nyl 0.2.0__tar.gz → 0.3.0__tar.gz

{nyl-0.2.0 → nyl-0.3.0}/.github/workflows/python.yaml

@@ -38,6 +38,11 @@ jobs:
       - name: Run ${{ matrix.step }}
         run: krakenw run fmt lint
 
+      - name: Install the Kyverno CLI (required for some Nyl features)
+        uses: kyverno/action-install-cli@v0.2.0
+        with:
+          release: 'v1.13.0'
+
       # TODO: Until krakenw run test works (currently fails because of doctest modules)
       - name: Run tests
         run: uv run pytest -vv

{nyl-0.2.0 → nyl-0.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: nyl
-Version: 0.2.0
+Version: 0.3.0
 Summary: Advanced templating engine for Kubernetes and GitOps.
 Author-email: Niklas Rosenstein <rosensteinniklas@gmail.com>
 License: MIT
@@ -15,7 +15,7 @@ Requires-Dist: nr-stream>=1.1.5
 Requires-Dist: pyyaml>=6.0.1
 Requires-Dist: requests>=2.32.3
 Requires-Dist: stablehash<0.3.0,>=0.2.1
-Requires-Dist: structured-templates<0.1.0,>=0.0.6
+Requires-Dist: structured-templates>=0.1.1
 Requires-Dist: typer>=0.12.3
 Requires-Dist: typing-extensions>=4.12.2
 Description-Content-Type: text/markdown
@@ -31,6 +31,12 @@ Requires Python 3.11 or newer.
 
     $ uvx nyl
 
+For some features, additional programs must be available:
+
+* [kubectl](https://kubernetes.io/de/docs/reference/kubectl/) for most operations
+* [kyverno](https://kyverno.io/docs/kyverno-cli/) when using the Nyl `PostProcessor` resource
+* [sops](https://github.com/getsops/sops) when using the SOPS secrets provider
+
 ## Local development
 
 Install the project with [Uv](https://docs.astral.sh/uv/).

{nyl-0.2.0 → nyl-0.3.0}/README.md

@@ -9,6 +9,12 @@ Requires Python 3.11 or newer.
 
     $ uvx nyl
 
+For some features, additional programs must be available:
+
+* [kubectl](https://kubernetes.io/de/docs/reference/kubectl/) for most operations
+* [kyverno](https://kyverno.io/docs/kyverno-cli/) when using the Nyl `PostProcessor` resource
+* [sops](https://github.com/getsops/sops) when using the SOPS secrets provider
+
 ## Local development
 
 Install the project with [Uv](https://docs.astral.sh/uv/).

{nyl-0.2.0 → nyl-0.3.0}/argocd-cmp/Dockerfile

@@ -29,7 +29,7 @@ RUN \
     case "$(uname -m)" in \
         x86_64) BIN_ARCH='amd64' ;; \
         aarch64) BIN_ARCH='arm64' ;; \
-        *) echo "Unsupported architecture: $ARCH" && exit 1 ;; \
+        *) echo "Unsupported architecture: $(uname -m)" && exit 1 ;; \
     esac \
     && printf "%s" "$BIN_ARCH" > /BINARY_ARCH
 
@@ -57,12 +57,24 @@ RUN curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/s
 FROM fetch-bin-base AS sops-bin
 # Find SOPS releases at https://github.com/getsops/sops/releases
 ARG SOPS_VERSION=v3.9.0
-RUN curl -LO https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.$(cat /BINARY_ARCH) \
+RUN curl -fLO https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.$(cat /BINARY_ARCH) \
     && mv sops-${SOPS_VERSION}.linux.$(cat /BINARY_ARCH) /usr/local/bin/sops \
     && chmod +x /usr/local/bin/sops \
     && upx /usr/local/bin/sops \
     && sops --version
 
+FROM fetch-bin-base AS kyverno-bin
+ARG KYVERNO_VERSION=1.13.0
+RUN \
+    case "$(uname -m)" in \
+        x86_64) KYVERNO_ARCH='x86_64' ;; \
+        aarch64) KYVERNO_ARCH='arm64' ;; \
+        *) echo "Unsupported architecture: $(uname -m)" && exit 1 ;; \
+    esac \
+    && curl -fLO https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_linux_${KYVERNO_ARCH}.tar.gz \
+    && tar -xvf kyverno-cli_v${KYVERNO_VERSION}_linux_${KYVERNO_ARCH}.tar.gz \
+    && mv kyverno /usr/local/bin/ \
+    && upx /usr/local/bin/kyverno
 
