nyl 0.4.0__tar.gz → 0.5.1__tar.gz

nyl-0.5.1/.github/workflows/docs.yaml

@@ -0,0 +1,38 @@
+name: Documentation
+
+on:
+  push:
+    branches: [ develop ]
+    tags: [ '*' ]
+  pull_request:
+    branches: [ develop ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check Nix flake Nixpkgs inputs
+        uses: DeterminateSystems/flake-checker-action@main
+      - uses: cachix/install-nix-action@v25
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v14
+        with:
+          name: mycache
+          # If you chose signing key for write access
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          # If you chose API tokens for write access OR if you have a private cache
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      - name: Build docs
+        run: nix run .#docs build
+
+      - name: Publish documentation
+        uses: peaceiris/actions-gh-pages@v4
+        with:
+          personal_token: ${{ secrets.GITHUB_TOKEN }}
+          publish_dir: ./docs/site

nyl-0.5.1/.github/workflows/python.yaml

@@ -0,0 +1,70 @@
+name: Python
+
+on:
+  push:
+    branches: [ develop ]
+    tags: [ '*' ]
+  pull_request:
+    branches: [ develop ]
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+
+    strategy:
+      matrix:
+        python-version: ["3.11", "3.12"]
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check Nix flake Nixpkgs inputs
+        uses: DeterminateSystems/flake-checker-action@main
+      - uses: cachix/install-nix-action@v25
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v14
+        with:
+          name: mycache
+          # If you chose signing key for write access
+          signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          # If you chose API tokens for write access OR if you have a private cache
+          authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
+
+      # TODO: How would I best pass the Python version to use for the test?
+      - run: nix flake check
+
+      # TODO: nix flake check won't show us test output if everything passes, but showing it is useful.
+      - run: nix run .#test
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: test
+    environment: release
+    permissions:
+      id-token: write
+    if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get tags
+        run: git fetch --tags origin
+
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v2
+        with:
+          python-version: "3.10"
+
+      - name: Bump version
+        run: sed 's/version = "0.0.0"/version = "${{ github.ref_name }}"/' -i pyproject.toml && git diff
+
+      - name: Install uv
+        run: python -m pip install uv
+
+      - name: Build dist
+        run: uv build
+
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

{nyl-0.4.0 → nyl-0.5.1}/.gitignore

@@ -1,5 +1,6 @@
 .nyl/
 docs/site/
+/result
 
 # Python
 __pycache__/

{nyl-0.4.0 → nyl-0.5.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.3
 Name: nyl
-Version: 0.4.0
+Version: 0.5.1
 Summary: Advanced templating engine for Kubernetes and GitOps.
 Author-email: Niklas Rosenstein <rosensteinniklas@gmail.com>
 License: MIT

