This switches to a secure FS implementation in most places, except for
where we can not make changes at this moment because it would break
behavior.
Not handled in this commit:
- Allowing the root for `manifestgen` packages to be configured.
- Allowing the user to define a working root while building locally.
- Defaulting to the secure FS implementation in
`kustomization.MakeDefaultOptions`. Problem here is that constructing
the secure FS could result in an error, which we can not surface
without signature changes to the constructor func.
Signed-off-by: Hidde Beydals <hello@hidde.co>
The creation of oldConditions, statusableConditions and
reconcilableConditions is an adhoc solution to deal with the upstream
changes on `pkg/apis/meta`, which are yet to be replicated across other
Flux API components.
Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>
When running bootstrap in-parallel for many clusters that target the same repository, the 2nd commit with the sync files fails with ` non-fast-forward update`. We now detect the conflict, and we retry the operations by creating a fresh clone from upstream.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
If implemented, there will a common interface to print flux resource.
We are adding new way to print resource information e.g. diff of
objects.
Signed-off-by: Soule BA <soule@weave.works>
This commit migrate to the last version of pkg/ssa v0.14.1 that contains a fix
for stringData secrets. The test case was changed accordingly to
validate a stringData drift.
A progress-bar flag option has also been added in order to be able to
disable it.
Signed-off-by: Soule BA <soule@weave.works>
- in `flux bootstrap` and `flux create kustomization` etc.
- E.g. for example `--path=.flux` should work now
- Previous behaviour is to strip off any leading "." and leave you with
"./flux" in the kustomizations / folder structure generated by `flux
bootstrap`
Signed-off-by: Simon Howe <footless@gmail.com>
If implemented, flux diff kustomization will managed correctly sops
managed dockerconfigjson secrets.
Sops encrypted secret with stringData maps are supported too.
Signed-off-by: Soule BA <soule@weave.works>
If implemented, when an error happens when dry-running an object, we
return early. This match pkg ssa implementation
Signed-off-by: Soule BA <soule@weave.works>
If implemented, calling the diff command on kustomization will return 0,
1(if changes are identified), >1 for errors.
Signed-off-by: Soule BA <soule@weave.works>
If implemented it will permit queriying the Kubernetes API to fetch the specified
Flux Kustomization, then uses the specified path to build the overlay.
It will then ssa-dry-run apply and output the diff using homeport/dyff
Signed-off-by: Soule BA <soule@weave.works>
If implemented it will permit queriying the Kubernetes API to fetch the specified
Flux Kustomization, then uses the specified path to build
the overlay.
Signed-off-by: Soule BA <soule@weave.works>
The new command set is:
flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --hostname=<domain> --token-auth
There is a parity in the capabilities with the other providers.
Signed-off-by: Soule BA <soule@weave.works>
The `flux tree kustomization` command prints the resources reconciled by the given Kustomization.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
When a user provided the `--ca-file` flag to the `bootstrap` command,
the given CA file wasn't taken into account for cloning the repository
locally. It was just passed along to the CR that is created so Flux
can make use of it when cloning the repository in-cluster.
However, users may not want to add a custom CA to their local host's
trust chain and may expect the `--ca-file` flag to be respected also
for cloning the repository locally. This is what this commit
accomplishes.
closes#1775
Signed-off-by: Max Jonas Werner <mail@makk.es>
Remove use of the fake client, and replace with a real client connected to the
testEnv.
This required fixes to the yaml files as the testEnv has stricter verifcation
of objects. This also meant it was not possible to test a GitRepository with
a missing artifact since that is not a valid state.
The tests are slower than before, taking around 7-10 seconds each because the
testEnv is setup and destroyed for every test. These will be sped up in a
follow up PR.
Signed-off-by: Allen Porter <allen@thebends.org>
The new flag fetch and display the request ressource and then continue
watching the ressource until timeout or cancellation.
A single ressource/ressource type is supported.
Signed-off-by: Soule BA <soule@weave.works>
Add tests for flux trace command that fake out the kubernetes client,
load objects from a yaml file and create them in the client, and
assert on the output of the trace command to an expected golden file.
This is a follow up from the suggestions in PR https://github.com/fluxcd/flux2/pull/1626 which suggested that additional
testing would be helpful. This test approach is modeled after the helm command tests.
