pepr 0.24.1 → 0.26.0

package/dist/cli.js

@@ -291,11 +291,154 @@ function watcherService(name2) {
 
 // src/lib/assets/pods.ts
 var import_zlib = require("zlib");
-var namespace = {
-  apiVersion: "v1",
-  kind: "Namespace",
-  metadata: { name: "pepr-system" }
+
+// src/lib/helpers.ts
+var import_kubernetes_fluent_client = require("kubernetes-fluent-client");
+var import_fs2 = require("fs");
+var import_commander = __toESM(require("commander"));
+var createRBACMap = (capabilities) => {
+  return capabilities.reduce((acc, capability) => {
+    capability.bindings.forEach((binding) => {
+      const key = `${binding.kind.group}/${binding.kind.version}/${binding.kind.kind}`;
+      acc["pepr.dev/v1/peprstore"] = {
+        verbs: ["create", "get", "patch", "watch"],
+        plural: "peprstores"
+      };
+      if (!acc[key] && binding.isWatch) {
+        acc[key] = {
+          verbs: ["watch"],
+          plural: binding.kind.plural || `${binding.kind.kind.toLowerCase()}s`
+        };
+      }
+    });
+    return acc;
+  }, {});
 };
+async function createDirectoryIfNotExists(path) {
+  try {
+    await import_fs2.promises.access(path);
+  } catch (error) {
+    if (error.code === "ENOENT") {
+      await import_fs2.promises.mkdir(path, { recursive: true });
+    } else {
+      throw error;
+    }
+  }
+}
+function hasEveryOverlap(array1, array2) {
+  if (!Array.isArray(array1) || !Array.isArray(array2)) {
+    return false;
+  }
+  return array1.every((element) => array2.includes(element));
+}
+function hasAnyOverlap(array1, array2) {
+  if (!Array.isArray(array1) || !Array.isArray(array2)) {
+    return false;
+  }
+  return array1.some((element) => array2.includes(element));
+}
+function ignoredNamespaceConflict(ignoreNamespaces, bindingNamespaces) {
+  return hasAnyOverlap(bindingNamespaces, ignoreNamespaces);
+}
+function bindingAndCapabilityNSConflict(bindingNamespaces, capabilityNamespaces) {
+  if (!capabilityNamespaces) {
+    return false;
+  }
+  return capabilityNamespaces.length !== 0 && !hasEveryOverlap(bindingNamespaces, capabilityNamespaces);
+}
+function generateWatchNamespaceError(ignoredNamespaces, bindingNamespaces, capabilityNamespaces) {
+  let err = "";
+  if (ignoredNamespaceConflict(ignoredNamespaces, bindingNamespaces)) {
+    err += `Binding uses a Pepr ignored namespace: ignoredNamespaces: [${ignoredNamespaces.join(
+      ", "
+    )}] bindingNamespaces: [${bindingNamespaces.join(", ")}].`;
+  }
+  if (bindingAndCapabilityNSConflict(bindingNamespaces, capabilityNamespaces)) {
+    err += `Binding uses namespace not governed by capability: bindingNamespaces: [${bindingNamespaces.join(
+      ", "
+    )}] capabilityNamespaces:$[${capabilityNamespaces.join(", ")}].`;
+  }
+  return err.replace(/\.([^ ])/g, ". $1");
+}
+function namespaceComplianceValidator(capability, ignoredNamespaces) {
+  const { namespaces: capabilityNamespaces, bindings, name: name2 } = capability;
+  const bindingNamespaces = bindings.flatMap((binding) => binding.filters.namespaces);
+  const namespaceError = generateWatchNamespaceError(
+    ignoredNamespaces ? ignoredNamespaces : [],
+    bindingNamespaces,
+    capabilityNamespaces ? capabilityNamespaces : []
+  );
+  if (namespaceError !== "") {
+    throw new Error(
+      `Error in ${name2} capability. A binding violates namespace rules. Please check ignoredNamespaces and capability namespaces: ${namespaceError}`
+    );
+  }
+}
+async function checkDeploymentStatus(namespace2) {
+  const deployments = await (0, import_kubernetes_fluent_client.K8s)(import_kubernetes_fluent_client.kind.Deployment).InNamespace(namespace2).Get();
+  let status = false;
+  let readyCount = 0;
+  for (const deployment2 of deployments.items) {
+    const readyReplicas = deployment2.status?.readyReplicas ? deployment2.status?.readyReplicas : 0;
+    if (deployment2.status?.readyReplicas !== deployment2.spec?.replicas) {
+      logger_default.info(
+        `Waiting for deployment ${deployment2.metadata?.name} rollout to finish: ${readyReplicas} of ${deployment2.spec?.replicas} replicas are available`
+      );
+    } else {
+      logger_default.info(
+        `Deployment ${deployment2.metadata?.name} rolled out: ${readyReplicas} of ${deployment2.spec?.replicas} replicas are available`
+      );
+      readyCount++;
+    }
+  }
+  if (readyCount === deployments.items.length) {
+    status = true;
+  }
+  return status;
+}
+async function namespaceDeploymentsReady(namespace2 = "pepr-system") {
+  logger_default.info(`Checking ${namespace2} deployments status...`);
+  let ready = false;
+  while (!ready) {
+    ready = await checkDeploymentStatus(namespace2);
+    if (ready) {
+      return ready;
+    }
+    await new Promise((resolve4) => setTimeout(resolve4, 1e3));
+  }
+  logger_default.info(`All ${namespace2} deployments are ready`);
+}
+function secretOverLimit(str) {
+  const encoder = new TextEncoder();
+  const encoded = encoder.encode(str);
+  const sizeInBytes = encoded.length;
+  const oneMiBInBytes = 1048576;
+  return sizeInBytes > oneMiBInBytes;
+}
+var parseTimeout = (value, previous) => {
