kx-cli 0.0.9__tar.gz → 0.0.11__tar.gz

{kx_cli-0.0.9/src/kx_cli.egg-info → kx_cli-0.0.11}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: kx-cli
-Version: 0.0.9
+Version: 0.0.11
 Summary: kubectl wrapper with index-based resource selection
 Classifier: Programming Language :: Python :: 3
 Classifier: Programming Language :: Python :: 3.11
@@ -70,7 +70,7 @@ With pip:
 pip install kx-cli
 ```
 
-As a kubectl plugin via [krew](https://krew.sigs.k8s.io/), where kx is published as `idx` (no Python required; krew-index submission in progress):
+As a kubectl plugin via [krew](https://krew.sigs.k8s.io/), where kx is published as `idx` (no Python required):
 
 ```bash
 kubectl krew install idx
@@ -92,14 +92,15 @@ pipx run --spec kx-cli kx get pods
 
 Known kinds can drop the `get`: `kx pods`, `kx deploy -n kube-system`, `kx svc --match api` — kubectl shorthands (`po`, `deploy`, `svc`, `sts`, ...) included. An integer after a kind relists just that index: `kx po 3`. CRDs and other resource types still use `kx get <resource>`.
 
-Global flags: `--no-color` disables styled output, `-v`/`--version` prints the installed version, and `--help` on any command shows usage, examples, and aliases.
+Global flags: `--no-color` disables styled output, `-v`/`--version` prints the installed version, and `-h`/`--help` on any command shows usage, examples, and aliases.
 
 ### Commands
 
 <!-- commands-table-start -->
 | Command | Description |
 |---|---|
-| `kx get <resource> [--match/-m str] [kubectl flags...]` | List resources and assign index numbers for use with other commands; shorthand: kx <kind> (e.g. kx pods, kx po 3). |
+| `kx get <resource> [--match/-m str] [--decode] [--key/-k str] [--yes/-y] [kubectl flags...]` | List resources and assign index numbers for use with other commands; shorthand: kx <kind> (e.g. kx pods, kx po 3). |
+| `kx secret [--match/-m str] [--decode] [--key/-k str] [--yes/-y] [kubectl flags...]` | List Secrets like kx get, or show an indexed Secret's data with --decode; alias: kx secrets. |
 | `kx top [--match/-m str] [--no-limits] [kubectl flags...]` | List CPU/memory usage for pods in the current namespace and assign index numbers, like kx get; shows usage as a percent of each pod's resource limits unless --no-limits. |
 | `kx describe <indexes>... [kubectl flags...]` | Show full kubectl describe output for one or more indexed resources. |
 | `kx events <indexes>...` | Show Kubernetes events for one or more indexed resources. |
@@ -113,7 +114,7 @@ Global flags: `--no-color` disables styled output, `-v`/`--version` prints the i
 | `kx delete <indexes>... [--yes/-y]` | Delete one or more indexed resources (prompts for confirmation unless --yes). |
 | `kx edit <index> [kubectl flags...]` | Open an indexed resource in your editor via kubectl edit. |
 | `kx exec <index> [<cmd>...] [kubectl flags...]` | Open an interactive shell in an indexed pod (bash, falling back to sh). |
-| `kx tree <index> [--index/-i]` | Show the ownership graph for an indexed resource; --index assigns indexes to tree nodes. |
+| `kx tree [<index>] [--index/-i]` | Show the ownership graph for an indexed resource, or the whole current namespace when no index is given; --index assigns indexes to tree nodes. A Namespace index graphs that namespace. |
 | `kx rollout <action> <index>` | Run a rollout action (status, restart, pause, resume, history, undo) on a Deployment, StatefulSet, or DaemonSet. |
 | `kx scale <index> <replicas>` | Scale an indexed Deployment, StatefulSet, or ReplicaSet to a given replica count. |
 | `kx port-forward <index> <port> [kubectl flags...]` | Forward a local port to an indexed resource (Pod, Deployment, ReplicaSet, StatefulSet, DaemonSet, Service). |
@@ -147,6 +148,21 @@ CronJob runs, usage near limits), a per-pod status table, recent log tails
 from broken containers, and warning events — one screen instead of four
 kubectl commands.
 
