mirror of https://github.com/fluxcd/flux2.git
Add a build kustomization feature
If implemented it will permit queriying the Kubernetes API to fetch the specified Flux Kustomization, then uses the specified path to build the overlay. Signed-off-by: Soule BA <soule@weave.works>pull/2167/head
Soule BA
3 years ago
parent
63e54f3575
commit
70fb87bc93
@ -0,0 +1,31 @@
|
||||
/*
|
||||
Copyright 2021 The Flux authors
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"github.com/spf13/cobra"
|
||||
)
|
||||
|
||||
var buildCmd = &cobra.Command{
|
||||
Use: "build",
|
||||
Short: "Build a flux resource",
|
||||
Long: "The build command is used to build flux resources.",
|
||||
}
|
||||
|
||||
func init() {
|
||||
rootCmd.AddCommand(buildCmd)
|
||||
}
|
||||
@ -0,0 +1,80 @@
|
||||
/*
|
||||
Copyright 2021 The Flux authors
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
|
||||
"github.com/fluxcd/flux2/internal/kustomization"
|
||||
kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
|
||||
)
|
||||
|
||||
var buildKsCmd = &cobra.Command{
|
||||
Use: "kustomization",
|
||||
Aliases: []string{"ks"},
|
||||
Short: "Build Kustomization",
|
||||
Long: `The build command queries the Kubernetes API and fetches the specified Flux Kustomization,
|
||||
then it uses the specified files or path to build the overlay to write the resulting multi-doc YAML to stdout.`,
|
||||
Example: `# Create a new overlay.
|
||||
flux build kustomization my-app --resources ./path/to/local/manifests`,
|
||||
ValidArgsFunction: resourceNamesCompletionFunc(kustomizev1.GroupVersion.WithKind(kustomizev1.KustomizationKind)),
|
||||
RunE: buildKsCmdRun,
|
||||
}
|
||||
|
||||
type buildKsFlags struct {
|
||||
resources string
|
||||
}
|
||||
|
||||
var buildKsArgs buildKsFlags
|
||||
|
||||
func init() {
|
||||
buildKsCmd.Flags().StringVar(&buildKsArgs.resources, "resources", "", "Name of a file containing a file to add to the kustomization file.)")
|
||||
buildCmd.AddCommand(buildKsCmd)
|
||||
}
|
||||
|
||||
func buildKsCmdRun(cmd *cobra.Command, args []string) error {
|
||||
if len(args) < 1 {
|
||||
return fmt.Errorf("%s name is required", kustomizationType.humanKind)
|
||||
}
|
||||
name := args[0]
|
||||
|
||||
if buildKsArgs.resources == "" {
|
||||
return fmt.Errorf("invalid resource path %q", buildKsArgs.resources)
|
||||
}
|
||||
|
||||
if fs, err := os.Stat(buildKsArgs.resources); err != nil || !fs.IsDir() {
|
||||
return fmt.Errorf("invalid resource path %q", buildKsArgs.resources)
|
||||
}
|
||||
|
||||
builder, err := kustomization.NewBuilder(rootArgs.kubeconfig, rootArgs.kubecontext, rootArgs.namespace, name, buildKsArgs.resources, kustomization.WithTimeout(rootArgs.timeout))
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
manifests, err := builder.Build()
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
cmd.Print(string(manifests))
|
||||
|
||||
return nil
|
||||
|
||||
}
|
||||
@ -0,0 +1,228 @@
|
||||
/*
|
||||
Copyright 2021 The Flux authors
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package kustomization
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"encoding/base64"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"time"
|
||||
|
||||
"github.com/fluxcd/flux2/internal/utils"
|
||||
kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/kustomize/api/konfig"
|
||||
"sigs.k8s.io/kustomize/api/resmap"
|
||||
"sigs.k8s.io/kustomize/api/resource"
|
||||
"sigs.k8s.io/kustomize/kyaml/filesys"
|
||||
)
|
||||
|
||||
const mask string = "**SOPS**"
|
||||
|
||||
var defaultTimeout = 80 * time.Second
|
||||
|
||||
// Builder builds yaml manifests
|
||||
// It retrieves the kustomization object from the k8s cluster
|
||||
// and overlays the manifests with the resources specified in the resourcesPath
|
||||
type Builder struct {
|
||||
client client.WithWatch
|
||||
name string
|
||||
namespace string
|
||||
resourcesPath string
|
||||
kustomization *kustomizev1.Kustomization
|
||||
timeout time.Duration
|
||||
}
|
||||
|
||||
type BuilderOptionFunc func(b *Builder) error
|
||||
|
||||
func WithTimeout(timeout time.Duration) BuilderOptionFunc {
|
||||
return func(b *Builder) error {
|
||||
b.timeout = timeout
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
// NewBuilder returns a new Builder
|
||||
// to dp : create functional options
|
||||
func NewBuilder(kubeconfig string, kubecontext string, namespace, name, resources string, opts ...BuilderOptionFunc) (*Builder, error) {
|
||||
kubeClient, err := utils.KubeClient(kubeconfig, kubecontext)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
b := &Builder{
|
||||
client: kubeClient,
|
||||
name: name,
|
||||
namespace: namespace,
|
||||
resourcesPath: resources,
|
||||
}
|
||||
|
||||
for _, opt := range opts {
|
||||
if err := opt(b); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
if b.timeout == 0 {
|
||||
b.timeout = defaultTimeout
|
||||
}
|
||||
|
||||
return b, nil
|
||||
}
|
||||
|
||||
func (b *Builder) getKustomization(ctx context.Context) (*kustomizev1.Kustomization, error) {
|
||||
namespacedName := types.NamespacedName{
|
||||
Namespace: b.namespace,
|
||||
Name: b.name,
|
||||
}
|
||||
|
||||
k := &kustomizev1.Kustomization{}
|
||||
err := b.client.Get(ctx, namespacedName, k)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return k, nil
|
||||
}
|
||||
|
||||
// Build builds the yaml manifests from the kustomization object
|
||||
// and overlays the manifests with the resources specified in the resourcesPath
|
||||
// It expects a kustomization.yaml file in the resourcesPath, and it will
|
||||
// generate a kustomization.yaml file if it doesn't exist
|
||||
func (b *Builder) Build() ([]byte, error) {
|
||||
m, err := b.build()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
resources, err := m.AsYaml()
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("kustomize build failed: %w", err)
|
||||
}
|
||||
|
||||
return resources, nil
|
||||
}
|
||||
|
||||
func (b *Builder) build() (resmap.ResMap, error) {
|
||||
ctx, cancel := context.WithTimeout(context.Background(), b.timeout)
|
||||
defer cancel()
|
||||
|
||||
// Get the kustomization object
|
||||
k, err := b.getKustomization(ctx)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// generate kustomization.yaml if needed
|
||||
saved, err := b.generate(*k, b.resourcesPath)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to generate kustomization.yaml: %w", err)
|
||||
}
|
||||
|
||||
// build the kustomization
|
||||
m, err := b.do(ctx, *k, b.resourcesPath)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
// make sure secrets are masked
|
||||
for _, res := range m.Resources() {
|
||||
err := trimSopsData(res)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
|
||||
// store the kustomization object
|
||||
b.kustomization = k
|
||||
|
||||
// restore the kustomization.yaml
|
||||
err = restore(saved, b.resourcesPath)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("failed to restore kustomization.yaml: %w", err)
|
||||
}
|
||||
|
||||
return m, nil
|
||||
|
||||
}
|
||||
|
||||
func (b *Builder) generate(kustomization kustomizev1.Kustomization, dirPath string) ([]byte, error) {
|
||||
gen := NewGenerator(&kustomizeImpl{kustomization})
|
||||
return gen.WriteFile(dirPath)
|
||||
}
|
||||
|
||||
func (b *Builder) do(ctx context.Context, kustomization kustomizev1.Kustomization, dirPath string) (resmap.ResMap, error) {
|
||||
fs := filesys.MakeFsOnDisk()
|
||||
m, err := buildKustomization(fs, dirPath)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("kustomize build failed: %w", err)
|
||||
}
|
||||
|
||||
for _, res := range m.Resources() {
|
||||
// run variable substitutions
|
||||
if kustomization.Spec.PostBuild != nil {
|
||||
outRes, err := substituteVariables(ctx, b.client, &kustomizeImpl{kustomization}, res)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("var substitution failed for '%s': %w", res.GetName(), err)
|
||||
}
|
||||
|
||||
if outRes != nil {
|
||||
_, err = m.Replace(res)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
return m, nil
|
||||
}
|
||||
|
||||
func trimSopsData(res *resource.Resource) error {
|
||||
// sopsMess is the base64 encoded mask
|
||||
sopsMess := base64.StdEncoding.EncodeToString([]byte(mask))
|
||||
|
||||
if res.GetKind() == "Secret" {
|
||||
dataMap := res.GetDataMap()
|
||||
for k, v := range dataMap {
|
||||
data, err := base64.StdEncoding.DecodeString(v)
|
||||
if err != nil {
|
||||
fmt.Println(fmt.Errorf("failed to decode secret data: %w", err))
|
||||
}
|
||||
|
||||
if bytes.Contains(data, []byte("sops")) {
|
||||
dataMap[k] = sopsMess
|
||||
}
|
||||
}
|
||||
res.SetDataMap(dataMap)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func restore(saved []byte, dirPath string) error {
|
||||
kfile := filepath.Join(dirPath, konfig.DefaultKustomizationFileName())
|
||||
err := os.WriteFile(kfile, saved, 0644)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to restore kustomization.yaml: %w", err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@ -0,0 +1,120 @@
|
||||
/*
|
||||
Copyright 2021 The Flux authors
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package kustomization
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/google/go-cmp/cmp"
|
||||
"sigs.k8s.io/kustomize/api/resource"
|
||||
"sigs.k8s.io/kustomize/kyaml/yaml"
|
||||
)
|
||||
|
||||
func TestSanitizeResources(t *testing.T) {
|
||||
testCases := []struct {
|
||||
name string
|
||||
yamlStr string
|
||||
expected string
|
||||
}{
|
||||
{
|
||||
name: "secret with sops token",
|
||||
yamlStr: `apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: my-secret
|
||||
type: Opaque
|
||||
data:
|
||||
token: |
|
||||
ewoJImRhdGEiOiAiRU5DW0FFUzI1Nl9HQ00sZGF0YTpvQmU1UGxQbWZRQ1VVYzRzcUtJbW
|
||||
p3PT0saXY6TUxMRVcxNVFDOWtSZFZWYWdKbnpMQ1NrMHhaR1dJcEFlVGZIenl4VDEwZz0s
|
||||
dGFnOkszR2tCQ0dTK3V0NFRwazZuZGIwQ0E9PSx0eXBlOnN0cl0iLAoJInNvcHMiOiB7Cg
|
||||
kJImttcyI6IG51bGwsCgkJImdjcF9rbXMiOiBudWxsLAoJCSJhenVyZV9rdiI6IG51bGws
|
||||
CgkJImhjX3ZhdWx0IjogbnVsbCwKCQkiYWdlIjogWwoJCQl7CgkJCQkicmVjaXBpZW50Ij
|
||||
ogImFnZTEwbGEyZ2Uwd3R2eDNxcjdkYXRxZjdyczR5bmd4c3pkYWw5MjdmczlydWthbXI4
|
||||
dTJwc2hzdnR6N2NlIiwKCQkJCSJlbmMiOiAiLS0tLS1CRUdJTiBBR0UgRU5DUllQVEVEIE
|
||||
ZJTEUtLS0tLVxuWVdkbExXVnVZM0o1Y0hScGIyNHViM0puTDNZeENpMCtJRmd5TlRVeE9T
|
||||
QTFMMlJwWkhScksxRlNWbVlyZDFWYVxuWTBoeFdGUXpTREJzVDFrM1dqTnRZbVUxUW1saW
|
||||
FESnljWGxOQ25GMVlqZE5PVGhWYlZOdk1HOXJOUzlaVVhad1xuTW5WMGJuUlVNR050ZWpG
|
||||
UGJ6TTRVMlV6V2tzemVWa0tMUzB0SUdKNlVHaHhNVVYzWW1WSlRIbEpTVUpwUlZSWlxuVm
|
||||
pkMFJWUmFkVTh3ZWt4WFRISXJZVXBsWWtOMmFFRUswSS9NQ0V0WFJrK2IvTjJHMUpGM3ZI
|
||||
UVQyNGRTaFdZRFxudytKSVVTQTNhTGYyc3YwenIyTWRVRWRWV0JKb004blQ0RDR4VmJCT1
|
||||
JEKzY2OVcrOW5EZVN3PT1cbi0tLS0tRU5EIEFHRSBFTkNSWVBURUQgRklMRS0tLS0tXG4i
|
||||
CgkJCX0KCQldLAoJCSJsYXN0bW9kaWZpZWQiOiAiMjAyMS0xMS0yNlQxNjozNDo1MVoiLA
|
||||
oJCSJtYWMiOiAiRU5DW0FFUzI1Nl9HQ00sZGF0YTpDT0d6ZjVZQ0hOTlA2ejRKYUVLcmpO
|
||||
M004ZjUrUTF1S1VLVE1Id2ozODgvSUNtTHlpMnNTclRtajdQUCtYN005alRWd2E4d1ZnWV
|
||||
RwTkxpVkp4K0xjeHF2SVhNMFR5bysvQ3UxenJmYW85OGFpQUNQOCtUU0VEaUZRTnRFdXMy
|
||||
M0grZC9YMWhxTXdSSERJM2tRKzZzY2dFR25xWTU3cjNSRFNBM0U4RWhIcjQ9LGl2Okx4aX
|
||||
RWSVltOHNyWlZxRnVlSmg5bG9DbEE0NFkyWjNYQVZZbXhlc01tT2c9LHRhZzpZOHFGRDhV
|
||||
R2xEZndOU3Y3eGxjbjZBPT0sdHlwZTpzdHJdIiwKCQkicGdwIjogbnVsbCwKCQkidW5lbm
|
||||
NyeXB0ZWRfc3VmZml4IjogIl91bmVuY3J5cHRlZCIsCgkJInZlcnNpb24iOiAiMy43LjEi
|
||||
Cgl9Cn0=
|
||||
`,
|
||||
expected: `apiVersion: v1
|
||||
data:
|
||||
token: KipTT1BTKio=
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: my-secret
|
||||
type: Opaque
|
||||
`,
|
||||
},
|
||||
{
|
||||
name: "secret with basic auth",
|
||||
yamlStr: `apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: secret-basic-auth
|
||||
type: kubernetes.io/basic-auth
|
||||
data:
|
||||
username: admin
|
||||
password: password
|
||||
`,
|
||||
expected: `apiVersion: v1
|
||||
data:
|
||||
password: password
|
||||
username: admin
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: secret-basic-auth
|
||||
type: kubernetes.io/basic-auth
|
||||
`,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range testCases {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
r, err := yaml.Parse(tc.yamlStr)
|
||||
if err != nil {
|
||||
t.Fatalf("unable to parse yaml: %v", err)
|
||||
}
|
||||
|
||||
resource := &resource.Resource{RNode: *r}
|
||||
err = trimSopsData(resource)
|
||||
if err != nil {
|
||||
t.Fatalf("unable to trim sops data: %v", err)
|
||||
}
|
||||
|
||||
sYaml, err := resource.AsYAML()
|
||||
if err != nil {
|
||||
t.Fatalf("unable to convert sanitized resources to yaml: %v", err)
|
||||
}
|
||||
if diff := cmp.Diff(string(sYaml), tc.expected); diff != "" {
|
||||
t.Errorf("unexpected sanitized resources: (-got +want)%v", diff)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,84 @@
|
||||
/*
|
||||
Copyright 2021 The Flux authors
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package kustomization
|
||||
|
||||
import (
|
||||
kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1beta2"
|
||||
"github.com/fluxcd/pkg/apis/kustomize"
|
||||
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
)
|
||||
|
||||
// Kustomize defines the methods to retrieve the kustomization information
|
||||
// TO DO @souleb: move this to fluxcd/pkg along with generator and varsub
|
||||
type Kustomize interface {
|
||||
client.Object
|
||||
GetTargetNamespace() string
|
||||
GetPatches() []kustomize.Patch
|
||||
GetPatchesStrategicMerge() []apiextensionsv1.JSON
|
||||
GetPatchesJSON6902() []kustomize.JSON6902Patch
|
||||
GetImages() []kustomize.Image
|
||||
GetSubstituteFrom() []SubstituteReference
|
||||
GetSubstitute() map[string]string
|
||||
}
|
||||
|
||||
// SubstituteReference contains a reference to a resource containing
|
||||
// the variables name and value.
|
||||
type SubstituteReference struct {
|
||||
Kind string `json:"kind"`
|
||||
Name string `json:"name"`
|
||||
}
|
||||
|
||||
// TO DO @souleb: this is a temporary hack to get the kustomize object
|
||||
// from the kustomize controller.
|
||||
// At some point we should remove this and have the kustomize controller implement
|
||||
// the Kustomize interface.
|
||||
type kustomizeImpl struct {
|
||||
kustomizev1.Kustomization
|
||||
}
|
||||
|
||||
func (k *kustomizeImpl) GetTargetNamespace() string {
|
||||
return k.Spec.TargetNamespace
|
||||
}
|
||||
|
||||
func (k *kustomizeImpl) GetPatches() []kustomize.Patch {
|
||||
return k.Spec.Patches
|
||||
}
|
||||
|
||||
func (k *kustomizeImpl) GetPatchesStrategicMerge() []apiextensionsv1.JSON {
|
||||
return k.Spec.PatchesStrategicMerge
|
||||
}
|
||||
|
||||
func (k *kustomizeImpl) GetPatchesJSON6902() []kustomize.JSON6902Patch {
|
||||
return k.Spec.PatchesJSON6902
|
||||
}
|
||||
|
||||
func (k *kustomizeImpl) GetImages() []kustomize.Image {
|
||||
return k.Spec.Images
|
||||
}
|
||||
|
||||
func (k *kustomizeImpl) GetSubstituteFrom() []SubstituteReference {
|
||||
refs := make([]SubstituteReference, 0, len(k.Spec.PostBuild.SubstituteFrom))
|
||||
for _, s := range k.Spec.PostBuild.SubstituteFrom {
|
||||
refs = append(refs, SubstituteReference(s))
|
||||
}
|
||||
return refs
|
||||
}
|
||||
|
||||
func (k *kustomizeImpl) GetSubstitute() map[string]string {
|
||||
return k.Spec.PostBuild.Substitute
|
||||
}
|
||||
@ -0,0 +1,258 @@
|
||||
/*
|
||||
Copyright 2021 The Flux authors
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package kustomization
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"sync"
|
||||
|
||||
"sigs.k8s.io/kustomize/api/konfig"
|
||||
"sigs.k8s.io/kustomize/api/krusty"
|
||||
"sigs.k8s.io/kustomize/api/provider"
|
||||
"sigs.k8s.io/kustomize/api/resmap"
|
||||
kustypes "sigs.k8s.io/kustomize/api/types"
|
||||
"sigs.k8s.io/kustomize/kyaml/filesys"
|
||||
"sigs.k8s.io/yaml"
|
||||
|
||||
"github.com/fluxcd/pkg/apis/kustomize"
|
||||
)
|
||||
|
||||
type KustomizeGenerator struct {
|
||||
kustomization Kustomize
|
||||
}
|
||||
|
||||
func NewGenerator(kustomization Kustomize) *KustomizeGenerator {
|
||||
return &KustomizeGenerator{
|
||||
kustomization: kustomization,
|
||||
}
|
||||
}
|
||||
|
||||
// WriteFile generates a kustomization.yaml in the given directory if it does not exist.
|
||||
// It apply the flux kustomize resources to the kustomization.yaml and then write the
|
||||
// updated kustomization.yaml to the directory.
|
||||
// It returns the original kustomization.yaml.
|
||||
func (kg *KustomizeGenerator) WriteFile(dirPath string) ([]byte, error) {
|
||||
if err := kg.generateKustomization(dirPath); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
kfile := filepath.Join(dirPath, konfig.DefaultKustomizationFileName())
|
||||
|
||||
data, err := os.ReadFile(kfile)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
kus := kustypes.Kustomization{
|
||||
TypeMeta: kustypes.TypeMeta{
|
||||
APIVersion: kustypes.KustomizationVersion,
|
||||
Kind: kustypes.KustomizationKind,
|
||||
},
|
||||
}
|
||||
|
||||
if err := yaml.Unmarshal(data, &kus); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if kg.kustomization.GetTargetNamespace() != "" {
|
||||
kus.Namespace = kg.kustomization.GetTargetNamespace()
|
||||
}
|
||||
|
||||
for _, m := range kg.kustomization.GetPatches() {
|
||||
kus.Patches = append(kus.Patches, kustypes.Patch{
|
||||
Patch: m.Patch,
|
||||
Target: adaptSelector(&m.Target),
|
||||
})
|
||||
}
|
||||
|
||||
for _, m := range kg.kustomization.GetPatchesStrategicMerge() {
|
||||
kus.PatchesStrategicMerge = append(kus.PatchesStrategicMerge, kustypes.PatchStrategicMerge(m.Raw))
|
||||
}
|
||||
|
||||
for _, m := range kg.kustomization.GetPatchesJSON6902() {
|
||||
patch, err := json.Marshal(m.Patch)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
kus.PatchesJson6902 = append(kus.PatchesJson6902, kustypes.Patch{
|
||||
Patch: string(patch),
|
||||
Target: adaptSelector(&m.Target),
|
||||
})
|
||||
}
|
||||
|
||||
for _, image := range kg.kustomization.GetImages() {
|
||||
newImage := kustypes.Image{
|
||||
Name: image.Name,
|
||||
NewName: image.NewName,
|
||||
NewTag: image.NewTag,
|
||||
}
|
||||
if exists, index := checkKustomizeImageExists(kus.Images, image.Name); exists {
|
||||
kus.Images[index] = newImage
|
||||
} else {
|
||||
kus.Images = append(kus.Images, newImage)
|
||||
}
|
||||
}
|
||||
|
||||
manifest, err := yaml.Marshal(kus)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
os.WriteFile(kfile, manifest, 0644)
|
||||
|
||||
return data, nil
|
||||
}
|
||||
|
||||
func checkKustomizeImageExists(images []kustypes.Image, imageName string) (bool, int) {
|
||||
for i, image := range images {
|
||||
if imageName == image.Name {
|
||||
return true, i
|
||||
}
|
||||
}
|
||||
|
||||
return false, -1
|
||||
}
|
||||
|
||||
func (kg *KustomizeGenerator) generateKustomization(dirPath string) error {
|
||||
fs := filesys.MakeFsOnDisk()
|
||||
|
||||
// Determine if there already is a Kustomization file at the root,
|
||||
// as this means we do not have to generate one.
|
||||
for _, kfilename := range konfig.RecognizedKustomizationFileNames() {
|
||||
if kpath := filepath.Join(dirPath, kfilename); fs.Exists(kpath) && !fs.IsDir(kpath) {
|
||||
return nil
|
||||
}
|
||||
}
|
||||
|
||||
scan := func(base string) ([]string, error) {
|
||||
var paths []string
|
||||
pvd := provider.NewDefaultDepProvider()
|
||||
rf := pvd.GetResourceFactory()
|
||||
err := fs.Walk(base, func(path string, info os.FileInfo, err error) error {
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
if path == base {
|
||||
return nil
|
||||
}
|
||||
if info.IsDir() {
|
||||
// If a sub-directory contains an existing kustomization file add the
|
||||
// directory as a resource and do not decend into it.
|
||||
for _, kfilename := range konfig.RecognizedKustomizationFileNames() {
|
||||
if kpath := filepath.Join(path, kfilename); fs.Exists(kpath) && !fs.IsDir(kpath) {
|
||||
paths = append(paths, path)
|
||||
return filepath.SkipDir
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
extension := filepath.Ext(path)
|
||||
if extension != ".yaml" && extension != ".yml" {
|
||||
return nil
|
||||
}
|
||||
|
||||
fContents, err := fs.ReadFile(path)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
if _, err := rf.SliceFromBytes(fContents); err != nil {
|
||||
return fmt.Errorf("failed to decode Kubernetes YAML from %s: %w", path, err)
|
||||
}
|
||||
paths = append(paths, path)
|
||||
return nil
|
||||
})
|
||||
return paths, err
|
||||
}
|
||||
|
||||
abs, err := filepath.Abs(dirPath)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
files, err := scan(abs)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
kfile := filepath.Join(dirPath, konfig.DefaultKustomizationFileName())
|
||||
f, err := fs.Create(kfile)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
f.Close()
|
||||
|
||||
kus := kustypes.Kustomization{
|
||||
TypeMeta: kustypes.TypeMeta{
|
||||
APIVersion: kustypes.KustomizationVersion,
|
||||
Kind: kustypes.KustomizationKind,
|
||||
},
|
||||
}
|
||||
|
||||
var resources []string
|
||||
for _, file := range files {
|
||||
resources = append(resources, strings.Replace(file, abs, ".", 1))
|
||||
}
|
||||
|
||||
kus.Resources = resources
|
||||
kd, err := yaml.Marshal(kus)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
return os.WriteFile(kfile, kd, os.ModePerm)
|
||||
}
|
||||
|
||||
func adaptSelector(selector *kustomize.Selector) (output *kustypes.Selector) {
|
||||
if selector != nil {
|
||||
output = &kustypes.Selector{}
|
||||
output.Gvk.Group = selector.Group
|
||||
output.Gvk.Kind = selector.Kind
|
||||
output.Gvk.Version = selector.Version
|
||||
output.Name = selector.Name
|
||||
output.Namespace = selector.Namespace
|
||||
output.LabelSelector = selector.LabelSelector
|
||||
output.AnnotationSelector = selector.AnnotationSelector
|
||||
}
|
||||
return
|
||||
}
|
||||
|
||||
// TODO: remove mutex when kustomize fixes the concurrent map read/write panic
|
||||
var kustomizeBuildMutex sync.Mutex
|
||||
|
||||
// buildKustomization wraps krusty.MakeKustomizer with the following settings:
|
||||
// - load files from outside the kustomization.yaml root
|
||||
// - disable plugins except for the builtin ones
|
||||
func buildKustomization(fs filesys.FileSystem, dirPath string) (resmap.ResMap, error) {
|
||||
// temporary workaround for concurrent map read and map write bug
|
||||
// https://github.com/kubernetes-sigs/kustomize/issues/3659
|
||||
kustomizeBuildMutex.Lock()
|
||||
defer kustomizeBuildMutex.Unlock()
|
||||
|
||||
buildOptions := &krusty.Options{
|
||||
LoadRestrictions: kustypes.LoadRestrictionsNone,
|
||||
PluginConfig: kustypes.DisabledPluginConfig(),
|
||||
}
|
||||
|
||||
k := krusty.MakeKustomizer(buildOptions)
|
||||
return k.Run(fs, dirPath)
|
||||
}
|
||||
@ -0,0 +1,119 @@
|
||||
/*
|
||||
Copyright 2021 The Flux authors
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package kustomization
|
||||
|
||||
import (
|
||||
"context"
|
||||
"fmt"
|
||||
"regexp"
|
||||
"strings"
|
||||
|
||||
"github.com/drone/envsubst"
|
||||
corev1 "k8s.io/api/core/v1"
|
||||
"k8s.io/apimachinery/pkg/types"
|
||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||
"sigs.k8s.io/kustomize/api/resource"
|
||||
"sigs.k8s.io/yaml"
|
||||
)
|
||||
|
||||
const (
|
||||
// varsubRegex is the regular expression used to validate
|
||||
// the var names before substitution
|
||||
varsubRegex = "^[_[:alpha:]][_[:alpha:][:digit:]]*$"
|
||||
DisabledValue = "disabled"
|
||||
)
|
||||
|
||||
// substituteVariables replaces the vars with their values in the specified resource.
|
||||
// If a resource is labeled or annotated with
|
||||
// 'kustomize.toolkit.fluxcd.io/substitute: disabled' the substitution is skipped.
|
||||
func substituteVariables(
|
||||
ctx context.Context,
|
||||
kubeClient client.Client,
|
||||
kustomization Kustomize,
|
||||
res *resource.Resource) (*resource.Resource, error) {
|
||||
resData, err := res.AsYAML()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
key := fmt.Sprintf("%s/substitute", kustomization.GetObjectKind().GroupVersionKind().Group)
|
||||
|
||||
if res.GetLabels()[key] == DisabledValue || res.GetAnnotations()[key] == DisabledValue {
|
||||
return nil, nil
|
||||
}
|
||||
|
||||
vars := make(map[string]string)
|
||||
|
||||
// load vars from ConfigMaps and Secrets data keys
|
||||
for _, reference := range kustomization.GetSubstituteFrom() {
|
||||
namespacedName := types.NamespacedName{Namespace: kustomization.GetNamespace(), Name: reference.Name}
|
||||
switch reference.Kind {
|
||||
case "ConfigMap":
|
||||
resource := &corev1.ConfigMap{}
|
||||
if err := kubeClient.Get(ctx, namespacedName, resource); err != nil {
|
||||
return nil, fmt.Errorf("substitute from 'ConfigMap/%s' error: %w", reference.Name, err)
|
||||
}
|
||||
for k, v := range resource.Data {
|
||||
vars[k] = strings.Replace(v, "\n", "", -1)
|
||||
}
|
||||
case "Secret":
|
||||
resource := &corev1.Secret{}
|
||||
if err := kubeClient.Get(ctx, namespacedName, resource); err != nil {
|
||||
return nil, fmt.Errorf("substitute from 'Secret/%s' error: %w", reference.Name, err)
|
||||
}
|
||||
for k, v := range resource.Data {
|
||||
vars[k] = strings.Replace(string(v), "\n", "", -1)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// load in-line vars (overrides the ones from resources)
|
||||
if kustomization.GetSubstitute() != nil {
|
||||
for k, v := range kustomization.GetSubstitute() {
|
||||
vars[k] = strings.Replace(v, "\n", "", -1)
|
||||
}
|
||||
}
|
||||
|
||||
// run bash variable substitutions
|
||||
if len(vars) > 0 {
|
||||
r, _ := regexp.Compile(varsubRegex)
|
||||
for v := range vars {
|
||||
if !r.MatchString(v) {
|
||||
return nil, fmt.Errorf("'%s' var name is invalid, must match '%s'", v, varsubRegex)
|
||||
}
|
||||
}
|
||||
|
||||
output, err := envsubst.Eval(string(resData), func(s string) string {
|
||||
return vars[s]
|
||||
})
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("variable substitution failed: %w", err)
|
||||
}
|
||||
|
||||
jsonData, err := yaml.YAMLToJSON([]byte(output))
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("YAMLToJSON: %w", err)
|
||||
}
|
||||
|
||||
err = res.UnmarshalJSON(jsonData)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("UnmarshalJSON: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
return res, nil
|
||||
}
|
||||
Loading…
Reference in New Issue