pepr 0.45.0 → 0.45.1-nightly.0

package/src/lib/processors/mutate-processor.ts

@@ -10,7 +10,7 @@ import { shouldSkipRequest } from "../filter/filter";
 import { MutateResponse } from "../k8s";
 import { AdmissionRequest, Binding } from "../types";
 import Log from "../telemetry/logger";
-import { ModuleConfig } from "../core/module";
+import { ModuleConfig } from "../types";
 import { PeprMutateRequest } from "../mutate-request";
 import { base64Encode, convertFromBase64Map, convertToBase64Map } from "../utils";
 import { OnError } from "../../cli/init/enums";

package/src/lib/processors/validate-processor.ts

@@ -9,7 +9,7 @@ import { AdmissionRequest, Binding } from "../types";
 import Log from "../telemetry/logger";
 import { convertFromBase64Map } from "../utils";
 import { PeprValidateRequest } from "../validate-request";
-import { ModuleConfig } from "../core/module";
+import { ModuleConfig } from "../types";
 import { resolveIgnoreNamespaces } from "../assets/webhooks";
 import { MeasureWebhookTimeout } from "../telemetry/webhookTimeouts";
 import { WebhookType } from "../enums";

package/src/lib/processors/watch-processor.ts

@@ -4,11 +4,12 @@ import Log from "../telemetry/logger";
 import { Binding } from "../types";
 import { Capability } from "../core/capability";
 import { Event } from "../enums";
-import { K8s, KubernetesObject, WatchCfg, WatchEvent } from "kubernetes-fluent-client";
+import { K8s, KubernetesObject, WatchCfg, WatchEvent, GenericClass } from "kubernetes-fluent-client";
 import { Queue } from "../core/queue";
-import { WatchPhase } from "kubernetes-fluent-client/dist/fluent/types";
+import { WatchPhase, WatcherType } from "kubernetes-fluent-client/dist/fluent/types";
+import { KubernetesListObject } from "kubernetes-fluent-client/dist/types";
 import { filterNoMatchReason } from "../filter/filter";
-import { metricsCollector } from "../telemetry/metrics";
+import { metricsCollector, MetricsCollectorInstance } from "../telemetry/metrics";
 import { removeFinalizer } from "../finalizer";
 
 // stores Queue instances
@@ -157,36 +158,8 @@ async function runBinding(
     }
   }, watchCfg);
 
-  // If failure continues, log and exit
-  watcher.events.on(WatchEvent.GIVE_UP, err => {
-    Log.error(err, "Watch failed after 5 attempts, giving up");
-    process.exit(1);
-  });
-
-  watcher.events.on(WatchEvent.CONNECT, url => logEvent(WatchEvent.CONNECT, url));
-
-  watcher.events.on(WatchEvent.DATA_ERROR, err => logEvent(WatchEvent.DATA_ERROR, err.message));
-  watcher.events.on(WatchEvent.RECONNECT, retryCount =>
-    logEvent(WatchEvent.RECONNECT, `Reconnecting after ${retryCount} attempt${retryCount === 1 ? "" : "s"}`),
-  );
-  watcher.events.on(WatchEvent.RECONNECT_PENDING, () => logEvent(WatchEvent.RECONNECT_PENDING));
-  watcher.events.on(WatchEvent.GIVE_UP, err => logEvent(WatchEvent.GIVE_UP, err.message));
-  watcher.events.on(WatchEvent.ABORT, err => logEvent(WatchEvent.ABORT, err.message));
-  watcher.events.on(WatchEvent.OLD_RESOURCE_VERSION, err => logEvent(WatchEvent.OLD_RESOURCE_VERSION, err));
-  watcher.events.on(WatchEvent.NETWORK_ERROR, err => logEvent(WatchEvent.NETWORK_ERROR, err.message));
-  watcher.events.on(WatchEvent.LIST_ERROR, err => logEvent(WatchEvent.LIST_ERROR, err.message));
-  watcher.events.on(WatchEvent.LIST, list => logEvent(WatchEvent.LIST, JSON.stringify(list, undefined, 2)));
-  watcher.events.on(WatchEvent.CACHE_MISS, windowName => {
-    metricsCollector.incCacheMiss(windowName);
-  });
-
-  watcher.events.on(WatchEvent.INIT_CACHE_MISS, windowName => {
-    metricsCollector.initCacheMissWindow(windowName);
-  });
-
-  watcher.events.on(WatchEvent.INC_RESYNC_FAILURE_COUNT, retryCount => {
-    metricsCollector.incRetryCount(retryCount);
-  });
+  // Register event handlers
+  registerWatchEventHandlers(watcher, logEvent, metricsCollector);
 
