nyl 0.2.2__tar.gz → 0.4.0__tar.gz

{nyl-0.2.2 → nyl-0.4.0}/.github/workflows/python.yaml

@@ -38,6 +38,11 @@ jobs:
       - name: Run ${{ matrix.step }}
         run: krakenw run fmt lint
 
+      - name: Install the Kyverno CLI (required for some Nyl features)
+        uses: kyverno/action-install-cli@v0.2.0
+        with:
+          release: 'v1.13.0'
+
       # TODO: Until krakenw run test works (currently fails because of doctest modules)
       - name: Run tests
         run: uv run pytest -vv

{nyl-0.2.2 → nyl-0.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: nyl
-Version: 0.2.2
+Version: 0.4.0
 Summary: Advanced templating engine for Kubernetes and GitOps.
 Author-email: Niklas Rosenstein <rosensteinniklas@gmail.com>
 License: MIT
@@ -31,6 +31,12 @@ Requires Python 3.11 or newer.
 
     $ uvx nyl
 
+For some features, additional programs must be available:
+
+* [kubectl](https://kubernetes.io/de/docs/reference/kubectl/) for most operations
+* [kyverno](https://kyverno.io/docs/kyverno-cli/) when using the Nyl `PostProcessor` resource
+* [sops](https://github.com/getsops/sops) when using the SOPS secrets provider
+
 ## Local development
 
 Install the project with [Uv](https://docs.astral.sh/uv/).

{nyl-0.2.2 → nyl-0.4.0}/README.md

@@ -9,6 +9,12 @@ Requires Python 3.11 or newer.
 
     $ uvx nyl
 
+For some features, additional programs must be available:
+
+* [kubectl](https://kubernetes.io/de/docs/reference/kubectl/) for most operations
+* [kyverno](https://kyverno.io/docs/kyverno-cli/) when using the Nyl `PostProcessor` resource
+* [sops](https://github.com/getsops/sops) when using the SOPS secrets provider
+
 ## Local development
 
 Install the project with [Uv](https://docs.astral.sh/uv/).

{nyl-0.2.2 → nyl-0.4.0}/argocd-cmp/Dockerfile

@@ -29,7 +29,7 @@ RUN \
     case "$(uname -m)" in \
         x86_64) BIN_ARCH='amd64' ;; \
         aarch64) BIN_ARCH='arm64' ;; \
-        *) echo "Unsupported architecture: $ARCH" && exit 1 ;; \
+        *) echo "Unsupported architecture: $(uname -m)" && exit 1 ;; \
     esac \
     && printf "%s" "$BIN_ARCH" > /BINARY_ARCH
 
@@ -57,12 +57,24 @@ RUN curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/s
 FROM fetch-bin-base AS sops-bin
 # Find SOPS releases at https://github.com/getsops/sops/releases
 ARG SOPS_VERSION=v3.9.0
-RUN curl -LO https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.$(cat /BINARY_ARCH) \
+RUN curl -fLO https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.$(cat /BINARY_ARCH) \
     && mv sops-${SOPS_VERSION}.linux.$(cat /BINARY_ARCH) /usr/local/bin/sops \
     && chmod +x /usr/local/bin/sops \
     && upx /usr/local/bin/sops \
     && sops --version
 
+FROM fetch-bin-base AS kyverno-bin
+ARG KYVERNO_VERSION=1.13.0
+RUN \
+    case "$(uname -m)" in \
+        x86_64) KYVERNO_ARCH='x86_64' ;; \
+        aarch64) KYVERNO_ARCH='arm64' ;; \
+        *) echo "Unsupported architecture: $(uname -m)" && exit 1 ;; \
+    esac \
+    && curl -fLO https://github.com/kyverno/kyverno/releases/download/v${KYVERNO_VERSION}/kyverno-cli_v${KYVERNO_VERSION}_linux_${KYVERNO_ARCH}.tar.gz \
+    && tar -xvf kyverno-cli_v${KYVERNO_VERSION}_linux_${KYVERNO_ARCH}.tar.gz \
+    && mv kyverno /usr/local/bin/ \
+    && upx /usr/local/bin/kyverno
 