 #: Build the ArgoCD CMP server image.
 #: ----------------------------------
@@ -73,6 +85,7 @@ COPY --from=argocd-bin /usr/local/bin/argocd /usr/local/bin/argocd
 RUN ln -s /usr/local/bin/argocd /usr/local/bin/argocd-cmp-server && chown 999:999 /usr/local/bin/argocd-cmp-server
 COPY --from=helm-bin /usr/local/bin/helm /usr/local/bin/helm
 COPY --from=sops-bin /usr/local/bin/sops /usr/local/bin/sops
+COPY --from=kyverno-bin /usr/local/bin/kyverno /usr/local/bin/kyverno
 COPY --from=build /opt/nyl /opt/nyl
 RUN ln -s /opt/nyl/.venv/bin/nyl /usr/local/bin/nyl
 COPY --chown=999 argocd-cmp/plugin.yaml /home/argocd/cmp-server/config/plugin.yaml

nyl-0.3.0/docs/content/reference/glossary.md

@@ -0,0 +1,27 @@
+# Glossary
+
+  [Nyl-inline]: ./templating/inlining/overview.md
+
+### Manifest
+
+A manifest is a file that may define zero or more Kubernetes or [Nyl inline resources][Nyl-inline]. Nyl understands
+individual manifests, i.e. YAML files, and certain behaviours operate on that level, such as Kubernetes Namespace
+auto-filling and resource post-processing applying only to all resources defined in the same manifest as the
+[`PostProcessor`](./templating/inlining/postprocessor.md).
+
+### Profile
+
+...
+
+### Project
+
+...
+
+### Resource
+
+A resource is a YAML document that follows the schema of a Kubernetes API resource or [Nyl inline resource][Nyl-inline].
+An example would be a Kubernetes `ConfigMap`, `Deployment`, `Pod` or a Nyl `HelmChart` or `PostProcessor`.
+
+### Secrets provider
+
+...

nyl-0.2.0/docs/content/reference/templating/inlining.md → nyl-0.3.0/docs/content/reference/templating/inlining/helmcharts.md

@@ -2,19 +2,11 @@
 weight: 5
 ---
 
-# Inlining
+# HelmChart
 
-Nyl supports inlining of Kubernetes resources generated from templates in your configuration. Resources that are
-inlined by Nyl are typically in the `inline.nyl.io/v1` API group, however Nyl also has the concept of
-[components](./components.md) which effectively allow you to define your own API groups and resource kinds for
-inlined resources.
-
-## Helm charts
-
-Nyl currently only supports inlining of Helm charts. Helm charts are inlined by specifying a `HelmChart` resource in
-your configuration. Just like any other resource, the Helm chart resource values can be templated using Nyl's
-[structured templating](../templating/basics.md) (for example to inject secrets), and are then rendered to Kubernetes
-resources that are inlined in your configuration.
+Nyl allows you to inline Helm charts by specifying a `HelmChart` resource in your manifest. Just like any other
+resource, the Helm chart resource values can be templated using Nyl's [structured templating](../templating/basics.md)
+(for example to inject secrets), and are then rendered to Kubernetes resources that are inlined in your configuration.
 
 __Example__
 
@@ -28,6 +20,7 @@ spec:
   chart:
     repository: https://charts.bitnami.com/bitnami
     name: nginx
+    # version: "..."
   values:
     controller:
       service:

nyl-0.3.0/docs/content/reference/templating/inlining/overview.md

@@ -0,0 +1,10 @@
+---
+title: Overview
+---
+
+# Inlining Overview
+
+Nyl supports inlining of Kubernetes resources generated from templates in your configuration. Resources that are
+inlined by Nyl are typically in the `inline.nyl.io/v1` API group, however Nyl also has the concept of
+[components](./components.md) which effectively allow you to define your own API groups and resource kinds for
+inlined resources.

