Merge branch 'main' into main

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM docker.io/rust:1.63.0-bullseye
+FROM docker.io/rust:1.64.0-bullseye
 
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt update && apt upgrade -y

.github/codecov.yml

@@ -1,6 +1,11 @@
 comment:
   require_changes: no
   layout: "diff,files"
+coverage:
+  status:
+    project:
+      project: off
+      patch: off
 
 #flags:
 #  kube:

.github/workflows/ci.yml

@@ -27,33 +27,45 @@ jobs:
       - uses: Swatinem/rust-cache@v2
 
       # Install OpenSSL Libraries for Windows
-      - name: install openssl
+      # - name: install openssl
+      #   if: matrix.os == 'windows-latest'
+      #   run: |
+      #     $ErrorActionPreference = "Stop"
+      #     choco install --verbose openssl
+      #     openssl version
+      #     refreshenv
+      #     echo "OPENSSL_LIB_DIR=C:/Program Files/OpenSSL-Win64/lib" >> $env:GITHUB_ENV
+      #     echo "OPENSSL_DIR=C:/Program Files/OpenSSL-Win64/" >> $env:GITHUB_ENV
+      #     echo "OPENSSL_INCLUDE_DIR=C:/Program Files/OpenSSL-Win64/include" >> $env:GITHUB_ENV
+      # Only test Rustls on Windows instead due to #1191
+      - name: "Interim Hacky Windows Test for #1191"
         if: matrix.os == 'windows-latest'
         run: |
-          $ErrorActionPreference = "Stop"
-          choco install --verbose openssl
-          openssl version
-          refreshenv
-          echo "OPENSSL_LIB_DIR=C:/Program Files/OpenSSL-Win64/lib" >> $env:GITHUB_ENV
-          echo "OPENSSL_DIR=C:/Program Files/OpenSSL-Win64/" >> $env:GITHUB_ENV
-          echo "OPENSSL_INCLUDE_DIR=C:/Program Files/OpenSSL-Win64/include" >> $env:GITHUB_ENV
+          sed -i '0,/openssl/s//rustls/' kube/Cargo.toml
+          cat kube/Cargo.toml
+          cargo build
+          cargo test --workspace --lib --exclude kube-examples --exclude e2e -j6
+
 
       # Real CI work starts here
       - name: Build workspace
+        if: matrix.os != 'windows-latest'
         run: cargo build
 
       # Workspace unit tests with various feature sets
       - name: Run workspace unit tests (no default features)
         run: cargo test --workspace --lib --no-default-features -j6
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-latest' # only linux tests all feature combinations
       - name: Run workspace unit tests (default features)
         run: cargo test --workspace --lib --exclude kube-examples --exclude e2e -j6
         if: matrix.os == 'ubuntu-latest'
       - name: Run workspace unit tests (all features)
+        if: matrix.os != 'windows-latest'
         run: cargo test --workspace --lib --all-features --exclude kube-examples --exclude e2e -j6
       # Workspace documentation (all features only)
       - name: Run workspace doc tests
         run: cargo test --workspace --doc --all-features --exclude kube-examples --exclude e2e -j6
+        if: matrix.os == 'ubuntu-latest'
       - name: Run ad-hoc doc test verification
         run: |
           if rg "\`\`\`ignored"; then
@@ -63,6 +75,7 @@ jobs:
         if: matrix.os == 'ubuntu-latest'
       # Examples
       - name: Test examples
+        if: matrix.os != 'windows-latest'
         run: cargo test -p kube-examples --examples -j6
 
   msrv:

.github/workflows/clippy.yml

@@ -1,6 +1,11 @@
 name: clippy
 on:
   pull_request:
+    paths:
+      - '**.rs'
+      - '**.toml'
+      - '**.yml'
+
 jobs:
   clippy_nightly:
     runs-on: ubuntu-latest

.github/workflows/coverage.yml

@@ -5,6 +5,10 @@ on:
     branches:
       - main
   pull_request:
+    paths:
+      - '**.rs'
+      - '**.toml'
+      - '**.yml'
 
 jobs:
   tarpaulin-codecov:

.github/workflows/lint.yml

@@ -1,6 +1,10 @@
 name: lint
 on:
   pull_request:
+    paths:
+      - '**.rs'
+      - '**.toml'
+      - '**.yml'
 
 jobs:
   cargo-deny:

.github/workflows/rustfmt.yml

@@ -5,6 +5,10 @@ on:
     # Limit to `main` because this action creates a PR
     branches:
       - main
+    paths:
+      - '**.rs'
+      - '**.yml'
+
 jobs:
   rustfmt_nightly:
     runs-on: ubuntu-latest

CHANGELOG.md

@@ -5,7 +5,50 @@
 <!-- next-header -->
 UNRELEASED
 ===================
- * see https://github.com/kube-rs/kube/compare/0.82.2...main
+ * see https://github.com/kube-rs/kube/compare/0.84.0...main
+
+[0.84.0](https://github.com/kube-rs/kube/releases/tag/0.84.0) / 2023-07-14
+===================
+<!-- Release notes generated using configuration in .github/release.yml at 0.84.0 -->
+
+## Highlights
+### Stream Improvements
+On the `runtime` side, the `Controller` now delays reconciles until the main `Store` is ready (via a [new `Store` helper](https://docs.rs/kube/0.84.0/kube/runtime/reflector/struct.Store.html#method.wait_until_ready) from #1243). The stream selection for owned resources is more efficient (#1240), and the underlying `watcher` streams now all paginate (#1249). There are also many new  [`WatchStreamExt`](https://docs.rs/kube/0.84.0/kube/runtime/trait.WatchStreamExt.html) helpers ( #1246 + #1228 + #1232) as a continued work towards the more customisable streams-api (#1080).
+
+On the client-side; streaming logs are now easier to deal with as an `AsyncBufRead` #1235.
+
+### OIDC Refresh
+Optional OIDC refreshable token support was introduced in #1229 under `kube/oidc` for out-of-cluster `Client` configuration. Previously, refresh support was limited to non-OIDC tokens from the `GcpOuth` provider (`kube/oauth`) or through arbitrary `exec` calls / `TokenFile` loading.
+
+## What's Changed
+### Added
+* Add `Predicate` trait to allow combination + fallbacks by @clux in https://github.com/kube-rs/kube/pull/1228
+* Added refreshing OIDC ID token as an optional feature by @Razz4780 in https://github.com/kube-rs/kube/pull/1229
+* Add `WatchStreamExt::default_backoff` shorthand by @clux in https://github.com/kube-rs/kube/pull/1232
+* Derive `PartialEq` on `core` params structs by @danrspencer in https://github.com/kube-rs/kube/pull/1237
+* Track store readiness by @nightkr in https://github.com/kube-rs/kube/pull/1243
+* Add `WatchStreamExt::modify()` to modify events by @aryan9600 in https://github.com/kube-rs/kube/pull/1246
+* Add default pagination to `watcher` by @clux in https://github.com/kube-rs/kube/pull/1249
+### Changed
+* Bump MSRV from 1.63 to 1.64 by @clux in https://github.com/kube-rs/kube/pull/1233
+* Change `Api::log_stream` to return `AsyncBufRead` by @aryan9600 in https://github.com/kube-rs/kube/pull/1235
+### Fixed
+* Make `Controller::owns` use `metadata_watcher` internally by @clux in https://github.com/kube-rs/kube/pull/1240
+
+[0.83.0](https://github.com/kube-rs/kube/releases/tag/0.83.0) / 2023-06-05
+===================
+<!-- Release notes generated using configuration in .github/release.yml at 0.83.0 -->
+
+## What's Changed
+### Added
+* Add `Controller::reconcile_on` by @co42 in https://github.com/kube-rs/kube/pull/1163
+* Add `predicates::resource_version` by @clux in https://github.com/kube-rs/kube/pull/1221
+* add `Duration` to `kube-core` by @hawkw in https://github.com/kube-rs/kube/pull/1224
+### Changed
+* Introduce `GetParams` support by @mateiidavid in https://github.com/kube-rs/kube/pull/1214
+### Fixed
+* Swap `validator` for `garde` by @mateiidavid in https://github.com/kube-rs/kube/pull/1212
+* fix: `#[kube(crates(serde = "some_crate::serde"))]` was not working by @chubei in https://github.com/kube-rs/kube/pull/1215
 
 [0.82.2](https://github.com/kube-rs/kube/releases/tag/0.82.2) / 2023-04-19
 ===================

README.md

@@ -1,7 +1,7 @@
 # kube-rs
 
 [![Crates.io](https://img.shields.io/crates/v/kube.svg)](https://crates.io/crates/kube)
-[![Rust 1.63](https://img.shields.io/badge/MSRV-1.63-dea584.svg)](https://github.com/rust-lang/rust/releases/tag/1.63.0)
+[![Rust 1.64](https://img.shields.io/badge/MSRV-1.64-dea584.svg)](https://github.com/rust-lang/rust/releases/tag/1.64.0)
 [![Tested against Kubernetes v1_21 and above](https://img.shields.io/badge/MK8SV-v1_21-326ce5.svg)](https://kube.rs/kubernetes-version)
 [![Best Practices](https://bestpractices.coreinfrastructure.org/projects/5413/badge)](https://bestpractices.coreinfrastructure.org/projects/5413)
 [![Discord chat](https://img.shields.io/discord/500028886025895936.svg?logo=discord&style=plastic)](https://discord.gg/tokio)
@@ -16,7 +16,7 @@ Select a version of `kube` along with the generated [k8s-openapi](https://github
 
 ```toml
 [dependencies]
-kube = { version = "0.82.2", features = ["runtime", "derive"] }
+kube = { version = "0.84.0", features = ["runtime", "derive"] }
 k8s-openapi = { version = "0.18.0", features = ["v1_26"] }
 ```
 
@@ -152,7 +152,7 @@ By default `openssl` is used for TLS, but [rustls](https://github.com/ctz/rustls
 
 ```toml
 [dependencies]
-kube = { version = "0.82.2", default-features = false, features = ["client", "rustls-tls"] }
+kube = { version = "0.84.0", default-features = false, features = ["client", "rustls-tls"] }
 k8s-openapi = { version = "0.18.0", features = ["v1_26"] }
 ```
 

deny.toml

@@ -108,6 +108,19 @@ name = "syn"
 # https://github.com/jcreekmore/pem-rs/blob/master/Cargo.toml#L16
 name = "base64"
 
+[[bans.skip]]
+# used by h2->hyper->hyper-openssl (we have latest)
+# newer used by serde_json
+name = "indexmap"
+[[bans.skip]]
+# via indexmap - have to also skip this
+name = "hashbrown"
+
+[[bans.skip]]
+# latest via openssl->hyper-openssl (we have latest)
+# newer via tower-http (we have latest)
+name = "bitflags"
+
 [[bans.skip]]
 # deep in dependency tree, only dual use via dev dependency
 name = "redox_syscall"

e2e/Cargo.toml

@@ -28,7 +28,7 @@ anyhow = "1.0.44"
 tracing = "0.1.36"
 tracing-subscriber = "0.3.3"
 futures = "0.3.17"
-kube = { path = "../kube", version = "^0.82.2", default-features = false, features = ["client", "runtime", "ws", "admission", "gzip"] }
+kube = { path = "../kube", version = "^0.84.0", default-features = false, features = ["client", "runtime", "ws", "admission", "gzip"] }
 k8s-openapi = { version = "0.18.0", default-features = false }
 serde_json = "1.0.68"
 tokio = { version = "1.14.0", features = ["full"] }

examples/Cargo.toml

@@ -14,23 +14,24 @@ license = "Apache-2.0"
 release = false
 
 [features]
-default = ["openssl-tls", "kubederive", "ws", "latest", "runtime"]
+default = ["openssl-tls", "kubederive", "ws", "latest", "runtime", "refresh"]
 kubederive = ["kube/derive"]
 openssl-tls = ["kube/client", "kube/openssl-tls"]
 rustls-tls = ["kube/client", "kube/rustls-tls"]
 runtime = ["kube/runtime", "kube/unstable-runtime"]
+refresh = ["kube/oauth", "kube/oidc"]
 ws = ["kube/ws"]
 latest = ["k8s-openapi/v1_26"]
 
 [dev-dependencies]
 tokio-util = "0.7.0"
 assert-json-diff = "2.0.1"
-validator = { version = "0.16.0", features = ["derive"] }
+garde = { version = "0.11.2", default-features = false, features = ["derive"] }
 anyhow = "1.0.44"
 futures = "0.3.17"
 jsonpath_lib = "0.3.0"
-kube = { path = "../kube", version = "^0.82.2", default-features = false, features = ["admission"] }
-kube-derive = { path = "../kube-derive", version = "^0.82.2", default-features = false } # only needed to opt out of schema
+kube = { path = "../kube", version = "^0.84.0", default-features = false, features = ["admission"] }
+kube-derive = { path = "../kube-derive", version = "^0.84.0", default-features = false } # only needed to opt out of schema
 k8s-openapi = { version = "0.18.0", default-features = false }
 serde = { version = "1.0.130", features = ["derive"] }
 serde_json = "1.0.68"

examples/crd_api.rs

@@ -1,12 +1,12 @@
 use anyhow::{bail, Result};
 use either::Either::{Left, Right};
+use garde::Validate;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use serde_json::json;
 use std::time::Duration;
 use tokio::time::sleep;
 use tracing::*;
-use validator::Validate;
 
 use k8s_openapi::apiextensions_apiserver::pkg::apis::apiextensions::v1::CustomResourceDefinition;
 use kube::{
@@ -22,9 +22,12 @@ use kube::{
 #[kube(scale = r#"{"specReplicasPath":".spec.replicas", "statusReplicasPath":".status.replicas"}"#)]
 #[kube(printcolumn = r#"{"name":"Team", "jsonPath": ".spec.metadata.team", "type": "string"}"#)]
 pub struct FooSpec {
-    #[validate(length(min = 3))]
+    #[schemars(length(min = 3))]
+    #[garde(length(min = 3))]
     name: String,
+    #[garde(skip)]
     info: String,
+    #[garde(skip)]
     replicas: i32,
 }
 
@@ -201,7 +204,7 @@ async fn main() -> Result<()> {
         replicas: 1,
     });
     // using derived Validate rules locally:
-    assert!(fx.spec.validate().is_err());
+    assert!(fx.spec.validate(&()).is_err());
     // check rejection from apiserver (validation rules embedded in JsonSchema)
     match foos.create(&pp, &fx).await {
         Err(kube::Error::Api(ae)) => {

examples/crd_reflector.rs

@@ -36,10 +36,15 @@ async fn main() -> anyhow::Result<()> {
     let (reader, writer) = reflector::store::<Foo>();
 
     let foos: Api<Foo> = Api::default_namespaced(client);
-    let wc = watcher::Config::default().timeout(20); // low timeout in this example
-    let rf = reflector(writer, watcher(foos, wc));
+    let wc = watcher::Config::default().any_semantic();
+    let mut stream = watcher(foos, wc)
+        .default_backoff()
+        .reflect(writer)
+        .applied_objects()
+        .boxed();
 
     tokio::spawn(async move {
+        reader.wait_until_ready().await.unwrap();
         loop {
             // Periodically read our state
             // while this runs you can kubectl apply -f crd-baz.yaml or crd-qux.yaml and see it works
@@ -48,8 +53,7 @@ async fn main() -> anyhow::Result<()> {
             info!("Current crds: {:?}", crds);
         }
     });
-    let mut rfa = rf.applied_objects().boxed();
-    while let Some(event) = rfa.try_next().await? {
+    while let Some(event) = stream.try_next().await? {
         info!("saw {}", event.name_any());
     }
     Ok(())

examples/kubectl.rs

@@ -163,14 +163,15 @@ impl App {
             std::fs::read_to_string(&pth).with_context(|| format!("Failed to read {}", pth.display()))?;
         for doc in multidoc_deserialize(&yaml)? {
             let obj: DynamicObject = serde_yaml::from_value(doc)?;
+            let namespace = obj.metadata.namespace.as_deref().or(self.namespace.as_deref());
             let gvk = if let Some(tm) = &obj.types {
                 GroupVersionKind::try_from(tm)?
             } else {
                 bail!("cannot apply object without valid TypeMeta {:?}", obj);
             };
             let name = obj.name_any();
             if let Some((ar, caps)) = discovery.resolve_gvk(&gvk) {
-                let api = dynamic_api(ar, caps, client.clone(), &self.namespace, false);
+                let api = dynamic_api(ar, caps, client.clone(), namespace, false);
                 trace!("Applying {}: \n{}", gvk.kind, serde_yaml::to_string(&obj)?);
                 let data: serde_json::Value = serde_json::to_value(&obj)?;
                 let _r = api.patch(&name, &ssapply, &Patch::Apply(data)).await?;
@@ -207,7 +208,7 @@ async fn main() -> Result<()> {
             wc = wc.labels(label);
         }
 
-        let api = dynamic_api(ar, caps, client, &app.namespace, app.all);
+        let api = dynamic_api(ar, caps, client, app.namespace.as_deref(), app.all);
 
         tracing::info!(?app.verb, ?resource, name = ?app.name.clone().unwrap_or_default(), "requested objects");
         match app.verb {
@@ -227,7 +228,7 @@ fn dynamic_api(
     ar: ApiResource,
     caps: ApiCapabilities,
     client: Client,
-    ns: &Option<String>,
+    ns: Option<&str>,
     all: bool,
 ) -> Api<DynamicObject> {
     if caps.scope == Scope::Cluster || all {

examples/log_stream.rs

@@ -1,5 +1,5 @@
 use anyhow::{anyhow, Result};
-use futures::{StreamExt, TryStreamExt};
+use futures::{AsyncBufReadExt, TryStreamExt};
 use k8s_openapi::api::core::v1::Pod;
 use kube::{
     api::{Api, LogParams},
@@ -26,10 +26,10 @@ async fn main() -> Result<()> {
             ..LogParams::default()
         })
         .await?
-        .boxed();
+        .lines();
 
     while let Some(line) = logs.try_next().await? {
-        info!("{:?}", String::from_utf8_lossy(&line));
+        info!("{}", line);
     }
     Ok(())
 }