+### Read a Secret in plaintext
+
+`kx secret <index> --decode` prints an indexed Secret's keys and values
+decoded, instead of the base64 kubectl returns. Values that aren't text show a
+`<binary, N bytes>` placeholder rather than garbling the table. `--key`/`-k`
+prints a single value raw — no banner, no wrapping — so it drops straight into
+a shell: `export PGPASSWORD=$(kx secret 1 --decode -k password)`, or redirect a
+binary value to a file. Bare `kx secret --decode` decodes every Secret in the
+namespace in one call, `-n` included — it confirms first unless you pass
+`--yes`/`-y`, since that prints every credential in the namespace.
+
+<div align="center">
+  <img src="https://raw.githubusercontent.com/jzills/kx/main/demo/secret.gif" alt="kx secret --decode demo" width="800"/>
+</div>
+
 ### Scan images for vulnerabilities
 
 `kx scan <index>` scans the unique container images of an indexed workload

{kx_cli-0.0.9 → kx_cli-0.0.11}/README.md

@@ -47,7 +47,7 @@ With pip:
 pip install kx-cli
 ```
 
-As a kubectl plugin via [krew](https://krew.sigs.k8s.io/), where kx is published as `idx` (no Python required; krew-index submission in progress):
+As a kubectl plugin via [krew](https://krew.sigs.k8s.io/), where kx is published as `idx` (no Python required):
 
 ```bash
 kubectl krew install idx
@@ -69,14 +69,15 @@ pipx run --spec kx-cli kx get pods
 
 Known kinds can drop the `get`: `kx pods`, `kx deploy -n kube-system`, `kx svc --match api` — kubectl shorthands (`po`, `deploy`, `svc`, `sts`, ...) included. An integer after a kind relists just that index: `kx po 3`. CRDs and other resource types still use `kx get <resource>`.
 
-Global flags: `--no-color` disables styled output, `-v`/`--version` prints the installed version, and `--help` on any command shows usage, examples, and aliases.
+Global flags: `--no-color` disables styled output, `-v`/`--version` prints the installed version, and `-h`/`--help` on any command shows usage, examples, and aliases.
 
 ### Commands
 
 <!-- commands-table-start -->
 | Command | Description |
 |---|---|
-| `kx get <resource> [--match/-m str] [kubectl flags...]` | List resources and assign index numbers for use with other commands; shorthand: kx <kind> (e.g. kx pods, kx po 3). |
+| `kx get <resource> [--match/-m str] [--decode] [--key/-k str] [--yes/-y] [kubectl flags...]` | List resources and assign index numbers for use with other commands; shorthand: kx <kind> (e.g. kx pods, kx po 3). |
+| `kx secret [--match/-m str] [--decode] [--key/-k str] [--yes/-y] [kubectl flags...]` | List Secrets like kx get, or show an indexed Secret's data with --decode; alias: kx secrets. |
 | `kx top [--match/-m str] [--no-limits] [kubectl flags...]` | List CPU/memory usage for pods in the current namespace and assign index numbers, like kx get; shows usage as a percent of each pod's resource limits unless --no-limits. |
 | `kx describe <indexes>... [kubectl flags...]` | Show full kubectl describe output for one or more indexed resources. |
 | `kx events <indexes>...` | Show Kubernetes events for one or more indexed resources. |
@@ -90,7 +91,7 @@ Global flags: `--no-color` disables styled output, `-v`/`--version` prints the i
 | `kx delete <indexes>... [--yes/-y]` | Delete one or more indexed resources (prompts for confirmation unless --yes). |
 | `kx edit <index> [kubectl flags...]` | Open an indexed resource in your editor via kubectl edit. |
 | `kx exec <index> [<cmd>...] [kubectl flags...]` | Open an interactive shell in an indexed pod (bash, falling back to sh). |
-| `kx tree <index> [--index/-i]` | Show the ownership graph for an indexed resource; --index assigns indexes to tree nodes. |
+| `kx tree [<index>] [--index/-i]` | Show the ownership graph for an indexed resource, or the whole current namespace when no index is given; --index assigns indexes to tree nodes. A Namespace index graphs that namespace. |
 | `kx rollout <action> <index>` | Run a rollout action (status, restart, pause, resume, history, undo) on a Deployment, StatefulSet, or DaemonSet. |
 | `kx scale <index> <replicas>` | Scale an indexed Deployment, StatefulSet, or ReplicaSet to a given replica count. |
 | `kx port-forward <index> <port> [kubectl flags...]` | Forward a local port to an indexed resource (Pod, Deployment, ReplicaSet, StatefulSet, DaemonSet, Service). |
@@ -124,6 +125,21 @@ CronJob runs, usage near limits), a per-pod status table, recent log tails
 from broken containers, and warning events — one screen instead of four
 kubectl commands.
 