 #: Build the ArgoCD CMP server image.
 #: ----------------------------------
@@ -73,6 +85,7 @@ COPY --from=argocd-bin /usr/local/bin/argocd /usr/local/bin/argocd
 RUN ln -s /usr/local/bin/argocd /usr/local/bin/argocd-cmp-server && chown 999:999 /usr/local/bin/argocd-cmp-server
 COPY --from=helm-bin /usr/local/bin/helm /usr/local/bin/helm
 COPY --from=sops-bin /usr/local/bin/sops /usr/local/bin/sops
+COPY --from=kyverno-bin /usr/local/bin/kyverno /usr/local/bin/kyverno
 COPY --from=build /opt/nyl /opt/nyl
 RUN ln -s /opt/nyl/.venv/bin/nyl /usr/local/bin/nyl
 COPY --chown=999 argocd-cmp/plugin.yaml /home/argocd/cmp-server/config/plugin.yaml

{nyl-0.2.2 → nyl-0.4.0}/docs/content/reference/configuration/profiles.md

@@ -45,9 +45,12 @@ machine and use that to connect to the Kubernetes cluster.
     ```toml title="nyl-profile.toml"
     [default.kubeconfig]
     type = "ssh"
+    sudo = false  # default, set to true to use `sudo cat <path>`
     user = "root"
     host = "mycluster.example.com"
+    port = 22 # default
     path = "/etc/rancher/k3s/k3s.yaml"
+    # replace_apiserver_hostname
 
     [default.tunnel]
     type = "ssh"
@@ -61,9 +64,12 @@ machine and use that to connect to the Kubernetes cluster.
     default:
       kubeconfig:
         type: ssh
+        sudo: false
         user: root
         host: mycluster.example.com
+        port: 22
         path: /etc/rancher/k3s/k3s.yaml
+        replace_apiserver_hostname: null
       tunnel:
         type: ssh
         user: root
@@ -77,9 +83,12 @@ machine and use that to connect to the Kubernetes cluster.
       "default": {
         "kubeconfig": {
           "type": "ssh",
+          "sudo": false,
           "user": "root",
           "host": "mycluster.example.com",
-          "path": "/etc/rancher/k3s/k3s.yaml"
+          "port": 22,
+          "path": "/etc/rancher/k3s/k3s.yaml",
+          "replace_apiserver_hostname": null
         },
         "tunnel": {
           "type": "ssh",
@@ -100,7 +109,7 @@ is reachable from your local machine.
     user = "root"
     host = "mycluster.example.com"
     path = "/etc/rancher/k3s/k3s.yaml"
-    replace_apiserver_hostname = "mycluster.example.com"
+    replace_apiserver_hostname = "reachable-address.com"
     ```
 
 === "YAML"
@@ -112,7 +121,7 @@ is reachable from your local machine.
         user: root
         host: mycluster.example.com
         path: /etc/rancher/k3s/k3s.yaml
-        replace_apiserver_hostname: mycluster.example.com
+        replace_apiserver_hostname: reachable-address.com
     ```
 
 === "JSON"
@@ -125,11 +134,19 @@ is reachable from your local machine.
           "user": "root",
           "host": "mycluster.example.com",
           "path": "/etc/rancher/k3s/k3s.yaml",
-          "replace_apiserver_hostname": "mycluster.example.com"
+          "replace_apiserver_hostname": "reachable-address.com"
         }
     }
     ```
 
+!!! note
+
+    When retrieving a Kubeconfig via SSH that has `127.0.0.1`, `0.0.0.0` or `localhost` as the hostname in the `server`
+    field, and `replace_apiserver_hostname` is not specified, Nyl will automatically replace it with the `host` field
+    specified that was used to execute the remote command to read the Kubeconfig. This is because we expect the two
+    hosts to be the same, and you cannot reach the Kubernetes API server through your local machine without using tunnel
+    (which you can use, see [Tunnel management](#tunnel-management)).
+
 If you are you are already setup with a kubeconfig file, you can specify the path to the file directly or have it
 automatically use your `~/.kube/config` file/`KUBECONFIG` environment variable. You may specify the context to use
 from that kubeconfig file which ensures Nyl interacts with the correct cluster, even if your

