mirror of https://github.com/fluxcd/flux2.git
Merge branch 'main' into add-reason-for-suspend
Travis Mattera
8 months ago
committed by
GitHub
commit
80f73504bf
@ -1,5 +1,9 @@
|
|||||||
kind: Cluster
|
kind: Cluster
|
||||||
apiVersion: kind.x-k8s.io/v1alpha4
|
apiVersion: kind.x-k8s.io/v1alpha4
|
||||||
|
nodes:
|
||||||
|
- role: control-plane
|
||||||
|
- role: worker
|
||||||
|
- role: worker
|
||||||
networking:
|
networking:
|
||||||
disableDefaultCNI: true # disable kindnet
|
disableDefaultCNI: true # disable kindnet
|
||||||
podSubnet: 192.168.0.0/16 # set to Calico's default subnet
|
podSubnet: 192.168.0.0/16 # set to Calico's default subnet
|
||||||
|
|||||||
@ -0,0 +1,101 @@
|
|||||||
|
name: e2e-openshift
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
push:
|
||||||
|
branches: [ 'main', 'update-components', 'openshift-*', 'release/**' ]
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
e2e-openshift:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
strategy:
|
||||||
|
matrix:
|
||||||
|
# Keep this list up-to-date with https://endoflife.date/red-hat-openshift
|
||||||
|
OPENSHIFT_VERSION: [ 4.14.0-okd, 4.15.0-okd ]
|
||||||
|
fail-fast: false
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
|
||||||
|
with:
|
||||||
|
go-version: 1.22.x
|
||||||
|
cache-dependency-path: |
|
||||||
|
**/go.sum
|
||||||
|
**/go.mod
|
||||||
|
- name: Prepare
|
||||||
|
id: prep
|
||||||
|
run: |
|
||||||
|
ID=${GITHUB_SHA:0:7}-${{ matrix.OPENSHIFT_VERSION }}-$(date +%s)
|
||||||
|
PSEUDO_RAND_SUFFIX=$(echo "${ID}" | shasum | awk '{print $1}')
|
||||||
|
echo "cluster=flux2-openshift-${PSEUDO_RAND_SUFFIX}" >> $GITHUB_OUTPUT
|
||||||
|
KUBECONFIG_PATH="$(git rev-parse --show-toplevel)/bin/kubeconfig.yaml"
|
||||||
|
echo "kubeconfig-path=${KUBECONFIG_PATH}" >> $GITHUB_OUTPUT
|
||||||
|
- name: Setup Kustomize
|
||||||
|
uses: fluxcd/pkg/actions/kustomize@main
|
||||||
|
- name: Build
|
||||||
|
run: make build-dev
|
||||||
|
- name: Create repository
|
||||||
|
run: |
|
||||||
|
gh repo create --private --add-readme fluxcd-testing/${{ steps.prep.outputs.cluster }}
|
||||||
|
env:
|
||||||
|
GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
|
||||||
|
- name: Create cluster
|
||||||
|
id: create-cluster
|
||||||
|
uses: replicatedhq/compatibility-actions/create-cluster@v1
|
||||||
|
with:
|
||||||
|
api-token: ${{ secrets.REPLICATED_API_TOKEN }}
|
||||||
|
kubernetes-distribution: "openshift"
|
||||||
|
kubernetes-version: ${{ matrix.OPENSHIFT_VERSION }}
|
||||||
|
ttl: 20m
|
||||||
|
cluster-name: "${{ steps.prep.outputs.cluster }}"
|
||||||
|
kubeconfig-path: ${{ steps.prep.outputs.kubeconfig-path }}
|
||||||
|
export-kubeconfig: true
|
||||||
|
- name: Run flux bootstrap
|
||||||
|
run: |
|
||||||
|
./bin/flux bootstrap git --manifests ./manifests/openshift/ \
|
||||||
|
--components-extra=image-reflector-controller,image-automation-controller \
|
||||||
|
--url=https://github.com/fluxcd-testing/${{ steps.prep.outputs.cluster }} \
|
||||||
|
--branch=main \
|
||||||
|
--path=clusters/openshift \
|
||||||
|
--token-auth
|
||||||
|
env:
|
||||||
|
GIT_PASSWORD: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
|
||||||
|
- name: Run flux check
|
||||||
|
run: |
|
||||||
|
./bin/flux check
|
||||||
|
- name: Run flux reconcile
|
||||||
|
run: |
|
||||||
|
./bin/flux reconcile ks flux-system --with-source
|
||||||
|
./bin/flux get all
|
||||||
|
./bin/flux events
|
||||||
|
- name: Collect reconcile logs
|
||||||
|
if: ${{ always() }}
|
||||||
|
continue-on-error: true
|
||||||
|
run: |
|
||||||
|
kubectl -n flux-system get all
|
||||||
|
kubectl -n flux-system describe pods
|
||||||
|
kubectl -n flux-system logs deploy/source-controller
|
||||||
|
kubectl -n flux-system logs deploy/kustomize-controller
|
||||||
|
kubectl -n flux-system logs deploy/notification-controller
|
||||||
|
- name: Delete flux
|
||||||
|
run: |
|
||||||
|
./bin/flux uninstall -s --keep-namespace
|
||||||
|
kubectl delete ns flux-system --wait
|
||||||
|
- name: Delete cluster
|
||||||
|
if: ${{ always() }}
|
||||||
|
uses: replicatedhq/replicated-actions/remove-cluster@v1
|
||||||
|
continue-on-error: true
|
||||||
|
with:
|
||||||
|
api-token: ${{ secrets.REPLICATED_API_TOKEN }}
|
||||||
|
cluster-id: ${{ steps.create-cluster.outputs.cluster-id }}
|
||||||
|
- name: Delete repository
|
||||||
|
if: ${{ always() }}
|
||||||
|
continue-on-error: true
|
||||||
|
run: |
|
||||||
|
gh repo delete fluxcd-testing/${{ steps.prep.outputs.cluster }} --yes
|
||||||
|
env:
|
||||||
|
GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
|
||||||
@ -0,0 +1,276 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2023 The Flux authors