+### Read a Secret in plaintext
+
+`kx secret <index> --decode` prints an indexed Secret's keys and values
+decoded, instead of the base64 kubectl returns. Values that aren't text show a
+`<binary, N bytes>` placeholder rather than garbling the table. `--key`/`-k`
+prints a single value raw — no banner, no wrapping — so it drops straight into
+a shell: `export PGPASSWORD=$(kx secret 1 --decode -k password)`, or redirect a
+binary value to a file. Bare `kx secret --decode` decodes every Secret in the
+namespace in one call, `-n` included — it confirms first unless you pass
+`--yes`/`-y`, since that prints every credential in the namespace.
+
+<div align="center">
+  <img src="https://raw.githubusercontent.com/jzills/kx/main/demo/secret.gif" alt="kx secret --decode demo" width="800"/>
+</div>
+
 ### Scan images for vulnerabilities
 
 `kx scan <index>` scans the unique container images of an indexed workload

{kx_cli-0.0.9 → kx_cli-0.0.11}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "kx-cli"
-version = "0.0.9"
+version = "0.0.11"
 description = "kubectl wrapper with index-based resource selection"
 readme = "README.md"
 requires-python = ">=3.11"

{kx_cli-0.0.9 → kx_cli-0.0.11}/src/kx/commands/events.py

@@ -1,4 +1,4 @@
-from kx.events import EventsServiceProtocol
+from kx.events import EventRow, EventsServiceProtocol
 from kx.kubectl import KubectlServiceProtocol
 from kx.refresh import ensure_exists
 from kx.state import StateServiceProtocol
@@ -15,7 +15,7 @@ class EventsCommand:
         self.events = events
         self.kubectl = kubectl
 
-    def execute(self, index: int) -> str:
+    def execute(self, index: int) -> list[EventRow]:
         name, namespace, kind = self.state.fields(index)
         all_events = self.events.get(namespace)
         filtered = self.events.filter(all_events, name, kind)
@@ -24,14 +24,21 @@ class EventsCommand:
             # Deleted resources keep their events ~1h; only an empty result
             # warrants checking whether the target itself is gone.
             ensure_exists(self.kubectl, kind, name, namespace)
-            return "No events found"
+            return []
 
-        output = []
+        rows = []
         for event in filtered:
             obj = event.involved_object
-            output.append(
-                f"{event.type:8} {event.reason:30} "
-                f"{obj.kind:10} {event.metadata.creation_timestamp} "
-                f"{event.message}"
+            timestamp = getattr(event, "last_timestamp", None) or getattr(
+                event.metadata, "creation_timestamp", None
             )
-        return "\n".join(output)
+            rows.append(
+                EventRow(
+                    type=event.type or "",
+                    reason=event.reason or "",
+                    kind=obj.kind,
+                    message=event.message or "",
+                    timestamp=timestamp,
+                )
+            )
+        return rows

