nyl 0.5.1__tar.gz → 0.7.0__tar.gz

nyl-0.7.0/.changelog/0.7.0.toml

@@ -0,0 +1,70 @@
+release-date = "2025-01-17"
+
+[[entries]]
+id = "d86d5d47-3d02-4321-94a3-bea25c512ecc"
+type = "breaking change"
+description = "Recognize `nyl.io/default-namespace: \"true\"` on Namespace resources to choose between one of multiple namespaces defined in the same manifest file."
+author = "@NiklasRosenstein"
+
+[[entries]]
+id = "056ab3d5-fc80-449c-af24-d7bca6f3e522"
+type = "breaking change"
+description = "Instead of not assuming a default namespace when multiple `Namespace` resources are defined in a manifest file, pick the first one alphabetically when none have the `nyl.io/default-namespace: \"true\"` annotation"
+author = "@NiklasRosenstein"
+
+[[entries]]
+id = "d0798272-7c1c-402d-8e04-d578cea6a410"
+type = "improvement"
+description = "Apply Nyl `PostProcessor` instructions at the end, after Nyl had a chance to fill in the manifest file's determined default namespace. Kyverno might add the `namespace: default` field to any resource that has no namespace set, making it impossbile for Nyl after the fact to tell which resources need to have their namespace injected."
+author = "@NiklasRosenstein"
+
+[[entries]]
+id = "8a3b94a4-0dd9-45a0-8cb2-bd679979527e"
+type = "fix"
+description = "Update `PostProcessor`, pointing Kyverno to a directory and expecting it to output all manifest, not just the mutated ones. The `PostProcessor` is now invoked at the very end, even after Nyl patches resources with the default namespace in the current manifest file."
+author = "@NiklasRosenstein"
+
+[[entries]]
+id = "843a3744-7e50-49d3-8dc5-8800e866ca01"
+type = "fix"
+description = "fix #57 -- `ARGOCD_APP_NAMESPACE` and the `--default-namespace` option are used now only when no namespace is defined in the manifest file"
+author = "@NiklasRosenstein"
+
+[[entries]]
+id = "3152517a-b701-4d38-ba18-f97f2f03cd09"
+type = "improvement"
+description = "Resources generated by the Nyl `HelmChart` resource now get the chart resource's `metadata.namespace` populated before they are passed up and inlined into the rest of the manifest. Fixes #56"
+author = "@NiklasRosenstein"
+
+[[entries]]
+id = "cdbd2567-9801-4514-8552-6fdc352a8185"
+type = "improvement"
+description = "Fix deprecation warnings of using the `loguru.logger.opt(ansi)` keyword argument and use the new `colors` kwarg instead"
+author = "@NiklasRosenstein"
+
+[[entries]]
+id = "dd1038ab-19cf-406a-bc06-ccc14ad8fbbb"
+type = "feature"
+description = "Add `PostProcessor.spec.kyvernoRules` field as a shorthand for defining Kyverno policies in a Nyl manifest."
+author = "@NiklasRosenstein"
+
+[[entries]]
+id = "2eed140a-4d16-448a-96fb-997b3ca81297"
+type = "refactor"
+description = "Refactor `PostProcessor` implementation for generating policy files and invoking Kyverno"
+author = "@NiklasRosenstein"
+
+[[entries]]
+id = "320c1dce-1ba6-451b-9f25-a279ae8b9eb2"
+type = "improvement"
+description = "`PostProcessor` log for invoking Kyverno now lists the policy file paths that are going to be applied"
+author = "@NiklasRosenstein"
+
+[[entries]]
+id = "138bdc5d-848b-45fe-a5f4-4c658535339d"
+type = "fix"
+description = "`nyl new chart` now generates 2-space indented YAML and has a more complete template"
+author = "@NiklasRosenstein"
+issues = [
+    "https://github.com/NiklasRosenstein/nyl/issues/47",
+]

