mirror of https://github.com/helm/helm
MrJack
1 week ago
committed by
GitHub
commit
81b99295be
@ -1,110 +0,0 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package util
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"regexp"
|
||||
)
|
||||
|
||||
// validName is a regular expression for resource names.
|
||||
//
|
||||
// According to the Kubernetes help text, the regular expression it uses is:
|
||||
//
|
||||
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||
//
|
||||
// This follows the above regular expression (but requires a full string match, not partial).
|
||||
//
|
||||
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
var validName = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)
|
||||
|
||||
var (
|
||||
// errMissingName indicates that a release (name) was not provided.
|
||||
errMissingName = errors.New("no name provided")
|
||||
|
||||
// errInvalidName indicates that an invalid release name was provided
|
||||
errInvalidName = fmt.Errorf(
|
||||
"invalid release name, must match regex %s and the length must not be longer than 53",
|
||||
validName.String())
|
||||
|
||||
// errInvalidKubernetesName indicates that the name does not meet the Kubernetes
|
||||
// restrictions on metadata names.
|
||||
errInvalidKubernetesName = fmt.Errorf(
|
||||
"invalid metadata name, must match regex %s and the length must not be longer than 253",
|
||||
validName.String())
|
||||
)
|
||||
|
||||
const (
|
||||
// According to the Kubernetes docs (https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#rfc-1035-label-names)
|
||||
// some resource names have a max length of 63 characters while others have a max
|
||||
// length of 253 characters. As we cannot be sure the resources used in a chart, we
|
||||
// therefore need to limit it to 63 chars and reserve 10 chars for additional part to name
|
||||
// of the resource. The reason is that chart maintainers can use release name as part of
|
||||
// the resource name (and some additional chars).
|
||||
maxReleaseNameLen = 53
|
||||
// maxMetadataNameLen is the maximum length Kubernetes allows for any name.
|
||||
maxMetadataNameLen = 253
|
||||
)
|
||||
|
||||
// ValidateReleaseName performs checks for an entry for a Helm release name
|
||||
//
|
||||
// For Helm to allow a name, it must be below a certain character count (53) and also match
|
||||
// a regular expression.
|
||||
//
|
||||
// According to the Kubernetes help text, the regular expression it uses is:
|
||||
//
|
||||
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||
//
|
||||
// This follows the above regular expression (but requires a full string match, not partial).
|
||||
//
|
||||
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
func ValidateReleaseName(name string) error {
|
||||
// This case is preserved for backwards compatibility
|
||||
if name == "" {
|
||||
return errMissingName
|
||||
}
|
||||
if len(name) > maxReleaseNameLen || !validName.MatchString(name) {
|
||||
return errInvalidName
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ValidateMetadataName validates the name field of a Kubernetes metadata object.
|
||||
//
|
||||
// Empty strings, strings longer than 253 chars, or strings that don't match the regexp
|
||||
// will fail.
|
||||
//
|
||||
// According to the Kubernetes help text, the regular expression it uses is:
|
||||
//
|
||||
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||
//
|
||||
// This follows the above regular expression (but requires a full string match, not partial).
|
||||
//
|
||||
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
//
|
||||
// Deprecated: remove in Helm 4. Name validation now uses rules defined in
|
||||
// pkg/lint/rules.validateMetadataNameFunc()
|
||||
func ValidateMetadataName(name string) error {
|
||||
if name == "" || len(name) > maxMetadataNameLen || !validName.MatchString(name) {
|
||||
return errInvalidKubernetesName
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@ -1,93 +0,0 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package util
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
// TestValidateReleaseName is a regression test for ValidateName
|
||||
//
|
||||
// Kubernetes has strict naming conventions for resource names. This test represents
|
||||
// those conventions.
|
||||
//
|
||||
// See https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
//
|
||||
// NOTE: At the time of this writing, the docs above say that names cannot begin with
|
||||
// digits. However, `kubectl`'s regular expression explicit allows this, and
|
||||
// Kubernetes (at least as of 1.18) also accepts resources whose names begin with digits.
|
||||
func TestValidateReleaseName(t *testing.T) {
|
||||
names := map[string]bool{
|
||||
"": false,
|
||||
"foo": true,
|
||||
"foo.bar1234baz.seventyone": true,
|
||||
"FOO": false,
|
||||
"123baz": true,
|
||||
"foo.BAR.baz": false,
|
||||
"one-two": true,
|
||||
"-two": false,
|
||||
"one_two": false,
|
||||
"a..b": false,
|
||||
"%^&#$%*@^*@&#^": false,
|
||||
"example:com": false,
|
||||
"example%%com": false,
|
||||
"a1111111111111111111111111111111111111111111111111111111111z": false,
|
||||
}
|
||||
for input, expectPass := range names {
|
||||
err := ValidateReleaseName(input)
|
||||
if expectPass {
|
||||
assert.NoErrorf(t, err, "Expected release name %q to pass validation", input)
|
||||
} else {
|
||||
assert.Errorf(t, err, "Expected release name %q to fail validation, but it passed", input)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateMetadataName(t *testing.T) {
|
||||
names := map[string]bool{
|
||||
"": false,
|
||||
"foo": true,
|
||||
"foo.bar1234baz.seventyone": true,
|
||||
"FOO": false,
|
||||
"123baz": true,
|
||||
"foo.BAR.baz": false,
|
||||
"one-two": true,
|
||||
"-two": false,
|
||||
"one_two": false,
|
||||
"a..b": false,
|
||||
"%^&#$%*@^*@&#^": false,
|
||||
"example:com": false,
|
||||
"example%%com": false,
|
||||
"a1111111111111111111111111111111111111111111111111111111111z": true,
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z": false,
|
||||
}
|
||||
for input, expectPass := range names {
|
||||
err := ValidateMetadataName(input)
|
||||
if expectPass {
|
||||
assert.NoError(t, err, "Expected %q to succeed", input)
|
||||
} else {
|
||||
assert.Error(t, err, "Expected %q to fail", input)
|
||||
}
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,74 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package archive
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"io"
|
||||
"math"
|
||||
"os"
|
||||
)
|
||||
|
||||
// BudgetedReader tracks cumulative file reads against a size limit.
|
||||
type BudgetedReader struct {
|
||||
max int64
|
||||
remaining int64
|
||||
}
|
||||
|
||||
// NewBudgetedReader creates a BudgetedReader with the given maximum total size.
|
||||
// The remaining budget is initialized to the maximum.
|
||||
func NewBudgetedReader(limit int64) *BudgetedReader {
|
||||
return &BudgetedReader{
|
||||
max: limit,
|
||||
remaining: limit,
|
||||
}
|
||||
}
|
||||
|
||||
// ReadFileWithBudget reads a file and decrements the remaining budget by the bytes read.
|
||||
// It returns an error if the total would exceed the configured maximum.
|
||||
// The read is capped via io.LimitReader so a file that grows between stat
|
||||
// and read cannot cause unbounded memory allocation.
|
||||
func (r *BudgetedReader) ReadFileWithBudget(path string, size int64) ([]byte, error) {
|
||||
if size > r.remaining {
|
||||
return nil, fmt.Errorf("chart exceeds maximum decompressed size of %d bytes", r.max)
|
||||
}
|
||||
|
||||
f, err := os.Open(path)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer f.Close()
|
||||
|
||||
// Read at most r.remaining+1 bytes so we can detect over-budget without
|
||||
// allocating unbounded memory if the file grew since stat.
|
||||
// Clamp to avoid int64 overflow when r.remaining is near math.MaxInt64.
|
||||
limit := r.remaining
|
||||
if limit < math.MaxInt64 {
|
||||
limit++
|
||||
}
|
||||
data, err := io.ReadAll(io.LimitReader(f, limit))
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
if int64(len(data)) > r.remaining {
|
||||
return nil, fmt.Errorf("chart exceeds maximum decompressed size of %d bytes", r.max)
|
||||
}
|
||||
|
||||
r.remaining -= int64(len(data))
|
||||
return data, nil
|
||||
}
|
||||
@ -0,0 +1,128 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package archive
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestReadFileWithBudget(t *testing.T) {
|
||||
dir := t.TempDir()
|
||||
|
||||
writeFile := func(t *testing.T, name string, size int) string {
|
||||
t.Helper()
|
||||
p := filepath.Join(dir, name)
|
||||
if err := os.WriteFile(p, make([]byte, size), 0o644); err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
return p
|
||||
}
|
||||
|
||||
tcs := []struct {
|
||||
name string
|
||||
check func(t *testing.T)
|
||||
}{
|
||||
{
|
||||
name: "reads file and decrements budget",
|
||||
check: func(t *testing.T) {
|
||||
t.Helper()
|
||||
p := writeFile(t, "small.txt", 100)
|
||||
fi, err := os.Stat(p)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to stat %s: %v", p, err)
|
||||
}
|
||||
limit := int64(1000)
|
||||
|
||||
br := NewBudgetedReader(limit)
|
||||
data, err := br.ReadFileWithBudget(p, fi.Size())
|
||||
if err != nil {
|
||||
t.Fatalf("unexpected error: %v", err)
|
||||
}
|
||||
if len(data) != 100 {
|
||||
t.Fatalf("expected 100 bytes, got %d", len(data))
|
||||
}
|
||||
if br.remaining != 900 {
|
||||
t.Fatalf("expected remaining=900, got %d", br.remaining)
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "rejects file exceeding budget",
|
||||
check: func(t *testing.T) {
|
||||
t.Helper()
|
||||
p := writeFile(t, "big.txt", 500)
|
||||
fi, err := os.Stat(p)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to stat %s: %v", p, err)
|
||||
}
|
||||
limit := int64(100)
|
||||
|
||||
br := NewBudgetedReader(limit)
|
||||
_, err = br.ReadFileWithBudget(p, fi.Size())
|
||||
if err == nil {
|
||||
t.Fatal("expected error for file exceeding budget")
|
||||
}
|
||||
expectedErr := fmt.Sprintf("chart exceeds maximum decompressed size of %d bytes", limit)
|
||||
if err.Error() != expectedErr {
|
||||
t.Fatalf("expected %q, got %q", expectedErr, err.Error())
|
||||
}
|
||||
if br.remaining != 100 {
|
||||
t.Fatalf("budget should not change on rejection, got %d", br.remaining)
|
||||
}
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "tracks budget across multiple reads",
|
||||
check: func(t *testing.T) {
|
||||
t.Helper()
|
||||
remaining := int64(250)
|
||||
|
||||
br := NewBudgetedReader(remaining)
|
||||
for i := range 3 {
|
||||
p := writeFile(t, fmt.Sprintf("f%d.txt", i), 80)
|
||||
fi, err := os.Stat(p)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to stat %s: %v", p, err)
|
||||
}
|
||||
if _, err := br.ReadFileWithBudget(p, fi.Size()); err != nil {
|
||||
t.Fatalf("read %d: unexpected error: %v", i, err)
|
||||
}
|
||||
}
|
||||
if br.remaining != 10 {
|
||||
t.Fatalf("expected remaining=10, got %d", br.remaining)
|
||||
}
|
||||
|
||||
p := writeFile(t, "over.txt", 20)
|
||||
fi, err := os.Stat(p)
|
||||
if err != nil {
|
||||
t.Fatalf("failed to stat %s: %v", p, err)
|
||||
}
|
||||
_, err = br.ReadFileWithBudget(p, fi.Size())
|
||||
if err == nil {
|
||||
t.Fatal("expected error when cumulative reads exceed budget")
|
||||
}
|
||||
},
|
||||
},
|
||||
}
|
||||
|
||||
for _, tc := range tcs {
|
||||
t.Run(tc.name, tc.check)
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,109 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package cmd
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"fmt"
|
||||
"io"
|
||||
"path/filepath"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/require"
|
||||
|
||||
"helm.sh/helm/v4/pkg/action"
|
||||
"helm.sh/helm/v4/pkg/chart/common"
|
||||
kubefake "helm.sh/helm/v4/pkg/kube/fake"
|
||||
"helm.sh/helm/v4/pkg/repo/v1/repotest"
|
||||
)
|
||||
|
||||
func TestTemplateOCIRegistryMessagesNotOnStdout(t *testing.T) {
|
||||
defer resetEnv()()
|
||||
|
||||
stdout, stderr := runOCIChartCommand(t, func(ref, registryConfig, contentCache string) []string {
|
||||
return []string{
|
||||
"template", "release-name", ref,
|
||||
"--version", "0.1.0",
|
||||
"--plain-http",
|
||||
"--registry-config", registryConfig,
|
||||
"--content-cache", contentCache,
|
||||
}
|
||||
})
|
||||
|
||||
require.NotEmpty(t, stdout)
|
||||
require.NotContains(t, stdout, "Pulled:")
|
||||
require.NotContains(t, stdout, "Digest:")
|
||||
require.Contains(t, stderr, "Pulled:")
|
||||
require.Contains(t, stderr, "Digest:")
|
||||
}
|
||||
|
||||
func TestShowOCIRegistryMessagesNotOnStdout(t *testing.T) {
|
||||
defer resetEnv()()
|
||||
|
||||
stdout, stderr := runOCIChartCommand(t, func(ref, registryConfig, contentCache string) []string {
|
||||
return []string{
|
||||
"show", "chart", ref,
|
||||
"--version", "0.1.0",
|
||||
"--plain-http",
|
||||
"--registry-config", registryConfig,
|
||||
"--content-cache", contentCache,
|
||||
}
|
||||
})
|
||||
|
||||
require.NotEmpty(t, stdout)
|
||||
require.Contains(t, stdout, "name: oci-dependent-chart")
|
||||
require.NotContains(t, stdout, "Pulled:")
|
||||
require.NotContains(t, stdout, "Digest:")
|
||||
require.Contains(t, stderr, "Pulled:")
|
||||
require.Contains(t, stderr, "Digest:")
|
||||
}
|
||||
|
||||
func runOCIChartCommand(t *testing.T, argsFn func(ref, registryConfig, contentCache string) []string) (string, string) {
|
||||
t.Helper()
|
||||
|
||||
srv := repotest.NewTempServer(
|
||||
t,
|
||||
repotest.WithChartSourceGlob("testdata/testcharts/*.tgz*"),
|
||||
)
|
||||
t.Cleanup(func() { srv.Stop() })
|
||||
|
||||
ociSrv, err := repotest.NewOCIServer(t, srv.Root())
|
||||
require.NoError(t, err)
|
||||
ociSrv.Run(t)
|
||||
|
||||
ref := fmt.Sprintf("oci://%s/u/ocitestuser/oci-dependent-chart", ociSrv.RegistryURL)
|
||||
registryConfig := filepath.Join(srv.Root(), "config.json")
|
||||
contentCache := t.TempDir()
|
||||
args := argsFn(ref, registryConfig, contentCache)
|
||||
|
||||
stdout := &bytes.Buffer{}
|
||||
stderr := &bytes.Buffer{}
|
||||
actionConfig := &action.Configuration{
|
||||
Releases: storageFixture(),
|
||||
KubeClient: &kubefake.PrintingKubeClient{Out: io.Discard},
|
||||
Capabilities: common.DefaultCapabilities,
|
||||
}
|
||||
|
||||
root, err := newRootCmdWithConfig(actionConfig, stdout, args, SetupLogging)
|
||||
require.NoError(t, err)
|
||||
root.SetOut(stdout)
|
||||
root.SetErr(stderr)
|
||||
root.SetArgs(args)
|
||||
|
||||
require.NoError(t, root.Execute(), "stdout:\n%s\nstderr:\n%s", stdout.String(), stderr.String())
|
||||
return stdout.String(), stderr.String()
|
||||
}
|
||||
@ -1 +1 @@
|
||||
v4.2
|
||||
v4.3
|
||||
|
||||
@ -1 +1 @@
|
||||
Version: v4.2
|
||||
Version: v4.3
|
||||
@ -1 +1 @@
|
||||
version.BuildInfo{Version:"v4.2", GitCommit:"", GitTreeState:"", GoVersion:"", KubeClientVersion:"v1.20"}
|
||||
version.BuildInfo{Version:"v4.3", GitCommit:"", GitTreeState:"", GoVersion:"", KubeClientVersion:"v1.20"}
|
||||
|
||||
Loading…
Reference in new issue