kx_cli-0.0.11/src/kx/commands/secret.py

@@ -0,0 +1,58 @@
+import base64
+import json
+
+from kx.kubectl import KubectlServiceProtocol
+from kx.state import StateServiceProtocol
+
+
+def to_display(value: bytes) -> str:
+    """Decoded text, or a placeholder for values that aren't valid UTF-8.
+
+    Keeps keystores and other binary payloads from garbling the table; `--key`
+    still emits their raw bytes so they can be redirected to a file."""
+    try:
+        return value.decode("utf-8")
+    except UnicodeDecodeError:
+        return f"<binary, {len(value)} bytes>"
+
+
+def _decode_data(obj: dict) -> dict[str, bytes]:
+    """Decoded `data` for one Secret object. Values stay `bytes` so the render
+    layer owns the text/binary decision. `stringData` is write-only and never
+    returned by the API, so `data` holds everything."""
+    return {
+        key: base64.b64decode(value) for key, value in (obj.get("data") or {}).items()
+    }
+
+
+class SecretCommand:
+    def __init__(self, state: StateServiceProtocol, kubectl: KubectlServiceProtocol):
+        self.state = state
+        self.kubectl = kubectl
+
+    def execute(self, index: int) -> dict[str, bytes]:
+        """Decoded data for the indexed Secret."""
+        name, namespace, kind = self.state.fields(index)
+        raw = self.kubectl.run(
+            ["get", kind, name, "-n", namespace, "-o", "json"],
+        )
+        return _decode_data(json.loads(raw))
+
+    def execute_all(
+        self, extra_args: list[str] | None = None
+    ) -> list[tuple[str, str, dict[str, bytes]]]:
+        """Every Secret in the target namespace as (name, namespace, data).
+
+        One kubectl call returns the whole list with data attached, so a
+        namespace sweep costs the same as a single fetch. `extra_args` carries
+        the user's kubectl flags so `-n` selects the namespace."""
+        raw = self.kubectl.run(["get", "secret", "-o", "json", *(extra_args or [])])
+        obj = json.loads(raw)
+        return [
+            (
+                item.get("metadata", {}).get("name", ""),
+                item.get("metadata", {}).get("namespace", ""),
+                _decode_data(item),
+            )
+            for item in obj.get("items") or []
+        ]

kx_cli-0.0.11/src/kx/commands/tree.py

@@ -0,0 +1,65 @@
+from rich.tree import Tree
+
+from kx.kinds import Kind
+from kx.kubectl import KubectlServiceProtocol
+from kx.state import State, StateServiceProtocol
+from kx.types import (
+    BuildIndexedTree,
+    BuildNamespaceIndexedTree,
+    BuildNamespaceTree,
+    BuildTree,
+)
+
+
+class TreeCommand:
+    def __init__(
+        self,
+        state: StateServiceProtocol,
+        kubectl: KubectlServiceProtocol,
+        build_tree: BuildTree,
+        build_indexed_tree: BuildIndexedTree,
+        build_namespace_tree: BuildNamespaceTree,
+        build_namespace_indexed_tree: BuildNamespaceIndexedTree,
+    ):
+        self.state = state
+        self.kubectl = kubectl
+        self.build_tree = build_tree
+        self.build_indexed_tree = build_indexed_tree
+        self.build_namespace_tree = build_namespace_tree
+        self.build_namespace_indexed_tree = build_namespace_indexed_tree
+
+    def execute(self, index: int, indexed: bool = False) -> Tree:
+        name, namespace, kind = self.state.fields(index)
+        # A Namespace row walks that namespace itself — its own name, not the
+        # namespace the `kx get ns` was run in.
+        if kind == Kind.Namespace:
+            return self._namespace(name, indexed)
+        if indexed:
+            tree, resources = self.build_indexed_tree(kind, name, namespace)
+            if resources:
+                self.state.save(
+                    State(
+                        resources={name: kind for name, kind in resources},
+                        namespace=namespace,
+                    )
+                )
+        else:
+            tree = self.build_tree(kind, name, namespace)
+        return tree
+
+    def execute_namespace(self, namespace: str, indexed: bool = False) -> Tree:
+        return self._namespace(namespace, indexed)
+
+    def _namespace(self, namespace: str, indexed: bool) -> Tree:
+        if indexed:
+            tree, resources = self.build_namespace_indexed_tree(namespace)
+            if resources:
+                self.state.save(
+                    State(
+                        resources={name: kind for name, kind in resources},
+                        namespace=namespace,
+                    )
+                )
+        else:
+            tree = self.build_namespace_tree(namespace)
+        return tree

