feat: Cache docker builds

.cargo/config.toml

@@ -1,2 +0,0 @@
-[env]
-RUSTC_BOOTSTRAP = "1"

.gitea/workflows/build.yaml

@@ -9,8 +9,7 @@ on:
 
 jobs:
   build:
-    uses: dreaded_x/workflows/.gitea/workflows/rust-kubernetes.yaml@66ab50c3ac239dbdd1e42e6276ec2e65b6a79379
+    uses: infra/workflows/.gitea/workflows/docker.yaml@956337b9bd5e72a93d3a57513cd421e7554dd61d
     secrets: inherit
     with:
-      generate_crds: true
       webhook_url: ${{ secrets.WEBHOOK_URL }}

.pre-commit-config.yaml

@@ -2,7 +2,7 @@ fail_fast: true
 
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
@@ -14,7 +14,7 @@ repos:
       - id: check-merge-conflict
 
   - repo: https://github.com/crate-ci/typos
-    rev: v1.31.1
+    rev: typos-dict-v0.13.13
     hooks:
       - id: typos
         args: ["--force-exclude"]
@@ -72,6 +72,6 @@ repos:
         pass_filenames: false
 
   - repo: https://github.com/hadolint/hadolint
-    rev: v2.12.0
+    rev: v2.14.0
     hooks:
       - id: hadolint

Cargo.toml

@@ -8,35 +8,38 @@ default-run = "lldap-controller"
 members = ["queries"]
 
 [workspace.dependencies]
-cynic = "3.10.0"
+cynic = "3.12.0"
-insta = { version = "1.42.2", features = ["yaml"] }
+cynic-codegen = "3.12.0"
+insta = { version = "1.45.0", features = ["yaml"] }
 
 [dependencies]
 queries = { path = "./queries" }
 lldap_auth = { git = "https://github.com/lldap/lldap" }
+# Purposefully kept at 0.8.x for compatibility with lldap
 rand = { version = "0.8.5" }
-serde_json = "1.0.140"
+serde_json = "1.0.145"
 cynic = { workspace = true, features = ["http-reqwest"] }
-tokio = { version = "1.44.0", features = ["full"] }
+tokio = { version = "1.48.0", features = ["full"] }
-kube = { version = "0.99.0", features = ["derive", "runtime"] }
+kube = { version = "2.0.1", features = ["derive", "runtime"] }
-k8s-openapi = { version = "0.24.0", features = ["v1_31"] }
+k8s-openapi = { version = "0.26.1", features = ["v1_34"] }
-schemars = { version = "0.8.22", features = ["chrono"] }
+schemars = { version = "1.1.0", features = ["chrono04"] }
-serde = { version = "1.0.219", features = ["derive"] }
+serde = { version = "1.0.228", features = ["derive"] }
 serde_yaml = "0.9.34"
 futures = "0.3.31"
-tracing-subscriber = { version = "0.3.19", features = ["json", "env-filter"] }
+tracing-subscriber = { version = "0.3.22", features = ["json", "env-filter"] }
-tracing = "0.1.41"
+tracing = "0.1.44"
-thiserror = "2.0.12"
+thiserror = "2.0.17"
-chrono = "0.4.40"
+chrono = "0.4.42"
 passwords = "3.1.16"
-reqwest = { version = "0.12.14", default-features = false, features = [
+reqwest = { version = "0.12.26", default-features = false, features = [
   "json",
   "rustls-tls",
 ] }
 git-version = "0.3.9"
-color-eyre = "0.6.3"
+color-eyre = "0.6.5"
 dotenvy = "0.15.7"
 leon = "3.0.2"
+async-trait = "0.1.89"
 
 [dev-dependencies]
 insta = { workspace = true }

Dockerfile

@@ -1,7 +1,7 @@
-FROM rust:1.86 AS base
+FROM rust:1.92 AS base
 ENV CARGO_REGISTRIES_CRATES_IO_PROTOCOL=sparse
-RUN cargo install cargo-chef --locked --version 0.1.71 && \
+RUN cargo install cargo-chef --locked --version 0.1.73 && \
-    cargo install cargo-auditable --locked --version 0.6.6
+    cargo install cargo-auditable --locked --version 0.7.2
 WORKDIR /app
 
 FROM base AS planner
@@ -15,9 +15,11 @@ RUN cargo chef cook --release --recipe-path recipe.json
 COPY . .
 ARG RELEASE_VERSION
 ENV RELEASE_VERSION=${RELEASE_VERSION}
-RUN cargo auditable build --release
+RUN cargo auditable build --release && /app/target/release/crdgen > /crds.yaml
 