nyl-0.4.0/docs/content/reference/glossary.md

@@ -0,0 +1,27 @@
+# Glossary
+
+  [Nyl-inline]: ./templating/inlining/overview.md
+
+### Manifest
+
+A manifest is a file that may define zero or more Kubernetes or [Nyl inline resources][Nyl-inline]. Nyl understands
+individual manifests, i.e. YAML files, and certain behaviours operate on that level, such as Kubernetes Namespace
+auto-filling and resource post-processing applying only to all resources defined in the same manifest as the
+[`PostProcessor`](./templating/inlining/postprocessor.md).
+
+### Profile
+
+...
+
+### Project
+
+...
+
+### Resource
+
+A resource is a YAML document that follows the schema of a Kubernetes API resource or [Nyl inline resource][Nyl-inline].
+An example would be a Kubernetes `ConfigMap`, `Deployment`, `Pod` or a Nyl `HelmChart` or `PostProcessor`.
+
+### Secrets provider
+
+...

nyl-0.2.2/docs/content/reference/templating/inlining.md → nyl-0.4.0/docs/content/reference/templating/inlining/helmcharts.md

@@ -2,19 +2,11 @@
 weight: 5
 ---
 
-# Inlining
+# HelmChart
 
-Nyl supports inlining of Kubernetes resources generated from templates in your configuration. Resources that are
-inlined by Nyl are typically in the `inline.nyl.io/v1` API group, however Nyl also has the concept of
-[components](./components.md) which effectively allow you to define your own API groups and resource kinds for
-inlined resources.
-
-## Helm charts
-
-Nyl currently only supports inlining of Helm charts. Helm charts are inlined by specifying a `HelmChart` resource in
-your configuration. Just like any other resource, the Helm chart resource values can be templated using Nyl's
-[structured templating](../templating/basics.md) (for example to inject secrets), and are then rendered to Kubernetes
-resources that are inlined in your configuration.
+Nyl allows you to inline Helm charts by specifying a `HelmChart` resource in your manifest. Just like any other
+resource, the Helm chart resource values can be templated using Nyl's [structured templating](../templating/basics.md)
+(for example to inject secrets), and are then rendered to Kubernetes resources that are inlined in your configuration.
 
 __Example__
 
@@ -28,6 +20,7 @@ spec:
   chart:
     repository: https://charts.bitnami.com/bitnami
     name: nginx
+    # version: "..."
   values:
     controller:
       service:

nyl-0.4.0/docs/content/reference/templating/inlining/overview.md

@@ -0,0 +1,10 @@
+---
+title: Overview
+---
+
+# Inlining Overview
+
+Nyl supports inlining of Kubernetes resources generated from templates in your configuration. Resources that are
+inlined by Nyl are typically in the `inline.nyl.io/v1` API group, however Nyl also has the concept of
+[components](./components.md) which effectively allow you to define your own API groups and resource kinds for
+inlined resources.

