squarepeg 0.4.0__tar.gz → 0.4.1__tar.gz

{squarepeg-0.4.0 → squarepeg-0.4.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: squarepeg
-Version: 0.4.0
+Version: 0.4.1
 Summary: Run a docker-run-style command as a Kubernetes Pod or Job, streaming its output like a local process
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -49,6 +49,9 @@ Full documentation lives in the [wiki](https://github.com/BioWilko/squarepeg/wik
 - [Troubleshooting](https://github.com/BioWilko/squarepeg/wiki/Troubleshooting)
 - [Development](https://github.com/BioWilko/squarepeg/wiki/Development)
 
+> **MicroK8s on Python 3.13+:** if connecting fails with `CA cert does not include key usage extension`,
+> set `lenient_tls: true` in your config — see [Troubleshooting](https://github.com/BioWilko/squarepeg/wiki/Troubleshooting#runner-errors-exit-code-125).
+
 See also [`examples/config.yaml`](examples/config.yaml) for a fully worked
 config file.
 

{squarepeg-0.4.0 → squarepeg-0.4.1}/README.md

@@ -35,6 +35,9 @@ Full documentation lives in the [wiki](https://github.com/BioWilko/squarepeg/wik
 - [Troubleshooting](https://github.com/BioWilko/squarepeg/wiki/Troubleshooting)
 - [Development](https://github.com/BioWilko/squarepeg/wiki/Development)
 
+> **MicroK8s on Python 3.13+:** if connecting fails with `CA cert does not include key usage extension`,
+> set `lenient_tls: true` in your config — see [Troubleshooting](https://github.com/BioWilko/squarepeg/wiki/Troubleshooting#runner-errors-exit-code-125).
+
 See also [`examples/config.yaml`](examples/config.yaml) for a fully worked
 config file.
 

{squarepeg-0.4.0 → squarepeg-0.4.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "squarepeg"
-version = "0.4.0"
+version = "0.4.1"
 description = "Run a docker-run-style command as a Kubernetes Pod or Job, streaming its output like a local process"
 readme = "README.md"
 requires-python = ">=3.11"

{squarepeg-0.4.0 → squarepeg-0.4.1}/squarepeg/cli.py

@@ -354,6 +354,7 @@ def run(
         else coerce_int(resolved_config.get("timeout", 300), "timeout")
     )
     quiet = quiet or coerce_bool(resolved_config.get("quiet", False), "quiet")
+    lenient_tls = coerce_bool(resolved_config.get("lenient_tls", False), "lenient_tls")
     cleanup = (
         False if keep else coerce_bool(resolved_config.get("cleanup", True), "cleanup")
     )
@@ -435,7 +436,7 @@ def run(
         ui.set_run_tag(effective_run_id)
 
     if dry_run_server:
-        session = Session(namespace=spec.namespace, context=context, quiet=spec.quiet)
+        session = Session(namespace=spec.namespace, context=context, quiet=spec.quiet, lenient_tls=lenient_tls)
         spec.namespace = session.namespace
         validated = server_dry_run(session, spec, manifest)
         click.echo(yaml.safe_dump(validated, sort_keys=False), nl=False)
@@ -444,7 +445,7 @@ def run(
         click.echo(yaml.safe_dump(manifest, sort_keys=False), nl=False)
         return
 
-    session = Session(namespace=spec.namespace, context=context, quiet=spec.quiet)
+    session = Session(namespace=spec.namespace, context=context, quiet=spec.quiet, lenient_tls=lenient_tls)
     spec.namespace = session.namespace
     exit_code = run_manifest(session, spec, manifest)
     raise SystemExit(exit_code)
@@ -510,6 +511,7 @@ def clean(dry_run, min_age, namespace, context, quiet, no_color, config_paths, n
     if namespace is None:
         namespace = resolved_config.get("namespace")
     quiet = quiet or coerce_bool(resolved_config.get("quiet", False), "quiet")
+    lenient_tls = coerce_bool(resolved_config.get("lenient_tls", False), "lenient_tls")
 
     if min_age is None:
         min_age = coerce_int(
@@ -520,7 +522,7 @@ def clean(dry_run, min_age, namespace, context, quiet, no_color, config_paths, n
     elif min_age < 0:
         raise UsageError(f"--min-age must not be negative, got {min_age}")
 
-    session = Session(namespace=namespace, context=context, quiet=quiet)
+    session = Session(namespace=namespace, context=context, quiet=quiet, lenient_tls=lenient_tls)
 
     with ui.Status("scanning for orphaned resources", quiet=quiet):
         result = clean_orphans(session, min_age, quiet=quiet, dry_run=dry_run)

{squarepeg-0.4.0 → squarepeg-0.4.1}/squarepeg/config.py

@@ -31,6 +31,7 @@ ALLOWED_TOP_KEYS = {
     "timeout",
     "quiet",
     "allow_host_path_mounts",
+    "lenient_tls",
     "split_streams",
     "orphan_sweep",
     "orphan_sweep_min_age",

{squarepeg-0.4.0 → squarepeg-0.4.1}/squarepeg/k8s/session.py

@@ -1,8 +1,10 @@
+import ssl
 from pathlib import Path
 
 from kubernetes import client
 from kubernetes import config as kube_config
 from kubernetes.config.config_exception import ConfigException
+from urllib3.util.ssl_ import create_urllib3_context
 
 from squarepeg.errors import RunnerError
 from squarepeg.log import chatter
@@ -47,7 +49,13 @@ class Session:
     surface that failure, not be silently masked by an in-cluster fallback.
     """
 
-    def __init__(self, namespace: str | None = None, context: str | None = None, quiet: bool = False):
+    def __init__(
+        self,
+        namespace: str | None = None,
+        context: str | None = None,
+        quiet: bool = False,
+        lenient_tls: bool = False,
+    ):
         in_cluster = False
         try:
             kube_config.load_kube_config(context=context)
@@ -73,7 +81,19 @@ class Session:
 
         self.namespace = namespace or context_namespace or "default"
 
-        self.core = client.CoreV1Api()
-        self.batch = client.BatchV1Api()
+        api_client = None
+        if lenient_tls:
+            # short-term workaround for https://github.com/canonical/microk8s/issues/4864: microk8s's CA
+            # lacks the keyUsage extension, which Python 3.13+/urllib3 2.3+ reject via VERIFY_X509_STRICT.
+            # Only that flag is cleared -- CERT_REQUIRED, CA chain and hostname checks are all still
+            # enforced. The kubernetes client exposes no ssl_context option, so it's injected into the
+            # (lazily created) urllib3 connection pools' kwargs instead.
+            ssl_context = create_urllib3_context()
+            ssl_context.verify_flags &= ~ssl.VERIFY_X509_STRICT
+            api_client = client.ApiClient()
+            api_client.rest_client.pool_manager.connection_pool_kw["ssl_context"] = ssl_context
+
+        self.core = client.CoreV1Api(api_client)
+        self.batch = client.BatchV1Api(api_client)
 
         chatter(f"using context {self.context_name!r}, namespace {self.namespace!r}", quiet=quiet)

{squarepeg-0.4.0 → squarepeg-0.4.1}/squarepeg.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: squarepeg
-Version: 0.4.0
+Version: 0.4.1
 Summary: Run a docker-run-style command as a Kubernetes Pod or Job, streaming its output like a local process
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown
@@ -49,6 +49,9 @@ Full documentation lives in the [wiki](https://github.com/BioWilko/squarepeg/wik
 - [Troubleshooting](https://github.com/BioWilko/squarepeg/wiki/Troubleshooting)
 - [Development](https://github.com/BioWilko/squarepeg/wiki/Development)
 
+> **MicroK8s on Python 3.13+:** if connecting fails with `CA cert does not include key usage extension`,
+> set `lenient_tls: true` in your config — see [Troubleshooting](https://github.com/BioWilko/squarepeg/wiki/Troubleshooting#runner-errors-exit-code-125).
+
 See also [`examples/config.yaml`](examples/config.yaml) for a fully worked
 config file.
 

{squarepeg-0.4.0 → squarepeg-0.4.1}/tests/test_cli.py

@@ -26,10 +26,11 @@ class FakeSession:
     .core/.batch are plain MagicMocks returning empty lists by default, for 'clean' tests
     that need a listable (but otherwise inert) session."""
 
