pepr 0.2.9 → 0.3.0-rc0

package/README.md

@@ -6,9 +6,16 @@ Pepr is on a mission to save Kubernetes from the tyranny of YAML, intimidating g
 
 ## Features
 
-- Define a set of Kubernetes transformations/actions as Pepr capabilities.
-- Write capabilities in TypeScript and bundle them for in-cluster processing in [NodeJS](https://nodejs.org/).
-- React to cluster resources by mutating them, creating new Kubernetes resources, or performing arbitrary exec/API operations.
+- Zero-config K8s webhook mutations and [validations soon](https://github.com/defenseunicorns/pepr/issues/73).
+- Human-readable fluent API for generating [Pepr Capabilities](#capability)
+- Generate new K8s resources based off of cluster resource changes
+- Perform other exec/API calls based off of cluster resources changes or any other abitrary schedule
+- Out of the box airgap support with [Zarf](https://zarf.dev)
+- Entire NPM ecosystem available for advanced operations
+- Realtime K8s debugging system for testing/reacting to cluster changes
+- Controller network isolation and tamper-resistent module execution
+- Automatic least-privilege RBAC generation [soon](https://github.com/defenseunicorns/pepr/issues/31)
+- AMD64 and ARM64 support
 
 ## Example Pepr CapabilityAction
 

package/dist/fixtures/data/cm1.json

@@ -0,0 +1,75 @@
+{
+    "uid": "6295e2a5-ad33-43d0-a508-2c5893c7d535",
+    "kind": {
+        "group": "",
+        "version": "v1",
+        "kind": "ConfigMap"
+    },
+    "resource": {
+        "group": "",
+        "version": "v1",
+        "resource": "configmaps"
+    },
+    "requestKind": {
+        "group": "",
+        "version": "v1",
+        "kind": "ConfigMap"
+    },
+    "requestResource": {
+        "group": "",
+        "version": "v1",
+        "resource": "configmaps"
+    },
+    "name": "game-demo",
+    "namespace": "apps",
+    "operation": "CREATE",
+    "userInfo": {
+        "username": "kubernetes-admin",
+        "groups": ["system:masters", "system:authenticated"]
+    },
+    "object": {
+        "kind": "ConfigMap",
+        "apiVersion": "v1",
+        "metadata": {
+            "name": "game-demo",
+            "namespace": "apps",
+            "creationTimestamp": null,
+            "annotations": {
+                "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"v1\",\"data\":{\"game.properties\":\"enemy.types=aliens,monsters\\nplayer.maximum-lives=5    \\n\",\"player_initial_lives\":\"3\"},\"kind\":\"ConfigMap\",\"metadata\":{\"annotations\":{},\"name\":\"game-demo\",\"namespace\":\"apps\"}}\n"
+            },
+            "managedFields": [
+                {
+                    "manager": "kubectl-client-side-apply",
+                    "operation": "Update",
+                    "apiVersion": "v1",
+                    "time": "2023-03-31T19:46:37Z",
+                    "fieldsType": "FieldsV1",
+                    "fieldsV1": {
+                        "f:data": {
+                            ".": {},
+                            "f:game.properties": {},
+                            "f:player_initial_lives": {}
+                        },
+                        "f:metadata": {
+                            "f:annotations": {
+                                ".": {},
+                                "f:kubectl.kubernetes.io/last-applied-configuration": {}
+                            }
+                        }
+                    }
+                }
+            ]
+        },
+        "data": {
+            "game.properties": "enemy.types=aliens,monsters\nplayer.maximum-lives=5    \n",
+            "player_initial_lives": "3"
+        }
+    },
+    "oldObject": null,
+    "dryRun": false,
+    "options": {
+        "kind": "CreateOptions",
+        "apiVersion": "meta.k8s.io/v1",
+        "fieldManager": "kubectl-client-side-apply"
+    }
+}

