Add flag `--ca-crt-file` to `flux create secret git` to specify the path
to CA certificate. It takes precedence over `--ca-file` and uses the
key `ca.crt` in the generated Secret.
Signed-off-by: Sanskar Jaiswal <jaiswalsanskar078@gmail.com>
Add support for using `tls.key`, `tls.crt` and `ca.crt` keys while
generating a Secret, using the `--tls-key-file`, `--tls-crt-file` and
`--ca-crt-file` flags respectively.
Mark the flags `--key-file`, `--cert-file` and `--ca-file` as
deprecated.
Signed-off-by: Sanskar Jaiswal <jaiswalsanskar078@gmail.com>
If implemented users will be able to use a local kustomization file while
retrieving status from the live kustomization file.
Signed-off-by: Soule BA <soule@weave.works>
This change adds support for running `suspend/resume` on multiple
supported resources at the same time. This improves the user
experience by converting
```
flux suspend ks operator && \
flux suspend ks database && \
flux suspend ks app
```
to
```
flux suspend ks operator database app
```
This works for all types of resources (Kustomizations, Sources, etc.)
since it has been implemented at the `suspend.go` and `resume.go`
level.
When the `--wait` flag is passed to the `resume` command, then Flux
will wait for all resources in parallel within a goroutine each.
Each object is only processed once, even if user provided its name
more than once.
If suspension or resuming fails for one object, it is still carried
out for the remaining objects.
As a special case, the old behaviour of `resume` is retained, i.e.
when only one object name is provided, `resume` waits for the object
to become ready even if the `--wait` flag is not provided. In all
other cases the `--wait` flag is always considered.
closes#3746closes#3793
Co-Authored-By: Max Jonas Werner <mail@makk.es>
Signed-off-by: Rishikesh Nair <alienware505@gmail.com>
Signed-off-by: Max Jonas Werner <mail@makk.es>
Whenever an API type is not available then both, `flux get all` and
`flux get image all` will just skip over that type instead of logging
an error message.
Before:
```
$ flux get all
✗ failed to get API group resources: unable to retrieve the complete
list of server APIs: source.toolkit.fluxcd.io/v1beta2: the server
could not find the requested resource
[...]
✗ failed to get API group resources: unable to retrieve the complete
list of server APIs: image.toolkit.fluxcd.io/v1beta2: the server could
not find the requested resource
✗ failed to get API group resources: unable to retrieve the complete
list of server APIs: image.toolkit.fluxcd.io/v1beta2: the server could
not find the requested resource
[...]
$ echo $?
0
```
After:
```
$ flux get all
$ echo $?
0
```
closes#3973
Signed-off-by: Max Jonas Werner <mail@makk.es>
UX changes:
- Only print an error when a pod doesn't have a matching container
instead of exiting early.
- Return a non-zero status code when no pod is found at all.
Details:
In certain situations there might be 3rd-party pods running in the
Flux namespace that cause the command to fail streaming logs, e.g.
when they have multiple containers but none of them is called
`manager` (which all Flux-maintained pods do). An example of such a
situation is when Flux is installed with the 3rd-party Flux extension
on AKS.
The `logs` command is now more forgiving and merely logs an error in
these situations instead of completely bailing out. It still returns a
non-zero exit code.
For the parallel log streaming with `-f` the code is now a little more
complex so that errors are now written to stderr in parallel with all
other logs written to stdout. That's what `asyncCopy` is for.
refs #3944
Signed-off-by: Max Jonas Werner <mail@makk.es>
This is required because controller-runtime expects its consumers to
set a logger through log.SetLogger within 30 seconds of the program's
initalization. If not set, the entire debug stack is printed as an
error. Ref: https://github.com/kubernetes-sigs/controller-runtime/blob/ed8be90/pkg/log/log.go#L59
Since we have our own logging and don't care about controller-runtime's
logger, we configure it's logger to do nothing.
Signed-off-by: Sanskar Jaiswal <jaiswalsanskar078@gmail.com>
- When there's an error stat'ing the output directory flux now prints
the error:
Before:
```
✗ invalid output path ./ro-dir/foo
```
After:
```
✗ invalid output path "./ro-dir/foo": stat ./ro-dir/foo: permission denied
```
- When no output directory is provided flux now explicitly says so in
the error:
Before:
```
✗ invalid output path
```
After:
```
✗ output path cannot be empty
```
Signed-off-by: Max Jonas Werner <mail@makk.es>
If implemented, user will be able to ignore files when using `build
kustomization` and `diff kustomization` both with .sourceignore and
`ignore-paths` flag.