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"time"
|
||||||
|
|
||||||
|
"github.com/fluxcd/pkg/git"
|
||||||
|
"github.com/fluxcd/pkg/git/gogit"
|
||||||
|
"github.com/spf13/cobra"
|
||||||
|
|
||||||
|
"github.com/fluxcd/flux2/v2/internal/flags"
|
||||||
|
"github.com/fluxcd/flux2/v2/internal/utils"
|
||||||
|
"github.com/fluxcd/flux2/v2/pkg/bootstrap"
|
||||||
|
"github.com/fluxcd/flux2/v2/pkg/bootstrap/provider"
|
||||||
|
"github.com/fluxcd/flux2/v2/pkg/manifestgen"
|
||||||
|
"github.com/fluxcd/flux2/v2/pkg/manifestgen/install"
|
||||||
|
"github.com/fluxcd/flux2/v2/pkg/manifestgen/sourcesecret"
|
||||||
|
"github.com/fluxcd/flux2/v2/pkg/manifestgen/sync"
|
||||||
|
)
|
||||||
|
|
||||||
|
var bootstrapGiteaCmd = &cobra.Command{
|
||||||
|
Use: "gitea",
|
||||||
|
Short: "Deploy Flux on a cluster connected to a Gitea repository",
|
||||||
|
Long: `The bootstrap gitea command creates the Gitea repository if it doesn't exists and
|
||||||
|
commits the Flux manifests to the specified branch.
|
||||||
|
Then it configures the target cluster to synchronize with that repository.
|
||||||
|
If the Flux components are present on the cluster,
|
||||||
|
the bootstrap command will perform an upgrade if needed.`,
|
||||||
|
Example: ` # Create a Gitea personal access token and export it as an env var
|
||||||
|
export GITEA_TOKEN=<my-token>
|
||||||
|
|
||||||
|
# Run bootstrap for a private repository owned by a Gitea organization
|
||||||
|
flux bootstrap gitea --owner=<organization> --repository=<repository name> --path=clusters/my-cluster
|
||||||
|
|
||||||
|
# Run bootstrap for a private repository and assign organization teams to it
|
||||||
|
flux bootstrap gitea --owner=<organization> --repository=<repository name> --team=<team1 slug> --team=<team2 slug> --path=clusters/my-cluster
|
||||||
|
|
||||||
|
# Run bootstrap for a private repository and assign organization teams with their access level(e.g maintain, admin) to it
|
||||||
|
flux bootstrap gitea --owner=<organization> --repository=<repository name> --team=<team1 slug>:<access-level> --path=clusters/my-cluster
|
||||||
|
|
||||||
|
# Run bootstrap for a public repository on a personal account
|
||||||
|
flux bootstrap gitea --owner=<user> --repository=<repository name> --private=false --personal=true --path=clusters/my-cluster
|
||||||
|
|
||||||
|
# Run bootstrap for a private repository hosted on Gitea Enterprise using SSH auth
|
||||||
|
flux bootstrap gitea --owner=<organization> --repository=<repository name> --hostname=<domain> --ssh-hostname=<domain> --path=clusters/my-cluster
|
||||||
|
|
||||||
|
# Run bootstrap for a private repository hosted on Gitea Enterprise using HTTPS auth
|
||||||
|
flux bootstrap gitea --owner=<organization> --repository=<repository name> --hostname=<domain> --token-auth --path=clusters/my-cluster
|
||||||
|
|
||||||
|
# Run bootstrap for an existing repository with a branch named main
|
||||||
|
flux bootstrap gitea --owner=<organization> --repository=<repository name> --branch=main --path=clusters/my-cluster`,
|
||||||
|
RunE: bootstrapGiteaCmdRun,
|
||||||
|
}
|
||||||
|
|
||||||
|
type giteaFlags struct {
|
||||||
|
owner string
|
||||||
|
repository string
|
||||||
|
interval time.Duration
|
||||||
|
personal bool
|
||||||
|
private bool
|
||||||
|
hostname string
|
||||||
|
path flags.SafeRelativePath
|
||||||
|
teams []string
|
||||||
|
readWriteKey bool
|
||||||
|
reconcile bool
|
||||||
|
}
|
||||||
|
|
||||||
|
const (
|
||||||
|
gtDefaultPermission = "maintain"
|
||||||
|
gtDefaultDomain = "gitea.com"
|
||||||
|
gtTokenEnvVar = "GITEA_TOKEN"
|
||||||
|
)
|
||||||
|
|
||||||
|
var giteaArgs giteaFlags
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
bootstrapGiteaCmd.Flags().StringVar(&giteaArgs.owner, "owner", "", "Gitea user or organization name")
|
||||||
|
bootstrapGiteaCmd.Flags().StringVar(&giteaArgs.repository, "repository", "", "Gitea repository name")
|
||||||
|
bootstrapGiteaCmd.Flags().StringSliceVar(&giteaArgs.teams, "team", []string{}, "Gitea team and the access to be given to it(team:maintain). Defaults to maintainer access if no access level is specified (also accepts comma-separated values)")
|
||||||
|
bootstrapGiteaCmd.Flags().BoolVar(&giteaArgs.personal, "personal", false, "if true, the owner is assumed to be a Gitea user; otherwise an org")
|
||||||
|
bootstrapGiteaCmd.Flags().BoolVar(&giteaArgs.private, "private", true, "if true, the repository is setup or configured as private")
|
||||||
|
bootstrapGiteaCmd.Flags().DurationVar(&giteaArgs.interval, "interval", time.Minute, "sync interval")
|
||||||
|