nyl-0.5.1/docs/content/reference/configuration/secrets.md

@@ -0,0 +1,152 @@
+# Secrets
+
+You can connect Nyl with various secret providers to retrieve external or encrypted data that can be used in your
+templates. This is useful for keeping sensitive data out of your configuration files and ensuring that they are not
+accidentally committed to a version control system.
+
+## Configuration
+
+Secret providers are configured in a `nyl-secrets.<ext>` file that is located in the current working directory or any of
+its parent directories. Secret providers may also be defined in a [Project configuration file](./projects.md), though
+the file closer to the working directory will take precedence.
+
+There is no "global" way to define a secrets provider, as secrets are considered project-specific.
+
+As with other configuration file types, the file extension can be `.toml`, `.yaml`, or `.json`.
+
+The configuration contains any number of named secret providers. When not specified otherwise, Nyl will assume that the
+provider to use is named `default`. The provider to use can be overriden by passing the corresponding CLI option to
+respective Nyl commands or by setting the `NYL_SECRETS` environment variable.
+
+## Inspecting secret providers
+
+You can inspect secret providers using the `nyl secrets` command.
+
+```
+nyl secrets list            List the keys for all secrets in the provider.
+nyl secrets get <key>       Get the value of a secret as JSON.
+```
+
+## Templating
+
+Secrets are made available to templates using the `secrets.get()` function. The function takes a single argument, the
+key of the secret to retrieve.
+
+__Example__
+
+```yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: my-secret
+type: Opaque
+stringData:
+  password: ${{ secrets.get("my-password") }}
+```
+
+## CLI
+
+The `nyl secrets` command allows you to interact with the configured secret provider(s).
+
+```
+ Usage: nyl secrets [OPTIONS] COMMAND [ARGS]...                                 
+                                                                                
+ Interact with the secrets providers configured in `nyl-secrets.yaml`.          
+                                                                                
+╭─ Options ────────────────────────────────────────────────────────────────────╮
+│ --provider        TEXT  The name of the configured secrets provider to use.  │
+│                         [env var: NYL_SECRETS]                               │
+│                         [default: default]                                   │
+│ --help                  Show this message and exit.                          │
+╰──────────────────────────────────────────────────────────────────────────────╯
+╭─ Commands ───────────────────────────────────────────────────────────────────╮
+│ get     Get the value of a secret as JSON.                                   │
+│ list    List the keys for all secrets in the provider.                       │
+│ set     Set the value of a secret.                                           │
+│ unset   Unset the value of a secret.                                         │
+╰──────────────────────────────────────────────────────────────────────────────╯
+```
+
+---
+
+## Provider: [Sops]
+
+  [Sops]: https://github.com/getsops/sops
+
+Allows you to retrieve secrets from a [Sops] encrypted file. For a GitOps workflow, the file must be commited to the
+same repository to ensure that Nyl has access to it when it is invoked as an ArgoCD Config Management plugin. You also
+must have the `sops` program installed.
+
+__Example__
+
+=== "TOML"
+
+    ```toml title="nyl-secrets.toml"
+    [default]
+    type = "sops"
+    path = "../secrets.yaml"
+    ```
+
+=== "YAML"
+
+    ```yaml title="nyl-secrets.yaml"
+    default:
+      type: sops
+      path: ../secrets.yaml
+    ```
+
+=== "JSON"
+
+    ```toml title="nyl-secrets.json"
+    {
+      "default": {
+        "type": "sops",
+        "path": "../secrets.yaml"
+      }
+    }
+    ```
+
+The secrets will be decoded using the `sops` program, hence all the typical ways to configure Sops and how it decrypts
+files apply. The `path` field is relative to the location of the `nyl-secrets.yaml` file.
+
+---
+
+## Provider: [KubernetesSecret](https://kubernetes.io/docs/concepts/configuration/secret/)
+
+Allows you to point to a Kubernetes Secret as a source for secrets. Since Kubernetes secret values must be strings,
+this provider does not currently support nested keys, although it could be made possible by assuming TOML/YAML/JSON
+format for the Kubernetes `Secret` keys in the `data` field.
+
+The secret provider will use the same Kubernetes context that is configured in Nyl via [Profiles](./profiles.md).
+
+__Example__
+
+=== "TOML"
+
+    ```toml title="nyl-secrets.toml"
+    [default]
+    type = "KubernetesSecret"
+    name = "nyl-secrets"
+    namespace = "default"
+    ```
+
+=== "YAML"
+
+    ```yaml title="nyl-secrets.yaml"
+    default:
+      type: KubernetesSecret
+      name: nyl-secrets
+      namespace: default
+    ```
+
+=== "JSON"
+
+    ```toml title="nyl-secrets.json"
+    {
+      "default": {
+        "type": "KubernetesSecret",
+        "name": "nyl-secrets",
+        "namespace": "default"
+      }
+    }
+    ```