-    def __init__(self, namespace=None, context=None, quiet=False):
+    def __init__(self, namespace=None, context=None, quiet=False, lenient_tls=False):
         self.namespace = namespace or "default"
         self.context = context
         self.quiet = quiet
+        self.lenient_tls = lenient_tls
         self.context_name = context or "fake-context"
         self.core = MagicMock()
         self.batch = MagicMock()
@@ -318,11 +319,12 @@ def test_dry_run_server_constructs_session_with_context_and_quiet(monkeypatch):
     constructed = {}
 
     class RecordingFakeSession(FakeSession):
-        def __init__(self, namespace=None, context=None, quiet=False):
+        def __init__(self, namespace=None, context=None, quiet=False, lenient_tls=False):
             constructed["namespace"] = namespace
             constructed["context"] = context
             constructed["quiet"] = quiet
-            super().__init__(namespace=namespace, context=context, quiet=quiet)
+            constructed["lenient_tls"] = lenient_tls
+            super().__init__(namespace=namespace, context=context, quiet=quiet, lenient_tls=lenient_tls)
 
     monkeypatch.setattr(cli_module, "Session", RecordingFakeSession)
     monkeypatch.setattr(cli_module, "server_dry_run", lambda session, spec, manifest: manifest)
@@ -333,6 +335,27 @@ def test_dry_run_server_constructs_session_with_context_and_quiet(monkeypatch):
     assert result.exit_code == 0, result.output
     assert constructed["context"] == "my-context"
     assert constructed["quiet"] is True
+    assert constructed["lenient_tls"] is False
+
+
+def test_dry_run_server_lenient_tls_from_config(monkeypatch, tmp_path):
+    constructed = {}
+
+    class RecordingFakeSession(FakeSession):
+        def __init__(self, namespace=None, context=None, quiet=False, lenient_tls=False):
+            constructed["lenient_tls"] = lenient_tls
+            super().__init__(namespace=namespace, context=context, quiet=quiet, lenient_tls=lenient_tls)
+
+    monkeypatch.setattr(cli_module, "Session", RecordingFakeSession)
+    monkeypatch.setattr(cli_module, "server_dry_run", lambda session, spec, manifest: manifest)
+    config_file = tmp_path / "config.yaml"
+    config_file.write_text("lenient_tls: true\n")
+
+    result = CliRunner().invoke(
+        cli, ["run", "--no-default-config", "--config", str(config_file), "--dry-run-server", "alpine"]
+    )
+    assert result.exit_code == 0, result.output
+    assert constructed["lenient_tls"] is True
 
 
 def test_dry_run_server_apiserver_rejection_exits_125(monkeypatch):
@@ -354,7 +377,7 @@ def test_dry_run_server_apiserver_rejection_exits_125(monkeypatch):
 
 
 def test_dry_run_server_no_cluster_connection_exits_125(monkeypatch):
-    def raising_session(namespace=None, context=None, quiet=False):
+    def raising_session(namespace=None, context=None, quiet=False, lenient_tls=False):
         raise RunnerError("could not load a kubeconfig (...) and doesn't look like it's running in-cluster (...)")
 
     monkeypatch.setattr(cli_module, "Session", raising_session)
@@ -554,8 +577,8 @@ def _mock_clean_session(monkeypatch, pods=(), jobs=()):
     monkeypatch.setattr("squarepeg.k8s.orphans.current_created_by", lambda: CLEAN_CREATED_BY)
 
     class RecordingFakeSession(FakeSession):
-        def __init__(self, namespace=None, context=None, quiet=False):
-            super().__init__(namespace=namespace, context=context, quiet=quiet)
+        def __init__(self, namespace=None, context=None, quiet=False, lenient_tls=False):
+            super().__init__(namespace=namespace, context=context, quiet=quiet, lenient_tls=lenient_tls)
             self.core.list_namespaced_pod.return_value = SimpleNamespace(items=list(pods))
             self.batch.list_namespaced_job.return_value = SimpleNamespace(items=list(jobs))
 