{nyl-0.5.1 → nyl-0.7.0}/.github/workflows/docker.yaml

@@ -36,8 +36,8 @@ jobs:
           push: true
           file: argocd-cmp/Dockerfile
           tags: |
-            ghcr.io/niklasrosenstein/nyl/argocd-cmp:${{ github.sha }}
-            ${{ github.ref_type == 'tag' && format('ghcr.io/niklasrosenstein/nyl/argocd-cmp:{0}', github.ref_name) || '' }}
-          cache-to: type=registry,ref=ghcr.io/niklasrosenstein/nyl/argocd-cmp:cache,mode=max
-          cache-from: type=registry,ref=ghcr.io/niklasrosenstein/nyl/argocd-cmp:cache
+            ghcr.io/helsing-ai/nyl/argocd-cmp:${{ github.sha }}
+            ${{ github.ref_type == 'tag' && format('ghcr.io/helsing-ai/nyl/argocd-cmp:{0}', github.ref_name) || '' }}
+          cache-to: type=registry,ref=ghcr.io/helsing-ai/nyl/argocd-cmp:cache,mode=max
+          cache-from: type=registry,ref=ghcr.io/helsing-ai/nyl/argocd-cmp:cache
           platforms: linux/amd64,linux/arm64

{nyl-0.5.1 → nyl-0.7.0}/.github/workflows/docs.yaml

@@ -17,10 +17,10 @@ jobs:
       - uses: actions/checkout@v4
       - name: Check Nix flake Nixpkgs inputs
         uses: DeterminateSystems/flake-checker-action@main
-      - uses: cachix/install-nix-action@v25
+      - uses: cachix/install-nix-action@v30
         with:
           nix_path: nixpkgs=channel:nixos-unstable
-      - uses: cachix/cachix-action@v14
+      - uses: cachix/cachix-action@v15
         with:
           name: mycache
           # If you chose signing key for write access

nyl-0.7.0/.github/workflows/python.yaml

@@ -0,0 +1,87 @@
+name: Python
+
+on:
+  push:
+    branches: [ develop ]
+    tags: [ '*' ]
+  pull_request:
+    branches: [ develop ]
+
+jobs:
+  test-nix:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Check Nix flake Nixpkgs inputs
+        uses: DeterminateSystems/flake-checker-action@main
+      - uses: cachix/install-nix-action@v30
+        with:
+          nix_path: nixpkgs=channel:nixos-unstable
+      - uses: cachix/cachix-action@v15
+        with:
+          name: mycache
+
+      # Ignore failures until we can fix the Nix build.
+      - run: nix flake check || true
+      - run: nix run .#test || true
+
+  test-native:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: kyverno/action-install-cli@v0.2.0
+        with:
+          release: 'v1.13.2'
+
+      - name: Install SOPS
+        run: |
+          curl -LO https://github.com/getsops/sops/releases/download/v3.9.3/sops-v3.9.3.linux.amd64
+          mv sops-v3.9.3.linux.amd64 /usr/local/bin/sops
+          chmod +x /usr/local/bin/sops
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          version: "0.5.20"
+
+      - run: uv sync
+      - run: uv run pytest .
+      - run: uv run mypy .
+      - run: uv run ruff check .
+      - run: uv run ruff format --check .
+
+  publish:
+    runs-on: ubuntu-latest
+    needs: test-native
+    environment: release
+    permissions:
+      id-token: write
+    if: startsWith(github.ref, 'refs/tags/') && github.event_name == 'push'
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Get tags
+        run: git fetch --tags origin
+
+      - name: Set up Python 3.10
+        uses: actions/setup-python@v5
+        with:
+          python-version: "3.10"
+
+      - name: Bump version
+        run: sed 's/version = ".*"/version = "${{ github.ref_name }}"/' -i pyproject.toml && git diff
+
+      - name: Install uv
+        run: python -m pip install uv
+
+      - name: Build dist
+        run: uv build
+
+      - name: Publish
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          packages-dir: dist/

nyl-0.7.0/.github/workflows/update-flake-lock.yaml

@@ -0,0 +1,23 @@
+# See https://github.com/determinateSystems/update-flake-lock
+
+name: update-flake-lock
+on:
+  workflow_dispatch: # allows manual triggering
+  schedule:
+    - cron: '0 0 * * 0' # runs weekly on Sunday at 00:00
+
+jobs:
+  lockfile:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: Install Nix
+        uses: DeterminateSystems/nix-installer-action@main
+      - name: Update flake.lock
+        uses: DeterminateSystems/update-flake-lock@main
+        with:
+          pr-title: "Update flake.lock" # Title of PR to be created
+          pr-labels: |                  # Labels to be set on the PR
+            dependencies
+            automated

