From 7f2df6467771a75f5646b7f12afb408590ed1755 Mon Sep 17 00:00:00 2001 From: Matt Farina Date: Tue, 18 May 2021 10:26:16 -0400 Subject: [PATCH 01/10] bump version to v3.6.0 Signed-off-by: Matt Farina --- cmd/helm/testdata/output/version-client-shorthand.txt | 2 +- cmd/helm/testdata/output/version-client.txt | 2 +- cmd/helm/testdata/output/version-short.txt | 2 +- cmd/helm/testdata/output/version-template.txt | 2 +- cmd/helm/testdata/output/version.txt | 2 +- internal/version/version.go | 2 +- pkg/chartutil/capabilities_test.go | 4 ++-- 7 files changed, 8 insertions(+), 8 deletions(-) diff --git a/cmd/helm/testdata/output/version-client-shorthand.txt b/cmd/helm/testdata/output/version-client-shorthand.txt index 9dc0a8cfa..02e210fb7 100644 --- a/cmd/helm/testdata/output/version-client-shorthand.txt +++ b/cmd/helm/testdata/output/version-client-shorthand.txt @@ -1 +1 @@ -version.BuildInfo{Version:"v3.5", GitCommit:"", GitTreeState:"", GoVersion:""} +version.BuildInfo{Version:"v3.6", GitCommit:"", GitTreeState:"", GoVersion:""} diff --git a/cmd/helm/testdata/output/version-client.txt b/cmd/helm/testdata/output/version-client.txt index 9dc0a8cfa..02e210fb7 100644 --- a/cmd/helm/testdata/output/version-client.txt +++ b/cmd/helm/testdata/output/version-client.txt @@ -1 +1 @@ -version.BuildInfo{Version:"v3.5", GitCommit:"", GitTreeState:"", GoVersion:""} +version.BuildInfo{Version:"v3.6", GitCommit:"", GitTreeState:"", GoVersion:""} diff --git a/cmd/helm/testdata/output/version-short.txt b/cmd/helm/testdata/output/version-short.txt index 3c81e0c56..cde1fbc45 100644 --- a/cmd/helm/testdata/output/version-short.txt +++ b/cmd/helm/testdata/output/version-short.txt @@ -1 +1 @@ -v3.5 +v3.6 diff --git a/cmd/helm/testdata/output/version-template.txt b/cmd/helm/testdata/output/version-template.txt index 68945e7a4..84b18182b 100644 --- a/cmd/helm/testdata/output/version-template.txt +++ b/cmd/helm/testdata/output/version-template.txt @@ -1 +1 @@ -Version: v3.5 \ No newline at end of file +Version: v3.6 \ No newline at end of file diff --git a/cmd/helm/testdata/output/version.txt b/cmd/helm/testdata/output/version.txt index 9dc0a8cfa..02e210fb7 100644 --- a/cmd/helm/testdata/output/version.txt +++ b/cmd/helm/testdata/output/version.txt @@ -1 +1 @@ -version.BuildInfo{Version:"v3.5", GitCommit:"", GitTreeState:"", GoVersion:""} +version.BuildInfo{Version:"v3.6", GitCommit:"", GitTreeState:"", GoVersion:""} diff --git a/internal/version/version.go b/internal/version/version.go index 15822e914..4db8c0549 100644 --- a/internal/version/version.go +++ b/internal/version/version.go @@ -29,7 +29,7 @@ var ( // // Increment major number for new feature additions and behavioral changes. // Increment minor number for bug fixes and performance enhancements. - version = "v3.5" + version = "v3.6" // metadata is extra build time data metadata = "" diff --git a/pkg/chartutil/capabilities_test.go b/pkg/chartutil/capabilities_test.go index a68d16b45..fad20f1dc 100644 --- a/pkg/chartutil/capabilities_test.go +++ b/pkg/chartutil/capabilities_test.go @@ -62,8 +62,8 @@ func TestDefaultCapabilities(t *testing.T) { func TestDefaultCapabilitiesHelmVersion(t *testing.T) { hv := DefaultCapabilities.HelmVersion - if hv.Version != "v3.5" { - t.Errorf("Expected default HelmVersion to be v3.5, got %q", hv.Version) + if hv.Version != "v3.6" { + t.Errorf("Expected default HelmVersion to be v3.6, got %q", hv.Version) } } From 80402dc078908408fb724395177093f358ee7dae Mon Sep 17 00:00:00 2001 From: yxxhero Date: Sun, 14 Mar 2021 23:23:25 +0800 Subject: [PATCH 02/10] fix helm dep build/update doesn't inherit --insecure-skip-tls-verify from helm repo add Signed-off-by: yxxhero (cherry picked from commit f735a240b6fc483b74e324202dad414ee419225e) --- pkg/downloader/manager.go | 12 ++++---- pkg/downloader/manager_test.go | 28 ++++++++++++++++++- pkg/downloader/testdata/repositories.yaml | 3 ++ ...g-https-insecureskip-tls-verify-index.yaml | 14 ++++++++++ 4 files changed, 51 insertions(+), 6 deletions(-) create mode 100644 pkg/downloader/testdata/repository/testing-https-insecureskip-tls-verify-index.yaml diff --git a/pkg/downloader/manager.go b/pkg/downloader/manager.go index e89ac7c02..49b3d317c 100644 --- a/pkg/downloader/manager.go +++ b/pkg/downloader/manager.go @@ -310,7 +310,7 @@ func (m *Manager) downloadAll(deps []*chart.Dependency) error { // Any failure to resolve/download a chart should fail: // https://github.com/helm/helm/issues/1439 - churl, username, password, err := m.findChartURL(dep.Name, dep.Version, dep.Repository, repos) + churl, username, password, insecureskiptlsverify, err := m.findChartURL(dep.Name, dep.Version, dep.Repository, repos) if err != nil { saveError = errors.Wrapf(err, "could not find %s", churl) break @@ -332,6 +332,7 @@ func (m *Manager) downloadAll(deps []*chart.Dependency) error { Getters: m.Getters, Options: []getter.Option{ getter.WithBasicAuth(username, password), + getter.WithInsecureSkipVerifyTLS(insecureskiptlsverify), }, } @@ -685,9 +686,9 @@ func (m *Manager) parallelRepoUpdate(repos []*repo.Entry) error { // repoURL is the repository to search // // If it finds a URL that is "relative", it will prepend the repoURL. -func (m *Manager) findChartURL(name, version, repoURL string, repos map[string]*repo.ChartRepository) (url, username, password string, err error) { +func (m *Manager) findChartURL(name, version, repoURL string, repos map[string]*repo.ChartRepository) (url, username, password string, insecureskiptlsverify bool, err error) { if strings.HasPrefix(repoURL, "oci://") { - return fmt.Sprintf("%s/%s:%s", repoURL, name, version), "", "", nil + return fmt.Sprintf("%s/%s:%s", repoURL, name, version), "", "", false, nil } for _, cr := range repos { @@ -709,15 +710,16 @@ func (m *Manager) findChartURL(name, version, repoURL string, repos map[string]* } username = cr.Config.Username password = cr.Config.Password + insecureskiptlsverify = cr.Config.InsecureSkipTLSverify return } } url, err = repo.FindChartInRepoURL(repoURL, name, version, "", "", "", m.Getters) if err == nil { - return url, username, password, err + return url, username, password, false, err } err = errors.Errorf("chart %s not found in %s: %s", name, repoURL, err) - return url, username, password, err + return url, username, password, false, err } // findEntryByName finds an entry in the chart repository whose name matches the given name. diff --git a/pkg/downloader/manager_test.go b/pkg/downloader/manager_test.go index fc8d9abb2..ba6ecedf5 100644 --- a/pkg/downloader/manager_test.go +++ b/pkg/downloader/manager_test.go @@ -81,10 +81,11 @@ func TestFindChartURL(t *testing.T) { version := "0.1.0" repoURL := "http://example.com/charts" - churl, username, password, err := m.findChartURL(name, version, repoURL, repos) + churl, username, password, insecureSkipTLSVerify, err := m.findChartURL(name, version, repoURL, repos) if err != nil { t.Fatal(err) } + if churl != "https://charts.helm.sh/stable/alpine-0.1.0.tgz" { t.Errorf("Unexpected URL %q", churl) } @@ -94,6 +95,31 @@ func TestFindChartURL(t *testing.T) { if password != "" { t.Errorf("Unexpected password %q", password) } + if insecureSkipTLSVerify { + t.Errorf("Unexpected insecureSkipTLSVerify %t", insecureSkipTLSVerify) + } + + name = "tlsfoo" + version = "1.2.3" + repoURL = "https://example-https-insecureskiptlsverify.com" + + churl, username, password, insecureSkipTLSVerify, err = m.findChartURL(name, version, repoURL, repos) + if err != nil { + t.Fatal(err) + } + + if !insecureSkipTLSVerify { + t.Errorf("Unexpected insecureSkipTLSVerify %t", insecureSkipTLSVerify) + } + if churl != "https://example.com/tlsfoo-1.2.3.tgz" { + t.Errorf("Unexpected URL %q", churl) + } + if username != "" { + t.Errorf("Unexpected username %q", username) + } + if password != "" { + t.Errorf("Unexpected password %q", password) + } } func TestGetRepoNames(t *testing.T) { diff --git a/pkg/downloader/testdata/repositories.yaml b/pkg/downloader/testdata/repositories.yaml index 430865269..32bc395a0 100644 --- a/pkg/downloader/testdata/repositories.yaml +++ b/pkg/downloader/testdata/repositories.yaml @@ -21,3 +21,6 @@ repositories: certFile: "cert" keyFile: "key" caFile: "ca" + - name: testing-https-insecureskip-tls-verify + url: "https://example-https-insecureskiptlsverify.com" + insecure_skip_tls_verify: true diff --git a/pkg/downloader/testdata/repository/testing-https-insecureskip-tls-verify-index.yaml b/pkg/downloader/testdata/repository/testing-https-insecureskip-tls-verify-index.yaml new file mode 100644 index 000000000..11cfa629c --- /dev/null +++ b/pkg/downloader/testdata/repository/testing-https-insecureskip-tls-verify-index.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +entries: + tlsfoo: + - name: tlsfoo + description: TLS FOO Chart + home: https://helm.sh/helm + keywords: [] + maintainers: [] + sources: + - https://github.com/helm/charts + urls: + - https://example.com/tlsfoo-1.2.3.tgz + version: 1.2.3 + checksum: 0e6661f193211d7a5206918d42f5c2a9470b7373 From bcee7a30fe97133ef4302354f06261abe1a8b917 Mon Sep 17 00:00:00 2001 From: Marcus Speight Date: Wed, 18 Nov 2020 09:45:45 +0000 Subject: [PATCH 03/10] Fail message is now the same as the required message. Fixed #8973 Helm function 'fail' should not fail when doing 'helm lint' Signed-off-by: Marcus Speight (cherry picked from commit 7a0739a863d36371ed7e57ac5205926c7e574a24) --- pkg/engine/engine.go | 10 ++++++++++ pkg/engine/engine_test.go | 17 +++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/pkg/engine/engine.go b/pkg/engine/engine.go index 155d50a38..4da64f5cc 100644 --- a/pkg/engine/engine.go +++ b/pkg/engine/engine.go @@ -173,6 +173,16 @@ func (e Engine) initFunMap(t *template.Template, referenceTpls map[string]render return val, nil } + // Override sprig fail function for linting and wrapping message + funcMap["fail"] = func(msg string) (string, error) { + if e.LintMode { + // Don't fail when linting + log.Printf("[INFO] Fail: %s", msg) + return "", nil + } + return "", errors.New(warnWrap(msg)) + } + // If we are not linting and have a cluster connection, provide a Kubernetes-backed // implementation. if !e.LintMode && e.config != nil { diff --git a/pkg/engine/engine_test.go b/pkg/engine/engine_test.go index d2da7a77a..bb62fd1e0 100644 --- a/pkg/engine/engine_test.go +++ b/pkg/engine/engine_test.go @@ -286,6 +286,23 @@ func TestExecErrors(t *testing.T) { } } +func TestFailErrors(t *testing.T) { + vals := chartutil.Values{"Values": map[string]interface{}{}} + + failtpl := `{{ fail "This is an error" }}` + tplsFailed := map[string]renderable{ + "failtpl": {tpl: failtpl, vals: vals}, + } + _, err := new(Engine).render(tplsFailed) + if err == nil { + t.Fatalf("Expected failures while rendering: %s", err) + } + expected := `execution error at (failtpl:1:3): This is an error` + if err.Error() != expected { + t.Errorf("Expected '%s', got %q", expected, err.Error()) + } +} + func TestAllTemplates(t *testing.T) { ch1 := &chart.Chart{ Metadata: &chart.Metadata{Name: "ch1"}, From 9fbf594b800fe047db36113e650154914fe1ff4d Mon Sep 17 00:00:00 2001 From: Marcus Speight Date: Wed, 2 Dec 2020 18:23:17 +0000 Subject: [PATCH 04/10] Added test for lint mode Signed-off-by: Marcus Speight (cherry picked from commit 8aa42824f9a67a2bbaf81cdb3badb8515204bf9d) --- pkg/engine/engine_test.go | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/pkg/engine/engine_test.go b/pkg/engine/engine_test.go index bb62fd1e0..023423c3a 100644 --- a/pkg/engine/engine_test.go +++ b/pkg/engine/engine_test.go @@ -289,7 +289,7 @@ func TestExecErrors(t *testing.T) { func TestFailErrors(t *testing.T) { vals := chartutil.Values{"Values": map[string]interface{}{}} - failtpl := `{{ fail "This is an error" }}` + failtpl := `All your base are belong to us{{ fail "This is an error" }}` tplsFailed := map[string]renderable{ "failtpl": {tpl: failtpl, vals: vals}, } @@ -301,6 +301,18 @@ func TestFailErrors(t *testing.T) { if err.Error() != expected { t.Errorf("Expected '%s', got %q", expected, err.Error()) } + + var e Engine + e.LintMode = true + out, err := e.render(tplsFailed) + if err != nil { + t.Fatal(err) + } + + expectStr := "All your base are belong to us" + if gotStr := out["failtpl"]; gotStr != expectStr { + t.Errorf("Expected %q, got %q (%v)", expectStr, gotStr, out) + } } func TestAllTemplates(t *testing.T) { From cbd2868ac2f73899dda1df9546d69ccd26230150 Mon Sep 17 00:00:00 2001 From: Marcus Speight Date: Mon, 7 Dec 2020 14:58:30 +0000 Subject: [PATCH 05/10] Fixed Test Signed-off-by: Marcus Speight Signed-off-by: Marcus Speight (cherry picked from commit 7a663a56c24f4dd05375a4ece81e6107eb1b0d78) --- pkg/engine/engine_test.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/engine/engine_test.go b/pkg/engine/engine_test.go index 023423c3a..72ee02626 100644 --- a/pkg/engine/engine_test.go +++ b/pkg/engine/engine_test.go @@ -297,7 +297,7 @@ func TestFailErrors(t *testing.T) { if err == nil { t.Fatalf("Expected failures while rendering: %s", err) } - expected := `execution error at (failtpl:1:3): This is an error` + expected := `execution error at (failtpl:1:33): This is an error` if err.Error() != expected { t.Errorf("Expected '%s', got %q", expected, err.Error()) } From 7d81733af747f210cd9c06cfdc2e26ef41a7edfe Mon Sep 17 00:00:00 2001 From: Leon Bentrup <4458913+xanecs@users.noreply.github.com> Date: Tue, 6 Oct 2020 10:42:34 +0200 Subject: [PATCH 06/10] Correctly determine repository-config lockfile path helm repo add automatically creates a lockfile based on the repository config file path When the given filepath did not include a file extension, a lockfile in a nonexistent directory would have been created. Signed-off-by: Leon Bentrup <4458913+xanecs@users.noreply.github.com> (cherry picked from commit f091b9cc01afff97d285775fb4a7cfa899ec1d4d) --- cmd/helm/repo_add.go | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/cmd/helm/repo_add.go b/cmd/helm/repo_add.go index 52cd020f5..e07eb8685 100644 --- a/cmd/helm/repo_add.go +++ b/cmd/helm/repo_add.go @@ -112,7 +112,14 @@ func (o *repoAddOptions) run(out io.Writer) error { } // Acquire a file lock for process synchronization - fileLock := flock.New(strings.Replace(o.repoFile, filepath.Ext(o.repoFile), ".lock", 1)) + repoFileExt := filepath.Ext(o.repoFile) + var lockPath string + if len(repoFileExt) > 0 && len(repoFileExt) < len(o.repoFile) { + lockPath = strings.Replace(o.repoFile, repoFileExt, ".lock", 1) + } else { + lockPath = o.repoFile + ".lock" + } + fileLock := flock.New(lockPath) lockCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second) defer cancel() locked, err := fileLock.TryLockContext(lockCtx, time.Second) From c084ca0259aa5f1b3defe53f74214c3aa27daae7 Mon Sep 17 00:00:00 2001 From: Leon Bentrup <4458913+xanecs@users.noreply.github.com> Date: Wed, 7 Oct 2020 08:45:07 +0200 Subject: [PATCH 07/10] Add Test cases for repository-config without file extension Signed-off-by: Leon Bentrup <4458913+xanecs@users.noreply.github.com> (cherry picked from commit ccada716eea605060440788244d528edd29c8a6f) --- cmd/helm/repo_add_test.go | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/cmd/helm/repo_add_test.go b/cmd/helm/repo_add_test.go index f3bc54985..739173ee7 100644 --- a/cmd/helm/repo_add_test.go +++ b/cmd/helm/repo_add_test.go @@ -142,6 +142,18 @@ func TestRepoAddConcurrentDirNotExist(t *testing.T) { repoAddConcurrent(t, testName, repoFile) } +func TestRepoAddConcurrentNoFileExtension(t *testing.T) { + const testName = "test-name-3" + repoFile := filepath.Join(ensure.TempDir(t), "repositories") + repoAddConcurrent(t, testName, repoFile) +} + +func TestRepoAddConcurrentHiddenFile(t *testing.T) { + const testName = "test-name-4" + repoFile := filepath.Join(ensure.TempDir(t), ".repositories") + repoAddConcurrent(t, testName, repoFile) +} + func repoAddConcurrent(t *testing.T, testName, repoFile string) { ts, err := repotest.NewTempServerWithCleanup(t, "testdata/testserver/*.*") if err != nil { From f2d7ed8d8099dfd94478be40eed1a237bc2d8ef5 Mon Sep 17 00:00:00 2001 From: Mike Ng Date: Thu, 16 Jul 2020 13:01:46 -0400 Subject: [PATCH 08/10] fix(sql storage): Query() should return ErrReleaseNotFound immediately when no records are found Signed-off-by: Mike Ng (cherry picked from commit b86105aebc535541b8a40aefdfc443d434d06106) --- pkg/storage/driver/sql.go | 8 ++++---- pkg/storage/driver/sql_test.go | 21 +++++++++++++++++++++ 2 files changed, 25 insertions(+), 4 deletions(-) diff --git a/pkg/storage/driver/sql.go b/pkg/storage/driver/sql.go index 13538aba0..f36dab432 100644 --- a/pkg/storage/driver/sql.go +++ b/pkg/storage/driver/sql.go @@ -310,6 +310,10 @@ func (s *SQL) Query(labels map[string]string) ([]*rspb.Release, error) { return nil, err } + if len(records) == 0 { + return nil, ErrReleaseNotFound + } + var releases []*rspb.Release for _, record := range records { release, err := decodeRelease(record.Body) @@ -320,10 +324,6 @@ func (s *SQL) Query(labels map[string]string) ([]*rspb.Release, error) { releases = append(releases, release) } - if len(releases) == 0 { - return nil, ErrReleaseNotFound - } - return releases, nil } diff --git a/pkg/storage/driver/sql_test.go b/pkg/storage/driver/sql_test.go index 1562a90aa..87b6315b8 100644 --- a/pkg/storage/driver/sql_test.go +++ b/pkg/storage/driver/sql_test.go @@ -292,6 +292,11 @@ func TestSqlUpdate(t *testing.T) { func TestSqlQuery(t *testing.T) { // Reflect actual use cases in ../storage.go + labelSetUnknown := map[string]string{ + "name": "smug-pigeon", + "owner": sqlReleaseDefaultOwner, + "status": "unknown", + } labelSetDeployed := map[string]string{ "name": "smug-pigeon", "owner": sqlReleaseDefaultOwner, @@ -320,6 +325,15 @@ func TestSqlQuery(t *testing.T) { sqlReleaseTableNamespaceColumn, ) + mock. + ExpectQuery(regexp.QuoteMeta(query)). + WithArgs("smug-pigeon", sqlReleaseDefaultOwner, "unknown", "default"). + WillReturnRows( + mock.NewRows([]string{ + sqlReleaseTableBodyColumn, + }), + ).RowsWillBeClosed() + mock. ExpectQuery(regexp.QuoteMeta(query)). WithArgs("smug-pigeon", sqlReleaseDefaultOwner, "deployed", "default"). @@ -353,6 +367,13 @@ func TestSqlQuery(t *testing.T) { ), ).RowsWillBeClosed() + _, err := sqlDriver.Query(labelSetUnknown) + if err == nil { + t.Errorf("Expected error {%v}, got nil", ErrReleaseNotFound) + } else if err != ErrReleaseNotFound { + t.Fatalf("failed to query for unknown smug-pigeon release: %v", err) + } + results, err := sqlDriver.Query(labelSetDeployed) if err != nil { t.Fatalf("failed to query for deployed smug-pigeon release: %v", err) From 877276cedaab6ca583a20defcfa81d2f66d07d26 Mon Sep 17 00:00:00 2001 From: Mike Ng Date: Wed, 23 Sep 2020 12:54:31 -0400 Subject: [PATCH 09/10] keep existing behavior of returning ErrReleaseNotFound when release(s) failed to decode Signed-off-by: Mike Ng (cherry picked from commit 3be333b73b8330fada1de60b60264f8fc829c8e1) --- pkg/storage/driver/sql.go | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/pkg/storage/driver/sql.go b/pkg/storage/driver/sql.go index f36dab432..c8a6ae04f 100644 --- a/pkg/storage/driver/sql.go +++ b/pkg/storage/driver/sql.go @@ -324,6 +324,10 @@ func (s *SQL) Query(labels map[string]string) ([]*rspb.Release, error) { releases = append(releases, release) } + if len(releases) == 0 { + return nil, ErrReleaseNotFound + } + return releases, nil } From 17ed9c4cd3c61290587a22953e5359af5ecccaa2 Mon Sep 17 00:00:00 2001 From: Matt Farina Date: Fri, 11 Jun 2021 14:36:55 -0400 Subject: [PATCH 10/10] tweak basic handling Signed-off-by: Matt Farina --- cmd/helm/flags.go | 1 + cmd/helm/install_test.go | 37 ++++++++ cmd/helm/pull_test.go | 111 ++++++++++++++++++++++++ cmd/helm/repo_add.go | 3 + pkg/action/install.go | 30 ++++++- pkg/action/pull.go | 3 +- pkg/downloader/chart_downloader.go | 6 +- pkg/downloader/chart_downloader_test.go | 1 + pkg/downloader/manager.go | 12 +-- pkg/downloader/manager_test.go | 10 ++- pkg/getter/getter.go | 7 ++ pkg/getter/httpgetter.go | 21 ++++- pkg/getter/httpgetter_test.go | 98 +++++++++++++++++++++ pkg/repo/chartrepo.go | 12 +++ pkg/repo/chartrepo_test.go | 8 +- 15 files changed, 342 insertions(+), 18 deletions(-) diff --git a/cmd/helm/flags.go b/cmd/helm/flags.go index fe653625d..aefa836c7 100644 --- a/cmd/helm/flags.go +++ b/cmd/helm/flags.go @@ -57,6 +57,7 @@ func addChartPathOptionsFlags(f *pflag.FlagSet, c *action.ChartPathOptions) { f.StringVar(&c.KeyFile, "key-file", "", "identify HTTPS client using this SSL key file") f.BoolVar(&c.InsecureSkipTLSverify, "insecure-skip-tls-verify", false, "skip tls certificate checks for the chart download") f.StringVar(&c.CaFile, "ca-file", "", "verify certificates of HTTPS-enabled servers using this CA bundle") + f.BoolVar(&c.PassCredentialsAll, "pass-credentials", false, "pass credentials to all domains") } // bindOutputFlag will add the output flag to the given command and bind the diff --git a/cmd/helm/install_test.go b/cmd/helm/install_test.go index 0fae79534..13c994b92 100644 --- a/cmd/helm/install_test.go +++ b/cmd/helm/install_test.go @@ -18,10 +18,36 @@ package main import ( "fmt" + "net/http" + "net/http/httptest" "testing" + + "helm.sh/helm/v3/pkg/repo/repotest" ) func TestInstall(t *testing.T) { + srv, err := repotest.NewTempServerWithCleanup(t, "testdata/testcharts/*.tgz*") + if err != nil { + t.Fatal(err) + } + defer srv.Stop() + + srv.WithMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + username, password, ok := r.BasicAuth() + if !ok || username != "username" || password != "password" { + t.Errorf("Expected request to use basic auth and for username == 'username' and password == 'password', got '%v', '%s', '%s'", ok, username, password) + } + })) + + srv2 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + http.FileServer(http.Dir(srv.Root())).ServeHTTP(w, r) + })) + defer srv2.Close() + + if err := srv.LinkIndices(); err != nil { + t.Fatal(err) + } + tests := []cmdTestCase{ // Install, base case { @@ -207,6 +233,17 @@ func TestInstall(t *testing.T) { name: "install chart with only crds", cmd: "install crd-test testdata/testcharts/chart-with-only-crds --namespace default", }, + // Verify the user/pass works + { + name: "basic install with credentials", + cmd: "install aeneas reqtest --namespace default --repo " + srv.URL() + " --username username --password password", + golden: "output/install.txt", + }, + { + name: "basic install with credentials", + cmd: "install aeneas reqtest --namespace default --repo " + srv2.URL + " --username username --password password --pass-credentials", + golden: "output/install.txt", + }, } runTestActionCmd(t, tests) diff --git a/cmd/helm/pull_test.go b/cmd/helm/pull_test.go index 51cdfdfa4..4d86a5029 100644 --- a/cmd/helm/pull_test.go +++ b/cmd/helm/pull_test.go @@ -18,6 +18,8 @@ package main import ( "fmt" + "net/http" + "net/http/httptest" "os" "path/filepath" "testing" @@ -250,6 +252,115 @@ func TestPullCmd(t *testing.T) { } } +func TestPullWithCredentialsCmd(t *testing.T) { + srv, err := repotest.NewTempServerWithCleanup(t, "testdata/testcharts/*.tgz*") + if err != nil { + t.Fatal(err) + } + defer srv.Stop() + + srv.WithMiddleware(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + username, password, ok := r.BasicAuth() + if !ok || username != "username" || password != "password" { + t.Errorf("Expected request to use basic auth and for username == 'username' and password == 'password', got '%v', '%s', '%s'", ok, username, password) + } + })) + + srv2 := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + http.FileServer(http.Dir(srv.Root())).ServeHTTP(w, r) + })) + defer srv2.Close() + + if err := srv.LinkIndices(); err != nil { + t.Fatal(err) + } + + // all flags will get "-d outdir" appended. + tests := []struct { + name string + args string + existFile string + existDir string + wantError bool + wantErrorMsg string + expectFile string + expectDir bool + }{ + { + name: "Chart fetch using repo URL", + expectFile: "./signtest-0.1.0.tgz", + args: "signtest --repo " + srv.URL() + " --username username --password password", + }, + { + name: "Fail fetching non-existent chart on repo URL", + args: "someChart --repo " + srv.URL() + " --username username --password password", + wantError: true, + }, + { + name: "Specific version chart fetch using repo URL", + expectFile: "./signtest-0.1.0.tgz", + args: "signtest --version=0.1.0 --repo " + srv.URL() + " --username username --password password", + }, + { + name: "Specific version chart fetch using repo URL", + args: "signtest --version=0.2.0 --repo " + srv.URL() + " --username username --password password", + wantError: true, + }, + { + name: "Chart located on different domain with credentials passed", + args: "reqtest --repo " + srv2.URL + " --username username --password password --pass-credentials", + expectFile: "./reqtest-0.1.0.tgz", + }, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + outdir := srv.Root() + cmd := fmt.Sprintf("pull %s -d '%s' --repository-config %s --repository-cache %s --registry-config %s", + tt.args, + outdir, + filepath.Join(outdir, "repositories.yaml"), + outdir, + filepath.Join(outdir, "config.json"), + ) + // Create file or Dir before helm pull --untar, see: https://github.com/helm/helm/issues/7182 + if tt.existFile != "" { + file := filepath.Join(outdir, tt.existFile) + _, err := os.Create(file) + if err != nil { + t.Fatal(err) + } + } + if tt.existDir != "" { + file := filepath.Join(outdir, tt.existDir) + err := os.Mkdir(file, 0755) + if err != nil { + t.Fatal(err) + } + } + _, _, err := executeActionCommand(cmd) + if err != nil { + if tt.wantError { + if tt.wantErrorMsg != "" && tt.wantErrorMsg == err.Error() { + t.Fatalf("Actual error %s, not equal to expected error %s", err, tt.wantErrorMsg) + } + return + } + t.Fatalf("%q reported error: %s", tt.name, err) + } + + ef := filepath.Join(outdir, tt.expectFile) + fi, err := os.Stat(ef) + if err != nil { + t.Errorf("%q: expected a file at %s. %s", tt.name, ef, err) + } + if fi.IsDir() != tt.expectDir { + t.Errorf("%q: expected directory=%t, but it's not.", tt.name, tt.expectDir) + } + }) + } +} + func TestPullVersionCompletion(t *testing.T) { repoFile := "testdata/helmhome/helm/repositories.yaml" repoCache := "testdata/helmhome/helm/repository" diff --git a/cmd/helm/repo_add.go b/cmd/helm/repo_add.go index e07eb8685..beafb31cf 100644 --- a/cmd/helm/repo_add.go +++ b/cmd/helm/repo_add.go @@ -48,6 +48,7 @@ type repoAddOptions struct { url string username string password string + passCredentialsAll bool forceUpdate bool allowDeprecatedRepos bool @@ -91,6 +92,7 @@ func newRepoAddCmd(out io.Writer) *cobra.Command { f.StringVar(&o.caFile, "ca-file", "", "verify certificates of HTTPS-enabled servers using this CA bundle") f.BoolVar(&o.insecureSkipTLSverify, "insecure-skip-tls-verify", false, "skip tls certificate checks for the repository") f.BoolVar(&o.allowDeprecatedRepos, "allow-deprecated-repos", false, "by default, this command will not allow adding official repos that have been permanently deleted. This disables that behavior") + f.BoolVar(&o.passCredentialsAll, "pass-credentials", false, "pass credentials to all domains") return cmd } @@ -156,6 +158,7 @@ func (o *repoAddOptions) run(out io.Writer) error { URL: o.url, Username: o.username, Password: o.password, + PassCredentialsAll: o.passCredentialsAll, CertFile: o.certFile, KeyFile: o.keyFile, CAFile: o.caFile, diff --git a/pkg/action/install.go b/pkg/action/install.go index c33d6bf3c..933747d26 100644 --- a/pkg/action/install.go +++ b/pkg/action/install.go @@ -20,6 +20,7 @@ import ( "bytes" "fmt" "io/ioutil" + "net/url" "os" "path" "path/filepath" @@ -113,6 +114,7 @@ type ChartPathOptions struct { InsecureSkipTLSverify bool // --insecure-skip-verify Keyring string // --keyring Password string // --password + PassCredentialsAll bool // --pass-credentials RepoURL string // --repo Username string // --username Verify bool // --verify @@ -654,7 +656,7 @@ func (c *ChartPathOptions) LocateChart(name string, settings *cli.EnvSettings) ( Keyring: c.Keyring, Getters: getter.All(settings), Options: []getter.Option{ - getter.WithBasicAuth(c.Username, c.Password), + getter.WithPassCredentialsAll(c.PassCredentialsAll), getter.WithTLSClientConfig(c.CertFile, c.KeyFile, c.CaFile), getter.WithInsecureSkipVerifyTLS(c.InsecureSkipTLSverify), }, @@ -665,12 +667,34 @@ func (c *ChartPathOptions) LocateChart(name string, settings *cli.EnvSettings) ( dl.Verify = downloader.VerifyAlways } if c.RepoURL != "" { - chartURL, err := repo.FindChartInAuthAndTLSRepoURL(c.RepoURL, c.Username, c.Password, name, version, - c.CertFile, c.KeyFile, c.CaFile, c.InsecureSkipTLSverify, getter.All(settings)) + chartURL, err := repo.FindChartInAuthAndTLSAndPassRepoURL(c.RepoURL, c.Username, c.Password, name, version, + c.CertFile, c.KeyFile, c.CaFile, c.InsecureSkipTLSverify, c.PassCredentialsAll, getter.All(settings)) if err != nil { return "", err } name = chartURL + + // Only pass the user/pass on when the user has said to or when the + // location of the chart repo and the chart are the same domain. + u1, err := url.Parse(c.RepoURL) + if err != nil { + return "", err + } + u2, err := url.Parse(chartURL) + if err != nil { + return "", err + } + + // Host on URL (returned from url.Parse) contains the port if present. + // This check ensures credentials are not passed between different + // services on different ports. + if c.PassCredentialsAll || (u1.Scheme == u2.Scheme && u1.Host == u2.Host) { + dl.Options = append(dl.Options, getter.WithBasicAuth(c.Username, c.Password)) + } else { + dl.Options = append(dl.Options, getter.WithBasicAuth("", "")) + } + } else { + dl.Options = append(dl.Options, getter.WithBasicAuth(c.Username, c.Password)) } if err := os.MkdirAll(settings.RepositoryCache, 0755); err != nil { diff --git a/pkg/action/pull.go b/pkg/action/pull.go index 04faa3b6b..fa1247054 100644 --- a/pkg/action/pull.go +++ b/pkg/action/pull.go @@ -82,6 +82,7 @@ func (p *Pull) Run(chartRef string) (string, error) { Getters: getter.All(p.Settings), Options: []getter.Option{ getter.WithBasicAuth(p.Username, p.Password), + getter.WithPassCredentialsAll(p.PassCredentialsAll), getter.WithTLSClientConfig(p.CertFile, p.KeyFile, p.CaFile), getter.WithInsecureSkipVerifyTLS(p.InsecureSkipTLSverify), }, @@ -118,7 +119,7 @@ func (p *Pull) Run(chartRef string) (string, error) { } if p.RepoURL != "" { - chartURL, err := repo.FindChartInAuthAndTLSRepoURL(p.RepoURL, p.Username, p.Password, chartRef, p.Version, p.CertFile, p.KeyFile, p.CaFile, p.InsecureSkipTLSverify, getter.All(p.Settings)) + chartURL, err := repo.FindChartInAuthAndTLSAndPassRepoURL(p.RepoURL, p.Username, p.Password, chartRef, p.Version, p.CertFile, p.KeyFile, p.CaFile, p.InsecureSkipTLSverify, p.PassCredentialsAll, getter.All(p.Settings)) if err != nil { return out.String(), err } diff --git a/pkg/downloader/chart_downloader.go b/pkg/downloader/chart_downloader.go index 6c600bebb..2c0d55a55 100644 --- a/pkg/downloader/chart_downloader.go +++ b/pkg/downloader/chart_downloader.go @@ -195,6 +195,7 @@ func (c *ChartDownloader) ResolveChartVersion(ref, version string) (*url.URL, er c.Options = append( c.Options, getter.WithBasicAuth(rc.Username, rc.Password), + getter.WithPassCredentialsAll(rc.PassCredentialsAll), ) } return u, nil @@ -224,7 +225,10 @@ func (c *ChartDownloader) ResolveChartVersion(ref, version string) (*url.URL, er c.Options = append(c.Options, getter.WithTLSClientConfig(r.Config.CertFile, r.Config.KeyFile, r.Config.CAFile)) } if r.Config.Username != "" && r.Config.Password != "" { - c.Options = append(c.Options, getter.WithBasicAuth(r.Config.Username, r.Config.Password)) + c.Options = append(c.Options, + getter.WithBasicAuth(r.Config.Username, r.Config.Password), + getter.WithPassCredentialsAll(r.Config.PassCredentialsAll), + ) } } diff --git a/pkg/downloader/chart_downloader_test.go b/pkg/downloader/chart_downloader_test.go index 334d7aaa1..38a06671c 100644 --- a/pkg/downloader/chart_downloader_test.go +++ b/pkg/downloader/chart_downloader_test.go @@ -205,6 +205,7 @@ func TestDownloadTo(t *testing.T) { }), Options: []getter.Option{ getter.WithBasicAuth("username", "password"), + getter.WithPassCredentialsAll(false), }, } cname := "/signtest-0.1.0.tgz" diff --git a/pkg/downloader/manager.go b/pkg/downloader/manager.go index 2dedc5757..22db8bfdd 100644 --- a/pkg/downloader/manager.go +++ b/pkg/downloader/manager.go @@ -310,7 +310,7 @@ func (m *Manager) downloadAll(deps []*chart.Dependency) error { // Any failure to resolve/download a chart should fail: // https://github.com/helm/helm/issues/1439 - churl, username, password, insecureskiptlsverify, err := m.findChartURL(dep.Name, dep.Version, dep.Repository, repos) + churl, username, password, insecureskiptlsverify, passcredentialsall, err := m.findChartURL(dep.Name, dep.Version, dep.Repository, repos) if err != nil { saveError = errors.Wrapf(err, "could not find %s", churl) break @@ -332,6 +332,7 @@ func (m *Manager) downloadAll(deps []*chart.Dependency) error { Getters: m.Getters, Options: []getter.Option{ getter.WithBasicAuth(username, password), + getter.WithPassCredentialsAll(passcredentialsall), getter.WithInsecureSkipVerifyTLS(insecureskiptlsverify), }, } @@ -686,9 +687,9 @@ func (m *Manager) parallelRepoUpdate(repos []*repo.Entry) error { // repoURL is the repository to search // // If it finds a URL that is "relative", it will prepend the repoURL. -func (m *Manager) findChartURL(name, version, repoURL string, repos map[string]*repo.ChartRepository) (url, username, password string, insecureskiptlsverify bool, err error) { +func (m *Manager) findChartURL(name, version, repoURL string, repos map[string]*repo.ChartRepository) (url, username, password string, insecureskiptlsverify, passcredentialsall bool, err error) { if strings.HasPrefix(repoURL, "oci://") { - return fmt.Sprintf("%s/%s:%s", repoURL, name, version), "", "", false, nil + return fmt.Sprintf("%s/%s:%s", repoURL, name, version), "", "", false, false, nil } for _, cr := range repos { @@ -710,16 +711,17 @@ func (m *Manager) findChartURL(name, version, repoURL string, repos map[string]* } username = cr.Config.Username password = cr.Config.Password + passcredentialsall = cr.Config.PassCredentialsAll insecureskiptlsverify = cr.Config.InsecureSkipTLSverify return } } url, err = repo.FindChartInRepoURL(repoURL, name, version, "", "", "", m.Getters) if err == nil { - return url, username, password, false, err + return url, username, password, false, false, err } err = errors.Errorf("chart %s not found in %s: %s", name, repoURL, err) - return url, username, password, false, err + return url, username, password, false, false, err } // findEntryByName finds an entry in the chart repository whose name matches the given name. diff --git a/pkg/downloader/manager_test.go b/pkg/downloader/manager_test.go index ba6ecedf5..0cc6d6f12 100644 --- a/pkg/downloader/manager_test.go +++ b/pkg/downloader/manager_test.go @@ -81,7 +81,7 @@ func TestFindChartURL(t *testing.T) { version := "0.1.0" repoURL := "http://example.com/charts" - churl, username, password, insecureSkipTLSVerify, err := m.findChartURL(name, version, repoURL, repos) + churl, username, password, insecureSkipTLSVerify, passcredentialsall, err := m.findChartURL(name, version, repoURL, repos) if err != nil { t.Fatal(err) } @@ -95,6 +95,9 @@ func TestFindChartURL(t *testing.T) { if password != "" { t.Errorf("Unexpected password %q", password) } + if passcredentialsall != false { + t.Errorf("Unexpected passcredentialsall %t", passcredentialsall) + } if insecureSkipTLSVerify { t.Errorf("Unexpected insecureSkipTLSVerify %t", insecureSkipTLSVerify) } @@ -103,7 +106,7 @@ func TestFindChartURL(t *testing.T) { version = "1.2.3" repoURL = "https://example-https-insecureskiptlsverify.com" - churl, username, password, insecureSkipTLSVerify, err = m.findChartURL(name, version, repoURL, repos) + churl, username, password, insecureSkipTLSVerify, passcredentialsall, err = m.findChartURL(name, version, repoURL, repos) if err != nil { t.Fatal(err) } @@ -120,6 +123,9 @@ func TestFindChartURL(t *testing.T) { if password != "" { t.Errorf("Unexpected password %q", password) } + if passcredentialsall != false { + t.Errorf("Unexpected passcredentialsall %t", passcredentialsall) + } } func TestGetRepoNames(t *testing.T) { diff --git a/pkg/getter/getter.go b/pkg/getter/getter.go index 465348456..78add728a 100644 --- a/pkg/getter/getter.go +++ b/pkg/getter/getter.go @@ -38,6 +38,7 @@ type options struct { insecureSkipVerifyTLS bool username string password string + passCredentialsAll bool userAgent string version string registryClient *registry.Client @@ -64,6 +65,12 @@ func WithBasicAuth(username, password string) Option { } } +func WithPassCredentialsAll(pass bool) Option { + return func(opts *options) { + opts.passCredentialsAll = pass + } +} + // WithUserAgent sets the request's User-Agent header to use the provided agent name. func WithUserAgent(userAgent string) Option { return func(opts *options) { diff --git a/pkg/getter/httpgetter.go b/pkg/getter/httpgetter.go index 9920cf14c..94b64381c 100644 --- a/pkg/getter/httpgetter.go +++ b/pkg/getter/httpgetter.go @@ -20,6 +20,7 @@ import ( "crypto/tls" "io" "net/http" + "net/url" "github.com/pkg/errors" @@ -56,8 +57,24 @@ func (g *HTTPGetter) get(href string) (*bytes.Buffer, error) { req.Header.Set("User-Agent", g.opts.userAgent) } - if g.opts.username != "" && g.opts.password != "" { - req.SetBasicAuth(g.opts.username, g.opts.password) + // Before setting the basic auth credentials, make sure the URL associated + // with the basic auth is the one being fetched. + u1, err := url.Parse(g.opts.url) + if err != nil { + return buf, errors.Wrap(err, "Unable to parse getter URL") + } + u2, err := url.Parse(href) + if err != nil { + return buf, errors.Wrap(err, "Unable to parse URL getting from") + } + + // Host on URL (returned from url.Parse) contains the port if present. + // This check ensures credentials are not passed between different + // services on different ports. + if g.opts.passCredentialsAll || (u1.Scheme == u2.Scheme && u1.Host == u2.Host) { + if g.opts.username != "" && g.opts.password != "" { + req.SetBasicAuth(g.opts.username, g.opts.password) + } } client, err := g.httpClient() diff --git a/pkg/getter/httpgetter_test.go b/pkg/getter/httpgetter_test.go index ad97898cb..d823aec0d 100644 --- a/pkg/getter/httpgetter_test.go +++ b/pkg/getter/httpgetter_test.go @@ -54,6 +54,7 @@ func TestHTTPGetter(t *testing.T) { // Test with options g, err = NewHTTPGetter( WithBasicAuth("I", "Am"), + WithPassCredentialsAll(false), WithUserAgent("Groot"), WithTLSClientConfig(pub, priv, ca), WithInsecureSkipVerifyTLS(insecure), @@ -76,6 +77,10 @@ func TestHTTPGetter(t *testing.T) { t.Errorf("Expected NewHTTPGetter to contain %q as the password, got %q", "Am", hg.opts.password) } + if hg.opts.passCredentialsAll != false { + t.Errorf("Expected NewHTTPGetter to contain %t as PassCredentialsAll, got %t", false, hg.opts.passCredentialsAll) + } + if hg.opts.userAgent != "Groot" { t.Errorf("Expected NewHTTPGetter to contain %q as the user agent, got %q", "Groot", hg.opts.userAgent) } @@ -118,6 +123,28 @@ func TestHTTPGetter(t *testing.T) { if hg.opts.insecureSkipVerifyTLS != insecure { t.Errorf("Expected NewHTTPGetter to contain %t as InsecureSkipVerifyTLs flag, got %t", insecure, hg.opts.insecureSkipVerifyTLS) } + + // Checking false by default + if hg.opts.passCredentialsAll != false { + t.Errorf("Expected NewHTTPGetter to contain %t as PassCredentialsAll, got %t", false, hg.opts.passCredentialsAll) + } + + // Test setting PassCredentialsAll + g, err = NewHTTPGetter( + WithBasicAuth("I", "Am"), + WithPassCredentialsAll(true), + ) + if err != nil { + t.Fatal(err) + } + + hg, ok = g.(*HTTPGetter) + if !ok { + t.Fatal("expected NewHTTPGetter to produce an *HTTPGetter") + } + if hg.opts.passCredentialsAll != true { + t.Errorf("Expected NewHTTPGetter to contain %t as PassCredentialsAll, got %t", true, hg.opts.passCredentialsAll) + } } func TestDownload(t *testing.T) { @@ -163,6 +190,7 @@ func TestDownload(t *testing.T) { httpgetter, err := NewHTTPGetter( WithURL(u.String()), WithBasicAuth("username", "password"), + WithPassCredentialsAll(false), WithUserAgent(expectedUserAgent), ) if err != nil { @@ -176,6 +204,76 @@ func TestDownload(t *testing.T) { if got.String() != expect { t.Errorf("Expected %q, got %q", expect, got.String()) } + + // test with Get URL differing from withURL + crossAuthSrv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + username, password, ok := r.BasicAuth() + if ok || username == "username" || password == "password" { + t.Errorf("Expected request to not include but got '%v', '%s', '%s'", ok, username, password) + } + fmt.Fprint(w, expect) + })) + + defer crossAuthSrv.Close() + + u, _ = url.ParseRequestURI(crossAuthSrv.URL) + + // A different host is provided for the WithURL from the one used for Get + u2, _ := url.ParseRequestURI(crossAuthSrv.URL) + host := strings.Split(u2.Host, ":") + host[0] = host[0] + "a" + u2.Host = strings.Join(host, ":") + httpgetter, err = NewHTTPGetter( + WithURL(u2.String()), + WithBasicAuth("username", "password"), + WithPassCredentialsAll(false), + ) + if err != nil { + t.Fatal(err) + } + got, err = httpgetter.Get(u.String()) + if err != nil { + t.Fatal(err) + } + + if got.String() != expect { + t.Errorf("Expected %q, got %q", expect, got.String()) + } + + // test with Get URL differing from withURL and should pass creds + crossAuthSrv = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + username, password, ok := r.BasicAuth() + if !ok || username != "username" || password != "password" { + t.Errorf("Expected request to use basic auth and for username == 'username' and password == 'password', got '%v', '%s', '%s'", ok, username, password) + } + fmt.Fprint(w, expect) + })) + + defer crossAuthSrv.Close() + + u, _ = url.ParseRequestURI(crossAuthSrv.URL) + + // A different host is provided for the WithURL from the one used for Get + u2, _ = url.ParseRequestURI(crossAuthSrv.URL) + host = strings.Split(u2.Host, ":") + host[0] = host[0] + "a" + u2.Host = strings.Join(host, ":") + httpgetter, err = NewHTTPGetter( + WithURL(u2.String()), + WithBasicAuth("username", "password"), + WithPassCredentialsAll(true), + ) + if err != nil { + t.Fatal(err) + } + got, err = httpgetter.Get(u.String()) + if err != nil { + t.Fatal(err) + } + + if got.String() != expect { + t.Errorf("Expected %q, got %q", expect, got.String()) + } } func TestDownloadTLS(t *testing.T) { diff --git a/pkg/repo/chartrepo.go b/pkg/repo/chartrepo.go index 09b94fd42..67ede93fd 100644 --- a/pkg/repo/chartrepo.go +++ b/pkg/repo/chartrepo.go @@ -48,6 +48,7 @@ type Entry struct { KeyFile string `json:"keyFile"` CAFile string `json:"caFile"` InsecureSkipTLSverify bool `json:"insecure_skip_tls_verify"` + PassCredentialsAll bool `json:"pass_credentials_all"` } // ChartRepository represents a chart repository @@ -129,6 +130,7 @@ func (r *ChartRepository) DownloadIndexFile() (string, error) { getter.WithInsecureSkipVerifyTLS(r.Config.InsecureSkipTLSverify), getter.WithTLSClientConfig(r.Config.CertFile, r.Config.KeyFile, r.Config.CAFile), getter.WithBasicAuth(r.Config.Username, r.Config.Password), + getter.WithPassCredentialsAll(r.Config.PassCredentialsAll), ) if err != nil { return "", err @@ -217,6 +219,15 @@ func FindChartInAuthRepoURL(repoURL, username, password, chartName, chartVersion // but it also receives credentials and TLS verify flag for the chart repository. // TODO Helm 4, FindChartInAuthAndTLSRepoURL should be integrated into FindChartInAuthRepoURL. func FindChartInAuthAndTLSRepoURL(repoURL, username, password, chartName, chartVersion, certFile, keyFile, caFile string, insecureSkipTLSverify bool, getters getter.Providers) (string, error) { + return FindChartInAuthAndTLSAndPassRepoURL(repoURL, username, password, chartName, chartVersion, certFile, keyFile, caFile, false, false, getters) +} + +// FindChartInAuthAndTLSAndPassRepoURL finds chart in chart repository pointed by repoURL +// without adding repo to repositories, like FindChartInRepoURL, +// but it also receives credentials, TLS verify flag, and if credentials should +// be passed on to other domains. +// TODO Helm 4, FindChartInAuthAndTLSAndPassRepoURL should be integrated into FindChartInAuthRepoURL. +func FindChartInAuthAndTLSAndPassRepoURL(repoURL, username, password, chartName, chartVersion, certFile, keyFile, caFile string, insecureSkipTLSverify, passCredentialsAll bool, getters getter.Providers) (string, error) { // Download and write the index file to a temporary location buf := make([]byte, 20) @@ -227,6 +238,7 @@ func FindChartInAuthAndTLSRepoURL(repoURL, username, password, chartName, chartV URL: repoURL, Username: username, Password: password, + PassCredentialsAll: passCredentialsAll, CertFile: certFile, KeyFile: keyFile, CAFile: caFile, diff --git a/pkg/repo/chartrepo_test.go b/pkg/repo/chartrepo_test.go index 7bd563460..85401284e 100644 --- a/pkg/repo/chartrepo_test.go +++ b/pkg/repo/chartrepo_test.go @@ -292,14 +292,14 @@ func startLocalTLSServerForTests(handler http.Handler) (*httptest.Server, error) return httptest.NewTLSServer(handler), nil } -func TestFindChartInAuthAndTLSRepoURL(t *testing.T) { +func TestFindChartInAuthAndTLSAndPassRepoURL(t *testing.T) { srv, err := startLocalTLSServerForTests(nil) if err != nil { t.Fatal(err) } defer srv.Close() - chartURL, err := FindChartInAuthAndTLSRepoURL(srv.URL, "", "", "nginx", "", "", "", "", true, getter.All(&cli.EnvSettings{})) + chartURL, err := FindChartInAuthAndTLSAndPassRepoURL(srv.URL, "", "", "nginx", "", "", "", "", true, false, getter.All(&cli.EnvSettings{})) if err != nil { t.Fatalf("%v", err) } @@ -308,10 +308,10 @@ func TestFindChartInAuthAndTLSRepoURL(t *testing.T) { } // If the insecureSkipTLsverify is false, it will return an error that contains "x509: certificate signed by unknown authority". - _, err = FindChartInAuthAndTLSRepoURL(srv.URL, "", "", "nginx", "0.1.0", "", "", "", false, getter.All(&cli.EnvSettings{})) + _, err = FindChartInAuthAndTLSAndPassRepoURL(srv.URL, "", "", "nginx", "0.1.0", "", "", "", false, false, getter.All(&cli.EnvSettings{})) if !strings.Contains(err.Error(), "x509: certificate signed by unknown authority") { - t.Errorf("Expected TLS error for function FindChartInAuthAndTLSRepoURL not found, but got a different error (%v)", err) + t.Errorf("Expected TLS error for function FindChartInAuthAndTLSAndPassRepoURL not found, but got a different error (%v)", err) } }