nyl-0.3.0/docs/content/reference/templating/inlining/postprocessor.md

@@ -0,0 +1,120 @@
+# PostProcessor
+
+The `inline.nyl.io/v1/PostProcessor` resource can be used to configure post-processing steps for all Kubernetes
+resources defined in the same [Manifest](../../glossary.md#manifest) as the `PostProcessor`. This resource does
+not accept a `metadata` field.
+
+## Prerequisites
+
+* You need the [`kyverno` CLI](https://kyverno.io/docs/kyverno-cli/) installed 
+
+## API Spec
+
+```yaml
+apiVersion: inline.nyl.io/v1
+kind: PostProcessor
+spec:
+  kyverno:
+    # A list of files that each contain a Kyverno policy resource, usually a `ClusterPolicy`. The paths are first
+    # considered relative to the manifest that this resource is defined in, and will then be searched in the project
+    # search path.
+    policyFiles:
+    - path/to/policy.yaml
+
+    # A mapping of policy names (what you would give as a filename) and a YAML document that represents the Kyverno
+    # policy resource (usually a `ClusterPolicy`).
+    inlinePolicies:
+      my-policy:
+        apiVersion: kyverno.io/v1
+        kind: ClusterPolicy
+        metadata:
+          name: enforce-pod-security-context
+        spec: {} # ...
+```
+
+## Example
+
+If you're deploying to hardened RKE2, your pods must have a specific `securityContext` configuration in order to be
+allowed by the PodSecurityPolicy. The application's Helm charts that you deploy may have options to inject the
+required options, but if they are not you're usually out of luck unless you fork the Helm chart, or materialize
+the resources and edit them in your project.
+
+With the Nyl `PostProcessor`, you can apply Kyverno policies to validate or mutate the resources in a
+[manifest](../../glossary.md#manifest).
+
+=== "Manifest"
+
+    ```yaml title="forgejo.yaml"
+    ---
+    apiVersion: inline.nyl.io/v1
+    kind: PostProcessor
+    spec:
+      kyverno:
+        policyFiles:
+        - ./policies/security-profile.yaml
+
+    ---
+    apiVersion: v1
+    kind: Namespace
+    metadata:
+      name: forgejo
+
+    ---
+    apiVersion: inline.nyl.io/v1
+    kind: HelmChart
+    metadata:
+      name: forgejo
+      namespace: forgejo
+    spec:
+      chart:
+        repository: oci://code.forgejo.org/forgejo-helm # https://artifacthub.io/packages/helm/forgejo-helm/forgejo
+        name: forgejo
+        version: "10.0.1"
+      values: {}
+    ```
+
+=== "Kyverno Policy"
+
+    ```yaml title="policies/security-profile.yaml"
+    apiVersion: kyverno.io/v1
+    kind: ClusterPolicy
+    metadata:
+      name: enforce-security-context
+    spec:
+      validationFailureAction: enforce
+      rules:
+        - name: mutate-pod-security-context
+          match:
+            resources:
+              kinds:
+                - Pod
+          mutate:
+            patchStrategicMerge: &podSpec
+              spec:
+                securityContext:
+                  runAsNonRoot: true
+                  seccompProfile:
+                    type: RuntimeDefault
+                containers: &containers
+                  - (name): "*"
+                    securityContext:
+                      runAsNonRoot: true
+                      allowPrivilegeEscalation: false
+                      capabilities:
+                        drop:
+                          - "ALL"
+                initContainers: *containers
+        - name: mutate-deployment-security-context
+          match:
+            resources:
+              kinds:
+                - Deployment
+          mutate:
+            patchStrategicMerge:
+              spec:
+                template: *podSpec
+    ```
+
+Running `nyl template forgejo.yaml` will use the `kyverno` CLI to apply the policy to the manifests generated by
+the Helm chart. Note that the post processing happens at the very end after all other Kubernetes manifests have
+been generated.