kx_cli-0.0.11/src/kx/commands/yaml.py

@@ -0,0 +1,43 @@
+import yaml
+
+from kx.kubectl import KubectlServiceProtocol
+from kx.state import StateServiceProtocol
+
+
+def _find_keys(data: dict | list, keys: set[str]) -> dict:
+    """Collect the value of each requested key from anywhere in the manifest,
+    preferring the shallowest occurrence when a key appears at multiple depths.
+
+    A breadth-first walk guarantees shallowest-wins: a workload's own top-level
+    `metadata` is returned rather than its pod template's nested `metadata`,
+    while genuinely nested-only keys (e.g. `containerStatuses` under `status`)
+    are still found. A matched key's own subtree is not descended into."""
+    result: dict = {}
+    frontier: list = [data]
+    while frontier:
+        deeper: list = []
+        for node in frontier:
+            if isinstance(node, dict):
+                for k, v in node.items():
+                    if k in keys:
+                        result.setdefault(k, v)
+                    else:
+                        deeper.append(v)
+            elif isinstance(node, list):
+                deeper.extend(node)
+        frontier = deeper
+    return result
+
+
+class YamlCommand:
+    def __init__(self, state: StateServiceProtocol, kubectl: KubectlServiceProtocol):
+        self.state = state
+        self.kubectl = kubectl
+
+    def execute(self, index: int, show: list[str] | None = None) -> str:
+        name, namespace, kind = self.state.fields(index)
+        raw = self.kubectl.run(["get", kind, name, "-n", namespace, "-o", "yaml"])
+        if not show:
+            return raw
+        data = yaml.safe_load(raw)
+        return yaml.dump(_find_keys(data, set(show)), default_flow_style=False)

{kx_cli-0.0.9 → kx_cli-0.0.11}/src/kx/config.py

@@ -52,6 +52,13 @@ def load_config() -> Config:
     if "KX_THEME" in os.environ:
         kwargs["theme"] = os.environ["KX_THEME"]
 
+    if "max_history" in kwargs:
+        mh = kwargs["max_history"]
+        # bool is an int subclass; reject it and any non-int/non-positive value
+        # (a string from TOML, 0, or a negative) with a clear message.
+        if isinstance(mh, bool) or not isinstance(mh, int) or mh < 1:
+            raise SystemExit("kx: max_history must be a positive integer")
+
     if "theme" in kwargs and kwargs["theme"] not in THEMES:
         raise SystemExit(
             f"kx: unknown theme '{kwargs['theme']}' (run kx theme to list themes)"

{kx_cli-0.0.9 → kx_cli-0.0.11}/src/kx/console.py

@@ -1,5 +1,6 @@
 import re
 import json
+import sys
 import threading
 from contextlib import contextmanager
 from datetime import datetime, timezone
@@ -14,6 +15,8 @@ from rich.table import Table
 from rich.text import Text
 
 from kx.diagnostics import SEVERITY_PATTERN, Severity
+from kx.events import EventRow
+from kx.index import _parse_output
 from kx.kinds import plural_display
 from kx.scanner import SEVERITIES, ImageScan
 from kx.state import StateHistory
@@ -192,6 +195,25 @@ def print_raw(text: str) -> None:
     _console.print(text, markup=False, highlight=False)
 