+  const parsedValue = parseInt(value, 10);
+  const floatValue = parseFloat(value);
+  if (isNaN(parsedValue)) {
+    throw new import_commander.default.InvalidArgumentError("Not a number.");
+  } else if (parsedValue !== floatValue) {
+    throw new import_commander.default.InvalidArgumentError("Value must be an integer.");
+  } else if (parsedValue < 1 || parsedValue > 30) {
+    throw new import_commander.default.InvalidArgumentError("Number must be between 1 and 30.");
+  }
+  return parsedValue;
+};
+
+// src/lib/assets/pods.ts
+function namespace(namespaceLabels) {
+  return {
+    apiVersion: "v1",
+    kind: "Namespace",
+    metadata: {
+      name: "pepr-system",
+      labels: namespaceLabels ?? {}
+    }
+  };
+}
 function watcher(assets, hash) {
   const { name: name2, image, capabilities, config } = assets;
   let hasSchedule = false;
@@ -317,9 +460,13 @@ function watcher(assets, hash) {
     metadata: {
       name: app,
       namespace: "pepr-system",
+      annotations: {
+        "pepr.dev/description": config.description || ""
+      },
       labels: {
         app,
-        "pepr.dev/controller": "watcher"
+        "pepr.dev/controller": "watcher",
+        "pepr.dev/uuid": config.uuid
       }
     },
     spec: {
@@ -438,9 +585,13 @@ function deployment(assets, hash) {
     metadata: {
       name: name2,
       namespace: "pepr-system",
+      annotations: {
+        "pepr.dev/description": config.description || ""
+      },
       labels: {
         app,
-        "pepr.dev/controller": "admission"
+        "pepr.dev/controller": "admission",
+        "pepr.dev/uuid": config.uuid
       }
     },
     spec: {
@@ -562,18 +713,25 @@ function deployment(assets, hash) {
 function moduleSecret(name2, data, hash) {
   const compressed = (0, import_zlib.gzipSync)(data);
   const path = `module-${hash}.js.gz`;
-  return {
-    apiVersion: "v1",
-    kind: "Secret",
-    metadata: {
-      name: `${name2}-module`,
-      namespace: "pepr-system"
-    },
-    type: "Opaque",
-    data: {
-      [path]: compressed.toString("base64")
-    }
-  };
+  const compressedData = compressed.toString("base64");
+  if (secretOverLimit(compressedData)) {
+    const error = new Error(`Module secret for ${name2} is over the 1MB limit`);
+    console.error("Uncaught Exception:", error);
+    process.exit(1);
+  } else {
+    return {
+      apiVersion: "v1",
+      kind: "Secret",
+      metadata: {
+        name: `${name2}-module`,
+        namespace: "pepr-system"
+      },
+      type: "Opaque",
+      data: {
+        [path]: compressed.toString("base64")
+      }
+    };
+  }
 }
 function genEnv(config, watchMode = false) {
   const env = [
@@ -589,122 +747,6 @@ function genEnv(config, watchMode = false) {
   return env;
 }
 
-// src/lib/helpers.ts
-var import_kubernetes_fluent_client = require("kubernetes-fluent-client");
-var import_fs2 = require("fs");
-var createRBACMap = (capabilities) => {
-  return capabilities.reduce((acc, capability) => {
-    capability.bindings.forEach((binding) => {
-      const key = `${binding.kind.group}/${binding.kind.version}/${binding.kind.kind}`;
-      acc["pepr.dev/v1/peprstore"] = {
-        verbs: ["create", "get", "patch", "watch"],
-        plural: "peprstores"
-      };
-      if (!acc[key] && binding.isWatch) {
-        acc[key] = {
-          verbs: ["watch"],
-          plural: binding.kind.plural || `${binding.kind.kind.toLowerCase()}s`
-        };
-      }
-    });
-    return acc;
-  }, {});
-};
-async function createDirectoryIfNotExists(path) {
-  try {
-    await import_fs2.promises.access(path);
-  } catch (error) {
-    if (error.code === "ENOENT") {
-      await import_fs2.promises.mkdir(path, { recursive: true });
-    } else {
-      throw error;
-    }
-  }
-}
-function hasEveryOverlap(array1, array2) {
-  if (!Array.isArray(array1) || !Array.isArray(array2)) {
-    return false;
-  }
-  return array1.every((element) => array2.includes(element));
-}
-function hasAnyOverlap(array1, array2) {
-  if (!Array.isArray(array1) || !Array.isArray(array2)) {
-    return false;
-  }
-  return array1.some((element) => array2.includes(element));
-}
-function ignoredNamespaceConflict(ignoreNamespaces, bindingNamespaces) {
-  return hasAnyOverlap(bindingNamespaces, ignoreNamespaces);
-}
-function bindingAndCapabilityNSConflict(bindingNamespaces, capabilityNamespaces) {
-  if (!capabilityNamespaces) {
-    return false;
-  }
-  return capabilityNamespaces.length !== 0 && !hasEveryOverlap(bindingNamespaces, capabilityNamespaces);
-}
-function generateWatchNamespaceError(ignoredNamespaces, bindingNamespaces, capabilityNamespaces) {
-  let err = "";
-  if (ignoredNamespaceConflict(ignoredNamespaces, bindingNamespaces)) {
-    err += `Binding uses a Pepr ignored namespace: ignoredNamespaces: [${ignoredNamespaces.join(
-      ", "
-    )}] bindingNamespaces: [${bindingNamespaces.join(", ")}].`;
-  }
-  if (bindingAndCapabilityNSConflict(bindingNamespaces, capabilityNamespaces)) {
-    err += `Binding uses namespace not governed by capability: bindingNamespaces: [${bindingNamespaces.join(
-      ", "