{nyl-0.5.1 → nyl-0.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
-Metadata-Version: 2.3
+Metadata-Version: 2.4
 Name: nyl
-Version: 0.5.1
+Version: 0.7.0
 Summary: Advanced templating engine for Kubernetes and GitOps.
 Author-email: Niklas Rosenstein <rosensteinniklas@gmail.com>
 License: MIT
@@ -34,15 +34,32 @@ Requires Python 3.11 or newer.
 For some features, additional programs must be available:
 
 * [kubectl](https://kubernetes.io/de/docs/reference/kubectl/) for most operations
-* [kyverno](https://kyverno.io/docs/kyverno-cli/) when using the Nyl `PostProcessor` resource
+* [kyverno](https://kyverno.io/docs/kyverno-cli/) ^1.13.x when using the Nyl `PostProcessor` resource
 * [sops](https://github.com/getsops/sops) when using the SOPS secrets provider
 
+You can install Nyl with Nix to ensure all dependencies are met.
+
 ## Local development
 
 Install the project with [Uv](https://docs.astral.sh/uv/).
 
     $ uv sync
 
+To lint, run
+
+    $ nix flake check
+
+And to format code, run
+
+    $ nix fmt
+
+To build or serve the documentation, run
+
+    $ nix run .#docs serve
+    $ nix run .#docs build
+
+respectively.
+
 ## Tracking upstream information
 
 * Discussion around ArgoCD supporting Helm lookups (maybe with Project-level service account?), see

{nyl-0.5.1 → nyl-0.7.0}/README.md

@@ -12,15 +12,32 @@ Requires Python 3.11 or newer.
 For some features, additional programs must be available:
 
 * [kubectl](https://kubernetes.io/de/docs/reference/kubectl/) for most operations
-* [kyverno](https://kyverno.io/docs/kyverno-cli/) when using the Nyl `PostProcessor` resource
+* [kyverno](https://kyverno.io/docs/kyverno-cli/) ^1.13.x when using the Nyl `PostProcessor` resource
 * [sops](https://github.com/getsops/sops) when using the SOPS secrets provider
 
+You can install Nyl with Nix to ensure all dependencies are met.
+
 ## Local development
 
 Install the project with [Uv](https://docs.astral.sh/uv/).
 
     $ uv sync
 
+To lint, run
+
+    $ nix flake check
+
+And to format code, run
+
+    $ nix fmt
+
+To build or serve the documentation, run
+
+    $ nix run .#docs serve
+    $ nix run .#docs build
+
+respectively.
+
 ## Tracking upstream information
 
 * Discussion around ArgoCD supporting Helm lookups (maybe with Project-level service account?), see

{nyl-0.5.1 → nyl-0.7.0}/argocd-cmp/Dockerfile

@@ -2,8 +2,8 @@
 #: Build Nyl itself.
 #: -----------------
 
-FROM python:3.12-alpine AS build
-COPY --from=ghcr.io/astral-sh/uv:0.4.7 /uv /bin/uv
+FROM python:3.13-alpine AS build
+COPY --from=ghcr.io/astral-sh/uv:0.5.7 /uv /bin/uv
 
 WORKDIR /opt/nyl
 
@@ -39,7 +39,8 @@ RUN \
 
 FROM fetch-bin-base AS argocd-bin
 # Find ArgoCD releases at https://github.com/argoproj/argo-cd/releases
-ARG ARGOCD_VERSION=v2.12.0
+# renovate: datasource=github-releases depName=argocd packageName=argoproj/argo-cd
+ARG ARGOCD_VERSION=v2.13.1
 RUN curl -sSfLo /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releases/download/${ARGOCD_VERSION}/argocd-linux-$(cat /BINARY_ARCH) \
     && chmod +x /usr/local/bin/argocd \
     && upx /usr/local/bin/argocd \
@@ -47,7 +48,8 @@ RUN curl -sSfLo /usr/local/bin/argocd https://github.com/argoproj/argo-cd/releas
 
