Merge branch 'rundeck-plugins:master' into master

Author: haracejacob

.DS_Store

@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
         with:
           fetch-depth: 0
       - name: Get Fetch Tags
@@ -24,9 +24,9 @@ jobs:
         run: ./gradlew build
       - name: Get Release Version
         id: get_version
-        run: VERSION=$(./gradlew currentVersion -q -Prelease.quiet) && echo ::set-output name=VERSION::$VERSION
+        run: VERSION=$(./gradlew currentVersion -q -Prelease.quiet) && echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
       - name: Upload artifact zip
-        uses: actions/upload-artifact@v1.0.0
+        uses: actions/upload-artifact@v4.0.0
         with:
           # Artifact name
           name: kubernetes-${{ steps.get_version.outputs.VERSION }}

.github/workflows/gradle.yml

@@ -0,0 +1,15 @@
+name: Snyk Scan
+
+on:
+  push:
+    branches: [ main, master ]
+  pull_request:
+    branches: [ main, master ]
+  workflow_dispatch:
+
+jobs:
+  security:
+    uses: rundeck-plugins/.github/.github/workflows/snyk-scan-reusable.yml@main
+    secrets:
+      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
+      SNYK_ORG_ID: ${{ secrets.SNYK_ORG_ID }}

.github/workflows/snyk-scan.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        python-version: [ '2.x', '3.x' ]
+        python-version: [ '3.9', '3.10', '3.11', '3.12' ]
 
     steps:
     - uses: actions/checkout@v3
@@ -18,7 +18,6 @@ jobs:
       with:
         python-version: ${{ matrix.python-version }}
         architecture: x64
-        check-latest: true
     - name: Install dependencies
       run: |
         python -m pip install --upgrade pip

.github/workflows/tests.yml

@@ -23,3 +23,12 @@ gradle-app.setting
 
 # End of https://www.gitignore.io/api/java,gradle
 
+
+.DS_Store
+
+# Testing content
+.tox
+
+**/__pycache__
+
+/kubernetes_rundeck_plugin.egg-info/*

.gitignore

@@ -10,29 +10,119 @@ Use cases:
 
 ## Requirements
 
-These plugins require the python kubernetes SDK to be installed on the rundeck server.
-For example, you can install it using `pip install kubernetes`.
+### Python Dependencies
 
-The Python Kubernetes API client requires version 11 of the library. You can confirm it with `python -m pip list | grep kubernetes`.
+This plugin requires the following Python packages to be installed **on the server where Rundeck executes** (either your Rundeck server or your Runner nodes if using remote execution):
 
-Further information here: [https://github.com/kubernetes-client/python](https://github.com/kubernetes-client/python).
+- **kubernetes** >= 35.0.0 - The official Kubernetes Python client
+- **urllib3** >= 2.6.3 - HTTP client library
+- **pyyaml** - YAML parser and emitter
+- **packaging** >= 20.0 - Version comparison utilities
 
-### Authentication for Tectonic Environments.
-There is a pull request [work](https://github.com/kubernetes-client/python-base/pull/48) for the kubernetes python SDK to support authenticating with the kubernetes API using OIDC (which is used by tectonic).
+**Installation location:**
+- **Rundeck server**: If running jobs locally on the Rundeck server
+- **Runner nodes**: If using Rundeck Enterprise with remote execution
+- **Both**: If you have a mixed environment
 
-For now, you can install the kubernetes python SDK from this repo to have the OIDC support:
+You can install all dependencies using:
 
+```bash
+pip install -r requirements.txt
 ```
-git clone --recursive https://github.com/ltamaster/python
-cd python
-python setup.py install
 
+Or install the kubernetes client directly:
+
+```bash
+pip install 'kubernetes>=35.0.0'
+# or if pip3 is your command:
+pip3 install 'kubernetes>=35.0.0'
+```
+
+**Version 35.0.0+ is required** to address security vulnerabilities in transitive dependencies. This version removes the dependency on `google-auth`, which had a vulnerable `pyasn1` dependency (CVE-2026-23490).
+
+You can verify your installation with:
+
+```bash
+python -m pip list | grep kubernetes
 ```
 