{nyl-0.2.0 → nyl-0.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nyl"
-version = "0.2.0"  # sed'ed on publish in CI
+version = "0.3.0"  # sed'ed on publish in CI
 description = "Advanced templating engine for Kubernetes and GitOps."
 authors = [
     {name = "Niklas Rosenstein", email = "rosensteinniklas@gmail.com"},
@@ -20,7 +20,7 @@ dependencies = [
     "pyyaml>=6.0.1",
     "requests>=2.32.3",
     "stablehash>=0.2.1,<0.3.0",
-    "structured-templates>=0.0.6,<0.1.0",
+    "structured-templates>=0.1.1",
     "typer>=0.12.3",
     "typing-extensions>=4.12.2",
 ]

{nyl-0.2.0 → nyl-0.3.0}/src/kubernetes/dynamic/resource.pyi

@@ -40,3 +40,4 @@ class ResourceInstance:
     attributes: ResourceField
 
     def __getitem__(self, key: str) -> ResourceField | Any: ...
+    def to_dict(self) -> dict[str, Any]: ...

{nyl-0.2.0 → nyl-0.3.0}/src/nyl/commands/run.py

@@ -6,7 +6,7 @@ import sys
 from tempfile import TemporaryDirectory
 from loguru import logger
 from typer import Argument, Option
-import yaml
+from nyl.tools import yaml
 from nyl.profiles import ActivatedProfile, ProfileManager
 from nyl.profiles.kubeconfig import _trim_to_context
 from nyl.tools.logging import lazy_str
@@ -56,7 +56,7 @@ def run(
             sys.exit(1)
 
         try:
-            kubeconfig_data = yaml.safe_load(kubeconfig.read_text())
+            kubeconfig_data = yaml.loads(kubeconfig.read_text())
             kubeconfig_data = _trim_to_context(kubeconfig_data, profile_name)
         except ValueError:
             logger.debug("Failed to parse the kubeconfig file/find context '{}'.", profile_name)
@@ -83,7 +83,7 @@ def run(
             tmpdir = TemporaryDirectory()
             atexit.register(tmpdir.cleanup)
             kubeconfig = Path(tmpdir.name) / "kubeconfig"
-            kubeconfig.write_text(yaml.dump(kubeconfig_data))
+            kubeconfig.write_text(yaml.dumps(kubeconfig_data))
             kubeconfig.chmod(0o600)
 
     profile = ActivatedProfile(kubeconfig)

{nyl-0.2.0 → nyl-0.3.0}/src/nyl/commands/template.py

@@ -5,8 +5,9 @@ from pathlib import Path
 from textwrap import indent
 from typing import Optional
 from loguru import logger
+from nyl.resources.postprocessor import PostProcessor
 from typer import Argument, Option
-import yaml
+from nyl.tools import yaml
 from nyl.generator import reconcile_generator
 from nyl.generator.dispatch import DispatchingGenerator
 from nyl.profiles import ProfileManager
@@ -177,8 +178,13 @@ def template(
                 generator,
                 source.manifests,
                 on_generated=lambda m: template_engine.evaluate(Manifests([m])),
+                skip_resources=[PostProcessor],
             )
 
+        # Find any PostProcessor resources and apply them.
+        source.manifests, post_processors = PostProcessor.extract_from_list(source.manifests)
+        source.manifests = PostProcessor.apply_all(source.manifests, post_processors, source.file)
+
         # Find the namespaces that are defined in the file. If we find any manifests without a namespace, we will
         # inject that namespace name into them. Also find the applyset defined in the file.
         namespaces: set[str] = set()
@@ -252,7 +258,7 @@ def template(
                 kubectl.diff(Manifests([applyset.dump()]))
             else:
                 print("---")
-                print(yaml.safe_dump(applyset.dump()))
+                print(yaml.dumps(applyset.dump()))
 
         # Find all manifests without a namespace and inject the namespace name into them.
         # If there is an applyset, ensure they are marked as part of the applyset.
@@ -267,7 +273,7 @@ def template(
                 logger.opt(ansi=True).error(
                     "A manifest in <yellow>'{}'</> has no <cyan>metadata</> key:\n\n{}",
                     source.file,
-                    indent(yaml.safe_dump(manifest), "  "),
+                    indent(yaml.dumps(manifest), "  "),
                 )
                 exit(1)
 
@@ -317,7 +323,7 @@ def template(
             # If we're not going to be applying the manifests immediately via `kubectl`, we print them to stdout.
             for manifest in source.manifests:
                 print("---")
-                print(yaml.safe_dump(manifest))
+                print(yaml.dumps(manifest))
 
 
 def load_manifests(paths: list[Path]) -> list[ManifestsWithSource]:
@@ -347,7 +353,7 @@ def load_manifests(paths: list[Path]) -> list[ManifestsWithSource]:
 
     result = []
     for file in files:
-        manifests = Manifests(list(map(Manifest, filter(None, yaml.safe_load_all(file.read_text())))))
+        manifests = Manifests(list(map(Manifest, filter(None, yaml.loads_all(file.read_text())))))
         result.append(ManifestsWithSource(manifests, file))
 
     return result

{nyl-0.2.0 → nyl-0.3.0}/src/nyl/generator/__init__.py

@@ -4,8 +4,9 @@ This package contains everything related to the generation of Kubernetes manifes
 
 from abc import ABC, abstractmethod
 from collections.abc import Callable
-from typing import Any, ClassVar, Generic, TypeVar
+from typing import Any, ClassVar, Generic, Sequence, TypeVar
 
+from nyl.resources import NylResource
 from stablehash import stablehash
 
 from nyl.tools.types import Manifest, Manifests
@@ -37,6 +38,7 @@ def reconcile_generator(
     generator: Generator[Manifest],
     manifests: Manifests,
     on_generated: Callable[[Manifest], Manifests],
+    skip_resources: Sequence[type[NylResource]] = (),
 ) -> Manifests:
     """
     Recursively reconcile all Nyl resources in the manifests using the given generator.
@@ -46,6 +48,7 @@ def reconcile_generator(
         manifests: The list of manifests to reconcile.
         on_generated: A callback to call on each generated manifest, giving the opportunity to modify it.
                       This is used to pass the manifest through the `structured-templates` engine.
+        skip_resources: A list of Nyl resources to ignore.
     """
 
     queue = Manifests(manifests)
@@ -63,8 +66,11 @@ def reconcile_generator(
             result.append(resource)
         else:
             seen.add(resource_hash)
-            for manifest in generator.generate(resource):
-                queue.extend(on_generated(manifest))
+            if any(t.matches(resource) for t in skip_resources):
+                queue.append(resource)
+            else:
+                for manifest in generator.generate(resource):
+                    queue.extend(on_generated(manifest))
             loops += 1
 
     return result

{nyl-0.2.0 → nyl-0.3.0}/src/nyl/generator/dispatch_test.py

@@ -46,6 +46,10 @@ def test__DispatchingGenerator__default__creates_generator_for_every_nyl_inline_
         kube_api_versions=set(),
     )
 
+    # We make an exception for the PostProcessor resource as it has no generator.
+
     for kind in resource_kinds:
+        if kind == "PostProcessor":
+            continue
         assert kind in generator.generators.keys()
         assert isinstance(generator.generators[kind], Generator)

{nyl-0.2.0 → nyl-0.3.0}/src/nyl/generator/helmchart.py

@@ -9,7 +9,7 @@ from textwrap import indent
 from urllib.parse import parse_qs, urlparse
 
 from loguru import logger
-import yaml
+from nyl.tools import yaml
 from nyl.generator import Generator
 from nyl.resources.helmchart import ChartRef, HelmChart, ReleaseMetadata
 from nyl.tools.shell import pretty_cmd
@@ -91,7 +91,7 @@ class HelmChartGenerator(Generator[HelmChart], resource_type=HelmChart):
             else:
                 logger.opt(ansi=True).debug("Using cached Helm chart '{}' from repository '{}'", chart, repository)
 
-            chart = str(cache_dir / next(cache_dir.iterdir()))
+            chart = str(next(cache_dir.iterdir()))
             repository = None
 
         elif chart_ref.git:
@@ -152,7 +152,7 @@ class HelmChartGenerator(Generator[HelmChart], resource_type=HelmChart):
 
         with TemporaryDirectory() as tmp:
             values_file = Path(tmp) / "values.yaml"
-            values_file.write_text(yaml.safe_dump(res.spec.values))
+            values_file.write_text(yaml.dumps(res.spec.values))
 
             command = [
                 "helm",
@@ -207,6 +207,6 @@ class HelmChartGenerator(Generator[HelmChart], resource_type=HelmChart):
                     f"stderr:\n{indent(e.stderr.decode(), prefix)}"
                 )
 
