mirror of https://github.com/helm/helm
Gabb-c
5 years ago
committed by
GitHub
commit
7f8a9652e0
@ -0,0 +1,7 @@
|
||||
version: 2
|
||||
|
||||
updates:
|
||||
- package-ecosystem: "gomod"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
@ -0,0 +1,60 @@
|
||||
// +build !windows
|
||||
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"os/user"
|
||||
"path/filepath"
|
||||
)
|
||||
|
||||
func checkPerms(out io.Writer) {
|
||||
// This function MUST NOT FAIL, as it is just a check for a common permissions problem.
|
||||
// If for some reason the function hits a stopping condition, it may panic. But only if
|
||||
// we can be sure that it is panicing because Helm cannot proceed.
|
||||
|
||||
kc := settings.KubeConfig
|
||||
if kc == "" {
|
||||
kc = os.Getenv("KUBECONFIG")
|
||||
}
|
||||
if kc == "" {
|
||||
u, err := user.Current()
|
||||
if err != nil {
|
||||
// No idea where to find KubeConfig, so return silently. Many helm commands
|
||||
// can proceed happily without a KUBECONFIG, so this is not a fatal error.
|
||||
return
|
||||
}
|
||||
kc = filepath.Join(u.HomeDir, ".kube", "config")
|
||||
}
|
||||
fi, err := os.Stat(kc)
|
||||
if err != nil {
|
||||
// DO NOT error if no KubeConfig is found. Not all commands require one.
|
||||
return
|
||||
}
|
||||
|
||||
perm := fi.Mode().Perm()
|
||||
if perm&0040 > 0 {
|
||||
fmt.Fprintf(out, "WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: %s\n", kc)
|
||||
}
|
||||
if perm&0004 > 0 {
|
||||
fmt.Fprintf(out, "WARNING: Kubernetes configuration file is world-readable. This is insecure. Location: %s\n", kc)
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,63 @@
|
||||
// +build !windows
|
||||
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestCheckPerms(t *testing.T) {
|
||||
tdir, err := ioutil.TempDir("", "helmtest")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer os.RemoveAll(tdir)
|
||||
tfile := filepath.Join(tdir, "testconfig")
|
||||
fh, err := os.OpenFile(tfile, os.O_CREATE|os.O_APPEND|os.O_RDWR, 0440)
|
||||
if err != nil {
|
||||
t.Errorf("Failed to create temp file: %s", err)
|
||||
}
|
||||
|
||||
tconfig := settings.KubeConfig
|
||||
settings.KubeConfig = tfile
|
||||
defer func() { settings.KubeConfig = tconfig }()
|
||||
|
||||
var b bytes.Buffer
|
||||
checkPerms(&b)
|
||||
expectPrefix := "WARNING: Kubernetes configuration file is group-readable. This is insecure. Location:"
|
||||
if !strings.HasPrefix(b.String(), expectPrefix) {
|
||||
t.Errorf("Expected to get a warning for group perms. Got %q", b.String())
|
||||
}
|
||||
|
||||
if err := fh.Chmod(0404); err != nil {
|
||||
t.Errorf("Could not change mode on file: %s", err)
|
||||
}
|
||||
b.Reset()
|
||||
checkPerms(&b)
|
||||
expectPrefix = "WARNING: Kubernetes configuration file is world-readable. This is insecure. Location:"
|
||||
if !strings.HasPrefix(b.String(), expectPrefix) {
|
||||
t.Errorf("Expected to get a warning for world perms. Got %q", b.String())
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,24 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import "io"
|
||||
|
||||
func checkPerms(out io.Writer) {
|
||||
// Not yet implemented on Windows. If you know how to do a comprehensive perms
|
||||
// check on Windows, contributions welcomed!
|
||||
}
|
||||
@ -1,5 +1,5 @@
|
||||
table
|
||||
json
|
||||
yaml
|
||||
:0
|
||||
Completion ended with directive: ShellCompDirectiveDefault
|
||||
:4
|
||||
Completion ended with directive: ShellCompDirectiveNoFileComp
|
||||
|
||||
@ -0,0 +1 @@
|
||||
"test-name" already exists with the same configuration, skipping
|
||||
@ -0,0 +1,99 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package chartutil
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
// validName is a regular expression for resource names.
|
||||
//
|
||||
// According to the Kubernetes help text, the regular expression it uses is:
|
||||
//
|
||||
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||
//
|
||||
// This follows the above regular expression (but requires a full string match, not partial).
|
||||
//
|
||||
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
var validName = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)
|
||||
|
||||
var (
|
||||
// errMissingName indicates that a release (name) was not provided.
|
||||
errMissingName = errors.New("no name provided")
|
||||
|
||||
// errInvalidName indicates that an invalid release name was provided
|
||||
errInvalidName = errors.New("invalid release name, must match regex ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])+$ and the length must not longer than 53")
|
||||
|
||||
// errInvalidKubernetesName indicates that the name does not meet the Kubernetes
|
||||
// restrictions on metadata names.
|
||||
errInvalidKubernetesName = errors.New("invalid metadata name, must match regex ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])+$ and the length must not longer than 253")
|
||||
)
|
||||
|
||||
const (
|
||||
// maxNameLen is the maximum length Helm allows for a release name
|
||||
maxReleaseNameLen = 53
|
||||
// maxMetadataNameLen is the maximum length Kubernetes allows for any name.
|
||||
maxMetadataNameLen = 253
|
||||
)
|
||||
|
||||
// ValidateReleaseName performs checks for an entry for a Helm release name
|
||||
//
|
||||
// For Helm to allow a name, it must be below a certain character count (53) and also match
|
||||
// a reguar expression.
|
||||
//
|
||||
// According to the Kubernetes help text, the regular expression it uses is:
|
||||
//
|
||||
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||
//
|
||||
// This follows the above regular expression (but requires a full string match, not partial).
|
||||
//
|
||||
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
func ValidateReleaseName(name string) error {
|
||||
// This case is preserved for backwards compatibility
|
||||
if name == "" {
|
||||
return errMissingName
|
||||
|
||||
}
|
||||
if len(name) > maxReleaseNameLen || !validName.MatchString(name) {
|
||||
return errInvalidName
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ValidateMetadataName validates the name field of a Kubernetes metadata object.
|
||||
//
|
||||
// Empty strings, strings longer than 253 chars, or strings that don't match the regexp
|
||||
// will fail.
|
||||
//
|
||||
// According to the Kubernetes help text, the regular expression it uses is:
|
||||
//
|
||||
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||
//
|
||||
// This follows the above regular expression (but requires a full string match, not partial).
|
||||
//
|
||||
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
func ValidateMetadataName(name string) error {
|
||||
if name == "" || len(name) > maxMetadataNameLen || !validName.MatchString(name) {
|
||||
return errInvalidKubernetesName
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@ -0,0 +1,91 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package chartutil
|
||||
|
||||
import "testing"
|
||||
|
||||
// TestValidateName is a regression test for ValidateName
|
||||
//
|
||||
// Kubernetes has strict naming conventions for resource names. This test represents
|
||||
// those conventions.
|
||||
//
|
||||
// See https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
//
|
||||
// NOTE: At the time of this writing, the docs above say that names cannot begin with
|
||||
// digits. However, `kubectl`'s regular expression explicit allows this, and
|
||||
// Kubernetes (at least as of 1.18) also accepts resources whose names begin with digits.
|
||||
func TestValidateReleaseName(t *testing.T) {
|
||||
names := map[string]bool{
|
||||
"": false,
|
||||
"foo": true,
|
||||
"foo.bar1234baz.seventyone": true,
|
||||
"FOO": false,
|
||||
"123baz": true,
|
||||
"foo.BAR.baz": false,
|
||||
"one-two": true,
|
||||
"-two": false,
|
||||
"one_two": false,
|
||||
"a..b": false,
|
||||
"%^&#$%*@^*@&#^": false,
|
||||
"example:com": false,
|
||||
"example%%com": false,
|
||||
"a1111111111111111111111111111111111111111111111111111111111z": false,
|
||||
}
|
||||
for input, expectPass := range names {
|
||||
if err := ValidateReleaseName(input); (err == nil) != expectPass {
|
||||
st := "fail"
|
||||
if expectPass {
|
||||
st = "succeed"
|
||||
}
|
||||
t.Errorf("Expected %q to %s", input, st)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateMetadataName(t *testing.T) {
|
||||
names := map[string]bool{
|
||||
"": false,
|
||||
"foo": true,
|
||||
"foo.bar1234baz.seventyone": true,
|
||||
"FOO": false,
|
||||
"123baz": true,
|
||||
"foo.BAR.baz": false,
|
||||
"one-two": true,
|
||||
"-two": false,
|
||||
"one_two": false,
|
||||
"a..b": false,
|
||||
"%^&#$%*@^*@&#^": false,
|
||||
"example:com": false,
|
||||
"example%%com": false,
|
||||
"a1111111111111111111111111111111111111111111111111111111111z": true,
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z": false,
|
||||
}
|
||||
for input, expectPass := range names {
|
||||
if err := ValidateMetadataName(input); (err == nil) != expectPass {
|
||||
st := "fail"
|
||||
if expectPass {
|
||||
st = "succeed"
|
||||
}
|
||||
t.Errorf("Expected %q to %s", input, st)
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,40 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package installer
|
||||
|
||||
import "testing"
|
||||
|
||||
func TestIsRemoteHTTPArchive(t *testing.T) {
|
||||
srv := mockArchiveServer()
|
||||
defer srv.Close()
|
||||
source := srv.URL + "/plugins/fake-plugin-0.0.1.tar.gz"
|
||||
|
||||
if isRemoteHTTPArchive("/not/a/URL") {
|
||||
t.Errorf("Expected non-URL to return false")
|
||||
}
|
||||
|
||||
if isRemoteHTTPArchive("https://127.0.0.1:123/fake/plugin-1.2.3.tgz") {
|
||||
t.Errorf("Bad URL should not have succeeded.")
|
||||
}
|
||||
|
||||
if !isRemoteHTTPArchive(source) {
|
||||
t.Errorf("Expected %q to be a valid archive URL", source)
|
||||
}
|
||||
|
||||
if isRemoteHTTPArchive(source + "-not-an-extension") {
|
||||
t.Error("Expected media type match to fail")
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,11 @@
|
||||
name: "duplicate-entries"
|
||||
version: "0.1.0"
|
||||
usage: "usage"
|
||||
description: |-
|
||||
description
|
||||
command: "echo hello"
|
||||
ignoreFlags: true
|
||||
hooks:
|
||||
install: "echo installing..."
|
||||
hooks:
|
||||
install: "echo installing something different"
|
||||
@ -0,0 +1,50 @@
|
||||
serverInfo:
|
||||
contextPath: /v1/helm
|
||||
apiVersion: v1
|
||||
entries:
|
||||
nginx:
|
||||
- urls:
|
||||
- https://kubernetes-charts.storage.googleapis.com/nginx-0.2.0.tgz
|
||||
name: nginx
|
||||
description: string
|
||||
version: 0.2.0
|
||||
home: https://github.com/something/else
|
||||
digest: "sha256:1234567890abcdef"
|
||||
keywords:
|
||||
- popular
|
||||
- web server
|
||||
- proxy
|
||||
- urls:
|
||||
- https://kubernetes-charts.storage.googleapis.com/nginx-0.1.0.tgz
|
||||
name: nginx
|
||||
description: string
|
||||
version: 0.1.0
|
||||
home: https://github.com/something
|
||||
digest: "sha256:1234567890abcdef"
|
||||
keywords:
|
||||
- popular
|
||||
- web server
|
||||
- proxy
|
||||
alpine:
|
||||
- urls:
|
||||
- https://kubernetes-charts.storage.googleapis.com/alpine-1.0.0.tgz
|
||||
- http://storage2.googleapis.com/kubernetes-charts/alpine-1.0.0.tgz
|
||||
name: alpine
|
||||
description: string
|
||||
version: 1.0.0
|
||||
home: https://github.com/something
|
||||
keywords:
|
||||
- linux
|
||||
- alpine
|
||||
- small
|
||||
- sumtin
|
||||
digest: "sha256:1234567890abcdef"
|
||||
chartWithNoURL:
|
||||
- name: chartWithNoURL
|
||||
description: string
|
||||
version: 1.0.0
|
||||
home: https://github.com/something
|
||||
keywords:
|
||||
- small
|
||||
- sumtin
|
||||
digest: "sha256:1234567890abcdef"
|
||||
Loading…
Reference in new issue