bootstrapGiteaCmd.Flags().StringVar(&giteaArgs.hostname, "hostname", gtDefaultDomain, "Gitea hostname")
|
||||||
|
bootstrapGiteaCmd.Flags().Var(&giteaArgs.path, "path", "path relative to the repository root, when specified the cluster sync will be scoped to this path")
|
||||||
|
bootstrapGiteaCmd.Flags().BoolVar(&giteaArgs.readWriteKey, "read-write-key", false, "if true, the deploy key is configured with read/write permissions")
|
||||||
|
bootstrapGiteaCmd.Flags().BoolVar(&giteaArgs.reconcile, "reconcile", false, "if true, the configured options are also reconciled if the repository already exists")
|
||||||
|
|
||||||
|
bootstrapCmd.AddCommand(bootstrapGiteaCmd)
|
||||||
|
}
|
||||||
|
|
||||||
|
func bootstrapGiteaCmdRun(cmd *cobra.Command, args []string) error {
|
||||||
|
gtToken := os.Getenv(gtTokenEnvVar)
|
||||||
|
if gtToken == "" {
|
||||||
|
var err error
|
||||||
|
gtToken, err = readPasswordFromStdin("Please enter your Gitea personal access token (PAT): ")
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("could not read token: %w", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := bootstrapValidate(); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
||||||
|
defer cancel()
|
||||||
|
|
||||||
|
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
// Manifest base
|
||||||
|
if ver, err := getVersion(bootstrapArgs.version); err != nil {
|
||||||
|
return err
|
||||||
|
} else {
|
||||||
|
bootstrapArgs.version = ver
|
||||||
|
}
|
||||||
|
manifestsBase, err := buildEmbeddedManifestBase()
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
defer os.RemoveAll(manifestsBase)
|
||||||
|
|
||||||
|
var caBundle []byte
|
||||||
|
if bootstrapArgs.caFile != "" {
|
||||||
|
var err error
|
||||||
|
caBundle, err = os.ReadFile(bootstrapArgs.caFile)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("unable to read TLS CA file: %w", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
// Build Gitea provider
|
||||||
|
providerCfg := provider.Config{
|
||||||
|
Provider: provider.GitProviderGitea,
|
||||||
|
Hostname: giteaArgs.hostname,
|
||||||
|
Token: gtToken,
|
||||||
|
CaBundle: caBundle,
|
||||||
|
}
|
||||||
|
providerClient, err := provider.BuildGitProvider(providerCfg)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
tmpDir, err := manifestgen.MkdirTempAbs("", "flux-bootstrap-")
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("failed to create temporary working dir: %w", err)
|
||||||
|
}
|
||||||
|
defer os.RemoveAll(tmpDir)
|
||||||
|
|
||||||
|
clientOpts := []gogit.ClientOption{gogit.WithDiskStorage(), gogit.WithFallbackToDefaultKnownHosts()}
|
||||||
|
gitClient, err := gogit.NewClient(tmpDir, &git.AuthOptions{
|
||||||
|
Transport: git.HTTPS,
|
||||||
|
Username: giteaArgs.owner,
|
||||||
|
Password: gtToken,
|
||||||
|
CAFile: caBundle,
|
||||||
|
}, clientOpts...)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("failed to create a Git client: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
// Install manifest config
|
||||||
|
installOptions := install.Options{
|
||||||
|
BaseURL: rootArgs.defaults.BaseURL,
|
||||||
|
Version: bootstrapArgs.version,
|
||||||
|
Namespace: *kubeconfigArgs.Namespace,
|
||||||
|
Components: bootstrapComponents(),
|
||||||
|
Registry: bootstrapArgs.registry,
|
||||||
|
RegistryCredential: bootstrapArgs.registryCredential,
|
||||||
|
ImagePullSecret: bootstrapArgs.imagePullSecret,
|
||||||
|
WatchAllNamespaces: bootstrapArgs.watchAllNamespaces,
|
||||||
|
NetworkPolicy: bootstrapArgs.networkPolicy,
|
||||||
|
LogLevel: bootstrapArgs.logLevel.String(),
|
||||||
|
NotificationController: rootArgs.defaults.NotificationController,
|
||||||
|
ManifestFile: rootArgs.defaults.ManifestFile,
|
||||||
|
Timeout: rootArgs.timeout,
|
||||||
|
TargetPath: giteaArgs.path.ToSlash(),
|
||||||
|
ClusterDomain: bootstrapArgs.clusterDomain,
|
||||||
|
TolerationKeys: bootstrapArgs.tolerationKeys,
|
||||||
|
}
|
||||||
|
if customBaseURL := bootstrapArgs.manifestsPath; customBaseURL != "" {
|
||||||
|
installOptions.BaseURL = customBaseURL
|
||||||
|
}
|
||||||
|
|
||||||
|
// Source generation and secret config
|
||||||
|
secretOpts := sourcesecret.Options{
|
||||||
|
Name: bootstrapArgs.secretName,
|
||||||
|
Namespace: *kubeconfigArgs.Namespace,
|
||||||
|
TargetPath: giteaArgs.path.ToSlash(),
|
||||||
|
ManifestFile: sourcesecret.MakeDefaultOptions().ManifestFile,
|
||||||
|
}
|
||||||
|
if bootstrapArgs.tokenAuth {
|
||||||
|
secretOpts.Username = "git"
|
||||||
|
secretOpts.Password = gtToken
|
||||||
|
secretOpts.CAFile = caBundle
|
||||||
|
} else {
|
||||||
|
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
|
||||||