nyl-0.4.0/docs/content/reference/templating/inlining/postprocessor.md

@@ -0,0 +1,120 @@
+# PostProcessor
+
+The `inline.nyl.io/v1/PostProcessor` resource can be used to configure post-processing steps for all Kubernetes
+resources defined in the same [Manifest](../../glossary.md#manifest) as the `PostProcessor`. This resource does
+not accept a `metadata` field.
+
+## Prerequisites
+
+* You need the [`kyverno` CLI](https://kyverno.io/docs/kyverno-cli/) installed 
+
+## API Spec
+
+```yaml
+apiVersion: inline.nyl.io/v1
+kind: PostProcessor
+spec:
+  kyverno:
+    # A list of files that each contain a Kyverno policy resource, usually a `ClusterPolicy`. The paths are first
+    # considered relative to the manifest that this resource is defined in, and will then be searched in the project
+    # search path.
+    policyFiles:
+    - path/to/policy.yaml
+
+    # A mapping of policy names (what you would give as a filename) and a YAML document that represents the Kyverno
+    # policy resource (usually a `ClusterPolicy`).
+    inlinePolicies:
+      my-policy:
+        apiVersion: kyverno.io/v1
+        kind: ClusterPolicy
+        metadata:
+          name: enforce-pod-security-context
+        spec: {} # ...
+```
+
+## Example
+
+If you're deploying to hardened RKE2, your pods must have a specific `securityContext` configuration in order to be
+allowed by the PodSecurityPolicy. The application's Helm charts that you deploy may have options to inject the
+required options, but if they are not you're usually out of luck unless you fork the Helm chart, or materialize
+the resources and edit them in your project.
+
+With the Nyl `PostProcessor`, you can apply Kyverno policies to validate or mutate the resources in a
+[manifest](../../glossary.md#manifest).
+
+=== "Manifest"
+
+    ```yaml title="forgejo.yaml"
+    ---
+    apiVersion: inline.nyl.io/v1
+    kind: PostProcessor
+    spec:
+      kyverno:
+        policyFiles:
+        - ./policies/security-profile.yaml
+
+    ---
+    apiVersion: v1
+    kind: Namespace
+    metadata:
+      name: forgejo
+
+    ---
+    apiVersion: inline.nyl.io/v1
+    kind: HelmChart
+    metadata:
+      name: forgejo
+      namespace: forgejo
+    spec:
+      chart:
+        repository: oci://code.forgejo.org/forgejo-helm # https://artifacthub.io/packages/helm/forgejo-helm/forgejo
+        name: forgejo
+        version: "10.0.1"
+      values: {}
+    ```
+
+=== "Kyverno Policy"
+
+    ```yaml title="policies/security-profile.yaml"
+    apiVersion: kyverno.io/v1
+    kind: ClusterPolicy
+    metadata:
+      name: enforce-security-context
+    spec:
+      validationFailureAction: enforce
+      rules:
+        - name: mutate-pod-security-context
+          match:
+            resources:
+              kinds:
+                - Pod
+          mutate:
+            patchStrategicMerge: &podSpec
+              spec:
+                securityContext:
+                  runAsNonRoot: true
+                  seccompProfile:
+                    type: RuntimeDefault
+                containers: &containers
+                  - (name): "*"
+                    securityContext:
+                      runAsNonRoot: true
+                      allowPrivilegeEscalation: false
+                      capabilities:
+                        drop:
+                          - "ALL"
+                initContainers: *containers
+        - name: mutate-deployment-security-context
+          match:
+            resources:
+              kinds:
+                - Deployment
+          mutate:
+            patchStrategicMerge:
+              spec:
+                template: *podSpec
+    ```
+
+Running `nyl template forgejo.yaml` will use the `kyverno` CLI to apply the policy to the manifests generated by
+the Helm chart. Note that the post processing happens at the very end after all other Kubernetes manifests have
+been generated.

{nyl-0.2.2 → nyl-0.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nyl"
-version = "0.2.2"  # sed'ed on publish in CI
+version = "0.4.0"  # sed'ed on publish in CI
 description = "Advanced templating engine for Kubernetes and GitOps."
 authors = [
     {name = "Niklas Rosenstein", email = "rosensteinniklas@gmail.com"},

{nyl-0.2.2 → nyl-0.4.0}/src/nyl/commands/template.py

@@ -5,6 +5,7 @@ from pathlib import Path
 from textwrap import indent
 from typing import Optional
 from loguru import logger
+from nyl.resources.postprocessor import PostProcessor
 from typer import Argument, Option
 from nyl.tools import yaml
 from nyl.generator import reconcile_generator
@@ -177,8 +178,13 @@ def template(
                 generator,
                 source.manifests,
                 on_generated=lambda m: template_engine.evaluate(Manifests([m])),
+                skip_resources=[PostProcessor],
             )
 
+        # Find any PostProcessor resources and apply them.
+        source.manifests, post_processors = PostProcessor.extract_from_list(source.manifests)
+        source.manifests = PostProcessor.apply_all(source.manifests, post_processors, source.file)
+
         # Find the namespaces that are defined in the file. If we find any manifests without a namespace, we will
         # inject that namespace name into them. Also find the applyset defined in the file.
         namespaces: set[str] = set()

{nyl-0.2.2 → nyl-0.4.0}/src/nyl/generator/__init__.py

@@ -4,8 +4,9 @@ This package contains everything related to the generation of Kubernetes manifes
 
 from abc import ABC, abstractmethod
 from collections.abc import Callable
-from typing import Any, ClassVar, Generic, TypeVar
+from typing import Any, ClassVar, Generic, Sequence, TypeVar
 
