pepr 0.33.0 → 0.34.0

package/src/lib/helpers.ts

@@ -6,24 +6,7 @@ import { K8s, KubernetesObject, kind } from "kubernetes-fluent-client";
 import Log from "./logger";
 import { Binding, CapabilityExport } from "./types";
 import { sanitizeResourceName } from "../sdk/sdk";
-import { mergeDeepRight } from "ramda";
 
-export function mergePkgJSONEnv(env: Record<string, string>, pkgJSONEnv?: Record<string, string>) {
-  if (!pkgJSONEnv) {
-    return env;
-  }
-  // Cannot override watch mode because it is critical to deployments
-  Object.keys(pkgJSONEnv).forEach(key => {
-    if (key === "PEPR_WATCH_MODE") {
-      delete pkgJSONEnv[key];
-    }
-  });
-  return mergeDeepRight(env, pkgJSONEnv);
-}
-
-export function envMapToArray(env: Record<string, string>) {
-  return Object.entries(env).map(([key, value]) => ({ name: key, value }));
-}
 export class ValidationError extends Error {}
 
 export function validateCapabilityNames(capabilities: CapabilityExport[] | undefined): void {

package/src/lib/included-files.test.ts

@@ -0,0 +1,22 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { createDockerfile } from "./included-files";
+import { expect, describe, test } from "@jest/globals";
+import { promises as fs } from "fs";
+
+describe("createDockerfile", () => {
+  const version = "0.0.1";
+  const description = "Pepr supports WASM modules!";
+  const includedFiles = ["main.wasm", "wasm_exec.js"];
+  test("should create a Dockerfile.controller with the correct content", async () => {
+    await createDockerfile(version, description, includedFiles);
+
+    const generatedContent = await fs.readFile("Dockerfile.controller", "utf-8");
+    expect(generatedContent).toContain(`FROM ghcr.io/defenseunicorns/pepr/controller:v${version}`);
+    expect(generatedContent).toContain(`LABEL description="${description}"`);
+    includedFiles.forEach(file => {
+      expect(generatedContent).toContain(`ADD ${file} ${file}`);
+    });
+  });
+});

package/src/lib/logger.test.ts

@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { beforeEach, describe, expect, it, jest } from "@jest/globals";
+
+describe("Logger", () => {
+  beforeEach(() => {
+    jest.resetModules(); // Clear the cache for modules
+    process.env = {}; // Clear environment variables
+  });
+
+  it("should set log level based on LOG_LEVEL environment variable", async () => {
+    process.env.LOG_LEVEL = "debug";
+    const { default: logger } = await import("./logger");
+
+    expect(logger.level).toBe("debug");
+  });
+});

