mirror of https://github.com/fluxcd/flux2.git
Compare commits
No commits in common. 'main' and 'v2.3.0' have entirely different histories.
@ -1,5 +0,0 @@
|
|||||||
annotations:
|
|
||||||
- checks:
|
|
||||||
- dangerous-workflow
|
|
||||||
reasons:
|
|
||||||
- reason: not-applicable # This workflow does not run untrusted code, the bot will only backport a code if the a PR was approved and merged into main.
|
|
||||||
@ -1,128 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
"os"
|
|
||||||
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/utils"
|
|
||||||
"github.com/fluxcd/flux2/v2/pkg/manifestgen/sourcesecret"
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
corev1 "k8s.io/api/core/v1"
|
|
||||||
"sigs.k8s.io/yaml"
|
|
||||||
)
|
|
||||||
|
|
||||||
var createSecretGitHubAppCmd = &cobra.Command{
|
|
||||||
Use: "githubapp [name]",
|
|
||||||
Short: "Create or update a github app secret",
|
|
||||||
Long: withPreviewNote(`The create secret githubapp command generates a Kubernetes secret that can be used for GitRepository authentication with github app`),
|
|
||||||
Example: ` # Create a githubapp authentication secret on disk and encrypt it with Mozilla SOPS
|
|
||||||
flux create secret githubapp podinfo-auth \
|
|
||||||
--app-id="1" \
|
|
||||||
--app-installation-id="2" \
|
|
||||||
--app-private-key=./private-key-file.pem \
|
|
||||||
--export > githubapp-auth.yaml
|
|
||||||
|
|
||||||
sops --encrypt --encrypted-regex '^(data|stringData)$' \
|
|
||||||
--in-place githubapp-auth.yaml
|
|
||||||
`,
|
|
||||||
RunE: createSecretGitHubAppCmdRun,
|
|
||||||
}
|
|
||||||
|
|
||||||
type secretGitHubAppFlags struct {
|
|
||||||
appID string
|
|
||||||
appInstallationID string
|
|
||||||
privateKeyFile string
|
|
||||||
baseURL string
|
|
||||||
}
|
|
||||||
|
|
||||||
var secretGitHubAppArgs = secretGitHubAppFlags{}
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
createSecretGitHubAppCmd.Flags().StringVar(&secretGitHubAppArgs.appID, "app-id", "", "github app ID")
|
|
||||||
createSecretGitHubAppCmd.Flags().StringVar(&secretGitHubAppArgs.appInstallationID, "app-installation-id", "", "github app installation ID")
|
|
||||||
createSecretGitHubAppCmd.Flags().StringVar(&secretGitHubAppArgs.privateKeyFile, "app-private-key", "", "github app private key file path")
|
|
||||||
createSecretGitHubAppCmd.Flags().StringVar(&secretGitHubAppArgs.baseURL, "app-base-url", "", "github app base URL")
|
|
||||||
|
|
||||||
createSecretCmd.AddCommand(createSecretGitHubAppCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func createSecretGitHubAppCmdRun(cmd *cobra.Command, args []string) error {
|
|
||||||
if len(args) < 1 {
|
|
||||||
return fmt.Errorf("name is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
secretName := args[0]
|
|
||||||
|
|
||||||
if secretGitHubAppArgs.appID == "" {
|
|
||||||
return fmt.Errorf("--app-id is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
if secretGitHubAppArgs.appInstallationID == "" {
|
|
||||||
return fmt.Errorf("--app-installation-id is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
if secretGitHubAppArgs.privateKeyFile == "" {
|
|
||||||
return fmt.Errorf("--app-private-key is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
privateKey, err := os.ReadFile(secretGitHubAppArgs.privateKeyFile)
|
|
||||||
if err != nil {
|
|
||||||
return fmt.Errorf("unable to read private key file: %w", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
opts := sourcesecret.Options{
|
|
||||||
Name: secretName,
|
|
||||||
Namespace: *kubeconfigArgs.Namespace,
|
|
||||||
GitHubAppID: secretGitHubAppArgs.appID,
|
|
||||||
GitHubAppInstallationID: secretGitHubAppArgs.appInstallationID,
|
|
||||||
GitHubAppPrivateKey: string(privateKey),
|
|
||||||
}
|
|
||||||
|
|
||||||
if secretGitHubAppArgs.baseURL != "" {