-    )}] capabilityNamespaces:$[${capabilityNamespaces.join(", ")}].`;
-  }
-  return err.replace(/\.([^ ])/g, ". $1");
-}
-function namespaceComplianceValidator(capability, ignoredNamespaces) {
-  const { namespaces: capabilityNamespaces, bindings, name: name2 } = capability;
-  const bindingNamespaces = bindings.flatMap((binding) => binding.filters.namespaces);
-  const namespaceError = generateWatchNamespaceError(
-    ignoredNamespaces ? ignoredNamespaces : [],
-    bindingNamespaces,
-    capabilityNamespaces ? capabilityNamespaces : []
-  );
-  if (namespaceError !== "") {
-    throw new Error(
-      `Error in ${name2} capability. A binding violates namespace rules. Please check ignoredNamespaces and capability namespaces: ${namespaceError}`
-    );
-  }
-}
-async function checkDeploymentStatus(namespace2) {
-  const deployments = await (0, import_kubernetes_fluent_client.K8s)(import_kubernetes_fluent_client.kind.Deployment).InNamespace(namespace2).Get();
-  let status = false;
-  let readyCount = 0;
-  for (const deployment2 of deployments.items) {
-    const readyReplicas = deployment2.status?.readyReplicas ? deployment2.status?.readyReplicas : 0;
-    if (deployment2.status?.readyReplicas !== deployment2.spec?.replicas) {
-      logger_default.info(
-        `Waiting for deployment ${deployment2.metadata?.name} rollout to finish: ${readyReplicas} of ${deployment2.spec?.replicas} replicas are available`
-      );
-    } else {
-      logger_default.info(
-        `Deployment ${deployment2.metadata?.name} rolled out: ${readyReplicas} of ${deployment2.spec?.replicas} replicas are available`
-      );
-      readyCount++;
-    }
-  }
-  if (readyCount === deployments.items.length) {
-    status = true;
-  }
-  return status;
-}
-async function namespaceDeploymentsReady(namespace2 = "pepr-system") {
-  logger_default.info(`Checking ${namespace2} deployments status...`);
-  let ready = false;
-  while (!ready) {
-    ready = await checkDeploymentStatus(namespace2);
-    if (ready) {
-      return ready;
-    }
-    await new Promise((resolve4) => setTimeout(resolve4, 1e3));
-  }
-  logger_default.info(`All ${namespace2} deployments are ready`);
-}
-
 // src/lib/assets/rbac.ts
 function clusterRole(name2, capabilities, rbacMode = "") {
   const rbacMap = createRBACMap(capabilities);
@@ -865,7 +907,7 @@ async function generateWebhookRules(assets, isMutateWebhook) {
   for (const capability of capabilities) {
     console.info(`Module ${config.uuid} has capability: ${capability.name}`);
     for (const binding of capability.bindings) {
-      const { event, kind: kind5, isMutate, isValidate } = binding;
+      const { event, kind: kind6, isMutate, isValidate } = binding;
       if (isMutateWebhook && !isMutate) {
         continue;
       }
@@ -878,10 +920,10 @@ async function generateWebhookRules(assets, isMutateWebhook) {
       } else {
         operations.push(event);
       }
-      const resource = kind5.plural || `${kind5.kind.toLowerCase()}s`;
+      const resource = kind6.plural || `${kind6.kind.toLowerCase()}s`;
       const ruleObject = {
-        apiGroups: [kind5.group],
-        apiVersions: [kind5.version || "*"],
+        apiGroups: [kind6.group],
+        apiVersions: [kind6.version || "*"],
         operations,
         resources: [resource]
       };
@@ -953,7 +995,7 @@ async function deploy(assets, force, webhookTimeout) {
   logger_default.info("Establishing connection to Kubernetes");
   const { name: name2, host, path } = assets;
   logger_default.info("Applying pepr-system namespace");
-  await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Namespace).Apply(namespace);
+  await (0, import_kubernetes_fluent_client3.K8s)(import_kubernetes_fluent_client3.kind.Namespace).Apply(namespace(assets.config.customLabels?.namespace));
   const mutateWebhook = await webhookConfig(assets, "mutate", webhookTimeout);
   if (mutateWebhook) {
     logger_default.info("Applying mutating webhook");
@@ -1088,11 +1130,11 @@ async function allYaml(assets, rbacMode) {
   const { name: name2, tls, apiToken, path } = assets;
   const code = await import_fs4.promises.readFile(path);
   const hash = import_crypto2.default.createHash("sha256").update(code).digest("hex");
-  const mutateWebhook = await webhookConfig(assets, "mutate");
-  const validateWebhook = await webhookConfig(assets, "validate");
+  const mutateWebhook = await webhookConfig(assets, "mutate", assets.config.webhookTimeout);
+  const validateWebhook = await webhookConfig(assets, "validate", assets.config.webhookTimeout);
   const watchDeployment = watcher(assets, hash);
   const resources = [
-    namespace,
+    namespace(assets.config.customLabels?.namespace),
     clusterRole(name2, assets.capabilities, rbacMode),
     clusterRoleBinding(name2),
     serviceAccount(name2),
@@ -1102,7 +1144,6 @@ async function allYaml(assets, rbacMode) {
     service(name2),
     watcherService(name2),
     moduleSecret(name2, code, hash),
-    peprStoreCRD,
     storeRole(name2),
     storeRoleBinding(name2)
   ];
@@ -1357,7 +1398,7 @@ var gitIgnore = "# Ignore node_modules and Pepr build artifacts\nnode_modules\nd