+from nyl.resources import NylResource
 from stablehash import stablehash
 
 from nyl.tools.types import Manifest, Manifests
@@ -37,6 +38,7 @@ def reconcile_generator(
     generator: Generator[Manifest],
     manifests: Manifests,
     on_generated: Callable[[Manifest], Manifests],
+    skip_resources: Sequence[type[NylResource]] = (),
 ) -> Manifests:
     """
     Recursively reconcile all Nyl resources in the manifests using the given generator.
@@ -46,6 +48,7 @@ def reconcile_generator(
         manifests: The list of manifests to reconcile.
         on_generated: A callback to call on each generated manifest, giving the opportunity to modify it.
                       This is used to pass the manifest through the `structured-templates` engine.
+        skip_resources: A list of Nyl resources to ignore.
     """
 
     queue = Manifests(manifests)
@@ -63,8 +66,11 @@ def reconcile_generator(
             result.append(resource)
         else:
             seen.add(resource_hash)
-            for manifest in generator.generate(resource):
-                queue.extend(on_generated(manifest))
+            if any(t.matches(resource) for t in skip_resources):
+                queue.append(resource)
+            else:
+                for manifest in generator.generate(resource):
+                    queue.extend(on_generated(manifest))
             loops += 1
 
     return result

{nyl-0.2.2 → nyl-0.4.0}/src/nyl/generator/dispatch_test.py

@@ -46,6 +46,10 @@ def test__DispatchingGenerator__default__creates_generator_for_every_nyl_inline_
         kube_api_versions=set(),
     )
 
+    # We make an exception for the PostProcessor resource as it has no generator.
+
     for kind in resource_kinds:
+        if kind == "PostProcessor":
+            continue
         assert kind in generator.generators.keys()
         assert isinstance(generator.generators[kind], Generator)

{nyl-0.2.2 → nyl-0.4.0}/src/nyl/generator/helmchart.py

@@ -91,7 +91,7 @@ class HelmChartGenerator(Generator[HelmChart], resource_type=HelmChart):
             else:
                 logger.opt(ansi=True).debug("Using cached Helm chart '{}' from repository '{}'", chart, repository)
 
-            chart = str(cache_dir / next(cache_dir.iterdir()))
+            chart = str(next(cache_dir.iterdir()))
             repository = None
 
         elif chart_ref.git:

{nyl-0.2.2 → nyl-0.4.0}/src/nyl/profiles/config.py

@@ -58,11 +58,21 @@ class KubeconfigFromSsh:
     The username to connect to the remote host with.
     """
 
+    sudo: bool = False
+    """
+    Use `sudo cat` to retrieve the file instead of ust `cat`.
+    """
+
     host: str
     """
     The remote host to connect to.
     """
 
+    port: int = 22
+    """
+    SSH port to use.
+    """
+
     identity_file: str | None = None
     """
     An SSH private key file to use for authentication.
@@ -82,7 +92,10 @@ class KubeconfigFromSsh:
     """
     Replace the hostname in the apiserver configuration of the Kubeconfig. This is useful for example with K3s when
     reading reading the `/etc/rancher/k3s/k3s.yaml` file from a remote host, but the API server in that file is not
-    reachable from the local machine (e.g. because it `0.0.0.0`).
+    reachable from that machine.
+
+    Note that if the host in the retrieve Kubeconfig is `localhost`, `0.0.0.0` or `127.0.0.1`, it will be automatically
+    replaced with the specified `host` that was also SSH-ed to, unless this option is set.
     """
 
 

{nyl-0.2.2 → nyl-0.4.0}/src/nyl/profiles/kubeconfig.py

@@ -67,9 +67,13 @@ class KubeconfigManager:
 
                 command = [
                     "ssh",
+                    "-p",
+                    str(source.port),
                     f"{source.user}@{source.host}",
                     f"cat {shlex.quote(source.path)}",
                 ]
+                if source.sudo:
+                    command[4] = "sudo " + command[4]
                 if source.identity_file:
                     command[1:1] = ["-i", str(self._cwd / source.identity_file)]
 
@@ -94,8 +98,13 @@ class KubeconfigManager:
         if api_host is None:
             raise ValueError(f"no hostname in Kubeconfig server URL: {server!r}")
 