|
|
||||||
opts.GitHubAppBaseURL = secretGitHubAppArgs.baseURL
|
|
||||||
}
|
|
||||||
|
|
||||||
secret, err := sourcesecret.Generate(opts)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if createArgs.export {
|
|
||||||
rootCmd.Println(secret.Content)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
|
||||||
defer cancel()
|
|
||||||
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
var s corev1.Secret
|
|
||||||
if err := yaml.Unmarshal([]byte(secret.Content), &s); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if err := upsertSecret(ctx, kubeClient, s); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
logger.Actionf("githubapp secret '%s' created in '%s' namespace", secretName, *kubeconfigArgs.Namespace)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@ -1,74 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2022 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestCreateSecretGitHubApp(t *testing.T) {
|
|
||||||
tests := []struct {
|
|
||||||
name string
|
|
||||||
args string
|
|
||||||
assert assertFunc
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with missing name",
|
|
||||||
args: "create secret githubapp",
|
|
||||||
assert: assertError("name is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with missing app-id",
|
|
||||||
args: "create secret githubapp appinfo",
|
|
||||||
assert: assertError("--app-id is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with missing appInstallationID",
|
|
||||||
args: "create secret githubapp appinfo --app-id 1",
|
|
||||||
assert: assertError("--app-installation-id is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with missing private key file",
|
|
||||||
args: "create secret githubapp appinfo --app-id 1 --app-installation-id 2",
|
|
||||||
assert: assertError("--app-private-key is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with private key file that does not exist",
|
|
||||||
args: "create secret githubapp appinfo --app-id 1 --app-installation-id 2 --app-private-key pk.pem",
|
|
||||||
assert: assertError("unable to read private key file: open pk.pem: no such file or directory"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with app info",
|
|
||||||
args: "create secret githubapp appinfo --namespace my-namespace --app-id 1 --app-installation-id 2 --app-private-key ./testdata/create_secret/githubapp/test-private-key.pem --export",
|
|
||||||
assert: assertGoldenFile("testdata/create_secret/githubapp/secret.yaml"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "create githubapp secret with appinfo and base url",
|
|
||||||
args: "create secret githubapp appinfo --namespace my-namespace --app-id 1 --app-installation-id 2 --app-private-key ./testdata/create_secret/githubapp/test-private-key.pem --app-base-url www.example.com/api/v3 --export",
|
|
||||||
assert: assertGoldenFile("testdata/create_secret/githubapp/secret-with-baseurl.yaml"),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
for _, tt := range tests {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.args,
|
|
||||||
assert: tt.assert,
|
|
||||||
}
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,112 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
corev1 "k8s.io/api/core/v1"
|
|
||||||
"sigs.k8s.io/yaml"
|
|
||||||
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/utils"
|
|
||||||
"github.com/fluxcd/flux2/v2/pkg/manifestgen/sourcesecret"
|
|
||||||
)
|
|
||||||
|
|
||||||
var createSecretProxyCmd = &cobra.Command{
|
|
||||||
Use: "proxy [name]",
|
|
||||||
Short: "Create or update a Kubernetes secret for proxy authentication",
|
|
||||||
Long: `The create secret proxy command generates a Kubernetes secret with the
|
|
||||||
proxy address and the basic authentication credentials.`,
|
|
||||||
Example: ` # Create a proxy secret on disk and encrypt it with SOPS
