mirror of https://github.com/fluxcd/flux2.git
Compare commits
24 Commits
| Author | SHA1 | Date |
|---|---|---|
Hidde Beydals
|
5c5c15ea21 | 1 year ago |
Hidde Beydals
|
775838d3ad | 1 year ago |
|
Hidde Beydals
|
eaae83efa4 | 1 year ago |
fluxcdbot
|
c1f7f20454 | 1 year ago |
|
Hidde Beydals
|
bba9e0952d | 1 year ago |
Stuebinger, Bernd
|
0ea68fd43b | 1 year ago |
|
Hidde Beydals
|
492b50e4f0 | 1 year ago |
dependabot[bot]
|
f46f59bbba | 1 year ago |
|
Hidde Beydals
|
2eb52e314a | 1 year ago |
|
dependabot[bot]
|
06dd89e160 | 1 year ago |
|
Hidde Beydals
|
2ac481c889 | 1 year ago |
|
dependabot[bot]
|
f434fed50f | 1 year ago |
|
Hidde Beydals
|
01f43fc109 | 1 year ago |
|
dependabot[bot]
|
c369c06731 | 1 year ago |
|
Hidde Beydals
|
9b3958825a | 1 year ago |
|
Hidde Beydals
|
f581add81c | 1 year ago |
|
Hidde Beydals
|
107dbd09ab | 1 year ago |
|
fluxcdbot
|
ec034c0c3c | 1 year ago |
|
Hidde Beydals
|
012782448e | 1 year ago |
Stefan Prodan
|
6be9ce2d4e | 1 year ago |
|
Stefan Prodan
|
0a380b1495 | 1 year ago |
Sven Hoexter
|
aae92ee097 | 1 year ago |
|
Hidde Beydals
|
459f6f2c24 | 1 year ago |
|
Hidde Beydals
|
986e405ada | 1 year ago |
@ -1,9 +1,5 @@
|
|||||||
kind: Cluster
|
kind: Cluster
|
||||||
apiVersion: kind.x-k8s.io/v1alpha4
|
apiVersion: kind.x-k8s.io/v1alpha4
|
||||||
nodes:
|
|
||||||
- role: control-plane
|
|
||||||
- role: worker
|
|
||||||
- role: worker
|
|
||||||
networking:
|
networking:
|
||||||
disableDefaultCNI: true # disable kindnet
|
disableDefaultCNI: true # disable kindnet
|
||||||
podSubnet: 192.168.0.0/16 # set to Calico's default subnet
|
podSubnet: 192.168.0.0/16 # set to Calico's default subnet
|
||||||
|
|||||||
@ -1,256 +0,0 @@
|
|||||||
name: conformance
|
|
||||||
|
|
||||||
on:
|
|
||||||
workflow_dispatch:
|
|
||||||
push:
|
|
||||||
branches: [ 'main', 'update-components', 'release/**', 'conform*' ]
|
|
||||||
|
|
||||||
permissions:
|
|
||||||
contents: read
|
|
||||||
|
|
||||||
env:
|
|
||||||
GO_VERSION: 1.23.x
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
conform-kubernetes:
|
|
||||||
runs-on:
|
|
||||||
group: "ARM64"
|
|
||||||
strategy:
|
|
||||||
matrix:
|
|
||||||
# Keep this list up-to-date with https://endoflife.date/kubernetes
|
|
||||||
# Build images with https://github.com/fluxcd/flux-benchmark/actions/workflows/build-kind.yaml
|
|
||||||
KUBERNETES_VERSION: [1.30.9, 1.31.5, 1.32.1 ]
|
|
||||||
fail-fast: false
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
||||||
- name: Setup Go
|
|
||||||
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
|
|
||||||
with:
|
|
||||||
go-version: ${{ env.GO_VERSION }}
|
|
||||||
cache-dependency-path: |
|
|
||||||
**/go.sum
|
|
||||||
**/go.mod
|
|
||||||
- name: Prepare
|
|
||||||
id: prep
|
|
||||||
run: |
|
|
||||||
ID=${GITHUB_SHA:0:7}-${{ matrix.KUBERNETES_VERSION }}-$(date +%s)
|
|
||||||
echo "CLUSTER=arm64-${ID}" >> $GITHUB_OUTPUT
|
|
||||||
- name: Build
|
|
||||||
run: |
|
|
||||||
make build
|
|
||||||
- name: Setup Kubernetes
|
|
||||||
uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3 # v1.12.0
|
|
||||||
with:
|
|
||||||
version: v0.22.0
|
|
||||||
cluster_name: ${{ steps.prep.outputs.CLUSTER }}
|
|
||||||
node_image: ghcr.io/fluxcd/kindest/node:v${{ matrix.KUBERNETES_VERSION }}-arm64
|
|
||||||
- name: Run e2e tests
|
|
||||||
run: TEST_KUBECONFIG=$HOME/.kube/config make e2e
|
|
||||||
- name: Run multi-tenancy tests
|
|
||||||
run: |
|
|
||||||
./bin/flux install
|
|
||||||
./bin/flux create source git flux-system \
|
|
||||||
--interval=15m \
|
|
||||||
--url=https://github.com/fluxcd/flux2-multi-tenancy \
|
|
||||||
--branch=main \
|
|
||||||
--ignore-paths="./clusters/**/flux-system/"
|
|
||||||
./bin/flux create kustomization flux-system \
|
|
||||||
--interval=15m \
|
|
||||||
--source=flux-system \
|
|
||||||
--path=./clusters/staging
|
|
||||||
kubectl -n flux-system wait kustomization/tenants --for=condition=ready --timeout=5m
|
|
||||||
kubectl -n apps wait kustomization/dev-team --for=condition=ready --timeout=1m
|
|
||||||
kubectl -n apps wait helmrelease/podinfo --for=condition=ready --timeout=1m
|
|
||||||
- name: Debug failure
|
|
||||||
if: failure()
|
|
||||||
run: |
|
|
||||||
kubectl -n flux-system get all
|
|
||||||
kubectl -n flux-system describe po
|
|
||||||
kubectl -n flux-system logs deploy/source-controller
|
|
||||||
kubectl -n flux-system logs deploy/kustomize-controller
|
|
||||||
|
|
||||||
conform-k3s:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
strategy:
|
|
||||||
matrix:
|
|
||||||
# Keep this list up-to-date with https://endoflife.date/kubernetes
|
|
||||||
# Available versions can be found with "replicated cluster versions"
|
|
||||||
K3S_VERSION: [ 1.30.9, 1.31.5, 1.32.1 ]
|
|
||||||
fail-fast: false
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
||||||
- name: Setup Go
|
|
||||||
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
|
|
||||||
with:
|
|
||||||
go-version: ${{ env.GO_VERSION }}
|
|
||||||
cache-dependency-path: |
|
|
||||||
**/go.sum
|
|
||||||
**/go.mod
|
|
||||||
- name: Prepare
|
|
||||||
id: prep
|
|
||||||
run: |
|
|
||||||
ID=${GITHUB_SHA:0:7}-${{ matrix.K3S_VERSION }}-$(date +%s)
|
|
||||||
PSEUDO_RAND_SUFFIX=$(echo "${ID}" | shasum | awk '{print $1}')
|
|
||||||
echo "cluster=flux2-k3s-${PSEUDO_RAND_SUFFIX}" >> $GITHUB_OUTPUT
|
|
||||||
KUBECONFIG_PATH="$(git rev-parse --show-toplevel)/bin/kubeconfig.yaml"
|
|
||||||
echo "kubeconfig-path=${KUBECONFIG_PATH}" >> $GITHUB_OUTPUT
|
|
||||||
- name: Setup Kustomize
|
|
||||||
uses: fluxcd/pkg/actions/kustomize@c964ce7b91949ff4b5e3959db4f1d7bb2e029a49 # main
|
|
||||||
- name: Build
|
|
||||||
run: make build-dev
|
|
||||||
- name: Create repository
|
|
||||||
run: |
|
|
||||||
gh repo create --private --add-readme fluxcd-testing/${{ steps.prep.outputs.cluster }}
|
|
||||||
env:
|
|
||||||
GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
|
|
||||||
- name: Create cluster
|
|
||||||
id: create-cluster
|
|
||||||
uses: replicatedhq/replicated-actions/create-cluster@c98ab3b97925af5db9faf3f9676df7a9c6736985 # v1.17.0
|
|
||||||
with:
|
|
||||||
api-token: ${{ secrets.REPLICATED_API_TOKEN }}
|
|
||||||
kubernetes-distribution: "k3s"
|
|
||||||
kubernetes-version: ${{ matrix.K3S_VERSION }}
|
|
||||||
ttl: 20m
|
|
||||||
cluster-name: "${{ steps.prep.outputs.cluster }}"
|
|
||||||
kubeconfig-path: ${{ steps.prep.outputs.kubeconfig-path }}
|
|
||||||
export-kubeconfig: true
|
|
||||||
- name: Run e2e tests
|
|
||||||
run: TEST_KUBECONFIG=${{ steps.prep.outputs.kubeconfig-path }} make e2e
|
|
||||||
- name: Run flux bootstrap
|
|
||||||
run: |
|
|
||||||
./bin/flux bootstrap git --manifests ./manifests/install/ \
|
|
||||||
--components-extra=image-reflector-controller,image-automation-controller \
|
|
||||||
--url=https://github.com/fluxcd-testing/${{ steps.prep.outputs.cluster }} \
|
|
||||||
--branch=main \
|
|
||||||
--path=clusters/k3s \
|
|
||||||
--token-auth
|
|
||||||
env:
|
|
||||||
GIT_PASSWORD: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
|
|
||||||
- name: Run flux check
|
|
||||||
run: |
|
|
||||||
./bin/flux check
|
|
||||||
- name: Run flux reconcile
|
|
||||||
run: |
|
|
||||||
./bin/flux reconcile ks flux-system --with-source
|
|
||||||
./bin/flux get all
|
|
||||||
./bin/flux events
|
|
||||||
- name: Collect reconcile logs
|
|
||||||
if: ${{ always() }}
|
|
||||||
continue-on-error: true
|
|
||||||
run: |
|
|
||||||
kubectl -n flux-system get all
|
|
||||||
kubectl -n flux-system describe pods
|
|
||||||
kubectl -n flux-system logs deploy/source-controller
|
|
||||||
kubectl -n flux-system logs deploy/kustomize-controller
|
|
||||||
kubectl -n flux-system logs deploy/notification-controller
|
|
||||||
- name: Delete flux
|
|
||||||
run: |
|
|
||||||
./bin/flux uninstall -s --keep-namespace
|
|
||||||
kubectl delete ns flux-system --wait
|
|
||||||
- name: Delete cluster
|
|
||||||
if: ${{ always() }}
|
|
||||||
uses: replicatedhq/replicated-actions/remove-cluster@c98ab3b97925af5db9faf3f9676df7a9c6736985 # v1.17.0
|
|
||||||
continue-on-error: true
|
|
||||||
with:
|
|
||||||
api-token: ${{ secrets.REPLICATED_API_TOKEN }}
|
|
||||||
cluster-id: ${{ steps.create-cluster.outputs.cluster-id }}
|
|
||||||
- name: Delete repository
|
|
||||||
if: ${{ always() }}
|
|
||||||
continue-on-error: true
|
|
||||||
run: |
|
|
||||||
gh repo delete fluxcd-testing/${{ steps.prep.outputs.cluster }} --yes
|
|
||||||
env:
|
|
||||||
GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
|
|
||||||
|
|
||||||
conform-openshift:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
strategy:
|
|
||||||
matrix:
|
|
||||||
# Keep this list up-to-date with https://endoflife.date/red-hat-openshift
|
|
||||||
OPENSHIFT_VERSION: [ 4.17.0-okd ]
|
|
||||||
fail-fast: false
|
|
||||||
steps:
|
|
||||||
- name: Checkout
|
|