This required some changes to the kubernetes client setup to make it
possible to use a fake. If we agree this pattern makes sense, it can be
applied to other commands.
Signed-off-by: Allen Porter <allen@thebends.org>
The trace command allows Flux users to point the CLI to a Kubernetes object in-cluster and get a detailed report about the GitOps pipeline that manages that particular object.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
Based on observations in
https://github.com/fluxcd/flux2/runs/2410633975:
1. Print error correctly by switching from `%w` to `%s`
2. Only print the change messsage if there has not been an error.
Signed-off-by: Hidde Beydals <hello@hidde.co>
Pushing the first branch is sufficient to set a default, and the
`README.md` (and/or LICENSE) can better be pushed later on so commit
author and templates be configured.
This was already done for User in an earlier patch release.
Signed-off-by: Hidde Beydals <hello@hidde.co>
The behavior introduced during the introduction of go-git-providers
was more strict, and has proven pretty quickly to not be useful to
all users. Therefore, the reconciliation behavior for repository
configuration has been put behind an opt-in flag, so that it does
not overwrite people their configs by accident.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This is useful in case the `Kustomization` does not reconcile
successfully because for example the controller(s) are in a crash loop,
which is not visible in the resource itself.
Signed-off-by: Hidde Beydals <hello@hidde.co>
We have observed that the code at times outperforms GitHub mechanics,
resulting in not found errors that are only true for a millisecond.
Retrying those actions once with a 2 second delay should be more
friendly to users.
Signed-off-by: Hidde Beydals <hello@hidde.co>
Using the `--commit-message-appendix` flag a string can be added to the
commit messages made by the bootstrapper process to for example skip CI
actions from executing using e.g. `[skip ci]`.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This commit factors out the bootstrap logic into a new `bootstrap`
package, while also moving to `go-git-providers` to handle things
around Git providers (e.g. repository creation, deploy key
upsertions).
The `GitProviderBootstrapper` is a superset of the
`PlainGitBootstrapper` that besides `Reconciler` also implements the
`RepositoryReconciler`.
The Git actions rely on an interface, making it easier to support
other implementations than `go-git` at a later moment, to for example
support bootstrapping to Git servers that only support the v2 protocol.
Signed-off-by: Hidde Beydals <hello@hidde.co>
- deletes Flux components (deployments and services)
- deletes Flux RBAC (service accounts, cluster roles and cluster role bindings)
- removes the Kubernetes finalizers from Flux custom resources
- deletes Flux custom resource definitions and custom resources
- deletes the namespace where Flux was installed
- preserves the Kubernetes objects and Helm releases that were reconciled on the cluster by Flux
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
So that `<kind>/<name>` flags can be supplied as:
* `secret/foo`
* `Secret/foo`
* `SeCrEt/foo`
But result in: `Secret/foo`.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This includes various bug fixes, especially around the area of missing
names for `<kind>/<name>` formats.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This commit adds multiple safe guards for relative paths, ensuring they
never traverse outside the working directory.
The `SafeRelativePath` flag calculates the safe relative path based on a
relative base dir, which results in a flattened path.
The write methods of `manifestgen` make use of the `SecureJoin` as well,
to ensure writes are never outside of the given directory when used as
a lib outside of the CLI.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This adds all the standard subcommands for the ImageRepository type.
Following `source`, I have put them under a namespace: `auto`,
referring to automation.
NB For `create` I use controllerutil.CreateOrUpdate, which looks to me
like a slightly more rounded version of the upsert* funcs.
Signed-off-by: Michael Bridgen <michael@weave.works>
This works around another bug on Windows platforms that would cause the
kustomize-controller to choke on the kustomization.yaml generated by the
bootstrap command due to the filepath being in a Windows format.
By using `filepath.Rel`, the output is _just_ the filename for files
relative to the bootstrap path, which is at the moment sufficient to
make it work.
Signed-off-by: Hidde Beydals <hello@hidde.co>
Stefan Prodan
Somtochi Onyekwere
Hidde Beydals
Sanskar Jaiswal
Soule BA
Paulo Gomes
Simon Howe
Aurel Canciu
Jakob Schrettenbrunner
Kazuki Suda
Max Jonas Werner
Allen Porter
Chanwit Kaewkasi
Dmitry Rybin
Sunny
Michael Bridgen
Dylan Arbour
Alexei Ledenev
Sylvain Rabot