-        if isinstance(source, KubeconfigFromSsh) and source.replace_apiserver_hostname:
-            api_host = source.replace_apiserver_hostname
+        if isinstance(source, KubeconfigFromSsh):
+            if source.replace_apiserver_hostname:
+                api_host = source.replace_apiserver_hostname
+            elif api_host in ("127.0.0.1", "0.0.0.0", "localhost"):
+                # Automatically replace the API server since we won't be able to reach the Kubernetes API server
+                # pointing to localhost from the current machine.
+                api_host = source.host
 
         raw_kubeconfig.chmod(0o600)
         return GetRawKubeconfigResult(

{nyl-0.2.2 → nyl-0.4.0}/src/nyl/resources/placeholder.py

@@ -1,6 +1,4 @@
-import base64
 from dataclasses import dataclass
-import hashlib
 from typing import Annotated, ClassVar
 from nyl.resources import API_VERSION_K8S, NylResource, ObjectMetadata
 from databind.core import SerializeDefaults
@@ -78,33 +76,3 @@ class Placeholder(NylResource, api_version=API_VERSION_K8S):
                 namespace=namespace,
             )
         )
-
-
-def calculate_applyset_id(*, name: str, namespace: str = "", group: str) -> str:
-    """
-    Calculate the ID of a Kubernetes ApplySet with the specified name.
-    """
-
-    # reference: https://kubernetes.io/docs/reference/labels-annotations-taints/#applyset-kubernetes-io-id
-    hash = hashlib.sha256(f"{name}.{namespace}.ApplySet.{group}".encode()).digest()
-    uid = base64.b64encode(hash).decode().rstrip("=").replace("/", "_").replace("+", "-")
-    return f"applyset-{uid}-v1"
-
-
-def get_canonical_resource_kind_name(api_version: str, kind: str) -> str:
-    """
-    Given the apiVersion and kind of a Kubernetes resource, return the canonical name of the resource. This name can
-    be used to identify the resource in an ApplySet's `applyset.kubernetes.io/contains-group-kinds` annotation.
-
-    Note that according to the [reference][1], the resource name should use the plural form, but it appears that the
-    resource kind name is also accepted. Deriving the plural form will be difficult without querying the Kubernetes
-    API.
-
-    [1]: https://kubernetes.io/docs/reference/labels-annotations-taints/#applyset-kubernetes-io-contains-group-kinds
-
-    Args:
-        api_version: The apiVersion of the resource.
-        kind: The kind of the resource.
-    """
-
-    return (f"{kind}." + (api_version.split("/")[0] if "/" in api_version else "")).rstrip(".")