|
secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
|
||||||
|
secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
|
||||||
|
|
||||||
|
secretOpts.SSHHostname = giteaArgs.hostname
|
||||||
|
if bootstrapArgs.sshHostname != "" {
|
||||||
|
secretOpts.SSHHostname = bootstrapArgs.sshHostname
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
// Sync manifest config
|
||||||
|
syncOpts := sync.Options{
|
||||||
|
Interval: giteaArgs.interval,
|
||||||
|
Name: *kubeconfigArgs.Namespace,
|
||||||
|
Namespace: *kubeconfigArgs.Namespace,
|
||||||
|
Branch: bootstrapArgs.branch,
|
||||||
|
Secret: bootstrapArgs.secretName,
|
||||||
|
TargetPath: giteaArgs.path.ToSlash(),
|
||||||
|
ManifestFile: sync.MakeDefaultOptions().ManifestFile,
|
||||||
|
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
|
||||||
|
}
|
||||||
|
|
||||||
|
entityList, err := bootstrap.LoadEntityListFromPath(bootstrapArgs.gpgKeyRingPath)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
// Bootstrap config
|
||||||
|
bootstrapOpts := []bootstrap.GitProviderOption{
|
||||||
|
bootstrap.WithProviderRepository(giteaArgs.owner, giteaArgs.repository, giteaArgs.personal),
|
||||||
|
bootstrap.WithBranch(bootstrapArgs.branch),
|
||||||
|
bootstrap.WithBootstrapTransportType("https"),
|
||||||
|
bootstrap.WithSignature(bootstrapArgs.authorName, bootstrapArgs.authorEmail),
|
||||||
|
bootstrap.WithCommitMessageAppendix(bootstrapArgs.commitMessageAppendix),
|
||||||
|
bootstrap.WithProviderTeamPermissions(mapTeamSlice(giteaArgs.teams, gtDefaultPermission)),
|
||||||
|
bootstrap.WithReadWriteKeyPermissions(giteaArgs.readWriteKey),
|
||||||
|
bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
|
||||||
|
bootstrap.WithLogger(logger),
|
||||||
|
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
|
||||||
|
}
|
||||||
|
if bootstrapArgs.sshHostname != "" {
|
||||||
|
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))
|
||||||
|
}
|
||||||
|
if bootstrapArgs.tokenAuth {
|
||||||
|
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSyncTransportType("https"))
|
||||||
|
}
|
||||||
|
if !giteaArgs.private {
|
||||||
|
bootstrapOpts = append(bootstrapOpts, bootstrap.WithProviderRepositoryConfig("", "", "public"))
|
||||||
|
}
|
||||||
|
if giteaArgs.reconcile {
|
||||||
|
bootstrapOpts = append(bootstrapOpts, bootstrap.WithReconcile())
|
||||||
|
}
|
||||||
|
|
||||||
|
// Setup bootstrapper with constructed configs
|
||||||
|
b, err := bootstrap.NewGitProviderBootstrapper(gitClient, providerClient, kubeClient, bootstrapOpts...)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
// Run
|
||||||
|
return bootstrap.Run(ctx, b, manifestsBase, installOptions, secretOpts, syncOpts, rootArgs.pollInterval, rootArgs.timeout)
|
||||||
|
}
|
||||||
@ -0,0 +1,126 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2023 The Flux authors
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
"github.com/manifoldco/promptui"
|
||||||
|
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
|
||||||
|
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/client"
|
||||||
|
|
||||||
|
kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
|
||||||
|
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
||||||
|
|
||||||
|
"github.com/fluxcd/flux2/v2/pkg/manifestgen"
|
||||||
|
)
|
||||||
|
|
||||||
|
// bootstrapLabels are labels put on a resource by kustomize-controller. These labels on the CRD indicates
|
||||||
|
// that flux has been bootstrapped.
|
||||||
|
var bootstrapLabels = []string{
|
||||||
|
fmt.Sprintf("%s/name", kustomizev1.GroupVersion.Group),
|
||||||
|
fmt.Sprintf("%s/namespace", kustomizev1.GroupVersion.Group),
|
||||||
|
}
|
||||||
|
|
||||||
|
// fluxClusterInfo contains information about an existing flux installation on a cluster.
|
||||||
|
type fluxClusterInfo struct {
|
||||||
|
// bootstrapped indicates that Flux was installed using the `flux bootstrap` command.
|
||||||
|
bootstrapped bool
|
||||||
|
// managedBy is the name of the tool being used to manage the installation of Flux.
|
||||||
|
managedBy string
|
||||||
|
// partOf indicates which distribution the instance is a part of.
|
||||||
|
partOf string
|
||||||
|
// version is the Flux version number in semver format.
|
||||||
|
version string
|
||||||
|
}
|
||||||
|
|
||||||
|
// getFluxClusterInfo returns information on the Flux installation running on the cluster.
|
||||||
|
// If an error occurred, the returned error will be non-nil.
|
||||||
|
//
|
||||||
|
// This function retrieves the GitRepository CRD from the cluster and checks it
|
||||||
|
// for a set of labels used to determine the Flux version and how Flux was installed.
