Espejote: An in-cluster templating controller

triggers:
- name: interval (1)
  interval: 10s
- name: ext-configmaps
  watchResource:
    apiVersion: v1
    kind: ConfigMap
    labelSelector:
      matchExpressions:
      - key: espejote.io/created-by
        operator: DoesNotExist
    minTimeBetweenTriggers: 10s
- name: my-configmap
  watchResource:
    apiVersion: v1
    kind: ConfigMap
    name: my-configmap

local esp = import "espejote.libsonnet";

if esp.triggerName() == "ext-configmaps" then
  // Do some partial re-rendering
  local resource = esp.triggerData().resource;
else
  // Do a full re-render

context:
- def: configs
  resource:
    apiVersion: v1
    kind: ConfigMap
    labelSelector:
      matchExpressions:
      - key: espejote.io/created-by
        operator: DoesNotExist
  cache: true
- def: config
  resource:
    apiVersion: v1
    kind: ConfigMap
    name: my-configmap

local esp = import 'espejote.libsonnet';
local config = esp.context().config;

local esp = import 'espejote.libsonnet';
esp.markForDelete({
  apiVersion: 'v1',
  kind: 'ConfigMap',
  metadata: {
    namespace: 'my-namespace',
    name: 'my-configmap',
  }
})

spec:
  serviceAccountRef:
    name: my-service-account

webhookConfiguration:
  objectSelector:
    matchLabels:
      cluster-autoscaler: default
      k8s-app: cluster-autoscaler
  rules:
    - apiGroups:
        - ''
      apiVersions:
        - '*'
      operations:
        - CREATE
      resources:
        - pods

apiVersion: espejote.io/v1alpha1
kind: JsonnetLibrary
metadata:
  name: my-library
  namespace: controller-namespace
spec:
  data:
    my-function.libsonnet: |
      {
        myFunction: function() 42,
      }
    hello-world.libsonnet: |
      {
        helloWorld: function(name) 'Hello, %s!' % [name],
      }

apiVersion: espejote.io/v1alpha1
kind: ManagedResource
metadata:
  name: copy-configmap
  namespace: my-namespace (1)
spec:
  applyOptions: (2)
    forceConflicts: true
  triggers:
  - name: interval
    interval: 10s (3)
  - name: cm
    watchResource: (4)
      apiVersion: v1
      kind: ConfigMap
      # name: my-configmap (5)
      labelSelector: (6)
        matchExpressions:
        - key: espejote.io/created-by
          operator: DoesNotExist
      # matchNames: [] (7)
      # ignoreNames: [] (8)
      minTimeBetweenTriggers: 10s (9)
  context: (10)
  - name: cm (11)
    resource: (12)
      apiVersion: v1
      kind: ConfigMap
      # name: my-configmap
      # matchNames: []
      # ignoreNames: []
      labelSelector:
        matchExpressions:
        - key: espejote.io/created-by
          operator: DoesNotExist
      cache: true (13)
  template: |
    local esp = import 'espejote.libsonnet';
    local cm = esp.context().cm; (15)

    if esp.triggerName() == "cm" then {
      local triggerData = esp.triggerData().resource, (14)
      // Do some partial re-rendering
    } else [ (16)
      c {
        metadata: {
          name: 'copy-of-' + c.metadata.name,
          // namespace: c.metadata.namespace, (17)
          labels+: {
            'espejote.io/created-by': 'copy-configmap'
          }
        }
      },
      for c in cm.items (18)
    ]
  serviceAccountRef:
    name: my-service-account (19)

apiVersion: espejote.io/v1alpha1
kind: Admission
metadata:
  name: pods-inject-creator-annotation
  namespace: my-namespace
spec:
  mutating: true (1)
  template: |
    local esp = import 'espejote.libsonnet';
    local admission = esp.ALPHA.admission; (2)

    local user = admission.admissionRequest().userInfo.username; (3)
    local obj = admission.admissionRequest().object;

    if std.get(obj.metadata, 'annotations') == null then
      admission.patched('added user annotation', admission.assertPatch([ (4)
        admission.jsonPatchOp('add', '/metadata/annotations', { 'creator': user }),
      ]))
    else
      admission.patched('added user annotation', admission.assertPatch([
        admission.jsonPatchOp('add', '/metadata/annotations/creator', user),
      ]))
  webhookConfiguration: (5)
    rules:
      - apiGroups:
          - ''
        apiVersions:
          - '*'
        operations:
          - CREATE
        resources:
          - pods

source_namespace="openshift-console"
target_namespace="openshift-config"

# # Wait for the secret to be created before trying to get it.
# # TODO: --for=create is included with OCP 4.17
# kubectl -n "${source_namespace}" wait secret "${SECRET_NAME}" --for=create --timeout=30m
echo "Waiting for secret ${SECRET_NAME} to be created"
while test -z "$(kubectl -n "${source_namespace}" get secret "${SECRET_NAME}" --ignore-not-found -oname)" ; do
   printf "."
   sleep 1
done
printf "\n"

# When using -w flag kubectl returns the secret once on startup and then again when it changes.
kubectl -n "${source_namespace}" get secret "${SECRET_NAME}" -ojson -w | jq -c --unbuffered | while read -r secret ; do
   echo "Syncing secret: $(printf "%s" "$secret" | jq -r '.metadata.name')"

   kubectl -n "$target_namespace" apply --server-side -f <(printf "%s" "$secret" | jq '{"apiVersion": .apiVersion, "kind": .kind, "metadata": {"name": .metadata.name}, "type": .type, "data": .data}')
done

apiVersion: sync.appuio.ch/v1alpha1
kind: SyncConfig
[...]
spec:
  namespaceSelector:
    ignoreNames:
      - my-ignored-namespace
    labelSelector:
      matchExpressions:
        - key: network-policies.syn.tools/no-defaults
          operator: DoesNotExist
  syncItems:
    - apiVersion: networking.k8s.io/v1
[...]