nyl-0.4.0/src/nyl/resources/postprocessor.py

@@ -0,0 +1,128 @@
+from dataclasses import dataclass, field
+from pathlib import Path
+import subprocess
+import sys
+from tempfile import TemporaryDirectory
+from typing import Any
+
+from loguru import logger
+import yaml
+
+from nyl.resources import API_VERSION_INLINE, NylResource
+from nyl.tools.kubernetes import resource_locator
+from nyl.tools.logging import lazy_str
+from nyl.tools.shell import pretty_cmd
+from nyl.tools.types import Manifests
+
+KyvernoPolicyDocument = dict[str, Any]
+
+
+@dataclass(kw_only=True)
+class KyvernoSpec:
+    policyFiles: list[str] = field(default_factory=list)
+    """
+    A list of Kyverno policy filenames, either relative to the file that defined the #PostProcessor resource
+    or discoverable in the project search path.
+    """
+
+    inlinePolicies: dict[str, KyvernoPolicyDocument] = field(default_factory=dict)
+    """
+    A mapping of policy name to the Kyverno policy document. Allows specifying Kyverno policies to be applied
+    to the generated manifests inline.
+    """
+
+
+@dataclass(kw_only=True)
+class PostProcessorSpec:
+    kyverno: KyvernoSpec
+    """
+    Apply Kyverno policies.
+    """
+
+
+@dataclass(kw_only=True)
+class PostProcessor(NylResource, api_version=API_VERSION_INLINE):
+    """
+    Configuration for post-processing Kubernetes manifests in a file. Note that the post-processing is always
+    scoped to the file that the processor is defined in. Post processors will be applied after all inline resources
+    are reconciled.
+    """
+
+    # metadata: ObjectMetadata
+
+    spec: PostProcessorSpec
+
+    def process(self, manifests: Manifests, source_file: Path) -> Manifests:
+        """
+        Post-process the given manifests.
+        """
+
+        if self.spec.kyverno.policyFiles or self.spec.kyverno.inlinePolicies:
+            logger.info("Applying Kyverno policies to manifests from '{}': {}", source_file.name, self.spec.kyverno)
+
+            policy_paths = []
+
+            for policy in map(Path, self.spec.kyverno.policyFiles):
+                if (source_file.parent / policy).exists():
+                    policy = (source_file.parent / policy).resolve()
+
+                assert policy.is_file() or policy.is_dir(), f"Path '{policy}' must be a directory or file"
+                # TODO: Resolve relative paths to full paths.
+                policy_paths.append(Path(policy))
+
+            with TemporaryDirectory() as _tmp:
+                tmp = Path(_tmp)
+
+                # Write inline policies to files.
+                inline_dir = tmp / "inline-policies"
+                inline_dir.mkdir()
+                for key, value in self.spec.kyverno.inlinePolicies.items():
+                    # If the file name does not end with a YAML suffix, Kyverno will ignore the input file.
+                    if not key.endswith(".yml") and not key.endswith(".yaml"):
+                        key += ".yaml"
+                    policy_paths.append(inline_dir.joinpath(key))
+                    policy_paths[-1].write_text(yaml.safe_dump(value))
+
+                # Write manifests to a file.
+                manifests_file = tmp / "manifests.yaml"
+                manifests_file.write_text(yaml.safe_dump_all(manifests))
+                output_file = tmp / "output.yaml"
+
+                command = [
+                    "kyverno",
+                    "apply",
+                    *map(str, policy_paths),
+                    f"--resource={manifests_file}",
+                    "-o",
+                    str(output_file),
+                ]
+                logger.debug("$ {}", lazy_str(pretty_cmd, command))
+                subprocess.check_call(command, stdout=sys.stderr)  # TODO: Catch output?
+
+                # Kyverno only prints the mutated manifests. We assume their name/kind doesn't change and
+                # merge them back into the original list.
+                mutated_manifests = Manifests(list(filter(None, yaml.safe_load_all(output_file.read_text()))))
+
+                logger.info("  Mutated manifests: {}", ", ".join(map(resource_locator, mutated_manifests)))
+                keyed_manifests = {resource_locator(m): m for m in manifests}
+                keyed_manifests.update({resource_locator(m): m for m in mutated_manifests})
+                manifests = Manifests(list(keyed_manifests.values()))
+
+        return manifests
+
+    @staticmethod
+    def extract_from_list(manifests: Manifests) -> tuple[Manifests, list["PostProcessor"]]:
+        processors = []
+        new_manifests = Manifests([])
+        for manifest in list(manifests):
+            if processor := PostProcessor.maybe_load(manifest):
+                processors.append(processor)
+            else:
+                new_manifests.append(manifest)
+        return new_manifests, processors
+
+    @staticmethod
+    def apply_all(manifests: Manifests, processors: list["PostProcessor"], source_file: Path) -> Manifests:
+        for processor in processors:
+            manifests = processor.process(manifests, source_file)
+        return manifests

