pepr 2.0.0 → 2.0.3

package/package.json

@@ -16,17 +16,18 @@
     "!src/fixtures/**",
     "!dist/**/*.test.d.ts*"
   ],
-  "version": "2.0.0",
+  "version": "2.0.3",
   "main": "dist/lib.js",
   "types": "dist/lib.d.ts",
   "scripts": {
     "build": "tsc -p config/tsconfig.root.json && node build.mjs && npm pack",
     "build:image": "npm run build && docker buildx build --output type=docker --tag pepr:dev .",
-    "build:image:unicorn": "npm run build && docker buildx build --output type=docker --tag pepr/private:dev $(node scripts/read-unicorn-build-args.mjs) .",
+    "build:image:unicorn": "npm run build && docker buildx build --file config/Dockerfile --output type=docker --tag pepr/private:dev .",
     "ci": "npm ci",
     "cluster:k3d": "k3d cluster delete pepr-dev && k3d cluster create pepr-dev --k3s-arg '--debug@server:0' --wait && kubectl rollout status deployment -n kube-system",
     "cluster:k3d:import-upstream": "npm run build && docker buildx build --output type=docker --tag pepr:dev . && k3d image import pepr:dev -c pepr-dev",
-    "cluster:k3d:import-unicorn": "npm run build && docker buildx build --output type=docker --tag pepr/private:dev $(node scripts/read-unicorn-build-args.mjs) . && k3d image import pepr/private:dev -c pepr-dev",
+    "cluster:k3d:import-unicorn": "npm run build && docker buildx build --file config/Dockerfile --output type=docker --tag pepr/private:dev . && k3d image import pepr/private:dev -c pepr-dev",
+    "check:container-image-equality": "tsx scripts/check-chainguard-image-equality.ts",
     "format:check": "npm run format:src && npm run format:tests && npm run format:markdown && npm run format:integration && npm run format:prettier -- --check",
     "format:fix": "npm run format:src -- --fix && npm run format:markdown -- --fix && npm run format:integration -- --fix && npm run format:prettier -- --write",
     "format:integration": "eslint --config config/eslint.integration.config.mjs integration/cli integration/helpers",
@@ -35,7 +36,7 @@
     "format:src": "eslint --config config/eslint.root.config.mjs 'src/**/*.ts' '.github/workflows/scripts/**/*.ts' --ignore-pattern '**/*.test.ts' --ignore-pattern 'src/templates/**'",
     "format:tests": "eslint --config config/eslint.test.config.mjs 'src/**/*.test.ts'",
     "gen-data-json": "node hack/build-template-data.mjs",
-    "prebuild": "rm -fr dist/* && npm run gen-data-json",
+    "prebuild": "node patches/apply-patches.mjs && rm -fr dist/* && npm run gen-data-json",
     "prepare": "if [ \"$NODE_ENV\" != 'production' ]; then husky; fi",
     "set-version": "bash -lc 'ver=${PEPR_VERSION:-}; if [ -z \"$ver\" ]; then git fetch --tags --force; ver=$(git describe --tags --abbrev=0); fi; ver=${ver#v}; echo Using version $ver; node ./scripts/set-version.js \"$ver\"'",
     "test": "npm run test:unit && npm run test:integration",
@@ -50,16 +51,16 @@
   },
   "dependencies": {
     "@types/ramda": "0.32.0",
-    "@typescript-eslint/eslint-plugin": "8.66.0",
-    "@typescript-eslint/parser": "8.66.0",
+    "@typescript-eslint/eslint-plugin": "8.70.0",
+    "@typescript-eslint/parser": "8.70.0",
     "commander": "15.0.0",
     "eslint": "^10.8.0",
     "express": "5.2.1",
     "fast-json-patch": "3.1.1",
-    "globals": "17.9.0",
+    "globals": "17.12.0",
     "http-status-codes": "^2.3.0",
     "json-pointer": "^0.6.2",
-    "kubernetes-fluent-client": "3.11.11",
+    "kubernetes-fluent-client": "3.12.3",
     "pino": "10.3.1",
     "pino-pretty": "13.1.3",
     "prom-client": "15.1.3",
@@ -67,8 +68,8 @@
     "ramda": "0.32.0"
   },
   "devDependencies": {
-    "@commitlint/cli": "21.2.1",
-    "@commitlint/config-conventional": "21.2.0",
+    "@commitlint/cli": "21.2.2",
+    "@commitlint/config-conventional": "21.2.2",
     "@eslint/eslintrc": "^3.3.6",
     "@eslint/js": "^10.0.1",
     "@types/command-line-args": "^5.2.3",
@@ -76,7 +77,7 @@
     "@types/json-pointer": "^1.0.34",
     "@types/json-schema": "^7.0.15",
     "@types/ms": "^2.1.0",
-    "@types/node": "^24.13.3",
+    "@types/node": "^26.2.0",
     "@types/node-forge": "1.3.14",
     "@types/readable-stream": "^4.0.21",
     "@types/urijs": "^1.19.25",
@@ -86,18 +87,19 @@
     "husky": "^9.1.6",
     "js-yaml": "^5.2.1",
     "ms": "^2.1.3",
+    "patch-package": "^8.0.1",
     "prettier": "^3.6.2",
     "selfsigned": "^5.5.0",
     "shellcheck": "^4.1.0",
     "tsx": "^4.20.3",
-    "undici": "8.10.0",
+    "undici": "8.10.2",
     "vitest": "^4.0.4"
   },
   "overrides": {
     "brace-expansion": "^5.0.9",
     "ip-address": "^10.5.0",
     "tar": "^7.5.16",
-    "fast-uri": "^3.1.5"
+    "fast-uri": "^3.1.7"
   },
   "peerDependencies": {
     "@types/prompts": "^2.4.9",