Signed-off-by: Soule BA <bah.soule@gmail.com>
This change set implements support for the `--deploy-token-auth` option
in the `flux bootstrap gitlab` command.
That option will reconcile a GitLab Project Deploy Token to use for the
authentication of the GitLab git repository.
A GitLab Project Deploy Token can be used the same way as a Personal
Access Token which is already supported via `--token-auth`.
The difference with the GitLab Project Deploy Token is that the token is
managed (created, updated, deleted) by Flux and not provided by the
user.
This change is transparent to the source-controller.
A prerequisite for this change is the
`fluxcd/go-git-providers` change here:
* https://github.com/fluxcd/go-git-providers/pull/191
See related discussion here: https://github.com/fluxcd/flux2/discussions/3595
GitLab Issue here: https://gitlab.com/gitlab-org/gitlab/-/issues/392605
Signed-off-by: Timo Furrer <tuxtimo@gmail.com>
This adds a command to Flux which behaves similarly as `kubectl events`,
including the Flux sources events when showing events for top level
objects, thus making debugging easy for Flux users.
For example, `flux events --for kustomization/<name>` includes the
events of its source (e.g. a `GitRepository`, `OCIRepository` or
`Bucket`).
In addition, `flux events --for helmrelease/<name>` includes events of
the `HelmChart` and `HelmRepository`. While `flux events --for
alerts/<name>` includes the events of the `Provider`.
Signed-off-by: Somtochi Onyekwere <somtochionyekwere@gmail.com>
This is a backwards compatible change in terms of "YAML API", as they
spec still equals the previous one. Object type has just changed.
Signed-off-by: Hidde Beydals <hidde@hhh.computer>
The `\b` in the regular expression ensures we only match with a
hexadecimal notation as awhole, while still allowing to match with
e.g. `sha1:...` which would not have been possible by using `\W`
as this includes `_`.
Signed-off-by: Hidde Beydals <hello@hidde.co>
As the other version has a different signature, but exists for a
different build tag. Resulting in my IDE becoming absolutely confused
when I tried to enable both at the same time. Opted for "exec" because
this one shells out.
Signed-off-by: Hidde Beydals <hello@hidde.co>
As otherwise the `.golden` values can not be automatically updated using
`-update` as documented in `CONTRIBUTING.md`.
Also ensure we do not use `defer` but rather `t.Cleanup` in tests, as
this will always be called even if e.g. `t.Fatal` absruptly stops the
test.
Signed-off-by: Hidde Beydals <hello@hidde.co>
Before:
```
$ flux get source git -A
✗ no GitRepository objects found in flux-system namespace
```
After:
```
$ flux get source git -A
✗ no GitRepository objects found in any namespace
```
Signed-off-by: Max Jonas Werner <max@e13.dev>
If this is implemented, it will not assume that access to a kubeconfig
is guaranteed even if just for retrieving configured namespace.
Signed-off-by: Soule BA <soule@weave.works>
Use default known_hosts and ssh configuration when no private key file
is provided while bootstraping using ssh.
Signed-off-by: Sanskar Jaiswal <jaiswalsanskar078@gmail.com>
If you're using an HTTP-based Git server with Flux, you need to provide `--token-auth` to avoid triggering an SSH host key check (see [here](https://github.com/fluxcd/flux2/issues/2825#issuecomment-1151355914)). Unfortunately, doing this forces the URL in the `GitRepository` resource created during bootstrapping to always use `https`. This will cause Kustomization reconcile errors for servers that do not have HTTPS enabled or do not have the appropriate certs installed or available.
This pull request fixes this by keeping the repository URL scheme intact when using `--token-auth`.
Signed-off-by: Carlos Nunez <75340335+carlosonunez-vmw@users.noreply.github.com>
I've noticed during CI, that the current command
already expected a configured Docker client to
push artifacts to authenticated registries.
Some users might not want to have the Docker client
in their process (like a CI job) or build an handcrafted
config.json file.
This would allow this kind of behavior:
```
flux push artifact oci://my-registry.dev/foo:v1 \
--source xxx \
--revision xxx \
--path . \
--creds $TOKEN # Authenticate via "Bearer $TOKEN" Authorization header
```
Or via Autologin:
```
flux push artifact oci://012345678901.dkr.ecr.us-east-1.amazonaws.com/foo:v1 \
--source xxx \
--revision xxx \
--path . \
--provider aws
```
This has been implemented for:
* flux push artifact
* flux list artifact
* flux tag artifact
* flux pull artifact
This will require another PR in https://github.com/fluxcd/pkg/pull/352
Signed-off-by: Adrien Fillon <adrien.fillon@manomano.com>
* Added support for OCIRepositories to `flux trace`
* Changed indentation to compensate new, longer field name "Source
Revision"
* Added unit tests for the new output
closes#2970
Signed-off-by: Max Jonas Werner <max@e13.dev>
Implement build, push, pull and tag artifact commands.
For authentication purposes, all `flux <verb> artifact` commands are using the '~/.docker/config.json' config file and the Docker credential helpers.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This sets the container to `manager` which is used by all Flux
controllers as the container name.
The other options I thought about were selecting the first, or doing
something with image detection. But both can be sensitive to either
users adding their patch as a first entry, or e.g. mirroring the image
to a different name.
Signed-off-by: Hidde Beydals <hello@hidde.co>
Allow specifying the name of the Kubernetes Secret that contains a key with the kubeconfig file for connecting to a remote cluster.
Signed-off-by: Stefan Prodan <stefan.prodan@gmail.com>
This change will allow user to bootstrap with http git urls
But user must explicitely set --allow-insecure-http=true
Signed-off-by: Vipul Newaskar <vipulnewaskar7@gmail.com>
A new --ignore-paths flag is added to following commands:
flux create source git --ignore-paths ...
flux create source bucket --ignore-paths ...
A StringSliceVar is used which supports specifying the flag multiple
times to populate a list or either a comma seperated string value
A unit test with a golden file is added to validate the flag
Signed-off-by: Tarun Gupta Akirala <takirala@users.noreply.github.com>
The output of `kubectl version` has changed with newer kubectl version
from
```
{
"serverVersion": ...,
"clientVersion": ...
}
```
to
```
{
"serverVersion": ...,
"clientVersion": ...,
"kustomizeVersion": ...
}
```
So the `kustomizeVersion` field is new which causes the JSON
unmarshaling to fail.
We now just unmarshal it to `map[string]interface{}` and peel the
server git version out of that map manually w/o unmarshalling the JSON
into a custom type.
Signed-off-by: Max Jonas Werner <mail@makk.es>
If implemented this fixes a bug where retrieving the groupVersion.Group
of a kustomization were returning an empty string.
Signed-off-by: Soule BA <soule@weave.works>
This ensures the command will wait for the object to report a Ready
Condition with an ObservedGeneration matching the Generation of the
resource. Ensuring that when a "create" is actually a mutation, it waits
instead of prematurely assuming the Source to be Ready.
Signed-off-by: Hidde Beydals <hello@hidde.co>
The creation of oldConditions, statusableConditions and
reconcilableConditions is an adhoc solution to deal with the upstream
changes on `pkg/apis/meta`, which are yet to be replicated across other
Flux API components.
Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>
If implemented, there will a common interface to print flux resource.
We are adding new way to print resource information e.g. diff of
objects.
Signed-off-by: Soule BA <soule@weave.works>
Add a template values check in the `assertGoldenTemplateFile()` function
to only update golden files if they aren't templates. A note is printed
when an update to a template golden file is needed and `-update` flag
can't update it.
Signed-off-by: Sunny <darkowlzz@protonmail.com>
Message content could be long compared to other fields. Moving it to
the end helps improve the visibility of the other fields.
Signed-off-by: Sunny <darkowlzz@protonmail.com>
This commit migrate to the last version of pkg/ssa v0.14.1 that contains a fix
for stringData secrets. The test case was changed accordingly to
validate a stringData drift.
A progress-bar flag option has also been added in order to be able to
disable it.
Signed-off-by: Soule BA <soule@weave.works>
The TestTrace/Deployment and TestTrace/HelmRelease test cases fail in
environments where the timezone isn't UTC, because they compare a local time
string to the golden file, which has time in UTC. Here is an example:
```
--- FAIL: TestTrace (0.12s)
--- FAIL: TestTrace/Deployment (0.08s)
main_test.go:337: Mismatch from golden file 'testdata/trace/deployment.golden': Mismatch from expected value (-want +got):
strings.Join({
... // 88 identical bytes
" Flux\n---\nHelmRelease: podinfo\nNamespace: podinfo-8\nRevi",
"sion: 6.0.0\nStatus: Last reconciled at 2021-07-16 ",
- "15:42:20 +0000 UTC",
+ "09:42:20 -0600 MDT",
"\nMessage: Release reconciliation succeeded\n---\nHelmChart:",
" podinfo-podinfo\nNamespace: flux-system-9\nChart: ",
" podinfo\nVersion: 6.0.0\nRevision: 6.0.0\nStatus: ",
" Last reconciled at 2021-07-16 ",
- "15:32:09 +0000 UTC",
+ "09:32:09 -0600 MDT",
"\nMessage: Fetched revision: 6.0.0\n---\nHelmRepository: pod",
"info\nNamespace: flux-system-9\nURL: https://stefa",
"nprodan.github.io/podinfo\nRevision: 8411f23d07d3701f0e96e7",
"d9e503b7936d7e1d56\nStatus: Last reconciled at 2021-07-",
- "1",
"1",
- " 00:25:46 +0000 UTC",
+ "0 18:25:46 -0600 MDT",
"\nMessage: Fetched revision: 8411f23d07d3701f0e96e7d9e503b",
"7936d7e1d56\n",
}, "")
```
This commit fixes the issue by converting the golden test times to local
time before comparing. The utility function toLocalTime() is added to
trace_test.go, and then it is used to provide localized times as
template parameters to the golden files.
Signed-off-by: Andrew Jenkins <andrew@aspenmesh.io>
If implemented, flux diff kustomization will managed correctly sops
managed dockerconfigjson secrets.
Sops encrypted secret with stringData maps are supported too.
Signed-off-by: Soule BA <soule@weave.works>
If implemented, calling the diff command on kustomization will return 0,
1(if changes are identified), >1 for errors.
Signed-off-by: Soule BA <soule@weave.works>
If implemented it will permit queriying the Kubernetes API to fetch the specified
Flux Kustomization, then uses the specified path to build the overlay.
It will then ssa-dry-run apply and output the diff using homeport/dyff
Signed-off-by: Soule BA <soule@weave.works>
If implemented it will permit queriying the Kubernetes API to fetch the specified
Flux Kustomization, then uses the specified path to build
the overlay.
Signed-off-by: Soule BA <soule@weave.works>
It now accepts arguments in the forms <resource>/<name>
and <resource> <name> instead of requiring api version and
kind as flags.
Signed-off-by: Jakob Schrettenbrunner <jakob.schrettenbrunner@telekom.de>
Remove the overwrite of the repositoryURL.Host variable to include Git
servers deployed on non-standard https ports
Co-authored-by: Sebastián Vargas <develolux@gmail.com>
Signed-off-by: Alby Hernández <me@achetronic.com>
Signed-off-by: Alby Hernández <alby.hernandez@system73.com>
This fixes a styling issue:
```
$ flux --help
Command line utility for assembling Kubernetes CD pipelines the GitOps
way.
Usage:
flux [command]
...
Available Commands:
...
suspend Suspend resources
trace trace an in-cluster object throughout the GitOps delivery
pipeline
uninstall Uninstall Flux and its custom resource definitions
...
```
Signed-off-by: Hidde Beydals <hello@hidde.co>
The new command set is:
flux bootstrap bitbucket-server --owner=<project> --username=<user> --repository=<repository name> --hostname=<domain> --token-auth
There is a parity in the capabilities with the other providers.
Signed-off-by: Soule BA <soule@weave.works>
bufio's reader.ReadString includes any CRLF characters and we don't
want these in the resulting token because this leads to errors in the
authentication like this:
```
✗ failed to get Git repository
"https://github.com/kingdon-ci/jenkins-infra": Get
"https://api.github.com/repos/kingdon-ci/jenkins-infra": net/http:
invalid header field value "Bearer gho_NNNNNsecrettokenMMMMM\n" for
key Authorization
```
Signed-off-by: Max Jonas Werner <mail@makk.es>
This change adds functionality to both, `bootstrap github` and
`bootstrap gitlab` to prompt the user for the personal access tokens
if those can't be derived from the shell environment. Echoing is
turned off for better privacy.
Instead of having to interactively type the token or manually paste it
from the clipboard, users can also pipe it to Flux which comes in
handy e.g. when executing Flux remotely over an SSH connection:
```
$ echo 'asdf' | flux bootstrap github
```
Otherwise, Flux will prompt the user:
```
$ flux bootstrap github
Please type your GitHub personal access token:
```
closes#2011
Signed-off-by: Max Jonas Werner <mail@makk.es>
