mirror of https://github.com/helm/helm
Denis O
7 months ago
committed by
GitHub
commit
acfa5a581f
@ -1,20 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
# Copyright The Helm Authors.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
curl -sSL https://github.com/golangci/golangci-lint/releases/download/v$GOLANGCI_LINT_VERSION/golangci-lint-$GOLANGCI_LINT_VERSION-linux-amd64.tar.gz | tar xz
|
|
||||||
sudo mv golangci-lint-$GOLANGCI_LINT_VERSION-linux-amd64/golangci-lint /usr/local/bin/golangci-lint
|
|
||||||
rm -rf golangci-lint-$GOLANGCI_LINT_VERSION-linux-amd64
|
|
||||||
@ -1,43 +0,0 @@
|
|||||||
---
|
|
||||||
version: 2
|
|
||||||
|
|
||||||
jobs:
|
|
||||||
build:
|
|
||||||
working_directory: ~/helm.sh/helm
|
|
||||||
docker:
|
|
||||||
- image: circleci/golang:1.17
|
|
||||||
|
|
||||||
auth:
|
|
||||||
username: $DOCKER_USER
|
|
||||||
password: $DOCKER_PASS
|
|
||||||
|
|
||||||
environment:
|
|
||||||
GOCACHE: "/tmp/go/cache"
|
|
||||||
GOLANGCI_LINT_VERSION: "1.36.0"
|
|
||||||
|
|
||||||
steps:
|
|
||||||
- checkout
|
|
||||||
- run:
|
|
||||||
name: install test dependencies
|
|
||||||
command: .circleci/bootstrap.sh
|
|
||||||
- run:
|
|
||||||
name: test style
|
|
||||||
command: make test-style
|
|
||||||
- run:
|
|
||||||
name: test
|
|
||||||
command: make test-coverage
|
|
||||||
- run:
|
|
||||||
name: test build
|
|
||||||
command: make
|
|
||||||
- deploy:
|
|
||||||
name: deploy
|
|
||||||
command: .circleci/deploy.sh
|
|
||||||
|
|
||||||
workflows:
|
|
||||||
version: 2
|
|
||||||
build:
|
|
||||||
jobs:
|
|
||||||
- build:
|
|
||||||
filters:
|
|
||||||
tags:
|
|
||||||
only: /.*/
|
|
||||||
@ -1,49 +0,0 @@
|
|||||||
#!/usr/bin/env bash
|
|
||||||
|
|
||||||
# Copyright The Helm Authors.
|
|
||||||
#
|
|
||||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
# you may not use this file except in compliance with the License.
|
|
||||||
# You may obtain a copy of the License at
|
|
||||||
#
|
|
||||||
# http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
#
|
|
||||||
# Unless required by applicable law or agreed to in writing, software
|
|
||||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
# See the License for the specific language governing permissions and
|
|
||||||
# limitations under the License.
|
|
||||||
set -euo pipefail
|
|
||||||
|
|
||||||
# Skip on pull request builds
|
|
||||||
if [[ -n "${CIRCLE_PR_NUMBER:-}" ]]; then
|
|
||||||
exit
|
|
||||||
fi
|
|
||||||
|
|
||||||
: ${AZURE_STORAGE_CONNECTION_STRING:?"AZURE_STORAGE_CONNECTION_STRING environment variable is not set"}
|
|
||||||
: ${AZURE_STORAGE_CONTAINER_NAME:?"AZURE_STORAGE_CONTAINER_NAME environment variable is not set"}
|
|
||||||
|
|
||||||
VERSION=
|
|
||||||
if [[ -n "${CIRCLE_TAG:-}" ]]; then
|
|
||||||
VERSION="${CIRCLE_TAG}"
|
|
||||||
elif [[ "${CIRCLE_BRANCH:-}" == "main" ]]; then
|
|
||||||
VERSION="canary"
|
|
||||||
else
|
|
||||||
echo "Skipping deploy step; this is neither a releasable branch or a tag"
|
|
||||||
exit
|
|
||||||
fi
|
|
||||||
|
|
||||||
echo "Installing Azure CLI"
|
|
||||||
echo "deb [arch=amd64] https://packages.microsoft.com/repos/azure-cli/ stretch main" | sudo tee /etc/apt/sources.list.d/azure-cli.list
|
|
||||||
curl -L https://packages.microsoft.com/keys/microsoft.asc | sudo apt-key add
|
|
||||||
sudo apt install apt-transport-https
|
|
||||||
sudo apt update
|
|
||||||
sudo apt install azure-cli
|
|
||||||
|
|
||||||
|
|
||||||
echo "Building helm binaries"
|
|
||||||