|
|
||||||
flux create secret proxy my-proxy \
|
|
||||||
--namespace=my-namespace \
|
|
||||||
--address=https://my-proxy.com \
|
|
||||||
--username=my-username \
|
|
||||||
--password=my-password \
|
|
||||||
--export > proxy.yaml
|
|
||||||
|
|
||||||
sops --encrypt --encrypted-regex '^(data|stringData)$' \
|
|
||||||
--in-place proxy.yaml`,
|
|
||||||
|
|
||||||
RunE: createSecretProxyCmdRun,
|
|
||||||
}
|
|
||||||
|
|
||||||
type secretProxyFlags struct {
|
|
||||||
address string
|
|
||||||
username string
|
|
||||||
password string
|
|
||||||
}
|
|
||||||
|
|
||||||
var secretProxyArgs secretProxyFlags
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
createSecretProxyCmd.Flags().StringVar(&secretProxyArgs.address, "address", "", "proxy address")
|
|
||||||
createSecretProxyCmd.Flags().StringVarP(&secretProxyArgs.username, "username", "u", "", "basic authentication username")
|
|
||||||
createSecretProxyCmd.Flags().StringVarP(&secretProxyArgs.password, "password", "p", "", "basic authentication password")
|
|
||||||
|
|
||||||
createSecretCmd.AddCommand(createSecretProxyCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func createSecretProxyCmdRun(cmd *cobra.Command, args []string) error {
|
|
||||||
name := args[0]
|
|
||||||
|
|
||||||
labels, err := parseLabels()
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if secretProxyArgs.address == "" {
|
|
||||||
return errors.New("address is required")
|
|
||||||
}
|
|
||||||
|
|
||||||
opts := sourcesecret.Options{
|
|
||||||
Name: name,
|
|
||||||
Namespace: *kubeconfigArgs.Namespace,
|
|
||||||
Labels: labels,
|
|
||||||
Address: secretProxyArgs.address,
|
|
||||||
Username: secretProxyArgs.username,
|
|
||||||
Password: secretProxyArgs.password,
|
|
||||||
}
|
|
||||||
secret, err := sourcesecret.Generate(opts)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if createArgs.export {
|
|
||||||
rootCmd.Println(secret.Content)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
|
||||||
defer cancel()
|
|
||||||
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
var s corev1.Secret
|
|
||||||
if err := yaml.Unmarshal([]byte(secret.Content), &s); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
if err := upsertSecret(ctx, kubeClient, s); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
logger.Actionf("proxy secret '%s' created in '%s' namespace", name, *kubeconfigArgs.Namespace)
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@ -1,47 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestCreateProxySecret(t *testing.T) {
|
|
||||||
tests := []struct {
|
|
||||||
name string
|
|
||||||
args string
|
|
||||||
assert assertFunc
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
args: "create secret proxy proxy-secret",
|
|
||||||
assert: assertError("address is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
args: "create secret proxy proxy-secret --address=https://my-proxy.com --username=my-username --password=my-password --namespace=my-namespace --export",
|
|
||||||
assert: assertGoldenFile("testdata/create_secret/proxy/secret-proxy.yaml"),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
for _, tt := range tests {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.args,
|
|
||||||
assert: tt.assert,
|
|
||||||
}
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,68 +0,0 @@
|
|||||||
//go:build e2e
|
|
||||||
// +build e2e
|
|
||||||
|
|
||||||
/*
|
|
||||||
Copyright 2025 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestCreateTenant(t *testing.T) {
|
|
||||||
tests := []struct {
|
|
||||||
name string
|
|
||||||
args string
|
|
||||||
assert assertFunc
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
name: "no args",
|
|
||||||
args: "create tenant",
|
|
||||||
assert: assertError("name is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "no namespace",
|
|
||||||
args: "create tenant dev-team --cluster-role=cluster-admin",
|
|
||||||
assert: assertError("with-namespace is required"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "basic tenant",
|
|
||||||
args: "create tenant dev-team --with-namespace=apps --cluster-role=cluster-admin --export",
|
|
||||||
assert: assertGoldenFile("./testdata/create_tenant/tenant-basic.yaml"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "tenant with custom serviceaccount",
|
|
||||||
args: "create tenant dev-team --with-namespace=apps --cluster-role=cluster-admin --with-service-account=flux-tenant --export",
|
|
||||||
assert: assertGoldenFile("./testdata/create_tenant/tenant-with-service-account.yaml"),
|
|
||||||
},
|
|
||||||
{
|
|
||||||
name: "tenant with custom cluster role",
|
|
||||||
args: "create tenant dev-team --with-namespace=apps --cluster-role=custom-role --export",
|
|
||||||
assert: assertGoldenFile("./testdata/create_tenant/tenant-with-cluster-role.yaml"),
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, tt := range tests {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.args,
|
|
||||||
assert: tt.assert,
|
|
||||||
}
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,31 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
)
|
|
||||||
|
|
||||||
var debugCmd = &cobra.Command{
|
|
||||||
Use: "debug",
|
|
||||||
Short: "Debug a flux resource",
|
|
||||||
Long: `The debug command can be used to troubleshoot failing resource reconciliations.`,
|
|
||||||
}
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
rootCmd.AddCommand(debugCmd)
|
|
||||||
}
|
|
||||||
@ -1,113 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
helmv2 "github.com/fluxcd/helm-controller/api/v2"
|
|
||||||
"github.com/fluxcd/pkg/chartutil"
|
|
||||||
"github.com/go-logr/logr"
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
"k8s.io/apimachinery/pkg/types"
|
|
||||||
"sigs.k8s.io/yaml"
|
|
||||||
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/utils"
|
|
||||||
)
|
|
||||||
|
|
||||||
var debugHelmReleaseCmd = &cobra.Command{
|
|
||||||
Use: "helmrelease [name]",
|
|
||||||
Aliases: []string{"hr"},
|
|
||||||
Short: "Debug a HelmRelease resource",
|
|
||||||
Long: withPreviewNote(`The debug helmrelease command can be used to troubleshoot failing Helm release reconciliations.
|
|
||||||
WARNING: This command will print sensitive information if Kubernetes Secrets are referenced in the HelmRelease .spec.valuesFrom field.`),
|
|
||||||
Example: ` # Print the status of a Helm release
|
|
||||||
flux debug hr podinfo --show-status
|
|
||||||
|
|
||||||
# Export the final values of a Helm release composed from referred ConfigMaps and Secrets
|
|
||||||
flux debug hr podinfo --show-values > values.yaml`,
|
|
||||||
RunE: debugHelmReleaseCmdRun,
|
|
||||||
Args: cobra.ExactArgs(1),
|
|
||||||
ValidArgsFunction: resourceNamesCompletionFunc(helmv2.GroupVersion.WithKind(helmv2.HelmReleaseKind)),
|
|
||||||
}
|
|
||||||
|
|
||||||
type debugHelmReleaseFlags struct {
|
|
||||||
showStatus bool
|
|
||||||
showValues bool
|
|
||||||
}
|
|
||||||
|
|
||||||
var debugHelmReleaseArgs debugHelmReleaseFlags
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
debugHelmReleaseCmd.Flags().BoolVar(&debugHelmReleaseArgs.showStatus, "show-status", false, "print the status of the Helm release")
|
|
||||||
debugHelmReleaseCmd.Flags().BoolVar(&debugHelmReleaseArgs.showValues, "show-values", false, "print the final values of the Helm release")
|
|
||||||
debugCmd.AddCommand(debugHelmReleaseCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func debugHelmReleaseCmdRun(cmd *cobra.Command, args []string) error {
|
|
||||||
name := args[0]
|
|
||||||
|
|
||||||
if (!debugHelmReleaseArgs.showStatus && !debugHelmReleaseArgs.showValues) ||
|
|
||||||
(debugHelmReleaseArgs.showStatus && debugHelmReleaseArgs.showValues) {
|
|
||||||
return fmt.Errorf("either --show-status or --show-values must be set")
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
|
||||||
defer cancel()
|
|
||||||
|
|
||||||
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
hr := &helmv2.HelmRelease{}
|
|
||||||
hrName := types.NamespacedName{Namespace: *kubeconfigArgs.Namespace, Name: name}
|
|
||||||
if err := kubeClient.Get(ctx, hrName, hr); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if debugHelmReleaseArgs.showStatus {
|
|
||||||
status, err := yaml.Marshal(hr.Status)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
rootCmd.Println("# Status documentation: https://fluxcd.io/flux/components/helm/helmreleases/#helmrelease-status")
|
|
||||||
rootCmd.Print(string(status))
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
if debugHelmReleaseArgs.showValues {
|
|
||||||
finalValues, err := chartutil.ChartValuesFromReferences(ctx,
|
|
||||||
logr.Discard(),
|
|
||||||
kubeClient,
|
|
||||||
hr.GetNamespace(),
|
|
||||||
hr.GetValues(),
|
|
||||||
hr.Spec.ValuesFrom...)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
values, err := yaml.Marshal(finalValues)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
rootCmd.Print(string(values))
|
|
||||||
}
|
|
||||||
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@ -1,71 +0,0 @@
|
|||||||
//go:build unit
|
|
||||||
// +build unit
|
|
||||||
|
|
||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestDebugHelmRelease(t *testing.T) {
|
|
||||||
namespace := allocateNamespace("debug")
|
|
||||||
|
|
||||||
objectFile := "testdata/debug_helmrelease/objects.yaml"
|
|
||||||
tmpl := map[string]string{
|
|
||||||
"fluxns": namespace,
|
|
||||||
}
|
|
||||||
testEnv.CreateObjectFile(objectFile, tmpl, t)
|
|
||||||
|
|
||||||
cases := []struct {
|
|
||||||
name string
|
|
||||||
arg string
|
|
||||||
goldenFile string
|
|
||||||
tmpl map[string]string
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
"debug status",
|
|
||||||
"debug helmrelease test-values-inline --show-status --show-values=false",
|
|
||||||
"testdata/debug_helmrelease/status.golden.yaml",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"debug values",
|
|
||||||
"debug helmrelease test-values-inline --show-values --show-status=false",
|
|
||||||
"testdata/debug_helmrelease/values-inline.golden.yaml",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"debug values from",
|
|
||||||
"debug helmrelease test-values-from --show-values --show-status=false",
|
|
||||||
"testdata/debug_helmrelease/values-from.golden.yaml",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, tt := range cases {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.arg + " -n=" + namespace,
|
|
||||||
assert: assertGoldenTemplateFile(tt.goldenFile, tmpl),
|
|
||||||
}
|
|
||||||
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,134 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"errors"
|
|
||||||
"fmt"
|
|
||||||
"sort"
|
|
||||||
"strings"
|
|
||||||
|
|
||||||
kustomizev1 "github.com/fluxcd/kustomize-controller/api/v1"
|
|
||||||
"github.com/fluxcd/pkg/kustomize"
|
|
||||||
"github.com/spf13/cobra"
|
|
||||||
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
|
||||||
"k8s.io/apimachinery/pkg/runtime"
|
|
||||||
"k8s.io/apimachinery/pkg/types"
|
|
||||||
"sigs.k8s.io/yaml"
|
|
||||||
|
|
||||||
"github.com/fluxcd/flux2/v2/internal/utils"
|
|
||||||
)
|
|
||||||
|
|
||||||
var debugKustomizationCmd = &cobra.Command{
|
|
||||||
Use: "kustomization [name]",
|
|
||||||
Aliases: []string{"ks"},
|
|
||||||
Short: "Debug a Flux Kustomization resource",
|
|
||||||
Long: withPreviewNote(`The debug kustomization command can be used to troubleshoot failing Flux Kustomization reconciliations.
|
|
||||||
WARNING: This command will print sensitive information if Kubernetes Secrets are referenced in the Kustomization .spec.postBuild.substituteFrom field.`),
|
|
||||||
Example: ` # Print the status of a Flux Kustomization
|
|
||||||
flux debug ks podinfo --show-status
|
|
||||||
|
|
||||||
# Export the final variables used for post-build substitutions composed from referred ConfigMaps and Secrets
|
|
||||||
flux debug ks podinfo --show-vars > vars.env`,
|
|
||||||
RunE: debugKustomizationCmdRun,
|
|
||||||
Args: cobra.ExactArgs(1),
|
|
||||||
ValidArgsFunction: resourceNamesCompletionFunc(kustomizev1.GroupVersion.WithKind(kustomizev1.KustomizationKind)),
|
|
||||||
}
|
|
||||||
|
|
||||||
type debugKustomizationFlags struct {
|
|
||||||
showStatus bool
|
|
||||||
showVars bool
|
|
||||||
}
|
|
||||||
|
|
||||||
var debugKustomizationArgs debugKustomizationFlags
|
|
||||||
|
|
||||||
func init() {
|
|
||||||
debugKustomizationCmd.Flags().BoolVar(&debugKustomizationArgs.showStatus, "show-status", false, "print the status of the Flux Kustomization")
|
|
||||||
debugKustomizationCmd.Flags().BoolVar(&debugKustomizationArgs.showVars, "show-vars", false, "print the final vars of the Flux Kustomization in dot env format")
|
|
||||||
debugCmd.AddCommand(debugKustomizationCmd)
|
|
||||||
}
|
|
||||||
|
|
||||||
func debugKustomizationCmdRun(cmd *cobra.Command, args []string) error {
|
|
||||||
name := args[0]
|
|
||||||
|
|
||||||
if (!debugKustomizationArgs.showStatus && !debugKustomizationArgs.showVars) ||
|
|
||||||
(debugKustomizationArgs.showStatus && debugKustomizationArgs.showVars) {
|
|
||||||
return fmt.Errorf("either --show-status or --show-vars must be set")
|
|
||||||
}
|
|
||||||
|
|
||||||
ctx, cancel := context.WithTimeout(context.Background(), rootArgs.timeout)
|
|
||||||
defer cancel()
|
|
||||||
|
|
||||||
kubeClient, err := utils.KubeClient(kubeconfigArgs, kubeclientOptions)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
ks := &kustomizev1.Kustomization{}
|
|
||||||
ksName := types.NamespacedName{Namespace: *kubeconfigArgs.Namespace, Name: name}
|
|
||||||
if err := kubeClient.Get(ctx, ksName, ks); err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if debugKustomizationArgs.showStatus {
|
|
||||||
status, err := yaml.Marshal(ks.Status)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
rootCmd.Println("# Status documentation: https://fluxcd.io/flux/components/kustomize/kustomizations/#kustomization-status")
|
|
||||||
rootCmd.Print(string(status))
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
|
|
||||||
if debugKustomizationArgs.showVars {
|
|
||||||
if ks.Spec.PostBuild == nil {
|
|
||||||
return errors.New("no post build substitutions found")
|
|
||||||
}
|
|
||||||
|
|
||||||
ksObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(ks)
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
finalVars, err := kustomize.LoadVariables(ctx, kubeClient, unstructured.Unstructured{Object: ksObj})
|
|
||||||
if err != nil {
|
|
||||||
return err
|
|
||||||
}
|
|
||||||
|
|
||||||
if len(ks.Spec.PostBuild.Substitute) > 0 {
|
|
||||||
for k, v := range ks.Spec.PostBuild.Substitute {
|
|
||||||
// Remove new lines from the values as they are not supported.
|
|
||||||
// Replicates the controller behavior from
|
|
||||||
// https://github.com/fluxcd/pkg/blob/main/kustomize/kustomize_varsub.go
|
|
||||||
finalVars[k] = strings.ReplaceAll(v, "\n", "")
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
keys := make([]string, 0, len(finalVars))
|
|
||||||
for k := range finalVars {
|
|
||||||
keys = append(keys, k)
|
|
||||||
}
|
|
||||||
sort.Strings(keys)
|
|
||||||
|
|
||||||
for _, k := range keys {
|
|
||||||
rootCmd.Println(k + "=" + finalVars[k])
|
|
||||||
}
|
|
||||||
}
|
|
||||||
|
|
||||||
return nil
|
|
||||||
}
|
|
||||||
@ -1,71 +0,0 @@
|
|||||||
//go:build unit
|
|
||||||
// +build unit
|
|
||||||
|
|
||||||
/*
|
|
||||||
Copyright 2024 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func TestDebugKustomization(t *testing.T) {
|
|
||||||
namespace := allocateNamespace("debug")
|
|
||||||
|
|
||||||
objectFile := "testdata/debug_kustomization/objects.yaml"
|
|
||||||
tmpl := map[string]string{
|
|
||||||
"fluxns": namespace,
|
|
||||||
}
|
|
||||||
testEnv.CreateObjectFile(objectFile, tmpl, t)
|
|
||||||
|
|
||||||
cases := []struct {
|
|
||||||
name string
|
|
||||||
arg string
|
|
||||||
goldenFile string
|
|
||||||
tmpl map[string]string
|
|
||||||
}{
|
|
||||||
{
|
|
||||||
"debug status",
|
|
||||||
"debug ks test --show-status --show-vars=false",
|
|
||||||
"testdata/debug_kustomization/status.golden.yaml",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"debug vars",
|
|
||||||
"debug ks test --show-vars --show-status=false",
|
|
||||||
"testdata/debug_kustomization/vars.golden.env",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"debug vars from",
|
|
||||||
"debug ks test-from --show-vars --show-status=false",
|
|
||||||
"testdata/debug_kustomization/vars-from.golden.env",
|
|
||||||
tmpl,
|
|
||||||
},
|
|
||||||
}
|
|
||||||
|
|
||||||
for _, tt := range cases {
|
|
||||||
t.Run(tt.name, func(t *testing.T) {
|
|
||||||
cmd := cmdTestCase{
|
|
||||||
args: tt.arg + " -n=" + namespace,
|
|
||||||
assert: assertGoldenTemplateFile(tt.goldenFile, tmpl),
|
|
||||||
}
|
|
||||||
|
|
||||||
cmd.runTestCmd(t)
|
|
||||||
})
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,41 +0,0 @@
|
|||||||
/*
|
|
||||||
Copyright 2025 The Flux authors
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"context"
|
|
||||||
"fmt"
|
|
||||||
|
|
||||||
"github.com/google/go-containerregistry/pkg/crane"
|
|
||||||
|
|
||||||
"github.com/fluxcd/pkg/auth"
|
|
||||||
"github.com/fluxcd/pkg/auth/azure"
|
|
||||||
authutils "github.com/fluxcd/pkg/auth/utils"
|
|
||||||
)
|
|
||||||
|
|
||||||
// loginWithProvider gets a crane authentication option for the given provider and URL.
|
|
||||||
func loginWithProvider(ctx context.Context, url, provider string) (crane.Option, error) {
|
|
||||||
var opts []auth.Option
|
|
||||||
if provider == azure.ProviderName {
|
|
||||||
opts = append(opts, auth.WithAllowShellOut())
|
|
||||||
}
|
|
||||||
authenticator, err := authutils.GetArtifactRegistryCredentials(ctx, provider, url, opts...)
|
|
||||||
if err != nil {
|
|
||||||
return nil, fmt.Errorf("could not login to provider %s with url %s: %w", provider, url, err)
|
|
||||||
}
|
|
||||||
return crane.WithAuth(authenticator), nil
|
|
||||||
}
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in New Issue