 FROM fetch-bin-base AS helm-bin
 # Find Helm releases at https://github.com/helm/helm/releases
-ARG HELM_VERSION=v3.15.3
+# renovate: datasource=github-releases depName=helm packageName=helm/helm
+ARG HELM_VERSION=v3.16.3
 RUN curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/scripts/get-helm-3 \
     && chmod 700 get_helm.sh \
     && ./get_helm.sh --version $HELM_VERSION \
@@ -56,7 +58,8 @@ RUN curl -fsSL -o get_helm.sh https://raw.githubusercontent.com/helm/helm/main/s
 
 FROM fetch-bin-base AS sops-bin
 # Find SOPS releases at https://github.com/getsops/sops/releases
-ARG SOPS_VERSION=v3.9.0
+# renovate: datasource=github-releases depName=sops packageName=getsops/sops
+ARG SOPS_VERSION=v3.9.2
 RUN curl -fLO https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.$(cat /BINARY_ARCH) \
     && mv sops-${SOPS_VERSION}.linux.$(cat /BINARY_ARCH) /usr/local/bin/sops \
     && chmod +x /usr/local/bin/sops \
@@ -64,7 +67,8 @@ RUN curl -fLO https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/
     && sops --version
 
 FROM fetch-bin-base AS kyverno-bin
-ARG KYVERNO_VERSION=1.13.0
+# renovate: datasource=github-releases depName=kyverno packageName=kyverno/kyverno
+ARG KYVERNO_VERSION=1.13.2
 RUN \
     case "$(uname -m)" in \
         x86_64) KYVERNO_ARCH='x86_64' ;; \
@@ -79,7 +83,7 @@ RUN \
 #: Build the ArgoCD CMP server image.
 #: ----------------------------------
 
-FROM python:3.12-alpine AS nyl-cmp
+FROM python:3.13-alpine AS nyl-cmp
 RUN apk add git
 COPY --from=argocd-bin /usr/local/bin/argocd /usr/local/bin/argocd
 RUN ln -s /usr/local/bin/argocd /usr/local/bin/argocd-cmp-server && chown 999:999 /usr/local/bin/argocd-cmp-server

{nyl-0.5.1 → nyl-0.7.0}/argocd-with-nyl/argocd.yaml

@@ -40,7 +40,7 @@ spec:
     repoServer:
       extraContainers:
         - name: nyl-v1
-          image: ghcr.io/niklasrosenstein/nyl/argocd-cmp:0.0.7
+          image: ghcr.io/helsing-ai/nyl/argocd-cmp:0.0.7
           securityContext:
             runAsNonRoot: true
             runAsUser: 999
@@ -76,7 +76,7 @@ metadata:
 spec:
   project: default
   source:
-    repoURL: https://github.com/NiklasRosenstein/nyl.git
+    repoURL: https://github.com/helsing-ai/nyl.git
     targetRevision: HEAD
     path: argocd-with-nyl
   destination:

nyl-0.7.0/docs/content/changelog.md

@@ -0,0 +1,69 @@
+# Changelog
+
+## 0.7.0
+
+<table><tr><th>Type</th><th>Description</th><th>PR</th><th>Issues</th><th>Author</th></tr>
+  <tr><td>Breaking change</td><td>
+
+Recognize `nyl.io/default-namespace: "true"` on Namespace resources to choose between one of multiple namespaces defined in the same manifest file.</td><td></td><td></td><td>@NiklasRosenstein</td></tr>
+  <tr><td>Breaking change</td><td>
+
+Instead of not assuming a default namespace when multiple `Namespace` resources are defined in a manifest file, pick the first one alphabetically when none have the `nyl.io/default-namespace: "true"` annotation</td><td></td><td></td><td>@NiklasRosenstein</td></tr>
+  <tr><td>Improvement</td><td>
+
+Apply Nyl `PostProcessor` instructions at the end, after Nyl had a chance to fill in the manifest file's determined default namespace. Kyverno might add the `namespace: default` field to any resource that has no namespace set, making it impossbile for Nyl after the fact to tell which resources need to have their namespace injected.</td><td></td><td></td><td>@NiklasRosenstein</td></tr>
+  <tr><td>Fix</td><td>
+
+Update `PostProcessor`, pointing Kyverno to a directory and expecting it to output all manifest, not just the mutated ones. The `PostProcessor` is now invoked at the very end, even after Nyl patches resources with the default namespace in the current manifest file.</td><td></td><td></td><td>@NiklasRosenstein</td></tr>
+  <tr><td>Fix</td><td>
+
+fix #57 -- `ARGOCD_APP_NAMESPACE` and the `--default-namespace` option are used now only when no namespace is defined in the manifest file</td><td></td><td></td><td>@NiklasRosenstein</td></tr>
+  <tr><td>Improvement</td><td>
+
+Resources generated by the Nyl `HelmChart` resource now get the chart resource's `metadata.namespace` populated before they are passed up and inlined into the rest of the manifest. Fixes #56</td><td></td><td></td><td>@NiklasRosenstein</td></tr>
+  <tr><td>Improvement</td><td>
+
+Fix deprecation warnings of using the `loguru.logger.opt(ansi)` keyword argument and use the new `colors` kwarg instead</td><td></td><td></td><td>@NiklasRosenstein</td></tr>
+  <tr><td>Feature</td><td>
+
+Add `PostProcessor.spec.kyvernoRules` field as a shorthand for defining Kyverno policies in a Nyl manifest.</td><td></td><td></td><td>@NiklasRosenstein</td></tr>
+  <tr><td>Refactor</td><td>
+
+Refactor `PostProcessor` implementation for generating policy files and invoking Kyverno</td><td></td><td></td><td>@NiklasRosenstein</td></tr>
+  <tr><td>Improvement</td><td>
+
+`PostProcessor` log for invoking Kyverno now lists the policy file paths that are going to be applied</td><td></td><td></td><td>@NiklasRosenstein</td></tr>
+  <tr><td>Fix</td><td>
+
+`nyl new chart` now generates 2-space indented YAML and has a more complete template</td><td></td><td><a href="https://github.com/NiklasRosenstein/nyl/issues/47">47</a></td><td>@NiklasRosenstein</td></tr>
+</table>
+
+## 0.6.0
+
+* Upgraded `argocd-cmp-server` in `nyl/argocd-cmp` container image to `v2.13.1` (see [#46](https://github.com/helsing-ai/nyl/pull/46))
+* Re-introduce `settings.generate_placeholders` in `nyl-project.toml`, but warn if it is used. Enabling the option will have the
+    same effect as setting `on_lookup_failure = "CreatePlaceholder"` and take precedence over the original value of `on_lookup_failure`.
+
+## 0.5.1
+
+* Add Nix flake
+* Docs: Add missing API docs for `nyl.secrets.kubernetes`
+
+## 0.5.0
+
+* Add the [`KubernetesSecret`](./reference/configuration/secrets.md#provider-kubernetessecret) secret provider
+* Add the `ntyl secrets set` and `nyl secrets unset` commands
+* Breaking: Replace the `settings.generate_placeholders` option with `settings.on_lookup_failure`
+
+## 0.4.0
+
+* Automatically replace the host in Kubeconfig `server` field if it is set to `localhost`, `0.0.0.0` or `127.0.0.1`
+    when a Kubeconfig is retrieved via SSH (saving you to configure `replace_apiserver_hostname` when sourcing a
+    Kubeconfig from a K3s/RKE2 cluster via SSH).
+* Add `port` and `sudo` option to `KubeconfigFromSsh` config
+
+## 0.3.0
+
+* Add [`PostProcessor`](./reference/templating/inlining/postprocessor.md) inline resource which supports applying
+    Kyverno policies to the generated resources.
+* Fixed a bug in the construction of the local Helm chart path when referencing a Helm chart in a Git repository.

{nyl-0.5.1 → nyl-0.7.0}/docs/content/reference/applysets.md

@@ -7,4 +7,4 @@ resources in a cluster. Nyl provides basic support for ApplySets, allowing you t
 and prune resources as they are removed from your configuration.
 
 Note that ApplySet support is experimental and has still has various issues. You can following the progress of the
-feature in the [nyl#5](https://github.com/NiklasRosenstein/nyl/issues/5).
+feature in the [nyl#5](https://github.com/helsing-ai/nyl/issues/5).

{nyl-0.5.1 → nyl-0.7.0}/docs/content/reference/argocd-plugin.md

@@ -16,7 +16,7 @@ We recommend the following configuration:
 repoServer:
   extraContainers:
     - name: nyl-v1
-      image: ghcr.io/niklasrosenstein/nyl/argocd-cmp:{{ NYL_VERSION }}
+      image: ghcr.io/helsing-ai/nyl/argocd-cmp:{{ NYL_VERSION }}
       securityContext:
         runAsNonRoot: true
         runAsUser: 999

{nyl-0.5.1 → nyl-0.7.0}/docs/content/reference/templating/inlining/helmcharts.md

@@ -52,6 +52,9 @@ application, you would need to create a Helm chart that includes all the other c
 complicated setup that is hard to maintain: It either requires you to repeat the same values in multiple places, or
 all subcharts support `globals`.
 
+The `HelmChart` generator populates its own Kubernetes namespace to that of its generated resources that lack a
+namespace.
+
 #### Secret injection
 
 Natively, ArgoCD applications do not support injecting secrets into the Helm chart values. With Nyl, you can connect

{nyl-0.5.1 → nyl-0.7.0}/docs/content/reference/templating/inlining/postprocessor.md

@@ -6,14 +6,21 @@ not accept a `metadata` field.
 
 ## Prerequisites
 
-* You need the [`kyverno` CLI](https://kyverno.io/docs/kyverno-cli/) installed 
+You need the [`kyverno` CLI](https://kyverno.io/docs/kyverno-cli/) >1.13.x installed 
+
+!!! danger
+    In Kyverno 1.12.6, the `kyverno apply` command with the `-o` option outputs only the mutated resources. In
+    Kyverno 1.13.2, all resources are outputted. Nyl relies on the latter behavior.
 
 ## API Spec
 
 ```yaml
 apiVersion: inline.nyl.io/v1
 kind: PostProcessor
+metadata:
+  name: my-post-processor
 spec:
+  # Configure Kyverno policies to apply.
   kyverno:
     # A list of files that each contain a Kyverno policy resource, usually a `ClusterPolicy`. The paths are first
     # considered relative to the manifest that this resource is defined in, and will then be searched in the project
@@ -29,7 +36,36 @@ spec:
         kind: ClusterPolicy
         metadata:
           name: enforce-pod-security-context
-        spec: {} # ...
+        spec:
+          rules:
+          - name: my-rule
+            match:
+              resources:
+                kinds:
+                  - Pod
+            validate:
+              message: "Pod must have security context"
+              pattern:
+                spec:
+                  securityContext:
+                    runAsNonRoot: true
+
+  # Define rules for a single Kyverno `ClusterPolicy` to apply. The `name` field of the rule configuration may be
+  # ommited. Applies after policies defined in `kyverno`.
+  #
+  # To find more about Kyverno policies and rules, read https://kyverno.io/docs/writing-policies/.
+  kyvernoRules:
+  - match:
+      resources:
+        kinds:
+          - Service
+    mutate:
+      patchStrategicMerge:
+        spec:
+          (type): LoadBalancer
+          allocateLoadBalancerNodePorts: false
+          loadBalancerClass: ngrok
+
 ```
 
 ## Example

{nyl-0.5.1 → nyl-0.7.0}/flake.nix

@@ -108,6 +108,6 @@
         '';
 
         devShells.default =
-          pkgs.mkShell { buildInputs = [ uvProject.venv.dev ]; };
+          pkgs.mkShell { buildInputs = [ uvProject.venv.dev ] ++ dependencies; };
       });
 }

{nyl-0.5.1 → nyl-0.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "nyl"
-version = "0.5.1"  # sed'ed on publish in CI
+version = "0.7.0"
 description = "Advanced templating engine for Kubernetes and GitOps."
 authors = [
     {name = "Niklas Rosenstein", email = "rosensteinniklas@gmail.com"},
@@ -40,3 +40,22 @@ dev-dependencies = [
     "types-pyyaml>=6.0.12.20240311",
     "types-requests>=2.32.0.20240712",
 ]
+
+[tool.mypy]
+explicit_package_bases = true
+namespace_packages = true
+show_column_numbers = true
+strict = true
+mypy_path = ["src"]
+
+[tool.ruff]
+line-length = 120
+
+[tool.slap.test]
+pytest = "uv run pytest ."
+mypy = "uv run mypy ."
+ruff-check = "uv run ruff check ."
+ruff-fmt = "uv run ruff format --check ."
+
+[tool.slap.run]
+fmt = "uv run ruff format . && uv run ruff check --fix ."

nyl-0.7.0/renovate.json

@@ -0,0 +1,34 @@
+{
+    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+    "extends": [
+        "config:recommended"
+    ],
+    "rebaseWhen": "conflicted",
+    "packageRules": [
+        {
+            "groupName": "minor and patch updates",
+            "matchUpdateTypes": [
+                "minor",
+                "patch",
+                "pin",
+                "digest"
+            ],
+            "matchPackageNames": [
+                "*"
+            ]
+        }
+    ],
+    "customManagers": [
+        {
+            "customType": "regex",
+            "description": "Update _VERSION variables in Dockerfiles",
+            "fileMatch": [
+                "(^|/|\\.)Dockerfile$",
+                "(^|/)Dockerfile\\.[^/]*$"
+            ],
+            "matchStrings": [
+                "# renovate: datasource=(?<datasource>[a-z-]+?)(?: depName=(?<depName>.+?))? packageName=(?<packageName>.+?)(?: versioning=(?<versioning>[a-z-]+?))?\\s(?:ENV|ARG) .+?_VERSION=(?<currentValue>.+?)\\s"
+            ]
+        }
+    ]
+}

{nyl-0.5.1 → nyl-0.7.0}/src/nyl/commands/__init__.py

@@ -79,7 +79,7 @@ def _callback(
     logger.add(sys.stderr, level=LogLevel.ERROR.name if quiet else log_level.name, format=fmt)
     if log_file:
         logger.add(log_file, level=log_level.name, format=fmt)
-    logger.opt(ansi=True).debug("Nyl v{} run from <yellow>{}</>.", __version__, Path.cwd())
+    logger.opt(colors=True).debug("Nyl v{} run from <yellow>{}</>.", __version__, Path.cwd())
 
     # Log some helpful information for debugging purposes.
     logger.debug("Used command-line arguments: {}", lazy_str(pretty_cmd, sys.argv))

{nyl-0.5.1 → nyl-0.7.0}/src/nyl/commands/new.py

@@ -52,7 +52,11 @@ def chart(dir: Path) -> None:
         dir,
         "values.yaml",
         """
-        image: my/image:tag
+        image:
+          repository: my/image
+          tag: 1.0.0
+          pullPolicy: IfNotPresent
+          pullSecret: ""
         """,
     )
 
@@ -82,20 +86,25 @@ def chart(dir: Path) -> None:
         apiVersion: apps/v1
         kind: Deployment
         metadata:
-            name: {{ .Release.Name }}
+          name: {{ .Release.Name }}
         spec:
-            replicas: 1
-            selector:
+          replicas: 1
+          selector:
             matchLabels:
-                app: {{ .Release.Name }}
-            template:
+              app.kubernetes.io/name: {{ .Release.Name }}
+          template:
             metadata:
-                labels:
-                app: {{ .Release.Name }}
+              labels:
+                app.kubernetes.io/name: {{ .Release.Name }}
             spec:
-                containers:
-                - name: {{ .Release.Name }}
-                image: {{ .Values.image }}
+              {{- if .Values.image.pullSecret }}
+              imagePullSecrets:
+              - name: {{ .Values.image.pullSecret }}
+              {{- end }}
+              containers:
+              - name: {{ .Release.Name }}
+                image: {{ .Values.image.repository }}:{{ .Values.image.tag }}
+                imagePullPolicy: {{ .Values.image.pullPolicy }}
         """,
     )