package/src/cli/build/applyCompatibilityPatches.ts

@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+
+const THREAD_STREAM_TYPES = ["thread-stream", "index.d.ts"];
+const TRANSFER_LIST_ITEM = "workerThreads.TransferListItem[]";
+const TRANSFERABLE = "workerThreads.Transferable[]";
+
+export function applyBuildCompatibilityPatches(npmRoot: string): void {
+  const threadStreamTypes = join(npmRoot, ...THREAD_STREAM_TYPES);
+
+  if (!existsSync(threadStreamTypes)) {
+    return;
+  }
+
+  const currentTypes = readFileSync(threadStreamTypes, "utf8");
+
+  if (!currentTypes.includes(TRANSFER_LIST_ITEM) || currentTypes.includes(TRANSFERABLE)) {
+    return;
+  }
+
+  writeFileSync(threadStreamTypes, currentTypes.replace(TRANSFER_LIST_ITEM, TRANSFERABLE));
+}

package/src/cli/build/buildModule.ts

@@ -9,6 +9,7 @@ import { watchForChanges } from "./build.helpers";
 import { PeprConfig, Reloader } from "../types";
 import { BuildContext } from "esbuild";
 import { loadModule } from "./loadModule";
+import { applyBuildCompatibilityPatches } from "./applyCompatibilityPatches";
 
 export type BuildModuleReturn = {
   ctx: BuildContext<BuildOptions>;
@@ -71,6 +72,7 @@ export async function buildModule(
 
     // Resolve node_modules folder (in support of npm workspaces!) and run tsc
     const npmRoot = execFileSync("npm", ["root"]).toString().trim();
+    applyBuildCompatibilityPatches(npmRoot);
     execFileSync(`${npmRoot}/.bin/tsc`, [
       "--project",
       `${modulePath}/tsconfig.json`,
@@ -142,18 +144,20 @@ export async function buildModule(
   }
 }
 
-interface BuildModuleResult {
+interface BuildModuleError extends Error {
   stdout?: Buffer;
-  stderr: Buffer;
+  stderr?: Buffer;
 }
 
-function handleModuleBuildError(e: BuildModuleResult): void {
+function handleModuleBuildError(e: BuildModuleError): never {
   console.error(`Error building module:`, e);
 
-  if (!e.stdout) process.exit(1); // Exit with a non-zero exit code on any other error
+  if (!e.stdout) {
+    throw e;
+  }
 
   const out = e.stdout.toString() as string;
-  const err = e.stderr.toString();
+  const err = e.stderr?.toString() ?? "";
 
   console.info(out);
   console.error(err);
@@ -183,4 +187,6 @@ function handleModuleBuildError(e: BuildModuleResult): void {
       );
     });
   }
+
+  throw e;
 }

package/src/cli/build/index.ts

@@ -19,6 +19,7 @@ import {
 import { buildModule, BuildModuleReturn } from "./buildModule";
 import Log from "../../lib/telemetry/logger";
 import { resolve } from "path";
+import { warnIfAdminRbac } from "../rbacModeWarning";
 
 interface BuildOpts {
   customName?: string;
@@ -172,6 +173,7 @@ export default function (program: Command): void {
         return;
       }
 
+      warnIfAdminRbac(determineRbacMode(opts, buildModuleResult.cfg));
       await generateDeploymentAssets(buildModuleResult, opts, outputDir);
     });
 }

package/src/cli/deploy/buildAndDeploy.ts

@@ -5,6 +5,7 @@ import { namespaceDeploymentsReady } from "../../lib/deploymentChecks";
 import { namespaceComplianceValidator, validateCapabilityNames } from "../../lib/helpers";
 import { CapabilityExport } from "../../lib/types";
 import { buildModule } from "../build/buildModule";
+import { warnIfAdminRbac } from "../rbacModeWarning";
 
 export async function buildAndDeployModule(image: string, force: boolean): Promise<void> {
   const builtModule = await buildModule("dist", {});
@@ -24,6 +25,7 @@ export async function buildAndDeployModule(image: string, force: boolean): Promi
     validateNamespaces(capability, webhook);
   }
   try {
+    warnIfAdminRbac(builtModule.cfg.pepr.rbacMode);
     await webhook.deploy(deployWebhook, force, builtModule.cfg.pepr.webhookTimeout ?? 10);
 
     // wait for capabilities to be loaded and test names

package/src/cli/dev.ts

@@ -13,6 +13,7 @@ import { deployWebhook } from "../lib/assets/deploy";
 import { promises as fs } from "fs";
 import { validateCapabilityNames } from "../lib/helpers";
 import Log from "../lib/telemetry/logger";
+import { warnIfAdminRbac } from "./rbacModeWarning";
 
 export default function (program: Command): void {
   program
@@ -56,6 +57,7 @@ export default function (program: Command): void {
 
       try {
         let program: ChildProcess;
+        let hasWarnedAboutAdminRbac = false;
         const name = `pepr-${cfg.pepr.uuid}`;
         const scheduleStore = `pepr-${cfg.pepr.uuid}-schedule`;
         const store = `pepr-${cfg.pepr.uuid}-store`;
@@ -65,6 +67,10 @@ export default function (program: Command): void {
           Log.info(`Running module ${path}`);
 
           // Deploy the webhook with a 30 second timeout for debugging, don't force
+          if (!hasWarnedAboutAdminRbac) {
+            warnIfAdminRbac(cfg.pepr.rbacMode);
+            hasWarnedAboutAdminRbac = true;
+          }
           await webhook.deploy(deployWebhook, false, 30);
 
           try {

package/src/cli/init/index.ts

@@ -14,6 +14,7 @@ import { createProjectFiles } from "./createProjectFiles";
 import { v4 as uuidv4 } from "uuid";
 import Log from "../../lib/telemetry/logger";
 import { sanitizeResourceName } from "../../sdk/sdk";
+import { warnIfAdminRbac } from "../rbacModeWarning";
 
 export default function (): Command {
   let response = {} as PromptOptions;
@@ -71,12 +72,7 @@ export default function (): Command {
           }
 
           Log.info(`New Pepr module created at ${dirName}`);
-          Log.warn(
-            `The default RBAC mode (admin) generates a ClusterRole with cluster-admin level ` +
-              `permissions for the hello-pepr capability. This is intended for demo/POC purposes only ` +
-              `and should NOT be used in production.` +
-              `See https://docs.pepr.dev/user-guide/rbac/ for more details.`,
-          );
+          warnIfAdminRbac(packageJSON.data.pepr.rbacMode);
           Log.info(`Open VSCode or your editor of choice in ${dirName} to get started!`);
         } catch (error) {
           throw new Error(`Error creating Pepr module:`, { cause: error });

package/src/cli/rbacModeWarning.ts

@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: Apache-2.0
+// SPDX-FileCopyrightText: 2023-Present The Pepr Authors
+
+import Log from "../lib/telemetry/logger";
+
+export const ADMIN_RBAC_WARNING =
+  "Admin RBAC mode grants broad cluster-wide permissions. It is intended for demo/POC purposes " +
+  "only and should NOT be used in production. Use scoped RBAC mode for production workloads. " +
+  "See https://docs.pepr.dev/user-guide/rbac/ for more details.";
+
+export function warnIfAdminRbac(rbacMode?: string): void {
+  if (rbacMode !== "scoped") {
+    Log.warn(ADMIN_RBAC_WARNING);
+  }
+}

package/src/lib/assets/assets.ts

@@ -182,24 +182,6 @@ export class Assets {
     mutateWebhook: V1MutatingWebhookConfiguration | V1ValidatingWebhookConfiguration | null,
     helm: Record<string, Record<string, string>>,
   ): Promise<void> => {
-    if (validateWebhook || mutateWebhook) {
-      await fs.writeFile(
-        helm.files.admissionDeploymentYaml,
-        dedent(admissionDeployTemplate(this.buildTimestamp, "admission")),
-      );
-      await fs.writeFile(
-        helm.files.admissionServiceMonitorYaml,
-        dedent(
-          serviceMonitorTemplate(
-            process.env.PEPR_CUSTOM_BUILD_NAME
-              ? `admission-${process.env.PEPR_CUSTOM_BUILD_NAME}`
-              : "admission",
-            `admission`,
-          ),
-        ),
-      );
-    }
-
     if (mutateWebhook) {
       await fs.writeFile(
         helm.files.mutationWebhookYaml,
@@ -215,6 +197,26 @@ export class Assets {
     }
   };
 
+  writeAdmissionControllerFiles = async (
+    helm: Record<string, Record<string, string>>,
+  ): Promise<void> => {
+    await fs.writeFile(
+      helm.files.admissionDeploymentYaml,
+      dedent(admissionDeployTemplate(this.buildTimestamp, "admission")),
+    );
+    await fs.writeFile(
+      helm.files.admissionServiceMonitorYaml,
+      dedent(
+        serviceMonitorTemplate(
+          process.env.PEPR_CUSTOM_BUILD_NAME
+            ? `admission-${process.env.PEPR_CUSTOM_BUILD_NAME}`
+            : "admission",
+          `admission`,
+        ),
+      ),
+    );
+  };
+
   generateHelmChart = async (
     webhookGeneratorFunction: (
       assets: Assets,
@@ -299,6 +301,10 @@ export class Assets {
         ),
       };
 
+      if (isAdmission(this.capabilities) || norWatchOrAdmission(this.capabilities)) {
+        await this.writeAdmissionControllerFiles(helm);
+      }
+
       await this.writeWebhookFiles(webhooks.validate, webhooks.mutate, helm);
 
       const watchDeployment = getWatcherFunction(this, moduleHash, this.buildTimestamp);

package/src/lib/assets/yaml/generateZarfYaml.ts

@@ -5,6 +5,7 @@ type ConfigType = "manifests" | "charts";
 
 export function generateZarfYamlGeneric(assets: Assets, path: string, type: ConfigType): string {
   const zarfComponentName = process.env.PEPR_CUSTOM_BUILD_NAME ?? "module";
+  const helmReleaseName = process.env.PEPR_CUSTOM_BUILD_NAME ?? assets.name;
   const manifestSettings = {
     name: zarfComponentName,
     namespace: "pepr-system",
@@ -15,6 +16,7 @@ export function generateZarfYamlGeneric(assets: Assets, path: string, type: Conf
     namespace: "pepr-system",
     version: `${assets.config.appVersion || "0.0.1"}`,
     localPath: path,
+    releaseName: helmReleaseName,
   };
 
   const component = {

package/src/lib/core/queue.ts

@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-FileCopyrightText: 2023-Present The Pepr Authors
 import { KubernetesObject } from "@kubernetes/client-node";
-import { WatchPhase } from "kubernetes-fluent-client/dist/fluent/shared-types";
+import { WatchPhase } from "kubernetes-fluent-client";
 import { randomBytes } from "node:crypto";
 import Log from "../telemetry/logger";
 

package/src/lib/processors/watch-processor.ts

@@ -5,16 +5,16 @@ import { Binding } from "../types";
 import { Capability } from "../core/capability";
 import { Event } from "../enums";
 import {
+  GenericClass,
   K8s,
+  KubernetesListObject,
   KubernetesObject,
   WatchCfg,
   WatchEvent,
-  GenericClass,
+  WatcherType,
+  WatchPhase,
 } from "kubernetes-fluent-client";
 import { Queue } from "../core/queue";
-import { WatcherType } from "kubernetes-fluent-client/dist/fluent/types";
-import { WatchPhase } from "kubernetes-fluent-client/dist/fluent/shared-types";
-import { KubernetesListObject } from "kubernetes-fluent-client/dist/types";
 import { filterNoMatchReason } from "../filter/filter";
 import { metricsCollector, MetricsCollectorInstance } from "../telemetry/metrics";
 import { removeFinalizer } from "../finalizer";

package/src/lib/types.ts

@@ -1,9 +1,13 @@
 // SPDX-License-Identifier: Apache-2.0
 // SPDX-FileCopyrightText: 2023-Present The Pepr Authors
 
-import { GenericClass, GroupVersionKind, KubernetesObject } from "kubernetes-fluent-client";
+import {
+  GenericClass,
+  GroupVersionKind,
+  KubernetesObject,
+  WatchPhase,
+} from "kubernetes-fluent-client";
 import { Event } from "./enums";
-import { WatchPhase } from "kubernetes-fluent-client/dist/fluent/shared-types";
 import { Logger } from "pino";
 import { PeprMutateRequest } from "./mutate-request";
 import { PeprValidateRequest } from "./validate-request";