mirror of https://github.com/helm/helm
dayeguilaiye
2 years ago
committed by
GitHub
commit
fef9d96505
@ -1,14 +0,0 @@
|
||||
---
|
||||
|
||||
# This file can be removed when Helm no longer uses CircleCI on any release
|
||||
# branches. Once CircleCI is turned off this file can be removed.
|
||||
version: 2
|
||||
|
||||
jobs:
|
||||
build:
|
||||
docker:
|
||||
- image: cimg/go:1.18
|
||||
|
||||
steps:
|
||||
- checkout
|
||||
|
||||
@ -1,11 +1,39 @@
|
||||
version: 2
|
||||
|
||||
updates:
|
||||
- # Keep dev-v3 branch dependencies up to date, while Helm v3 is within support
|
||||
package-ecosystem: "gomod"
|
||||
target-branch: "dev-v3"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
groups:
|
||||
k8s.io:
|
||||
patterns:
|
||||
- "k8s.io/api"
|
||||
- "k8s.io/apiextensions-apiserver"
|
||||
- "k8s.io/apimachinery"
|
||||
- "k8s.io/apiserver"
|
||||
- "k8s.io/cli-runtime"
|
||||
- "k8s.io/client-go"
|
||||
- "k8s.io/kubectl"
|
||||
- package-ecosystem: "gomod"
|
||||
target-branch: "main"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
groups:
|
||||
k8s.io:
|
||||
patterns:
|
||||
- "k8s.io/api"
|
||||
- "k8s.io/apiextensions-apiserver"
|
||||
- "k8s.io/apimachinery"
|
||||
- "k8s.io/apiserver"
|
||||
- "k8s.io/cli-runtime"
|
||||
- "k8s.io/client-go"
|
||||
- "k8s.io/kubectl"
|
||||
- package-ecosystem: "github-actions"
|
||||
target-branch: "main"
|
||||
directory: "/"
|
||||
schedule:
|
||||
interval: "daily"
|
||||
|
||||
@ -0,0 +1,26 @@
|
||||
name: golangci-lint
|
||||
|
||||
on:
|
||||
push:
|
||||
pull_request:
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
golangci:
|
||||
name: golangci-lint
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Checkout
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
|
||||
|
||||
- name: Setup Go
|
||||
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@5.3.0
|
||||
with:
|
||||
go-version: '1.23'
|
||||
check-latest: true
|
||||
- name: golangci-lint
|
||||
uses: golangci/golangci-lint-action@2226d7cb06a077cd73e56eedd38eecad18e5d837 #pin@6.5.0
|
||||
with:
|
||||
version: v1.62
|
||||
@ -0,0 +1,24 @@
|
||||
name: govulncheck
|
||||
on:
|
||||
push:
|
||||
paths:
|
||||
- go.sum
|
||||
schedule:
|
||||
- cron: "0 0 * * *"
|
||||
|
||||
permissions: read-all
|
||||
|
||||
jobs:
|
||||
govulncheck:
|
||||
name: govulncheck
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- name: Setup Go
|
||||
uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@5.3.0
|
||||
with:
|
||||
go-version: '1.23'
|
||||
check-latest: true
|
||||
- name: govulncheck
|
||||
uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # pin@1.0.4
|
||||
with:
|
||||
go-package: ./...
|
||||
@ -0,0 +1,69 @@
|
||||
name: Scorecard supply-chain security
|
||||
on:
|
||||
# For Branch-Protection check. Only the default branch is supported. See
|
||||
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#branch-protection
|
||||
branch_protection_rule:
|
||||
# To guarantee Maintained check is occasionally updated. See
|
||||
# https://github.com/ossf/scorecard/blob/main/docs/checks.md#maintained
|
||||
schedule:
|
||||
- cron: '25 7 * * 0'
|
||||
push:
|
||||
branches: [ "main" ]
|
||||
|
||||
# Declare default permissions as read only.
|
||||
permissions: read-all
|
||||
|
||||
jobs:
|
||||
analysis:
|
||||
name: Scorecard analysis
|
||||
runs-on: ubuntu-latest
|
||||
permissions:
|
||||
# Needed to upload the results to code-scanning dashboard.
|
||||
security-events: write
|
||||
# Needed to publish results and get a badge (see publish_results below).
|
||||
id-token: write
|
||||
# Uncomment the permissions below if installing in a private repository.
|
||||
# contents: read
|
||||
# actions: read
|
||||
|
||||
steps:
|
||||
- name: "Checkout code"
|
||||
uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
|
||||
with:
|
||||
persist-credentials: false
|
||||
|
||||
- name: "Run analysis"
|
||||
uses: ossf/scorecard-action@f49aabe0b5af0936a0987cfb85d86b75731b0186 # v2.4.1
|
||||
with:
|
||||
results_file: results.sarif
|
||||
results_format: sarif
|
||||
# (Optional) "write" PAT token. Uncomment the `repo_token` line below if:
|
||||
# - you want to enable the Branch-Protection check on a *public* repository, or
|
||||
# - you are installing Scorecard on a *private* repository
|
||||
# To create the PAT, follow the steps in https://github.com/ossf/scorecard-action?tab=readme-ov-file#authentication-with-fine-grained-pat-optional.