package/dist/fixtures/data/deployment1.json

@@ -0,0 +1,170 @@
+{
+    "uid": "b6b9e558-5b95-488e-bad4-f1d0875569bb",
+    "kind": {
+        "group": "apps",
+        "version": "v1",
+        "kind": "Deployment"
+    },
+    "resource": {
+        "group": "apps",
+        "version": "v1",
+        "resource": "deployments"
+    },
+    "requestKind": {
+        "group": "apps",
+        "version": "v1",
+        "kind": "Deployment"
+    },
+    "requestResource": {
+        "group": "apps",
+        "version": "v1",
+        "resource": "deployments"
+    },
+    "name": "nginx-deployment",
+    "namespace": "apps",
+    "operation": "CREATE",
+    "userInfo": {
+        "username": "kubernetes-admin",
+        "groups": ["system:masters", "system:authenticated"]
+    },
+    "object": {
+        "kind": "Deployment",
+        "apiVersion": "apps/v1",
+        "metadata": {
+            "name": "nginx-deployment",
+            "namespace": "apps",
+            "creationTimestamp": null,
+            "labels": {
+                "app": "nginx"
+            },
+            "annotations": {
+                "kubectl.kubernetes.io/last-applied-configuration": "{\"apiVersion\":\"apps/v1\",\"kind\":\"Deployment\",\"metadata\":{\"annotations\":{},\"labels\":{\"app\":\"nginx\"},\"name\":\"nginx-deployment\",\"namespace\":\"apps\"},\"spec\":{\"replicas\":1,\"selector\":{\"matchLabels\":{\"app\":\"nginx\"}},\"template\":{\"metadata\":{\"labels\":{\"app\":\"nginx\"}},\"spec\":{\"containers\":[{\"image\":\"nginx:1.14.2\",\"name\":\"nginx\",\"ports\":[{\"containerPort\":80}]}]}}}}\n"
+            },
+            "managedFields": [
+                {
+                    "manager": "kubectl-client-side-apply",
+                    "operation": "Update",
+                    "apiVersion": "apps/v1",
+                    "time": "2023-03-31T19:36:29Z",
+                    "fieldsType": "FieldsV1",
+                    "fieldsV1": {
+                        "f:metadata": {
+                            "f:annotations": {
+                                ".": {},
+                                "f:kubectl.kubernetes.io/last-applied-configuration": {}
+                            },
+                            "f:labels": {
+                                ".": {},
+                                "f:app": {}
+                            }
+                        },
+                        "f:spec": {
+                            "f:progressDeadlineSeconds": {},
+                            "f:replicas": {},
+                            "f:revisionHistoryLimit": {},
+                            "f:selector": {},
+                            "f:strategy": {
+                                "f:rollingUpdate": {
+                                    ".": {},
+                                    "f:maxSurge": {},
+                                    "f:maxUnavailable": {}
+                                },
+                                "f:type": {}
+                            },
+                            "f:template": {
+                                "f:metadata": {
+                                    "f:labels": {
+                                        ".": {},
+                                        "f:app": {}
+                                    }
+                                },
+                                "f:spec": {
+                                    "f:containers": {
+                                        "k:{\"name\":\"nginx\"}": {
+                                            ".": {},
+                                            "f:image": {},
+                                            "f:imagePullPolicy": {},
+                                            "f:name": {},
+                                            "f:ports": {
+                                                ".": {},
+                                                "k:{\"containerPort\":80,\"protocol\":\"TCP\"}": {
+                                                    ".": {},
+                                                    "f:containerPort": {},
+                                                    "f:protocol": {}
+                                                }
+                                            },
+                                            "f:resources": {},
+                                            "f:terminationMessagePath": {},
+                                            "f:terminationMessagePolicy": {}
+                                        }
+                                    },
+                                    "f:dnsPolicy": {},
+                                    "f:restartPolicy": {},
+                                    "f:schedulerName": {},
+                                    "f:securityContext": {},
+                                    "f:terminationGracePeriodSeconds": {}
+                                }
+                            }
+                        }
+                    }
+                }
+            ]
+        },
+        "spec": {
+            "replicas": 1,
+            "selector": {
+                "matchLabels": {
+                    "app": "nginx"
+                }
+            },
+            "template": {
+                "metadata": {
+                    "creationTimestamp": null,
+                    "labels": {
+                        "app": "nginx"
+                    }
+                },
+                "spec": {
+                    "containers": [
+                        {
+                            "name": "nginx",
+                            "image": "nginx:1.14.2",
+                            "ports": [
+                                {
+                                    "containerPort": 80,
+                                    "protocol": "TCP"
+                                }
+                            ],
+                            "resources": {},
+                            "terminationMessagePath": "/dev/termination-log",
+                            "terminationMessagePolicy": "File",
+                            "imagePullPolicy": "IfNotPresent"
+                        }
+                    ],
+                    "restartPolicy": "Always",
+                    "terminationGracePeriodSeconds": 30,
+                    "dnsPolicy": "ClusterFirst",
+                    "securityContext": {},
+                    "schedulerName": "default-scheduler"
+                }
+            },
+            "strategy": {
+                "type": "RollingUpdate",
+                "rollingUpdate": {
+                    "maxUnavailable": "25%",
+                    "maxSurge": "25%"
+                }
+            },
+            "revisionHistoryLimit": 10,
+            "progressDeadlineSeconds": 600
+        },
+        "status": {}
+    },
+    "oldObject": null,
+    "dryRun": false,
+    "options": {
+        "kind": "CreateOptions",
+        "apiVersion": "meta.k8s.io/v1",
+        "fieldManager": "kubectl-client-side-apply"
+    }
+}