 
+def write_value(value: bytes) -> None:
+    """Write a secret value to stdout unstyled, bypassing Rich entirely.
+
+    Rich wraps at the console width (_PIPE_WIDTH off-terminal), which would
+    inject newlines into a long value — a cert or token — and corrupt
+    `$(kx secret 1 --decode -k tls.crt)`. Writing to the byte buffer also keeps
+    `> store.p12` byte-exact. The trailing newline is added only for text, so
+    binary redirects reproduce the file exactly while text stays shell-friendly.
+    """
+    try:
+        value.decode("utf-8")
+    except UnicodeDecodeError:
+        payload = value
+    else:
+        payload = value + b"\n"
+    sys.stdout.buffer.write(payload)
+    sys.stdout.buffer.flush()
+
+
 def print_rich(renderable) -> None:
     _console.print(renderable)
 
@@ -245,28 +267,20 @@ def _print_get_caption(resource_type: str, namespace: str, count: int) -> None:
 def render_indexed_table(
     text: str, resource_type: str, namespace: str, note: str | None = None
 ) -> None:
-    lines = [line for line in text.splitlines() if line.strip()]
-    if not lines:
-        # kubectl exits 0 with empty stdout when nothing matches ("No
-        # resources found" goes to stderr) — show the caption, not silence.
-        _print_get_caption(resource_type, namespace, 0)
-        return
-
-    header_line = lines[0]
-    first_col = header_line.split()[0] if header_line.split() else ""
-    if first_col != "X" and note is None:
-        _console.print(text, markup=False, highlight=False)
+    # Share index._parse_output (the single table parser) rather than a private
+    # copy: it extends the last column to end-of-line, so a value wider than its
+    # header (kubectl doesn't pad the last column) is never sliced off.
+    headers, rows, _ = _parse_output(text)
+    if not headers:
+        # Non-tabular output (JSON/YAML, or a table with no NAME column) prints
+        # as-is; genuinely empty stdout (kubectl sends "No resources found" to
+        # stderr) shows the zero-count caption instead of silence.
+        if text.strip():
+            _console.print(text, markup=False, highlight=False)
+        else:
+            _print_get_caption(resource_type, namespace, 0)
         return
 
-    spans = [(m.start(), m.end()) for m in re.finditer(r"\S+\s*", header_line)]
-    headers = [header_line[start:end].strip() for start, end in spans]
-
-    rows = []
-    for line in lines[1:]:
-        cols = [line[start:end].strip() for start, end in spans]
-        if cols:
-            rows.append(cols)
-
     if not rows:
         _print_get_caption(resource_type, namespace, 0)
         return
@@ -329,8 +343,8 @@ def render_indexed_table(
         _console.print(f"[muted]{note}[/muted]")
 
 
-def render_events_table(text: str) -> None:
-    if text.strip() == "No events found":
+def render_events_table(rows: list[EventRow]) -> None:
+    if not rows:
         _console.print("[muted]No events found[/muted]")
         return
 
@@ -343,31 +357,17 @@ def render_events_table(text: str) -> None:
     for col in ("TYPE", "REASON", "KIND", "AGE", "MESSAGE"):
         table.add_column(col)
 
-    for line in text.splitlines():
-        if not line.strip():
-            continue
-        event_type = line[0:8].strip()
-        reason = line[9:39].strip()
-        kind = line[40:50].strip()
-        rest = line[51:]
-        parts = rest.split(" ", 2)
-        timestamp = (
-            f"{parts[0]} {parts[1]}" if len(parts) >= 2 else (parts[0] if parts else "")
-        )
-        message = parts[2] if len(parts) >= 3 else ""
-
-        try:
-            age = _format_age(datetime.fromisoformat(timestamp))
-        except ValueError:
-            age = timestamp
-
-        type_color = "muted" if event_type == "Normal" else "warn"
+    for row in rows:
+        age = _format_age(row.timestamp)
+        type_color = "muted" if row.type == "Normal" else "warn"
         table.add_row(
-            f"[{type_color}]{event_type}[/]",
-            reason,
-            kind,
+            f"[{type_color}]{row.type}[/]",
+            row.reason,
+            row.kind,
             f"[muted]{age}[/]",
-            message,
+            # Text (not markup) so bracketed characters in a message are shown
+            # literally, matching the WARNING EVENTS section.
+            Text(row.message),
         )
 
