configure(&block) if block
+        end
+
+        def configure(&block)
+          instance_eval(&block)
+        end
+      end
+    end
+  end
+end
+

data/lib/matsuri/dsl/cluster/scope.rb

@@ -0,0 +1,245 @@
+# frozen_string_literal: true
+
+require 'rlet'
+require 'matsuri/core_ext'
+
+module Matsuri
+  module DSL
+    module Cluster
+      # Non K8S object. This class encapsulates the idea of a scope for the DSL. Currently,
+      # the only attribute accepted by the scope is namespace. This is also the
+      # entry point for the DSL.
+      class Scope
+        include Let
+        include Matsuri::DSL::Concerns::ManifestSet
+
+        # @TODO see if kubectl reconcile will also handle the general resources
+        # If not, we will have to reconcile rbac resources and apply the rest
+        attr_accessor :definitions, :options
+
+        let(:current_namespace) { options[:namespace]  }
+        let(:source_file)       { parent_scope[:source_file] }
+        let(:skip?)             { options[:skip] }
+
+        let(:parent_scope)      { options[:scoped_options] || {} }
+
+        let(:scoped_options) do
+          {
+            namespace:   current_namespace,
+            source_file: source_file,
+            skip:        skip?
+          }
+        end
+
+        def initialize(options = {}, &block)
+          self.definitions = []
+          self.options = options
+          instance_eval(&block) if block
+        end
+
+        # Load and evaluate from a filename.
+        # Set the filename and line number so # that errors are correctly reported
+        # Inject the relative source path so manifests can be tracked back to a source file
+        def self.from_filename(filename, scoped_options = {})
+          relative_source = filename.sub(/^#{File.join(Matsuri::Config.base_path, '/')}/, '')
+          child_scope = scoped_options.merge(source_file: relative_source)
+          # Always return the newly created scope regardless of return value from evaluating
+          # the imported source file
+          new(scoped_options: child_scope).tap { |s| s.instance_eval(File.read(filename), filename, 1) }
+        end
+
+        # This could be used by the DSL, but we really should not
+        def import(filename)
+          definitions << self.class.from_filename(filename, scoped_options)
+        end
+
+        # Load and evaluate from a class.
+        # Set the filename and line number so # that errors are correctly reported
+        # Inject the relative source path so manifests can be tracked back to a source file
+        def self.from_class(klass, scoped_options = {})
+          filename, _ = klass.method(:scope_manifest).source_location
+          relative_source = filename.sub(/^#{File.join(Matsuri::Config.base_path, '/')}/, '')
+          child_scope = scoped_options.merge(source_file: relative_source)
+
+          # Create a new scope and pass it to the class
+          new_scope = new(scoped_options: child_scope)
+          klass.scope_manifest(new_scope)
+
+          new_scope
+        end
+
+        # This could be used by the DSL, but we really should not
+        def import_class(klass)
+          definitions << self.class.from_class(klass, scoped_options)
+        end
+
+        ### Manifest sets
+        let(:rbac_manifests)    { definitions.map(&descend_tree.(:rbac_manifests)) }
+        let(:cluster_manifests) { definitions.map(&descend_tree.(:cluster_manifests)) }
+        let(:descend_tree)      { ->(m) { ->(x) { x.respond_to?(m) ? x.send(m) : x.map(&m) } } }
+
+        ### DSL methods
+        def scope(options = {}, &block)
+          definitions << self.class.new(options.merge(scoped_options: scoped_options), &block)
+        end
+
+        def namespace(name, &block)
+          scope(namespace: name, &block)
+        end
+
+        # Examples:
+        # role 'role-reader', namespace: 'default', api_groups: '', resources: :pods, verbs: %w[get watch list]
+        #
+        # role 'deployer', namespace: 'default'  do
+        #   rule api_groups: '', resources: 'pods',       verbs: %w[get watch list]
+        #   rule api_groups: '', resources: 'deployments, verbs: %w[get watch list]
+        #
+        #   # `resources` are short-hand for the `rule` helper
+        #   resources :pods, verbs: %w[get watch list]
+        #   resources :pods, verbs: %w[get watch list], names: 'toolbox'
+        #   resources :deployments, verbs: %w[patch update], names: %w[legalio-web legalio-resque legalio-resque-algolia]
+        #
+        #   # Creates a single RoleBinding with the same name as the Role, in the same namespace
+        #   # All bind_to are aggregated into subjects for that RoleBinding
+        #   bind_to 'deployer', kind: :service_account # namespace defaults to role namespace
+        #   bind_to 'deployer', kind: :service_account, namespace: 'qa0'
+        #   bind_to 'alice@example.com', kind: :user
+        #   bind_to 'sysadmins', kind: :group
+        # end
+        def role(name, options = {}, &block)
+          final_options = { name: name }.merge(options).merge(scoped_options: scoped_options)
+          require_namespace!('role', final_options)
+
+          definitions << Matsuri::DSL::Cluster::Role.new(final_options).tap do |role|
+            if options[:resources].present? && options[:verbs].present?
+              role.resources(options[:resources], names: options[:resource_names], verbs: options[:verbs], api_groups: options[:api_groups])
+            end
+
+            role.configure(&block)
+          end
+        end
+
+        # cluster_role 'traefik-ingress-controller' do
+        #   # labels 'example.com/addon', 'traefik'
+        #   # aggregate_to :admin, :edit
+        #   # urls '/api', verbs: :get
+        #
+        #   resources %w[services endpoints secrets], verbs: %w[get list watch]
+        #   resources :ingresses,                     verbs: %w[get list watch], api_groups: :extensions
+        #
+        #   # Creates a single ClusterRoleBinding with the same name as the ClusterRole
+        #   # All bind_to are aggregated into subjects for that ClusterRoleBinding
+        #   bind_to 'traefik-ingress-controller', kind: :service_account, namespace: 'kube-system'
+        # end
+        def cluster_role(name, options = {}, &block)
+          forbid_namespace!('cluster_role', options)
+          final_options = { name: name }.merge(options).merge(scoped_options: scoped_options)
+
+          definitions << Matsuri::DSL::Cluster::ClusterRole.new(final_options).tap do |role|
+            if options[:resources].present? && options[:verbs].present?
+              role.resources(options[:resources], names: options[:resource_names], verbs: options[:verbs], api_groups: options[:api_groups])
+            end
+
+            role.configure(&block)
+          end
+        end
+
+        # Defines a cluster role aggregated from other roles using label selectors
+        # Examples:
+        # aggregated_cluster_role 'platform-admin' do
+        #   # Example using match labels
+        #   match 'example.com/aggregate-to-admin' => 'true',
+        #         'rails-app' => 'frontend'
+        #
+        #   # Example using match expressions
+        #   match 'legal.io/aggregate-to-admin', :in, 'true'
+        #   match 'legal.io/aggregate-to-admin', :in, %w[v1 v2 v3]
+        #   match 'legal.io/aggregate-to-admin', :not_in, 'true'
+        #   match 'legal.io/aggregate-to-admin', :not_in, 'true'
+        #   match 'legal.io/aggregate', :exists
+        #   match 'legal.io/aggregate', :does_not_exist
+        # end
+        def aggregated_cluster_role(name, options = {}, &block)
+          forbid_namespace!('aggregated_cluster_role', options)
+
+          final_options = { name: name }.merge(options).merge(scoped_options: scoped_options)
+          definitions << Matsuri::DSL::Cluster::AggregatedClusterRole.new(final_options, &block)
+        end
+
+        # Examples
+        #  bind :role, 'failover-operator', namespace: :default do
+        #    subject 'mongodb-operator', kind: :service_account, namespace: :default
+        #    subject 'redis-operator',   kind: :service_account, namespace: :default
+        #  end
+        #
+        # namespace :default do
+        #   bind :role, 'failover-operator', do
+        #     subject 'mongodb-operator', kind: :service_account, namespace: :default
+        #     subject 'redis-operator',   kind: :service_account, namespace: :default
+        #   end
+        # end
+        #
+        # bind :cluster_role, 'traefik-ingress-controller' do
+        #  subject 'traefik-ingress-controller', kind: :service_account, namespace: 'kube-system'
+        # end
+        def bind(type, name, options = {}, &block)
+          case type
+          when :role then bind_role(name, options, &block)
+          when :cluster_role then bind_cluster_role(name, options, &block)
+          else
+            fail ArgumentError, "bind type must be :role or :cluster_role. Is: #{type}"
+          end
+        end
+
+        def bind_role(name, options = {}, &block)
+          final_options = { name: name }.merge(options).merge(type: :role, scoped_options: scoped_options)
+          require_namespace!('bind_role', final_options)
+
+          definitions << Matsuri::DSL::Cluster::Binding.new(final_options, &block)
+        end
+
+        def bind_cluster_role(name, options = {}, &block)
+          forbid_namespace!('bind_cluster_role', options)
+          final_options = { name: name }.merge(options).merge(type: :cluster_role, scoped_options: scoped_options)
+
+          definitions << Matsuri::DSL::Cluster::Binding.new(final_options, &block)
+        end
+
+        # Examples:
+        # service_account 'traefik-ingress-controller', namespace: 'kube-system'
+        #
+        # service_account 'deployer' do
+        #   image_pull_secret 'gcp-private-regsitry'
+        #
+        #   secret 'gcloud-service-account'
+        #   secret 'aws-access-token'
+        # end
+        #
+        # service_account 'guest' do
+        #   automount_token false
+        # end
+        def service_account(name, options = {}, &block)
+          final_options = { name: name }.merge(options).merge(type: :role, scoped_options: scoped_options)
+          require_namespace!('service_account', final_options)
+
+          definitions << Matsuri::DSL::Cluster::ServiceAccount.new(final_options, &block)
+        end
+
+        private
+
+        def require_namespace!(helper_name, final_options)
+          return if final_options[:namespace].present? || current_namespace.present?
+
+          fail ArgumentError,
+               "#{helper_name} requires namespace to be declared. Either pass namespace as an option or declare it inside " \
+               'a namespace scope.'
+        end
+
+        def forbid_namespace!(helper_name, options)
+          fail ArgumentError, "#{helper_name} cannot be invoked inside a namespaced scope" unless current_namespace.nil?
+          fail ArgumentError, "#{helper_name} cannot be invoked with a namespace"          unless options[:namespace].nil?
+        end
+      end
+    end
+  end
+end