package/src/lib/metrics.test.ts

@@ -0,0 +1,132 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { expect, test } from "@jest/globals";
+import { performance } from "perf_hooks";
+
+import { MetricsCollector } from "./metrics";
+
+test("constructor initializes counters correctly", () => {
+  const collector = new MetricsCollector("testPrefix");
+
+  expect(collector).toBeTruthy();
+});
+
+test("error method increments error counter", async () => {
+  const collector = new MetricsCollector("testPrefix");
+
+  collector.error();
+
+  const metrics = await collector.getMetrics();
+  expect(metrics).toMatch(/testPrefix_errors 1/);
+});
+
+test("alert method increments alerts counter", async () => {
+  const collector = new MetricsCollector("testPrefix");
+
+  collector.alert();
+
+  const metrics = await collector.getMetrics();
+  expect(metrics).toMatch(/testPrefix_alerts 1/);
+});
+
+test("observeStart returns current timestamp", () => {
+  const timeBefore = performance.now();
+  const startTime = MetricsCollector.observeStart();
+  const timeAfter = performance.now();
+
+  expect(timeBefore <= startTime).toBe(true);
+  expect(timeAfter >= startTime).toBe(true);
+});
+
+test("observeEnd updates summary", async () => {
+  const collector = new MetricsCollector("testPrefix");
+
+  const startTime = MetricsCollector.observeStart();
+  await new Promise(resolve => setTimeout(resolve, 100)); // Delay to simulate operation
+  collector.observeEnd(startTime);
+
+  await new Promise(resolve => setTimeout(resolve, 100)); // Delay to simulate operation
+  collector.observeEnd(startTime, "validate");
+  collector.observeEnd(startTime, "validate");
+
+  const metrics = await collector.getMetrics();
+  expect(metrics).toMatch(/testPrefix_mutate_count 1/);
+  expect(metrics).toMatch(/testPrefix_mutate_sum \d+\.\d+/);
+
+  expect(metrics).toMatch(/testPrefix_validate_count 2/);
+  expect(metrics).toMatch(/testPrefix_validate_sum \d+\.\d+/);
+});
+
+test("coverage tests, with duplicate counters, default prefix (pepr) and still works properly", async () => {
+  const collector = new MetricsCollector();
+  collector.addCounter("testCounter", "testHelp");
+  // second one should log, but still work fine TODO: validate log
+  collector.addCounter("testCounter", "testHelp");
+  let metrics = await collector.getMetrics();
+  expect(metrics).toMatch(/pepr_testCounter 0/);
+  collector.incCounter("testCounter");
+  metrics = await collector.getMetrics();
+  expect(metrics).toMatch(/pepr_testCounter 1/);
+  collector.addSummary("testSummary", "testHelp");
+  // second one should log, but still work fine TODO: validate log
+  collector.addSummary("testSummary", "testHelp");
+  const startTime = MetricsCollector.observeStart();
+
+  await new Promise(resolve => setTimeout(resolve, 100)); // Delay to simulate operation
+  collector.observeEnd(startTime, "testSummary");
+  collector.observeEnd(startTime, "testSummary");
+  metrics = await collector.getMetrics();
+  expect(metrics).toMatch(/pepr_testSummary_count 2/);
+  expect(metrics).toMatch(/pepr_testSummary_sum \d+\.\d+/);
+});
+
+test("incCacheMiss increments cache miss gauge", async () => {
+  const collector = new MetricsCollector("testPrefix");
+
+  collector.incCacheMiss("window1");
+
+  const metrics = await collector.getMetrics();
+  expect(metrics).toMatch(/testPrefix_cache_miss{window="window1"} 1/);
+});
+
+test("incRetryCount increments retry count gauge", async () => {
+  const collector = new MetricsCollector("testPrefix");
+
+  collector.incRetryCount("1");
+
+  const metrics = await collector.getMetrics();
+  expect(metrics).toMatch(/testPrefix_resync_failure_count{count="1"} 1/);
+});
+
+test("initCacheMissWindow initializes cache miss gauge to zero", async () => {
+  const collector = new MetricsCollector("testPrefix");
+
+  collector.initCacheMissWindow("window1");
+
+  const metrics = await collector.getMetrics();
+  expect(metrics).toMatch(/testPrefix_cache_miss{window="window1"} 0/);
+});
+
+test("should initialize cache miss window and maintain size limit", async () => {
+  process.env.PEPR_MAX_CACHE_MISS_WINDOWS = "3";
+  const collector = new MetricsCollector("pepr");
+  collector.initCacheMissWindow("window1");
+  collector.initCacheMissWindow("window2");
+  collector.initCacheMissWindow("window3");
+  collector.initCacheMissWindow("window4");
+
+  const metrics = await collector.getMetrics();
+  expect(metrics).not.toContain("window1");
+  expect(metrics).toContain("window4");
+
+  collector.initCacheMissWindow("window5");
+  collector.initCacheMissWindow("window6");
+  collector.initCacheMissWindow("window7");
+
+  const updatedMetrics = await collector.getMetrics();
+  expect(updatedMetrics).not.toContain("window4");
+  expect(updatedMetrics).toContain("window5");
+  expect(updatedMetrics).toContain("window6");
+  expect(updatedMetrics).toContain("window7");
+});

package/src/lib/metrics.ts

@@ -4,7 +4,7 @@
 /* eslint-disable class-methods-use-this */
 
 import { performance } from "perf_hooks";
-import promClient, { Counter, Registry, Summary } from "prom-client";
+import promClient, { Counter, Registry, Gauge, Summary } from "prom-client";
 import Log from "./logger";
 
 const loggingPrefix = "MetricsCollector";
@@ -14,12 +14,15 @@ interface MetricNames {
   alerts: string;
   mutate: string;
   validate: string;
+  cacheMiss: string;
+  resyncFailureCount: string;
 }
 
 interface MetricArgs {
   name: string;
   help: string;
   registers: Registry[];
+  labelNames?: string[];
 }
 
 /**
@@ -28,14 +31,18 @@ interface MetricArgs {
 export class MetricsCollector {
   #registry: Registry;
   #counters: Map<string, Counter<string>> = new Map();
+  #gauges: Map<string, Gauge<string>> = new Map();
   #summaries: Map<string, Summary<string>> = new Map();
   #prefix: string;
+  #cacheMissWindows: Map<string, number> = new Map();
 
   #metricNames: MetricNames = {
     errors: "errors",
     alerts: "alerts",
-    mutate: "Mutate",
-    validate: "Validate",
+    mutate: "mutate",
+    validate: "validate",
+    cacheMiss: "cache_miss",
+    resyncFailureCount: "resync_failure_count",
   };
 
   /**
@@ -49,15 +56,18 @@ export class MetricsCollector {
     this.addCounter(this.#metricNames.alerts, "Mutation/Validate bad api token received");
     this.addSummary(this.#metricNames.mutate, "Mutation operation summary");
     this.addSummary(this.#metricNames.validate, "Validation operation summary");
+    this.addGauge(this.#metricNames.cacheMiss, "Number of cache misses per window", ["window"]);
+    this.addGauge(this.#metricNames.resyncFailureCount, "Number of failures per resync operation", ["count"]);
   }
 
   #getMetricName = (name: string) => `${this.#prefix}_${name}`;
 
-  #addMetric = <T extends Counter<string> | Summary<string>>(
+  #addMetric = <T extends Counter<string> | Gauge<string> | Summary<string>>(
     collection: Map<string, T>,
     MetricType: new (args: MetricArgs) => T,
     name: string,
     help: string,
+    labelNames?: string[],
   ) => {
     if (collection.has(this.#getMetricName(name))) {
       Log.debug(`Metric for ${name} already exists`, loggingPrefix);
@@ -68,23 +78,32 @@ export class MetricsCollector {
       name: this.#getMetricName(name),
       help,
       registers: [this.#registry],
+      labelNames,
     });
 
     collection.set(this.#getMetricName(name), metric);
   };
 
   addCounter = (name: string, help: string) => {
-    this.#addMetric(this.#counters, promClient.Counter, name, help);
+    this.#addMetric(this.#counters, promClient.Counter, name, help, []);
   };
 
   addSummary = (name: string, help: string) => {
-    this.#addMetric(this.#summaries, promClient.Summary, name, help);
+    this.#addMetric(this.#summaries, promClient.Summary, name, help, []);
+  };
+
+  addGauge = (name: string, help: string, labelNames?: string[]) => {
+    this.#addMetric(this.#gauges, promClient.Gauge, name, help, labelNames);
   };
 
   incCounter = (name: string) => {
     this.#counters.get(this.#getMetricName(name))?.inc();
   };
 
+  incGauge = (name: string, labels?: Record<string, string>, value: number = 1) => {
+    this.#gauges.get(this.#getMetricName(name))?.inc(labels || {}, value);
+  };
+
   /**
    * Increments the error counter.
    */
@@ -117,4 +136,47 @@ export class MetricsCollector {
   static observeStart() {
     return performance.now();
   }
+
+  /**
+   * Increments the cache miss gauge for a given label.
+   * @param label - The label for the cache miss.
+   */
+  incCacheMiss = (window: string) => {
+    this.incGauge(this.#metricNames.cacheMiss, { window });
+  };
+
+  /**
+   * Increments the retry count gauge.
+   * @param count - The count to increment by.
+   */
+  incRetryCount = (count: string) => {
+    this.incGauge(this.#metricNames.resyncFailureCount, { count });
+  };
+
+  /**
+   * Initializes the cache miss gauge for a given label.
+   * @param label - The label for the cache miss.
+   */
+  initCacheMissWindow = (window: string) => {
+    this.#rollCacheMissWindows();
+    this.#gauges.get(this.#getMetricName(this.#metricNames.cacheMiss))?.set({ window }, 0);
+    this.#cacheMissWindows.set(window, 0);
+  };
+
+  /**
+   * Manages the size of the cache miss gauge map.
+   */
+  #rollCacheMissWindows = () => {
+    const maxCacheMissWindows = process.env.PEPR_MAX_CACHE_MISS_WINDOWS
+      ? parseInt(process.env.PEPR_MAX_CACHE_MISS_WINDOWS, 10)
+      : undefined;
+
+    if (maxCacheMissWindows !== undefined && this.#cacheMissWindows.size >= maxCacheMissWindows) {
+      const firstKey = this.#cacheMissWindows.keys().next().value;
+      this.#cacheMissWindows.delete(firstKey);
+      this.#gauges.get(this.#getMetricName(this.#metricNames.cacheMiss))?.remove({ window: firstKey });
+    }
+  };
 }
+
+export const metricsCollector = new MetricsCollector("pepr");

package/src/lib/module.test.ts

@@ -0,0 +1,126 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { beforeEach, expect, jest, test, describe } from "@jest/globals";
+import { clone } from "ramda";
+import { Capability } from "./capability";
+import { Schedule } from "./schedule";
+import { Errors } from "./errors";
+import { PackageJSON, PeprModule } from "./module";
+import { CapabilityExport } from "./types";
+
+// Mock Controller
+const startServerMock = jest.fn();
+jest.mock("./controller", () => {
+  return {
+    Controller: jest.fn().mockImplementation(() => {
+      return { startServer: startServerMock };
+    }),
+  };
+});
+
+// Reset the mocks before each test
+beforeEach(() => {
+  jest.clearAllMocks();
+});
+
+// Mock PackageJSON
+const packageJSON: PackageJSON = {
+  description: "Test Description",
+  pepr: {
+    uuid: "20e17cf6-a2e4-46b2-b626-75d88d96c88b",
+    description: "Development module for pepr",
+    onError: "ignore",
+    alwaysIgnore: {
+      namespaces: [],
+    },
+  },
+};
+
+test("should instantiate Controller and start it with the default port", () => {
+  new PeprModule(packageJSON);
+  expect(startServerMock).toHaveBeenCalledWith(3000);
+});
+
+test("should instantiate Controller and start it with the specified port", () => {
+  const module = new PeprModule(packageJSON, [], { deferStart: true });
+  const port = Math.floor(Math.random() * 10000) + 1000;
+  module.start(port);
+  expect(startServerMock).toHaveBeenCalledWith(port);
+});
+
+test("should not start if deferStart is true", () => {
+  new PeprModule(packageJSON, [], { deferStart: true });
+  expect(startServerMock).not.toHaveBeenCalled();
+});
+
+test("should reject invalid pepr onError conditions", () => {
+  const cfg = clone(packageJSON);
+  cfg.pepr.onError = "invalidError";
+  expect(() => new PeprModule(cfg)).toThrow();
+});
+
+test("should allow valid pepr onError conditions", () => {
+  const cfg = clone(packageJSON);
+  cfg.pepr.onError = Errors.audit;
+  expect(() => new PeprModule(cfg)).not.toThrow();
+
+  cfg.pepr.onError = Errors.ignore;
+  expect(() => new PeprModule(cfg)).not.toThrow();
+
+  cfg.pepr.onError = Errors.reject;
+  expect(() => new PeprModule(cfg)).not.toThrow();
+});
+
+test("should not create a controller if PEPR_MODE is set to build", () => {
+  process.env.PEPR_MODE = "build";
+  new PeprModule(packageJSON);
+  expect(startServerMock).not.toHaveBeenCalled();
+});
+
+test("should send the capabilities to the parent process if PEPR_MODE is set to build", () => {
+  const sendMock = jest.spyOn(process, "send").mockImplementation(() => true);
+  process.env.PEPR_MODE = "build";
+
+  const capability = new Capability({
+    name: "test",
+    description: "test",
+  });
+
+  const expected: CapabilityExport = {
+    name: capability.name,
+    description: capability.description,
+    namespaces: capability.namespaces,
+    bindings: capability.bindings,
+    hasSchedule: capability.hasSchedule,
+  };
+
+  new PeprModule(packageJSON, [capability]);
+  expect(sendMock).toHaveBeenCalledWith([expected]);
+});
+
+describe("Capability", () => {
+  let capability: Capability;
+  let schedule: Schedule;
+
+  beforeEach(() => {
+    capability = new Capability({
+      name: "test",
+      description: "test",
+    });
+    schedule = {
+      name: "test-name",
+      every: 1,
+      unit: "seconds",
+      run: jest.fn(),
+      startTime: new Date(),
+      completions: 1,
+    };
+  });
+
+  test("should handle OnSchedule", () => {
+    const { OnSchedule } = capability;
+    OnSchedule(schedule);
+    expect(capability.hasSchedule).toBe(true);
+  });
+});

package/src/lib/mutate-request.test.ts

@@ -0,0 +1,188 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { beforeEach, describe, expect, it } from "@jest/globals";
+import { KubernetesObject } from "kubernetes-fluent-client";
+
+import { Operation, AdmissionRequest } from "./k8s";
+import { PeprMutateRequest } from "./mutate-request";
+
+describe("PeprMutateRequest", () => {
+  let mockRequest: AdmissionRequest<KubernetesObject>;
+
+  beforeEach(() => {
+    mockRequest = {
+      operation: Operation.CREATE,
+      object: {
+        apiVersion: "v1",
+        kind: "Pod",
+        metadata: {
+          name: "test-pod",
+          labels: {
+            "existing-label": "true",
+          },
+          annotations: {
+            "existing-annotation": "true",
+          },
+        },
+      },
+      dryRun: false,
+      uid: "test-uid",
+      name: "test-pod",
+      kind: { group: "", version: "v1", kind: "Pod" },
+      resource: { group: "", version: "v1", resource: "pods" },
+      userInfo: {},
+    };
+  });
+
+  it("should initialize correctly for non-DELETE operations", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(wrapper.Raw).toEqual(mockRequest.object);
+  });
+
+  it("should initialize correctly for DELETE operations", () => {
+    mockRequest = {
+      ...mockRequest,
+      operation: Operation.DELETE,
+      oldObject: {
+        apiVersion: "v1",
+        kind: "Pod",
+        metadata: {
+          name: "test-pod",
+        },
+      },
+    };
+
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(wrapper.Raw).toEqual(mockRequest.oldObject);
+  });
+
+  it("should provide correct value for PermitSideEffects", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(wrapper.PermitSideEffects).toEqual(true);
+  });
+
+  it("should provide correct value for IsDryRun", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(wrapper.IsDryRun).toEqual(false);
+  });
+
+  it("should provide access to old resource", () => {
+    mockRequest = {
+      ...mockRequest,
+      oldObject: {
+        apiVersion: "v1",
+        kind: "Pod",
+        metadata: {
+          name: "old-test-pod",
+        },
+      },
+    };
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(wrapper.OldResource).toEqual(mockRequest.oldObject);
+  });
+
+  it("should provide access to the request object", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(wrapper.Request).toEqual(mockRequest);
+  });
+
+  it("should throw an error if the request object is not available", () => {
+    mockRequest = {
+      ...mockRequest,
+      object: undefined as unknown as KubernetesObject,
+    };
+
+    expect(() => new PeprMutateRequest(mockRequest)).toThrow("unable to load the request object into PeprRequest.RawP");
+  });
+
+  it("should merge the provided object with the current resource", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    wrapper.Merge({
+      metadata: {
+        labels: {
+          "test-label-2": "true",
+        },
+      },
+    });
+
+    expect(wrapper.Raw.metadata?.labels).toEqual({
+      "existing-label": "true",
+      "test-label-2": "true",
+    });
+  });
+
+  it("should set a label", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    wrapper.SetLabel("new-label", "newValue");
+    expect(wrapper.Raw.metadata?.labels?.["new-label"]).toEqual("newValue");
+  });
+
+  it("should set an annotation", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    wrapper.SetAnnotation("new-annotation", "newValue");
+    expect(wrapper.Raw.metadata?.annotations?.["new-annotation"]).toEqual("newValue");
+  });
+
+  it("should remove an existing label", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    wrapper.RemoveLabel("existing-label");
+    expect(wrapper.Raw.metadata?.labels?.["existing-label"]).toBeUndefined();
+  });
+
+  it("should remove an existing annotation", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    wrapper.RemoveAnnotation("existing-annotation");
+    expect(wrapper.Raw.metadata?.annotations?.["existing-annotation"]).toBeUndefined();
+  });
+
+  it("should check if a label exists", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(wrapper.HasLabel("existing-label")).toBeTruthy();
+    expect(wrapper.HasLabel("non-existent-label")).toBeFalsy();
+  });
+
+  it("should check if an annotation exists", () => {
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(wrapper.HasAnnotation("existing-annotation")).toBeTruthy();
+    expect(wrapper.HasAnnotation("non-existent-annotation")).toBeFalsy();
+  });
+
+  it("should set a label when metadata and labels do not exist", () => {
+    delete mockRequest.object.metadata;
+    const wrapper = new PeprMutateRequest(mockRequest);
+    wrapper.SetLabel("new-label", "newValue");
+    expect(wrapper.Raw.metadata?.labels?.["new-label"]).toEqual("newValue");
+  });
+
+  it("should set an annotation when metadata and annotations do not exist", () => {
+    delete mockRequest.object.metadata;
+    const wrapper = new PeprMutateRequest(mockRequest);
+    wrapper.SetAnnotation("new-annotation", "newValue");
+    expect(wrapper.Raw.metadata?.annotations?.["new-annotation"]).toEqual("newValue");
+  });
+
+  it("should not throw an error when removing a non-existent label", () => {
+    delete mockRequest.object.metadata;
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(() => wrapper.RemoveLabel("non-existent-label")).not.toThrow();
+  });
+
+  it("should not throw an error when removing a non-existent annotation", () => {
+    delete mockRequest.object.metadata;
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(() => wrapper.RemoveAnnotation("non-existent-annotation")).not.toThrow();
+  });
+
+  it("should return false for HasLabel when metadata or labels do not exist", () => {
+    delete mockRequest.object.metadata;
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(wrapper.HasLabel("any-label")).toBeFalsy();
+  });
+
+  it("should return false for HasAnnotation when metadata or annotations do not exist", () => {
+    delete mockRequest.object.metadata;
+    const wrapper = new PeprMutateRequest(mockRequest);
+    expect(wrapper.HasAnnotation("any-annotation")).toBeFalsy();
+  });
+});