     _console.print(table)
@@ -687,7 +687,7 @@ def print_command_help(ctx) -> None:
         names = "  ".join(opt.opts)
         _console.print(f"  [body]{names:<20}[/body]  [muted]{opt.help or ''}[/muted]")
     _console.print(
-        f"  [body]{'--help':<20}[/body]  [muted]Show this message and exit.[/muted]"
+        f"  [body]{'-h, --help':<20}[/body]  [muted]Show this message and exit.[/muted]"
     )
 
     aliases = getattr(ctx.command.callback, "_aliases", [])
@@ -745,7 +745,7 @@ def print_help(
         f"  [body]{'-v, --version':<14}[/body]  [muted]Show the kx version and exit.[/muted]"
     )
     _console.print(
-        f"  [body]{'--help':<14}[/body]  [muted]Show this message and exit.[/muted]"
+        f"  [body]{'-h, --help':<14}[/body]  [muted]Show this message and exit.[/muted]"
     )
     if version:
         _console.print()

{kx_cli-0.0.9 → kx_cli-0.0.11}/src/kx/events.py

@@ -1,9 +1,24 @@
-from kubernetes import client
+from dataclasses import dataclass
+from datetime import datetime
 from typing import Protocol
 
+from kubernetes import client
+
 from kx.k8s import load_config
 
 
+@dataclass
+class EventRow:
+    """One event, flattened for rendering. `timestamp` is the event's last-seen
+    time (falling back to creation) as a datetime, or None if unavailable."""
+
+    type: str
+    reason: str
+    kind: str
+    message: str
+    timestamp: datetime | None = None
+
+
 class EventsServiceProtocol(Protocol):
     def get(self, namespace: str) -> list: ...
     def filter(self, events: list, name: str, kind: str) -> list: ...

{kx_cli-0.0.9 → kx_cli-0.0.11}/src/kx/graph.py

@@ -16,6 +16,17 @@ def build_indexed_tree(
     return _build(kind, name, namespace, indexed=True)
 
 
+def build_namespace_tree(namespace: str) -> Tree:
+    root, _ = _build_namespace(namespace, indexed=False)
+    return root
+
+
+def build_namespace_indexed_tree(
+    namespace: str,
+) -> tuple[Tree, list[tuple[str, str]]]:
+    return _build_namespace(namespace, indexed=True)
+
+
 def _build(
     kind: str, name: str, namespace: str, indexed: bool
 ) -> tuple[Tree, list[tuple[str, str]]]:
@@ -54,6 +65,115 @@ def _build(
     return root, resources
 