 var readmeMd = '# Pepr Module\n\nThis is a Pepr Module. [Pepr](https://github.com/defenseunicorns/pepr) is a type-safe Kubernetes middleware system.\n\nThe `capabilities` directory contains all the capabilities for this module. By default,\na capability is a single typescript file in the format of `capability-name.ts` that is\nimported in the root `pepr.ts` file as `import { HelloPepr } from "./capabilities/hello-pepr";`.\nBecause this is typescript, you can organize this however you choose, e.g. creating a sub-folder\nper-capability or common logic in shared files or folders.\n\nExample Structure:\n\n```\nModule Root\n\u251C\u2500\u2500 package.json\n\u251C\u2500\u2500 pepr.ts\n\u2514\u2500\u2500 capabilities\n    \u251C\u2500\u2500 example-one.ts\n    \u251C\u2500\u2500 example-three.ts\n    \u2514\u2500\u2500 example-two.ts\n```\n';
 var peprTS = 'import { PeprModule } from "pepr";\n// cfg loads your pepr configuration from package.json\nimport cfg from "./package.json";\n\n// HelloPepr is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\nimport { HelloPepr } from "./capabilities/hello-pepr";\n\n/**\n * This is the main entrypoint for this Pepr module. It is run when the module is started.\n * This is where you register your Pepr configurations and capabilities.\n */\nnew PeprModule(cfg, [\n  // "HelloPepr" is a demo capability that is included with Pepr. Comment or delete the line below to remove it.\n  HelloPepr,\n\n  // Your additional capabilities go here\n]);\n';
 var helloPeprTS = 'import {\n  Capability,\n  K8s,\n  Log,\n  PeprMutateRequest,\n  RegisterKind,\n  a,\n  fetch,\n  fetchStatus,\n  kind,\n} from "pepr";\n\n/**\n *  The HelloPepr Capability is an example capability to demonstrate some general concepts of Pepr.\n *  To test this capability you run `pepr dev`and then run the following command:\n *  `kubectl apply -f capabilities/hello-pepr.samples.yaml`\n */\nexport const HelloPepr = new Capability({\n  name: "hello-pepr",\n  description: "A simple example capability to show how things work.",\n  namespaces: ["pepr-demo", "pepr-demo-2"],\n});\n\n// Use the \'When\' function to create a new action, use \'Store\' to persist data\nconst { When, Store } = HelloPepr;\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Namespace)                                   *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action removes the label `remove-me` when a Namespace is created.\n * Note we don\'t need to specify the namespace here, because we\'ve already specified\n * it in the Capability definition above.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .Mutate(ns => ns.RemoveLabel("remove-me"));\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Watch Action with K8s SSA (Namespace)                           *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action watches for the `pepr-demo-2` namespace to be created, then creates a ConfigMap with\n * the name `pepr-ssa-demo` and adds the namespace UID to the ConfigMap data. Because Pepr uses\n * server-side apply for this operation, the ConfigMap will be created or updated if it already exists.\n */\nWhen(a.Namespace)\n  .IsCreated()\n  .WithName("pepr-demo-2")\n  .Watch(async ns => {\n    Log.info("Namespace pepr-demo-2 was created.");\n\n    try {\n      // Apply the ConfigMap using K8s server-side apply\n      await K8s(kind.ConfigMap).Apply({\n        metadata: {\n          name: "pepr-ssa-demo",\n          namespace: "pepr-demo-2",\n        },\n        data: {\n          "ns-uid": ns.metadata.uid,\n        },\n      });\n    } catch (error) {\n      // You can use the Log object to log messages to the Pepr controller pod\n      Log.error(error, "Failed to apply ConfigMap using server-side apply.");\n    }\n\n    // You can share data between actions using the Store, including between different types of actions\n    Store.setItem("watch-data", "This data was stored by a Watch Action.");\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 1)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is a single action. They can be in the same file or put imported from other files.\n * In this example, when a ConfigMap is created with the name `example-1`, then add a label and annotation.\n *\n * Equivalent to manually running:\n * `kubectl label configmap example-1 pepr=was-here`\n * `kubectl annotate configmap example-1 pepr.dev=annotations-work-too`\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request\n      .SetLabel("pepr", "was-here")\n      .SetAnnotation("pepr.dev", "annotations-work-too");\n\n    // Use the Store to persist data between requests and Pepr controller pods\n    Store.setItem("example-1", "was-here");\n\n    // This data is written asynchronously and can be read back via `Store.getItem()` or `Store.subscribe()`\n    Store.setItem("example-1-data", JSON.stringify(request.Raw.data));\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate & Validate Actions (CM Example 2)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This combines 3 different types of actions: \'Mutate\', \'Validate\', and \'Watch\'. The order\n * of the actions is required, but each action is optional. In this example, when a ConfigMap is created\n * with the name `example-2`, then add a label and annotation, validate that the ConfigMap has the label\n * `pepr`, and log the request.