|
||||||
|
// It returns the NotFound error from the underlying library if it was unable to find
|
||||||
|
// the GitRepository CRD and this can be used to check if Flux is installed.
|
||||||
|
func getFluxClusterInfo(ctx context.Context, c client.Client) (fluxClusterInfo, error) {
|
||||||
|
var info fluxClusterInfo
|
||||||
|
crdMetadata := &metav1.PartialObjectMetadata{
|
||||||
|
TypeMeta: metav1.TypeMeta{
|
||||||
|
APIVersion: apiextensionsv1.SchemeGroupVersion.String(),
|
||||||
|
Kind: "CustomResourceDefinition",
|
||||||
|
},
|
||||||
|
ObjectMeta: metav1.ObjectMeta{
|
||||||
|
Name: fmt.Sprintf("gitrepositories.%s", sourcev1.GroupVersion.Group),
|
||||||
|
},
|
||||||
|
}
|
||||||
|
if err := c.Get(ctx, client.ObjectKeyFromObject(crdMetadata), crdMetadata); err != nil {
|
||||||
|
return info, err
|
||||||
|
}
|
||||||
|
|
||||||
|
info.version = crdMetadata.Labels[manifestgen.VersionLabelKey]
|
||||||
|
|
||||||
|
var present bool
|
||||||
|
for _, l := range bootstrapLabels {
|
||||||
|
_, present = crdMetadata.Labels[l]
|
||||||
|
}
|
||||||
|
if present {
|
||||||
|
info.bootstrapped = true
|
||||||
|
}
|
||||||
|
|
||||||
|
// the `app.kubernetes.io/managed-by` label is not set by flux but might be set by other
|
||||||
|
// tools used to install Flux e.g Helm.
|
||||||
|
if manager, ok := crdMetadata.Labels["app.kubernetes.io/managed-by"]; ok {
|
||||||
|
info.managedBy = manager
|
||||||
|
}
|
||||||
|
|
||||||
|
if partOf, ok := crdMetadata.Labels[manifestgen.PartOfLabelKey]; ok {
|
||||||
|
info.partOf = partOf
|
||||||
|
}
|
||||||
|
return info, nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// confirmFluxInstallOverride displays a prompt to the user so that they can confirm before overriding
|
||||||
|
// a Flux installation. It returns nil if the installation should continue,
|
||||||
|
// promptui.ErrAbort if the user doesn't confirm, or an error encountered.
|
||||||
|
func confirmFluxInstallOverride(info fluxClusterInfo) error {
|
||||||
|
// no need to display prompt if installation is managed by Flux
|
||||||
|
if installManagedByFlux(info.managedBy) {
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
display := fmt.Sprintf("Flux %s has been installed on this cluster with %s!", info.version, info.managedBy)
|
||||||
|
fmt.Fprintln(rootCmd.ErrOrStderr(), display)
|
||||||
|
prompt := promptui.Prompt{
|
||||||
|
Label: fmt.Sprintf("Are you sure you want to override the %s installation? Y/N", info.managedBy),
|
||||||
|
IsConfirm: true,
|
||||||
|
}
|
||||||
|
_, err := prompt.Run()
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
func (info fluxClusterInfo) distribution() string {
|
||||||
|
distribution := info.version
|
||||||
|
if info.partOf != "" {
|
||||||
|
distribution = fmt.Sprintf("%s-%s", info.partOf, info.version)
|
||||||
|
}
|
||||||
|
return distribution
|
||||||
|
}
|
||||||
|
|
||||||
|
func installManagedByFlux(manager string) bool {
|
||||||
|
return manager == "" || manager == "flux"
|
||||||
|
}
|
||||||
@ -0,0 +1,141 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2023 The Flux authors
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
. "github.com/onsi/gomega"
|
||||||
|
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
|
||||||
|
"k8s.io/apimachinery/pkg/api/errors"
|
||||||
|
"k8s.io/apimachinery/pkg/runtime"
|
||||||
|
"sigs.k8s.io/controller-runtime/pkg/client/fake"
|
||||||
|
|
||||||
|
kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
|
||||||
|
ssautil "github.com/fluxcd/pkg/ssa/utils"
|
||||||
|
)
|
||||||
|
|
||||||
|
func Test_getFluxClusterInfo(t *testing.T) {
|
||||||
|
g := NewWithT(t)
|
||||||
|
f, err := os.Open("./testdata/cluster_info/gitrepositories.yaml")
|
||||||
|
g.Expect(err).To(BeNil())
|
||||||
|
|
||||||
|
objs, err := ssautil.ReadObjects(f)
|
||||||
|
g.Expect(err).To(Not(HaveOccurred()))
|
||||||
|
gitrepo := objs[0]
|
||||||
|
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
labels map[string]string
|
||||||
|
wantErr bool
|
||||||
|
wantInfo fluxClusterInfo
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "no git repository CRD present",
|
||||||
|
wantErr: true,
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "CRD with kustomize-controller labels",
|
||||||
|
labels: map[string]string{
|
||||||
|
fmt.Sprintf("%s/name", kustomizev1.GroupVersion.Group): "flux-system",
|
||||||
|
fmt.Sprintf("%s/namespace", kustomizev1.GroupVersion.Group): "flux-system",
|
||||||
|
"app.kubernetes.io/version": "v2.1.0",
|
||||||
|
},
|
||||||
|
wantInfo: fluxClusterInfo{
|
||||||
|
version: "v2.1.0",
|
||||||
|
bootstrapped: true,
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "CRD with kustomize-controller labels and managed-by label",
|
||||||
|
labels: map[string]string{
|
||||||
|
fmt.Sprintf("%s/name", kustomizev1.GroupVersion.Group): "flux-system",
|
||||||
|
fmt.Sprintf("%s/namespace", kustomizev1.GroupVersion.Group): "flux-system",
|
||||||
|
"app.kubernetes.io/version": "v2.1.0",
|
||||||
|
"app.kubernetes.io/managed-by": "flux",
|
||||||
|
},
|
||||||
|
wantInfo: fluxClusterInfo{
|
||||||
|
version: "v2.1.0",
|
||||||
|
bootstrapped: true,
|
||||||
|
managedBy: "flux",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "CRD with only managed-by label",
|
||||||
|
labels: map[string]string{
|
||||||
|
"app.kubernetes.io/version": "v2.1.0",
|
||||||
|
"app.kubernetes.io/managed-by": "helm",
|
||||||
|
},
|
||||||
|
wantInfo: fluxClusterInfo{
|
||||||
|
version: "v2.1.0",
|
||||||
|
managedBy: "helm",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "CRD with no labels",
|
||||||
|
labels: map[string]string{},
|
||||||
|
wantInfo: fluxClusterInfo{},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "CRD with only version label",
|
||||||
|
labels: map[string]string{
|
||||||
|
"app.kubernetes.io/version": "v2.1.0",
|
||||||
|
},
|
||||||
|
wantInfo: fluxClusterInfo{
|
||||||
|
version: "v2.1.0",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "CRD with version and part-of labels",
|
||||||
|
labels: map[string]string{
|
||||||
|
"app.kubernetes.io/version": "v2.1.0",
|
||||||
|
"app.kubernetes.io/part-of": "flux",
|
||||||
|
},
|
||||||
|
wantInfo: fluxClusterInfo{
|
||||||
|
version: "v2.1.0",
|
||||||
|
partOf: "flux",
|
||||||
|
},
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tt := range tests {
|
||||||
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
g := NewWithT(t)
|
||||||
|
newscheme := runtime.NewScheme()
|
||||||
|
apiextensionsv1.AddToScheme(newscheme)
|
||||||
|
builder := fake.NewClientBuilder().WithScheme(newscheme)
|
||||||
|
if tt.labels != nil {
|
||||||
|
gitrepo.SetLabels(tt.labels)
|
||||||
|
builder = builder.WithRuntimeObjects(gitrepo)
|
||||||
|
}
|
||||||
|
|
||||||
|
client := builder.Build()
|
||||||
|
info, err := getFluxClusterInfo(context.Background(), client)
|
||||||
|
if tt.wantErr {
|
||||||
|
g.Expect(err).To(HaveOccurred())
|
||||||
|
g.Expect(errors.IsNotFound(err)).To(BeTrue())
|
||||||
|
} else {
|
||||||
|
g.Expect(err).To(Not(HaveOccurred()))
|
||||||
|
}
|
||||||
|
|
||||||
|
g.Expect(info).To(BeEquivalentTo(tt.wantInfo))
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,161 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024 The Flux authors
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"context"
|
||||||
|
"encoding/json"
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
|
||||||
|
"github.com/fluxcd/flux2/v2/internal/utils"
|
||||||
|
"github.com/fluxcd/flux2/v2/pkg/manifestgen/sourcesecret"
|
||||||
|
"github.com/notaryproject/notation-go/verifier/trustpolicy"
|
||||||
|
"github.com/spf13/cobra"
|
||||||
|
corev1 "k8s.io/api/core/v1"
|
||||||
|
"sigs.k8s.io/yaml"
|
||||||
|
)
|
||||||
|
|
||||||
|
var createSecretNotationCmd = &cobra.Command{
|
||||||
|
Use: "notation [name]",
|
||||||
|
Short: "Create or update a Kubernetes secret for verifications of artifacts signed by Notation",
|
||||||
|
Long: withPreviewNote(`The create secret notation command generates a Kubernetes secret with root ca certificates and trust policy.`),
|
||||||
|
Example: ` # Create a Notation configuration secret on disk and encrypt it with Mozilla SOPS
|
||||||
|
flux create secret notation my-notation-cert \
|
||||||
|
--namespace=my-namespace \
|
||||||
|
--trust-policy-file=./my-trust-policy.json \
|
||||||
|
--ca-cert-file=./my-cert.crt \
|
||||||
|
--export > my-notation-cert.yaml
|
||||||
|
|
||||||
|
sops --encrypt --encrypted-regex '^(data|stringData)$' \
|
||||||
|
--in-place my-notation-cert.yaml`,
|
||||||
|
|
||||||
|
RunE: createSecretNotationCmdRun,
|
||||||
|
}
|
||||||
|
|
||||||
|
type secretNotationFlags struct {
|
||||||
|
trustPolicyFile string
|
||||||
|
caCrtFile []string
|
||||||
|
}
|
||||||
|
|
||||||
|
var secretNotationArgs secretNotationFlags
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
createSecretNotationCmd.Flags().StringVar(&secretNotationArgs.trustPolicyFile, "trust-policy-file", "", "notation trust policy file path")
|
||||||
|
createSecretNotationCmd.Flags().StringSliceVar(&secretNotationArgs.caCrtFile, "ca-cert-file", []string{}, "root ca cert file path")
|
||||||
|
|
||||||
|
createSecretCmd.AddCommand(createSecretNotationCmd)
|
||||||
|
}
|
||||||
|
|
||||||
|
func createSecretNotationCmdRun(cmd *cobra.Command, args []string) error {
|
||||||
|
if len(args) < 1 {
|
||||||
|
return fmt.Errorf("name is required")
|
||||||
|
}
|
||||||
|
|
||||||
|
if secretNotationArgs.caCrtFile == nil || len(secretNotationArgs.caCrtFile) == 0 {
|
||||||
|
return fmt.Errorf("--ca-cert-file is required")
|
||||||
|
}
|
||||||
|
|
||||||
|
if secretNotationArgs.trustPolicyFile == "" {
|
||||||
|
return fmt.Errorf("--trust-policy-file is required")
|
||||||
|
}
|
||||||
|
|
||||||
|
name := args[0]
|
||||||
|
|
||||||
|
labels, err := parseLabels()
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
policy, err := os.ReadFile(secretNotationArgs.trustPolicyFile)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("unable to read trust policy file: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var doc trustpolicy.Document
|
||||||
|
|
||||||
|
if err := json.Unmarshal(policy, &doc); err != nil {
|
||||||
|
return fmt.Errorf("failed to unmarshal trust policy %s: %w", secretNotationArgs.trustPolicyFile, err)
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := doc.Validate(); err != nil {
|
||||||
|
return fmt.Errorf("invalid trust policy: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
var (
|
||||||
|
caCerts []sourcesecret.VerificationCrt
|
||||||
|
fileErr error
|
||||||
|
)
|
||||||
|
for _, caCrtFile := range secretNotationArgs.caCrtFile {
|
||||||
|
fileName := filepath.Base(caCrtFile)
|
||||||
|
if !strings.HasSuffix(fileName, ".crt") && !strings.HasSuffix(fileName, ".pem") {
|
||||||
|
fileErr = errors.Join(fileErr, fmt.Errorf("%s must end with either .crt or .pem", fileName))
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
caBundle, err := os.ReadFile(caCrtFile)
|
||||||
|
if err != nil {
|
||||||
|
fileErr = errors.Join(fileErr, fmt.Errorf("unable to read TLS CA file: %w", err))
|
||||||
|
continue
|
||||||
|
}
|
||||||
|
caCerts = append(caCerts, sourcesecret.VerificationCrt{Name: fileName, CACrt: caBundle})
|
||||||
|
}
|
||||||
|
|
||||||
|
if fileErr != nil {
|
||||||
|
return fileErr
|
||||||
|
}
|
||||||
|
|
||||||
|
if len(caCerts) == 0 {
|
||||||
|
return fmt.Errorf("no CA certs found")
|
||||||
|
}
|
||||||
|
|
||||||
|
opts := sourcesecret.Options{
|
||||||
|
Name: name,
|
||||||
|
Namespace: *kubeconfigArgs.Namespace,
|
||||||
|
Labels: labels,
|
||||||
|
VerificationCrts: caCerts,
|
||||||
|
TrustPolicy: policy,
|
||||||
|
}
|
||||||
|
secret, err := sourcesecret.Generate(opts)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
if createArgs.export {
|
||||||
|
rootCmd.Println(secret.Content)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
||||||
|
defer cancel()
|
||||||
|
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
var s corev1.Secret
|
||||||
|
if err := yaml.Unmarshal([]byte(secret.Content), &s); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
if err := upsertSecret(ctx, kubeClient, s); err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
|
||||||
|
logger.Actionf("notation configuration secret '%s' created in '%s' namespace", name, *kubeconfigArgs.Namespace)
|
||||||
|
return nil
|
||||||
|
}
|
||||||
@ -0,0 +1,124 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024 The Flux authors
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
trustPolicy = "./testdata/create_secret/notation/test-trust-policy.json"
|
||||||
|
invalidTrustPolicy = "./testdata/create_secret/notation/invalid-trust-policy.json"
|
||||||
|
invalidJson = "./testdata/create_secret/notation/invalid.json"
|
||||||
|
testCertFolder = "./testdata/create_secret/notation"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestCreateNotationSecret(t *testing.T) {
|
||||||
|
crt, err := os.Create(filepath.Join(t.TempDir(), "ca.crt"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal("could not create ca.crt file")
|
||||||
|
}
|
||||||
|
|
||||||
|
pem, err := os.Create(filepath.Join(t.TempDir(), "ca.pem"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal("could not create ca.pem file")
|
||||||
|
}
|
||||||
|
|
||||||
|
invalidCert, err := os.Create(filepath.Join(t.TempDir(), "ca.p12"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal("could not create ca.p12 file")
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err = crt.Write([]byte("ca-data-crt"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal("could not write to crt certificate file")
|
||||||
|
}
|
||||||
|
|
||||||
|
_, err = pem.Write([]byte("ca-data-pem"))
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal("could not write to pem certificate file")
|
||||||
|
}
|
||||||
|
|
||||||
|
tests := []struct {
|
||||||
|
name string
|
||||||
|
args string
|
||||||
|
assert assertFunc
|
||||||
|
}{
|
||||||
|
{
|
||||||
|
name: "no args",
|
||||||
|
args: "create secret notation",
|
||||||
|
assert: assertError("name is required"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "no trust policy",
|
||||||
|
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s", testCertFolder),
|
||||||
|
assert: assertError("--trust-policy-file is required"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "no cert",
|
||||||
|
args: fmt.Sprintf("create secret notation notation-config --trust-policy-file=%s", trustPolicy),
|
||||||
|
assert: assertError("--ca-cert-file is required"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "non pem and crt cert",
|
||||||
|
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s", invalidCert.Name(), trustPolicy),
|
||||||
|
assert: assertError("ca.p12 must end with either .crt or .pem"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "invalid trust policy",
|
||||||
|
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s", t.TempDir(), invalidTrustPolicy),
|
||||||
|
assert: assertError("invalid trust policy: a trust policy statement is missing a name, every statement requires a name"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "invalid trust policy json",