make build-cross
|
|
||||||
make dist checksum VERSION="${VERSION}"
|
|
||||||
|
|
||||||
echo "Pushing binaries to Azure"
|
|
||||||
az storage blob upload-batch -s _dist/ -d "$AZURE_STORAGE_CONTAINER_NAME" --pattern 'helm-*' --connection-string "$AZURE_STORAGE_CONNECTION_STRING"
|
|
||||||
@ -1,7 +1,39 @@
|
|||||||
version: 2
|
version: 2
|
||||||
|
|
||||||
updates:
|
updates:
|
||||||
|
- # Keep dev-v3 branch dependencies up to date, while Helm v3 is within support
|
||||||
|
package-ecosystem: "gomod"
|
||||||
|
target-branch: "dev-v3"
|
||||||
|
directory: "/"
|
||||||
|
schedule:
|
||||||
|
interval: "daily"
|
||||||
|
groups:
|
||||||
|
k8s.io:
|
||||||
|
patterns:
|
||||||
|
- "k8s.io/api"
|
||||||
|
- "k8s.io/apiextensions-apiserver"
|
||||||
|
- "k8s.io/apimachinery"
|
||||||
|
- "k8s.io/apiserver"
|
||||||
|
- "k8s.io/cli-runtime"
|
||||||
|
- "k8s.io/client-go"
|
||||||
|
- "k8s.io/kubectl"
|
||||||
- package-ecosystem: "gomod"
|
- package-ecosystem: "gomod"
|
||||||
|
target-branch: "main"
|
||||||
|
directory: "/"
|
||||||
|
schedule:
|
||||||
|
interval: "daily"
|
||||||
|
groups:
|
||||||
|
k8s.io:
|
||||||
|
patterns:
|
||||||
|
- "k8s.io/api"
|
||||||
|
- "k8s.io/apiextensions-apiserver"
|
||||||
|
- "k8s.io/apimachinery"
|
||||||
|
- "k8s.io/apiserver"
|
||||||
|
- "k8s.io/cli-runtime"
|
||||||
|
- "k8s.io/client-go"
|
||||||
|
- "k8s.io/kubectl"
|
||||||
|
- package-ecosystem: "github-actions"
|
||||||
|
target-branch: "main"
|
||||||
directory: "/"
|
directory: "/"
|
||||||
schedule:
|
schedule:
|
||||||
interval: "daily"
|
interval: "daily"
|
||||||
|
|||||||
@ -1,29 +0,0 @@
|
|||||||
name: build-pr
|
|
||||||
on:
|
|
||||||
pull_request:
|
|
||||||
branches:
|
|
||||||
- main
|
|
||||||
jobs:
|
|
||||||
build:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- name: Checkout source code
|
|
||||||
uses: actions/checkout@v2
|
|
||||||
- name: Setup Go
|
|
||||||
uses: actions/setup-go@v2
|
|
||||||
with:
|
|
||||||
go-version: '1.17'
|
|
||||||
- name: Install golangci-lint
|
|
||||||
run: |
|
|
||||||
curl -sSLO https://github.com/golangci/golangci-lint/releases/download/v$GOLANGCI_LINT_VERSION/golangci-lint-$GOLANGCI_LINT_VERSION-linux-amd64.tar.gz
|
|
||||||
shasum -a 256 golangci-lint-$GOLANGCI_LINT_VERSION-linux-amd64.tar.gz | grep "^$GOLANGCI_LINT_SHA256 " > /dev/null
|
|
||||||
tar -xf golangci-lint-$GOLANGCI_LINT_VERSION-linux-amd64.tar.gz
|
|
||||||
sudo mv golangci-lint-$GOLANGCI_LINT_VERSION-linux-amd64/golangci-lint /usr/local/bin/golangci-lint
|
|
||||||
rm -rf golangci-lint-$GOLANGCI_LINT_VERSION-linux-amd64*
|
|
||||||
env:
|
|
||||||
GOLANGCI_LINT_VERSION: '1.43.0'
|
|
||||||
GOLANGCI_LINT_SHA256: 'f3515cebec926257da703ba0a2b169e4a322c11dc31a8b4656b50a43e48877f4'
|
|
||||||
- name: Test style
|
|
||||||
run: make test-style
|
|
||||||
- name: Run unit tests
|
|
||||||
run: make test-coverage
|
|
||||||
@ -0,0 +1,32 @@
|
|||||||
|
name: build-test
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- "main"
|
||||||
|
- "dev-v3"
|
||||||
|
- "release-**"
|
||||||
|
pull_request:
|
||||||
|
branches:
|
||||||
|
- "main"
|
||||||
|
- "dev-v3"
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
build:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Checkout source code
|
||||||
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@5.3.0
|
||||||
|
with:
|
||||||
|
go-version: '1.23'
|
||||||
|
check-latest: true
|
||||||
|
- name: Test source headers are present
|
||||||
|