@@ -597,8 +620,8 @@ def test_clean_partial_failure_exit_code(monkeypatch):
     monkeypatch.setattr("squarepeg.k8s.orphans.current_created_by", lambda: CLEAN_CREATED_BY)
 
     class FailingFakeSession(FakeSession):
-        def __init__(self, namespace=None, context=None, quiet=False):
-            super().__init__(namespace=namespace, context=context, quiet=quiet)
+        def __init__(self, namespace=None, context=None, quiet=False, lenient_tls=False):
+            super().__init__(namespace=namespace, context=context, quiet=quiet, lenient_tls=lenient_tls)
             self.core.list_namespaced_pod.return_value = SimpleNamespace(items=[_clean_pod("p1"), _clean_pod("p2")])
             self.core.delete_namespaced_pod.side_effect = [ApiException(status=500, reason="err"), None]
 
@@ -613,8 +636,8 @@ def test_clean_listing_failure_exits_125(monkeypatch):
     monkeypatch.setattr("squarepeg.k8s.orphans.current_created_by", lambda: CLEAN_CREATED_BY)
 
     class RaisingFakeSession(FakeSession):
-        def __init__(self, namespace=None, context=None, quiet=False):
-            super().__init__(namespace=namespace, context=context, quiet=quiet)
+        def __init__(self, namespace=None, context=None, quiet=False, lenient_tls=False):
+            super().__init__(namespace=namespace, context=context, quiet=quiet, lenient_tls=lenient_tls)
             self.core.list_namespaced_pod.side_effect = ApiException(status=403, reason="Forbidden")
 
     monkeypatch.setattr(cli_module, "Session", RaisingFakeSession)
@@ -628,10 +651,10 @@ def test_clean_namespace_and_context_forwarded_to_session(monkeypatch):
     monkeypatch.setattr("squarepeg.k8s.orphans.current_created_by", lambda: CLEAN_CREATED_BY)
 
     class RecordingFakeSession(FakeSession):
-        def __init__(self, namespace=None, context=None, quiet=False):
+        def __init__(self, namespace=None, context=None, quiet=False, lenient_tls=False):
             constructed["namespace"] = namespace
             constructed["context"] = context
-            super().__init__(namespace=namespace, context=context, quiet=quiet)
+            super().__init__(namespace=namespace, context=context, quiet=quiet, lenient_tls=lenient_tls)
 
     monkeypatch.setattr(cli_module, "Session", RecordingFakeSession)
     result = _separated_runner().invoke(

{squarepeg-0.4.0 → squarepeg-0.4.1}/tests/test_session.py

@@ -1,3 +1,4 @@
+import ssl
 from unittest.mock import MagicMock
 
 import pytest
@@ -119,3 +120,26 @@ def test_explicit_context_failure_does_not_fall_back_to_incluster(monkeypatch):
         session_module.Session(context="myctx", quiet=True)
 
     incluster.assert_not_called()
+
+
+def _pool_kw(api):
+    return api.api_client.rest_client.pool_manager.connection_pool_kw
+
+
+def test_default_session_injects_no_ssl_context(monkeypatch):
+    monkeypatch.setattr(session_module.kube_config, "load_kube_config", MagicMock())
+    monkeypatch.setattr(session_module.kube_config, "list_kube_config_contexts", MagicMock(return_value=_ctx()))
+    s = session_module.Session(quiet=True)
+    assert "ssl_context" not in _pool_kw(s.core)
+    assert "ssl_context" not in _pool_kw(s.batch)
+
+
+def test_lenient_tls_clears_only_x509_strict(monkeypatch):
+    monkeypatch.setattr(session_module.kube_config, "load_kube_config", MagicMock())
+    monkeypatch.setattr(session_module.kube_config, "list_kube_config_contexts", MagicMock(return_value=_ctx()))
+    s = session_module.Session(quiet=True, lenient_tls=True)
+    assert s.core.api_client is s.batch.api_client
+    ctx = _pool_kw(s.core)["ssl_context"]
+    assert not ctx.verify_flags & ssl.VERIFY_X509_STRICT
+    assert ctx.verify_mode == ssl.CERT_REQUIRED
+    assert ctx.check_hostname is True