{nyl-0.4.0 → nyl-0.5.1}/docs/content/reference/configuration-api/secrets.md

@@ -4,3 +4,8 @@
     options:
         show_root_heading: true
         show_source: false
+
+::: nyl.secrets.kubernetes
+    options:
+        show_root_heading: true
+        show_source: false

nyl-0.5.1/flake.lock

@@ -0,0 +1,348 @@
+{
+  "nodes": {
+    "flake-utils": {
+      "inputs": {
+        "systems": "systems"
+      },
+      "locked": {
+        "lastModified": 1726560853,
+        "narHash": "sha256-X6rJYSESBVr3hBoH0WbKE5KvhPU5bloyZ2L4K60/fPQ=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "c1dfcf08411b08f6b8615f7d8971a2bfa81d5e8a",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
+    "lix": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1730846669,
+        "narHash": "sha256-HUdKD2GLudNnQm4yvakMSUhcHF2g0Nc+1QxgDwrlU90=",
+        "ref": "refs/heads/main",
+        "rev": "72292671a9e1c7600d1cc4240e717ac3bdd6cef0",
+        "revCount": 16450,
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/lix.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/lix.git"
+      }
+    },
+    "lix-unit": {
+      "inputs": {
+        "lix": "lix",
+        "mdbook-nixdoc": [
+          "pyproject-nix",
+          "mdbook-nixdoc"
+        ],
+        "nix-github-actions": [
+          "pyproject-nix",
+          "nix-github-actions"
+        ],
+        "nixpkgs": [
+          "pyproject-nix",
+          "nixpkgs"
+        ],
+        "treefmt-nix": [
+          "pyproject-nix",
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730863251,
+        "narHash": "sha256-NoImlilaWPAGWz/Ja0uXcagQ8UK61KEev2jFDM+vgzQ=",
+        "owner": "adisbladis",
+        "repo": "lix-unit",
+        "rev": "2893fe1a7e870a3da8a04be89ca494c1ff9c3e82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "adisbladis",
+        "repo": "lix-unit",
+        "type": "github"
+      }
+    },
+    "lix-unit_2": {
+      "inputs": {
+        "lix": "lix_2",
+        "mdbook-nixdoc": [
+          "uv2nix",
+          "mdbook-nixdoc"
+        ],
+        "nix-github-actions": [
+          "uv2nix",
+          "nix-github-actions"
+        ],
+        "nixpkgs": [
+          "uv2nix",
+          "nixpkgs"
+        ],
+        "treefmt-nix": [
+          "uv2nix",
+          "treefmt-nix"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730863251,
+        "narHash": "sha256-NoImlilaWPAGWz/Ja0uXcagQ8UK61KEev2jFDM+vgzQ=",
+        "owner": "adisbladis",
+        "repo": "lix-unit",
+        "rev": "2893fe1a7e870a3da8a04be89ca494c1ff9c3e82",
+        "type": "github"
+      },
+      "original": {
+        "owner": "adisbladis",
+        "repo": "lix-unit",
+        "type": "github"
+      }
+    },
+    "lix_2": {
+      "flake": false,
+      "locked": {
+        "lastModified": 1730846669,
+        "narHash": "sha256-HUdKD2GLudNnQm4yvakMSUhcHF2g0Nc+1QxgDwrlU90=",
+        "ref": "refs/heads/main",
+        "rev": "72292671a9e1c7600d1cc4240e717ac3bdd6cef0",
+        "revCount": 16450,
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/lix.git"
+      },
+      "original": {
+        "type": "git",
+        "url": "https://git.lix.systems/lix-project/lix.git"
+      }
+    },
+    "mdbook-nixdoc": {
+      "inputs": {
+        "nix-github-actions": [
+          "pyproject-nix",
+          "nix-github-actions"
+        ],
+        "nixpkgs": [
+          "pyproject-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1708395692,
+        "narHash": "sha256-smf0VmxGbjJDZqKvxxG3ZVqubgbVwAWG26wPo+BT/A0=",
+        "owner": "adisbladis",
+        "repo": "mdbook-nixdoc",
+        "rev": "d6a71b114b9221c0b4f20d31b81766d072cc26be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "adisbladis",
+        "repo": "mdbook-nixdoc",
+        "type": "github"
+      }
+    },
+    "mdbook-nixdoc_2": {
+      "inputs": {
+        "nix-github-actions": [
+          "uv2nix",
+          "nix-github-actions"
+        ],
+        "nixpkgs": [
+          "uv2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1708395692,
+        "narHash": "sha256-smf0VmxGbjJDZqKvxxG3ZVqubgbVwAWG26wPo+BT/A0=",
+        "owner": "adisbladis",
+        "repo": "mdbook-nixdoc",
+        "rev": "d6a71b114b9221c0b4f20d31b81766d072cc26be",
+        "type": "github"
+      },
+      "original": {
+        "owner": "adisbladis",
+        "repo": "mdbook-nixdoc",
+        "type": "github"
+      }
+    },
+    "nix-github-actions": {
+      "inputs": {
+        "nixpkgs": [
+          "pyproject-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
+    "nix-github-actions_2": {
+      "inputs": {
+        "nixpkgs": [
+          "uv2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1729742964,
+        "narHash": "sha256-B4mzTcQ0FZHdpeWcpDYPERtyjJd/NIuaQ9+BV1h+MpA=",
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "rev": "e04df33f62cdcf93d73e9a04142464753a16db67",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "nix-github-actions",
+        "type": "github"
+      }
+    },
+    "nixpkgs": {
+      "locked": {
+        "lastModified": 1730785428,
+        "narHash": "sha256-Zwl8YgTVJTEum+L+0zVAWvXAGbWAuXHax3KzuejaDyo=",
+        "owner": "nixos",
+        "repo": "nixpkgs",
+        "rev": "4aa36568d413aca0ea84a1684d2d46f55dbabad7",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nixos",
+        "ref": "nixos-unstable",
+        "repo": "nixpkgs",
+        "type": "github"
+      }
+    },
+    "pyproject-nix": {
+      "inputs": {
+        "lix-unit": "lix-unit",
+        "mdbook-nixdoc": "mdbook-nixdoc",
+        "nix-github-actions": "nix-github-actions",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "treefmt-nix": "treefmt-nix"
+      },
+      "locked": {
+        "lastModified": 1730863432,
+        "narHash": "sha256-xn3xCNJRrveAnAodqjZj0ZQ5kbrcnpcM3zUGlygoKbc=",
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "rev": "d78783b228419b475002e396c2433ecc82bbc7b0",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-community",
+        "repo": "pyproject.nix",
+        "type": "github"
+      }
+    },
+    "root": {
+      "inputs": {
+        "flake-utils": "flake-utils",
+        "nixpkgs": "nixpkgs",
+        "pyproject-nix": "pyproject-nix",
+        "uv2nix": "uv2nix"
+      }
+    },
+    "systems": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "treefmt-nix": {
+      "inputs": {
+        "nixpkgs": [
+          "pyproject-nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730321837,
+        "narHash": "sha256-vK+a09qq19QNu2MlLcvN4qcRctJbqWkX7ahgPZ/+maI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "746901bb8dba96d154b66492a29f5db0693dbfcc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "treefmt-nix_2": {
+      "inputs": {
+        "nixpkgs": [
+          "uv2nix",
+          "nixpkgs"
+        ]
+      },
+      "locked": {
+        "lastModified": 1730321837,
+        "narHash": "sha256-vK+a09qq19QNu2MlLcvN4qcRctJbqWkX7ahgPZ/+maI=",
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "rev": "746901bb8dba96d154b66492a29f5db0693dbfcc",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "treefmt-nix",
+        "type": "github"
+      }
+    },
+    "uv2nix": {
+      "inputs": {
+        "lix-unit": "lix-unit_2",
+        "mdbook-nixdoc": "mdbook-nixdoc_2",
+        "nix-github-actions": "nix-github-actions_2",
+        "nixpkgs": [
+          "nixpkgs"
+        ],
+        "pyproject-nix": [
+          "pyproject-nix"
+        ],
+        "treefmt-nix": "treefmt-nix_2"
+      },
+      "locked": {
+        "lastModified": 1730876081,
+        "narHash": "sha256-lynNnnKxF4zNlmmMtCIrmbWM7V1GPEMWrFc8MXbmVJI=",
+        "owner": "adisbladis",
+        "repo": "uv2nix",
+        "rev": "7184376b4e8fbf80dcce44f9b48cd909176dd0f4",
+        "type": "github"
+      },
+      "original": {
+        "owner": "adisbladis",
+        "repo": "uv2nix",
+        "type": "github"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}