||||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
|
||||||
- name: Setup Go
|
|
||||||
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
|
|
||||||
with:
|
|
||||||
go-version: ${{ env.GO_VERSION }}
|
|
||||||
cache-dependency-path: |
|
|
||||||
**/go.sum
|
|
||||||
**/go.mod
|
|
||||||
- name: Prepare
|
|
||||||
id: prep
|
|
||||||
run: |
|
|
||||||
ID=${GITHUB_SHA:0:7}-${{ matrix.OPENSHIFT_VERSION }}-$(date +%s)
|
|
||||||
PSEUDO_RAND_SUFFIX=$(echo "${ID}" | shasum | awk '{print $1}')
|
|
||||||
echo "cluster=flux2-openshift-${PSEUDO_RAND_SUFFIX}" >> $GITHUB_OUTPUT
|
|
||||||
KUBECONFIG_PATH="$(git rev-parse --show-toplevel)/bin/kubeconfig.yaml"
|
|
||||||
echo "kubeconfig-path=${KUBECONFIG_PATH}" >> $GITHUB_OUTPUT
|
|
||||||
- name: Setup Kustomize
|
|
||||||
uses: fluxcd/pkg/actions/kustomize@c964ce7b91949ff4b5e3959db4f1d7bb2e029a49 # main
|
|
||||||
- name: Build
|
|
||||||
run: make build-dev
|
|
||||||
- name: Create repository
|
|
||||||
run: |
|
|
||||||
gh repo create --private --add-readme fluxcd-testing/${{ steps.prep.outputs.cluster }}
|
|
||||||
env:
|
|
||||||
GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
|
|
||||||
- name: Create cluster
|
|
||||||
id: create-cluster
|
|
||||||
uses: replicatedhq/replicated-actions/create-cluster@c98ab3b97925af5db9faf3f9676df7a9c6736985 # v1.17.0
|
|
||||||
with:
|
|
||||||
api-token: ${{ secrets.REPLICATED_API_TOKEN }}
|
|
||||||
kubernetes-distribution: "openshift"
|
|
||||||
kubernetes-version: ${{ matrix.OPENSHIFT_VERSION }}
|
|
||||||
ttl: 20m
|
|
||||||
cluster-name: "${{ steps.prep.outputs.cluster }}"
|
|
||||||
kubeconfig-path: ${{ steps.prep.outputs.kubeconfig-path }}
|
|
||||||
export-kubeconfig: true
|
|
||||||
- name: Run flux bootstrap
|
|
||||||
run: |
|
|
||||||
./bin/flux bootstrap git --manifests ./manifests/openshift/ \
|
|
||||||
--components-extra=image-reflector-controller,image-automation-controller \
|
|
||||||
--url=https://github.com/fluxcd-testing/${{ steps.prep.outputs.cluster }} \
|
|
||||||
--branch=main \
|
|
||||||
--path=clusters/openshift \
|
|
||||||
--token-auth
|
|
||||||
env:
|
|
||||||
GIT_PASSWORD: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
|
|
||||||
- name: Run flux check
|
|
||||||
run: |
|
|
||||||
./bin/flux check
|
|
||||||
- name: Run flux reconcile
|
|
||||||
run: |
|
|
||||||
./bin/flux reconcile ks flux-system --with-source
|
|
||||||
./bin/flux get all
|
|
||||||
./bin/flux events
|
|
||||||
- name: Collect reconcile logs
|
|
||||||
if: ${{ always() }}
|
|
||||||
continue-on-error: true
|
|
||||||
run: |
|
|
||||||
kubectl -n flux-system get all
|
|
||||||
kubectl -n flux-system describe pods
|
|
||||||
kubectl -n flux-system logs deploy/source-controller
|
|
||||||
kubectl -n flux-system logs deploy/kustomize-controller
|
|
||||||
kubectl -n flux-system logs deploy/notification-controller
|
|
||||||
- name: Delete flux
|
|
||||||
run: |
|
|
||||||
./bin/flux uninstall -s --keep-namespace
|
|
||||||
kubectl delete ns flux-system --wait
|
|
||||||
- name: Delete cluster
|
|
||||||
if: ${{ always() }}
|
|
||||||
uses: replicatedhq/replicated-actions/remove-cluster@c98ab3b97925af5db9faf3f9676df7a9c6736985 # v1.17.0
|
|
||||||
continue-on-error: true
|
|
||||||
with:
|
|
||||||
api-token: ${{ secrets.REPLICATED_API_TOKEN }}
|
|
||||||
cluster-id: ${{ steps.create-cluster.outputs.cluster-id }}
|
|
||||||
- name: Delete repository
|
|
||||||
if: ${{ always() }}
|
|
||||||
continue-on-error: true
|
|
||||||
run: |
|
|
||||||
gh repo delete fluxcd-testing/${{ steps.prep.outputs.cluster }} --yes
|
|
||||||
env:
|
|
||||||
GITHUB_TOKEN: ${{ secrets.GITPROVIDER_BOT_TOKEN }}
|
|
||||||
@ -0,0 +1,106 @@
|
|||||||
|
name: e2e-arm64
|
||||||
|
|
||||||
|
on:
|
||||||
|
workflow_dispatch:
|
||||||
|
push:
|
||||||
|
branches: [ 'main', 'update-components', 'e2e-*', 'release/**' ]
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
e2e-arm64-kubernetes:
|
||||||
|
# Hosted on Equinix
|
||||||
|
# Docs: https://github.com/fluxcd/flux2/tree/main/.github/runners
|
||||||
|
runs-on: [self-hosted, Linux, ARM64, equinix]
|
||||||
|
strategy:
|
||||||
|
matrix:
|
||||||
|
# Keep this list up-to-date with https://endoflife.date/kubernetes
|
||||||
|
# Check which versions are available on DockerHub with 'crane ls kindest/node'
|
||||||
|
KUBERNETES_VERSION: [ 1.26.6, 1.27.3, 1.28.0, 1.29.0 ]
|
||||||
|
fail-fast: false
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
|
||||||
|
with:
|
||||||
|
go-version: 1.20.x
|
||||||
|
cache-dependency-path: |
|
||||||
|
**/go.sum
|
||||||
|
**/go.mod
|
||||||
|
- name: Prepare
|
||||||
|
id: prep
|
||||||
|
run: |
|
||||||
|
ID=${GITHUB_SHA:0:7}-${{ matrix.KUBERNETES_VERSION }}-$(date +%s)
|
||||||
|
echo "CLUSTER=arm64-${ID}" >> $GITHUB_OUTPUT
|
||||||
|
- name: Build
|
||||||
|
run: |
|
||||||
|
make build
|
||||||
|
- name: Setup Kubernetes Kind
|
||||||
|
run: |
|
||||||
|
kind create cluster \
|
||||||
|
--wait 5m \
|
||||||
|
--name ${{ steps.prep.outputs.CLUSTER }} \
|
||||||
|
--kubeconfig=/tmp/${{ steps.prep.outputs.CLUSTER }} \
|
||||||
|
--image=kindest/node:v${{ matrix.KUBERNETES_VERSION }}
|
||||||
|
- name: Run e2e tests
|
||||||
|
run: TEST_KUBECONFIG=/tmp/${{ steps.prep.outputs.CLUSTER }} make e2e
|
||||||
|
- name: Run multi-tenancy tests
|
||||||
|
env:
|
||||||
|
KUBECONFIG: /tmp/${{ steps.prep.outputs.CLUSTER }}
|
||||||
|
run: |
|
||||||
|
./bin/flux install
|
||||||
|
./bin/flux create source git flux-system \
|
||||||
|
--interval=15m \
|
||||||
|
--url=https://github.com/fluxcd/flux2-multi-tenancy \
|
||||||
|
--branch=main \
|
||||||
|
--ignore-paths="./clusters/**/flux-system/"
|
||||||
|
./bin/flux create kustomization flux-system \
|
||||||
|
--interval=15m \
|
||||||
|
--source=flux-system \
|
||||||
|
--path=./clusters/staging
|
||||||
|
kubectl -n flux-system wait kustomization/tenants --for=condition=ready --timeout=5m
|
||||||
|
kubectl -n apps wait kustomization/dev-team --for=condition=ready --timeout=1m
|
||||||
|
kubectl -n apps wait helmrelease/podinfo --for=condition=ready --timeout=1m
|
||||||
|
- name: Run monitoring tests
|
||||||
|
# Keep this test in sync with https://fluxcd.io/flux/guides/monitoring/
|
||||||
|
env:
|
||||||
|
KUBECONFIG: /tmp/${{ steps.prep.outputs.CLUSTER }}
|
||||||
|
run: |
|
||||||
|
./bin/flux create source git flux-monitoring \
|
||||||
|
--interval=30m \
|
||||||
|
--url=https://github.com/fluxcd/flux2 \
|
||||||
|
--branch=${GITHUB_REF#refs/heads/}
|
||||||
|
./bin/flux create kustomization kube-prometheus-stack \
|
||||||
|
--interval=1h \
|
||||||
|
--prune \
|
||||||
|
--source=flux-monitoring \
|
||||||
|
--path="./manifests/monitoring/kube-prometheus-stack" \
|
||||||
|
--health-check-timeout=5m \
|
||||||
|
--wait
|
||||||
|
./bin/flux create kustomization monitoring-config \
|
||||||
|
--depends-on=kube-prometheus-stack \
|
||||||
|
--interval=1h \
|
||||||
|
--prune=true \
|
||||||
|
--source=flux-monitoring \
|
||||||
|
--path="./manifests/monitoring/monitoring-config" \
|
||||||
|
--health-check-timeout=1m \
|
||||||
|
--wait
|
||||||
|
kubectl -n flux-system wait kustomization/kube-prometheus-stack --for=condition=ready --timeout=5m
|
||||||
|
kubectl -n flux-system wait kustomization/monitoring-config --for=condition=ready --timeout=5m
|
||||||
|
kubectl -n monitoring wait helmrelease/kube-prometheus-stack --for=condition=ready --timeout=1m
|
||||||
|
- name: Debug failure
|
||||||
|
if: failure()
|
||||||
|
env:
|
||||||
|
KUBECONFIG: /tmp/${{ steps.prep.outputs.CLUSTER }}
|
||||||
|
run: |
|
||||||
|
kubectl -n flux-system get all
|
||||||
|
kubectl -n flux-system describe po
|
||||||
|
kubectl -n flux-system logs deploy/source-controller
|
||||||
|
kubectl -n flux-system logs deploy/kustomize-controller
|
||||||
|
- name: Cleanup
|
||||||
|
if: always()
|
||||||
|
run: |
|
||||||
|
kind delete cluster --name ${{ steps.prep.outputs.CLUSTER }}
|
||||||
|
rm /tmp/${{ steps.prep.outputs.CLUSTER }}
|
||||||
@ -1,5 +0,0 @@
|
|||||||
annotations:
|
|
||||||
- checks:
|
|
||||||
- dangerous-workflow
|
|
||||||
reasons:
|
|
||||||
- reason: not-applicable # This workflow does not run untrusted code, the bot will only backport a code if the a PR was approved and merged into main.
|
|
||||||
@ -1,86 +0,0 @@
|
|||||||
//go:build unit
|
|
||||||
// +build unit
|
|
||||||
|
|
||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import "testing"
|
|
||||||
|
|
||||||
func TestCreateHelmRelease(t *testing.T) {
|
|
||||||
tmpl := map[string]string{
|
|
||||||
"fluxns": allocateNamespace("flux-system"),
|
|
||||||
}
|
|
||||||
setupHRSource(t, tmpl)
|
|
||||||
|
|
||||||
tests := []struct {
|
|
||||||
name string
|
|
||||||
args string
|
|
||||||
assert assertFunc
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
name: "missing name",
|
|
||||||