-            manifests = Manifests(list(filter(None, yaml.safe_load_all(result.stdout.decode()))))
+            manifests = Manifests(list(filter(None, yaml.loads_all(result.stdout.decode()))))
 
             return manifests

{nyl-0.2.0 → nyl-0.3.0}/src/nyl/profiles/kubeconfig.py

@@ -5,8 +5,8 @@ import shlex
 import subprocess
 from typing import Any
 from urllib.parse import urlparse
-import yaml
 
+from nyl.tools import yaml
 from nyl.tools.shell import pretty_cmd
 from .config import KubeconfigFromSsh, LocalKubeconfig
 from loguru import logger
@@ -87,7 +87,7 @@ class KubeconfigManager:
                 raise ValueError(f"Unsupported Kubeconfig type: {source.__class__.__name__}")
 
         # Find the Kubernetes API host and port.
-        kubeconfig_data = yaml.safe_load(raw_kubeconfig.read_text())
+        kubeconfig_data = yaml.loads(raw_kubeconfig.read_text())
         kubeconfig_data = _trim_to_context(kubeconfig_data, source.context)
         server: str = kubeconfig_data["clusters"][0]["cluster"]["server"]
         api_host, api_port = (lambda parsed: (parsed.hostname, parsed.port or 443))(urlparse(server))
@@ -108,7 +108,7 @@ class KubeconfigManager:
     def get_updated_kubeconfig(
         self, *, profile_name: str, path: Path, context: str, api_host: str, api_port: int
     ) -> Path:
-        kubeconfig_data = yaml.safe_load(path.read_text())
+        kubeconfig_data = yaml.loads(path.read_text())
         kubeconfig_data = _trim_to_context(kubeconfig_data, context, rename_context=profile_name)
 
         # TODO: Do we need to support the Kubernetes API hosted on a subpath?
@@ -116,7 +116,7 @@ class KubeconfigManager:
 
         final_kubeconfig = self._state_dir / profile_name / "kubeconfig.local"
         final_kubeconfig.parent.mkdir(parents=True, exist_ok=True)
-        final_kubeconfig.write_text(yaml.safe_dump(kubeconfig_data))
+        final_kubeconfig.write_text(yaml.dumps(kubeconfig_data))
         final_kubeconfig.chmod(0o600)
 
         return final_kubeconfig

{nyl-0.2.0 → nyl-0.3.0}/src/nyl/resources/placeholder.py

@@ -1,6 +1,4 @@
-import base64
 from dataclasses import dataclass
-import hashlib
 from typing import Annotated, ClassVar
 from nyl.resources import API_VERSION_K8S, NylResource, ObjectMetadata
 from databind.core import SerializeDefaults
@@ -78,33 +76,3 @@ class Placeholder(NylResource, api_version=API_VERSION_K8S):
                 namespace=namespace,
             )
         )
-
-
-def calculate_applyset_id(*, name: str, namespace: str = "", group: str) -> str:
-    """
-    Calculate the ID of a Kubernetes ApplySet with the specified name.
-    """
-
-    # reference: https://kubernetes.io/docs/reference/labels-annotations-taints/#applyset-kubernetes-io-id
-    hash = hashlib.sha256(f"{name}.{namespace}.ApplySet.{group}".encode()).digest()
-    uid = base64.b64encode(hash).decode().rstrip("=").replace("/", "_").replace("+", "-")
-    return f"applyset-{uid}-v1"
-
-
-def get_canonical_resource_kind_name(api_version: str, kind: str) -> str:
-    """
-    Given the apiVersion and kind of a Kubernetes resource, return the canonical name of the resource. This name can
-    be used to identify the resource in an ApplySet's `applyset.kubernetes.io/contains-group-kinds` annotation.
-
-    Note that according to the [reference][1], the resource name should use the plural form, but it appears that the
-    resource kind name is also accepted. Deriving the plural form will be difficult without querying the Kubernetes
-    API.
-
-    [1]: https://kubernetes.io/docs/reference/labels-annotations-taints/#applyset-kubernetes-io-contains-group-kinds
-
-    Args:
-        api_version: The apiVersion of the resource.
-        kind: The kind of the resource.
-    """
-
-    return (f"{kind}." + (api_version.split("/")[0] if "/" in api_version else "")).rstrip(".")