+Further information: [https://github.com/kubernetes-client/python](https://github.com/kubernetes-client/python)
+
+### Python Version Support
+
+- **Python 3.9+** is required (urllib3 2.6.x requires Python 3.9+)
+- **Python 3.10+** is recommended for best performance and security
+
+### Kubernetes Cluster Compatibility
+
+This plugin requires the Kubernetes Python client library version **35.0.0 or newer**.
+
+The Kubernetes Python client is generally **backwards compatible** with older Kubernetes clusters. For the most accurate and up-to-date information about which Kubernetes API/server versions are supported by a given client version, refer to the upstream compatibility documentation:
+
+- [Kubernetes Python Client Compatibility](https://github.com/kubernetes-client/python#compatibility)
+
+In practice, upgrading the client library typically does not require upgrading your Kubernetes cluster, but you should verify compatibility against the upstream documentation and test in a non-production environment before making changes.
+
+### Upgrading from Previous Plugin Versions
+
+If you're upgrading from a previous version of this plugin (v2.0.16 or earlier), you **must** upgrade your Python dependencies to avoid security vulnerabilities.
+
+**Run this command on each server where Rundeck executes jobs:**
+
+```bash
+pip install --upgrade 'kubernetes>=35.0.0'
+# or if pip3 is your command:
+pip3 install --upgrade 'kubernetes>=35.0.0'
+```
+
+**Where to run this command:**
+- **Rundeck server**: If jobs run locally on your Rundeck server
+- **Each Runner node**: If using Rundeck Enterprise with remote execution
+- **Both**: If you have a mixed environment
+
+**Why the upgrade is required:**
+- Previous versions allowed any kubernetes client version, including older versions with security vulnerabilities
+- Version 35.0.0+ eliminates CVE-2026-23490 (High severity DoS vulnerability) by removing the vulnerable dependency chain
+- The upgrade is backwards compatible with your existing Kubernetes clusters
+
+**What won't break:**
+- Your existing Kubernetes cluster version (no cluster upgrade required)
+- Your existing plugin configurations
+- Your existing Rundeck jobs and workflows
+- Communication with older Kubernetes API versions (v1.25, v1.28, v1.30, etc.)
+
+**What happens if you don't upgrade:**
+- Jobs will continue to work (no immediate breakage)
+- A security warning will appear in job logs on every execution
+- Your installation remains vulnerable to CVE-2026-23490
+
+**What changes:**
+- The Python kubernetes client library must be upgraded on all execution nodes
+- Any custom scripts or automation that install dependencies will need to use the new version
+
 ## Build and Install
 
 Run `gradle build` to build the zip file. Then, copy the zip file to the `$RDECK_BASE\libext` folder.
 
+## Testing
+
+To run the tests specified in the `tox.ini` file, follow these steps:
+
+- Install Tox: Ensure you have Tox installed. You can install it using pip:
+   ```sh
+   pip install tox
+   ```
+- Run Tox: Execute Tox in the directory containing the `tox.ini` file. This will run the tests in all specified environments (Python 3.9, 3.10, 3.11, 3.12):
+   ```sh
+   tox
+   ```
+- Run Specific Environment: If you want to run tests for a specific Python version, you can specify the environment:
+   ```sh
+   tox -e py39   # For Python 3.9
+   tox -e py310  # For Python 3.10
+   tox -e py311  # For Python 3.11
+   tox -e py312  # For Python 3.12
+   ```
 
 ## Authentication
 
@@ -51,7 +141,7 @@ Otherwise, you can set the following parameters:
 This plugin allows getting the container pods from kubernetes as rundeck nodes.
 
 * **Default attributes**: List of key=value pairs, example: username=root
-* **Custom Mapping**: Custom mapping adding on the rundeck nodes, for example: ```nodename.selector=default:Name,hostname.selector=default:pod_id```
+* **Custom Mapping**: Custom mapping adding on the rundeck nodes, for example: ```nodename.selector=default:name,hostname.selector=default:pod_id```
 
 * **Tags**: List of tags. You can add static and custom tags, for example:
 ```tag.selector=default:image, tag.selector=default:status, kubernetes```

README.md

@@ -27,6 +27,43 @@
 if os.environ.get('RD_JOB_LOGLEVEL') == 'DEBUG':
     log.setLevel(logging.DEBUG)
 
+# Check kubernetes client version and warn if outdated
+try:
+    from packaging import version
+    from packaging.version import InvalidVersion
+except ImportError:
+    version = None
+    InvalidVersion = None
+
+if version is not None:
+    MIN_KUBERNETES_VERSION = "35.0.0"
+    try:
+        import kubernetes
+        current_version = kubernetes.__version__
+        try:
+            if version.parse(current_version) < version.parse(MIN_KUBERNETES_VERSION):
+                log.warning("=" * 80)
+                log.warning("SECURITY WARNING: Outdated Kubernetes Python client detected")
+                log.warning(f"Current version: {current_version}")
+                log.warning(f"Required version: {MIN_KUBERNETES_VERSION}+")
+                log.warning("")
+                log.warning("Your installation is vulnerable to CVE-2026-23490 (CVSS 7.5 HIGH)")
+                log.warning("")
+                log.warning("ACTION REQUIRED: Upgrade the kubernetes Python library on the")
+                log.warning("server where Rundeck is running (or on your Runner if using")
+                log.warning("remote execution):")
+                log.warning("")
+                log.warning(f"  pip install --upgrade 'kubernetes>={MIN_KUBERNETES_VERSION}'")
+                log.warning(f"  # or: pip3 install --upgrade 'kubernetes>={MIN_KUBERNETES_VERSION}'")
+                log.warning("")
+                log.warning("The plugin will continue to work, but you should upgrade to")
+                log.warning("eliminate the security vulnerability.")
+                log.warning("=" * 80)
+        except InvalidVersion:
+            pass
+    except (AttributeError, ImportError):
+        pass
+
 
 def connect():
     config_file = None
@@ -323,11 +360,12 @@ def parseJson(obj):
 
 
 def create_pod_template_spec(data):
-    ports = []
 
-    for port in data["ports"].split(','):
-        portDefinition = client.V1ContainerPort(container_port=int(port))
-        ports.append(portDefinition)
+    ports = []
+    if data["ports"]:
+        for port in data["ports"].split(','):
+            portDefinition = client.V1ContainerPort(container_port=int(port))
+            ports.append(portDefinition)
 
     envs = []
     if "environments" in data:

contents/common.py

@@ -106,11 +106,15 @@ def create_deployment_object(data):
         template.metadata = client.V1ObjectMeta(labels=labels)
 
     # Create the specification of deployment
-    spec = client.ExtensionsV1beta1DeploymentSpec(
+    spec = client.V1DeploymentSpec(
         replicas=int(data["replicas"]),
-        template=template)
+        template=template,
+        selector=client.V1LabelSelector(
+            match_labels={}  # This will match all pods
+        )
+    )
     # Instantiate the deployment object
-    deployment = client.ExtensionsV1beta1Deployment(
+    deployment = client.V1Deployment(
         api_version=data["api_version"],
         kind="Deployment",
         metadata=client.V1ObjectMeta(labels=labels,

contents/deployment-update.py

@@ -0,0 +1,41 @@
+#!/usr/bin/env python -u
+import logging
+import sys
+import os
+import common
+
+from kubernetes import client
+from kubernetes.client.rest import ApiException
+
+
+logging.basicConfig(stream=sys.stderr, level=logging.INFO,
+                    format='%(levelname)s: %(name)s: %(message)s')
+log = logging.getLogger('kubernetes-model-source')
+
+
+def main():
+
+    pod_name = os.environ.get('RD_CONFIG_NAME')
+    namespace = os.environ.get('RD_CONFIG_NAMESPACE')
+
+    if not pod_name:
+        [pod_name, namespace, container] = common.get_core_node_parameter_list()
+
+    common.connect()
+
+    try:
+        api = client.CoreV1Api()
+
+        api_response = api.read_namespaced_pod(
+            name=pod_name,
+            namespace=namespace)
+
+        print(common.parseJson(api_response.status))
+
+    except ApiException:
+        log.exception("Exception deleting deployment:")
+        sys.exit(1)
+
+
+if __name__ == '__main__':
+    main()

contents/pod-describe.py

@@ -137,8 +137,9 @@ def nodeCollectData(pod, container, defaults, taglist, mappingList, boEmoticon):
     data['terminated'] = terminated
 
     # Add labels as its own map of node attributes.
-    for key, value in pod.metadata.labels.items():
-        data['labels:' + key] = value
+    if pod.metadata.labels is not None:
+        for key, value in pod.metadata.labels.items():
+            data['labels:' + key] = value
 
     emoticon = ""
     if default_settings['default:status'] == "running":