args: "create helmrelease --export",
|
|
||||||
assert: assertError("name is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "missing chart template and chartRef",
|
|
||||||
args: "create helmrelease podinfo --export",
|
|
||||||
assert: assertError("chart or chart-ref is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "unknown source kind",
|
|
||||||
args: "create helmrelease podinfo --source foobar/podinfo --chart podinfo --export",
|
|
||||||
assert: assertError(`invalid argument "foobar/podinfo" for "--source" flag: source kind 'foobar' is not supported, must be one of: HelmRepository, GitRepository, Bucket`),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "unknown chart reference kind",
|
|
||||||
args: "create helmrelease podinfo --chart-ref foobar/podinfo --export",
|
|
||||||
assert: assertError(`chart reference kind 'foobar' is not supported, must be one of: OCIRepository, HelmChart`),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "basic helmrelease",
|
|
||||||
args: "create helmrelease podinfo --source Helmrepository/podinfo --chart podinfo --interval=1m0s --export",
|
|
||||||
assert: assertGoldenTemplateFile("testdata/create_hr/basic.yaml", tmpl),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "chart with OCIRepository source",
|
|
||||||
args: "create helmrelease podinfo --chart-ref OCIRepository/podinfo --interval=1m0s --export",
|
|
||||||
assert: assertGoldenTemplateFile("testdata/create_hr/or_basic.yaml", tmpl),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "chart with HelmChart source",
|
|
||||||
args: "create helmrelease podinfo --chart-ref HelmChart/podinfo --interval=1m0s --export",
|
|
||||||
assert: assertGoldenTemplateFile("testdata/create_hr/hc_basic.yaml", tmpl),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, tt := range tests {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.args + " -n " + tmpl["fluxns"],
|
|
||||||
assert: tt.assert,
|
|
||||||
}
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func setupHRSource(t *testing.T, tmpl map[string]string) {
|
|
||||||
t.Helper()
|
|
||||||
testEnv.CreateObjectFile("./testdata/create_hr/setup-source.yaml", tmpl, t)
|
|
||||||
}
|
|
||||||
@ -1,128 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
"os"
|
|
||||||
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/utils"
|
|
||||||
"github.com/fluxcd/flux2/v2/pkg/manifestgen/sourcesecret"
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
corev1 "k8s.io/api/core/v1"
|
|
||||||
"sigs.k8s.io/yaml"
|
|
||||||
)
|
|
||||||
|
|
||||||
var createSecretGitHubAppCmd = &cobra.Command{
|
|
||||||
Use: "githubapp [name]",
|
|
||||||
Short: "Create or update a github app secret",
|
|
||||||
Long: withPreviewNote(`The create secret githubapp command generates a Kubernetes secret that can be used for GitRepository authentication with github app`),
|
|
||||||
Example: ` # Create a githubapp authentication secret on disk and encrypt it with Mozilla SOPS
|
|
||||||
flux create secret githubapp podinfo-auth \
|
|
||||||
--app-id="1" \
|
|
||||||
--app-installation-id="2" \
|
|
||||||
--app-private-key=./private-key-file.pem \
|
|
||||||
--export > githubapp-auth.yaml
|
|
||||||
|
|
||||||
sops --encrypt --encrypted-regex '^(data|stringData)$' \
|
|
||||||
--in-place githubapp-auth.yaml
|
|
||||||
`,
|
|
||||||
RunE: createSecretGitHubAppCmdRun,
|
|
||||||
}
|
|
||||||
|
|
||||||
type secretGitHubAppFlags struct {
|
|
||||||
appID string
|
|
||||||
appInstallationID string
|
|
||||||
privateKeyFile string
|
|
||||||
baseURL string
|
|
||||||
}
|
|
||||||
|
|
||||||
var secretGitHubAppArgs = secretGitHubAppFlags{}
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
createSecretGitHubAppCmd.Flags().StringVar(&secretGitHubAppArgs.appID, "app-id", "", "github app ID")
|
|
||||||
createSecretGitHubAppCmd.Flags().StringVar(&secretGitHubAppArgs.appInstallationID, "app-installation-id", "", "github app installation ID")
|
|
||||||
createSecretGitHubAppCmd.Flags().StringVar(&secretGitHubAppArgs.privateKeyFile, "app-private-key", "", "github app private key file path")
|
|
||||||
createSecretGitHubAppCmd.Flags().StringVar(&secretGitHubAppArgs.baseURL, "app-base-url", "", "github app base URL")
|
|
||||||
|
|
||||||
createSecretCmd.AddCommand(createSecretGitHubAppCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func createSecretGitHubAppCmdRun(cmd *cobra.Command, args []string) error {
|
|
||||||
if len(args) < 1 {
|
|
||||||
return fmt.Errorf("name is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
secretName := args[0]
|
|
||||||
|
|
||||||
if secretGitHubAppArgs.appID == "" {
|
|
||||||
return fmt.Errorf("--app-id is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
if secretGitHubAppArgs.appInstallationID == "" {
|
|
||||||
return fmt.Errorf("--app-installation-id is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
if secretGitHubAppArgs.privateKeyFile == "" {
|
|
||||||
return fmt.Errorf("--app-private-key is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
privateKey, err := os.ReadFile(secretGitHubAppArgs.privateKeyFile)
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("unable to read private key file: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
opts := sourcesecret.Options{
|
|
||||||
Name: secretName,
|
|
||||||
Namespace: *kubeconfigArgs.Namespace,
|
|
||||||
GitHubAppID: secretGitHubAppArgs.appID,
|
|
||||||
GitHubAppInstallationID: secretGitHubAppArgs.appInstallationID,
|
|
||||||
GitHubAppPrivateKey: string(privateKey),
|
|
||||||
}
|
|
||||||
|
|
||||||
if secretGitHubAppArgs.baseURL != "" {
|
|
||||||
opts.GitHubAppBaseURL = secretGitHubAppArgs.baseURL
|
|
||||||
}
|
|
||||||
|
|
||||||
secret, err := sourcesecret.Generate(opts)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if createArgs.export {
|
|
||||||
rootCmd.Println(secret.Content)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
|
||||||
defer cancel()
|
|
||||||
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
var s corev1.Secret
|
|
||||||
if err := yaml.Unmarshal([]byte(secret.Content), &s); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if err := upsertSecret(ctx, kubeClient, s); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
logger.Actionf("githubapp secret '%s' created in '%s' namespace", secretName, *kubeconfigArgs.Namespace)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@ -1,74 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2022 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestCreateSecretGitHubApp(t *testing.T) {
|
|
||||||
tests := []struct {
|
|
||||||
name string
|
|
||||||
args string
|
|
||||||
assert assertFunc
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with missing name",
|
|
||||||
args: "create secret githubapp",
|
|
||||||
assert: assertError("name is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with missing app-id",
|
|
||||||
args: "create secret githubapp appinfo",
|
|
||||||
assert: assertError("--app-id is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with missing appInstallationID",
|
|
||||||
args: "create secret githubapp appinfo --app-id 1",
|
|
||||||
assert: assertError("--app-installation-id is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with missing private key file",
|
|
||||||
args: "create secret githubapp appinfo --app-id 1 --app-installation-id 2",
|
|
||||||
assert: assertError("--app-private-key is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with private key file that does not exist",
|
|
||||||
args: "create secret githubapp appinfo --app-id 1 --app-installation-id 2 --app-private-key pk.pem",
|
|
||||||
assert: assertError("unable to read private key file: open pk.pem: no such file or directory"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with app info",
|
|
||||||
args: "create secret githubapp appinfo --namespace my-namespace --app-id 1 --app-installation-id 2 --app-private-key ./testdata/create_secret/githubapp/test-private-key.pem --export",
|
|
||||||
assert: assertGoldenFile("testdata/create_secret/githubapp/secret.yaml"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with appinfo and base url",
|
|
||||||
args: "create secret githubapp appinfo --namespace my-namespace --app-id 1 --app-installation-id 2 --app-private-key ./testdata/create_secret/githubapp/test-private-key.pem --app-base-url www.example.com/api/v3 --export",
|
|
||||||
assert: assertGoldenFile("testdata/create_secret/githubapp/secret-with-baseurl.yaml"),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
for _, tt := range tests {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.args,
|
|
||||||
assert: tt.assert,
|
|
||||||
}
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,161 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"encoding/json"
|
|
||||||
"errors"
|
|
||||||
"fmt"