|
||||
# repo_token: ${{ secrets.SCORECARD_TOKEN }}
|
||||
|
||||
# Public repositories:
|
||||
# - Publish results to OpenSSF REST API for easy access by consumers
|
||||
# - Allows the repository to include the Scorecard badge.
|
||||
# - See https://github.com/ossf/scorecard-action#publishing-results.
|
||||
# For private repositories:
|
||||
# - `publish_results` will always be set to `false`, regardless
|
||||
# of the value entered here.
|
||||
publish_results: true
|
||||
|
||||
# Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
|
||||
# format to the repository Actions tab.
|
||||
- name: "Upload artifact"
|
||||
uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
|
||||
with:
|
||||
name: SARIF file
|
||||
path: results.sarif
|
||||
retention-days: 5
|
||||
|
||||
# Upload the results to GitHub's code scanning dashboard (optional).
|
||||
# Commenting out will disable upload of results to your repo's Code Scanning dashboard
|
||||
- name: "Upload to code-scanning"
|
||||
uses: github/codeql-action/upload-sarif@v3
|
||||
with:
|
||||
sarif_file: results.sarif
|
||||
@ -0,0 +1,98 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"io"
|
||||
"log"
|
||||
|
||||
"github.com/spf13/cobra"
|
||||
k8sLabels "k8s.io/apimachinery/pkg/labels"
|
||||
|
||||
"helm.sh/helm/v4/cmd/helm/require"
|
||||
"helm.sh/helm/v4/pkg/action"
|
||||
"helm.sh/helm/v4/pkg/cli/output"
|
||||
)
|
||||
|
||||
type metadataWriter struct {
|
||||
metadata *action.Metadata
|
||||
}
|
||||
|
||||
func newGetMetadataCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
|
||||
var outfmt output.Format
|
||||
client := action.NewGetMetadata(cfg)
|
||||
|
||||
cmd := &cobra.Command{
|
||||
Use: "metadata RELEASE_NAME",
|
||||
Short: "This command fetches metadata for a given release",
|
||||
Args: require.ExactArgs(1),
|
||||
ValidArgsFunction: func(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
|
||||
if len(args) != 0 {
|
||||
return noMoreArgsComp()
|
||||
}
|
||||
return compListReleases(toComplete, args, cfg)
|
||||
},
|
||||
RunE: func(_ *cobra.Command, args []string) error {
|
||||
releaseMetadata, err := client.Run(args[0])
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
return outfmt.Write(out, &metadataWriter{releaseMetadata})
|
||||
},
|
||||
}
|
||||
|
||||
f := cmd.Flags()
|
||||
f.IntVar(&client.Version, "revision", 0, "specify release revision")
|
||||
err := cmd.RegisterFlagCompletionFunc("revision", func(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {
|
||||
if len(args) == 1 {
|
||||
return compListRevisions(toComplete, cfg, args[0])
|
||||
}
|
||||
return nil, cobra.ShellCompDirectiveNoFileComp
|
||||
})
|
||||
|
||||
if err != nil {
|
||||
log.Fatal(err)
|
||||
}
|
||||
|
||||
bindOutputFlag(cmd, &outfmt)
|
||||
|
||||
return cmd
|
||||
}
|
||||
|
||||
func (w metadataWriter) WriteTable(out io.Writer) error {
|
||||
_, _ = fmt.Fprintf(out, "NAME: %v\n", w.metadata.Name)
|
||||
_, _ = fmt.Fprintf(out, "CHART: %v\n", w.metadata.Chart)
|
||||
_, _ = fmt.Fprintf(out, "VERSION: %v\n", w.metadata.Version)
|
||||
_, _ = fmt.Fprintf(out, "APP_VERSION: %v\n", w.metadata.AppVersion)
|
||||
_, _ = fmt.Fprintf(out, "ANNOTATIONS: %v\n", k8sLabels.Set(w.metadata.Annotations).String())
|
||||
_, _ = fmt.Fprintf(out, "DEPENDENCIES: %v\n", w.metadata.FormattedDepNames())
|
||||
_, _ = fmt.Fprintf(out, "NAMESPACE: %v\n", w.metadata.Namespace)
|
||||
_, _ = fmt.Fprintf(out, "REVISION: %v\n", w.metadata.Revision)
|
||||
_, _ = fmt.Fprintf(out, "STATUS: %v\n", w.metadata.Status)
|
||||
_, _ = fmt.Fprintf(out, "DEPLOYED_AT: %v\n", w.metadata.DeployedAt)
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
func (w metadataWriter) WriteJSON(out io.Writer) error {
|
||||
return output.EncodeJSON(out, w.metadata)
|
||||
}
|
||||
|
||||
func (w metadataWriter) WriteYAML(out io.Writer) error {
|
||||
return output.EncodeYAML(out, w.metadata)
|
||||
}
|
||||
@ -0,0 +1,66 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"testing"
|
||||
|
||||
"helm.sh/helm/v4/pkg/release"
|
||||
)
|
||||
|
||||
func TestGetMetadataCmd(t *testing.T) {
|
||||
tests := []cmdTestCase{{
|
||||
name: "get metadata with a release",
|
||||
cmd: "get metadata thomas-guide",
|
||||
golden: "output/get-metadata.txt",
|
||||
rels: []*release.Release{release.Mock(&release.MockReleaseOptions{Name: "thomas-guide"})},
|
||||
}, {
|
||||
name: "get metadata requires release name arg",
|
||||
cmd: "get metadata",
|
||||
golden: "output/get-metadata-args.txt",
|
||||
rels: []*release.Release{release.Mock(&release.MockReleaseOptions{Name: "thomas-guide"})},
|
||||
wantError: true,
|
||||
}, {
|
||||
name: "get metadata to json",
|
||||
cmd: "get metadata thomas-guide --output json",
|
||||
golden: "output/get-metadata.json",
|
||||
rels: []*release.Release{release.Mock(&release.MockReleaseOptions{Name: "thomas-guide"})},
|
||||
}, {
|
||||
name: "get metadata to yaml",
|
||||
cmd: "get metadata thomas-guide --output yaml",
|
||||
golden: "output/get-metadata.yaml",
|
||||
rels: []*release.Release{release.Mock(&release.MockReleaseOptions{Name: "thomas-guide"})},
|
||||
}}
|
||||
runTestCmd(t, tests)
|
||||
}
|
||||
|
||||
func TestGetMetadataCompletion(t *testing.T) {
|
||||
checkReleaseCompletion(t, "get metadata", false)
|
||||
}
|
||||
|
||||
func TestGetMetadataRevisionCompletion(t *testing.T) {
|
||||
revisionFlagCompletionTest(t, "get metadata")
|
||||
}
|
||||
|
||||
func TestGetMetadataOutputCompletion(t *testing.T) {
|
||||
outputFlagCompletionTest(t, "get metadata")
|
||||
}
|
||||
|
||||
func TestGetMetadataFileCompletion(t *testing.T) {
|
||||
checkFileCompletion(t, "get metadata", false)
|
||||
checkFileCompletion(t, "get metadata myrelease", false)
|
||||
}
|
||||
@ -0,0 +1,91 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"errors"
|
||||
"fmt"
|
||||
"os"
|
||||
"runtime"
|
||||
"runtime/pprof"
|
||||
)
|
||||
|
||||
var (
|
||||
cpuProfileFile *os.File
|
||||
cpuProfilePath string
|
||||
memProfilePath string
|
||||
)
|
||||
|
||||
func init() {
|
||||
cpuProfilePath = os.Getenv("HELM_PPROF_CPU_PROFILE")
|
||||
memProfilePath = os.Getenv("HELM_PPROF_MEM_PROFILE")
|
||||
}
|
||||
|
||||
// startProfiling starts profiling CPU usage if HELM_PPROF_CPU_PROFILE is set
|
||||
// to a file path. It returns an error if the file could not be created or
|
||||
// CPU profiling could not be started.
|
||||
func startProfiling() error {
|
||||
if cpuProfilePath != "" {
|
||||
var err error
|
||||
cpuProfileFile, err = os.Create(cpuProfilePath)
|
||||
if err != nil {
|
||||
return fmt.Errorf("could not create CPU profile: %w", err)
|
||||
}
|
||||
if err := pprof.StartCPUProfile(cpuProfileFile); err != nil {
|
||||
cpuProfileFile.Close()
|
||||
cpuProfileFile = nil
|
||||
return fmt.Errorf("could not start CPU profile: %w", err)
|
||||
}
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// stopProfiling stops profiling CPU and memory usage.
|
||||
// It writes memory profile to the file path specified in HELM_PPROF_MEM_PROFILE
|
||||
// environment variable.
|
||||
func stopProfiling() error {
|
||||
errs := []error{}
|
||||
|
||||
// Stop CPU profiling if it was started
|
||||
if cpuProfileFile != nil {
|
||||
pprof.StopCPUProfile()
|
||||
err := cpuProfileFile.Close()
|
||||
if err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
cpuProfileFile = nil
|
||||
}
|
||||
|
||||
if memProfilePath != "" {
|
||||
f, err := os.Create(memProfilePath)
|
||||
if err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
defer f.Close()
|
||||
|
||||
runtime.GC() // get up-to-date statistics
|
||||
if err := pprof.WriteHeapProfile(f); err != nil {
|
||||
errs = append(errs, err)
|
||||
}
|
||||
}
|
||||
|
||||
if err := errors.Join(errs...); err != nil {
|
||||
return fmt.Errorf("error(s) while stopping profiling: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
@ -1,58 +0,0 @@
|
||||
//go:build !windows
|
||||
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"os"
|
||||
"os/user"
|
||||
"path/filepath"
|
||||
)
|
||||
|
||||
func checkPerms() {
|
||||
// This function MUST NOT FAIL, as it is just a check for a common permissions problem.
|
||||
// If for some reason the function hits a stopping condition, it may panic. But only if
|
||||
// we can be sure that it is panicking because Helm cannot proceed.
|
||||
|
||||
kc := settings.KubeConfig
|
||||
if kc == "" {
|
||||
kc = os.Getenv("KUBECONFIG")
|
||||
}
|
||||
if kc == "" {
|
||||
u, err := user.Current()
|
||||
if err != nil {
|
||||
// No idea where to find KubeConfig, so return silently. Many helm commands
|
||||
// can proceed happily without a KUBECONFIG, so this is not a fatal error.
|
||||
return
|
||||
}
|
||||
kc = filepath.Join(u.HomeDir, ".kube", "config")
|
||||
}
|
||||
fi, err := os.Stat(kc)
|
||||
if err != nil {
|
||||
// DO NOT error if no KubeConfig is found. Not all commands require one.
|
||||
return
|
||||
}
|
||||
|
||||
perm := fi.Mode().Perm()
|
||||
if perm&0040 > 0 {
|
||||
warning("Kubernetes configuration file is group-readable. This is insecure. Location: %s", kc)
|
||||
}
|
||||
if perm&0004 > 0 {
|
||||
warning("Kubernetes configuration file is world-readable. This is insecure. Location: %s", kc)
|
||||
}
|
||||
}
|
||||
@ -1,82 +0,0 @@
|
||||
//go:build !windows
|
||||
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"io"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func checkPermsStderr() (string, error) {
|
||||
r, w, err := os.Pipe()
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
stderr := os.Stderr
|
||||
os.Stderr = w
|
||||
defer func() {
|
||||
os.Stderr = stderr
|
||||
}()
|
||||
|
||||
checkPerms()
|
||||
w.Close()
|
||||
|
||||
var text bytes.Buffer
|
||||
io.Copy(&text, r)
|
||||
return text.String(), nil
|
||||
}
|
||||
|
||||
func TestCheckPerms(t *testing.T) {
|
||||
tdir := t.TempDir()
|
||||
tfile := filepath.Join(tdir, "testconfig")
|
||||
fh, err := os.OpenFile(tfile, os.O_CREATE|os.O_APPEND|os.O_RDWR, 0440)
|
||||
if err != nil {
|
||||
t.Errorf("Failed to create temp file: %s", err)
|
||||
}
|
||||
|
||||
tconfig := settings.KubeConfig
|
||||
settings.KubeConfig = tfile
|
||||
defer func() { settings.KubeConfig = tconfig }()
|
||||
|
||||
text, err := checkPermsStderr()
|
||||
if err != nil {
|
||||
t.Fatalf("could not read from stderr: %s", err)
|
||||
}
|
||||
expectPrefix := "WARNING: Kubernetes configuration file is group-readable. This is insecure. Location:"
|
||||
if !strings.HasPrefix(text, expectPrefix) {
|
||||
t.Errorf("Expected to get a warning for group perms. Got %q", text)
|
||||
}
|
||||
|
||||
if err := fh.Chmod(0404); err != nil {
|
||||
t.Errorf("Could not change mode on file: %s", err)
|
||||
}
|
||||
text, err = checkPermsStderr()
|
||||
if err != nil {
|
||||
t.Fatalf("could not read from stderr: %s", err)
|
||||
}
|
||||
expectPrefix = "WARNING: Kubernetes configuration file is world-readable. This is insecure. Location:"
|
||||
if !strings.HasPrefix(text, expectPrefix) {
|
||||
t.Errorf("Expected to get a warning for world perms. Got %q", text)
|
||||
}
|
||||
}
|
||||
Some files were not shown because too many files have changed in this diff Show More
Loading…
Reference in new issue