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    // This Mutate Action will mutate the request before it is persisted to the cluster\n\n    // Use `request.Merge()` to merge the new data with the existing data\n    request.Merge({\n      metadata: {\n        labels: {\n          pepr: "was-here",\n        },\n        annotations: {\n          "pepr.dev": "annotations-work-too",\n        },\n      },\n    });\n  })\n  .Validate(request => {\n    // This Validate Action will validate the request before it is persisted to the cluster\n\n    // Approve the request if the ConfigMap has the label \'pepr\'\n    if (request.HasLabel("pepr")) {\n      return request.Approve();\n    }\n\n    // Otherwise, deny the request with an error message (optional)\n    return request.Deny("ConfigMap must have label \'pepr\'");\n  })\n  .Watch((cm, phase) => {\n    // This Watch Action will watch the ConfigMap after it has been persisted to the cluster\n    Log.info(cm, `ConfigMap was ${phase} with the name example-2`);\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 2a)                               *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action shows a simple validation that will deny any ConfigMap that has the\n * annotation `evil`. Note that the `Deny()` function takes an optional second parameter that is a\n * user-defined status code to return.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .Validate(request => {\n    if (request.HasAnnotation("evil")) {\n      return request.Deny("No evil CM annotations allowed.", 400);\n    }\n\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 3)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action combines different styles. Unlike the previous actions, this one will look\n * for any ConfigMap in the `pepr-demo` namespace that has the label `change=by-label` during either\n * CREATE or UPDATE. Note that all conditions added such as `WithName()`, `WithLabel()`, `InNamespace()`,\n * are ANDs so all conditions must be true for the request to be processed.\n */\nWhen(a.ConfigMap)\n  .IsCreatedOrUpdated()\n  .WithLabel("change", "by-label")\n  .Mutate(request => {\n    // The K8s object e are going to mutate\n    const cm = request.Raw;\n\n    // Get the username and uid of the K8s request\n    const { username, uid } = request.Request.userInfo;\n\n    // Store some data about the request in the configmap\n    cm.data["username"] = username;\n    cm.data["uid"] = uid;\n\n    // You can still mix other ways of making changes too\n    request.SetAnnotation("pepr.dev", "making-waves");\n  });\n\n// This action validates the label `change=by-label` is deleted\nWhen(a.ConfigMap)\n  .IsDeleted()\n  .WithLabel("change", "by-label")\n  .Validate(request => {\n    // Log and then always approve the request\n    Log.info("CM with label \'change=by-label\' was deleted.");\n    return request.Approve();\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action show how you can use the `Mutate()` function without an inline function.\n * This is useful if you want to keep your actions small and focused on a single task,\n * or if you want to reuse the same function in multiple actions.\n */\nWhen(a.ConfigMap).IsCreated().WithName("example-4").Mutate(example4Cb);\n\n// This function uses the complete type definition, but is not required.\nfunction example4Cb(cm: PeprMutateRequest<a.ConfigMap>) {\n  cm.SetLabel("pepr.dev/first", "true");\n  cm.SetLabel("pepr.dev/second", "true");\n  cm.SetLabel("pepr.dev/third", "true");\n}\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 4a)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This is the same as Example 4, except this only operates on a CM in the `pepr-demo-2` namespace.\n * Note because the Capability defines namespaces, the namespace specified here must be one of those.\n * Alternatively, you can remove the namespace from the Capability definition and specify it here.\n */\nWhen(a.ConfigMap)\n  .IsCreated()\n  .InNamespace("pepr-demo-2")\n  .WithName("example-4a")\n  .Mutate(example4Cb);\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (CM Example 5)                                *\n * ---------------------------------------------------------------------------------------------------\n *\n * This action is a bit more complex. It will look for any ConfigMap in the `pepr-demo`\n * namespace that has the label `chuck-norris` during CREATE. When it finds one, it will fetch a\n * random Chuck Norris joke from the API and add it to the ConfigMap. This is a great example of how\n * you can use Pepr to make changes to your K8s objects based on external data.\n *\n * Note the use of the `async` keyword. This is required for any action that uses `await` or `fetch()`.\n *\n * Also note we are passing a type to the `fetch()` function. This is optional, but it will help you\n * avoid mistakes when working with the data returned from the API. You can also use the `as` keyword to\n * cast the data returned from the API.