mirror of https://github.com/helm/helm
Gabb-c
5 years ago
committed by
GitHub
commit
7f8a9652e0
@ -0,0 +1,7 @@
|
|||||||
|
version: 2
|
||||||
|
|
||||||
|
updates:
|
||||||
|
- package-ecosystem: "gomod"
|
||||||
|
directory: "/"
|
||||||
|
schedule:
|
||||||
|
interval: "daily"
|
||||||
@ -0,0 +1,60 @@
|
|||||||
|
// +build !windows
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"os/user"
|
||||||
|
"path/filepath"
|
||||||
|
)
|
||||||
|
|
||||||
|
func checkPerms(out io.Writer) {
|
||||||
|
// This function MUST NOT FAIL, as it is just a check for a common permissions problem.
|
||||||
|
// If for some reason the function hits a stopping condition, it may panic. But only if
|
||||||
|
// we can be sure that it is panicing because Helm cannot proceed.
|
||||||
|
|
||||||
|
kc := settings.KubeConfig
|
||||||
|
if kc == "" {
|
||||||
|
kc = os.Getenv("KUBECONFIG")
|
||||||
|
}
|
||||||
|
if kc == "" {
|
||||||
|
u, err := user.Current()
|
||||||
|
if err != nil {
|
||||||
|
// No idea where to find KubeConfig, so return silently. Many helm commands
|
||||||
|
// can proceed happily without a KUBECONFIG, so this is not a fatal error.
|
||||||
|
return
|
||||||
|
}
|
||||||
|
kc = filepath.Join(u.HomeDir, ".kube", "config")
|
||||||
|
}
|
||||||
|
fi, err := os.Stat(kc)
|
||||||
|
if err != nil {
|
||||||
|
// DO NOT error if no KubeConfig is found. Not all commands require one.
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
perm := fi.Mode().Perm()
|
||||||
|
if perm&0040 > 0 {
|
||||||
|
fmt.Fprintf(out, "WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: %s\n", kc)
|
||||||
|
}
|
||||||
|
if perm&0004 > 0 {
|
||||||
|
fmt.Fprintf(out, "WARNING: Kubernetes configuration file is world-readable. This is insecure. Location: %s\n", kc)
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,63 @@
|
|||||||
|
// +build !windows
|
||||||
|
|
||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"io/ioutil"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestCheckPerms(t *testing.T) {
|
||||||
|
tdir, err := ioutil.TempDir("", "helmtest")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
defer os.RemoveAll(tdir)
|
||||||
|
tfile := filepath.Join(tdir, "testconfig")
|
||||||
|
fh, err := os.OpenFile(tfile, os.O_CREATE|os.O_APPEND|os.O_RDWR, 0440)
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("Failed to create temp file: %s", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
tconfig := settings.KubeConfig
|
||||||
|
settings.KubeConfig = tfile
|
||||||
|
defer func() { settings.KubeConfig = tconfig }()
|
||||||
|
|
||||||
|
var b bytes.Buffer
|
||||||
|
checkPerms(&b)
|
||||||
|
expectPrefix := "WARNING: Kubernetes configuration file is group-readable. This is insecure. Location:"
|
||||||
|
if !strings.HasPrefix(b.String(), expectPrefix) {
|
||||||
|
t.Errorf("Expected to get a warning for group perms. Got %q", b.String())
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := fh.Chmod(0404); err != nil {
|
||||||
|
t.Errorf("Could not change mode on file: %s", err)
|
||||||
|
}
|
||||||
|
b.Reset()
|
||||||
|
checkPerms(&b)
|
||||||
|
expectPrefix = "WARNING: Kubernetes configuration file is world-readable. This is insecure. Location:"
|
||||||
|
if !strings.HasPrefix(b.String(), expectPrefix) {
|
||||||
|
t.Errorf("Expected to get a warning for world perms. Got %q", b.String())
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
||||||
@ -0,0 +1,24 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import "io"
|
||||||
|
|
||||||
|
func checkPerms(out io.Writer) {
|
||||||
|
// Not yet implemented on Windows. If you know how to do a comprehensive perms
|
||||||
|
// check on Windows, contributions welcomed!
|
||||||
|
}
|
||||||
@ -1,5 +1,5 @@
|
|||||||
table
|
table
|
||||||
json
|
json
|
||||||
yaml
|
yaml
|
||||||
:0
|
:4
|
||||||
Completion ended with directive: ShellCompDirectiveDefault
|
Completion ended with directive: ShellCompDirectiveNoFileComp
|
||||||
|
|||||||
@ -0,0 +1 @@
|
|||||||
|
"test-name" already exists with the same configuration, skipping
|
||||||
@ -0,0 +1,99 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package chartutil
|
||||||
|
|
||||||
|
import (
|
||||||
|
"regexp"
|
||||||
|
|
||||||
|
"github.com/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// validName is a regular expression for resource names.
|
||||||
|
//
|
||||||
|
// According to the Kubernetes help text, the regular expression it uses is:
|
||||||
|
//
|
||||||
|
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||||
|
//
|
||||||
|
// This follows the above regular expression (but requires a full string match, not partial).
|
||||||
|
//
|
||||||
|
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||||
|
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||||
|
var validName = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)
|
||||||
|
|
||||||
|
var (
|
||||||
|
// errMissingName indicates that a release (name) was not provided.
|
||||||
|
errMissingName = errors.New("no name provided")
|
||||||
|
|
||||||
|
// errInvalidName indicates that an invalid release name was provided
|
||||||
|
errInvalidName = errors.New("invalid release name, must match regex ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])+$ and the length must not longer than 53")
|
||||||
|
|
||||||
|
// errInvalidKubernetesName indicates that the name does not meet the Kubernetes
|
||||||
|
// restrictions on metadata names.
|
||||||
|
errInvalidKubernetesName = errors.New("invalid metadata name, must match regex ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])+$ and the length must not longer than 253")
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
// maxNameLen is the maximum length Helm allows for a release name
|
||||||
|
maxReleaseNameLen = 53
|
||||||
|
// maxMetadataNameLen is the maximum length Kubernetes allows for any name.
|
||||||
|
maxMetadataNameLen = 253
|
||||||
|
)
|
||||||
|
|
||||||
|
// ValidateReleaseName performs checks for an entry for a Helm release name
|
||||||
|
//
|
||||||
|
// For Helm to allow a name, it must be below a certain character count (53) and also match
|
||||||
|
// a reguar expression.
|
||||||
|
//
|
||||||
|
// According to the Kubernetes help text, the regular expression it uses is:
|
||||||
|
//
|
||||||
|
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||||
|
//
|
||||||
|
// This follows the above regular expression (but requires a full string match, not partial).
|
||||||
|
//
|
||||||
|
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||||
|
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||||
|
func ValidateReleaseName(name string) error {
|
||||||
|
// This case is preserved for backwards compatibility
|
||||||
|
if name == "" {
|
||||||
|
return errMissingName
|
||||||
|
|
||||||
|
}
|
||||||
|
if len(name) > maxReleaseNameLen || !validName.MatchString(name) {
|
||||||
|
return errInvalidName
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateMetadataName validates the name field of a Kubernetes metadata object.
|
||||||
|
//
|
||||||
|
// Empty strings, strings longer than 253 chars, or strings that don't match the regexp
|
||||||
|
// will fail.
|
||||||
|
//
|
||||||
|
// According to the Kubernetes help text, the regular expression it uses is:
|
||||||
|
//
|
||||||
|
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||||
|
//
|
||||||
|
// This follows the above regular expression (but requires a full string match, not partial).
|
||||||
|
//
|
||||||
|
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||||
|
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||||
|
func ValidateMetadataName(name string) error {
|
||||||
|
if name == "" || len(name) > maxMetadataNameLen || !validName.MatchString(name) {
|
||||||
|
return errInvalidKubernetesName
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
@ -0,0 +1,91 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package chartutil
|
||||||
|
|
||||||
|
import "testing"
|
||||||
|
|
||||||
|
// TestValidateName is a regression test for ValidateName
|
||||||
|
//
|
||||||
|
// Kubernetes has strict naming conventions for resource names. This test represents
|
||||||
|
// those conventions.
|
||||||
|
//
|
||||||
|
// See https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||||
|
//
|
||||||
|
// NOTE: At the time of this writing, the docs above say that names cannot begin with
|
||||||
|
// digits. However, `kubectl`'s regular expression explicit allows this, and
|
||||||
|
// Kubernetes (at least as of 1.18) also accepts resources whose names begin with digits.
|
||||||
|
func TestValidateReleaseName(t *testing.T) {
|
||||||
|
names := map[string]bool{
|
||||||
|
"": false,
|
||||||
|
"foo": true,
|
||||||
|
"foo.bar1234baz.seventyone": true,
|
||||||
|
"FOO": false,
|
||||||
|
"123baz": true,
|
||||||
|
"foo.BAR.baz": false,
|
||||||
|
"one-two": true,
|
||||||
|
"-two": false,
|
||||||
|
"one_two": false,
|
||||||
|
"a..b": false,
|
||||||
|
"%^&#$%*@^*@&#^": false,
|
||||||
|
"example:com": false,
|
||||||
|
"example%%com": false,
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z": false,
|
||||||
|
}
|
||||||
|
for input, expectPass := range names {
|
||||||
|
if err := ValidateReleaseName(input); (err == nil) != expectPass {
|
||||||
|
st := "fail"
|
||||||
|
if expectPass {
|
||||||
|
st = "succeed"
|
||||||
|
}
|
||||||
|
t.Errorf("Expected %q to %s", input, st)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestValidateMetadataName(t *testing.T) {
|
||||||
|
names := map[string]bool{
|
||||||
|
"": false,
|
||||||
|
"foo": true,
|
||||||
|
"foo.bar1234baz.seventyone": true,
|
||||||
|
"FOO": false,
|
||||||
|
"123baz": true,
|
||||||
|
"foo.BAR.baz": false,
|
||||||
|
"one-two": true,
|
||||||
|
"-two": false,
|
||||||
|
"one_two": false,
|
||||||
|
"a..b": false,
|
||||||
|
"%^&#$%*@^*@&#^": false,
|
||||||
|
"example:com": false,
|
||||||
|
"example%%com": false,
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z": true,
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z": false,
|
||||||
|
}
|
||||||
|
for input, expectPass := range names {
|
||||||
|
if err := ValidateMetadataName(input); (err == nil) != expectPass {
|
||||||
|
st := "fail"
|
||||||
|
if expectPass {
|
||||||
|
st = "succeed"
|
||||||
|
}
|
||||||
|
t.Errorf("Expected %q to %s", input, st)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,40 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package installer
|
||||||
|
|
||||||
|
import "testing"
|
||||||
|
|
||||||
|
func TestIsRemoteHTTPArchive(t *testing.T) {
|
||||||
|
srv := mockArchiveServer()
|
||||||
|
defer srv.Close()
|
||||||
|
source := srv.URL + "/plugins/fake-plugin-0.0.1.tar.gz"
|
||||||
|
|
||||||
|
if isRemoteHTTPArchive("/not/a/URL") {
|
||||||
|
t.Errorf("Expected non-URL to return false")
|
||||||
|
}
|
||||||
|
|
||||||
|
if isRemoteHTTPArchive("https://127.0.0.1:123/fake/plugin-1.2.3.tgz") {
|
||||||
|
t.Errorf("Bad URL should not have succeeded.")
|
||||||
|
}
|
||||||
|
|
||||||
|
if !isRemoteHTTPArchive(source) {
|
||||||
|
t.Errorf("Expected %q to be a valid archive URL", source)
|
||||||
|
}
|
||||||
|
|
||||||
|
if isRemoteHTTPArchive(source + "-not-an-extension") {
|
||||||
|
t.Error("Expected media type match to fail")
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,11 @@
|
|||||||
|
name: "duplicate-entries"
|
||||||
|
version: "0.1.0"
|
||||||
|
usage: "usage"
|
||||||
|
description: |-
|
||||||
|
description
|
||||||
|
command: "echo hello"
|
||||||
|
ignoreFlags: true
|
||||||
|
hooks:
|
||||||
|
install: "echo installing..."
|
||||||
|
hooks:
|
||||||
|
install: "echo installing something different"
|
||||||
@ -0,0 +1,50 @@
|
|||||||
|
serverInfo:
|
||||||
|
contextPath: /v1/helm
|
||||||
|
apiVersion: v1
|
||||||
|
entries:
|
||||||
|
nginx:
|
||||||
|
- urls:
|
||||||
|
- https://kubernetes-charts.storage.googleapis.com/nginx-0.2.0.tgz
|
||||||
|
name: nginx
|
||||||
|
description: string
|
||||||
|
version: 0.2.0
|
||||||
|
home: https://github.com/something/else
|
||||||
|
digest: "sha256:1234567890abcdef"
|
||||||
|
keywords:
|
||||||
|
- popular
|
||||||
|
- web server
|
||||||
|
- proxy
|
||||||
|
- urls:
|
||||||
|
- https://kubernetes-charts.storage.googleapis.com/nginx-0.1.0.tgz
|
||||||
|
name: nginx
|
||||||
|
description: string
|
||||||
|
version: 0.1.0
|
||||||
|
home: https://github.com/something
|
||||||
|
digest: "sha256:1234567890abcdef"
|
||||||
|
keywords:
|
||||||
|
- popular
|
||||||
|
- web server
|
||||||
|
- proxy
|
||||||
|
alpine:
|
||||||
|
- urls:
|
||||||
|
- https://kubernetes-charts.storage.googleapis.com/alpine-1.0.0.tgz
|
||||||
|
- http://storage2.googleapis.com/kubernetes-charts/alpine-1.0.0.tgz
|
||||||
|
name: alpine
|
||||||
|
description: string
|
||||||
|
version: 1.0.0
|
||||||
|
home: https://github.com/something
|
||||||
|
keywords:
|
||||||
|
- linux
|
||||||
|
- alpine
|
||||||
|
- small
|
||||||
|
- sumtin
|
||||||
|
digest: "sha256:1234567890abcdef"
|
||||||
|
chartWithNoURL:
|
||||||
|
- name: chartWithNoURL
|
||||||
|
description: string
|
||||||
|
version: 1.0.0
|
||||||
|
home: https://github.com/something
|
||||||
|
keywords:
|
||||||
|
- small
|
||||||
|
- sumtin
|
||||||
|
digest: "sha256:1234567890abcdef"
|
||||||
Loading…
Reference in new issue