   // Start the watch
   try {
@@ -205,3 +178,55 @@ export function logEvent(event: WatchEvent, message: string = "", obj?: Kubernet
     Log.debug(logMessage);
   }
 }
+
+export type WatchEventArgs<K extends WatchEvent, T extends GenericClass> = {
+  [WatchEvent.LIST]: KubernetesListObject<InstanceType<T>>;
+  [WatchEvent.RECONNECT]: number;
+  [WatchEvent.CACHE_MISS]: string;
+  [WatchEvent.INIT_CACHE_MISS]: string;
+  [WatchEvent.GIVE_UP]: Error;
+  [WatchEvent.ABORT]: Error;
+  [WatchEvent.OLD_RESOURCE_VERSION]: string;
+  [WatchEvent.NETWORK_ERROR]: Error;
+  [WatchEvent.LIST_ERROR]: Error;
+  [WatchEvent.DATA_ERROR]: Error;
+  [WatchEvent.CONNECT]: string;
+  [WatchEvent.RECONNECT_PENDING]: undefined;
+  [WatchEvent.DATA]: undefined;
+  [WatchEvent.INC_RESYNC_FAILURE_COUNT]: number;
+}[K];
+
+export type LogEventFunction = (event: WatchEvent, message?: string) => void;
+export function registerWatchEventHandlers(
+  watcher: WatcherType<GenericClass>,
+  logEvent: LogEventFunction,
+  metricsCollector: MetricsCollectorInstance,
+): void {
+  const eventHandlers: {
+    [K in WatchEvent]?: (arg: WatchEventArgs<K, GenericClass>) => void;
+  } = {
+    [WatchEvent.DATA]: () => null,
+    [WatchEvent.GIVE_UP]: err => {
+      // If failure continues, log and exit
+      logEvent(WatchEvent.GIVE_UP, err.message);
+      process.exit(1);
+    },
+    [WatchEvent.CONNECT]: url => logEvent(WatchEvent.CONNECT, url),
+    [WatchEvent.DATA_ERROR]: err => logEvent(WatchEvent.DATA_ERROR, err.message),
+    [WatchEvent.RECONNECT]: retryCount =>
+      logEvent(WatchEvent.RECONNECT, `Reconnecting after ${retryCount} attempt${retryCount === 1 ? "" : "s"}`),
+    [WatchEvent.RECONNECT_PENDING]: () => logEvent(WatchEvent.RECONNECT_PENDING),
+    [WatchEvent.ABORT]: err => logEvent(WatchEvent.ABORT, err.message),
+    [WatchEvent.OLD_RESOURCE_VERSION]: errMessage => logEvent(WatchEvent.OLD_RESOURCE_VERSION, errMessage),
+    [WatchEvent.NETWORK_ERROR]: err => logEvent(WatchEvent.NETWORK_ERROR, err.message),
+    [WatchEvent.LIST_ERROR]: err => logEvent(WatchEvent.LIST_ERROR, err.message),
+    [WatchEvent.LIST]: list => logEvent(WatchEvent.LIST, JSON.stringify(list, undefined, 2)),
+    [WatchEvent.CACHE_MISS]: windowName => metricsCollector.incCacheMiss(windowName),
+    [WatchEvent.INIT_CACHE_MISS]: windowName => metricsCollector.initCacheMissWindow(windowName),
+    [WatchEvent.INC_RESYNC_FAILURE_COUNT]: retryCount => metricsCollector.incRetryCount(retryCount),
+  };
+
+  Object.entries(eventHandlers).forEach(([event, handler]) => {
+    watcher.events.on(event, handler);
+  });
+}

package/src/lib/telemetry/metrics.ts

@@ -9,7 +9,7 @@ import Log from "./logger";
 
 const loggingPrefix = "MetricsCollector";
 
-type MetricsCollectorInstance = InstanceType<typeof MetricsCollector>;
+export type MetricsCollectorInstance = InstanceType<typeof MetricsCollector>;
 interface MetricNames {
   errors: string;
   alerts: string;
@@ -54,7 +54,7 @@ export class MetricsCollector {
     this.#registry = new Registry();
     this.#prefix = prefix;
     this.addCounter(this.#metricNames.errors, "Mutation/Validate errors encountered");
-    this.addCounter(this.#metricNames.alerts, "Mutation/Validate bad api token received");
+    this.addCounter(this.#metricNames.alerts, "Mutation/Validate bad api path received");
     this.addSummary(this.#metricNames.mutate, "Mutation operation summary");
     this.addSummary(this.#metricNames.validate, "Validation operation summary");
     this.addGauge(this.#metricNames.cacheMiss, "Number of cache misses per window", ["window"]);
@@ -148,8 +148,8 @@ export class MetricsCollector {
    * Increments the retry count gauge.
    * @param count - The count to increment by.
    */
-  incRetryCount = (count: string): void => {
-    this.incGauge(this.#metricNames.resyncFailureCount, { count });
+  incRetryCount = (count: number): void => {
+    this.incGauge(this.#metricNames.resyncFailureCount, { count: count.toString() });
   };
 
   /**

package/src/lib/types.ts

@@ -8,6 +8,7 @@ import { Logger } from "pino";
 import { PeprMutateRequest } from "./mutate-request";
 import { PeprValidateRequest } from "./validate-request";
 import { V1PolicyRule as PolicyRule } from "@kubernetes/client-node";
+import { WebhookIgnore, MutateResponse, ValidateResponse } from "./k8s";
 
 /**
  * Specifically for deploying images with a private registry
@@ -356,4 +357,51 @@ export interface GroupVersionResource {
 // DeepPartial utility type for deep optional properties
 export type DeepPartial<T> = {
   [P in keyof T]?: T[P] extends object ? DeepPartial<T[P]> : T[P];
+}; /** Custom Labels Type for package.json */
+
+export type CustomLabels = { namespace: Record<string, string> } | Record<string, never>;
+/** Configuration that MAY be set a Pepr module's package.json. */
+export type ModuleConfigOptions = {
+  /** The Pepr version this module uses */
+  peprVersion: string;
+  /** The user-defined version of the module */
+  appVersion: string;
+  /** A description of the Pepr module and what it does. */
+  description: string;
+  /** The webhookTimeout */
+  webhookTimeout: number;
+  /** Reject K8s resource AdmissionRequests on error. */
+  onError: string;
+  /** Define the log level for the in-cluster controllers */
+  logLevel: string;
+  /** Propagate env variables to in-cluster controllers */
+  env: Record<string, string>;
+  /** Custom RBAC rules */
+  rbac: PolicyRule[];
+  /** The RBAC mode; if "scoped", generates scoped rules, otherwise uses wildcard rules. */
+  rbacMode: string;
+  /** Custom Labels for Kubernetes Objects */
+  customLabels: CustomLabels;
+};
+/** Global configuration for the Pepr runtime. */
+export type ModuleConfig = {
+  /** A unique identifier for this Pepr module. This is automatically generated by Pepr. */
+  uuid: string;
+  /** Configure global exclusions that will never be processed by Pepr. */
+  alwaysIgnore: WebhookIgnore;
+} & Partial<ModuleConfigOptions>;
+
+export type PackageJSON = {
+  description: string;
+  pepr: ModuleConfig;
 };
+
+export type PeprModuleOptions = {
+  deferStart?: boolean;
+
+  /** A user-defined callback to pre-process or intercept a Pepr request from K8s immediately before it is processed */
+  beforeHook?: (req: AdmissionRequest) => void;
+
+  /** A user-defined callback to post-process or intercept a Pepr response just before it is returned to K8s */
+  afterHook?: (res: MutateResponse | ValidateResponse) => void;
+}; // Track if this is a watch mode controller

package/src/sdk/sdk.ts

@@ -46,11 +46,15 @@ export function containers(
 export async function writeEvent(
   cr: GenericKind,
   event: Partial<kind.CoreEvent>,
-  eventType: string,
-  eventReason: string,
-  reportingComponent: string,
-  reportingInstance: string,
+  options: {
+    eventType: string;
+    eventReason: string;
+    reportingComponent: string;
+    reportingInstance: string;
+  },
 ): Promise<void> {
+  const { eventType, eventReason, reportingComponent, reportingInstance } = options;
+
   await K8s(kind.CoreEvent).Create({
     type: eventType,
     reason: eventReason,