-FROM gcr.io/distroless/cc-debian12:nonroot AS runtime
+FROM scratch AS manifests
+COPY --from=builder /crds.yaml /
+
+FROM gcr.io/distroless/cc-debian13:nonroot AS runtime
 COPY --from=builder /app/target/release/lldap-controller /lldap-controller
-COPY --from=builder /app/target/release/crdgen /crdgen
 CMD ["/lldap-controller"]

docker-bake.hcl

@@ -0,0 +1,38 @@
+variable "TAG_BASE" {}
+variable "RELEASE_VERSION" {}
+
+group "default" {
+  targets = ["lldap-controller", "manifests"]
+}
+
+target "docker-metadata-action" {}
+target "cache" {
+  cache-from = [
+    {
+      type = "gha",
+    }
+  ]
+
+  cache-to = [
+    {
+      type = "gha",
+      mode = "max"
+    }
+  ]
+}
+
+target "lldap-controller" {
+  inherits = ["docker-metadata-action", "cache"]
+  context = "./"
+  dockerfile = "Dockerfile"
+  tags = [for tag in target.docker-metadata-action.tags : "${TAG_BASE}:${tag}"]
+  target = "runtime"
+}
+
+target "manifests" {
+  inherits = ["cache"]
+  context = "./"
+  dockerfile = "Dockerfile"
+  target = "manifests"
+  output = [{ type = "cacheonly" }, "manifests"]
+}

manifests/cluster-role-binding.yaml

@@ -2,9 +2,11 @@ kind: ClusterRoleBinding
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: lldap-controller
+  namespace: lldap
 subjects:
   - kind: ServiceAccount
     name: lldap-controller
+    namespace: lldap
 roleRef:
   kind: ClusterRole
   name: lldap-controller

manifests/cluster-role.yaml

@@ -2,6 +2,7 @@ kind: ClusterRole
 apiVersion: rbac.authorization.k8s.io/v1
 metadata:
   name: lldap-controller
+  namespace: lldap
 rules:
   - apiGroups:
       - lldap.huizinga.dev

manifests/deployment.yaml

@@ -2,6 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: lldap-controller
+  namespace: lldap
   labels:
     app: lldap-controller
     app.kubernetes.io/name: lldap-controller
@@ -18,12 +19,17 @@ spec:
         kubectl.kubernetes.io/default-container: lldap-controller
     spec:
       serviceAccountName: lldap-controller
-      securityContext: {}
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
       containers:
         - name: lldap-controller
-          image: git.huizinga.dev/dreaded_x/lldap-controller@${DIGEST}
+          image: '{{ index .images "lldap-controller" }}'
           imagePullPolicy: IfNotPresent
-          securityContext: {}
           resources:
             limits:
               cpu: 200m
@@ -43,10 +49,16 @@ spec:
             - name: LLDAP_USERNAME
               value: admin
             - name: LLDAP_PASSWORD_FILE
-              value: /secrets/credentials/lldap-ldap-user-pass
+              value: /secrets/credentials/admin-pass
             - name: LLDAP_BIND_DN
               value: uid={username},ou=people,dc=huizinga,dc=dev
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL
       volumes:
         - name: credentials
           secret:
-            secretName: lldap-credentials
+            secretName: credentials

manifests/kustomization.yaml

@@ -1,9 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: lldap
 resources:
-  - ./crds.yaml
+  - namespace.yaml
-  - ./service-account.yaml
+  - crds.yaml
-  - ./cluster-role.yaml
+  - service-account.yaml
-  - ./cluster-role-binding.yaml
+  - cluster-role.yaml
-  - ./deployment.yaml
+  - cluster-role-binding.yaml
+  - deployment.yaml

manifests/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: lldap

manifests/service-account.yaml

@@ -2,6 +2,7 @@ apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: lldap-controller
+  namespace: lldap
   labels:
     app: lldap-controller
     app.kubernetes.io/name: lldap-controller

queries/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "queries"
 version = "0.1.0"
-edition = "2021"
+edition = "2024"
 
 [dependencies]
 cynic = { workspace = true }
@@ -10,4 +10,4 @@ cynic = { workspace = true }
 insta = { workspace = true }
 
 [build-dependencies]
-cynic-codegen = "3.10.0"
+cynic-codegen = { workspace = true }

rust-toolchain.toml

@@ -1,4 +1,4 @@
 [toolchain]
-channel = "1.86"
+channel = "1.92"
 profile = "default"
 components = ["rust-analyzer"]

src/lib.rs

@@ -1,4 +1,3 @@
-#![feature(let_chains)]
 pub mod context;
 pub mod lldap;
 pub mod resources;

src/lldap.rs

@@ -37,11 +37,11 @@ pub enum Error {
 pub type Result<T, E = Error> = std::result::Result<T, E>;
 
 fn check_graphql_errors<T>(response: GraphQlResponse<T>) -> Result<T> {
-    if let Some(errors) = &response.errors {
+    if let Some(errors) = &response.errors
-        if !errors.is_empty() {
+        && !errors.is_empty()
+    {
         Err(errors.first().expect("Should not be empty").clone())?;
     }
-    }
 
     Ok(response
         .data

src/resources/group.rs

@@ -1,6 +1,7 @@
 use std::sync::Arc;
 use std::time::Duration;
 
+use async_trait::async_trait;
 use kube::CustomResource;
 use kube::runtime::controller::Action;
 use schemars::JsonSchema;
@@ -19,6 +20,7 @@ use crate::context::{Context, ControllerEvents};
 #[serde(rename_all = "camelCase")]
 pub struct GroupSpec {}
 
+#[async_trait]
 impl Reconcile for Group {
     async fn reconcile(self: Arc<Self>, ctx: Arc<Context>) -> Result<Action> {
         let name = self

src/resources/mod.rs

@@ -5,6 +5,7 @@ mod user_attribute;
 use core::fmt;
 use std::sync::Arc;
 
+use async_trait::async_trait;
 use k8s_openapi::{ClusterResourceScope, NamespaceResourceScope};
 use kube::runtime::controller::Action;
 use kube::runtime::finalizer;
@@ -43,7 +44,8 @@ impl From<finalizer::Error<Self>> for Error {
 
 type Result<T, E = Error> = std::result::Result<T, E>;
 
-trait Reconcile {
+#[async_trait]
+pub trait Reconcile {
     async fn reconcile(self: Arc<Self>, ctx: Arc<Context>) -> Result<Action>;
 
     async fn cleanup(self: Arc<Self>, ctx: Arc<Context>) -> Result<Action>;

src/resources/service_user.rs

@@ -3,6 +3,7 @@ use std::str::from_utf8;
 use std::sync::Arc;
 use std::time::Duration;
 
+use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use k8s_openapi::api::core::v1::Secret;
 use k8s_openapi::apimachinery::pkg::apis::meta::v1::OwnerReference;
@@ -76,6 +77,7 @@ fn format_username(name: &str, namespace: &str) -> String {
     format!("{name}.{namespace}")
 }
 
+#[async_trait]
 impl Reconcile for ServiceUser {
     async fn reconcile(self: Arc<Self>, ctx: Arc<Context>) -> Result<Action> {
         let name = self

src/resources/user_attribute.rs

@@ -1,8 +1,9 @@
 use std::time::Duration;
 
+use async_trait::async_trait;
 use kube::api::{Patch, PatchParams};
 use kube::runtime::controller::Action;
-use kube::{Api, CELSchema, CustomResource};
+use kube::{Api, CustomResource, KubeSchema};
 use queries::AttributeType;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
@@ -33,7 +34,7 @@ impl From<Type> for AttributeType {
     }
 }
 
-#[derive(CustomResource, Deserialize, Serialize, Clone, Debug, CELSchema)]
+#[derive(CustomResource, Deserialize, Serialize, Clone, Debug, KubeSchema)]
 #[kube(
     kind = "UserAttribute",
     group = "lldap.huizinga.dev",
@@ -51,11 +52,11 @@ impl From<Type> for AttributeType {
     printcolumn = r#"{"name":"Age", "type":"date", "jsonPath":".metadata.creationTimestamp"}"#
 )]
 #[kube(
-    rule = Rule::new("self.spec == oldSelf.spec").message("User attributes are immutable"),
+    validation = Rule::new("self.spec == oldSelf.spec").message("User attributes are immutable"),
-    rule = Rule::new("!self.spec.userEditable || self.spec.userVisible && self.spec.userEditable").message("Editable attribute must also be visible")
+    validation = Rule::new("!self.spec.userEditable || self.spec.userVisible && self.spec.userEditable").message("Editable attribute must also be visible")
 )]
 #[serde(rename_all = "camelCase")]
-pub struct UesrAttributeSpec {
+pub struct UserAttributeSpec {
     r#type: Type,
     #[serde(default)]
     list: bool,
@@ -70,6 +71,7 @@ pub struct UserAttributesStatus {
     pub synced: bool,
 }
 
+#[async_trait]
 impl Reconcile for UserAttribute {
     async fn reconcile(
         self: std::sync::Arc<Self>,