nyl-0.4.0/src/nyl/resources/postprocessor_test.py

@@ -0,0 +1,133 @@
+from pathlib import Path
+from nyl.resources.postprocessor import KyvernoSpec, PostProcessor, PostProcessorSpec
+from nyl.tools.types import Manifest, Manifests
+
+
+def test__PostProcessor__extract_from_list() -> None:
+    manifest = Manifests(
+        [
+            Manifest(
+                {
+                    "apiVersion": "v1",
+                    "kind": "Pod",
+                    "metadata": {
+                        "name": "foo",
+                        "namespace": "bar",
+                    },
+                }
+            ),
+            Manifest({"apiVersion": "inline.nyl.io/v1", "kind": "PostProcessor", "spec": {"kyverno": {}}}),
+        ]
+    )
+
+    updated_manifest, processors = PostProcessor.extract_from_list(manifest)
+    assert updated_manifest == [manifest[0]]
+    assert len(processors) == 1
+
+
+def test__PostProcessor__process__inlinePolicy() -> None:
+    manifest = Manifests(
+        [
+            Manifest(
+                {
+                    "apiVersion": "v1",
+                    "kind": "Pod",
+                    "metadata": {"name": "foo", "namespace": "foo"},
+                    "spec": {
+                        "containers": [
+                            {
+                                "name": "main",
+                                "image": "nginx:latest",
+                            }
+                        ]
+                    },
+                }
+            )
+        ]
+    )
+
+    processor = PostProcessor(
+        spec=PostProcessorSpec(
+            kyverno=KyvernoSpec(
+                inlinePolicies={
+                    "security-profile": {
+                        "apiVersion": "kyverno.io/v1",
+                        "kind": "ClusterPolicy",
+                        "metadata": {"name": "enforce-pod-security-context"},
+                        "spec": {
+                            "validationFailureAction": "enforce",
+                            "rules": [
+                                {
+                                    "name": "mutate-pod-security-context",
+                                    "match": {"resources": {"kinds": ["Pod"]}},
+                                    "mutate": {
+                                        "patchStrategicMerge": {
+                                            "spec": {
+                                                "securityContext": {
+                                                    "runAsNonRoot": True,
+                                                    "seccompProfile": {"type": "RuntimeDefault"},
+                                                },
+                                                "containers": [
+                                                    {
+                                                        "(name)": "*",
+                                                        "securityContext": {
+                                                            "runAsNonRoot": True,
+                                                            "allowPrivilegeEscalation": False,
+                                                            "capabilities": {"drop": ["ALL"]},
+                                                        },
+                                                    }
+                                                ],
+                                                "initContainers": [
+                                                    {
+                                                        "(name)": "*",
+                                                        "securityContext": {
+                                                            "runAsNonRoot": True,
+                                                            "allowPrivilegeEscalation": False,
+                                                            "capabilities": {"drop": ["ALL"]},
+                                                        },
+                                                    }
+                                                ],
+                                            }
+                                        }
+                                    },
+                                },
+                            ],
+                        },
+                    }
+                }
+            )
+        )
+    )
+
+    updated_manifest = processor.process(manifest, Path("/"))
+
+    assert updated_manifest == [
+        {
+            "apiVersion": "v1",
+            "kind": "Pod",
+            "metadata": {"name": "foo", "namespace": "foo"},
+            "spec": {
+                "containers": [
+                    {
+                        "image": "nginx:latest",
+                        "name": "main",
+                        "securityContext": {
+                            "allowPrivilegeEscalation": False,
+                            "capabilities": {
+                                "drop": [
+                                    "ALL",
+                                ],
+                            },
+                            "runAsNonRoot": True,
+                        },
+                    },
+                ],
+                "securityContext": {
+                    "runAsNonRoot": True,
+                    "seccompProfile": {
+                        "type": "RuntimeDefault",
+                    },
+                },
+            },
+        }
+    ]

{nyl-0.2.2 → nyl-0.4.0}/src/nyl/tools/kubernetes.py

@@ -1,6 +1,7 @@
 from loguru import logger
 from kubernetes.dynamic import DynamicClient
 from kubernetes.client.api_client import ApiClient
+from nyl.tools.types import Manifest
 
 
 def discover_kubernetes_api_versions(client: ApiClient) -> set[str]:
@@ -15,3 +16,18 @@ def discover_kubernetes_api_versions(client: ApiClient) -> set[str]:
         all_versions.add(f"{resource.group_version}/{resource.kind}")
     logger.info("Discovered {} Kubernetes API version(s).", len(all_versions))
     return all_versions
+
+
+def resource_locator(manifest: Manifest) -> str:
+    """
+    Create a string that contains the apiVersion, kind, namespace and name of a Kubernetes resource formatted as
+
+        apiVersion/kind/namespace/name
+
+    This can be used to uniquely identify a resource.
+    """
+
+    return (
+        f"{manifest['apiVersion']}/{manifest['kind']}/"
+        f"{manifest['metadata'].get('namespace', '')}/{manifest['metadata']['name']}"
+    )