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"strings"
|
|
||||||
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/utils"
|
|
||||||
"github.com/fluxcd/flux2/v2/pkg/manifestgen/sourcesecret"
|
|
||||||
"github.com/notaryproject/notation-go/verifier/trustpolicy"
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
corev1 "k8s.io/api/core/v1"
|
|
||||||
"sigs.k8s.io/yaml"
|
|
||||||
)
|
|
||||||
|
|
||||||
var createSecretNotationCmd = &cobra.Command{
|
|
||||||
Use: "notation [name]",
|
|
||||||
Short: "Create or update a Kubernetes secret for verifications of artifacts signed by Notation",
|
|
||||||
Long: withPreviewNote(`The create secret notation command generates a Kubernetes secret with root ca certificates and trust policy.`),
|
|
||||||
Example: ` # Create a Notation configuration secret on disk and encrypt it with Mozilla SOPS
|
|
||||||
flux create secret notation my-notation-cert \
|
|
||||||
--namespace=my-namespace \
|
|
||||||
--trust-policy-file=./my-trust-policy.json \
|
|
||||||
--ca-cert-file=./my-cert.crt \
|
|
||||||
--export > my-notation-cert.yaml
|
|
||||||
|
|
||||||
sops --encrypt --encrypted-regex '^(data|stringData)$' \
|
|
||||||
--in-place my-notation-cert.yaml`,
|
|
||||||
|
|
||||||
RunE: createSecretNotationCmdRun,
|
|
||||||
}
|
|
||||||
|
|
||||||
type secretNotationFlags struct {
|
|
||||||
trustPolicyFile string
|
|
||||||
caCrtFile []string
|
|
||||||
}
|
|
||||||
|
|
||||||
var secretNotationArgs secretNotationFlags
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
createSecretNotationCmd.Flags().StringVar(&secretNotationArgs.trustPolicyFile, "trust-policy-file", "", "notation trust policy file path")
|
|
||||||
createSecretNotationCmd.Flags().StringSliceVar(&secretNotationArgs.caCrtFile, "ca-cert-file", []string{}, "root ca cert file path")
|
|
||||||
|
|
||||||
createSecretCmd.AddCommand(createSecretNotationCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func createSecretNotationCmdRun(cmd *cobra.Command, args []string) error {
|
|
||||||
if len(args) < 1 {
|
|
||||||
return fmt.Errorf("name is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
if secretNotationArgs.caCrtFile == nil || len(secretNotationArgs.caCrtFile) == 0 {
|
|
||||||
return fmt.Errorf("--ca-cert-file is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
if secretNotationArgs.trustPolicyFile == "" {
|
|
||||||
return fmt.Errorf("--trust-policy-file is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
name := args[0]
|
|
||||||
|
|
||||||
labels, err := parseLabels()
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
policy, err := os.ReadFile(secretNotationArgs.trustPolicyFile)
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("unable to read trust policy file: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
var doc trustpolicy.Document
|
|
||||||
|
|
||||||
if err := json.Unmarshal(policy, &doc); err != nil {
|
|
||||||
return fmt.Errorf("failed to unmarshal trust policy %s: %w", secretNotationArgs.trustPolicyFile, err)
|
|
||||||
}
|
|
||||||
|
|
||||||
if err := doc.Validate(); err != nil {
|
|
||||||
return fmt.Errorf("invalid trust policy: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
var (
|
|
||||||
caCerts []sourcesecret.VerificationCrt
|
|
||||||
fileErr error
|
|
||||||
)
|
|
||||||
for _, caCrtFile := range secretNotationArgs.caCrtFile {
|
|
||||||
fileName := filepath.Base(caCrtFile)
|
|
||||||
if !strings.HasSuffix(fileName, ".crt") && !strings.HasSuffix(fileName, ".pem") {
|
|
||||||
fileErr = errors.Join(fileErr, fmt.Errorf("%s must end with either .crt or .pem", fileName))
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
caBundle, err := os.ReadFile(caCrtFile)
|
|
||||||
if err != nil {
|
|
||||||
fileErr = errors.Join(fileErr, fmt.Errorf("unable to read TLS CA file: %w", err))
|
|
||||||
continue
|
|
||||||
}
|
|
||||||
caCerts = append(caCerts, sourcesecret.VerificationCrt{Name: fileName, CACrt: caBundle})
|
|
||||||
}
|
|
||||||
|
|
||||||
if fileErr != nil {
|
|
||||||
return fileErr
|
|
||||||
}
|
|
||||||
|
|
||||||
if len(caCerts) == 0 {
|
|
||||||
return fmt.Errorf("no CA certs found")
|
|
||||||
}
|
|
||||||
|
|
||||||
opts := sourcesecret.Options{
|
|
||||||
Name: name,
|
|
||||||
Namespace: *kubeconfigArgs.Namespace,
|
|
||||||
Labels: labels,
|
|
||||||
VerificationCrts: caCerts,
|
|
||||||
TrustPolicy: policy,
|
|
||||||
}
|
|
||||||
secret, err := sourcesecret.Generate(opts)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if createArgs.export {
|
|
||||||
rootCmd.Println(secret.Content)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
|
||||||
defer cancel()
|
|
||||||
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
var s corev1.Secret
|
|
||||||
if err := yaml.Unmarshal([]byte(secret.Content), &s); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if err := upsertSecret(ctx, kubeClient, s); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
logger.Actionf("notation configuration secret '%s' created in '%s' namespace", name, *kubeconfigArgs.Namespace)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@ -1,124 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"fmt"
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
const (
|
|
||||||
trustPolicy = "./testdata/create_secret/notation/test-trust-policy.json"
|
|
||||||
invalidTrustPolicy = "./testdata/create_secret/notation/invalid-trust-policy.json"
|
|
||||||
invalidJson = "./testdata/create_secret/notation/invalid.json"
|
|
||||||
testCertFolder = "./testdata/create_secret/notation"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestCreateNotationSecret(t *testing.T) {
|
|
||||||
crt, err := os.Create(filepath.Join(t.TempDir(), "ca.crt"))
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal("could not create ca.crt file")
|
|
||||||
}
|
|
||||||
|
|
||||||
pem, err := os.Create(filepath.Join(t.TempDir(), "ca.pem"))
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal("could not create ca.pem file")
|
|
||||||
}
|
|
||||||
|
|
||||||
invalidCert, err := os.Create(filepath.Join(t.TempDir(), "ca.p12"))
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal("could not create ca.p12 file")
|
|
||||||
}
|
|
||||||
|
|
||||||
_, err = crt.Write([]byte("ca-data-crt"))
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal("could not write to crt certificate file")
|
|
||||||
}
|
|
||||||
|
|
||||||
_, err = pem.Write([]byte("ca-data-pem"))
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal("could not write to pem certificate file")
|
|
||||||
}
|
|
||||||
|
|
||||||
tests := []struct {
|
|
||||||
name string
|
|
||||||
args string
|
|
||||||
assert assertFunc
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
name: "no args",
|
|
||||||
args: "create secret notation",
|
|
||||||
assert: assertError("name is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "no trust policy",
|
|
||||||
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s", testCertFolder),
|
|
||||||
assert: assertError("--trust-policy-file is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "no cert",
|
|
||||||
args: fmt.Sprintf("create secret notation notation-config --trust-policy-file=%s", trustPolicy),
|
|
||||||
assert: assertError("--ca-cert-file is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "non pem and crt cert",
|
|
||||||
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s", invalidCert.Name(), trustPolicy),
|
|
||||||
assert: assertError("ca.p12 must end with either .crt or .pem"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "invalid trust policy",
|
|
||||||
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s", t.TempDir(), invalidTrustPolicy),
|
|
||||||
assert: assertError("invalid trust policy: trust policy: a trust policy statement is missing a name, every statement requires a name"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "invalid trust policy json",
|
|
||||||
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s", t.TempDir(), invalidJson),
|
|
||||||
assert: assertError(fmt.Sprintf("failed to unmarshal trust policy %s: json: cannot unmarshal string into Go value of type trustpolicy.Document", invalidJson)),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "crt secret",
|
|
||||||
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s --namespace=my-namespace --export", crt.Name(), trustPolicy),
|
|
||||||
assert: assertGoldenFile("./testdata/create_secret/notation/secret-ca-crt.yaml"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "pem secret",
|
|
||||||
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --trust-policy-file=%s --namespace=my-namespace --export", pem.Name(), trustPolicy),
|
|
||||||
assert: assertGoldenFile("./testdata/create_secret/notation/secret-ca-pem.yaml"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "multi secret",
|
|
||||||
args: fmt.Sprintf("create secret notation notation-config --ca-cert-file=%s --ca-cert-file=%s --trust-policy-file=%s --namespace=my-namespace --export", crt.Name(), pem.Name(), trustPolicy),
|
|
||||||
assert: assertGoldenFile("./testdata/create_secret/notation/secret-ca-multi.yaml"),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, tt := range tests {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
defer func() {
|
|
||||||
secretNotationArgs = secretNotationFlags{}
|
|
||||||
}()
|
|
||||||
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.args,
|
|
||||||
assert: tt.assert,
|
|
||||||
}
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,112 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
corev1 "k8s.io/api/core/v1"
|
|
||||||
"sigs.k8s.io/yaml"
|
|
||||||
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/utils"
|
|
||||||
"github.com/fluxcd/flux2/v2/pkg/manifestgen/sourcesecret"
|
|
||||||
)
|
|
||||||
|
|
||||||
var createSecretProxyCmd = &cobra.Command{
|
|
||||||
Use: "proxy [name]",
|
|
||||||
Short: "Create or update a Kubernetes secret for proxy authentication",
|
|
||||||
Long: `The create secret proxy command generates a Kubernetes secret with the
|
|
||||||
proxy address and the basic authentication credentials.`,
|
|
||||||
Example: ` # Create a proxy secret on disk and encrypt it with SOPS
|
|
||||||
flux create secret proxy my-proxy \
|
|
||||||
--namespace=my-namespace \
|
|
||||||
--address=https://my-proxy.com \
|
|
||||||
--username=my-username \
|
|
||||||
--password=my-password \
|
|
||||||
--export > proxy.yaml
|
|
||||||
|
|
||||||
sops --encrypt --encrypted-regex '^(data|stringData)$' \
|
|
||||||
--in-place proxy.yaml`,
|
|
||||||
|
|
||||||
RunE: createSecretProxyCmdRun,
|
|
||||||
}
|
|
||||||
|
|
||||||
type secretProxyFlags struct {
|
|
||||||
address string
|
|
||||||
username string
|
|
||||||
password string
|
|
||||||
}
|
|
||||||
|
|
||||||
var secretProxyArgs secretProxyFlags
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
createSecretProxyCmd.Flags().StringVar(&secretProxyArgs.address, "address", "", "proxy address")
|
|
||||||
createSecretProxyCmd.Flags().StringVarP(&secretProxyArgs.username, "username", "u", "", "basic authentication username")
|
|
||||||
createSecretProxyCmd.Flags().StringVarP(&secretProxyArgs.password, "password", "p", "", "basic authentication password")
|
|
||||||
|
|
||||||
createSecretCmd.AddCommand(createSecretProxyCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func createSecretProxyCmdRun(cmd *cobra.Command, args []string) error {
|
|
||||||
name := args[0]
|
|
||||||
|
|
||||||
labels, err := parseLabels()
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if secretProxyArgs.address == "" {
|
|
||||||
return errors.New("address is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
opts := sourcesecret.Options{
|
|
||||||
Name: name,
|
|
||||||
Namespace: *kubeconfigArgs.Namespace,
|
|
||||||
Labels: labels,
|
|
||||||
Address: secretProxyArgs.address,
|
|
||||||
Username: secretProxyArgs.username,
|
|
||||||
Password: secretProxyArgs.password,
|
|
||||||
}
|
|
||||||
secret, err := sourcesecret.Generate(opts)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if createArgs.export {
|
|
||||||
rootCmd.Println(secret.Content)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
|
||||||
defer cancel()
|
|
||||||
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
var s corev1.Secret
|
|
||||||
if err := yaml.Unmarshal([]byte(secret.Content), &s); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if err := upsertSecret(ctx, kubeClient, s); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
logger.Actionf("proxy secret '%s' created in '%s' namespace", name, *kubeconfigArgs.Namespace)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@ -1,47 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestCreateProxySecret(t *testing.T) {
|
|
||||||
tests := []struct {
|
|
||||||
name string
|
|
||||||
args string
|
|
||||||
assert assertFunc
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
args: "create secret proxy proxy-secret",
|
|
||||||
assert: assertError("address is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
args: "create secret proxy proxy-secret --address=https://my-proxy.com --username=my-username --password=my-password --namespace=my-namespace --export",
|
|
||||||
assert: assertGoldenFile("testdata/create_secret/proxy/secret-proxy.yaml"),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
for _, tt := range tests {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.args,
|
|
||||||
assert: tt.assert,
|
|
||||||
}
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,217 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
"k8s.io/apimachinery/pkg/api/errors"
|
|
||||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
||||||
"k8s.io/apimachinery/pkg/types"
|
|
||||||
"k8s.io/apimachinery/pkg/util/wait"
|
|
||||||
"sigs.k8s.io/controller-runtime/pkg/client"
|
|
||||||
|
|
||||||
"github.com/fluxcd/pkg/apis/meta"
|
|
||||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
|
||||||
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/flags"
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/utils"
|
|
||||||
)
|
|
||||||
|
|
||||||
var createSourceChartCmd = &cobra.Command{
|
|
||||||
Use: "chart [name]",
|
|
||||||
Short: "Create or update a HelmChart source",
|
|
||||||
Long: `The create source chart command generates a HelmChart resource and waits for the chart to be available.`,
|
|
||||||
Example: ` # Create a source for a chart residing in a HelmRepository
|
|
||||||
flux create source chart podinfo \
|
|
||||||
--source=HelmRepository/podinfo \
|
|
||||||
--chart=podinfo \
|
|
||||||
--chart-version=6.x
|
|
||||||
|
|
||||||
# Create a source for a chart residing in a Git repository
|
|
||||||
flux create source chart podinfo \
|
|
||||||
--source=GitRepository/podinfo \
|
|
||||||
--chart=./charts/podinfo
|
|
||||||
|
|
||||||
# Create a source for a chart residing in a S3 Bucket
|
|
||||||
flux create source chart podinfo \
|
|
||||||
--source=Bucket/podinfo \
|
|
||||||
--chart=./charts/podinfo
|
|
||||||
|
|
||||||
# Create a source for a chart from OCI and verify its signature
|
|
||||||
flux create source chart podinfo \
|
|
||||||
--source HelmRepository/podinfo \
|
|
||||||
--chart podinfo \
|
|
||||||
--chart-version=6.6.2 \
|
|
||||||
--verify-provider=cosign \
|
|
||||||
--verify-issuer=https://token.actions.githubusercontent.com \
|
|
||||||
--verify-subject=https://github.com/stefanprodan/podinfo/.github/workflows/release.yml@refs/tags/6.6.2`,
|
|
||||||
RunE: createSourceChartCmdRun,
|
|
||||||
}
|
|
||||||
|
|
||||||
type sourceChartFlags struct {
|
|
||||||
chart string
|
|
||||||
chartVersion string
|
|
||||||
source flags.LocalHelmChartSource
|
|
||||||
reconcileStrategy string
|
|
||||||
verifyProvider flags.SourceOCIVerifyProvider
|
|
||||||
verifySecretRef string
|
|
||||||
verifyOIDCIssuer string
|
|
||||||
verifySubject string
|
|
||||||
}
|
|
||||||
|
|
||||||
var sourceChartArgs sourceChartFlags
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
createSourceChartCmd.Flags().StringVar(&sourceChartArgs.chart, "chart", "", "Helm chart name or path")
|
|
||||||
createSourceChartCmd.Flags().StringVar(&sourceChartArgs.chartVersion, "chart-version", "", "Helm chart version, accepts a semver range (ignored for charts from GitRepository sources)")
|
|
||||||
createSourceChartCmd.Flags().Var(&sourceChartArgs.source, "source", sourceChartArgs.source.Description())
|
|
||||||
createSourceChartCmd.Flags().StringVar(&sourceChartArgs.reconcileStrategy, "reconcile-strategy", "ChartVersion", "the reconcile strategy for helm chart (accepted values: Revision and ChartRevision)")
|
|
||||||
createSourceChartCmd.Flags().Var(&sourceChartArgs.verifyProvider, "verify-provider", sourceOCIRepositoryArgs.verifyProvider.Description())
|
|
||||||
createSourceChartCmd.Flags().StringVar(&sourceChartArgs.verifySecretRef, "verify-secret-ref", "", "the name of a secret to use for signature verification")
|
|
||||||
createSourceChartCmd.Flags().StringVar(&sourceChartArgs.verifySubject, "verify-subject", "", "regular expression to use for the OIDC subject during signature verification")
|
|
||||||
createSourceChartCmd.Flags().StringVar(&sourceChartArgs.verifyOIDCIssuer, "verify-issuer", "", "regular expression to use for the OIDC issuer during signature verification")
|
|
||||||
|
|
||||||
createSourceCmd.AddCommand(createSourceChartCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func createSourceChartCmdRun(cmd *cobra.Command, args []string) error {
|
|
||||||
name := args[0]
|
|
||||||
|
|
||||||
if sourceChartArgs.source.Kind == "" || sourceChartArgs.source.Name == "" {
|
|
||||||
return fmt.Errorf("chart source is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
if sourceChartArgs.chart == "" {
|
|
||||||
return fmt.Errorf("chart name or path is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
logger.Generatef("generating HelmChart source")
|
|
||||||
|
|
||||||
sourceLabels, err := parseLabels()
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
helmChart := &sourcev1.HelmChart{
|
|
||||||
ObjectMeta: metav1.ObjectMeta{
|
|
||||||
Name: name,
|
|
||||||
Namespace: *kubeconfigArgs.Namespace,
|
|
||||||
Labels: sourceLabels,
|
|
||||||
},
|
|
||||||
Spec: sourcev1.HelmChartSpec{
|
|
||||||
Chart: sourceChartArgs.chart,
|
|
||||||
Version: sourceChartArgs.chartVersion,
|
|
||||||
Interval: metav1.Duration{
|
|
||||||
Duration: createArgs.interval,
|
|
||||||
},
|
|
||||||
ReconcileStrategy: sourceChartArgs.reconcileStrategy,
|
|
||||||
SourceRef: sourcev1.LocalHelmChartSourceReference{
|
|
||||||
Kind: sourceChartArgs.source.Kind,
|
|
||||||
Name: sourceChartArgs.source.Name,
|
|
||||||
},
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
if provider := sourceChartArgs.verifyProvider.String(); provider != "" {
|
|
||||||
helmChart.Spec.Verify = &sourcev1.OCIRepositoryVerification{
|
|
||||||
Provider: provider,
|
|
||||||
}
|
|
||||||
if secretName := sourceChartArgs.verifySecretRef; secretName != "" {
|
|
||||||
helmChart.Spec.Verify.SecretRef = &meta.LocalObjectReference{
|
|
||||||
Name: secretName,
|
|
||||||
}
|
|
||||||
}
|
|
||||||
verifyIssuer := sourceChartArgs.verifyOIDCIssuer
|
|
||||||
verifySubject := sourceChartArgs.verifySubject
|
|
||||||
if verifyIssuer != "" || verifySubject != "" {
|
|
||||||
helmChart.Spec.Verify.MatchOIDCIdentity = []sourcev1.OIDCIdentityMatch{{
|
|
||||||
Issuer: verifyIssuer,
|
|
||||||
Subject: verifySubject,
|
|
||||||
}}
|
|
||||||
}
|
|
||||||
} else if sourceChartArgs.verifySecretRef != "" {
|
|
||||||
return fmt.Errorf("a verification provider must be specified when a secret is specified")
|
|
||||||
} else if sourceChartArgs.verifyOIDCIssuer != "" || sourceOCIRepositoryArgs.verifySubject != "" {
|
|
||||||
return fmt.Errorf("a verification provider must be specified when OIDC issuer/subject is specified")
|
|
||||||
}
|
|
||||||
|
|
||||||
if createArgs.export {
|
|
||||||
return printExport(exportHelmChart(helmChart))
|
|
||||||
}
|
|
||||||
|
|
||||||
logger.Actionf("applying HelmChart source")
|
|
||||||
|
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
|
||||||
defer cancel()
|
|
||||||
|
|
||||||
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
namespacedName, err := upsertHelmChart(ctx, kubeClient, helmChart)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
logger.Waitingf("waiting for HelmChart source reconciliation")
|
|
||||||
readyConditionFunc := isObjectReadyConditionFunc(kubeClient, namespacedName, helmChart)
|
|
||||||
if err := wait.PollUntilContextTimeout(ctx, rootArgs.pollInterval, rootArgs.timeout, true, readyConditionFunc); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
logger.Successf("HelmChart source reconciliation completed")
|
|
||||||
|
|
||||||
if helmChart.Status.Artifact == nil {
|
|
||||||
return fmt.Errorf("HelmChart source reconciliation completed but no artifact was found")
|
|
||||||
}
|
|
||||||
logger.Successf("fetched revision: %s", helmChart.Status.Artifact.Revision)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func upsertHelmChart(ctx context.Context, kubeClient client.Client,
|
|
||||||
helmChart *sourcev1.HelmChart) (types.NamespacedName, error) {
|
|
||||||
namespacedName := types.NamespacedName{
|
|
||||||
Namespace: helmChart.GetNamespace(),
|
|
||||||
Name: helmChart.GetName(),
|
|
||||||
}
|
|
||||||
|
|
||||||
var existing sourcev1.HelmChart
|
|
||||||
err := kubeClient.Get(ctx, namespacedName, &existing)
|
|
||||||
if err != nil {
|
|
||||||
if errors.IsNotFound(err) {
|
|
||||||
if err := kubeClient.Create(ctx, helmChart); err != nil {
|
|
||||||
return namespacedName, err
|
|
||||||
} else {
|
|
||||||
logger.Successf("source created")
|
|
||||||
return namespacedName, nil
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return namespacedName, err
|
|
||||||
}
|
|
||||||
|
|
||||||
existing.Labels = helmChart.Labels
|
|
||||||
existing.Spec = helmChart.Spec
|
|
||||||
if err := kubeClient.Update(ctx, &existing); err != nil {
|
|
||||||
return namespacedName, err
|
|
||||||
}
|
|
||||||
helmChart = &existing
|
|
||||||
logger.Successf("source updated")
|
|
||||||
return namespacedName, nil
|
|
||||||
}
|
|
||||||
@ -1,91 +0,0 @@
|
|||||||
//go:build unit
|
|
||||||
// +build unit
|
|
||||||
|
|
||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import "testing"
|
|
||||||
|
|
||||||
func TestCreateSourceChart(t *testing.T) {
|
|
||||||
tmpl := map[string]string{
|
|
||||||
"fluxns": allocateNamespace("flux-system"),
|
|
||||||
}
|
|
||||||
setupSourceChart(t, tmpl)
|
|
||||||
|
|
||||||
tests := []struct {
|
|
||||||
name string
|
|
||||||
args string
|
|
||||||
assert assertFunc
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
name: "missing name",
|
|
||||||
args: "create source chart --export",
|
|
||||||
assert: assertError("name is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "missing source reference",
|
|
||||||
args: "create source chart podinfo --export ",
|
|
||||||
assert: assertError("chart source is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "missing chart name",
|
|
||||||
args: "create source chart podinfo --source helmrepository/podinfo --export",
|
|
||||||
assert: assertError("chart name or path is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "unknown source kind",
|
|
||||||
args: "create source chart podinfo --source foobar/podinfo --export",
|
|
||||||
assert: assertError(`invalid argument "foobar/podinfo" for "--source" flag: source kind 'foobar' is not supported, must be one of: HelmRepository, GitRepository, Bucket`),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "basic chart",
|
|
||||||
args: "create source chart podinfo --source helmrepository/podinfo --chart podinfo --export",
|
|
||||||
assert: assertGoldenTemplateFile("testdata/create_source_chart/basic.yaml", tmpl),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "chart with basic signature verification",
|
|
||||||
args: "create source chart podinfo --source helmrepository/podinfo --chart podinfo --verify-provider cosign --export",
|
|
||||||
assert: assertGoldenTemplateFile("testdata/create_source_chart/verify_basic.yaml", tmpl),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "unknown signature verification provider",
|
|
||||||
args: "create source chart podinfo --source helmrepository/podinfo --chart podinfo --verify-provider foobar --export",
|
|
||||||
assert: assertError(`invalid argument "foobar" for "--verify-provider" flag: source OCI verify provider 'foobar' is not supported, must be one of: cosign`),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "chart with complete signature verification",
|
|
||||||
args: "create source chart podinfo --source helmrepository/podinfo --chart podinfo --verify-provider cosign --verify-issuer foo --verify-subject bar --export",
|
|
||||||
assert: assertGoldenTemplateFile("testdata/create_source_chart/verify_complete.yaml", tmpl),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, tt := range tests {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.args + " -n " + tmpl["fluxns"],
|
|
||||||
assert: tt.assert,
|
|
||||||
}
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
func setupSourceChart(t *testing.T, tmpl map[string]string) {
|
|
||||||
t.Helper()
|
|
||||||
testEnv.CreateObjectFile("./testdata/create_source_chart/setup-source.yaml", tmpl, t)
|
|
||||||
}
|
|
||||||
@ -1,31 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
)
|
|
||||||
|
|
||||||
var debugCmd = &cobra.Command{
|
|
||||||
Use: "debug",
|
|
||||||
Short: "Debug a flux resource",
|
|
||||||
Long: `The debug command can be used to troubleshoot failing resource reconciliations.`,
|
|
||||||
}
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
rootCmd.AddCommand(debugCmd)
|
|
||||||
}
|
|
||||||
@ -1,113 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
helmv2 "github.com/fluxcd/helm-controller/api/v2"
|
|
||||||
"github.com/fluxcd/pkg/chartutil"
|
|
||||||
"github.com/go-logr/logr"
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
"k8s.io/apimachinery/pkg/types"
|
|
||||||
"sigs.k8s.io/yaml"
|
|
||||||
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/utils"
|
|
||||||
)
|
|
||||||
|
|
||||||
var debugHelmReleaseCmd = &cobra.Command{
|
|
||||||
Use: "helmrelease [name]",
|
|
||||||
Aliases: []string{"hr"},
|
|
||||||
Short: "Debug a HelmRelease resource",
|
|
||||||
Long: withPreviewNote(`The debug helmrelease command can be used to troubleshoot failing Helm release reconciliations.
|
|
||||||
WARNING: This command will print sensitive information if Kubernetes Secrets are referenced in the HelmRelease .spec.valuesFrom field.`),
|
|
||||||
Example: ` # Print the status of a Helm release
|
|
||||||
flux debug hr podinfo --show-status
|
|
||||||
|
|
||||||
# Export the final values of a Helm release composed from referred ConfigMaps and Secrets
|
|
||||||
flux debug hr podinfo --show-values > values.yaml`,
|
|
||||||
RunE: debugHelmReleaseCmdRun,
|
|
||||||
Args: cobra.ExactArgs(1),
|
|
||||||
ValidArgsFunction: resourceNamesCompletionFunc(helmv2.GroupVersion.WithKind(helmv2.HelmReleaseKind)),
|
|
||||||
}
|
|
||||||
|
|
||||||
type debugHelmReleaseFlags struct {
|
|
||||||
showStatus bool
|
|
||||||
showValues bool
|
|
||||||
}
|
|
||||||
|
|
||||||
var debugHelmReleaseArgs debugHelmReleaseFlags
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
debugHelmReleaseCmd.Flags().BoolVar(&debugHelmReleaseArgs.showStatus, "show-status", false, "print the status of the Helm release")
|
|
||||||
debugHelmReleaseCmd.Flags().BoolVar(&debugHelmReleaseArgs.showValues, "show-values", false, "print the final values of the Helm release")
|
|
||||||
debugCmd.AddCommand(debugHelmReleaseCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func debugHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
|
|
||||||
name := args[0]
|
|
||||||
|
|
||||||
if (!debugHelmReleaseArgs.showStatus && !debugHelmReleaseArgs.showValues) ||
|
|
||||||
(debugHelmReleaseArgs.showStatus && debugHelmReleaseArgs.showValues) {
|
|
||||||
return fmt.Errorf("either --show-status or --show-values must be set")
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
|
||||||
defer cancel()
|
|
||||||
|
|
||||||
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
hr := &helmv2.HelmRelease{}
|
|
||||||
hrName := types.NamespacedName{Namespace: *kubeconfigArgs.Namespace, Name: name}
|
|
||||||
if err := kubeClient.Get(ctx, hrName, hr); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if debugHelmReleaseArgs.showStatus {
|
|
||||||
status, err := yaml.Marshal(hr.Status)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
rootCmd.Println("# Status documentation: https://fluxcd.io/flux/components/helm/helmreleases/#helmrelease-status")
|
|
||||||
rootCmd.Print(string(status))
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
if debugHelmReleaseArgs.showValues {
|
|
||||||
finalValues, err := chartutil.ChartValuesFromReferences(ctx,
|
|
||||||
logr.Discard(),
|
|
||||||
kubeClient,
|
|
||||||
hr.GetNamespace(),
|
|
||||||
hr.GetValues(),
|
|
||||||
hr.Spec.ValuesFrom...)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
values, err := yaml.Marshal(finalValues)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
rootCmd.Print(string(values))
|
|
||||||
}
|
|
||||||
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@ -1,71 +0,0 @@
|
|||||||
//go:build unit
|
|
||||||
// +build unit
|
|
||||||
|
|
||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestDebugHelmRelease(t *testing.T) {
|
|
||||||
namespace := allocateNamespace("debug")
|
|
||||||
|
|
||||||
objectFile := "testdata/debug_helmrelease/objects.yaml"
|
|
||||||
tmpl := map[string]string{
|
|
||||||
"fluxns": namespace,
|
|
||||||
}
|
|
||||||
testEnv.CreateObjectFile(objectFile, tmpl, t)
|
|
||||||
|
|
||||||
cases := []struct {
|
|
||||||
name string
|
|
||||||
arg string
|
|
||||||
goldenFile string
|
|
||||||
tmpl map[string]string
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
"debug status",
|
|
||||||
"debug helmrelease test-values-inline --show-status --show-values=false",
|
|
||||||
"testdata/debug_helmrelease/status.golden.yaml",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"debug values",
|
|
||||||
"debug helmrelease test-values-inline --show-values --show-status=false",
|
|
||||||
"testdata/debug_helmrelease/values-inline.golden.yaml",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"debug values from",
|
|
||||||
"debug helmrelease test-values-from --show-values --show-status=false",
|
|
||||||
"testdata/debug_helmrelease/values-from.golden.yaml",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, tt := range cases {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.arg + " -n=" + namespace,
|
|
||||||
assert: assertGoldenTemplateFile(tt.goldenFile, tmpl),
|
|
||||||
}
|
|
||||||
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,134 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
"fmt"
|
|
||||||
"sort"
|
|
||||||
"strings"
|
|
||||||
|
|
||||||
kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
|
|
||||||
"github.com/fluxcd/pkg/kustomize"
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
|
||||||
"k8s.io/apimachinery/pkg/runtime"
|
|
||||||
"k8s.io/apimachinery/pkg/types"
|
|
||||||
"sigs.k8s.io/yaml"
|
|
||||||
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/utils"
|
|
||||||
)
|
|
||||||
|
|
||||||
var debugKustomizationCmd = &cobra.Command{
|
|
||||||
Use: "kustomization [name]",
|
|
||||||
Aliases: []string{"ks"},
|
|
||||||
Short: "Debug a Flux Kustomization resource",
|
|
||||||
Long: withPreviewNote(`The debug kustomization command can be used to troubleshoot failing Flux Kustomization reconciliations.
|
|
||||||
WARNING: This command will print sensitive information if Kubernetes Secrets are referenced in the Kustomization .spec.postBuild.substituteFrom field.`),
|
|
||||||
Example: ` # Print the status of a Flux Kustomization
|
|
||||||
flux debug ks podinfo --show-status
|
|
||||||
|
|
||||||
# Export the final variables used for post-build substitutions composed from referred ConfigMaps and Secrets
|
|
||||||
flux debug ks podinfo --show-vars > vars.env`,
|
|
||||||
RunE: debugKustomizationCmdRun,
|
|
||||||
Args: cobra.ExactArgs(1),
|
|
||||||
ValidArgsFunction: resourceNamesCompletionFunc(kustomizev1.GroupVersion.WithKind(kustomizev1.KustomizationKind)),
|
|
||||||
}
|
|
||||||
|
|
||||||
type debugKustomizationFlags struct {
|
|
||||||
showStatus bool
|
|
||||||
showVars bool
|
|
||||||
}
|
|
||||||
|
|
||||||
var debugKustomizationArgs debugKustomizationFlags
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
debugKustomizationCmd.Flags().BoolVar(&debugKustomizationArgs.showStatus, "show-status", false, "print the status of the Flux Kustomization")
|
|
||||||
debugKustomizationCmd.Flags().BoolVar(&debugKustomizationArgs.showVars, "show-vars", false, "print the final vars of the Flux Kustomization in dot env format")
|
|
||||||
debugCmd.AddCommand(debugKustomizationCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func debugKustomizationCmdRun(cmd *cobra.Command, args []string) error {
|
|
||||||
name := args[0]
|
|
||||||
|
|
||||||
if (!debugKustomizationArgs.showStatus && !debugKustomizationArgs.showVars) ||
|
|
||||||
(debugKustomizationArgs.showStatus && debugKustomizationArgs.showVars) {
|
|
||||||
return fmt.Errorf("either --show-status or --show-vars must be set")
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
|
||||||
defer cancel()
|
|
||||||
|
|
||||||
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
ks := &kustomizev1.Kustomization{}
|
|
||||||
ksName := types.NamespacedName{Namespace: *kubeconfigArgs.Namespace, Name: name}
|
|
||||||
if err := kubeClient.Get(ctx, ksName, ks); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if debugKustomizationArgs.showStatus {
|
|
||||||
status, err := yaml.Marshal(ks.Status)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
rootCmd.Println("# Status documentation: https://fluxcd.io/flux/components/kustomize/kustomizations/#kustomization-status")
|
|
||||||
rootCmd.Print(string(status))
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
if debugKustomizationArgs.showVars {
|
|
||||||
if ks.Spec.PostBuild == nil {
|
|
||||||
return errors.New("no post build substitutions found")
|
|
||||||
}
|
|
||||||
|
|
||||||
ksObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(ks)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
finalVars, err := kustomize.LoadVariables(ctx, kubeClient, unstructured.Unstructured{Object: ksObj})
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if len(ks.Spec.PostBuild.Substitute) > 0 {
|
|
||||||
for k, v := range ks.Spec.PostBuild.Substitute {
|
|
||||||
// Remove new lines from the values as they are not supported.