\n *\n * These are equivalent:\n * ```ts\n * const joke = await fetch<TheChuckNorrisJoke>("https://api.chucknorris.io/jokes/random?category=dev");\n * const joke = await fetch("https://api.chucknorris.io/jokes/random?category=dev") as TheChuckNorrisJoke;\n * ```\n *\n * Alternatively, you can drop the type completely:\n *\n * ```ts\n * fetch("https://api.chucknorris.io/jokes/random?category=dev")\n * ```\n */\ninterface TheChuckNorrisJoke {\n  icon_url: string;\n  id: string;\n  url: string;\n  value: string;\n}\n\nWhen(a.ConfigMap)\n  .IsCreated()\n  .WithLabel("chuck-norris")\n  .Mutate(async change => {\n    // Try/catch is not needed as a response object will always be returned\n    const response = await fetch<TheChuckNorrisJoke>(\n      "https://api.chucknorris.io/jokes/random?category=dev",\n    );\n\n    // Instead, check the `response.ok` field\n    if (response.ok) {\n      // Add the Chuck Norris joke to the configmap\n      change.Raw.data["chuck-says"] = response.data.value;\n      return;\n    }\n\n    // You can also assert on different HTTP response codes\n    if (response.status === fetchStatus.NOT_FOUND) {\n      // Do something else\n      return;\n    }\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Secret Base64 Handling)                      *\n * ---------------------------------------------------------------------------------------------------\n *\n * The K8s JS client provides incomplete support for base64 encoding/decoding handling for secrets,\n * unlike the GO client. To make this less painful, Pepr automatically handles base64 encoding/decoding\n * secret data before and after the action is executed.\n */\nWhen(a.Secret)\n  .IsCreated()\n  .WithName("secret-1")\n  .Mutate(request => {\n    const secret = request.Raw;\n\n    // This will be encoded at the end of all processing back to base64: "Y2hhbmdlLXdpdGhvdXQtZW5jb2Rpbmc="\n    secret.data.magic = "change-without-encoding";\n\n    // You can modify the data directly, and it will be encoded at the end of all processing\n    secret.data.example += " - modified by Pepr";\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Untyped Custom Resource)                     *\n * ---------------------------------------------------------------------------------------------------\n *\n * Out of the box, Pepr supports all the standard Kubernetes objects. However, you can also create\n * your own types. This is useful if you are working with an Operator that creates custom resources.\n * There are two ways to do this, the first is to use the `When()` function with a `GenericKind`,\n * the second is to create a new class that extends `GenericKind` and use the `RegisterKind()` function.\n *\n * This example shows how to use the `When()` function with a `GenericKind`. Note that you\n * must specify the `group`, `version`, and `kind` of the object (if applicable). This is how Pepr knows\n * if the action should be triggered or not. Since we are using a `GenericKind`,\n * Pepr will not be able to provide any intellisense for the object, so you will need to refer to the\n * Kubernetes API documentation for the object you are working with.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-1\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```\n */\nWhen(a.GenericKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n})\n  .IsCreated()\n  .WithName("example-1")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr without type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * ---------------------------------------------------------------------------------------------------\n *                                   Mutate Action (Typed Custom Resource)                       *\n * ---------------------------------------------------------------------------------------------------\n *\n * This example shows how to use the `RegisterKind()` function to create a new type. This is useful\n * if you are working with an Operator that creates custom resources and you want to have intellisense\n * for the object. Note that you must specify the `group`, `version`, and `kind` of the object (if applicable)\n * as this is how Pepr knows if the action should be triggered or not.\n *\n * Once you register a new Kind with Pepr, you can use the `When()` function with the new Kind. Ideally,\n * you should register custom Kinds at the top of your Capability file or Pepr Module so they are available\n * to all actions, but we are putting it here for demonstration purposes.\n *\n * You will need to wait for the CRD in `hello-pepr.samples.yaml` to be created, then you can apply\n *\n * ```yaml\n * apiVersion: pepr.dev/v1\n * kind: Unicorn\n * metadata:\n *   name: example-2\n *   namespace: pepr-demo\n * spec:\n *   message: replace-me\n *   counter: 0\n * ```*\n */\nclass UnicornKind extends a.GenericKind {\n  spec: {\n    /**\n     * JSDoc comments can be added to explain more details about the field.\n     *\n     * @example\n     * ```ts\n     * request.Raw.spec.message = "Hello Pepr!";\n     * ```\n     * */\n    message: string;\n    counter: number;\n  };\n}\n\nRegisterKind(UnicornKind, {\n  group: "pepr.dev",\n  version: "v1",\n  kind: "Unicorn",\n});\n\nWhen(UnicornKind)\n  .IsCreated()\n  .WithName("example-2")\n  .Mutate(request => {\n    request.Merge({\n      spec: {\n        message: "Hello Pepr with type data!",\n        counter: Math.random(),\n      },\n    });\n  });\n\n/**\n * A callback function that is called once the Pepr Store is fully loaded.\n */\nStore.onReady(data => {\n  Log.info(data, "Pepr Store Ready");\n});\n';
-var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.24.1", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "git clone https://github.com/defenseunicorns/pepr-upgrade-test.git", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.29.10", express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "2.1.0", pino: "8.18.0", "pino-pretty": "10.3.1", "prom-client": "15.1.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.6.0", "@commitlint/config-conventional": "18.6.0", "@jest/globals": "29.7.0", "@types/eslint": "8.56.2", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.11", "@types/prompts": "2.4.9", "@types/uuid": "9.0.8", jest: "29.7.0", nock: "13.5.1", "ts-jest": "29.1.2" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.15.0", "@typescript-eslint/parser": "6.15.0", commander: "11.1.0", esbuild: "0.19.10", eslint: "8.56.0", "node-forge": "1.3.1", prettier: "3.1.1", prompts: "2.4.2", typescript: "5.3.3", uuid: "9.0.1" } };
+var packageJSON = { name: "pepr", description: "Kubernetes application engine", author: "Defense Unicorns", homepage: "https://github.com/defenseunicorns/pepr", license: "Apache-2.0", bin: "dist/cli.js", repository: "defenseunicorns/pepr", engines: { node: ">=18.0.0" }, version: "0.26.0", main: "dist/lib.js", types: "dist/lib.d.ts", scripts: { "gen-data-json": "node hack/build-template-data.js", prebuild: "rm -fr dist/* && npm run gen-data-json", build: "tsc && node build.mjs", test: "npm run test:unit && npm run test:journey", "test:unit": "npm run gen-data-json && jest src --coverage --detectOpenHandles --coverageDirectory=./coverage", "test:journey": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run", "test:journey:prep": "git clone https://github.com/defenseunicorns/pepr-upgrade-test.git", "test:journey-wasm": "npm run test:journey:k3d && npm run test:journey:build && npm run test:journey:image && npm run test:journey:run-wasm", "test:journey:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system", "test:journey:build": "npm run build && npm pack", "test:journey:image": "docker buildx build --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev", "test:journey:run": "jest --detectOpenHandles journey/entrypoint.test.ts && npm run test:journey:prep && npm run test:journey:upgrade", "test:journey:run-wasm": "jest --detectOpenHandles journey/entrypoint-wasm.test.ts", "test:journey:upgrade": "npm run test:journey:k3d && npm run test:journey:image && jest --detectOpenHandles journey/pepr-upgrade.test.ts", "format:check": "eslint src && prettier src --check", "format:fix": "eslint src --fix && prettier src --write" }, dependencies: { "@types/ramda": "0.29.10", express: "4.18.2", "fast-json-patch": "3.1.1", "kubernetes-fluent-client": "2.1.3", pino: "8.18.0", "pino-pretty": "10.3.1", "prom-client": "15.1.0", ramda: "0.29.1" }, devDependencies: { "@commitlint/cli": "18.6.1", "@commitlint/config-conventional": "18.6.2", "@jest/globals": "29.7.0", "@types/eslint": "8.56.2", "@types/express": "4.17.21", "@types/node": "18.x.x", "@types/node-forge": "1.3.11", "@types/prompts": "2.4.9", "@types/uuid": "9.0.8", jest: "29.7.0", nock: "13.5.1", "ts-jest": "29.1.2" }, peerDependencies: { "@typescript-eslint/eslint-plugin": "6.15.0", "@typescript-eslint/parser": "6.15.0", commander: "11.1.0", esbuild: "0.19.10", eslint: "8.56.0", "node-forge": "1.3.1", prettier: "3.1.1", prompts: "2.4.2", typescript: "5.3.3", uuid: "9.0.1" } };
 
 // src/templates/pepr.code-snippets.json
 var pepr_code_snippets_default = {
@@ -1463,6 +1504,10 @@ function genPkgJSON(opts, pgkVerOverride) {
       name: opts.name.trim(),
       uuid: pgkVerOverride ? "static-test" : uuid,
       onError: opts.errorBehavior,
+      webhookTimeout: 10,
+      customLabels: {
+        namespace: {}
+      },
       alwaysIgnore: {
         namespaces: [],
         labels: []
@@ -1585,18 +1630,30 @@ async function peprFormat(validateOnly) {
 }
 
 // src/cli/build.ts
-var import_commander = require("commander");
+var import_commander2 = require("commander");
 var peprTS2 = "pepr.ts";
 var outputDir = "dist";
 function build_default(program2) {
   program2.command("build").description("Build a Pepr Module for deployment").option("-e, --entry-point [file]", "Specify the entry point file to build with.", peprTS2).option(
     "-n, --no-embed",
     "Disables embedding of deployment files into output module.  Useful when creating library modules intended solely for reuse/distribution via NPM."
+  ).option(
+    "-i, --custom-image [custom-image]",
+    "Custom Image: Use custom image for Admission and Watch Deployments."
   ).option(
     "-r, --registry-info [<registry>/<username>]",
     "Registry Info: Image registry and username. Note: You must be signed into the registry"
-  ).option("-o, --output-dir [output directory]", "Define where to place build output").addOption(
-    new import_commander.Option("--rbac-mode [admin|scoped]", "Rbac Mode: admin, scoped (default: admin)").choices(["admin", "scoped"]).default("admin")
+  ).option("-o, --output-dir [output directory]", "Define where to place build output").option(
+    "--timeout [timeout]",
+    "How long the API server should wait for a webhook to respond before treating the call as a failure",
+    parseTimeout
+  ).addOption(
+    new import_commander2.Option(
+      "--registry <GitHub|Iron Bank>",
+      "Container registry: Choose container registry for deployment manifests. Can't be used with --custom-image."
+    ).choices(["GitHub", "Iron Bank"])
+  ).addOption(
+    new import_commander2.Option("--rbac-mode [admin|scoped]", "Rbac Mode: admin, scoped (default: admin)").choices(["admin", "scoped"]).default("admin")
   ).action(async (opts) => {
     if (opts.outputDir) {
       outputDir = opts.outputDir;
@@ -1608,11 +1665,21 @@ function build_default(program2) {
     const { cfg, path, uuid } = await buildModule(void 0, opts.entryPoint, opts.embed);
     const { includedFiles } = cfg.pepr;
     let image = "";
+    if (opts.customImage) {
+      if (opts.registry) {
+        console.error(`Custom Image and registry cannot be used together.`);
+        process.exit(1);
+      }
+      image = opts.customImage;
+    }
+    if (opts.timeout !== void 0) {
+      cfg.pepr.webhookTimeout = opts.timeout;
+    }
     if (opts.registryInfo !== void 0) {
       console.info(`Including ${includedFiles.length} files in controller image.`);
-      image = `${opts.registryInfo}/custom-pepr-controller:${cfg.dependencies.pepr}`;
+      image = `${opts.registryInfo}/custom-pepr-controller:${cfg.pepr.peprVersion}`;
       if (includedFiles.length > 0) {
-        await createDockerfile(cfg.dependencies.pepr, cfg.description, includedFiles);
+        await createDockerfile(cfg.pepr.peprVersion, cfg.description, includedFiles);
         (0, import_child_process2.execSync)(`docker build --tag ${image} -f Dockerfile.controller .`, { stdio: "inherit" });
         (0, import_child_process2.execSync)(`docker push ${image}`, { stdio: "inherit" });
       }
@@ -1629,6 +1696,14 @@ function build_default(program2) {
       },
       path
     );
+    if (opts?.registry == "Iron Bank") {
+      console.warn(
+        `
+	This command assumes the latest release. Pepr's Iron Bank image release cycle is dictated by renovate and is typically released a few days after the GitHub release.
+	As an alternative you may consider custom --custom-image to target a specific image and version.`
+      );
+      image = `registry1.dso.mil/ironbank/opensource/defenseunicorns/pepr/controller:${cfg.pepr.peprVersion}`;
+    }
     if (image !== "") {
       assets.image = image;
     }
@@ -2080,12 +2155,38 @@ function init_default(program2) {
   });
 }
 
+// src/cli/uuid.ts
+var import_kubernetes_fluent_client5 = require("kubernetes-fluent-client");
+function uuid_default(program2) {
+  program2.command("uuid [uuid]").description("Module UUID(s) currently deployed in the cluster").action(async (uuid) => {
+    const uuidTable = {};
+    let deployments;
+    if (!uuid) {
+      deployments = await (0, import_kubernetes_fluent_client5.K8s)(import_kubernetes_fluent_client5.kind.Deployment).InNamespace("pepr-system").WithLabel("pepr.dev/uuid").Get();
+    } else {
+      deployments = await (0, import_kubernetes_fluent_client5.K8s)(import_kubernetes_fluent_client5.kind.Deployment).InNamespace("pepr-system").WithLabel("pepr.dev/uuid", uuid).Get();
+    }
+    deployments.items.map((deploy2) => {
+      const uuid2 = deploy2.metadata?.labels?.["pepr.dev/uuid"] || "";
+      const description = deploy2.metadata?.annotations?.["pepr.dev/description"] || "";
+      if (uuid2 !== "") {
+        uuidTable[uuid2] = description;
+      }
+    });
+    console.log("UUID		Description");
+    console.log("--------------------------------------------");
+    Object.entries(uuidTable).forEach(([uuid2, description]) => {
+      console.log(`${uuid2}	${description}`);
+    });
+  });
+}
+
 // src/cli/root.ts
-var import_commander2 = require("commander");
-var RootCmd = class extends import_commander2.Command {
+var import_commander3 = require("commander");
+var RootCmd = class extends import_commander3.Command {
   // eslint-disable-next-line class-methods-use-this
   createCommand(name2) {
-    const cmd = new import_commander2.Command(name2);
+    const cmd = new import_commander3.Command(name2);
     cmd.option("-l, --log-level [level]", "Log level: debug, info, warn, error", "info");
     cmd.hook("preAction", (run) => {
       logger_default.level = run.opts().logLevel;
@@ -2175,4 +2276,5 @@ dev_default(program);
 update_default(program);
 format_default(program);
 monitor_default(program);
+uuid_default(program);
 program.parse();