run: make test-source-headers
|
||||||
|
- name: Run unit tests
|
||||||
|
run: make test-coverage
|
||||||
|
- name: Test build
|
||||||
|
run: make build
|
||||||
@ -0,0 +1,26 @@
|
|||||||
|
name: golangci-lint
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
pull_request:
|
||||||
|
|
||||||
|
permissions:
|
||||||
|
contents: read
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
golangci:
|
||||||
|
name: golangci-lint
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
|
||||||
|
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@5.3.0
|
||||||
|
with:
|
||||||
|
go-version: '1.23'
|
||||||
|
check-latest: true
|
||||||
|
- name: golangci-lint
|
||||||
|
uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 #pin@6.5.0
|
||||||
|
with:
|
||||||
|
version: v1.62
|
||||||
@ -0,0 +1,24 @@
|
|||||||
|
name: govulncheck
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
paths:
|
||||||
|
- go.sum
|
||||||
|
schedule:
|
||||||
|
- cron: "0 0 * * *"
|
||||||
|
|
||||||
|
permissions: read-all
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
govulncheck:
|
||||||
|
name: govulncheck
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
steps:
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@5.3.0
|
||||||
|
with:
|
||||||
|
go-version: '1.23'
|
||||||
|
check-latest: true
|
||||||
|
- name: govulncheck
|
||||||
|
uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # pin@1.0.4
|
||||||
|
with:
|
||||||
|
go-package: ./...
|
||||||
@ -0,0 +1,105 @@
|
|||||||
|
name: release
|
||||||
|
on:
|
||||||
|
create:
|
||||||
|
tags:
|
||||||
|
- v*
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
|
||||||
|
permissions: read-all
|
||||||
|
|
||||||
|
# Note the only differences between release and canary-release jobs are:
|
||||||
|
# - only canary passes --overwrite flag
|
||||||
|
# - the VERSION make variable passed to 'make dist checksum' is expected to
|
||||||
|
# be "canary" if the job is triggered by a push to "main" branch. If the
|
||||||
|
# job is triggered by a tag push, VERSION should be the tag ref.
|
||||||
|
jobs:
|
||||||
|
release:
|
||||||
|
if: startsWith(github.ref, 'refs/tags/v')
|
||||||
|
runs-on: ubuntu-latest-16-cores
|
||||||
|
steps:
|
||||||
|
- name: Checkout source code
|
||||||
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@5.3.0
|
||||||
|
with:
|
||||||
|
go-version: '1.23'
|
||||||
|
|
||||||
|
- name: Run unit tests
|
||||||
|
run: make test-coverage
|
||||||
|
|
||||||
|
- name: Build Helm Binaries
|
||||||
|
run: |
|
||||||
|
set -eu -o pipefail
|
||||||
|
|
||||||
|
make build-cross VERSION="${{ github.ref_name }}"
|
||||||
|
make dist checksum VERSION="${{ github.ref_name }}"
|
||||||
|
|
||||||
|
- name: Set latest version
|
||||||
|
run: |
|
||||||
|
set -eu -o pipefail
|
||||||
|
|
||||||
|
mkdir -p _dist_versions
|
||||||
|
|
||||||
|
# Push the latest semver tag, excluding prerelease tags
|
||||||
|
LATEST_VERSION="$(git tag | sort -r --version-sort | grep '^v[0-9]' | grep -v '-' | head -n1)"
|
||||||
|
echo "LATEST_VERSION=${LATEST_VERSION}"
|
||||||
|
echo "${LATEST_VERSION}" > _dist_versions/helm-latest-version
|
||||||
|
echo "${LATEST_VERSION}" > _dist_versions/helm3-latest-version
|
||||||
|
|
||||||
|
- name: Upload Binaries
|
||||||
|
uses: bacongobbler/azure-blob-storage-upload@50f7d898b7697e864130ea04c303ca38b5751c50 # pin@3.0.0
|
||||||
|
env:
|
||||||
|
AZURE_STORAGE_CONNECTION_STRING: "${{ secrets.AZURE_STORAGE_CONNECTION_STRING }}"
|
||||||
|
AZURE_STORAGE_CONTAINER_NAME: "${{ secrets.AZURE_STORAGE_CONTAINER_NAME }}"
|
||||||
|
with:
|
||||||
|
source_dir: _dist
|
||||||
|
container_name: ${{ secrets.AZURE_STORAGE_CONTAINER_NAME }}
|
||||||
|
connection_string: ${{ secrets.AZURE_STORAGE_CONNECTION_STRING }}
|
||||||
|
extra_args: '--pattern helm-*'
|
||||||
|
|
||||||
|
- name: Upload Version tag files
|
||||||
|
uses: bacongobbler/azure-blob-storage-upload@50f7d898b7697e864130ea04c303ca38b5751c50 # pin@3.0.0
|
||||||
|
env:
|
||||||
|
AZURE_STORAGE_CONNECTION_STRING: "${{ secrets.AZURE_STORAGE_CONNECTION_STRING }}"
|
||||||
|
AZURE_STORAGE_CONTAINER_NAME: "${{ secrets.AZURE_STORAGE_CONTAINER_NAME }}"
|
||||||
|
with:
|
||||||
|
overwrite: 'true'
|
||||||
|
source_dir: _dist_versions
|
||||||
|
container_name: ${{ secrets.AZURE_STORAGE_CONTAINER_NAME }}
|
||||||
|
connection_string: ${{ secrets.AZURE_STORAGE_CONNECTION_STRING }}
|
||||||
|
|
||||||
|
canary-release:
|
||||||
|
runs-on: ubuntu-latest-16-cores
|
||||||
|
if: github.ref == 'refs/heads/main'
|
||||||
|
steps:
|
||||||
|
- name: Checkout source code
|
||||||
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
|
||||||
|
|
||||||
|
- name: Setup Go
|
||||||
|
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@5.3.0
|
||||||
|
with:
|
||||||
|
go-version: '1.23'
|
||||||
|
check-latest: true
|
||||||
|
|
||||||
|
- name: Run unit tests
|
||||||
|
run: make test-coverage
|
||||||
|
|
||||||
|
- name: Build Helm Binaries
|
||||||
|
run: |
|
||||||
|
make build-cross
|
||||||
|
make dist checksum VERSION="canary"
|
||||||
|
|
||||||
|
- name: Upload Binaries
|
||||||
|
uses: bacongobbler/azure-blob-storage-upload@50f7d898b7697e864130ea04c303ca38b5751c50 # pin@3.0.0
|
||||||
|
with:
|
||||||
|
source_dir: _dist
|
||||||
|
container_name: ${{ secrets.AZURE_STORAGE_CONTAINER_NAME }}
|
||||||
|
connection_string: ${{ secrets.AZURE_STORAGE_CONNECTION_STRING }}
|
||||||
|
extra_args: '--pattern helm-*'
|
||||||
|
# WARNING: this will overwrite existing blobs in your blob storage
|
||||||
|
overwrite: 'true'
|
||||||
@ -0,0 +1,69 @@
|
|||||||
|
name: Scorecard supply-chain security
|
||||||
|
on:
|
||||||
|
# For Branch-Protection check. Only the default branch is supported. See
|
||||||
|
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
|
||||||
|
branch_protection_rule:
|
||||||
|
# To guarantee Maintained check is occasionally updated. See
|
||||||
|
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
|
||||||
|
schedule:
|
||||||
|
- cron: '25 7 * * 0'
|
||||||
|
push:
|
||||||
|
branches: [ "main" ]
|
||||||
|
|
||||||
|
# Declare default permissions as read only.
|
||||||
|
permissions: read-all
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
analysis:
|
||||||
|
name: Scorecard analysis
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
permissions:
|
||||||
|
# Needed to upload the results to code-scanning dashboard.
|
||||||
|
security-events: write
|
||||||
|
# Needed to publish results and get a badge (see publish_results below).
|
||||||
|
id-token: write
|
||||||
|
# Uncomment the permissions below if installing in a private repository.
|
||||||
|
# contents: read
|
||||||
|
# actions: read
|
||||||
|
|
||||||
|
steps:
|
||||||
|
- name: "Checkout code"
|
||||||
|
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||||
|
with:
|
||||||
|
persist-credentials: false
|
||||||
|
|
||||||
|
- name: "Run analysis"
|
||||||
|
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
|
||||||
|
with:
|
||||||
|
results_file: results.sarif
|
||||||
|
results_format: sarif
|
||||||
|
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
|
||||||
|
# - you want to enable the Branch-Protection check on a *public* repository, or
|
||||||
|
# - you are installing Scorecard on a *private* repository
|
||||||
|
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
|
||||||
|
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
|
||||||
|
|
||||||
|
# Public repositories:
|
||||||
|
# - Publish results to OpenSSF REST API for easy access by consumers
|
||||||
|
# - Allows the repository to include the Scorecard badge.
|
||||||
|
# - See https://github.com/ossf/scorecard-action#publishing-results.
|
||||||
|
# For private repositories:
|
||||||
|
# - `publish_results` will always be set to `false`, regardless
|
||||||
|
# of the value entered here.
|
||||||
|
publish_results: true
|
||||||
|
|
||||||
|
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
|
||||||
|
# format to the repository Actions tab.
|
||||||
|
- name: "Upload artifact"
|
||||||
|
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
|
||||||
|
with:
|
||||||
|
name: SARIF file
|
||||||
|
path: results.sarif
|
||||||
|
retention-days: 5
|
||||||
|
|
||||||
|
# Upload the results to GitHub's code scanning dashboard (optional).
|
||||||
|
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
|
||||||
|
- name: "Upload to code-scanning"
|
||||||
|
uses: github/codeql-action/upload-sarif@v3
|
||||||
|
with:
|
||||||
|
sarif_file: results.sarif
|
||||||
@ -1,25 +1,31 @@
|
|||||||
maintainers:
|
maintainers:
|
||||||
- adamreese
|
- gjenkins8
|
||||||
- bacongobbler
|
- joejulian
|
||||||
- hickeyma
|
|
||||||
- jdolitsky
|
|
||||||
- marckhouzam
|
- marckhouzam
|
||||||
- mattfarina
|
- mattfarina
|
||||||
|
- robertsirc
|
||||||
|
- sabre1041
|
||||||
- scottrigby
|
- scottrigby
|
||||||
- SlickNik
|
|
||||||
- technosophos
|
- technosophos
|
||||||
triage:
|
triage:
|
||||||
|
- banjoh
|
||||||
- yxxhero
|
- yxxhero
|
||||||
- zonggen
|
- zonggen
|
||||||
|
- z4ce
|
||||||
emeritus:
|
emeritus:
|
||||||
|
- adamreese
|
||||||
|
- bacongobbler
|
||||||
- fibonacci1729
|
- fibonacci1729
|
||||||
|
- hickeyma
|
||||||
- jascott1
|
- jascott1
|
||||||
|
- jdolitsky
|
||||||
- michelleN
|
- michelleN
|
||||||
- migmartri
|
- migmartri
|
||||||
- nebril
|
- nebril
|
||||||
- prydonius
|
- prydonius
|
||||||
- rimusz
|
- rimusz
|
||||||
- seh
|
- seh
|
||||||
|
- SlickNik
|
||||||
- thomastaylor312
|
- thomastaylor312
|
||||||
- vaikas-google
|
- vaikas-google
|
||||||
- viglesiasce
|
- viglesiasce
|
||||||
|
|||||||
@ -0,0 +1,98 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"log"
|
||||||
|
|
||||||
|
"github.com/spf13/cobra"
|
||||||
|
k8sLabels "k8s.io/apimachinery/pkg/labels"
|
||||||
|
|
||||||
|
"helm.sh/helm/v4/cmd/helm/require"
|
||||||
|
"helm.sh/helm/v4/pkg/action"
|
||||||
|
"helm.sh/helm/v4/pkg/cli/output"
|
||||||
|
)
|
||||||
|
|
||||||
|
type metadataWriter struct {
|
||||||
|
metadata *action.Metadata
|
||||||
|
}
|
||||||
|
|
||||||
|
func newGetMetadataCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
|
||||||
|
var outfmt output.Format
|
||||||
|
client := action.NewGetMetadata(cfg)
|
||||||
|
|
||||||
|
cmd := &cobra.Command{
|
||||||
|
Use: "metadata RELEASE_NAME",
|
||||||
|
Short: "This command fetches metadata for a given release",
|
||||||
|
Args: require.ExactArgs(1),
|
||||||
|
ValidArgsFunction: func(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
|
||||||
|
if len(args) != 0 {
|
||||||
|
return noMoreArgsComp()
|
||||||
|
}
|
||||||
|
return compListReleases(toComplete, args, cfg)
|
||||||
|
},
|
||||||
|
RunE: func(_ *cobra.Command, args []string) error {
|
||||||
|
releaseMetadata, err := client.Run(args[0])
|
||||||
|
if err != nil {
|
||||||
|
return err
|
||||||
|
}
|
||||||
|
return outfmt.Write(out, &metadataWriter{releaseMetadata})
|
||||||
|
},
|
||||||
|
}
|
||||||
|
|
||||||
|
f := cmd.Flags()
|
||||||
|
f.IntVar(&client.Version, "revision", 0, "specify release revision")
|
||||||
|
err := cmd.RegisterFlagCompletionFunc("revision", func(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
|
||||||
|
if len(args) == 1 {
|
||||||
|
return compListRevisions(toComplete, cfg, args[0])
|
||||||
|
}
|
||||||
|
return nil, cobra.ShellCompDirectiveNoFileComp
|
||||||
|
})
|
||||||
|
|
||||||
|
if err != nil {
|
||||||
|
log.Fatal(err)
|
||||||
|
}
|
||||||
|
|
||||||
|
bindOutputFlag(cmd, &outfmt)
|
||||||
|
|
||||||
|
return cmd
|
||||||
|
}
|
||||||
|
|
||||||
|
func (w metadataWriter) WriteTable(out io.Writer) error {
|
||||||
|
_, _ = fmt.Fprintf(out, "NAME: %v\n", w.metadata.Name)
|
||||||
|
_, _ = fmt.Fprintf(out, "CHART: %v\n", w.metadata.Chart)
|
||||||
|
_, _ = fmt.Fprintf(out, "VERSION: %v\n", w.metadata.Version)
|
||||||
|
_, _ = fmt.Fprintf(out, "APP_VERSION: %v\n", w.metadata.AppVersion)
|
||||||
|
_, _ = fmt.Fprintf(out, "ANNOTATIONS: %v\n", k8sLabels.Set(w.metadata.Annotations).String())
|
||||||
|
_, _ = fmt.Fprintf(out, "DEPENDENCIES: %v\n", w.metadata.FormattedDepNames())
|
||||||
|
_, _ = fmt.Fprintf(out, "NAMESPACE: %v\n", w.metadata.Namespace)
|
||||||
|
_, _ = fmt.Fprintf(out, "REVISION: %v\n", w.metadata.Revision)
|
||||||
|
_, _ = fmt.Fprintf(out, "STATUS: %v\n", w.metadata.Status)
|
||||||
|
_, _ = fmt.Fprintf(out, "DEPLOYED_AT: %v\n", w.metadata.DeployedAt)
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
func (w metadataWriter) WriteJSON(out io.Writer) error {
|
||||||
|
return output.EncodeJSON(out, w.metadata)
|
||||||
|
}
|
||||||
|
|
||||||
|
func (w metadataWriter) WriteYAML(out io.Writer) error {
|
||||||
|
return output.EncodeYAML(out, w.metadata)
|
||||||
|
}
|
||||||
@ -0,0 +1,66 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
|
||||||
|
"helm.sh/helm/v4/pkg/release"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestGetMetadataCmd(t *testing.T) {
|
||||||
|
tests := []cmdTestCase{{
|
||||||
|
name: "get metadata with a release",
|
||||||
|
cmd: "get metadata thomas-guide",
|
||||||
|
golden: "output/get-metadata.txt",
|
||||||
|
rels: []*release.Release{release.Mock(&release.MockReleaseOptions{Name: "thomas-guide"})},
|
||||||
|
}, {
|
||||||
|
name: "get metadata requires release name arg",
|
||||||
|
cmd: "get metadata",
|
||||||
|
golden: "output/get-metadata-args.txt",
|
||||||
|
rels: []*release.Release{release.Mock(&release.MockReleaseOptions{Name: "thomas-guide"})},
|
||||||
|
wantError: true,
|
||||||
|
}, {
|
||||||
|
name: "get metadata to json",
|
||||||
|
cmd: "get metadata thomas-guide --output json",
|
||||||
|
golden: "output/get-metadata.json",
|
||||||
|
rels: []*release.Release{release.Mock(&release.MockReleaseOptions{Name: "thomas-guide"})},
|
||||||
|
}, {
|
||||||
|
name: "get metadata to yaml",
|
||||||
|
cmd: "get metadata thomas-guide --output yaml",
|
||||||
|
golden: "output/get-metadata.yaml",
|
||||||
|
rels: []*release.Release{release.Mock(&release.MockReleaseOptions{Name: "thomas-guide"})},
|
||||||
|
}}
|
||||||
|
runTestCmd(t, tests)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestGetMetadataCompletion(t *testing.T) {
|
||||||
|
checkReleaseCompletion(t, "get metadata", false)
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestGetMetadataRevisionCompletion(t *testing.T) {
|
||||||
|
revisionFlagCompletionTest(t, "get metadata")
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestGetMetadataOutputCompletion(t *testing.T) {
|
||||||
|
outputFlagCompletionTest(t, "get metadata")
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestGetMetadataFileCompletion(t *testing.T) {
|
||||||
|
checkFileCompletion(t, "get metadata", false)
|
||||||
|
checkFileCompletion(t, "get metadata myrelease", false)
|
||||||
|
}
|
||||||
@ -0,0 +1,91 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"errors"
|
||||||
|
"fmt"
|
||||||
|
"os"
|
||||||
|
"runtime"
|
||||||
|
"runtime/pprof"
|
||||||
|
)
|
||||||
|
|
||||||
|
var (
|
||||||
|
cpuProfileFile *os.File
|
||||||
|
cpuProfilePath string
|
||||||
|
memProfilePath string
|
||||||
|
)
|
||||||
|
|
||||||
|
func init() {
|
||||||
|
cpuProfilePath = os.Getenv("HELM_PPROF_CPU_PROFILE")
|
||||||
|
memProfilePath = os.Getenv("HELM_PPROF_MEM_PROFILE")
|
||||||
|
}
|
||||||
|
|
||||||
|
// startProfiling starts profiling CPU usage if HELM_PPROF_CPU_PROFILE is set
|
||||||
|
// to a file path. It returns an error if the file could not be created or
|
||||||
|
// CPU profiling could not be started.
|
||||||
|
func startProfiling() error {
|
||||||
|
if cpuProfilePath != "" {
|
||||||
|
var err error
|
||||||
|
cpuProfileFile, err = os.Create(cpuProfilePath)
|
||||||
|
if err != nil {
|
||||||
|
return fmt.Errorf("could not create CPU profile: %w", err)
|
||||||
|
}
|
||||||
|
if err := pprof.StartCPUProfile(cpuProfileFile); err != nil {
|
||||||
|
cpuProfileFile.Close()
|
||||||
|
cpuProfileFile = nil
|
||||||
|
return fmt.Errorf("could not start CPU profile: %w", err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// stopProfiling stops profiling CPU and memory usage.
|
||||||
|
// It writes memory profile to the file path specified in HELM_PPROF_MEM_PROFILE
|
||||||
|
// environment variable.
|
||||||
|
func stopProfiling() error {
|
||||||
|
errs := []error{}
|
||||||
|
|
||||||
|
// Stop CPU profiling if it was started
|
||||||
|
if cpuProfileFile != nil {
|
||||||
|
pprof.StopCPUProfile()
|
||||||
|
err := cpuProfileFile.Close()
|
||||||
|
if err != nil {
|
||||||
|
errs = append(errs, err)
|
||||||
|
}
|
||||||
|
cpuProfileFile = nil
|
||||||
|
}
|
||||||
|
|
||||||
|
if memProfilePath != "" {
|
||||||
|
f, err := os.Create(memProfilePath)
|
||||||
|
if err != nil {
|
||||||
|
errs = append(errs, err)
|
||||||
|
}
|
||||||
|
defer f.Close()
|
||||||
|
|
||||||
|
runtime.GC() // get up-to-date statistics
|
||||||
|
if err := pprof.WriteHeapProfile(f); err != nil {
|
||||||
|
errs = append(errs, err)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := errors.Join(errs...); err != nil {
|
||||||
|
return fmt.Errorf("error(s) while stopping profiling: %w", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
return nil
|
||||||
|
}
|
||||||
@ -0,0 +1,25 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestRegistryLogoutFileCompletion(t *testing.T) {
|
||||||
|
checkFileCompletion(t, "registry logout", false)
|
||||||
|
}
|
||||||
@ -1,59 +0,0 @@
|
|||||||
//go:build !windows
|
|
||||||
// +build !windows
|
|
||||||
|
|
||||||
/*
|
|
||||||
Copyright The Helm Authors.
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"os"
|
|
||||||
"os/user"
|
|
||||||
"path/filepath"
|
|
||||||
)
|
|
||||||
|
|
||||||
func checkPerms() {
|
|
||||||
// This function MUST NOT FAIL, as it is just a check for a common permissions problem.
|
|
||||||
// If for some reason the function hits a stopping condition, it may panic. But only if
|
|
||||||
// we can be sure that it is panicking because Helm cannot proceed.
|
|
||||||
|
|
||||||
kc := settings.KubeConfig
|
|
||||||
if kc == "" {
|
|
||||||
kc = os.Getenv("KUBECONFIG")
|
|
||||||
}
|
|
||||||
if kc == "" {
|
|
||||||
u, err := user.Current()
|
|
||||||
if err != nil {
|
|
||||||
// No idea where to find KubeConfig, so return silently. Many helm commands
|
|
||||||
// can proceed happily without a KUBECONFIG, so this is not a fatal error.
|
|
||||||
return
|
|
||||||
}
|
|
||||||
kc = filepath.Join(u.HomeDir, ".kube", "config")
|
|
||||||
}
|
|
||||||
fi, err := os.Stat(kc)
|
|
||||||
if err != nil {
|
|
||||||
// DO NOT error if no KubeConfig is found. Not all commands require one.
|
|
||||||
return
|
|
||||||
}
|
|
||||||
|
|
||||||
perm := fi.Mode().Perm()
|
|
||||||
if perm&0040 > 0 {
|
|
||||||
warning("Kubernetes configuration file is group-readable. This is insecure. Location: %s", kc)
|
|
||||||
}
|
|
||||||
if perm&0004 > 0 {
|
|
||||||
warning("Kubernetes configuration file is world-readable. This is insecure. Location: %s", kc)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
@ -1,88 +0,0 @@
|
|||||||
//go:build !windows
|
|
||||||
// +build !windows
|
|
||||||
|
|
||||||
/*
|
|
||||||
Copyright The Helm Authors.
|
|
||||||
|
|
||||||
Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
you may not use this file except in compliance with the License.
|
|
||||||
You may obtain a copy of the License at
|
|
||||||
|
|
||||||
http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
|
|
||||||
Unless required by applicable law or agreed to in writing, software
|
|
||||||
distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
See the License for the specific language governing permissions and
|
|
||||||
limitations under the License.
|
|
||||||
*/
|
|
||||||
|
|
||||||
package main
|
|
||||||
|
|
||||||
import (
|
|
||||||
"bytes"
|
|
||||||
"io"
|
|
||||||
"io/ioutil"
|
|
||||||
"os"
|
|
||||||
"path/filepath"
|
|
||||||
"strings"
|
|
||||||
"testing"
|
|
||||||
)
|
|
||||||
|
|
||||||
func checkPermsStderr() (string, error) {
|
|
||||||
r, w, err := os.Pipe()
|
|
||||||
if err != nil {
|
|
||||||
return "", err
|
|
||||||
}
|
|
||||||
|
|
||||||
stderr := os.Stderr
|
|
||||||
os.Stderr = w
|
|
||||||
defer func() {
|
|
||||||
os.Stderr = stderr
|
|
||||||
}()
|
|
||||||
|
|
||||||
checkPerms()
|
|
||||||
w.Close()
|
|
||||||
|
|
||||||
var text bytes.Buffer
|
|
||||||
io.Copy(&text, r)
|
|
||||||
return text.String(), nil
|
|
||||||
}
|
|
||||||
|
|
||||||
func TestCheckPerms(t *testing.T) {
|
|
||||||
tdir, err := ioutil.TempDir("", "helmtest")
|
|
||||||
if err != nil {
|
|
||||||
t.Fatal(err)
|
|
||||||
}
|
|
||||||
defer os.RemoveAll(tdir)
|
|
||||||
tfile := filepath.Join(tdir, "testconfig")
|
|
||||||
fh, err := os.OpenFile(tfile, os.O_CREATE|os.O_APPEND|os.O_RDWR, 0440)
|
|
||||||
if err != nil {
|
|
||||||
t.Errorf("Failed to create temp file: %s", err)
|
|
||||||
}
|
|
||||||
|
|
||||||
tconfig := settings.KubeConfig
|
|
||||||
settings.KubeConfig = tfile
|
|
||||||
defer func() { settings.KubeConfig = tconfig }()
|
|
||||||
|
|
||||||
text, err := checkPermsStderr()
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("could not read from stderr: %s", err)
|
|
||||||
}
|
|
||||||
expectPrefix := "WARNING: Kubernetes configuration file is group-readable. This is insecure. Location:"
|
|
||||||
if !strings.HasPrefix(text, expectPrefix) {
|
|
||||||
t.Errorf("Expected to get a warning for group perms. Got %q", text)
|
|
||||||
}
|
|
||||||
|
|
||||||
if err := fh.Chmod(0404); err != nil {
|
|
||||||
t.Errorf("Could not change mode on file: %s", err)
|
|
||||||
}
|
|
||||||
text, err = checkPermsStderr()
|
|
||||||
if err != nil {
|
|
||||||
t.Fatalf("could not read from stderr: %s", err)
|
|
||||||
}
|
|
||||||
expectPrefix = "WARNING: Kubernetes configuration file is world-readable. This is insecure. Location:"
|
|
||||||
if !strings.HasPrefix(text, expectPrefix) {
|
|
||||||
t.Errorf("Expected to get a warning for world perms. Got %q", text)
|
|
||||||
}
|
|
||||||
}
|
|
||||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in new issue