|
|
||||||
// Replicates the controller behavior from
|
|
||||||
// https://github.com/fluxcd/pkg/blob/main/kustomize/kustomize_varsub.go
|
|
||||||
finalVars[k] = strings.ReplaceAll(v, "\n", "")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
keys := make([]string, 0, len(finalVars))
|
|
||||||
for k := range finalVars {
|
|
||||||
keys = append(keys, k)
|
|
||||||
}
|
|
||||||
sort.Strings(keys)
|
|
||||||
|
|
||||||
for _, k := range keys {
|
|
||||||
rootCmd.Println(k + "=" + finalVars[k])
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@ -1,71 +0,0 @@
|
|||||||
//go:build unit
|
|
||||||
// +build unit
|
|
||||||
|
|
||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestDebugKustomization(t *testing.T) {
|
|
||||||
namespace := allocateNamespace("debug")
|
|
||||||
|
|
||||||
objectFile := "testdata/debug_kustomization/objects.yaml"
|
|
||||||
tmpl := map[string]string{
|
|
||||||
"fluxns": namespace,
|
|
||||||
}
|
|
||||||
testEnv.CreateObjectFile(objectFile, tmpl, t)
|
|
||||||
|
|
||||||
cases := []struct {
|
|
||||||
name string
|
|
||||||
arg string
|
|
||||||
goldenFile string
|
|
||||||
tmpl map[string]string
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
"debug status",
|
|
||||||
"debug ks test --show-status --show-vars=false",
|
|
||||||
"testdata/debug_kustomization/status.golden.yaml",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"debug vars",
|
|
||||||
"debug ks test --show-vars --show-status=false",
|
|
||||||
"testdata/debug_kustomization/vars.golden.env",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"debug vars from",
|
|
||||||
"debug ks test-from --show-vars --show-status=false",
|
|
||||||
"testdata/debug_kustomization/vars-from.golden.env",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, tt := range cases {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.arg + " -n=" + namespace,
|
|
||||||
assert: assertGoldenTemplateFile(tt.goldenFile, tmpl),
|
|
||||||
}
|
|
||||||
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,40 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
|
|
||||||
sourcev1 "github.com/fluxcd/source-controller/api/v1beta2"
|
|
||||||
)
|
|
||||||
|
|
||||||
var deleteSourceChartCmd = &cobra.Command{
|
|
||||||
Use: "chart [name]",
|
|
||||||
Short: "Delete a HelmChart source",
|
|
||||||
Long: "The delete source chart command deletes the given HelmChart from the cluster.",
|
|
||||||
Example: ` # Delete a HelmChart
|
|
||||||
flux delete source chart podinfo`,
|
|
||||||
ValidArgsFunction: resourceNamesCompletionFunc(sourcev1.GroupVersion.WithKind(sourcev1.HelmChartKind)),
|
|
||||||
RunE: deleteCommand{
|
|
||||||
apiType: helmChartType,
|
|
||||||
object: universalAdapter{&sourcev1.HelmChart{}},
|
|
||||||
}.run,
|
|
||||||
}
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
deleteSourceCmd.AddCommand(deleteSourceChartCmd)
|
|
||||||
}
|
|
||||||
@ -1,74 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"bufio"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/fluxcd/pkg/envsubst"
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
)
|
|
||||||
|
|
||||||
var envsubstCmd = &cobra.Command{
|
|
||||||
Use: "envsubst",
|
|
||||||
Args: cobra.NoArgs,
|
|
||||||
Short: "envsubst substitutes the values of environment variables",
|
|
||||||
Long: withPreviewNote(`The envsubst command substitutes the values of environment variables
|
|
||||||
in the string piped as standard input and writes the result to the standard output. This command can be used
|
|
||||||
to replicate the behavior of the Flux Kustomization post-build substitutions.`),
|
|
||||||
Example: ` # Run env var substitutions on the kustomization build output
|
|
||||||
export cluster_region=eu-central-1
|
|
||||||
kustomize build . | flux envsubst
|
|
||||||
|
|
||||||
# Run env var substitutions and error out if a variable is not set
|
|
||||||
kustomize build . | flux envsubst --strict
|
|
||||||
`,
|
|
||||||
RunE: runEnvsubstCmd,
|
|
||||||
}
|
|
||||||
|
|
||||||
type envsubstFlags struct {
|
|
||||||
strict bool
|
|
||||||
}
|
|
||||||
|
|
||||||
var envsubstArgs envsubstFlags
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
envsubstCmd.Flags().BoolVar(&envsubstArgs.strict, "strict", false,
|
|
||||||
"fail if a variable without a default value is declared in the input but is missing from the environment")
|
|
||||||
rootCmd.AddCommand(envsubstCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func runEnvsubstCmd(cmd *cobra.Command, args []string) error {
|
|
||||||
stdin := bufio.NewScanner(rootCmd.InOrStdin())
|
|
||||||
stdout := bufio.NewWriter(rootCmd.OutOrStdout())
|
|
||||||
for stdin.Scan() {
|
|
||||||
line, err := envsubst.EvalEnv(stdin.Text(), envsubstArgs.strict)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
_, err = fmt.Fprintln(stdout, line)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
err = stdout.Flush()
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
}
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@ -1,50 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"bytes"
|
|
||||||
"os"
|
|
||||||
"testing"
|
|
||||||
|
|
||||||
. "github.com/onsi/gomega"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestEnvsubst(t *testing.T) {
|
|
||||||
g := NewWithT(t)
|
|
||||||
input, err := os.ReadFile("testdata/envsubst/file.yaml")
|
|
||||||
g.Expect(err).NotTo(HaveOccurred())
|
|
||||||
|
|
||||||
t.Setenv("REPO_NAME", "test")
|
|
||||||
|
|
||||||
output, err := executeCommandWithIn("envsubst", bytes.NewReader(input))
|
|
||||||
g.Expect(err).NotTo(HaveOccurred())
|
|
||||||
|
|
||||||
expected, err := os.ReadFile("testdata/envsubst/file.gold")
|
|
||||||
g.Expect(err).NotTo(HaveOccurred())
|
|
||||||
g.Expect(output).To(Equal(string(expected)))
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestEnvsubst_Strinct(t *testing.T) {
|
|
||||||
g := NewWithT(t)
|
|
||||||
input, err := os.ReadFile("testdata/envsubst/file.yaml")
|
|
||||||
g.Expect(err).NotTo(HaveOccurred())
|
|
||||||
|
|
||||||
_, err = executeCommandWithIn("envsubst --strict", bytes.NewReader(input))
|
|
||||||
g.Expect(err).To(HaveOccurred())
|
|
||||||
g.Expect(err.Error()).To(ContainSubstring("variable not set (strict mode)"))
|
|
||||||
}
|
|
||||||
@ -1,67 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
|
||||||
|
|
||||||
sourcev1 "github.com/fluxcd/source-controller/api/v1"
|
|
||||||
)
|
|
||||||
|
|
||||||
var exportSourceChartCmd = &cobra.Command{
|
|
||||||
Use: "chart [name]",
|
|
||||||
Short: "Export HelmChart sources in YAML format",
|
|
||||||
Long: withPreviewNote("The export source chart command exports one or all HelmChart sources in YAML format."),
|
|
||||||
Example: ` # Export all chart sources
|
|
||||||
flux export source chart --all > sources.yaml`,
|
|
||||||
ValidArgsFunction: resourceNamesCompletionFunc(sourcev1.GroupVersion.WithKind(sourcev1.HelmChartKind)),
|
|
||||||
RunE: exportCommand{
|
|
||||||
list: helmChartListAdapter{&sourcev1.HelmChartList{}},
|
|
||||||
object: helmChartAdapter{&sourcev1.HelmChart{}},
|
|
||||||
}.run,
|
|
||||||
}
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
exportSourceCmd.AddCommand(exportSourceChartCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func exportHelmChart(source *sourcev1.HelmChart) interface{} {
|
|
||||||
gvk := sourcev1.GroupVersion.WithKind(sourcev1.HelmChartKind)
|
|
||||||
export := sourcev1.HelmChart{
|
|
||||||
TypeMeta: metav1.TypeMeta{
|
|
||||||
Kind: gvk.Kind,
|
|
||||||
APIVersion: gvk.GroupVersion().String(),
|
|
||||||
},
|
|
||||||
ObjectMeta: metav1.ObjectMeta{
|
|
||||||
Name: source.Name,
|
|
||||||
Namespace: source.Namespace,
|
|
||||||
Labels: source.Labels,
|
|
||||||
Annotations: source.Annotations,
|
|
||||||
},
|
|
||||||
Spec: source.Spec,
|
|
||||||
}
|
|
||||||
return export
|
|
||||||
}
|
|
||||||
|
|
||||||
func (ex helmChartAdapter) export() interface{} {
|
|
||||||
return exportHelmChart(ex.HelmChart)
|
|
||||||
}
|
|
||||||
|
|
||||||
func (ex helmChartListAdapter) exportItem(i int) interface{} {
|
|
||||||
return exportHelmChart(&ex.HelmChartList.Items[i])
|
|
||||||
}
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue