If implemented it will permit queriying the Kubernetes API to fetch the specified
Flux Kustomization, then uses the specified path to build the overlay.
It will then ssa-dry-run apply and output the diff using homeport/dyff
Signed-off-by: Soule BA <soule@weave.works>
If implemented it will permit queriying the Kubernetes API to fetch the specified
Flux Kustomization, then uses the specified path to build
the overlay.
Signed-off-by: Soule BA <soule@weave.works>
It now accepts arguments in the forms <resource>/<name>
and <resource> <name> instead of requiring api version and
kind as flags.
Signed-off-by: Jakob Schrettenbrunner <jakob.schrettenbrunner@telekom.de>
Remove the overwrite of the repositoryURL.Host variable to include Git
servers deployed on non-standard https ports
Co-authored-by: Sebastián Vargas <develolux@gmail.com>
Signed-off-by: Alby Hernández <me@achetronic.com>
Signed-off-by: Alby Hernández <alby.hernandez@system73.com>
This fixes a styling issue:
```
$ flux --help
Command line utility for assembling Kubernetes CD pipelines the GitOps
way.
Usage:
flux [command]
...
Available Commands:
...
suspend Suspend resources
trace trace an in-cluster object throughout the GitOps delivery
pipeline
uninstall Uninstall Flux and its custom resource definitions
...
```
Signed-off-by: Hidde Beydals <hello@hidde.co>
The new command set is:
flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --hostname=<domain> --token-auth
There is a parity in the capabilities with the other providers.
Signed-off-by: Soule BA <soule@weave.works>
bufio's reader.ReadString includes any CRLF characters and we don't
want these in the resulting token because this leads to errors in the
authentication like this:
```
✗ failed to get Git repository
"https://github.com/kingdon-ci/jenkins-infra": Get
"https://api.github.com/repos/kingdon-ci/jenkins-infra": net/http:
invalid header field value "Bearer gho_NNNNNsecrettokenMMMMM\n" for
key Authorization
```
Signed-off-by: Max Jonas Werner <mail@makk.es>
This change adds functionality to both, `bootstrap github` and
`bootstrap gitlab` to prompt the user for the personal access tokens
if those can't be derived from the shell environment. Echoing is
turned off for better privacy.
Instead of having to interactively type the token or manually paste it
from the clipboard, users can also pipe it to Flux which comes in
handy e.g. when executing Flux remotely over an SSH connection:
```
$ echo 'asdf' | flux bootstrap github
```
Otherwise, Flux will prompt the user:
```
$ flux bootstrap github
Please type your GitHub personal access token:
```
closes#2011
Signed-off-by: Max Jonas Werner <mail@makk.es>
Motivation: RSA SHA-1 SSH keys are no longer accepted by GitHub https://github.blog/2021-09-01-improving-git-protocol-security-github/.
Given this we are switching the default from RSA to ECDSA for `git`, `github` and `gitlab` variants of `flux bootstrap`.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
Use `app.kubernetes.io/part-of: flux` label instead of `app.kubernetes.io/instance` to select the in-cluster objects used in flux version, check, logs and uninstall commands.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
While fixing an unrelated issue, I noticed:
✗ GitRepository reconciliation failed: ''PGP public keys secret error: expected pointer, but got nil
the single quote should surround the readyCond.Message
Signed-off-by: Kingdon Barrett <yebyen@gmail.com>
The `flux tree kustomization` command prints the resources reconciled by the given Kustomization.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This fixes the case where you create a HelmRelease with `--export` and
the `install: {}` field being there, adding no value to the manifest.
Signed-off-by: Max Jonas Werner <mail@makk.es>
When a user provided the `--ca-file` flag to the `bootstrap` command,
the given CA file wasn't taken into account for cloning the repository
locally. It was just passed along to the CR that is created so Flux
can make use of it when cloning the repository in-cluster.
However, users may not want to add a custom CA to their local host's
trust chain and may expect the `--ca-file` flag to be respected also
for cloning the repository locally. This is what this commit
accomplishes.
closes#1775
Signed-off-by: Max Jonas Werner <mail@makk.es>
The create source tests are more interesting than the existing tests as they
create objects then wit for the flux source reconciler to complete. The tests
simulate this with a background goroutine that waits for an object to be
created then uses a test specific function to update it.
The tests set a timeout so that if there is a failure they timeout somewhat
quickly rather than hanging for a longer period of time.
Signed-off-by: Allen Porter <allen@thebends.org>
Speed up unit tests by using a shared envTest. This requires each
test to use its own namespace to avoid clobbering objects for
other tests. Tests previously took around 8 seconds each, and now
the initial test takes 2 seconds with follow up tests taking less
than a second each.
Also update existing tests that use a fixed namespace to use a
generated namespace.
Share gold file template function with yaml files.
Remove the testClusterMode, and instead rely on MainTest to do
the appropriate test setup and rootArgs flag setup. Move the
rootArg flag setup out of NewTestEnvKubeManager to avoid
side effects.
A follow up change can be to push the individual setups
from NewTestEnvKubeManager() into their respective TestMain since
the harness share little code.
Signed-off-by: Allen Porter <allen@thebends.org>
Replace the 4 arguments to cmdTestCase with a function that
can let tests run arbitrary logic if it is more complex than
what is provided by the test harness. Move the existing logic
into functions that the test can use for common assertions on
golden files and golden values.
These changes were pulled out of PR #1696 to make a smaller review.
Signed-off-by: Allen Porter <allen@thebends.org>
Remove use of the fake client, and replace with a real client connected to the
testEnv.
This required fixes to the yaml files as the testEnv has stricter verifcation
of objects. This also meant it was not possible to test a GitRepository with
a missing artifact since that is not a valid state.
The tests are slower than before, taking around 7-10 seconds each because the
testEnv is setup and destroyed for every test. These will be sped up in a
follow up PR.
Signed-off-by: Allen Porter <allen@thebends.org>
The new flag fetch and display the request ressource and then continue
watching the ressource until timeout or cancellation.
A single ressource/ressource type is supported.
Signed-off-by: Soule BA <soule@weave.works>
This should prevent the generation of the object getting bumped, as
observed on a GKE K8s 1.18 cluster using the logic before this commit.
We only want to generation to increase when there are actual changes to
the `spec` of a resource, as some controllers use the `generation`
value to make assumptions about what they should do during a
reconciliation.
Signed-off-by: Hidde Beydals <hello@hidde.co>
- move test helpers to main
- add support for inline golden values
- add test for `flux --version`
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
Add tests for flux trace command that fake out the kubernetes client,
load objects from a yaml file and create them in the client, and
assert on the output of the trace command to an expected golden file.
This is a follow up from the suggestions in PR https://github.com/fluxcd/flux2/pull/1626 which suggested that additional
testing would be helpful. This test approach is modeled after the helm command tests.
This required some changes to the kubernetes client setup to make it
possible to use a fake. If we agree this pattern makes sense, it can be
applied to other commands.
Signed-off-by: Allen Porter <allen@thebends.org>
Check for existence of GitRepository.Spec.Reference when displaying a trace to
avoid error:
✗ template: tmpl:28:21: executing "tmpl" at <.GitRepository.Spec.Reference.Tag>: nil pointer evaluating *v1beta1.GitRepositoryRef.Tag
Fixes issue #1621
Manually tested using the use cases highlighted in the issue.
Signed-off-by: Allen Porter <allen@thebends.org>
The trace command allows Flux users to point the CLI to a Kubernetes object in-cluster and get a detailed report about the GitOps pipeline that manages that particular object.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This includes an introduction of a `--pass-credentials` flag for the
`flux create source helm` command to allow configuring the new
option introduced.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This changes the logic for the parsing of private keys, as already
done for the source-controller, so that it is able to recognize and
work with a wider range of key formats instead of returning a vague
error:
```console
$ flux bootstrap git [..]
✗ ssh: this private key is passphrase protected
```
A patch for this was already submitted and merged in `go-git/go-git`,
but is not made available in a release yet:
https://github.com/go-git/go-git/pull/298
Signed-off-by: Hidde Beydals <hello@hidde.co>
This removes the usage of Hostname() which does not honor configured SSH
port to be used.
Resolves: #1377
See also: #1101, #1102
Signed-off-by: Tobias Jakobsson <jakobsson.tobias@gmail.com>
Remove the default branch value from `flux create source git` and validate that one of the ref options are specified.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
StringSliceVar allows for more flexibility when passing vars to list
flags.
Both formats will be supported:
- '--foo=one --foo=two'
- '--foo=one,two'
Signed-off-by: Claudia Beresford <claudiaberesford@gmail.com>
As otherwise (comparisons to) cluster configuration will fail due to
Separator differences. Was already fixed for provider implementations.
Signed-off-by: Hidde Beydals <hello@hidde.co>
The behavior introduced during the introduction of go-git-providers
was more strict, and has proven pretty quickly to not be useful to
all users. Therefore, the reconciliation behavior for repository
configuration has been put behind an opt-in flag, so that it does
not overwrite people their configs by accident.
Signed-off-by: Hidde Beydals <hello@hidde.co>
To highlight the fact that it configures the repository as defined,
which was not _really_ clear to some users and has resulted in public
repositories accidentally being changed to private (losing important
goodies like stars and linked forks).
Discussion on this is ongoing and there will likely be other
improvements in the near future to protect users against this.
Signed-off-by: Hidde Beydals <hello@hidde.co>
Using the `--commit-message-appendix` flag a string can be added to the
commit messages made by the bootstrapper process to for example skip CI
actions from executing using e.g. `[skip ci]`.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This command makes it possible to bootstrap to a generic Git server
using the local SSH agent, or a given password or private key file.
If a private key is generated, the user is prompted to give the
generated key access to the repository.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This includes making a lot of things configurable (e.g. SSH key
algorithm, RSA bit size, etc.) that used to be static.
Signed-off-by: Hidde Beydals <hello@hidde.co>
- change links in cli docs to be relative (making mkdocs AND hugo happy)
- run 'make docs'
- fix other links
Signed-off-by: Daniel Holbach <daniel@weave.works>
This commit adds support for supplying a path to an existing private
key file to both the `flux create secret git` and `flux create source
git` commands.
If a path is given, any private key generation configuration options
are ignored by the manifest generator. The SSH host will however still
be scanned for server keys.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This commit moves the `StatusChecker` to a separate package, while
making it more generic so that it is able to assess the status of any
given set of `object.ObjMetadata` identifiers.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This commit changes the way the build of manifests is triggered by
making smarter use of the capabilities of Make. The result should be
that the manifests are only regenerated if:
1. There is no `cmd/flux/manifests/` directory.
2. There have been made changes to the YAML files in the `manifests/`
directory that are newer than the files in `cmd/flux/manifests/`.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This was removed by accident in the PR that introduced the new
`manifestgen` packages, and now restored in full glory.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This fixes a bug on Windows where the safe relative path would contain
'\' slashes, which are not compatible with the controller.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This is the first release that includes a patch of the
`CachingClusterReader` so that it continues on all list errors.
Signed-off-by: Hidde Beydals <hello@hidde.co>
- add make target for generating the install manifests using kustomize
- embed the generated manifests in flux binary
- the install and bootstrap commands default to using the embedded manifests
- download the install manifests from GitHub only if the install/bootstrap version arg is set
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This ensures the advertised version from e.g. GKE or EKS (for example
`v1.17.15-gke.800`) do not trigger a false warning.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This prints a warning if the user has internet access and is running
an older version of the binary.
It also replaces the `blang/semver` package with `pkg/version` and
`Masterminds/semver` to align with controller dependencies.
Signed-off-by: Hidde Beydals <hello@hidde.co>
- deletes Flux components (deployments and services)
- deletes Flux RBAC (service accounts, cluster roles and cluster role bindings)
- removes the Kubernetes finalizers from Flux custom resources
- deletes Flux custom resource definitions and custom resources
- deletes the namespace where Flux was installed
- preserves the Kubernetes objects and Helm releases that were reconciled on the cluster by Flux
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
- add singular alias to get commands
- allow filtering the get commands result by resource name
- add the image commands to mkdocs index
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
ImageRepository objects can now refer to a secret containing
certificates to use for TLS. This adds the flag
flux create image repository --cert-secret-ref
for naming a secret to use. You can create such a secret with
flux create secret tls
Signed-off-by: Michael Bridgen <michael@weave.works>
This fixes a bug where the wrong type was displayed for various
`get source` commands.
```console
$ flux get sources helm --namespace default
✗ no Bucket objects found in default namespace
```
Signed-off-by: Hidde Beydals <hello@hidde.co>
The image-reflector controller now accepts a secret containing a
client certificate and key, and/or a CA certificate; so it's useful to
have a command for creating them.
`flux create secret helm` is close, but accepts username/password
(which would be ignored), and has the wrong name of course. Happily
though, much can be shared between the implementations.
Signed-off-by: Michael Bridgen <michael@weave.works>
* Use `LocalObjectReference` and `NamespacedObjectKindReference`
from `meta` package, as required by controller API changes.
* Remove `Update` field from created `ImageUpdateAutomation`,
as the API changed and the default is now defined in the Custom
Resource Definition.
Signed-off-by: Hidde Beydals <hello@hidde.co>
This commit deprecates the architecture flag (`--arch`) for the install
and bootstrap commands, in favor of the bundled multi-arch images that
will be available for the next MINOR range of GOTK controller releases.
Summary of changes:
* `*Arch` variables have been marked as deprecated for both commands.
* `-arm64` suffix is no longer selectively added to the image definition
of a component's `Deployment`.
* `kubernetes.io/arch` node selector with the defined value has been
removed from the components' `Deployment`s.
* `Arch` has been removed from the available `Options` in
`manifestgen/install`.
* Documentation references have been changed to highlight existence
of multi-arch images and supported architectures.
Signed-off-by: Hidde Beydals <hello@hidde.co>
controller-runtime methods now accept `client.Object` and
`client.ObjectList` rather than `runtime.Object`. This means the
adapter interfaces need to change signature, but happily, little else.
Since the list adapter is now distinct to the object adapter, `len()`
can go there instead of the command-specific interfaces.
Signed-off-by: Michael Bridgen <michael@weave.works>
This commit adds multiple safe guards for relative paths, ensuring they
never traverse outside the working directory.
The `SafeRelativePath` flag calculates the safe relative path based on a
relative base dir, which results in a flattened path.
The write methods of `manifestgen` make use of the `SecureJoin` as well,
to ensure writes are never outside of the given directory when used as
a lib outside of the CLI.
Signed-off-by: Hidde Beydals <hello@hidde.co>
It's a common pattern in the create commands to construct a value,
then (if not exporting it) upsert it and wait for it to
reconcile. This commit factors `upsert`, which does the update/insert
bit, and `upsertAndWait`, which does the whole thing.
Since these output messages, they are methods of `apiType` (previously
`names`), so that they have access to the name of the kind they are
operating on.
Signed-off-by: Michael Bridgen <michael@weave.works>
This means all the sub-subcommands can drop the `image-` prefix,
making them shorter and more fluent.
E.g.,
flux create image policy
rather than
flux create auto image-policy
Signed-off-by: Michael Bridgen <michael@weave.works>
Most commands use either a kind, or a more readable spelling of a
kind, in their output. To make this easier, this centralises the
definition of those names in one place, and lets the command
implementations choose whichever they need.
Signed-off-by: Michael Bridgen <michael@weave.works>
Since the generic commands tend to share a few of the methods they
need -- at least AsClientObject -- it's worth having just one wrapper
struct for each API type, and adding methods to it where necessary.
For the automation types, I put these in auto.go.
While doing this I also did some tidying:
- I changed the name of the wrappers to `<type>Adapter`, and the
generic adapter to `universalAdapter` (it's only needed for delete,
so far).
- I de-exported and renamed some interface methods e.g.,
`exportItem`. They aren't needed outside the package.
Signed-off-by: Michael Bridgen <michael@weave.works>
This uses the established abstractions to implement the usual
subcommands for the ImageUpdateAutomation type.
I've called the sub-subcommand in each case `image-update`, as a
fairly safe shorthand for the much longer `image-update-automation`.
Signed-off-by: Michael Bridgen <michael@weave.works>
This adds the create subcommand, without attempting any refactoring.
NB the TODO: the image/v1alpha1 API does not yet export a const for
the name of the kind. The field `RunInterval` will likely be changed
to `Interval` (with a value field), at some point, too.
Signed-off-by: Michael Bridgen <michael@weave.works>
The export command works the same way for most (all?) types. I have
made it generic and moved it into export.go, then ported
{export,create}_auto_image{repository,policy}.go to use it.
Signed-off-by: Michael Bridgen <michael@weave.works>
This adds a command for deleting ImagePolicy objects. Since the
control flow for the command needs only a runtime.Object (and a name
for the type), it can be factored out.
I have made the argument (field in the deleteCommand struct) an
interface `objectContainer`, through which the command code gets a
`runtime.Object` to deserialise into (and delete). It could be simply
a `runtime.Object` here; however things like `getCommand` require
other methods, so it's convenient to have an interface for it.
Signed-off-by: Michael Bridgen <michael@weave.works>
This factors the get command implementation so that the control flow
is generic and relies on a handful of methods, then uses that to add
`get auto image-policy` and to rewrite `get auto image-repository`.
Signed-off-by: Michael Bridgen <michael@weave.works>
This adds all the standard subcommands for the ImageRepository type.
Following `source`, I have put them under a namespace: `auto`,
referring to automation.
NB For `create` I use controllerutil.CreateOrUpdate, which looks to me
like a slightly more rounded version of the upsert* funcs.
Signed-off-by: Michael Bridgen <michael@weave.works>
This commit adds a flag for supplying extra components to bootstrap
(and its subcommands), to match the one for `flux install`.
Since the bootstrapComponents global is used in a few places, I made
it a func and renamed the variable. For consistency, I also renamed
the var used in install.go.
Lastly, so that the flag sorts next to `--components`, I changed it to
`--components-extra` in both commands.
Signed-off-by: Michael Bridgen <michael@weave.works>
If you want to install the default set of controllers and the image-*
controllers, at present you have to list every single one of them.
An improvement on this is to let people specify what they want _in
addition_ to the default controllers. This commit adds an argument
`--extra-components` which appends to the (most likely, default value)
slice of `--components`.
Signed-off-by: Michael Bridgen <michael@weave.works>
This commit refactors the `printLogger` into a `stderrLogger` that
properly logs to `os.stderr` instead of `os.stdout`.
Signed-off-by: Hidde Beydals <hello@hidde.co>