package/dist/fixtures/data/ns1.json

@@ -0,0 +1,72 @@
+{
+    "uid": "e309ad02-d69b-499d-adb4-0eae6dfa5a89",
+    "kind": {
+        "group": "",
+        "version": "v1",
+        "kind": "Namespace"
+    },
+    "resource": {
+        "group": "",
+        "version": "v1",
+        "resource": "namespaces"
+    },
+    "requestKind": {
+        "group": "",
+        "version": "v1",
+        "kind": "Namespace"
+    },
+    "requestResource": {
+        "group": "",
+        "version": "v1",
+        "resource": "namespaces"
+    },
+    "name": "hijeff",
+    "namespace": "hijeff",
+    "operation": "CREATE",
+    "userInfo": {
+        "username": "kubernetes-admin",
+        "groups": ["system:masters", "system:authenticated"]
+    },
+    "object": {
+        "kind": "Namespace",
+        "apiVersion": "v1",
+        "metadata": {
+            "name": "hijeff",
+            "uid": "e8c1d87c-dff1-49c6-aa9d-ef83f2702d7f",
+            "creationTimestamp": "2023-03-31T19:42:39Z",
+            "labels": {
+                "kubernetes.io/metadata.name": "hijeff"
+            },
+            "managedFields": [
+                {
+                    "manager": "kubectl-create",
+                    "operation": "Update",
+                    "apiVersion": "v1",
+                    "time": "2023-03-31T19:42:39Z",
+                    "fieldsType": "FieldsV1",
+                    "fieldsV1": {
+                        "f:metadata": {
+                            "f:labels": {
+                                ".": {},
+                                "f:kubernetes.io/metadata.name": {}
+                            }
+                        }
+                    }
+                }
+            ]
+        },
+        "spec": {
+            "finalizers": ["kubernetes"]
+        },
+        "status": {
+            "phase": "Active"
+        }
+    },
+    "oldObject": null,
+    "dryRun": false,
+    "options": {
+        "kind": "CreateOptions",
+        "apiVersion": "meta.k8s.io/v1",
+        "fieldManager": "kubectl-create"
+    }
+}

package/dist/fixtures/data/pod1.json

@@ -0,0 +1,271 @@
+{
+    "uid": "af5c3d45-72b8-11eb-a3a3-0242ac130003",
+    "kind": {
+        "group": "",
+        "version": "v1",
+        "kind": "Pod"
+    },
+    "resource": {
+        "group": "",
+        "version": "v1",
+        "resource": "pods"
+    },
+    "subResource": "",
+    "name": "podinfo",
+    "namespace": "default",
+    "operation": "Create",
+    "userInfo": {
+        "username": "system:serviceaccount:kube-system:replicaset-controller",
+        "uid": "95c8f0ca-d31a-4d3f-9f27-9a2a2661ab3c",
+        "groups": [
+            "system:serviceaccounts",
+            "system:serviceaccounts:kube-system",
+            "system:authenticated"
+        ]
+    },
+    "oldObject": {},
+    "dryRun": false,
+    "options": null,
+    "object": {
+        "apiVersion": "v1",
+        "kind": "Pod",
+        "metadata": {
+            "annotations": {
+                "prometheus.io/port": "9898",
+                "prometheus.io/scrape": "true"
+            },
+            "creationTimestamp": "2023-03-07T07:48:13Z",
+            "generateName": "cool-name-podinfo-66bbff7cf4-",
+            "labels": {
+                "app.kubernetes.io/name": "cool-name-podinfo",
+                "pod-template-hash": "66bbff7cf4",
+                "zarf-agent": "patched"
+            },
+            "name": "cool-name-podinfo-66bbff7cf4-fwhl2",
+            "namespace": "helm-releasename",
+            "ownerReferences": [
+                {
+                    "apiVersion": "apps/v1",
+                    "blockOwnerDeletion": true,
+                    "controller": true,
+                    "kind": "ReplicaSet",
+                    "name": "cool-name-podinfo-66bbff7cf4",
+                    "uid": "41d30484-6ccd-462b-b96a-e166095e3681"
+                }
+            ],
+            "resourceVersion": "46512",
+            "uid": "883303bc-e4b7-4fa8-a576-575cc4407201"
+        },
+        "spec": {
+            "containers": [
+                {
+                    "command": [
+                        "./podinfo",
+                        "--port=9898",
+                        "--cert-path=/data/cert",
+                        "--port-metrics=9797",
+                        "--grpc-port=9999",
+                        "--grpc-service-name=podinfo",
+                        "--level=info",
+                        "--random-delay=false",
+                        "--random-error=false"
+                    ],
+                    "env": [
+                        {
+                            "name": "PODINFO_UI_COLOR",
+                            "value": "#34577c"
+                        }
+                    ],
+                    "image": "127.0.0.1:31999/stefanprodan/podinfo-2985051089:6.1.6",
+                    "imagePullPolicy": "IfNotPresent",
+                    "livenessProbe": {
+                        "exec": {
+                            "command": ["podcli", "check", "http", "localhost:9898/healthz"]
+                        },
+                        "failureThreshold": 3,
+                        "initialDelaySeconds": 1,
+                        "periodSeconds": 10,
+                        "successThreshold": 1,
+                        "timeoutSeconds": 5
+                    },
+                    "name": "podinfo",
+                    "ports": [
+                        {
+                            "containerPort": 9898,
+                            "name": "http",
+                            "protocol": "TCP"
+                        },
+                        {
+                            "containerPort": 9797,
+                            "name": "http-metrics",
+                            "protocol": "TCP"
+                        },
+                        {
+                            "containerPort": 9999,
+                            "name": "grpc",
+                            "protocol": "TCP"
+                        }
+                    ],
+                    "readinessProbe": {
+                        "exec": {
+                            "command": ["podcli", "check", "http", "localhost:9898/readyz"]
+                        },
+                        "failureThreshold": 3,
+                        "initialDelaySeconds": 1,
+                        "periodSeconds": 10,
+                        "successThreshold": 1,
+                        "timeoutSeconds": 5
+                    },
+                    "resources": {
+                        "requests": {
+                            "cpu": "1m",
+                            "memory": "16Mi"
+                        }
+                    },
+                    "terminationMessagePath": "/dev/termination-log",
+                    "terminationMessagePolicy": "File",
+                    "volumeMounts": [
+                        {
+                            "mountPath": "/data",
+                            "name": "data"
+                        },
+                        {
+                            "mountPath": "/var/run/secrets/kubernetes.io/serviceaccount",
+                            "name": "kube-api-access-vn9dc",
+                            "readOnly": true
+                        }
+                    ]
+                }
+            ],
+            "dnsPolicy": "ClusterFirst",
+            "enableServiceLinks": true,
+            "imagePullSecrets": [
+                {
+                    "name": "private-registry"
+                }
+            ],
+            "nodeName": "k3d-k3s-default-server-0",
+            "preemptionPolicy": "PreemptLowerPriority",
+            "priority": 0,
+            "restartPolicy": "Always",
+            "schedulerName": "default-scheduler",
+            "securityContext": {},
+            "serviceAccount": "default",
+            "serviceAccountName": "default",
+            "terminationGracePeriodSeconds": 30,
+            "tolerations": [
+                {
+                    "effect": "NoExecute",
+                    "key": "node.kubernetes.io/not-ready",
+                    "operator": "Exists",
+                    "tolerationSeconds": 300
+                },
+                {
+                    "effect": "NoExecute",
+                    "key": "node.kubernetes.io/unreachable",
+                    "operator": "Exists",
+                    "tolerationSeconds": 300
+                }
+            ],
+            "volumes": [
+                {
+                    "emptyDir": {},
+                    "name": "data"
+                },
+                {
+                    "name": "kube-api-access-vn9dc",
+                    "projected": {
+                        "defaultMode": 420,
+                        "sources": [
+                            {
+                                "serviceAccountToken": {
+                                    "expirationSeconds": 3607,
+                                    "path": "token"
+                                }
+                            },
+                            {
+                                "configMap": {
+                                    "items": [
+                                        {
+                                            "key": "ca.crt",
+                                            "path": "ca.crt"
+                                        }
+                                    ],
+                                    "name": "kube-root-ca.crt"
+                                }
+                            },
+                            {
+                                "downwardAPI": {
+                                    "items": [
+                                        {
+                                            "fieldRef": {
+                                                "apiVersion": "v1",
+                                                "fieldPath": "metadata.namespace"
+                                            },
+                                            "path": "namespace"
+                                        }
+                                    ]
+                                }
+                            }
+                        ]
+                    }
+                }
+            ]
+        },
+        "status": {
+            "conditions": [
+                {
+                    "lastProbeTime": null,
+                    "lastTransitionTime": "2023-03-07T07:48:13Z",
+                    "status": "True",
+                    "type": "Initialized"
+                },
+                {
+                    "lastProbeTime": null,
+                    "lastTransitionTime": "2023-03-07T07:48:16Z",
+                    "status": "True",
+                    "type": "Ready"
+                },
+                {
+                    "lastProbeTime": null,
+                    "lastTransitionTime": "2023-03-07T07:48:16Z",
+                    "status": "True",
+                    "type": "ContainersReady"
+                },
+                {
+                    "lastProbeTime": null,
+                    "lastTransitionTime": "2023-03-07T07:48:13Z",
+                    "status": "True",
+                    "type": "PodScheduled"
+                }
+            ],
+            "containerStatuses": [
+                {
+                    "containerID": "containerd://81b20dafbf2498a52c8ab46fa1e95ce25c06271684e590a377ee4ac9fd2a85ee",
+                    "image": "127.0.0.1:31999/stefanprodan/podinfo-2985051089:6.1.6",
+                    "imageID": "127.0.0.1:31999/stefanprodan/podinfo-2985051089@sha256:1f1fb2d1bfadac8a487106ea62b2b582bedc83fe17b3332dffe9151dfc820742",
+                    "lastState": {},
+                    "name": "podinfo",
+                    "ready": true,
+                    "restartCount": 0,
+                    "started": true,
+                    "state": {
+                        "running": {
+                            "startedAt": "2023-03-07T07:48:14Z"
+                        }
+                    }
+                }
+            ],
+            "hostIP": "172.19.0.3",
+            "phase": "Running",
+            "podIP": "10.42.0.26",
+            "podIPs": [
+                {
+                    "ip": "10.42.0.26"
+                }
+            ],
+            "qosClass": "Burstable",
+            "startTime": "2023-03-07T07:48:13Z"
+        }
+    }
+}