 
+# Prefix + semantic color for each node kind in a namespace forest. Controllers
+# render as roots with their full kind name; owned resources use the short
+# prefixes the single-resource tree already uses (rs/job/pod).
+_NODE_STYLE: dict[Kind, tuple[str, str]] = {
+    Kind.Deployment: ("Deployment", "header"),
+    Kind.StatefulSet: ("StatefulSet", "header"),
+    Kind.DaemonSet: ("DaemonSet", "header"),
+    Kind.CronJob: ("CronJob", "header"),
+    Kind.Job: ("job", "accent"),
+    Kind.ReplicaSet: ("rs", "accent"),
+    Kind.Pod: ("pod", "body"),
+}
+
+# Stable order roots appear under the Namespace node.
+_ROOT_ORDER: list[Kind] = [
+    Kind.Deployment,
+    Kind.StatefulSet,
+    Kind.DaemonSet,
+    Kind.CronJob,
+    Kind.Job,
+    Kind.ReplicaSet,
+    Kind.Pod,
+]
+
+
+def _build_namespace(
+    namespace: str, indexed: bool
+) -> tuple[Tree, list[tuple[str, str]]]:
+    """Full ownership forest for a namespace: every workload controller as a
+    root with its owned resources beneath, plus orphan Jobs/ReplicaSets and bare
+    Pods so nothing is hidden. Each pod appears exactly once. Unlike `_build`,
+    the Namespace root node is not indexed — children number from 1."""
+    load_config()
+    apps = client.AppsV1Api()
+    core = client.CoreV1Api()
+    batch = client.BatchV1Api()
+
+    deployments = apps.list_namespaced_deployment(namespace).items
+    replica_sets = apps.list_namespaced_replica_set(namespace).items
+    stateful_sets = apps.list_namespaced_stateful_set(namespace).items
+    daemon_sets = apps.list_namespaced_daemon_set(namespace).items
+    cron_jobs = batch.list_namespaced_cron_job(namespace).items
+    jobs = batch.list_namespaced_job(namespace).items
+    pods = core.list_namespaced_pod(namespace).items
+
+    # Resources that can be owned by something else in the namespace, indexed by
+    # each owner uid so a parent finds its children in one pass.
+    child_kinds = (
+        [(rs, Kind.ReplicaSet) for rs in replica_sets]
+        + [(job, Kind.Job) for job in jobs]
+        + [(pod, Kind.Pod) for pod in pods]
+    )
+    children_by_owner: dict[str, list[tuple[object, Kind]]] = {}
+    for obj, kind in child_kinds:
+        for ref in obj.metadata.owner_references or []:
+            children_by_owner.setdefault(ref.uid, []).append((obj, kind))
+
+    present_uids = {
+        obj.metadata.uid
+        for obj in (
+            *deployments,
+            *replica_sets,
+            *stateful_sets,
+            *daemon_sets,
+            *cron_jobs,
+            *jobs,
+            *pods,
+        )
+    }
+
+    # Controllers are always roots; an owned child (rs/job/pod) is a root only
+    # when orphaned — its owner isn't among the namespace's collected objects.
+    roots: list[tuple[object, Kind]] = [
+        *[(d, Kind.Deployment) for d in deployments],
+        *[(s, Kind.StatefulSet) for s in stateful_sets],
+        *[(d, Kind.DaemonSet) for d in daemon_sets],
+        *[(c, Kind.CronJob) for c in cron_jobs],
+    ]
+    for obj, kind in child_kinds:
+        refs = obj.metadata.owner_references or []
+        if not any(ref.uid in present_uids for ref in refs):
+            roots.append((obj, kind))
+
+    order = {kind: position for position, kind in enumerate(_ROOT_ORDER)}
+    roots.sort(key=lambda pair: (order[pair[1]], pair[0].metadata.name))
+
+    resources: list[tuple[str, str]] = []
+    root = Tree(f"[header]Namespace/{namespace}[/header]")
+    if not roots:
+        root.add("[muted](no workloads)[/muted]")
+        return root, resources
+
+    for obj, kind in roots:
+        _render(obj, kind, root, children_by_owner, resources, indexed)
+    return root, resources
+
+
+def _render(obj, kind, parent, children_by_owner, resources, indexed):
+    """Add `obj` under `parent`, then recurse into its owned children; a Pod is
+    a leaf whose containers are listed directly."""
+    prefix, color = _NODE_STYLE[kind]
+    node = _add_node(parent, resources, indexed, color, prefix, obj.metadata.name, kind)
+    if kind == Kind.Pod:
+        _add_containers(obj, node)
+        return
+    for child, child_kind in children_by_owner.get(obj.metadata.uid, []):
+        _render(child, child_kind, node, children_by_owner, resources, indexed)
+
+
 def _add_node(parent, resources, indexed, color, prefix, name, kind):
     """Add a labelled child node; when indexed, prepend its 1-based index and
     record `(name, kind)` in `resources`."""