|
||||||
|
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s", t.TempDir(), invalidJson),
|
||||||
|
assert: assertError(fmt.Sprintf("failed to unmarshal trust policy %s: json: cannot unmarshal string into Go value of type trustpolicy.Document", invalidJson)),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "crt secret",
|
||||||
|
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s --namespace=my-namespace --export", crt.Name(), trustPolicy),
|
||||||
|
assert: assertGoldenFile("./testdata/create_secret/notation/secret-ca-crt.yaml"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "pem secret",
|
||||||
|
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s --namespace=my-namespace --export", pem.Name(), trustPolicy),
|
||||||
|
assert: assertGoldenFile("./testdata/create_secret/notation/secret-ca-pem.yaml"),
|
||||||
|
},
|
||||||
|
{
|
||||||
|
name: "multi secret",
|
||||||
|
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --ca-cert-file=%s --trust-policy-file=%s --namespace=my-namespace --export", crt.Name(), pem.Name(), trustPolicy),
|
||||||
|
assert: assertGoldenFile("./testdata/create_secret/notation/secret-ca-multi.yaml"),
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
for _, tt := range tests {
|
||||||
|
t.Run(tt.name, func(t *testing.T) {
|
||||||
|
defer func() {
|
||||||
|
secretNotationArgs = secretNotationFlags{}
|
||||||
|
}()
|
||||||
|
|
||||||
|
cmd := cmdTestCase{
|
||||||
|
args: tt.args,
|
||||||
|
assert: tt.assert,
|
||||||
|
}
|
||||||
|
cmd.runTestCmd(t)
|
||||||
|
})
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,74 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024 The Flux authors
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bufio"
|
||||||
|
"fmt"
|
||||||
|
|
||||||
|
"github.com/fluxcd/pkg/envsubst"
|
||||||
|
"github.com/spf13/cobra"
|
||||||
|
)
|
||||||
|
|
||||||
|
var envsubstCmd = &cobra.Command{
|
||||||
|
Use: "envsubst",
|
||||||
|
Args: cobra.NoArgs,
|
||||||
|
Short: "envsubst substitutes the values of environment variables",
|
||||||
|
Long: withPreviewNote(`The envsubst command substitutes the values of environment variables
|
||||||
|
in the string piped as standard input and writes the result to the standard output. This command can be used
|
||||||
|
to replicate the behavior of the Flux Kustomization post-build substitutions.`),
|
||||||
|
Example: ` # Run env var substitutions on the kustomization build output
|
||||||
|
export cluster_region=eu-central-1
|
||||||
|
kustomize build . | flux envsubst
|
||||||
|
|
||||||
|
# Run env var substitutions and error out if a variable is not set
|
||||||
|
kustomize build . | flux envsubst --strict
|
||||||
|
`,
|
||||||
|
RunE: runEnvsubstCmd,
|
||||||
|
}
|
||||||
|
|
||||||
|
type envsubstFlags struct {
|
||||||
|
strict bool
|
||||||
|
}
|
||||||
|
|
||||||
|
var envsubstArgs envsubstFlags
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
envsubstCmd.Flags().BoolVar(&envsubstArgs.strict, "strict", false,
|
||||||
|
"fail if a variable without a default value is declared in the input but is missing from the environment")
|
||||||
|
rootCmd.AddCommand(envsubstCmd)
|
||||||
|
}
|
||||||
|
|
||||||
|
func runEnvsubstCmd(cmd *cobra.Command, args []string) error {
|
||||||
|
stdin := bufio.NewScanner(rootCmd.InOrStdin())
|
||||||
|
stdout := bufio.NewWriter(rootCmd.OutOrStdout())
|
||||||
|
for stdin.Scan() {
|
||||||
|
line, err := envsubst.EvalEnv(stdin.Text(), envsubstArgs.strict)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
_, err = fmt.Fprintln(stdout, line)
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
err = stdout.Flush()
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
@ -0,0 +1,50 @@
|
|||||||
|
/*
|
||||||
|
Copyright 2024 The Flux authors
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"os"
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
. "github.com/onsi/gomega"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestEnvsubst(t *testing.T) {
|
||||||
|
g := NewWithT(t)
|
||||||
|
input, err := os.ReadFile("testdata/envsubst/file.yaml")
|
||||||
|
g.Expect(err).NotTo(HaveOccurred())
|
||||||
|
|
||||||
|
t.Setenv("REPO_NAME", "test")
|
||||||
|
|
||||||
|
output, err := executeCommandWithIn("envsubst", bytes.NewReader(input))
|
||||||
|
g.Expect(err).NotTo(HaveOccurred())
|
||||||
|
|
||||||
|
expected, err := os.ReadFile("testdata/envsubst/file.gold")
|
||||||
|
g.Expect(err).NotTo(HaveOccurred())
|
||||||
|
g.Expect(output).To(Equal(string(expected)))
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestEnvsubst_Strinct(t *testing.T) {
|
||||||
|
g := NewWithT(t)
|
||||||
|
input, err := os.ReadFile("testdata/envsubst/file.yaml")
|
||||||
|
g.Expect(err).NotTo(HaveOccurred())
|
||||||
|
|
||||||
|
_, err = executeCommandWithIn("envsubst --strict", bytes.NewReader(input))
|
||||||
|
g.Expect(err).To(HaveOccurred())
|
||||||
|
g.Expect(err.Error()).To(ContainSubstring("variable not set (strict mode)"))
|
||||||
|
}
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue