From 1cd903e9f8ff92149e70a3eeedc8b24770121ac7 Mon Sep 17 00:00:00 2001 From: Liam Mackie Date: Wed, 26 Aug 2026 15:34:29 +1000 Subject: [PATCH 1/7] initial --- README.md | 2 + cmd/octopus/main.go | 4 +- examples.md | 89 +++ go.mod | 106 ++- go.sum | 389 ++++++++++- pkg/apiclient/client_factory.go | 38 +- pkg/apiclient/remember_space_test.go | 108 +++ pkg/cmd/kubernetes/gateway/gateway.go | 26 + .../kubernetes/gateway/install/argosetup.go | 247 +++++++ pkg/cmd/kubernetes/gateway/install/commit.go | 384 +++++++++++ pkg/cmd/kubernetes/gateway/install/install.go | 640 ++++++++++++++++++ .../gateway/install/install_test.go | 569 ++++++++++++++++ pkg/cmd/kubernetes/gateway/install/prompt.go | 428 ++++++++++++ pkg/cmd/kubernetes/gateway/install/review.go | 403 +++++++++++ .../kubernetes/gateway/install/review_test.go | 211 ++++++ .../kubernetes/gateway/install/signin_test.go | 117 ++++ .../kubernetes/gateway/rotatetoken/rotate.go | 459 +++++++++++++ pkg/cmd/kubernetes/install/install.go | 73 ++ pkg/cmd/kubernetes/kubernetes.go | 31 + pkg/cmd/root/root.go | 2 + pkg/kubernetes/argocd/account.go | 331 +++++++++ pkg/kubernetes/argocd/account_test.go | 287 ++++++++ pkg/kubernetes/argocd/bootstrap.go | 224 ++++++ pkg/kubernetes/argocd/bootstrap_test.go | 205 ++++++ pkg/kubernetes/argocd/discover.go | 462 +++++++++++++ pkg/kubernetes/argocd/discover_test.go | 376 ++++++++++ pkg/kubernetes/argocd/eks.go | 284 ++++++++ pkg/kubernetes/argocd/eks_internal_test.go | 104 +++ pkg/kubernetes/argocd/eks_test.go | 104 +++ pkg/kubernetes/argocd/projects.go | 273 ++++++++ pkg/kubernetes/argocd/projects_test.go | 193 ++++++ pkg/kubernetes/argocd/token.go | 366 ++++++++++ pkg/kubernetes/cluster.go | 314 +++++++++ pkg/kubernetes/flags.go | 103 +++ pkg/kubernetes/helm/runner.go | 297 ++++++++ pkg/kubernetes/helm/runner_internal_test.go | 37 + pkg/kubernetes/kubeconfig.go | 167 +++++ pkg/kubernetes/kubeconfig_test.go | 123 ++++ pkg/kubernetes/naming.go | 66 ++ pkg/kubernetes/naming_test.go | 96 +++ pkg/kubernetes/octopus.go | 25 + pkg/kubernetes/octopus_test.go | 30 + pkg/kubernetes/preflight.go | 325 +++++++++ pkg/kubernetes/preflight_test.go | 48 ++ pkg/surveyext/asker.go | 39 ++ pkg/surveyext/editor.go | 8 +- pkg/surveyext/pty_test.go | 156 +++++ pkg/surveyext/stdin.go | 233 +++++++ pkg/surveyext/stdin_test.go | 177 +++++ 49 files changed, 9744 insertions(+), 35 deletions(-) create mode 100644 pkg/apiclient/remember_space_test.go create mode 100644 pkg/cmd/kubernetes/gateway/gateway.go create mode 100644 pkg/cmd/kubernetes/gateway/install/argosetup.go create mode 100644 pkg/cmd/kubernetes/gateway/install/commit.go create mode 100644 pkg/cmd/kubernetes/gateway/install/install.go create mode 100644 pkg/cmd/kubernetes/gateway/install/install_test.go create mode 100644 pkg/cmd/kubernetes/gateway/install/prompt.go create mode 100644 pkg/cmd/kubernetes/gateway/install/review.go create mode 100644 pkg/cmd/kubernetes/gateway/install/review_test.go create mode 100644 pkg/cmd/kubernetes/gateway/install/signin_test.go create mode 100644 pkg/cmd/kubernetes/gateway/rotatetoken/rotate.go create mode 100644 pkg/cmd/kubernetes/install/install.go create mode 100644 pkg/cmd/kubernetes/kubernetes.go create mode 100644 pkg/kubernetes/argocd/account.go create mode 100644 pkg/kubernetes/argocd/account_test.go create mode 100644 pkg/kubernetes/argocd/bootstrap.go create mode 100644 pkg/kubernetes/argocd/bootstrap_test.go create mode 100644 pkg/kubernetes/argocd/discover.go create mode 100644 pkg/kubernetes/argocd/discover_test.go create mode 100644 pkg/kubernetes/argocd/eks.go create mode 100644 pkg/kubernetes/argocd/eks_internal_test.go create mode 100644 pkg/kubernetes/argocd/eks_test.go create mode 100644 pkg/kubernetes/argocd/projects.go create mode 100644 pkg/kubernetes/argocd/projects_test.go create mode 100644 pkg/kubernetes/argocd/token.go create mode 100644 pkg/kubernetes/cluster.go create mode 100644 pkg/kubernetes/flags.go create mode 100644 pkg/kubernetes/helm/runner.go create mode 100644 pkg/kubernetes/helm/runner_internal_test.go create mode 100644 pkg/kubernetes/kubeconfig.go create mode 100644 pkg/kubernetes/kubeconfig_test.go create mode 100644 pkg/kubernetes/naming.go create mode 100644 pkg/kubernetes/naming_test.go create mode 100644 pkg/kubernetes/octopus.go create mode 100644 pkg/kubernetes/octopus_test.go create mode 100644 pkg/kubernetes/preflight.go create mode 100644 pkg/kubernetes/preflight_test.go create mode 100644 pkg/surveyext/asker.go create mode 100644 pkg/surveyext/pty_test.go create mode 100644 pkg/surveyext/stdin.go create mode 100644 pkg/surveyext/stdin_test.go diff --git a/README.md b/README.md index 032e84c3..03932a9a 100644 --- a/README.md +++ b/README.md @@ -280,11 +280,13 @@ pkg/ cmd/ # contains sub-packages for each cobra command account/ # contains commands related to accounts environment/ # contains commands related to environments + kubernetes/ # contains commands that install Octopus components into Kubernetes clusters ... # more commands constants/ # constant values to avoid duplicated strings, ints, etc errors/ # internal error objects executor/ # See 'architecture' below factory/ # "service locator" object used by commands to locate shared services + kubernetes/ # cluster discovery, connectivity preflight, and Helm, used by the kubernetes commands output/ # internal utilities which help formatting output question/ # See 'architecture' below diff --git a/cmd/octopus/main.go b/cmd/octopus/main.go index 24c133d3..189f82d4 100644 --- a/cmd/octopus/main.go +++ b/cmd/octopus/main.go @@ -15,10 +15,10 @@ import ( "github.com/briandowns/spinner" "github.com/spf13/viper" - "github.com/AlecAivazis/survey/v2" "github.com/OctopusDeploy/cli/pkg/config" "github.com/OctopusDeploy/cli/pkg/factory" "github.com/OctopusDeploy/cli/pkg/question" + "github.com/OctopusDeploy/cli/pkg/surveyext" "github.com/OctopusDeploy/cli/pkg/usage" "github.com/joho/godotenv" @@ -41,7 +41,7 @@ func main() { // initialize our wrapper around survey, which is also used as a flag for whether // we are in interactive mode or automation mode - askProvider := question.NewAskProvider(survey.AskOne) + askProvider := question.NewAskProvider(surveyext.AskOne) _, ci := os.LookupEnv("CI") // TODO move this to some other function and have it look for GITHUB_ACTIONS etc as we learn more about it if ci { diff --git a/examples.md b/examples.md index 78e9594e..2ac517ec 100644 --- a/examples.md +++ b/examples.md @@ -187,3 +187,92 @@ fi octopus project variables update BlueGreenTarget --project "Random Quotes" --id d8527596-6fa2-4394-94e1-07942d3d0202 --name "" --value $value --no-prompt octopus release create --version 1.0.1 --project "Random Quotes" --no-prompt ``` + +# Install the Octopus Argo CD gateway + +The gateway connects an Argo CD instance to Octopus. Run it with no arguments and the CLI reads +what it can from your cluster and from Octopus, asking only for the things it cannot work out: + +``` +octopus kubernetes gateway install +``` + +It discovers which namespace Argo CD is in, its in-cluster address, and whether it is serving +TLS; derives the install namespace and Helm release name from the name you give it; and takes +the Octopus server, space, and credentials from your existing login. + +# Preview an Argo CD gateway install without changing anything + +``` +octopus kubernetes gateway install --name production --environment Production --dry-run +``` + +`--dry-run` renders the manifests Helm would apply and skips the connectivity checks that need +to run a pod. Add `-o values.yaml` to also write out the resolved Helm values. + +# Install the Argo CD gateway unattended + +``` +octopus kubernetes gateway install \ + --name production \ + --environment Production \ + --argocd-token "$ARGOCD_TOKEN" \ + --no-prompt +``` + +The Argo CD token and the Octopus credential are written to Kubernetes Secrets and referenced +from the chart, so neither appears in the Helm release values or in a file written by `-o`. +Pass `--inline-secrets` if you would rather have them in the values. + +# Let the CLI create the Argo CD account it needs + +Octopus authenticates to Argo CD as a dedicated account, which normally means editing +`argocd-cm` and `argocd-rbac-cm` by hand and then running `argocd account generate-token`. +`--configure-argocd-account` does all three: + +``` +octopus kubernetes gateway install \ + --name production \ + --environment Production \ + --configure-argocd-account \ + --no-prompt +``` + +Interactively, the CLI shows you exactly which ConfigMap entries it would add and asks before +applying them. Add `--allow-sync=false` if Octopus should only observe Argo CD applications +rather than sync them. + +# Install the Argo CD gateway against AWS managed Argo CD (EKS capability) + +The [EKS capability for Argo CD](https://octopus.com/docs/argo-cd/instances/aws-managed-argo-cd) +runs Argo CD in the AWS control plane rather than on your nodes, so there is nothing in the +cluster to discover. Point the CLI at an EKS context and it works this out for you: it reads the +cluster name and region from your kubeconfig, asks AWS for the Argo CD capability endpoint, and +switches on the settings that mode needs — gRPC-Web (AWS's load balancer does not support +HTTP/2) and full TLS verification (AWS uses a publicly trusted certificate). + +``` +octopus kubernetes gateway install --kube-context arn:aws:eks:ap-southeast-2:123456789012:cluster/my-cluster +``` + +AWS caps Argo CD account tokens at 12 hours, so managed instances authenticate with project role +tokens instead — one per Argo CD project. Interactively, the CLI lists the projects in your +cluster, offers to add the `octopus` role with the right policies to the ones you pick, and links +you to Argo CD to generate each token. AWS signs those tokens in its own control plane, so that +last step cannot be automated. + +Each token says which project it belongs to, so you only pass the token: + +``` +octopus kubernetes gateway install \ + --name eks-production \ + --environment Production \ + --argocd-server-grpc-url grpc://abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com \ + --argocd-project-token "$DEFAULT_TOKEN" \ + --argocd-project-token "$TEAM_A_TOKEN" \ + --no-prompt +``` + +Use the project name `octo-gateway-unscoped` for a token to fall back on for Argo CD calls that +are not project-scoped. If your Argo CD API is not served at the root, add +`--argocd-grpc-web-root-path /argo/api`. diff --git a/go.mod b/go.mod index 575c6de1..9182a759 100644 --- a/go.mod +++ b/go.mod @@ -9,6 +9,7 @@ require ( github.com/OctopusDeploy/go-octopusdeploy/v2 v2.117.0 github.com/bmatcuk/doublestar/v4 v4.10.0 github.com/briandowns/spinner v1.23.2 + github.com/creack/pty v1.1.18 github.com/google/uuid v1.6.0 github.com/hashicorp/go-multierror v1.1.1 github.com/joho/godotenv v1.5.1 @@ -20,41 +21,132 @@ require ( github.com/spf13/pflag v1.0.10 github.com/spf13/viper v1.21.0 github.com/stretchr/testify v1.11.1 - golang.org/x/exp v0.0.0-20230129154200-a960b3787bd2 + golang.org/x/crypto v0.54.0 + golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 golang.org/x/term v0.45.0 + helm.sh/helm/v4 v4.2.4 + k8s.io/api v0.36.1 + k8s.io/apimachinery v0.36.1 + k8s.io/client-go v0.36.1 + sigs.k8s.io/yaml v1.6.0 ) require ( + dario.cat/mergo v1.0.1 // indirect + github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect + github.com/BurntSushi/toml v1.6.0 // indirect + github.com/MakeNowJust/heredoc v1.0.0 // indirect + github.com/Masterminds/goutils v1.1.1 // indirect + github.com/Masterminds/semver/v3 v3.5.0 // indirect + github.com/Masterminds/sprig/v3 v3.3.0 // indirect + github.com/Masterminds/squirrel v1.5.4 // indirect + github.com/ProtonMail/go-crypto v1.4.1 // indirect + github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect + github.com/blang/semver/v4 v4.0.0 // indirect + github.com/chai2010/gettext-go v1.0.2 // indirect + github.com/cloudflare/circl v1.6.3 // indirect github.com/cpuguy83/go-md2man/v2 v2.0.6 // indirect - github.com/davecgh/go-spew v1.1.1 // indirect + github.com/cyphar/filepath-securejoin v0.6.1 // indirect + github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/dghubble/sling v1.4.1 // indirect - github.com/fatih/color v1.13.0 // indirect + github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a // indirect + github.com/emicklei/go-restful/v3 v3.13.0 // indirect + github.com/evanphx/json-patch/v5 v5.9.11 // indirect + github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect + github.com/extism/go-sdk v1.7.1 // indirect + github.com/fatih/color v1.19.0 // indirect + github.com/fluxcd/cli-utils v1.2.1 // indirect github.com/fsnotify/fsnotify v1.9.0 // indirect + github.com/fxamacker/cbor/v2 v2.9.0 // indirect github.com/gabriel-vasile/mimetype v1.4.8 // indirect + github.com/go-errors/errors v1.5.1 // indirect + github.com/go-gorp/gorp/v3 v3.1.0 // indirect + github.com/go-logr/logr v1.4.3 // indirect + github.com/go-openapi/jsonpointer v0.21.1 // indirect + github.com/go-openapi/jsonreference v0.21.0 // indirect + github.com/go-openapi/swag v0.23.1 // indirect github.com/go-playground/locales v0.14.1 // indirect github.com/go-playground/universal-translator v0.18.1 // indirect github.com/go-playground/validator/v10 v10.25.0 // indirect github.com/go-viper/mapstructure/v2 v2.4.0 // indirect + github.com/gobwas/glob v0.2.3 // indirect + github.com/gofrs/flock v0.13.0 // indirect + github.com/google/btree v1.1.3 // indirect + github.com/google/gnostic-models v0.7.0 // indirect github.com/google/go-querystring v1.1.0 // indirect + github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect + github.com/gosuri/uitable v0.0.4 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect + github.com/huandu/xstrings v1.5.0 // indirect + github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca // indirect github.com/inconshreveable/mousetrap v1.1.0 // indirect + github.com/jmoiron/sqlx v1.4.0 // indirect + github.com/josharian/intern v1.0.0 // indirect + github.com/json-iterator/go v1.1.12 // indirect + github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect + github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect github.com/leodido/go-urn v1.4.0 // indirect - github.com/mattn/go-colorable v0.1.13 // indirect - github.com/mattn/go-isatty v0.0.16 // indirect + github.com/lib/pq v1.12.3 // indirect + github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect + github.com/mailru/easyjson v0.9.0 // indirect + github.com/mattn/go-colorable v0.1.14 // indirect + github.com/mattn/go-isatty v0.0.20 // indirect github.com/mattn/go-runewidth v0.0.14 // indirect + github.com/mitchellh/copystructure v1.2.0 // indirect + github.com/mitchellh/go-wordwrap v1.0.1 // indirect + github.com/mitchellh/reflectwalk v1.0.2 // indirect + github.com/moby/spdystream v0.5.1 // indirect + github.com/moby/term v0.5.2 // indirect + github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect + github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect + github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect + github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect + github.com/opencontainers/go-digest v1.0.0 // indirect + github.com/opencontainers/image-spec v1.1.1 // indirect github.com/pelletier/go-toml/v2 v2.2.4 // indirect - github.com/pmezard/go-difflib v1.0.0 // indirect + github.com/peterbourgon/diskv v2.0.1+incompatible // indirect + github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect github.com/rivo/uniseg v0.4.3 // indirect + github.com/rubenv/sql-migrate v1.8.1 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/sagikazarmark/locafero v0.11.0 // indirect + github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect + github.com/shopspring/decimal v1.4.0 // indirect github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 // indirect github.com/spf13/afero v1.15.0 // indirect github.com/spf13/cast v1.10.0 // indirect github.com/subosito/gotenv v1.6.0 // indirect + github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 // indirect + github.com/tetratelabs/wazero v1.12.0 // indirect + github.com/x448/float16 v0.8.4 // indirect + github.com/xlab/treeprint v1.2.0 // indirect + go.opentelemetry.io/proto/otlp v1.10.0 // indirect + go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/crypto v0.54.0 // indirect golang.org/x/net v0.57.0 // indirect + golang.org/x/oauth2 v0.36.0 // indirect + golang.org/x/sync v0.22.0 // indirect golang.org/x/sys v0.47.0 // indirect golang.org/x/text v0.40.0 // indirect + golang.org/x/time v0.15.0 // indirect + google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect + gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect + gopkg.in/inf.v0 v0.9.1 // indirect gopkg.in/yaml.v3 v3.0.1 // indirect + k8s.io/apiextensions-apiserver v0.36.1 // indirect + k8s.io/apiserver v0.36.1 // indirect + k8s.io/cli-runtime v0.36.1 // indirect + k8s.io/component-base v0.36.1 // indirect + k8s.io/klog/v2 v2.140.0 // indirect + k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a // indirect + k8s.io/kubectl v0.36.1 // indirect + k8s.io/streaming v0.36.1 // indirect + k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 // indirect + oras.land/oras-go/v2 v2.6.1 // indirect + sigs.k8s.io/controller-runtime v0.24.1 // indirect + sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect + sigs.k8s.io/kustomize/api v0.21.1 // indirect + sigs.k8s.io/kustomize/kyaml v0.21.1 // indirect + sigs.k8s.io/randfill v1.0.0 // indirect + sigs.k8s.io/structured-merge-diff/v6 v6.3.2 // indirect ) diff --git a/go.sum b/go.sum index e204fba1..b5ecf4f3 100644 --- a/go.sum +++ b/go.sum @@ -1,34 +1,132 @@ +dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s= +dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk= +filippo.io/edwards25519 v1.1.0 h1:FNf4tywRC1HmFuKW5xopWpigGjJKiJSV0Cqo0cJWDaA= +filippo.io/edwards25519 v1.1.0/go.mod h1:BxyFTGdWcka3PhytdK4V28tE5sGfRvvvRV7EaN4VDT4= +github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 h1:bvDV9vkmnHYOMsOr4WLk+Vo07yKIzd94sVoIqshQ4bU= +github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8= github.com/AlecAivazis/survey/v2 v2.3.7 h1:6I/u8FvytdGsgonrYsVn2t8t4QiRnh6QSTqkkhIiSjQ= github.com/AlecAivazis/survey/v2 v2.3.7/go.mod h1:xUTIdE4KCOIjsBAE1JYsUPoCqYdZ1reCfTwbto0Fduo= +github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c h1:udKWzYgxTojEKWjV8V+WSxDXJ4NFATAsZjh8iIbsQIg= +github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E= +github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk= +github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho= +github.com/DATA-DOG/go-sqlmock v1.5.2 h1:OcvFkGmslmlZibjAjaHm3L//6LiuBgolP7OputlJIzU= +github.com/DATA-DOG/go-sqlmock v1.5.2/go.mod h1:88MAG/4G7SMwSE3CeA0ZKzrT5CiOU3OJ+JlNzwDqpNU= +github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ= +github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE= github.com/MakeNowJust/heredoc/v2 v2.0.1 h1:rlCHh70XXXv7toz95ajQWOWQnN4WNLt0TdpZYIR/J6A= github.com/MakeNowJust/heredoc/v2 v2.0.1/go.mod h1:6/2Abh5s+hc3g9nbWLe9ObDIOhaRrqsyY9MWy+4JdRM= +github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI= +github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU= +github.com/Masterminds/semver/v3 v3.5.0 h1:kQceYJfbupGfZOKZQg0kou0DgAKhzDg2NZPAwZ/2OOE= +github.com/Masterminds/semver/v3 v3.5.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +github.com/Masterminds/sprig/v3 v3.3.0 h1:mQh0Yrg1XPo6vjYXgtf5OtijNAKJRNcTdOOGZe3tPhs= +github.com/Masterminds/sprig/v3 v3.3.0/go.mod h1:Zy1iXRYNqNLUolqCpL4uhk6SHUMAOSCzdgBfDb35Lz0= +github.com/Masterminds/squirrel v1.5.4 h1:uUcX/aBc8O7Fg9kaISIUsHXdKuqehiXAMQTYX8afzqM= +github.com/Masterminds/squirrel v1.5.4/go.mod h1:NNaOrjSoIDfDA40n7sr2tPNZRfjzjA400rg+riTZj10= github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2 h1:+vx7roKuyA63nhn5WAunQHLTznkw5W8b1Xc0dNjp83s= github.com/Netflix/go-expect v0.0.0-20220104043353-73e0943537d2/go.mod h1:HBCaDeC1lPdgDeDbhX8XFpy1jqjK0IBG8W5K+xYqA0w= github.com/OctopusDeploy/go-octodiff v1.0.0 h1:U+ORg6azniwwYo+O44giOw6TiD5USk8S4VDhOQ0Ven0= github.com/OctopusDeploy/go-octodiff v1.0.0/go.mod h1:Mze0+EkOWTgTmi8++fyUc6r0aLZT7qD9gX+31t8MmIU= github.com/OctopusDeploy/go-octopusdeploy/v2 v2.117.0 h1:Sh668C2qqIgNUWEvD9bda5j5IvMLYEeqGUD39i9AC50= github.com/OctopusDeploy/go-octopusdeploy/v2 v2.117.0/go.mod h1:VkTXDoIPbwGFi5+goo1VSwFNdMVo784cVtJdKIEvfus= +github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM= +github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo= +github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio= +github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs= +github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 h1:DklsrG3dyBCFEj5IhUbnKptjxatkF07cF2ak3yi77so= +github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2/go.mod h1:WaHUgvxTVq04UNunO+XhnAqY/wQc+bxr74GqbsZ/Jqw= +github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM= +github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw= +github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM= +github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ= github.com/bmatcuk/doublestar/v4 v4.10.0 h1:zU9WiOla1YA122oLM6i4EXvGW62DvKZVxIe6TYWexEs= github.com/bmatcuk/doublestar/v4 v4.10.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/briandowns/spinner v1.23.2 h1:Zc6ecUnI+YzLmJniCfDNaMbW0Wid1d5+qcTq4L2FW8w= github.com/briandowns/spinner v1.23.2/go.mod h1:LaZeM4wm2Ywy6vO571mvhQNRcWfRUnXOs0RcKV0wYKM= +github.com/bshuster-repo/logrus-logstash-hook v1.1.0 h1:o2FzZifLg+z/DN1OFmzTWzZZx/roaqt8IPZCIVco8r4= +github.com/bshuster-repo/logrus-logstash-hook v1.1.0/go.mod h1:Q2aXOe7rNuPgbBtPCOzYyWDvKX7+FpxE5sRdvcPoui0= +github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM= +github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= +github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs= +github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs= +github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk= +github.com/chai2010/gettext-go v1.0.2/go.mod h1:y+wnP2cHYaVj19NZhYKAwEMH2CI1gNHeQQ+5AjwawxA= +github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg8= +github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= +github.com/coreos/go-systemd/v22 v22.7.0 h1:LAEzFkke61DFROc7zNLX/WA2i5J8gYqe0rSj9KI28KA= +github.com/coreos/go-systemd/v22 v22.7.0/go.mod h1:xNUYtjHu2EDXbsxz1i41wouACIwT7Ybq9o0BQhMwD0w= github.com/cpuguy83/go-md2man/v2 v2.0.6 h1:XJtiaUW6dEEqVuZiMTn1ldk455QWwEIsMIJlo5vtkx0= github.com/cpuguy83/go-md2man/v2 v2.0.6/go.mod h1:oOW0eioCTA6cOiMLiUPZOpcVxMig6NIQQ7OS05n1F4g= -github.com/creack/pty v1.1.17 h1:QeVUsEDNrLBW4tMgZHvxy18sKtr6VI492kBhUfhDJNI= github.com/creack/pty v1.1.17/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= +github.com/creack/pty v1.1.18 h1:n56/Zwd5o6whRC5PMGretI4IdRLlmBXYNjScPaBgsbY= +github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr4O4= +github.com/cyphar/filepath-securejoin v0.6.1 h1:5CeZ1jPXEiYt3+Z6zqprSAgSWiggmpVyciv8syjIpVE= +github.com/cyphar/filepath-securejoin v0.6.1/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc= github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM= +github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/dghubble/sling v1.4.1 h1:AxjTubpVyozMvbBCtXcsWEyGGgUZutC5YGrfxPNVOcQ= github.com/dghubble/sling v1.4.1/go.mod h1:QoMB1KL3GAo+7HsD8Itd6S+6tW91who8BGZzuLvpOyc= -github.com/fatih/color v1.13.0 h1:8LOYc1KYPPmyKMuN8QV2DNRWNbLo6LZ0iLs8+mlH53w= -github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk= +github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f h1:lO4WD4F/rVNCu3HqELle0jiPLLBs70cWOduZpkS1E78= +github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f/go.mod h1:cuUVRXasLTGF7a8hSLbxyZXjz+1KgoB3wDUb6vlszIc= +github.com/distribution/distribution/v3 v3.1.1 h1:KUbk7C8CfaLXy8kbf/hGq9cad/wCoLB6dbWH6DMbmX0= +github.com/distribution/distribution/v3 v3.1.1/go.mod h1:d7lXwZpph0bVcOj4Aqn0nMrWHIwRQGdiV5TLeI+/w6Y= +github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= +github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= +github.com/dlclark/regexp2 v1.11.0 h1:G/nrcoOa7ZXlpoa/91N3X7mM3r8eIlMBBJZvsz/mxKI= +github.com/dlclark/regexp2 v1.11.0/go.mod h1:DHkYz0B9wPfa6wondMfaivmHpzrQ3v9q8cnmRbL6yW8= +github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY= +github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c= +github.com/docker/go-events v0.0.0-20250808211157-605354379745 h1:yOn6Ze6IbYI/KAw2lw/83ELYvZh6hvsygTVkD0dzMC4= +github.com/docker/go-events v0.0.0-20250808211157-605354379745/go.mod h1:Uw6UezgYA44ePAFQYUehOuCzmy5zmg/+nl2ZfMWGkpA= +github.com/docker/go-metrics v0.0.1 h1:AgB/0SvBxihN0X8OR4SjsblXkbMvalQ8cjmtKQ2rQV8= +github.com/docker/go-metrics v0.0.1/go.mod h1:cG1hvH2utMXtqgqqYE9plW6lDxS3/5ayHzueweSI3Vw= +github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a h1:UwSIFv5g5lIvbGgtf3tVwC7Ky9rmMFBp0RMs+6f6YqE= +github.com/dylibso/observe-sdk/go v0.0.0-20240819160327-2d926c5d788a/go.mod h1:C8DzXehI4zAbrdlbtOByKX6pfivJTBiV9Jjqv56Yd9Q= +github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes= +github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc= +github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU= +github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM= +github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2Wvf/TIe2xdyJxTlb6obmF18d8QdkxNDu4= +github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc= +github.com/extism/go-sdk v1.7.1 h1:lWJos6uY+tRFdlIHR+SJjwFDApY7OypS/2nMhiVQ9Sw= +github.com/extism/go-sdk v1.7.1/go.mod h1:IT+Xdg5AZM9hVtpFUA+uZCJMge/hbvshl8bwzLtFyKA= +github.com/fatih/color v1.19.0 h1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w= +github.com/fatih/color v1.19.0/go.mod h1:zNk67I0ZUT1bEGsSGyCZYZNrHuTkJJB+r6Q9VuMi0LE= +github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg= +github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= +github.com/fluxcd/cli-utils v1.2.1 h1:ug9CicKW7H9QXnvNDapTSKuryZvWcu4Nw7pRvQa6jDY= +github.com/fluxcd/cli-utils v1.2.1/go.mod h1:cky6M6eHvTQkoPtsuFYLIgAMYdpTCSLoor4IA6vueSw= +github.com/foxcpp/go-mockdns v1.2.0 h1:omK3OrHRD1IWJz1FuFBCFquhXslXoF17OvBS6JPzZF0= +github.com/foxcpp/go-mockdns v1.2.0/go.mod h1:IhLeSFGed3mJIAXPH2aiRQB+kqz7oqu8ld2qVbOu7Wk= github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8= github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0= github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k= github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= +github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM= +github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ= github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM= github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8= +github.com/go-errors/errors v1.5.1 h1:ZwEMSLRCapFLflTpT7NKaAc7ukJ8ZPEjzlxt8rPN8bk= +github.com/go-errors/errors v1.5.1/go.mod h1:sIVyrIiJhuEF+Pj9Ebtd6P/rEYROXFi3BopGUQ5a5Og= +github.com/go-gorp/gorp/v3 v3.1.0 h1:ItKF/Vbuj31dmV4jxA1qblpSwkl9g1typ24xoe70IGs= +github.com/go-gorp/gorp/v3 v3.1.0/go.mod h1:dLEjIyyRNiXvNZ8PSmzpt1GsWAUK8kjVhEpjH8TixEw= +github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= +github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI= +github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY= +github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag= +github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE= +github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ= +github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg= +github.com/go-openapi/jsonpointer v0.21.1 h1:whnzv/pNXtK2FbX/W9yJfRmE2gsmkfahjMKB0fZvcic= +github.com/go-openapi/jsonpointer v0.21.1/go.mod h1:50I1STOfbY1ycR8jGz8DaMeLCdXiI6aDteEdRNNzpdk= +github.com/go-openapi/jsonreference v0.21.0 h1:Rs+Y7hSXT83Jacb7kFyjn4ijOuVGSvOdF2+tg1TRrwQ= +github.com/go-openapi/jsonreference v0.21.0/go.mod h1:LmZmgsrTkVg9LG4EaHeY8cBDslNPMo06cago5JNLkm4= +github.com/go-openapi/swag v0.23.1 h1:lpsStH0n2ittzTnbaSloVZLuB5+fvSY/+hnagBjSNZU= +github.com/go-openapi/swag v0.23.1/go.mod h1:STZs8TbRvEQQKUA+JZNAm3EWlgaOBGpyFDqQnDHMef0= github.com/go-playground/assert/v2 v2.2.0 h1:JvknZsQTYeFEAhQwI4qEt9cyV5ONwRHC+lYKSsYSR8s= github.com/go-playground/assert/v2 v2.2.0/go.mod h1:VDjEfimB/XKnb+ZQfWdccd7VUvScMdVu0Titje2rxJ4= github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/oXslEjJA= @@ -37,69 +135,181 @@ github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJn github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY= github.com/go-playground/validator/v10 v10.25.0 h1:5Dh7cjvzR7BRZadnsVOzPhWsrwUr0nmsZJxEAnFLNO8= github.com/go-playground/validator/v10 v10.25.0/go.mod h1:GGzBIJMuE98Ic/kJsBXbz1x/7cByt++cQ+YOuDM5wus= +github.com/go-sql-driver/mysql v1.8.1 h1:LedoTUt/eveggdHS9qUFC1EFSa8bU2+1pZjSRpvNJ1Y= +github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg= +github.com/go-task/slim-sprig/v3 v3.0.0 h1:sUs3vkvUymDpBKi3qH1YSqBQk9+9D/8M2mN1vB6EwHI= +github.com/go-task/slim-sprig/v3 v3.0.0/go.mod h1:W848ghGpv3Qj3dhTPRyJypKRiqCdHZiAzKg9hl15HA8= github.com/go-viper/mapstructure/v2 v2.4.0 h1:EBsztssimR/CONLSZZ04E8qAkxNYq4Qp9LvH92wZUgs= github.com/go-viper/mapstructure/v2 v2.4.0/go.mod h1:oJDH3BJKyqBA2TXFhDsKDGDTlndYOZ6rGS0BRZIxGhM= +github.com/gobwas/glob v0.2.3 h1:A4xDbljILXROh+kObIiy5kIaPYD8e96x1tgBhUI5J+Y= +github.com/gobwas/glob v0.2.3/go.mod h1:d3Ez4x06l9bZtSvzIay5+Yzi0fmZzPgnTbPcKjJAkT8= +github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw= +github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0= +github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg= +github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4= +github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo= +github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ= github.com/google/go-cmp v0.5.2/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI= -github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY= +github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= +github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8= github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU= +github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg= +github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc= +github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= +github.com/gorilla/handlers v1.5.2 h1:cLTUSsNkgcwhgRqvCNmdbRWG0A3N4F+M2nWKdScwyEE= +github.com/gorilla/handlers v1.5.2/go.mod h1:dX+xVpaxdSw+q0Qek8SSsl3dfMk3jNddUkMzo0GtH0w= +github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY= +github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ= +github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo= +github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA= +github.com/gosuri/uitable v0.0.4 h1:IG2xLKRvErL3uhY6e1BylFzG+aJiwQviDDTfOKeKTpY= +github.com/gosuri/uitable v0.0.4/go.mod h1:tKR86bXuXPZazfOTG1FIzvjIdXzd0mo4Vtn16vt0PJo= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz+PMpZ14Jynv3O2Zs= +github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c= github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I= github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4= github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo= github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM= +github.com/hashicorp/golang-lru/arc/v2 v2.0.5 h1:l2zaLDubNhW4XO3LnliVj0GXO3+/CGNJAg1dcN2Fpfw= +github.com/hashicorp/golang-lru/arc/v2 v2.0.5/go.mod h1:ny6zBSQZi2JxIeYcv7kt2sH2PXJtirBN7RDhRpxPkxU= +github.com/hashicorp/golang-lru/v2 v2.0.5 h1:wW7h1TG88eUIJ2i69gaE3uNVtEPIagzhGvHgwfx2Vm4= +github.com/hashicorp/golang-lru/v2 v2.0.5/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM= github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog= github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec/go.mod h1:Q48J4R4DvxnHolD5P8pOtXigYlRuPLGl6moFx3ulM68= +github.com/huandu/xstrings v1.5.0 h1:2ag3IFq9ZDANvthTwTiqSSZLjDc+BedvHPAp5tJy2TI= +github.com/huandu/xstrings v1.5.0/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE= +github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca h1:T54Ema1DU8ngI+aef9ZhAhNGQhcRTrWxVeG07F+c/Rw= +github.com/ianlancetaylor/demangle v0.0.0-20240805132620-81f5be970eca/go.mod h1:gx7rwoVhcfuVKG5uya9Hs3Sxj7EIvldVofAWIUtGouw= github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8= github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw= +github.com/jmoiron/sqlx v1.4.0 h1:1PLqN7S1UYp5t4SrVVnt4nUVNemrDAtxlulVe+Qgm3o= +github.com/jmoiron/sqlx v1.4.0/go.mod h1:ZrZ7UsYB/weZdl2Bxg6jCRO9c3YHl8r3ahlKmRT4JLY= github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0= github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4= +github.com/josharian/intern v1.0.0 h1:vlS4z54oSdjm0bgjRigI+G1HpF+tI+9rE5LLzOg8HmY= +github.com/josharian/intern v1.0.0/go.mod h1:5DoeVV0s6jJacbCEi61lwdGj/aVlrQvzHFFd8Hwg//Y= +github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM= +github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo= github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51 h1:Z9n2FFNUXsshfwJMBgNA0RU6/i7WVaAegv3PtuIHPMs= github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51/go.mod h1:CzGEWj7cYgsdH8dAjBGEr58BoE7ScuLd+fwFZ44+/x8= github.com/kinbiko/jsonassert v1.1.1 h1:DB12divY+YB+cVpHULLuKePSi6+ui4M/shHSzJISkSE= github.com/kinbiko/jsonassert v1.1.1/go.mod h1:NO4lzrogohtIdNUNzx8sdzB55M4R4Q1bsrWVdqQ7C+A= +github.com/klauspost/compress v1.18.4 h1:RPhnKRAQ4Fh8zU2FY/6ZFDwTVTxgJ/EMydqSTzE9a2c= +github.com/klauspost/compress v1.18.4/go.mod h1:R0h/fSBs8DE4ENlcrlib3PsXS61voFxhIs2DeRhCvJ4= github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE= github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk= github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY= github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE= +github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 h1:SOEGU9fKiNWd/HOJuq6+3iTQz8KNCLtVX6idSoTLdUw= +github.com/lann/builder v0.0.0-20180802200727-47ae307949d0/go.mod h1:dXGbAdH5GtBTC4WfIxhKZfyBF/HBFgRZSWwZ9g/He9o= +github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 h1:P6pPBnrTSX3DEVR4fDembhRWSsG5rVo6hYhAB/ADZrk= +github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0/go.mod h1:vmVJ0l/dxyfGW6FmdpVm2joNMFikkuWg0EoCKLGUMNw= github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ= github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI= +github.com/lib/pq v1.10.9/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o= +github.com/lib/pq v1.12.3 h1:tTWxr2YLKwIvK90ZXEw8GP7UFHtcbTtty8zsI+YjrfQ= +github.com/lib/pq v1.12.3/go.mod h1:/p+8NSbOcwzAEI7wiMXFlgydTwcgTr3OSKMsD2BitpA= +github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de h1:9TO3cAIGXtEhnIaL+V+BEER86oLrvS+kWobKpbJuye0= +github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de/go.mod h1:zAbeS9B/r2mtpb6U+EI2rYA5OAXxsYw6wTamcNW+zcE= +github.com/mailru/easyjson v0.9.0 h1:PrnmzHw7262yW8sTBwxi1PdJA3Iw/EKBa8psRf7d9a4= +github.com/mailru/easyjson v0.9.0/go.mod h1:1+xMtQp2MRNVL/V1bOzuP3aP8VNwRW55fQUto+XFtTU= github.com/mattn/go-colorable v0.1.2/go.mod h1:U0ppj6V5qS13XJ6of8GYAs25YV2eR4EVcfRqFIhoBtE= -github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc= -github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= -github.com/mattn/go-colorable v0.1.13/go.mod h1:7S9/ev0klgBDR4GtXTXX8a3vIGJpMovkB8vQcUbaXHg= +github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE= +github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8= github.com/mattn/go-isatty v0.0.8/go.mod h1:Iq45c/XA43vh69/j3iqttzPXn0bhXyGjM0Hdxcsrc5s= -github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU= -github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94= -github.com/mattn/go-isatty v0.0.16 h1:bq3VjFmv/sOjHtdEhmkEV4x1AJtvUvOJ2PFAZ5+peKQ= -github.com/mattn/go-isatty v0.0.16/go.mod h1:kYGgaQfpe5nmfYZH+SKPsOc2e4SrIfOl2e/yFXSvRLM= +github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY= +github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y= github.com/mattn/go-runewidth v0.0.12/go.mod h1:RAqKPSqVFrSLVXbA8x7dzmKdmGzieGRCM46jaSJTDAk= github.com/mattn/go-runewidth v0.0.14 h1:+xnbZSEeDbOIg5/mE6JF0w6n9duR1l3/WmbinWVwUuU= github.com/mattn/go-runewidth v0.0.14/go.mod h1:Jdepj2loyihRzMpdS35Xk/zdY8IAYHsh153qUoGf23w= +github.com/mattn/go-sqlite3 v1.14.22 h1:2gZY6PC6kBnID23Tichd1K+Z0oS6nE/XwU+Vz/5o4kU= +github.com/mattn/go-sqlite3 v1.14.22/go.mod h1:Uh1q+B4BYcTPb+yiD3kU8Ct7aC0hY9fxUwlHK0RXw+Y= github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d h1:5PJl274Y63IEHC+7izoQE9x6ikvDFZS2mDVS3drnohI= github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d/go.mod h1:01TrycV0kFyexm33Z7vhZRXopbI8J3TDReVlkTgMUxE= +github.com/miekg/dns v1.1.57 h1:Jzi7ApEIzwEPLHWRcafCN9LZSBbqQpxjt/wpgvg7wcM= +github.com/miekg/dns v1.1.57/go.mod h1:uqRjCRUuEAA6qsOiJvDd+CFo/vW+y5WR6SNmHE55hZk= +github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw= +github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s= +github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0= +github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0= +github.com/mitchellh/reflectwalk v1.0.2 h1:G2LzWKi524PWgd3mLHV8Y5k7s6XUvT0Gef6zxSIeXaQ= +github.com/mitchellh/reflectwalk v1.0.2/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw= +github.com/moby/spdystream v0.5.1 h1:9sNYeYZUcci9R6/w7KDaFWEWeV4LStVG78Mpyq/Zm/Y= +github.com/moby/spdystream v0.5.1/go.mod h1:xBAYlnt/ay+11ShkdFKNAG7LsyK/tmNBVvVOwrfMgdI= +github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= +github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc= +github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= +github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= +github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= +github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= +github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8= +github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= +github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 h1:n6/2gBQ3RWajuToeY6ZtZTIKv2v7ThUy5KKusIT0yc0= +github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00/go.mod h1:Pm3mSP3c5uWn86xMLZ5Sa7JB9GsEZySvHYXCTK4E9q4= github.com/muesli/reflow v0.3.0 h1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s= github.com/muesli/reflow v0.3.0/go.mod h1:pbwTDkVPibjO2kyvBQRBxTWEEGDGq0FlB1BIKtnHY/8= +github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA= +github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ= +github.com/onsi/ginkgo/v2 v2.28.1 h1:S4hj+HbZp40fNKuLUQOYLDgZLwNUVn19N3Atb98NCyI= +github.com/onsi/ginkgo/v2 v2.28.1/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE= +github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28= +github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg= +github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U= +github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM= +github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040= +github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M= github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4= github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY= +github.com/peterbourgon/diskv v2.0.1+incompatible h1:UBdAOUP5p4RWqPBg048CAvpKN+vxiaj6gdUUzhl4XmI= +github.com/peterbourgon/diskv v2.0.1+incompatible/go.mod h1:uqqh8zWWbv1HBMNONnaR/tNboyR3/BZd58JJSHlUSCU= github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8 h1:KoWmjvw+nsYOo29YJK9vDA65RGE3NrOnUtO7a+RF9HU= github.com/pkg/browser v0.0.0-20210911075715-681adbf594b8/go.mod h1:HKlIX3XHQyzLZPlr7++PzdhaXEj94dEiJgZDTsxEqUI= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U= +github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/poy/onpar v1.1.2 h1:QaNrNiZx0+Nar5dLgTVp5mXkyoVFIbepjyEoGSnhbAY= +github.com/poy/onpar v1.1.2/go.mod h1:6X8FLNoxyr9kkmnlqpK6LSoiOtrO6MICtWwEuWkLjzg= +github.com/prometheus/client_golang v1.23.2 h1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o= +github.com/prometheus/client_golang v1.23.2/go.mod h1:Tb1a6LWHB3/SPIzCoaDXI4I8UHKeFTEQ1YCr+0Gyqmg= +github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk= +github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE= +github.com/prometheus/common v0.67.5 h1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4= +github.com/prometheus/common v0.67.5/go.mod h1:SjE/0MzDEEAyrdr5Gqc6G+sXI67maCxzaT3A2+HqjUw= +github.com/prometheus/otlptranslator v1.0.0 h1:s0LJW/iN9dkIH+EnhiD3BlkkP5QVIUVEoIwkU+A6qos= +github.com/prometheus/otlptranslator v1.0.0/go.mod h1:vRYWnXvI6aWGpsdY/mOT/cbeVRBlPWtBNDb7kGR3uKM= +github.com/prometheus/procfs v0.20.1 h1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc= +github.com/prometheus/procfs v0.20.1/go.mod h1:o9EMBZGRyvDrSPH1RqdxhojkuXstoe4UlK79eF5TGGo= +github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5 h1:EaDatTxkdHG+U3Bk4EUr+DZ7fOGwTfezUiUJMaIcaho= +github.com/redis/go-redis/extra/rediscmd/v9 v9.0.5/go.mod h1:fyalQWdtzDBECAQFBJuQe5bzQ02jGd5Qcbgb97Flm7U= +github.com/redis/go-redis/extra/redisotel/v9 v9.0.5 h1:EfpWLLCyXw8PSM2/XNJLjI3Pb27yVE+gIAfeqp8LUCc= +github.com/redis/go-redis/extra/redisotel/v9 v9.0.5/go.mod h1:WZjPDy7VNzn77AAfnAfVjZNvfJTYfPetfZk5yoSTLaQ= +github.com/redis/go-redis/v9 v9.7.3 h1:YpPyAayJV+XErNsatSElgRZZVCwXX9QzkKYNvO7x0wM= +github.com/redis/go-redis/v9 v9.7.3/go.mod h1:bGUrSggJ9X9GUmZpZNEOQKaANxSGgOEBRltRTZHSvrA= github.com/rivo/uniseg v0.1.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.2.0/go.mod h1:J6wj4VEh+S6ZtnVlnTBMWIodfgj8LQOQFoIToxlJtxc= github.com/rivo/uniseg v0.4.3 h1:utMvzDsuh3suAEnhH0RdHmoPbU648o6CvXxTx4SBMOw= github.com/rivo/uniseg v0.4.3/go.mod h1:FN3SvrM+Zdj16jyLfmOkMNblXMcoc8DfTHruCPUcx88= -github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8= -github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs= +github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ= +github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc= +github.com/rubenv/sql-migrate v1.8.1 h1:EPNwCvjAowHI3TnZ+4fQu3a915OpnQoPAjTXCGOy2U0= +github.com/rubenv/sql-migrate v1.8.1/go.mod h1:BTIKBORjzyxZDS6dzoiw6eAFYJ1iNlGAtjn4LGeVjS8= github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk= github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM= github.com/sagikazarmark/locafero v0.11.0 h1:1iurJgmM9G3PA/I+wWYIOw/5SyBtxapeHDcg+AAIFXc= github.com/sagikazarmark/locafero v0.11.0/go.mod h1:nVIGvgyzw595SUSUE6tvCp3YYTeHs15MvlmU87WwIik= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= +github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw= +github.com/sergi/go-diff v1.4.0/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4= +github.com/shopspring/decimal v1.4.0 h1:bxl37RwXBklmTi0C79JfXCEBD1cqqHt0bbgBAGFp81k= +github.com/shopspring/decimal v1.4.0/go.mod h1:gawqmDU56v4yIKSwfBSFip1HdCCXN8/+DMd9qYNcwME= +github.com/sirupsen/logrus v1.9.4 h1:TsZE7l11zFCLZnZ+teH4Umoq5BhEIfIzfRDZ1Uzql2w= +github.com/sirupsen/logrus v1.9.4/go.mod h1:ftWc9WdOfJ0a92nsE2jF5u5ZwH8Bv2zdeOC42RjbV2g= github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8 h1:+jumHNA0Wrelhe64i8F6HNlS8pkoyMv5sreGx2Ry5Rw= github.com/sourcegraph/conc v0.3.1-0.20240121214520-5f936abd7ae8/go.mod h1:3n1Cwaq1E1/1lhQhtRK2ts/ZwZEhjcQeJQ1RuC6Q/8U= github.com/spf13/afero v1.15.0 h1:b/YBCLWAJdFWJTN9cLhiXXcD7mzKn9Dm86dNnfyQw1I= @@ -114,39 +324,110 @@ github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3A github.com/spf13/viper v1.21.0 h1:x5S+0EU27Lbphp4UKm1C+1oQO+rKx36vfCoaVebLFSU= github.com/spf13/viper v1.21.0/go.mod h1:P0lhsswPGWD/1lZJ9ny3fYnVqxiegrlNrEmgLjbTCAY= github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= +github.com/stretchr/objx v0.5.2 h1:xuMeJ0Sdp5ZMRXx/aWO6RZxdr3beISkG5/G/aIRr3pY= +github.com/stretchr/objx v0.5.2/go.mod h1:FRsXN1f5AsAjCGJKqEizvkpNtU+EGNCLh3NxZ/8L+MA= +github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs= +github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI= github.com/stretchr/testify v1.6.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= +github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/subosito/gotenv v1.6.0 h1:9NlTDc1FTs4qu0DDq7AEtTPNw6SVm7uBMsUCUjABIf8= github.com/subosito/gotenv v1.6.0/go.mod h1:Dk4QP5c2W3ibzajGcXpNraDfq2IrhjMIvMSWPKKo0FU= +github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834 h1:ZF+QBjOI+tILZjBaFj3HgFonKXUcwgJ4djLb6i42S3Q= +github.com/tetratelabs/wabin v0.0.0-20230304001439-f6f874872834/go.mod h1:m9ymHTgNSEjuxvw8E7WWe4Pl4hZQHXONY8wE6dMLaRk= +github.com/tetratelabs/wazero v1.12.0 h1:DuWcpNu/FzgEXgGBDp8J1Spc+CWOvvtvVyjKlaZopYU= +github.com/tetratelabs/wazero v1.12.0/go.mod h1:LvKtzl2RqO4gyF27BiXU+nKAjcV8f38U+kP/q2vgxh0= +github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM= +github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg= +github.com/xlab/treeprint v1.2.0 h1:HzHnuAF1plUN2zGlAFHbSQP2qJ0ZAD3XF5XD7OesXRQ= +github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd/WEJu0= github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= +go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= +go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= +go.opentelemetry.io/contrib/bridges/prometheus v0.67.0 h1:dkBzNEAIKADEaFnuESzcXvpd09vxvDZsOjx11gjUqLk= +go.opentelemetry.io/contrib/bridges/prometheus v0.67.0/go.mod h1:Z5RIwRkZgauOIfnG5IpidvLpERjhTninpP1dTG2jTl4= +go.opentelemetry.io/contrib/exporters/autoexport v0.67.0 h1:4fnRcNpc6YFtG3zsFw9achKn3XgmxPxuMuqIL5rE8e8= +go.opentelemetry.io/contrib/exporters/autoexport v0.67.0/go.mod h1:qTvIHMFKoxW7HXg02gm6/Wofhq5p3Ib/A/NNt1EoBSQ= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 h1:OyrsyzuttWTSur2qN/Lm0m2a8yqyIjUVBZcxFPuXq2o= +go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0/go.mod h1:C2NGBr+kAB4bk3xtMXfZ94gqFDtg/GkI7e9zqGh5Beg= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0 h1:deI9UQMoGFgrg5iLPgzueqFPHevDl+28YKfSpPTI6rY= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.18.0/go.mod h1:PFx9NgpNUKXdf7J4Q3agRxMs3Y07QhTCVipKmLsMKnU= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0 h1:HIBTQ3VO5aupLKjC90JgMqpezVXwFuq6Ryjn0/izoag= +go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploghttp v0.19.0/go.mod h1:ji9vId85hMxqfvICA0Jt8JqEdrXaAkcpkI9HPXya0ro= +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0 h1:MdKucPl/HbzckWWEisiNqMPhRrAOQX8r4jTuGr636gk= +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.42.0/go.mod h1:RolT8tWtfHcjajEH5wFIZ4Dgh5jpPdFXYV9pTAk/qjc= +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0 h1:w1K+pCJoPpQifuVpsKamUdn9U0zM3xUziVOqsGksUrY= +go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.43.0/go.mod h1:HBy4BjzgVE8139ieRI75oXm3EcDN+6GhD88JT1Kjvxg= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 h1:88Y4s2C8oTui1LGM6bTWkw0ICGcOLCAI5l6zsD1j20k= +go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0/go.mod h1:Vl1/iaggsuRlrHf/hfPJPvVag77kKyvrLeD10kpMl+A= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0 h1:zWWrB1U6nqhS/k6zYB74CjRpuiitRtLLi68VcgmOEto= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.42.0/go.mod h1:2qXPNBX1OVRC0IwOnfo1ljoid+RD0QK3443EaqVlsOU= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 h1:3iZJKlCZufyRzPzlQhUIWVmfltrXuGyfjREgGP3UUjc= +go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0/go.mod h1:/G+nUPfhq2e+qiXMGxMwumDrP5jtzU+mWN7/sjT2rak= +go.opentelemetry.io/otel/exporters/prometheus v0.64.0 h1:g0LRDXMX/G1SEZtK8zl8Chm4K6GBwRkjPKE36LxiTYs= +go.opentelemetry.io/otel/exporters/prometheus v0.64.0/go.mod h1:UrgcjnarfdlBDP3GjDIJWe6HTprwSazNjwsI+Ru6hro= +go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0 h1:KJVjPD3rcPb98rIs3HznyJlrfx9ge5oJvxxlGR+P/7s= +go.opentelemetry.io/otel/exporters/stdout/stdoutlog v0.18.0/go.mod h1:K3kRa2ckmHWQaTWQdPRHc7qGXASuVuoEQXzrvlA98Ws= +go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0 h1:lSZHgNHfbmQTPfuTmWVkEu8J8qXaQwuV30pjCcAUvP8= +go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.42.0/go.mod h1:so9ounLcuoRDu033MW/E0AD4hhUjVqswrMF5FoZlBcw= +go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0 h1:s/1iRkCKDfhlh1JF26knRneorus8aOwVIDhvYx9WoDw= +go.opentelemetry.io/otel/exporters/stdout/stdouttrace v1.42.0/go.mod h1:UI3wi0FXg1Pofb8ZBiBLhtMzgoTm1TYkMvn71fAqDzs= +go.opentelemetry.io/otel/log v0.19.0 h1:KUZs/GOsw79TBBMfDWsXS+KZ4g2Ckzksd1ymzsIEbo4= +go.opentelemetry.io/otel/log v0.19.0/go.mod h1:5DQYeGmxVIr4n0/BcJvF4upsraHjg6vudJJpnkL6Ipk= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/sdk/log v0.19.0 h1:scYVLqT22D2gqXItnWiocLUKGH9yvkkeql5dBDiXyko= +go.opentelemetry.io/otel/sdk/log v0.19.0/go.mod h1:vFBowwXGLlW9AvpuF7bMgnNI95LiW10szrOdvzBHlAg= +go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= +go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= +go.opentelemetry.io/proto/otlp v1.10.0 h1:IQRWgT5srOCYfiWnpqUYz9CVmbO8bFmKcwYxpuCSL2g= +go.opentelemetry.io/proto/otlp v1.10.0/go.mod h1:/CV4QoCR/S9yaPj8utp3lvQPoqMtxXdzn7ozvvozVqk= +go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto= +go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= +go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0= +go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y= +go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc= +go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E= +go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0= +go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8= go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= -golang.org/x/exp v0.0.0-20230129154200-a960b3787bd2 h1:5sPMf9HJXrvBWIamTw+rTST0bZ3Mho2n1p58M0+W99c= -golang.org/x/exp v0.0.0-20230129154200-a960b3787bd2/go.mod h1:CxIveKay+FTh1D0yPZemJVgC/95VzuuOLq5Qi4xnoYc= +golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93 h1:fQsdNF2N+/YewlRZiricy4P1iimyPKZ/xwniHj8Q2a0= +golang.org/x/exp v0.0.0-20251219203646-944ab1f22d93/go.mod h1:EPRbTFwzwjXj9NpYyyrvenVh9Y+GFeEvMNh7Xuz7xgU= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= +golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= +golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= +golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20190222072716-a9d3bda3a223/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20200223170610-d5e6a3e2c0ae/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20210616045830-e2b7044e8c71/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220811171246-fbc7d0a398ab/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= @@ -159,14 +440,74 @@ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= +golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= +golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= +golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= +golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec= +google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= +google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI= +google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo= -gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk= +gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q= +gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo= +gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M= +gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc= +gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw= +gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY= +gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ= gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= +helm.sh/helm/v4 v4.2.4 h1:qIysMI0JpTC4WXf3AQ99V6rZGT0+gO0Ww8IOnnUnaZk= +helm.sh/helm/v4 v4.2.4/go.mod h1:ZP8nFdYe7jG1PTQelKzQXQ7m09/ruhMTrpDAf+OL5ms= +k8s.io/api v0.36.1 h1:XbL/EMj8K2aJpJtePmqUyQMsM0D4QI2pvl7YKJ20FTY= +k8s.io/api v0.36.1/go.mod h1:KOWo4ey3TINlXjeHVuwB3i+tXXnu+UcwFBHlI/9dvEo= +k8s.io/apiextensions-apiserver v0.36.1 h1:6JfYmPUsuUIHuN+3QxutXYWj492RqF5fBSx67GYK5Ks= +k8s.io/apiextensions-apiserver v0.36.1/go.mod h1:pLzZin90riwisdzKwv/GoTwENooytoIx5zWJb4Hkby8= +k8s.io/apimachinery v0.36.1 h1:G63Gjx2W+q0YD+72Vo8oY0nDnePVwnuzTmmy5ENrVSA= +k8s.io/apimachinery v0.36.1/go.mod h1:ibYOR00vW/I1kzvi5SF0dRuJ52BvKtfvRdOn35GPQ+8= +k8s.io/apiserver v0.36.1 h1:iMS5V+rPUertv5P9RaqJgmHHTuh4quWpoxchvMUY+JY= +k8s.io/apiserver v0.36.1/go.mod h1:Cby1PbLWztu0GDOxoO6iFOyyqIsziHNEW+w9zVQ22Kw= +k8s.io/cli-runtime v0.36.1 h1:yuC/BGnnj1YYPh6D1P+pZnzinCs6DvMq86yAeNqoqzM= +k8s.io/cli-runtime v0.36.1/go.mod h1:ZQWHGt8xAF7KnviB79vX0lYNyUUqKIpU+LQg7exuFAw= +k8s.io/client-go v0.36.1 h1:FN/K8QIT2CEDt+2WB2HnWrUANZ50AP5GII43/SP2JR0= +k8s.io/client-go v0.36.1/go.mod h1:s6rAnCtTGYDQnpNjEhSaISV+2O8jwruZ6m3QOYBFbtU= +k8s.io/component-base v0.36.1 h1:iG6GsELftXqTNG9HG6kiVjatSgAw1sf5pJ6R5a6N0kA= +k8s.io/component-base v0.36.1/go.mod h1:nf9XPlntRdqO6WMeEWAA5F93Y4ICZQdeT9GeqLDB3JI= +k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc= +k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0= +k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a h1:xCeOEAOoGYl2jnJoHkC3hkbPJgdATINPMAxaynU2Ovg= +k8s.io/kube-openapi v0.0.0-20260317180543-43fb72c5454a/go.mod h1:uGBT7iTA6c6MvqUvSXIaYZo9ukscABYi2btjhvgKGZ0= +k8s.io/kubectl v0.36.1 h1:96HqS9twIdHM0MlJLTwbo14b9kUKPkOzZ4tlRDLv4qI= +k8s.io/kubectl v0.36.1/go.mod h1:/DGPAIewKsFWF9VFgGvkPhao2Ev4SNuE3BioZo8yPbk= +k8s.io/streaming v0.36.1 h1:L+K68n4Gg940BGNNYtUBvL1WTLL0YnKT3s+P1MNAmR4= +k8s.io/streaming v0.36.1/go.mod h1:z6fV3D+NVkoeqRMtWwlUZK6U17SY/LqNzOxWL6GyR/s= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2 h1:AZYQSJemyQB5eRxqcPky+/7EdBj0xi3g0ZcxxJ7vbWU= +k8s.io/utils v0.0.0-20260210185600-b8788abfbbc2/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk= +oras.land/oras-go/v2 v2.6.1 h1:bonOEkjLfp8tt6qXWRRWP6p1F+9octchOf2EqnWB4Zs= +oras.land/oras-go/v2 v2.6.1/go.mod h1:dhtFrFOuZuDtAVeZ9FUnaa5zfzplG3ZnFX9/uH1J/Yk= +sigs.k8s.io/controller-runtime v0.24.1 h1:miPEwrmirImAvgME1L9qebGHrOnGJoVmVdtOU9fRfo4= +sigs.k8s.io/controller-runtime v0.24.1/go.mod h1:vFkfY5fGt5xAC/sKb8IBFKgWPNKG9OUG29dR8Y2wImw= +sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg= +sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg= +sigs.k8s.io/kustomize/api v0.21.1 h1:lzqbzvz2CSvsjIUZUBNFKtIMsEw7hVLJp0JeSIVmuJs= +sigs.k8s.io/kustomize/api v0.21.1/go.mod h1:f3wkKByTrgpgltLgySCntrYoq5d3q7aaxveSagwTlwI= +sigs.k8s.io/kustomize/kyaml v0.21.1 h1:IVlbmhC076nf6foyL6Taw4BkrLuEsXUXNpsE+ScX7fI= +sigs.k8s.io/kustomize/kyaml v0.21.1/go.mod h1:hmxADesM3yUN2vbA5z1/YTBnzLJ1dajdqpQonwBL1FQ= +sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU= +sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY= +sigs.k8s.io/structured-merge-diff/v6 v6.3.2 h1:kwVWMx5yS1CrnFWA/2QHyRVJ8jM6dBA80uLmm0wJkk8= +sigs.k8s.io/structured-merge-diff/v6 v6.3.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE= +sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs= +sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4= diff --git a/pkg/apiclient/client_factory.go b/pkg/apiclient/client_factory.go index 93c73abe..8a89083a 100644 --- a/pkg/apiclient/client_factory.go +++ b/pkg/apiclient/client_factory.go @@ -5,9 +5,11 @@ import ( "errors" "fmt" "net/url" + "os" "strings" "github.com/MakeNowJust/heredoc/v2" + "github.com/OctopusDeploy/cli/pkg/config" "github.com/OctopusDeploy/cli/pkg/constants" "github.com/OctopusDeploy/cli/pkg/output" "github.com/OctopusDeploy/cli/pkg/question" @@ -73,6 +75,10 @@ type Client struct { ActiveSpace *spaces.Space Ask question.AskProvider + + // RememberSpace saves an interactively chosen space as the default, so a + // person is asked once rather than on every command. Nil in tests. + RememberSpace func(spaceNameOrID string) error } func NewClientFactory(httpClient *http.Client, host string, credentials octopusApiClient.ICredential, spaceNameOrID string, ask question.AskProvider) (ClientFactory, error) { @@ -108,6 +114,24 @@ func NewClientFactory(httpClient *http.Client, host string, credentials octopusA return clientImpl, nil } +// rememberSpace saves only a choice the person actually made: a space from +// --space, the environment, or a server with just one was never asked about. +func (c *Client) rememberSpace(space *spaces.Space) { + if c.RememberSpace == nil { + return + } + + if err := c.RememberSpace(space.Name); err != nil { + // A convenience, so failing at it is not worth stopping for. + fmt.Fprintf(os.Stderr, "Could not save %s as your default space: %v\n", space.Name, err) + return + } + + // Say so rather than quietly editing the config file. + fmt.Fprintf(os.Stderr, "Saved %s as your default space. Change it with '%s config set Space '.\n", + space.Name, constants.ExecutableName) +} + // NewClientFactoryFromConfig Creates a new Client wrapper structure by reading the viper config. // specifies nil for the HTTP Client, so this is not for unit tests; use NewClientFactory(... instead) func NewClientFactoryFromConfig(ask question.AskProvider) (ClientFactory, error) { @@ -150,7 +174,17 @@ func NewClientFactoryFromConfig(ask question.AskProvider) (ClientFactory, error) credentials = accessTokenCredential } - return NewClientFactory(httpClient, host, credentials, spaceNameOrID, ask) + factory, err := NewClientFactory(httpClient, host, credentials, spaceNameOrID, ask) + if err != nil { + return nil, err + } + + if client, ok := factory.(*Client); ok { + client.RememberSpace = func(space string) error { + return config.New(viper.GetViper()).Set(constants.ConfigSpace, space) + } + } + return factory, nil } func ValidateMandatoryEnvironment(host string, apiKey string, accessToken string, isInteractive bool) error { @@ -312,6 +346,8 @@ func (c *Client) GetSpacedClient(requester Requester) (*octopusApiClient.Client, c.ActiveSpace = selectedSpace c.SpaceNameOrID = selectedSpace.ID foundSpaceID = selectedSpace.ID + + c.rememberSpace(selectedSpace) } } diff --git a/pkg/apiclient/remember_space_test.go b/pkg/apiclient/remember_space_test.go new file mode 100644 index 00000000..f8014cac --- /dev/null +++ b/pkg/apiclient/remember_space_test.go @@ -0,0 +1,108 @@ +package apiclient_test + +import ( + "testing" + + "github.com/AlecAivazis/survey/v2" + "github.com/OctopusDeploy/cli/pkg/apiclient" + "github.com/OctopusDeploy/cli/pkg/question" + "github.com/OctopusDeploy/cli/test/testutil" + octopusApiClient "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/client" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/spaces" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func newSpace(id, name string) *spaces.Space { + space := spaces.NewSpace(name) + space.ID = id + return space +} + +// rememberingFactory records whatever space the factory decides to save. +func rememberingFactory(t *testing.T, api *testutil.MockHttpServer, asker *testutil.AskMocker, saved *string) apiclient.ClientFactory { + t.Helper() + + credential, err := octopusApiClient.NewApiKey(apiKey) + require.NoError(t, err) + + factory, err := apiclient.NewClientFactory( + testutil.NewMockHttpClientWithTransport(api), hostUrl, credential, "", + question.NewAskProvider(asker.AsAsker())) + require.NoError(t, err) + + factory.(*apiclient.Client).RememberSpace = func(space string) error { + *saved = space + return nil + } + return factory +} + +func twoSpaces() []*spaces.Space { + return []*spaces.Space{newSpace("Spaces-1", "Default"), newSpace("Spaces-2", "Research")} +} + +// respondToSdkInit handles the two requests the SDK makes when it builds the +// system client, before any space lookup happens. +func respondToSdkInit(t *testing.T, api *testutil.MockHttpServer) { + t.Helper() + api.ExpectRequest(t, "GET", "/api/").RespondWith(testutil.NewRootResource()) + api.ExpectRequest(t, "GET", "/api/spaces").RespondWith(map[string]any{ + "Items": []any{}, "ItemsPerPage": 30, "TotalResults": 0, + }) +} + +// Being asked which space to use on every command is tedious, so a space the +// person actually picked becomes the default. +func TestGetSpacedClient_RemembersAnExplicitlyChosenSpace(t *testing.T) { + api, qa := testutil.NewMockServerAndAsker() + + var saved string + factory := rememberingFactory(t, api, qa, &saved) + + errReceiver := testutil.GoBegin(func() error { + defer testutil.Close(api, qa) + _, err := factory.GetSpacedClient(&apiclient.FakeRequesterContext{}) + return err + }) + + respondToSdkInit(t, api) + api.ExpectRequest(t, "GET", "/api/spaces/all").RespondWith(twoSpaces()) + + _ = qa.ExpectQuestion(t, &survey.Select{ + Message: "You have not specified a Space. Please select one:", + Options: []string{"Default", "Research"}, + }).AnswerWith("Research") + + // Building the space-scoped client repeats the SDK handshake. + api.ExpectRequest(t, "GET", "/api/").RespondWith(testutil.NewRootResource()) + api.ExpectRequest(t, "GET", "/api/Spaces-2").RespondWith(testutil.NewRootResource()) + + testutil.AssertSuccess(t, <-errReceiver) + + assert.Equal(t, "Research", saved, "the chosen space should become the default") +} + +// A server with one space asks nothing, so there is no choice to remember. +func TestGetSpacedClient_DoesNotRememberASpaceThatWasNeverChosen(t *testing.T) { + api, qa := testutil.NewMockServerAndAsker() + + var saved string + factory := rememberingFactory(t, api, qa, &saved) + + errReceiver := testutil.GoBegin(func() error { + defer testutil.Close(api, qa) + _, err := factory.GetSpacedClient(&apiclient.FakeRequesterContext{}) + return err + }) + + respondToSdkInit(t, api) + api.ExpectRequest(t, "GET", "/api/spaces/all"). + RespondWith([]*spaces.Space{newSpace("Spaces-1", "Default")}) + api.ExpectRequest(t, "GET", "/api/").RespondWith(testutil.NewRootResource()) + api.ExpectRequest(t, "GET", "/api/Spaces-1").RespondWith(testutil.NewRootResource()) + + testutil.AssertSuccess(t, <-errReceiver) + + assert.Empty(t, saved) +} diff --git a/pkg/cmd/kubernetes/gateway/gateway.go b/pkg/cmd/kubernetes/gateway/gateway.go new file mode 100644 index 00000000..acdd058a --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/gateway.go @@ -0,0 +1,26 @@ +package gateway + +import ( + "github.com/MakeNowJust/heredoc/v2" + cmdInstall "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway/install" + cmdRotateToken "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway/rotatetoken" + "github.com/OctopusDeploy/cli/pkg/constants" + "github.com/OctopusDeploy/cli/pkg/factory" + "github.com/spf13/cobra" +) + +func NewCmdGateway(f factory.Factory) *cobra.Command { + cmd := &cobra.Command{ + Use: "gateway ", + Short: "Manage the Octopus Argo CD gateway", + Long: heredoc.Doc(` + Manage the Octopus Argo CD gateway, which connects an Argo CD instance to Octopus. + `), + Example: heredoc.Docf("$ %s kubernetes gateway install", constants.ExecutableName), + } + + cmd.AddCommand(cmdInstall.NewCmdInstall(f)) + cmd.AddCommand(cmdRotateToken.NewCmdRotateToken(f)) + + return cmd +} diff --git a/pkg/cmd/kubernetes/gateway/install/argosetup.go b/pkg/cmd/kubernetes/gateway/install/argosetup.go new file mode 100644 index 00000000..de67b092 --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/argosetup.go @@ -0,0 +1,247 @@ +package install + +import ( + "context" + "errors" + "fmt" + "io" + "strings" + "time" + + "github.com/AlecAivazis/survey/v2" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/OctopusDeploy/cli/pkg/output" + "k8s.io/client-go/rest" +) + +// ConfigureAccountAndMintToken replaces the most tedious part of connecting +// Argo CD to Octopus: editing argocd-cm and argocd-rbac-cm, then running the +// Argo CD CLI. Callers fall back to the manual path if this returns an error. +func ConfigureAccountAndMintToken(ctx context.Context, opts *InstallOptions, status argocd.AccountStatus) (string, error) { + if !status.IsComplete() { + fmt.Fprintf(opts.Out, "Updating Argo CD configuration...\n") + if err := argocd.ConfigureAccount(ctx, opts.Cluster, opts.Instance, status); err != nil { + return "", err + } + } + + restConfig, err := opts.restConfig() + if err != nil { + return "", err + } + + client, closePortForward, err := argocd.Dial(ctx, opts.Cluster, restConfig, opts.Instance) + if err != nil { + return "", err + } + defer closePortForward() + + revert, err := SignIn(ctx, opts.Out, client, loginStrategies(opts, status.Spec)) + if revert != nil { + defer revert() + } + if err != nil { + return "", err + } + + // Argo CD reloads argocd-cm in the background. + if err := client.WaitForAccount(ctx, status.Spec.Name); err != nil { + return "", err + } + + token, err := client.GenerateToken(ctx, status.Spec.Name) + if err != nil { + return "", err + } + + fmt.Fprintf(opts.Out, "%s Generated an Argo CD token for the %s account\n", + output.Green("✔"), output.Cyan(status.Spec.Name)) + + reportAccess(opts, client.VerifyAccess(ctx)) + return token, nil +} + +// LoginStrategy is one way to obtain an Argo CD session. Each is only acted on +// when it is reached, because some of them change the cluster. +type LoginStrategy struct { + Describe string + Begin func(context.Context) (argocd.Credentials, func(), error) +} + +// ArgoLogin is the part of an Argo CD client SignIn needs. +type ArgoLogin interface { + Login(ctx context.Context, credentials argocd.Credentials) error +} + +// SignIn works through the ways of signing in until one is accepted. +// +// A rejection is not the end of it: the initial admin password is tried first +// because using it changes nothing, but Argo CD leaves that Secret in place +// when the admin password is changed, so a stale one is only discovered by +// being turned away. +func SignIn(ctx context.Context, out io.Writer, client ArgoLogin, strategies []LoginStrategy) (func(), error) { + var attempts []string + + for _, strategy := range strategies { + credentials, revert, err := strategy.Begin(ctx) + if err != nil { + attempts = append(attempts, fmt.Sprintf("%s: %v", strategy.Describe, err)) + continue + } + + if err := client.Login(ctx, credentials); err != nil { + if revert != nil { + revert() + } + attempts = append(attempts, fmt.Sprintf("%s: %v", strategy.Describe, err)) + fmt.Fprintf(out, " %s %s did not work, trying another way\n", output.Yellow("!"), strategy.Describe) + continue + } + + return revert, nil + } + + return nil, fmt.Errorf("could not sign in to Argo CD. Octopus tried:\n %s", strings.Join(attempts, "\n ")) +} + +func loginStrategies(opts *InstallOptions, spec argocd.AccountSpec) []LoginStrategy { + namespace := opts.Instance.Namespace + + strategies := []LoginStrategy{{ + Describe: "the initial admin password", + Begin: func(ctx context.Context) (argocd.Credentials, func(), error) { + diagnosis, err := argocd.DiagnoseAuth(ctx, opts.Cluster, opts.Instance) + if err != nil { + return argocd.Credentials{}, nil, err + } + if !diagnosis.AdminEnabled || !diagnosis.HasInitialAdminSecret { + return argocd.Credentials{}, nil, errors.New(diagnosis.Explain()) + } + + password, found, err := argocd.InitialAdminPassword(ctx, opts.Cluster, namespace) + if err != nil || !found { + return argocd.Credentials{}, nil, err + } + return argocd.Credentials{Username: argocd.AdminUsername, Password: password}, nil, nil + }, + }, { + Describe: fmt.Sprintf("a temporary password on the %s account", spec.Name), + Begin: func(ctx context.Context) (argocd.Credentials, func(), error) { + if !opts.NoPrompt { + if err := confirmBootstrap(opts, spec); err != nil { + return argocd.Credentials{}, nil, err + } + } + + bootstrap, err := argocd.BeginBootstrapLogin(ctx, opts.Cluster, opts.Instance, spec) + if err != nil { + return argocd.Credentials{}, nil, err + } + return bootstrap.Credentials(), revertBootstrap(opts, bootstrap, spec), nil + }, + }} + + if opts.NoPrompt { + return strategies + } + + return append(strategies, LoginStrategy{ + Describe: "credentials you supply", + Begin: func(context.Context) (argocd.Credentials, func(), error) { + credentials, err := askForCredentials(opts) + return credentials, nil, err + }, + }) +} + +func revertBootstrap(opts *InstallOptions, bootstrap *argocd.BootstrapLogin, spec argocd.AccountSpec) func() { + return func() { + // A fresh context: the caller's may already be cancelled, and the + // temporary password still has to go. + ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) + defer cancel() + + if err := bootstrap.Revert(ctx); err != nil { + fmt.Fprintf(opts.Out, "%s Could not remove the temporary Argo CD password for %s: %v\n"+ + " Remove accounts.%s.password from the %s/%s Secret by hand.\n", + output.Yellow("!"), spec.Name, err, spec.Name, opts.Instance.Namespace, argocd.SecretName) + } + } +} + +// confirmBootstrap asks first because argocd-secret is where Argo CD keeps its +// TLS and signing keys. +func confirmBootstrap(opts *InstallOptions, spec argocd.AccountSpec) error { + fmt.Fprintf(opts.Out, "\nOctopus can still get a token without an administrator password, by giving the\n"+ + "%s account a temporary password of its own and removing it afterwards.\n", output.Cyan(spec.Name)) + fmt.Fprintf(opts.Out, " %s\n", output.Dimf( + "This sets accounts.%s.password in the %s/%s Secret. Nothing else in that Secret is touched, and the administrator's password is not read or changed.", + spec.Name, opts.Instance.Namespace, argocd.SecretName)) + + proceed := false + if err := opts.Ask(&survey.Confirm{ + Message: "Generate the token this way?", + Default: true, + }, &proceed); err != nil { + return err + } + if !proceed { + return errors.New("declined") + } + return nil +} + +func askForCredentials(opts *InstallOptions) (argocd.Credentials, error) { + fmt.Fprintf(opts.Out, "\nSigning in to Argo CD needs an account that can create API keys.\n") + + credentials := argocd.Credentials{Username: argocd.AdminUsername} + if err := opts.Ask(&survey.Input{ + Message: "Argo CD username", + Default: argocd.AdminUsername, + }, &credentials.Username, survey.WithValidator(survey.Required)); err != nil { + return argocd.Credentials{}, err + } + + if err := opts.Ask(&survey.Password{ + Message: fmt.Sprintf("Argo CD password for %s", credentials.Username), + }, &credentials.Password, survey.WithValidator(survey.Required)); err != nil { + return argocd.Credentials{}, err + } + + return credentials, nil +} + +func (opts *InstallOptions) restConfig() (*rest.Config, error) { + kubeConfig, err := octoK8s.LoadKubeConfig(opts.KubeConfig.Value) + if err != nil { + return nil, err + } + return kubeConfig.RestConfig(opts.KubeContext.Value) +} + +// reportAccess exists because Argo CD answers an under-privileged request with +// an empty list rather than a refusal, so a gateway can connect and then show +// nothing. +func reportAccess(opts *InstallOptions, access argocd.AccessCheck) { + if !access.Readable() { + fmt.Fprintf(opts.Out, " %s The token could not read %s. Check the RBAC policies in %s.\n", + output.Yellow("!"), unreadable(access), argocd.RBACConfigMapName) + return + } + + fmt.Fprintf(opts.Out, " %s\n", output.Dimf("It can read %d %s and %d %s.", + access.Applications, octoK8s.Pluralise("application", "applications", access.Applications), + access.Clusters, octoK8s.Pluralise("cluster", "clusters", access.Clusters))) +} + +func unreadable(access argocd.AccessCheck) string { + switch { + case access.ApplicationsErr != nil && access.ClustersErr != nil: + return "applications or clusters" + case access.ApplicationsErr != nil: + return "applications" + default: + return "clusters" + } +} diff --git a/pkg/cmd/kubernetes/gateway/install/commit.go b/pkg/cmd/kubernetes/gateway/install/commit.go new file mode 100644 index 00000000..241fd847 --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/commit.go @@ -0,0 +1,384 @@ +package install + +import ( + "context" + "errors" + "fmt" + "os" + "strings" + "time" + + "github.com/AlecAivazis/survey/v2" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/util/flag" + "sigs.k8s.io/yaml" +) + +func (opts *InstallOptions) Commit(ctx context.Context) error { + timeout, err := opts.ResolveTimeout() + if err != nil { + return err + } + + values, err := opts.BuildValues() + if err != nil { + return err + } + + if err := opts.writeValuesFile(values); err != nil { + return err + } + + if err := opts.checkPermissions(ctx); err != nil { + return err + } + + if opts.DryRun.Value { + return opts.renderOnly(ctx, values, timeout) + } + + if err := opts.ensureNamespace(ctx); err != nil { + return err + } + + if err := opts.runPreflight(ctx); err != nil { + return err + } + + if err := opts.storeCredentials(ctx); err != nil { + return err + } + + fmt.Fprintf(opts.Out, "\nInstalling the Argo CD gateway into %s...\n", output.Cyan(opts.TargetNamespace)) + if opts.Wait.Value || opts.Atomic.Value { + // The gateway registers with Octopus from a job before it starts, so + // there is a long quiet stretch here. Say so rather than look stalled. + fmt.Fprintf(opts.Out, " %s\n", output.Dimf( + "Waiting for it to register with Octopus and become ready. This can take a few minutes, and gives up after %s.", timeout)) + } + + release, err := opts.Runner.Install(ctx, helm.InstallSpec{ + Chart: opts.chartRef(), + ReleaseName: opts.TargetRelease, + Namespace: opts.TargetNamespace, + Values: values, + Atomic: opts.Atomic.Value, + Wait: opts.Wait.Value, + Timeout: timeout, + }) + if err != nil { + return err + } + + opts.reportSuccess(release) + return nil +} + +func (opts *InstallOptions) chartRef() helm.ChartRef { + ref := ChartRef + ref.Version = opts.ChartVersion.Value + return ref +} + +// BuildValues passes credentials by Secret reference unless --inline-secrets +// was given, so they stay out of the release values and out of any file written +// by --output-values. +func (opts *InstallOptions) BuildValues() (map[string]any, error) { + if opts.ArgoCDServerGRPCURL.Value == "" { + return nil, errors.New("the Argo CD in-cluster address could not be determined; specify --" + FlagArgoCDServerGRPCURL) + } + if opts.OctopusGRPCURL.Value == "" { + return nil, errors.New("the Octopus gRPC address could not be determined; specify --" + FlagOctopusGRPCURL) + } + + registrationOctopus := map[string]any{ + "name": opts.Name.Value, + "serverApiUrl": opts.Host, + "spaceId": opts.Space.ID, + "environments": opts.Environments.Value, + } + + gatewayArgoCD := map[string]any{ + "serverGrpcUrl": opts.ArgoCDServerGRPCURL.Value, + "plaintext": opts.Instance.Plaintext, + "insecure": opts.Instance.SelfSignedTLS, + } + if opts.useGRPCWeb() { + gatewayArgoCD["grpcWeb"] = true + } + if opts.ArgoCDGRPCWebRootPath.Value != "" { + gatewayArgoCD["grpcWebRootPath"] = opts.ArgoCDGRPCWebRootPath.Value + } + + projectTokens, err := opts.ProjectTokens() + if err != nil { + return nil, err + } + + if opts.InlineSecrets.Value { + registrationOctopus["serverAccessToken"] = opts.OctopusCredential + } else { + registrationOctopus["serverAccessTokenSecretName"] = octopusTokenSecretName + registrationOctopus["serverAccessTokenSecretKey"] = octopusTokenSecretKey + } + + switch { + case len(projectTokens) > 0: + // AWS caps account tokens at 12 hours, so managed Argo CD authenticates + // per project instead. + if opts.InlineSecrets.Value { + gatewayArgoCD["projectAuthentication"] = projectTokens + } else { + gatewayArgoCD["projectAuthenticationSecretName"] = projectTokenSecretName + } + case opts.InlineSecrets.Value: + gatewayArgoCD["authenticationToken"] = opts.ArgoCDToken.Value + default: + gatewayArgoCD["authenticationTokenSecretName"] = argoTokenSecretName + gatewayArgoCD["authenticationTokenSecretKey"] = argoTokenSecretKey + } + + registration := map[string]any{"octopus": registrationOctopus} + if opts.ArgoCDWebUIURL.Value != "" { + registration["argocd"] = map[string]any{"webUiUrl": opts.ArgoCDWebUIURL.Value} + } + + return map[string]any{ + "registration": registration, + "gateway": map[string]any{ + "argocd": gatewayArgoCD, + "octopus": map[string]any{"serverGrpcUrl": opts.OctopusGRPCURL.Value}, + }, + }, nil +} + +func (opts *InstallOptions) writeValuesFile(values map[string]any) error { + if opts.OutputValues.Value == "" { + return nil + } + + encoded, err := yaml.Marshal(values) + if err != nil { + return fmt.Errorf("could not encode the Helm values: %w", err) + } + if err := os.WriteFile(opts.OutputValues.Value, encoded, 0o600); err != nil { + return fmt.Errorf("could not write %s: %w", opts.OutputValues.Value, err) + } + + fmt.Fprintf(opts.Out, "Wrote Helm values to %s\n", output.Cyan(opts.OutputValues.Value)) + if opts.InlineSecrets.Value { + fmt.Fprintf(opts.Out, "%s This file contains credentials in plain text.\n", output.Yellow("!")) + } + return nil +} + +// checkPermissions runs before anything is created, so a missing permission +// surfaces here rather than halfway through. +func (opts *InstallOptions) checkPermissions(ctx context.Context) error { + denied, err := opts.Cluster.CheckPermissions(ctx, octoK8s.InstallPermissions(opts.TargetNamespace)) + if err != nil { + return err + } + if len(denied) == 0 { + return nil + } + + var b strings.Builder + fmt.Fprintf(&b, "your Kubernetes credentials cannot perform this install in context %q:", opts.Cluster.ContextName) + for _, d := range denied { + fmt.Fprintf(&b, "\n cannot %s - needed to %s", d, d.Description) + } + + // A dry run creates nothing, so this is worth knowing but not worth + // withholding the preview for. + if opts.DryRun.Value { + fmt.Fprintf(opts.Out, "%s %s\n", output.Yellow("!"), b.String()) + return nil + } + return errors.New(b.String()) +} + +func (opts *InstallOptions) ensureNamespace(ctx context.Context) error { + exists, err := opts.Cluster.NamespaceExists(ctx, opts.TargetNamespace) + if err != nil { + return err + } + if exists { + fmt.Fprintf(opts.Out, "Using existing namespace %s\n", output.Cyan(opts.TargetNamespace)) + return nil + } + return opts.Cluster.CreateNamespace(ctx, opts.TargetNamespace) +} + +// runPreflight catches the case where an install succeeds and then never +// connects: the gateway registers over the REST API but runs over gRPC on a +// different port. +func (opts *InstallOptions) runPreflight(ctx context.Context) error { + if opts.SkipPreflight.Value { + return nil + } + + targets := []octoK8s.Target{ + { + Name: "Octopus REST API", + Address: opts.Host, + Remediation: "The gateway registers itself with Octopus over the REST API. " + + "Confirm this address is reachable from inside the cluster.", + }, + { + Name: "Octopus gRPC endpoint", + Address: opts.OctopusGRPCURL.Value, + Remediation: "The running gateway connects to Octopus over gRPC on a different port to the REST API. " + + "A load balancer, proxy, or firewall that forwards only HTTPS is the usual cause; make sure the gRPC port is forwarded too.", + }, + } + + checks := octoK8s.StaticChecks(targets) + podChecks, err := opts.Cluster.RunPreflight(ctx, octoK8s.PreflightRequest{ + Namespace: opts.TargetNamespace, + Image: opts.PreflightImage.Value, + Targets: targets, + }) + if err != nil { + return err + } + checks = append(checks, podChecks...) + + return opts.confirmPreflight(checks) +} + +func (opts *InstallOptions) printPreflight(checks []octoK8s.Check) int { + if len(checks) == 0 { + return 0 + } + + fmt.Fprintln(opts.Out, "\nConnectivity checks:") + failed := 0 + for _, c := range checks { + switch c.Result { + case octoK8s.CheckPassed: + fmt.Fprintf(opts.Out, " %s %s %s\n", output.Green("✔"), c.Name, output.Dim(c.Detail)) + case octoK8s.CheckSkipped: + fmt.Fprintf(opts.Out, " %s %s %s\n", output.Dim("-"), c.Name, output.Dim(c.Detail)) + default: + failed++ + fmt.Fprintf(opts.Out, " %s %s %s\n", output.Red("✘"), c.Name, c.Detail) + if c.Remediation != "" { + fmt.Fprintf(opts.Out, " %s\n", output.Dim(c.Remediation)) + } + } + } + + return failed +} + +func (opts *InstallOptions) confirmPreflight(checks []octoK8s.Check) error { + failed := opts.printPreflight(checks) + if failed == 0 { + return nil + } + + if opts.NoPrompt { + return fmt.Errorf("%d connectivity %s failed; fix the problems above or pass --%s", + failed, octoK8s.Pluralise("check", "checks", failed), octoK8s.FlagSkipPreflight) + } + + // A check can be wrong: egress policy may allow the real workload's service + // account but not a bare pod. + proceed := false + if err := opts.Ask(&survey.Confirm{ + Message: "Continue with the install anyway?", + Default: false, + Help: "The gateway is likely to install and then fail to connect.", + }, &proceed); err != nil { + return err + } + if !proceed { + return errors.New("install cancelled") + } + return nil +} + +// storeCredentials keeps credentials out of the Helm release values. +func (opts *InstallOptions) storeCredentials(ctx context.Context) error { + if opts.InlineSecrets.Value { + return nil + } + + projectTokens, err := opts.ProjectTokens() + if err != nil { + return err + } + + if len(projectTokens) > 0 { + // The chart reads these as environment variables prefixed with + // OCTOPUS_ARGOCD_, so the key names are part of its contract. + data := make(map[string]string, len(projectTokens)) + for _, t := range projectTokens { + data["PROJECT_AUTH_TOKEN_"+t.Project] = t.Token + } + if err := opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, projectTokenSecretName, data); err != nil { + return err + } + } else if err := opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, argoTokenSecretName, map[string]string{ + argoTokenSecretKey: opts.ArgoCDToken.Value, + }); err != nil { + return err + } + + return opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, octopusTokenSecretName, map[string]string{ + octopusTokenSecretKey: opts.OctopusCredential, + }) +} + +func (opts *InstallOptions) renderOnly(ctx context.Context, values map[string]any, timeout time.Duration) error { + fmt.Fprintf(opts.Out, "\n%s Rendering only. Nothing will be installed, and the connectivity checks that need a pod in the cluster are skipped.\n", + output.Dim("--"+octoK8s.FlagDryRun)) + + if !opts.SkipPreflight.Value { + // Report only: there is no install to abandon. + opts.printPreflight(octoK8s.StaticChecks([]octoK8s.Target{ + {Name: "Octopus REST API", Address: opts.Host}, + {Name: "Octopus gRPC endpoint", Address: opts.OctopusGRPCURL.Value}, + })) + } + + manifest, err := opts.Runner.Render(ctx, helm.InstallSpec{ + Chart: opts.chartRef(), + ReleaseName: opts.TargetRelease, + Namespace: opts.TargetNamespace, + Values: values, + Timeout: timeout, + }) + if err != nil { + return err + } + + fmt.Fprintln(opts.Out, manifest) + return nil +} + +func (opts *InstallOptions) reportSuccess(release helm.Release) { + fmt.Fprintf(opts.Out, "\n%s Installed %s %s as release %s in namespace %s.\n", + output.Green("✔"), release.Chart, release.Version, + output.Cyan(release.Name), output.Cyan(release.Namespace)) + fmt.Fprintf(opts.Out, " The gateway registers itself with Octopus, then connects. "+ + "It appears under Infrastructure > Argo CD Instances once it is healthy.\n") + + if opts.NoPrompt { + return + } + + generatable := []flag.Generatable{ + opts.Name, opts.Environments, opts.ArgoCDNamespace, opts.ArgoCDServerGRPCURL, + opts.ArgoCDToken, opts.ArgoCDProjectTokens, opts.ArgoCDWebUIURL, opts.OctopusGRPCURL, + opts.ArgoCDGRPCWeb, opts.ArgoCDGRPCWebRootPath, + opts.ArgoCDAccountName, opts.AllowSync, opts.InlineSecrets, + } + generatable = append(generatable, opts.CommonFlags.Generatable()...) + + autoCmd := flag.GenerateAutomationCmd(opts.CmdPath, opts.GetSpaceNameOrEmpty(), generatable...) + fmt.Fprintf(opts.Out, "\nAutomation Command: %s\n", autoCmd) +} diff --git a/pkg/cmd/kubernetes/gateway/install/install.go b/pkg/cmd/kubernetes/gateway/install/install.go new file mode 100644 index 00000000..74ee0786 --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/install.go @@ -0,0 +1,640 @@ +package install + +import ( + "context" + "errors" + "fmt" + "strings" + + "github.com/AlecAivazis/survey/v2" + "github.com/MakeNowJust/heredoc/v2" + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/constants" + "github.com/OctopusDeploy/cli/pkg/factory" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/question/selectors" + "github.com/OctopusDeploy/cli/pkg/util/flag" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/environments" + "github.com/spf13/cobra" +) + +var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/octopus-argocd-gateway-chart"} + +const ( + FlagName = "name" + FlagEnvironment = "environment" + FlagArgoCDNamespace = "argocd-namespace" + FlagArgoCDServerGRPCURL = "argocd-server-grpc-url" + FlagArgoCDToken = "argocd-token" + FlagArgoCDWebUIURL = "argocd-web-ui-url" + FlagOctopusGRPCURL = "octopus-grpc-url" + FlagConfigureArgoCDAccount = "configure-argocd-account" + FlagArgoCDAccountName = "argocd-account-name" + FlagAllowSync = "allow-sync" + FlagInlineSecrets = "inline-secrets" + FlagArgoCDGRPCWeb = "argocd-grpc-web" + FlagArgoCDGRPCWebRootPath = "argocd-grpc-web-root-path" + FlagArgoCDProjectToken = "argocd-project-token" +) + +// Passing credentials by Secret reference keeps them out of the Helm release +// values, out of any file written by --output-values, and out of the process +// table. +const ( + argoTokenSecretName = "octopus-argocd-gateway-argocd-token" + argoTokenSecretKey = "ARGOCD_AUTH_TOKEN" + octopusTokenSecretName = "octopus-argocd-gateway-server-token" + octopusTokenSecretKey = "OCTOPUS_SERVER_ACCESS_TOKEN" + projectTokenSecretName = "octopus-argocd-gateway-project-tokens" +) + +type InstallFlags struct { + Name *flag.Flag[string] + Environments *flag.Flag[[]string] + ArgoCDNamespace *flag.Flag[string] + ArgoCDServerGRPCURL *flag.Flag[string] + ArgoCDToken *flag.Flag[string] + ArgoCDWebUIURL *flag.Flag[string] + OctopusGRPCURL *flag.Flag[string] + ConfigureArgoCDAccount *flag.Flag[bool] + ArgoCDAccountName *flag.Flag[string] + AllowSync *flag.Flag[bool] + InlineSecrets *flag.Flag[bool] + ArgoCDGRPCWeb *flag.Flag[bool] + ArgoCDGRPCWebRootPath *flag.Flag[string] + ArgoCDProjectTokens *flag.Flag[[]string] + + *octoK8s.CommonFlags +} + +func NewInstallFlags() *InstallFlags { + return &InstallFlags{ + Name: flag.New[string](FlagName, false), + Environments: flag.New[[]string](FlagEnvironment, false), + ArgoCDNamespace: flag.New[string](FlagArgoCDNamespace, false), + ArgoCDServerGRPCURL: flag.New[string](FlagArgoCDServerGRPCURL, false), + ArgoCDToken: flag.New[string](FlagArgoCDToken, true), + ArgoCDWebUIURL: flag.New[string](FlagArgoCDWebUIURL, false), + OctopusGRPCURL: flag.New[string](FlagOctopusGRPCURL, false), + ConfigureArgoCDAccount: flag.New[bool](FlagConfigureArgoCDAccount, false), + ArgoCDAccountName: flag.New[string](FlagArgoCDAccountName, false), + AllowSync: flag.New[bool](FlagAllowSync, false), + InlineSecrets: flag.New[bool](FlagInlineSecrets, false), + ArgoCDGRPCWeb: flag.New[bool](FlagArgoCDGRPCWeb, false), + ArgoCDGRPCWebRootPath: flag.New[string](FlagArgoCDGRPCWebRootPath, false), + ArgoCDProjectTokens: flag.New[[]string](FlagArgoCDProjectToken, true), + CommonFlags: octoK8s.NewCommonFlags(), + } +} + +type InstallOptions struct { + *InstallFlags + *cmd.Dependencies + + GetAllEnvironmentsCallback selectors.GetAllEnvironmentsCallback + GetOctopusCredentialCallback func() (string, error) + + // Populated by Discover before prompting. Exported so tests can drive the + // prompt flow against a fake cluster. + Cluster *octoK8s.Cluster + Instances []argocd.Instance + Instance argocd.Instance + Runner *helm.Runner + KubeContextInfo octoK8s.Context + + TargetNamespace string + TargetRelease string + OctopusCredential string +} + +func NewInstallOptions(installFlags *InstallFlags, dependencies *cmd.Dependencies) *InstallOptions { + return &InstallOptions{ + InstallFlags: installFlags, + Dependencies: dependencies, + GetAllEnvironmentsCallback: func() ([]*environments.Environment, error) { + return selectors.GetAllEnvironments(dependencies.Client) + }, + } +} + +func NewCmdInstall(f factory.Factory) *cobra.Command { + installFlags := NewInstallFlags() + + command := &cobra.Command{ + Use: "install", + Short: "Install the Octopus Argo CD gateway", + Long: heredoc.Doc(` + Install the Octopus Argo CD gateway into a Kubernetes cluster. + + The gateway connects an Argo CD instance to Octopus. It runs in the same cluster as + Argo CD and makes an outgoing connection to Octopus, so Argo CD does not need to be + reachable from outside the cluster. + + Run without arguments to be prompted. Anything that can be read from the cluster or + from Octopus is filled in for you: the Argo CD namespace and in-cluster address, how + Argo CD is serving TLS, the Octopus server and space, and the install namespace. + `), + Example: heredoc.Docf(` + $ %[1]s kubernetes gateway install + $ %[1]s kubernetes gateway install --name production --environment Production --dry-run + $ %[1]s kubernetes gateway install --name production --environment Production --argocd-token eyJhbGci... --no-prompt + `, constants.ExecutableName), + RunE: func(c *cobra.Command, _ []string) error { + opts := NewInstallOptions(installFlags, cmd.NewDependencies(f, c)) + opts.GetOctopusCredentialCallback = func() (string, error) { return octopusCredential(f) } + return installRun(c.Context(), opts) + }, + } + + flags := command.Flags() + flags.SortFlags = false + flags.StringVarP(&installFlags.Name.Value, FlagName, "n", "", "Name for the Argo CD instance in Octopus. The namespace and Helm release name are derived from it.") + flags.StringSliceVarP(&installFlags.Environments.Value, FlagEnvironment, "e", nil, "Environment the Argo CD instance serves. Repeat for more than one.") + flags.StringVar(&installFlags.ArgoCDNamespace.Value, FlagArgoCDNamespace, "", "Namespace Argo CD is installed in. Discovered from the cluster if not set.") + flags.StringVar(&installFlags.ArgoCDServerGRPCURL.Value, FlagArgoCDServerGRPCURL, "", "In-cluster gRPC URL of the Argo CD API server. Discovered from the cluster if not set.") + flags.StringVar(&installFlags.ArgoCDToken.Value, FlagArgoCDToken, "", "Argo CD authentication token (JWT) the gateway uses to read from Argo CD.") + flags.StringVar(&installFlags.ArgoCDWebUIURL.Value, FlagArgoCDWebUIURL, "", "URL of the Argo CD web UI, used for links from Octopus. Discovered from the cluster if not set.") + flags.StringVar(&installFlags.OctopusGRPCURL.Value, FlagOctopusGRPCURL, "", "gRPC URL of your Octopus Server. Derived from the configured server URL if not set.") + flags.BoolVar(&installFlags.ConfigureArgoCDAccount.Value, FlagConfigureArgoCDAccount, false, "Create the Argo CD account and RBAC policies Octopus needs, and generate a token.") + flags.StringVar(&installFlags.ArgoCDAccountName.Value, FlagArgoCDAccountName, argocd.DefaultAccountName, "Name of the Argo CD account Octopus authenticates as.") + flags.BoolVar(&installFlags.AllowSync.Value, FlagAllowSync, true, "Allow Octopus to sync Argo CD applications, not just read them.") + flags.BoolVar(&installFlags.InlineSecrets.Value, FlagInlineSecrets, false, "Put credentials directly in the Helm values instead of in Kubernetes Secrets.") + flags.BoolVar(&installFlags.ArgoCDGRPCWeb.Value, FlagArgoCDGRPCWeb, false, "Tunnel gRPC over HTTP/1.1. Set automatically for AWS managed Argo CD, whose load balancer does not support HTTP/2.") + flags.StringVar(&installFlags.ArgoCDGRPCWebRootPath.Value, FlagArgoCDGRPCWebRootPath, "", "Root path of the Argo CD API when it is not served at the root, e.g. /argo/api.") + flags.StringArrayVar(&installFlags.ArgoCDProjectTokens.Value, FlagArgoCDProjectToken, nil, "Argo CD project role token. Repeat per project; the project is read from the token. Required for AWS managed Argo CD, which caps account token lifetimes at 12 hours.") + octoK8s.RegisterCommonFlags(command, installFlags.CommonFlags) + + return command +} + +func installRun(ctx context.Context, opts *InstallOptions) error { + if ctx == nil { + ctx = context.Background() + } + + if err := opts.resolveOctopusCredential(); err != nil { + return err + } + + if err := opts.Discover(ctx); err != nil { + return err + } + + if opts.NoPrompt { + if err := opts.validateForAutomation(); err != nil { + return err + } + if err := opts.ResolveWithoutPrompting(ctx); err != nil { + return err + } + } else { + if err := PromptMissing(ctx, opts); err != nil { + return err + } + // Most of this was worked out rather than asked for, so show all of it + // before anything is created. + if err := Confirm(ctx, opts); err != nil { + return err + } + } + + return opts.Commit(ctx) +} + +func (opts *InstallOptions) Discover(ctx context.Context) error { + kubeConfig, err := octoK8s.LoadKubeConfig(opts.KubeConfig.Value) + if err != nil { + return err + } + + for { + err := opts.connectAndDiscover(ctx, kubeConfig) + if err == nil { + return nil + } + + retry, retryErr := opts.ConfirmRetry(kubeConfig, err) + if retryErr != nil { + return retryErr + } + if !retry { + return err + } + } +} + +// connectAndDiscover holds everything that talks to the cluster, so a +// credential problem can be fixed and retried as a unit. +func (opts *InstallOptions) connectAndDiscover(ctx context.Context, kubeConfig *octoK8s.KubeConfig) error { + if err := opts.resolveKubeContext(kubeConfig); err != nil { + return err + } + + kubeContext, err := kubeConfig.FindContext(opts.KubeContext.Value) + if err != nil { + return err + } + opts.KubeContextInfo = kubeContext + + cluster, err := octoK8s.Connect(kubeConfig, opts.KubeContext.Value) + if err != nil { + return err + } + opts.Cluster = cluster + + // Building a client is offline, so this is the first call that proves the + // credentials work. Cloud clusters authenticate through a helper such as + // gcloud or aws, which fails here when its session has expired. + version, err := cluster.ServerVersion() + if err != nil { + return err + } + fmt.Fprintf(opts.Out, "Connected to %s %s\n", output.Cyan(opts.KubeContext.Value), output.Dimf("(Kubernetes %s)", version)) + + runner, err := helm.NewRunner(opts.KubeConfig.Value, opts.KubeContext.Value, opts.Out) + if err != nil { + return err + } + opts.Runner = runner + + return opts.discoverArgoCD(ctx) +} + +// ConfirmRetry avoids ending the command and discarding everything already +// answered. Expired cloud credentials are the common case, and are usually +// fixed in another terminal in seconds. +func (opts *InstallOptions) ConfirmRetry(kubeConfig *octoK8s.KubeConfig, cause error) (bool, error) { + if opts.NoPrompt { + return false, nil + } + // Nothing to retry, and no other cluster to move to. + if errors.As(cause, &argocd.ErrNoInstances{}) && len(kubeConfig.Contexts()) == 1 { + return false, nil + } + + fmt.Fprintf(opts.Out, "\n%s %v\n", output.Red("✘"), cause) + + const ( + tryAgain = "Try again" + pickOther = "Choose a different cluster" + cancel = "Cancel" + ) + + choices := []string{tryAgain} + if len(kubeConfig.Contexts()) > 1 { + choices = append(choices, pickOther) + } + choices = append(choices, cancel) + + answer := "" + if err := opts.Ask(&survey.Select{ + Message: "What would you like to do?", + Options: choices, + Help: "If a cloud credential helper failed, sign in again in another terminal and choose Try again.", + }, &answer); err != nil { + return false, err + } + + switch answer { + case tryAgain: + return true, nil + case pickOther: + // Sends resolveKubeContext back to the prompt. + opts.KubeContext.Value = "" + return true, nil + default: + return false, nil + } +} + +// discoverArgoCD covers both hosting models: Argo CD usually runs in the +// cluster, but the EKS capability runs it in the AWS control plane instead, +// where there is nothing in the cluster to find. +func (opts *InstallOptions) discoverArgoCD(ctx context.Context) error { + // A namespace given explicitly is authoritative: look there directly rather + // than relying on the labels matching anything expected. + if opts.ArgoCDNamespace.Value != "" { + instance, err := argocd.DiscoverInNamespace(ctx, opts.Cluster, opts.ArgoCDNamespace.Value) + if err != nil { + return err + } + opts.Instances = []argocd.Instance{instance} + return nil + } + + instances, err := argocd.Discover(ctx, opts.Cluster) + if err != nil && !errors.As(err, &argocd.ErrNoInstances{}) { + return err + } + + if managed, found, eksErr := argocd.DiscoverEKSManaged(ctx, opts.KubeContextInfo.EKS); found { + instances = append(instances, managed) + } else if eksErr != nil { + // Not fatal: the address can be supplied by flag or prompt instead. + fmt.Fprintf(opts.Out, "%s Could not read the EKS capabilities for this cluster: %v\n", + output.Yellow("!"), eksErr) + } + + opts.Instances = instances + + if len(instances) > 0 { + return nil + } + + // An address given by flag need not point at anything discoverable. + if opts.ArgoCDServerGRPCURL.Value != "" { + opts.Instances = []argocd.Instance{argocd.NewManagedInstance(opts.ArgoCDServerGRPCURL.Value)} + return nil + } + + // The capability may exist without being readable from here. + if opts.KubeContextInfo.EKS != nil && !opts.NoPrompt { + return nil + } + + return argocd.ErrNoInstances{} +} + +// resolveKubeContext always reports the chosen context rather than silently +// assuming one: installing into the wrong cluster is the most expensive mistake +// available here. +func (opts *InstallOptions) resolveKubeContext(kubeConfig *octoK8s.KubeConfig) error { + contexts := kubeConfig.Contexts() + if len(contexts) == 0 { + return errors.New("your kubeconfig does not contain any contexts") + } + + if opts.KubeContext.Value != "" { + if _, err := kubeConfig.FindContext(opts.KubeContext.Value); err != nil { + return err + } + return nil + } + + current, hasCurrent := kubeConfig.CurrentContext() + if opts.NoPrompt { + if !hasCurrent { + return fmt.Errorf("your kubeconfig has no current context, so --%s must be specified", octoK8s.FlagKubeContext) + } + opts.KubeContext.Value = current.Name + return nil + } + + if len(contexts) == 1 { + opts.KubeContext.Value = contexts[0].Name + return nil + } + + selected, err := selectors.Select(opts.Ask, "Which cluster should the gateway be installed into?", + func() ([]octoK8s.Context, error) { return contexts, nil }, + func(c octoK8s.Context) string { return c.Display() }) + if err != nil { + return err + } + opts.KubeContext.Value = selected.Name + return nil +} + +func (opts *InstallOptions) validateForAutomation() error { + var missing []string + if opts.Name.Value == "" { + missing = append(missing, "--"+FlagName) + } + if len(opts.Environments.Value) == 0 { + missing = append(missing, "--"+FlagEnvironment) + } + // A dry run applies nothing, so there is no credential to supply. + hasCredential := opts.ArgoCDToken.Value != "" || + len(opts.ArgoCDProjectTokens.Value) > 0 || + opts.ConfigureArgoCDAccount.Value + if !hasCredential && !opts.DryRun.Value { + missing = append(missing, fmt.Sprintf("--%s, --%s, or --%s", + FlagArgoCDToken, FlagArgoCDProjectToken, FlagConfigureArgoCDAccount)) + } + if len(missing) > 0 { + return fmt.Errorf("%s must be specified when prompting is disabled", strings.Join(missing, ", ")) + } + return nil +} + +func (opts *InstallOptions) ResolveWithoutPrompting(ctx context.Context) error { + instance, err := opts.selectInstanceByFlag() + if err != nil { + return err + } + opts.Instance = instance + opts.applyInstanceDefaults() + + if err := opts.resolveNames(); err != nil { + return err + } + + // The account and RBAC automation edits argocd-cm, which managed Argo CD + // does not have. + if opts.Instance.IsManaged() && opts.ConfigureArgoCDAccount.Value { + return fmt.Errorf("--%s cannot be used with AWS managed Argo CD, which has no in-cluster configuration to edit; "+ + "supply project role tokens with --%s instead", FlagConfigureArgoCDAccount, FlagArgoCDProjectToken) + } + + if opts.ArgoCDToken.Value == "" && opts.ConfigureArgoCDAccount.Value { + status, err := argocd.InspectAccount(ctx, opts.Cluster, opts.Instance, + argocd.AccountSpec{Name: opts.ArgoCDAccountName.Value, AllowSync: opts.AllowSync.Value}) + if err != nil { + return err + } + + token, err := ConfigureAccountAndMintToken(ctx, opts, status) + if err != nil { + return err + } + opts.ArgoCDToken.Value = token + } + + return nil +} + +func (opts *InstallOptions) selectInstanceByFlag() (argocd.Instance, error) { + if opts.ArgoCDNamespace.Value != "" { + for _, i := range opts.Instances { + if i.Namespace == opts.ArgoCDNamespace.Value { + return i, nil + } + } + return argocd.Instance{}, fmt.Errorf("no Argo CD API server was found in namespace %q", opts.ArgoCDNamespace.Value) + } + + if len(opts.Instances) > 1 { + namespaces := make([]string, 0, len(opts.Instances)) + for _, i := range opts.Instances { + namespaces = append(namespaces, i.Namespace) + } + return argocd.Instance{}, fmt.Errorf("this cluster has more than one Argo CD installation (%s), so --%s must be specified", + strings.Join(namespaces, ", "), FlagArgoCDNamespace) + } + return opts.Instances[0], nil +} + +// applyInstanceDefaults fills in whatever the user did not override. +func (opts *InstallOptions) applyInstanceDefaults() { + opts.ArgoCDNamespace.Value = opts.Instance.Namespace + if opts.ArgoCDServerGRPCURL.Value == "" { + opts.ArgoCDServerGRPCURL.Value = opts.Instance.ServerGRPCURL + } + if opts.ArgoCDWebUIURL.Value == "" { + opts.ArgoCDWebUIURL.Value = opts.Instance.WebUIURL + } + if opts.OctopusGRPCURL.Value == "" { + opts.OctopusGRPCURL.Value = octoK8s.DeriveGRPCURL(opts.Host) + } + if opts.ArgoCDAccountName.Value == "" { + opts.ArgoCDAccountName.Value = argocd.DefaultAccountName + } +} + +// resolveNames works the namespace and release name out from the display name. +func (opts *InstallOptions) resolveNames() error { + if opts.Namespace.Value != "" { + opts.TargetNamespace = opts.Namespace.Value + } else { + derived, err := octoK8s.DerivedNamespace(octoK8s.ArgoCDGatewayNamespacePrefix, opts.Name.Value) + if err != nil { + return err + } + opts.TargetNamespace = derived + } + + if opts.ReleaseName.Value != "" { + opts.TargetRelease = opts.ReleaseName.Value + } else { + derived, err := octoK8s.ReleaseName(opts.Name.Value) + if err != nil { + return err + } + opts.TargetRelease = derived + } + return nil +} + +// octopusCredential is used once by the chart's registration job; from then on +// the gateway uses its own credential. +func octopusCredential(f factory.Factory) (string, error) { + configProvider, err := f.GetConfigProvider() + if err != nil { + return "", err + } + + if apiKey := configProvider.Get(constants.ConfigApiKey); apiKey != "" { + return apiKey, nil + } + if accessToken := configProvider.Get(constants.ConfigAccessToken); accessToken != "" { + return accessToken, nil + } + + return "", fmt.Errorf("no Octopus credential is configured. Run %s login, or set %s", + constants.ExecutableName, constants.EnvOctopusApiKey) +} + +func (opts *InstallOptions) resolveOctopusCredential() error { + if opts.GetOctopusCredentialCallback == nil { + return errors.New("no Octopus credential source was configured") + } + + credential, err := opts.GetOctopusCredentialCallback() + if err != nil { + return err + } + opts.OctopusCredential = credential + return nil +} + +// Run installs the gateway using an existing set of dependencies. The +// `kubernetes install` wizard uses this to hand off after the user picks a +// component, so the two entry points share one implementation. +func Run(f factory.Factory, dependencies *cmd.Dependencies) error { + opts := NewInstallOptions(NewInstallFlags(), dependencies) + opts.GetOctopusCredentialCallback = func() (string, error) { return octopusCredential(f) } + return installRun(context.Background(), opts) +} + +// accountName is the Argo CD account, or role, Octopus authenticates as. +// Defaulted here as well as during discovery so a caller that reaches a prompt +// by another route cannot end up with a blank one. +func (opts *InstallOptions) accountName() string { + if opts.ArgoCDAccountName.Value == "" { + return argocd.DefaultAccountName + } + return opts.ArgoCDAccountName.Value +} + +func (opts *InstallOptions) useGRPCWeb() bool { + return opts.ArgoCDGRPCWeb.Value || opts.Instance.GRPCWeb +} + +func (opts *InstallOptions) ProjectTokens() ([]argocd.ProjectToken, error) { + tokens := make([]argocd.ProjectToken, 0, len(opts.ArgoCDProjectTokens.Value)) + seen := map[string]bool{} + + for _, raw := range opts.ArgoCDProjectTokens.Value { + project, token, err := splitProjectToken(raw) + if err != nil { + return nil, err + } + if seen[project] { + return nil, fmt.Errorf("more than one token was given for project %q", project) + } + seen[project] = true + + tokens = append(tokens, argocd.ProjectToken{Project: project, Token: token}) + } + return tokens, nil +} + +// splitProjectToken accepts a bare token, reading the project from its subject, +// or an explicit project=token for the rare case of overriding it. +func splitProjectToken(raw string) (project, token string, err error) { + raw = strings.TrimSpace(raw) + + if before, after, found := strings.Cut(raw, "="); found && !looksLikeToken(raw) { + project, token = strings.TrimSpace(before), strings.TrimSpace(after) + if project == "" || token == "" { + return "", "", fmt.Errorf("--%s must be a token, or project=token", FlagArgoCDProjectToken) + } + return project, token, nil + } + + claims, err := argocd.ParseProjectToken(raw) + if err != nil { + return "", "", fmt.Errorf("--%s: %w", FlagArgoCDProjectToken, err) + } + return claims.Project, raw, nil +} + +func looksLikeToken(value string) bool { + return strings.Count(value, ".") == 2 +} + +// addProjectToken records a token, working out which project it belongs to from +// the token itself. +func (opts *InstallOptions) addProjectToken(token string) error { + claims, err := argocd.ParseProjectToken(token) + if err != nil { + return err + } + if claims.Expired() { + return fmt.Errorf("this token expired on %s", claims.Expires.Format("2 Jan 2006")) + } + + for _, existing := range opts.ArgoCDProjectTokens.Value { + if project, _, err := splitProjectToken(existing); err == nil && project == claims.Project { + return fmt.Errorf("a token for project %q has already been added", claims.Project) + } + } + + opts.ArgoCDProjectTokens.Value = append(opts.ArgoCDProjectTokens.Value, token) + fmt.Fprintf(opts.Out, " %s Token accepted for project %s, role %s\n", + output.Green("✔"), output.Cyan(claims.Project), output.Cyan(claims.Role)) + return nil +} diff --git a/pkg/cmd/kubernetes/gateway/install/install_test.go b/pkg/cmd/kubernetes/gateway/install/install_test.go new file mode 100644 index 00000000..7106ce2a --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/install_test.go @@ -0,0 +1,569 @@ +package install_test + +import ( + "bytes" + "context" + "encoding/base64" + "encoding/json" + "errors" + "os" + "path/filepath" + "testing" + + "github.com/AlecAivazis/survey/v2" + + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway/install" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/OctopusDeploy/cli/test/testutil" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/environments" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/spaces" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/client-go/kubernetes/fake" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +const octopusHost = "https://my.octopus.app" + +func devEnvironment() *environments.Environment { + e := environments.NewEnvironment("Development") + e.ID = "Environments-1" + e.Slug = "development" + return e +} + +func prodEnvironment() *environments.Environment { + e := environments.NewEnvironment("Production") + e.ID = "Environments-2" + e.Slug = "production" + return e +} + +// stockInstance is what discovery reports for a default Argo CD install: TLS +// on, with Argo CD's own self-signed certificate. +func stockInstance() argocd.Instance { + return argocd.Instance{ + Namespace: "argocd", + ServiceName: "argocd-server", + Version: "v3.4.2", + ServerGRPCURL: "grpc://argocd-server.argocd.svc.cluster.local", + Plaintext: false, + SelfSignedTLS: true, + } +} + +// configuredArgoCD is a cluster whose Argo CD already has the octopus account +// and RBAC in place, so the installer only has to ask for a token. +func configuredArgoCD(objects ...runtime.Object) *octoK8s.Cluster { + base := []runtime.Object{ + &corev1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{Name: argocd.ConfigMapName, Namespace: "argocd"}, + Data: map[string]string{"accounts.octopus": "apiKey"}, + }, + &corev1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{Name: argocd.RBACConfigMapName, Namespace: "argocd"}, + Data: map[string]string{"policy.csv": ` +p, octopus, applications, get, *, allow +p, octopus, applications, sync, *, allow +p, octopus, clusters, get, *, allow +p, octopus, logs, get, */*, allow +`}, + }, + } + return octoK8s.NewClusterForTesting(fake.NewSimpleClientset(append(base, objects...)...), "test", "https://cluster") +} + +func newOptions(t *testing.T, flags *install.InstallFlags, asker func(p survey.Prompt, response interface{}, opts ...survey.AskOpt) error) *install.InstallOptions { + t.Helper() + + opts := &install.InstallOptions{ + InstallFlags: flags, + Dependencies: &cmd.Dependencies{ + Ask: asker, + Out: &bytes.Buffer{}, + Host: octopusHost, + Space: &spaces.Space{Name: "Default"}, + }, + GetAllEnvironmentsCallback: func() ([]*environments.Environment, error) { + return []*environments.Environment{devEnvironment(), prodEnvironment()}, nil + }, + Cluster: configuredArgoCD(), + Instances: []argocd.Instance{stockInstance()}, + } + opts.Space.ID = "Spaces-1" + return opts +} + +func TestPromptMissing_NoOptionsSupplied(t *testing.T) { + pa := []*testutil.PA{ + testutil.NewInputPrompt("Name", "A short, memorable, unique name for this Argo CD instance.", "Production"), + testutil.NewMultiSelectPrompt("Which environments does this Argo CD instance serve?", "", + []string{"Development", "Production"}, []string{"Production"}), + testutil.NewInputPromptWithDefault("Octopus Server gRPC address", + "The gateway holds a gRPC connection to Octopus on port 8443, separate from the REST API on 443. "+ + "If Octopus sits behind a load balancer or proxy, port 8443 must be forwarded to it.", + "grpc://my.octopus.app:8443", "grpc://my.octopus.app:8443"), + testutil.NewConfirmPromptWithDefault(`Generate an Argo CD token for the "octopus" account?`, + "Octopus needs an Argo CD token to read applications and clusters.", false, true), + testutil.NewPasswordPrompt("Argo CD authentication token", + "A JWT for an Argo CD account that can read applications, clusters and logs.", "eyJhbGciOiJIUzI1NiJ9.token"), + } + asker, checkRemainingPrompts := testutil.NewMockAsker(t, pa) + + flags := install.NewInstallFlags() + flags.ArgoCDAccountName.Value = argocd.DefaultAccountName + flags.AllowSync.Value = true + opts := newOptions(t, flags, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Equal(t, "Production", flags.Name.Value) + assert.Equal(t, []string{"production"}, flags.Environments.Value, "the environment slug is used, since it survives a rename") + assert.Equal(t, "grpc://my.octopus.app:8443", flags.OctopusGRPCURL.Value) + assert.Equal(t, "eyJhbGciOiJIUzI1NiJ9.token", flags.ArgoCDToken.Value) + + // Everything below was discovered rather than asked for. + assert.Equal(t, "argocd", flags.ArgoCDNamespace.Value) + assert.Equal(t, "grpc://argocd-server.argocd.svc.cluster.local", flags.ArgoCDServerGRPCURL.Value) + assert.Equal(t, "octo-argo-gateway-production", opts.TargetNamespace) + assert.Equal(t, "production", opts.TargetRelease) +} + +func TestPromptMissing_AllOptionsSupplied(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.Name.Value = "Production" + flags.Environments.Value = []string{"production"} + flags.ArgoCDNamespace.Value = "argocd" + flags.ArgoCDServerGRPCURL.Value = "grpc://argocd-server.argocd.svc.cluster.local" + flags.ArgoCDToken.Value = "eyJhbGciOiJIUzI1NiJ9.token" + flags.OctopusGRPCURL.Value = "grpc://my.octopus.app:8443" + flags.ArgoCDAccountName.Value = argocd.DefaultAccountName + + opts := newOptions(t, flags, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() +} + +func TestPromptMissing_DerivesNamespaceFromName(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.Name.Value = "EU West Production" + flags.Environments.Value = []string{"production"} + flags.ArgoCDNamespace.Value = "argocd" + flags.ArgoCDToken.Value = "token" + flags.OctopusGRPCURL.Value = "grpc://my.octopus.app:8443" + flags.ArgoCDAccountName.Value = argocd.DefaultAccountName + + opts := newOptions(t, flags, asker) + require.NoError(t, install.PromptMissing(context.Background(), opts)) + + assert.Equal(t, "octo-argo-gateway-eu-west-production", opts.TargetNamespace) + assert.Equal(t, "eu-west-production", opts.TargetRelease) +} + +// A cluster running Argo CD in insecure mode needs the opposite TLS settings to +// a stock install, and getting them wrong is a documented cause of a gateway +// that installs and then never connects. +func TestBuildValues_TLSSettingsFollowTheCluster(t *testing.T) { + tests := []struct { + name string + instance argocd.Instance + wantPlaintext bool + wantInsecure bool + }{ + {"stock install serves self-signed TLS", stockInstance(), false, true}, + {"insecure mode serves no TLS", argocd.Instance{ + Namespace: "argocd", + ServerGRPCURL: "grpc://argocd-server.argocd.svc.cluster.local", + Plaintext: true, + SelfSignedTLS: false, + }, true, false}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + opts := completedOptions(t) + opts.Instance = tt.instance + + values, err := opts.BuildValues() + require.NoError(t, err) + + argo := values["gateway"].(map[string]any)["argocd"].(map[string]any) + assert.Equal(t, tt.wantPlaintext, argo["plaintext"]) + assert.Equal(t, tt.wantInsecure, argo["insecure"]) + }) + } +} + +func TestBuildValues_CredentialsGoIntoSecretsByDefault(t *testing.T) { + opts := completedOptions(t) + + values, err := opts.BuildValues() + require.NoError(t, err) + + argo := values["gateway"].(map[string]any)["argocd"].(map[string]any) + octopus := values["registration"].(map[string]any)["octopus"].(map[string]any) + + assert.Equal(t, "octopus-argocd-gateway-argocd-token", argo["authenticationTokenSecretName"]) + assert.Equal(t, "ARGOCD_AUTH_TOKEN", argo["authenticationTokenSecretKey"]) + assert.Equal(t, "octopus-argocd-gateway-server-token", octopus["serverAccessTokenSecretName"]) + + assert.NotContains(t, argo, "authenticationToken", "the Argo CD JWT must not reach the Helm values") + assert.NotContains(t, octopus, "serverAccessToken", "the Octopus credential must not reach the Helm values") +} + +func TestBuildValues_InlineSecretsOptsIn(t *testing.T) { + opts := completedOptions(t) + opts.InlineSecrets.Value = true + + values, err := opts.BuildValues() + require.NoError(t, err) + + argo := values["gateway"].(map[string]any)["argocd"].(map[string]any) + octopus := values["registration"].(map[string]any)["octopus"].(map[string]any) + + assert.Equal(t, "eyJhbGciOiJIUzI1NiJ9.token", argo["authenticationToken"]) + assert.Equal(t, "API-TESTKEY", octopus["serverAccessToken"]) + assert.NotContains(t, argo, "authenticationTokenSecretName") +} + +func TestBuildValues_RegistrationDetailsComeFromOctopus(t *testing.T) { + opts := completedOptions(t) + + values, err := opts.BuildValues() + require.NoError(t, err) + + octopus := values["registration"].(map[string]any)["octopus"].(map[string]any) + assert.Equal(t, "Production", octopus["name"]) + assert.Equal(t, octopusHost, octopus["serverApiUrl"]) + assert.Equal(t, "Spaces-1", octopus["spaceId"]) + assert.Equal(t, []string{"production"}, octopus["environments"]) +} + +// The web UI URL is optional, so an Argo CD that does not advertise one should +// not produce an empty registration.argocd block. +func TestBuildValues_OmitsWebUIURLWhenUnknown(t *testing.T) { + opts := completedOptions(t) + + values, err := opts.BuildValues() + require.NoError(t, err) + assert.NotContains(t, values["registration"].(map[string]any), "argocd") + + opts.ArgoCDWebUIURL.Value = "https://argo.example.com" + values, err = opts.BuildValues() + require.NoError(t, err) + assert.Equal(t, "https://argo.example.com", + values["registration"].(map[string]any)["argocd"].(map[string]any)["webUiUrl"]) +} + +func completedOptions(t *testing.T) *install.InstallOptions { + t.Helper() + + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + flags := install.NewInstallFlags() + flags.Name.Value = "Production" + flags.Environments.Value = []string{"production"} + flags.ArgoCDServerGRPCURL.Value = "grpc://argocd-server.argocd.svc.cluster.local" + flags.ArgoCDToken.Value = "eyJhbGciOiJIUzI1NiJ9.token" + flags.OctopusGRPCURL.Value = "grpc://my.octopus.app:8443" + + opts := newOptions(t, flags, asker) + opts.Instance = stockInstance() + opts.OctopusCredential = "API-TESTKEY" + return opts +} + +func managedOptions(t *testing.T) *install.InstallOptions { + t.Helper() + + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + flags := install.NewInstallFlags() + flags.Name.Value = "EKS Production" + flags.Environments.Value = []string{"production"} + flags.OctopusGRPCURL.Value = "grpc://my.octopus.app:8443" + flags.ArgoCDServerGRPCURL.Value = "grpc://abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com" + + opts := newOptions(t, flags, asker) + opts.Instance = argocd.NewManagedInstance("abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com") + opts.Instances = []argocd.Instance{opts.Instance} + opts.OctopusCredential = "API-TESTKEY" + return opts +} + +func TestBuildValues_ManagedArgoCDUsesGRPCWebAndVerifiedTLS(t *testing.T) { + opts := managedOptions(t) + opts.ArgoCDProjectTokens.Value = []string{"default=token-a"} + + values, err := opts.BuildValues() + require.NoError(t, err) + + argo := values["gateway"].(map[string]any)["argocd"].(map[string]any) + assert.Equal(t, true, argo["grpcWeb"], "AWS's load balancer does not support HTTP/2") + assert.Equal(t, false, argo["insecure"], "AWS uses a publicly trusted certificate") + assert.Equal(t, false, argo["plaintext"]) + assert.Equal(t, "grpc://abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com", argo["serverGrpcUrl"]) +} + +func TestBuildValues_ManagedArgoCDAuthenticatesPerProject(t *testing.T) { + opts := managedOptions(t) + opts.ArgoCDProjectTokens.Value = []string{"default=token-a", "team-a=token-b"} + + values, err := opts.BuildValues() + require.NoError(t, err) + + argo := values["gateway"].(map[string]any)["argocd"].(map[string]any) + assert.Equal(t, "octopus-argocd-gateway-project-tokens", argo["projectAuthenticationSecretName"]) + assert.NotContains(t, argo, "authenticationTokenSecretName", "project tokens replace the single account token") + assert.NotContains(t, argo, "authenticationToken") +} + +func TestBuildValues_ManagedArgoCDInlineProjectTokens(t *testing.T) { + opts := managedOptions(t) + opts.ArgoCDProjectTokens.Value = []string{"default=token-a"} + opts.InlineSecrets.Value = true + + values, err := opts.BuildValues() + require.NoError(t, err) + + argo := values["gateway"].(map[string]any)["argocd"].(map[string]any) + assert.Equal(t, []argocd.ProjectToken{{Project: "default", Token: "token-a"}}, argo["projectAuthentication"]) +} + +func TestBuildValues_GRPCWebRootPath(t *testing.T) { + opts := managedOptions(t) + opts.ArgoCDProjectTokens.Value = []string{"default=token-a"} + opts.ArgoCDGRPCWebRootPath.Value = "/argo/api" + + values, err := opts.BuildValues() + require.NoError(t, err) + assert.Equal(t, "/argo/api", values["gateway"].(map[string]any)["argocd"].(map[string]any)["grpcWebRootPath"]) +} + +func TestBuildValues_InClusterOmitsGRPCWeb(t *testing.T) { + values, err := completedOptions(t).BuildValues() + require.NoError(t, err) + assert.NotContains(t, values["gateway"].(map[string]any)["argocd"].(map[string]any), "grpcWeb") +} + +func TestProjectTokens_Parsing(t *testing.T) { + opts := managedOptions(t) + opts.ArgoCDProjectTokens.Value = []string{"default=token-a", " team-a = token-b "} + + tokens, err := opts.ProjectTokens() + require.NoError(t, err) + assert.Equal(t, []argocd.ProjectToken{ + {Project: "default", Token: "token-a"}, + {Project: "team-a", Token: "token-b"}, + }, tokens) +} + +func TestProjectTokens_RejectsBadInput(t *testing.T) { + tests := map[string][]string{ + "no separator": {"default"}, + "empty project": {"=token"}, + "empty token": {"default="}, + "duplicate projet": {"default=a", "default=b"}, + } + + for name, value := range tests { + t.Run(name, func(t *testing.T) { + opts := managedOptions(t) + opts.ArgoCDProjectTokens.Value = value + + _, err := opts.ProjectTokens() + assert.Error(t, err) + }) + } +} + +// The account and RBAC automation edits argocd-cm, which managed Argo CD does +// not have. +func TestValidateForAutomation_RejectsAccountAutomationForManagedArgoCD(t *testing.T) { + opts := managedOptions(t) + opts.NoPrompt = true + opts.ConfigureArgoCDAccount.Value = true + + err := opts.ResolveWithoutPrompting(context.Background()) + require.Error(t, err) + assert.Contains(t, err.Error(), "AWS managed Argo CD") + assert.Contains(t, err.Error(), install.FlagArgoCDProjectToken) +} + +func kubeConfigWith(t *testing.T, contexts ...string) *octoK8s.KubeConfig { + t.Helper() + + body := "apiVersion: v1\nkind: Config\ncurrent-context: " + contexts[0] + "\ncontexts:\n" + for _, name := range contexts { + body += " - name: " + name + "\n context: {cluster: " + name + ", user: " + name + "}\n" + } + body += "clusters:\n" + for _, name := range contexts { + body += " - name: " + name + "\n cluster: {server: \"https://" + name + ":6443\"}\n" + } + body += "users:\n" + for _, name := range contexts { + body += " - name: " + name + "\n user: {token: abc}\n" + } + + path := filepath.Join(t.TempDir(), "config") + require.NoError(t, os.WriteFile(path, []byte(body), 0o600)) + + kubeConfig, err := octoK8s.LoadKubeConfig(path) + require.NoError(t, err) + return kubeConfig +} + +// An expired cloud credential should not end the command: the user signs in +// again in another terminal and picks up where they were. +func TestConfirmRetry_TryAgainKeepsTheChosenCluster(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPrompt("What would you like to do?", + "If a cloud credential helper failed, sign in again in another terminal and choose Try again.", + []string{"Try again", "Choose a different cluster", "Cancel"}, "Try again"), + }) + + flags := install.NewInstallFlags() + flags.KubeContext.Value = "gke-prod" + opts := newOptions(t, flags, asker) + + retry, err := opts.ConfirmRetry(kubeConfigWith(t, "gke-prod", "eks-prod"), errors.New("credentials expired")) + require.NoError(t, err) + + assert.True(t, retry) + assert.Equal(t, "gke-prod", flags.KubeContext.Value, "retrying keeps the same cluster") + checkRemainingPrompts() +} + +func TestConfirmRetry_ChoosingAnotherClusterClearsTheSelection(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPrompt("What would you like to do?", + "If a cloud credential helper failed, sign in again in another terminal and choose Try again.", + []string{"Try again", "Choose a different cluster", "Cancel"}, "Choose a different cluster"), + }) + + flags := install.NewInstallFlags() + flags.KubeContext.Value = "gke-prod" + opts := newOptions(t, flags, asker) + + retry, err := opts.ConfirmRetry(kubeConfigWith(t, "gke-prod", "eks-prod"), errors.New("credentials expired")) + require.NoError(t, err) + + assert.True(t, retry) + assert.Empty(t, flags.KubeContext.Value, "clearing the selection re-opens the cluster prompt") +} + +func TestConfirmRetry_Cancel(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPrompt("What would you like to do?", + "If a cloud credential helper failed, sign in again in another terminal and choose Try again.", + []string{"Try again", "Choose a different cluster", "Cancel"}, "Cancel"), + }) + + opts := newOptions(t, install.NewInstallFlags(), asker) + + retry, err := opts.ConfirmRetry(kubeConfigWith(t, "gke-prod", "eks-prod"), errors.New("credentials expired")) + require.NoError(t, err) + assert.False(t, retry) +} + +func TestConfirmRetry_SingleClusterOffersOnlyRetry(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPrompt("What would you like to do?", + "If a cloud credential helper failed, sign in again in another terminal and choose Try again.", + []string{"Try again", "Cancel"}, "Cancel"), + }) + + opts := newOptions(t, install.NewInstallFlags(), asker) + + _, err := opts.ConfirmRetry(kubeConfigWith(t, "only-cluster"), errors.New("credentials expired")) + require.NoError(t, err) +} + +func TestConfirmRetry_NeverPromptsWithPromptingDisabled(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{}) + + opts := newOptions(t, install.NewInstallFlags(), asker) + opts.NoPrompt = true + + retry, err := opts.ConfirmRetry(kubeConfigWith(t, "gke-prod", "eks-prod"), errors.New("credentials expired")) + require.NoError(t, err) + assert.False(t, retry) + checkRemainingPrompts() +} + +// A cluster with no Argo CD and nowhere else to look is a dead end, not +// something worth offering to retry. +func TestConfirmRetry_NoArgoCDOnTheOnlyCluster(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{}) + + opts := newOptions(t, install.NewInstallFlags(), asker) + + retry, err := opts.ConfirmRetry(kubeConfigWith(t, "only-cluster"), argocd.ErrNoInstances{}) + require.NoError(t, err) + assert.False(t, retry) + checkRemainingPrompts() +} + +// A bare token is enough: Argo CD puts the project in the subject, so the flag +// does not need to repeat it. +func TestProjectTokens_ReadsTheProjectFromTheToken(t *testing.T) { + opts := managedOptions(t) + opts.ArgoCDProjectTokens.Value = []string{ + jwtFor(t, "proj:team-a:octopus"), + jwtFor(t, "proj:team-b:octopus"), + } + + tokens, err := opts.ProjectTokens() + require.NoError(t, err) + require.Len(t, tokens, 2) + assert.Equal(t, "team-a", tokens[0].Project) + assert.Equal(t, "team-b", tokens[1].Project) +} + +func TestProjectTokens_ExplicitProjectStillWorks(t *testing.T) { + opts := managedOptions(t) + opts.ArgoCDProjectTokens.Value = []string{"team-a=opaque-token"} + + tokens, err := opts.ProjectTokens() + require.NoError(t, err) + assert.Equal(t, []argocd.ProjectToken{{Project: "team-a", Token: "opaque-token"}}, tokens) +} + +func TestProjectTokens_RejectsTwoTokensForOneProject(t *testing.T) { + opts := managedOptions(t) + opts.ArgoCDProjectTokens.Value = []string{ + jwtFor(t, "proj:team-a:octopus"), + jwtFor(t, "proj:team-a:other"), + } + + _, err := opts.ProjectTokens() + assert.ErrorContains(t, err, "team-a") +} + +func TestProjectTokens_RejectsAnAccountToken(t *testing.T) { + opts := managedOptions(t) + opts.ArgoCDProjectTokens.Value = []string{jwtFor(t, "admin:apiKey")} + + _, err := opts.ProjectTokens() + assert.ErrorContains(t, err, "project role token") +} + +func jwtFor(t *testing.T, subject string) string { + t.Helper() + + payload, err := json.Marshal(map[string]any{"iss": "argocd", "sub": subject}) + require.NoError(t, err) + + enc := base64.RawURLEncoding.EncodeToString + return enc([]byte(`{"alg":"HS256"}`)) + "." + enc(payload) + ".c2ln" +} diff --git a/pkg/cmd/kubernetes/gateway/install/prompt.go b/pkg/cmd/kubernetes/gateway/install/prompt.go new file mode 100644 index 00000000..12f22969 --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/prompt.go @@ -0,0 +1,428 @@ +package install + +import ( + "context" + "fmt" + "strings" + + "github.com/AlecAivazis/survey/v2" + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/question" + "github.com/OctopusDeploy/cli/pkg/question/selectors" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/environments" +) + +// PromptMissing guards every prompt on its flag, so supplying a flag suppresses +// the matching question and the generated automation command reproduces the run. +func PromptMissing(ctx context.Context, opts *InstallOptions) error { + // Recorded before discovery fills the rest in, so a supplied flag suppresses + // its prompt rather than merely seeding it. + suppliedOctopusGRPCURL := opts.OctopusGRPCURL.Value != "" + + if err := question.AskName(opts.Ask, "", "Argo CD instance", &opts.Name.Value); err != nil { + return err + } + + if err := opts.resolveNames(); err != nil { + return err + } + + if err := promptForEnvironments(opts); err != nil { + return err + } + + if err := promptForInstance(opts); err != nil { + return err + } + opts.applyInstanceDefaults() + + if !suppliedOctopusGRPCURL { + if err := promptForOctopusGRPCURL(opts); err != nil { + return err + } + } + + return promptForArgoCDToken(ctx, opts) +} + +func promptForEnvironments(opts *InstallOptions) error { + if len(opts.Environments.Value) > 0 { + return nil + } + + selected, err := selectors.EnvironmentsMultiSelect(opts.Ask, opts.GetAllEnvironmentsCallback, + "Which environments does this Argo CD instance serve?", true) + if err != nil { + return err + } + + for _, e := range selected { + opts.Environments.Value = append(opts.Environments.Value, environmentReference(e)) + } + return nil +} + +func environmentReference(e *environments.Environment) string { + if e.Slug != "" { + return e.Slug + } + return e.Name +} + +// promptForInstance usually has nothing to ask: discovery normally finds +// exactly one instance. +func promptForInstance(opts *InstallOptions) error { + if opts.ArgoCDNamespace.Value != "" { + instance, err := opts.selectInstanceByFlag() + if err != nil { + return err + } + opts.Instance = instance + return nil + } + + // An unreadable EKS capability still has an Argo CD behind it. + if len(opts.Instances) == 0 { + return promptForManagedEndpoint(opts) + } + + instance, err := selectors.Select(opts.Ask, "Which Argo CD instance should the gateway connect to?", + func() ([]argocd.Instance, error) { return opts.Instances, nil }, + func(i argocd.Instance) string { return i.Display() }) + if err != nil { + return err + } + opts.Instance = instance + + if instance.IsManaged() { + fmt.Fprintf(opts.Out, "AWS managed Argo CD at %s\n", output.Cyan(instance.ServerGRPCURL)) + fmt.Fprintf(opts.Out, " %s\n", output.Dim("(TLS verified, gRPC tunnelled over HTTP/1.1 - AWS's load balancer does not support HTTP/2)")) + if instance.Status != "" && !strings.EqualFold(instance.Status, "ACTIVE") { + fmt.Fprintf(opts.Out, " %s The capability is %s, so the gateway may not be able to connect yet.\n", + output.Yellow("!"), instance.Status) + } + return nil + } + + fmt.Fprintf(opts.Out, "Argo CD %s in namespace %s\n", output.Cyan(instance.Version), output.Cyan(instance.Namespace)) + fmt.Fprintf(opts.Out, " in-cluster address %s %s\n", output.Cyan(instance.ServerGRPCURL), output.Dim(tlsDescription(instance))) + return nil +} + +// tlsDescription is shown rather than decided silently: getting these wrong is +// a documented cause of a gateway that installs but never connects. +// promptForManagedEndpoint asks for the address of an Argo CD that is not +// running in this cluster, which is how the EKS capability for Argo CD works. +func promptForManagedEndpoint(opts *InstallOptions) error { + fmt.Fprintf(opts.Out, "\nNo Argo CD is running in this cluster.\n") + if opts.KubeContextInfo.EKS != nil { + fmt.Fprintf(opts.Out, " %s\n", output.Dim( + "This is an EKS cluster. If you are using the EKS capability for Argo CD, AWS runs Argo CD in its own "+ + "control plane and gives it a public address, which you can find on the cluster's Capabilities tab.")) + } + + endpoint := "" + if err := opts.Ask(&survey.Input{ + Message: "Argo CD API address", + Help: "For AWS managed Argo CD this looks like xxxxxxxx.eks-capabilities..amazonaws.com.", + }, &endpoint, survey.WithValidator(survey.Required)); err != nil { + return err + } + + opts.Instance = argocd.NewManagedInstance(endpoint) + return nil +} + +func tlsDescription(instance argocd.Instance) string { + switch { + case instance.Plaintext: + return "(Argo CD is running in insecure mode, so TLS will be disabled on this connection)" + case instance.SelfSignedTLS: + return "(TLS on, certificate verification off - Argo CD's default certificate is self-signed)" + default: + return "(TLS on)" + } +} + +func promptForOctopusGRPCURL(opts *InstallOptions) error { + // Derived from the URL the CLI is logged in to, which is nearly always + // right - but a proxy forwarding only HTTPS breaks the gateway, so confirm. + return opts.Ask(&survey.Input{ + Message: "Octopus Server gRPC address", + Default: opts.OctopusGRPCURL.Value, + Help: "The gateway holds a gRPC connection to Octopus on port 8443, separate from the REST API on 443. " + + "If Octopus sits behind a load balancer or proxy, port 8443 must be forwarded to it.", + }, &opts.OctopusGRPCURL.Value, survey.WithValidator(survey.Required)) +} + +// promptForArgoCDToken offers to do the whole thing, because creating the token +// by hand means editing two ConfigMaps and running the Argo CD CLI. +func promptForArgoCDToken(ctx context.Context, opts *InstallOptions) error { + if opts.ArgoCDToken.Value != "" { + return nil + } + + // A dry run never reaches Argo CD, so there is no need to find a token. + if opts.DryRun.Value { + return nil + } + + // Managed Argo CD has no argocd-cm to edit, and authenticates with project + // role tokens because AWS caps account tokens at 12 hours. + if opts.Instance.IsManaged() { + return promptForProjectTokens(opts) + } + + spec := argocd.AccountSpec{Name: opts.accountName(), AllowSync: opts.AllowSync.Value} + status, err := argocd.InspectAccount(ctx, opts.Cluster, opts.Instance, spec) + if err != nil { + return err + } + + fmt.Fprintf(opts.Out, "\n%s\n", status.Summary()) + + if !opts.ConfigureArgoCDAccount.Value { + if err := askToConfigureAccount(opts, status); err != nil { + return err + } + } + + if !opts.ConfigureArgoCDAccount.Value { + printManualTokenInstructions(opts, status) + return askForTokenValue(opts) + } + + token, err := ConfigureAccountAndMintToken(ctx, opts, status) + if err != nil { + fmt.Fprintf(opts.Out, "\n%s Could not set Argo CD up automatically: %v\n", output.Yellow("!"), err) + opts.ConfigureArgoCDAccount.Value = false + printManualTokenInstructions(opts, status) + return askForTokenValue(opts) + } + + opts.ArgoCDToken.Value = token + return nil +} + +func askToConfigureAccount(opts *InstallOptions, status argocd.AccountStatus) error { + message := fmt.Sprintf("Generate an Argo CD token for the %q account?", status.Spec.Name) + help := "Octopus needs an Argo CD token to read applications and clusters." + + if !status.IsComplete() { + fmt.Fprintf(opts.Out, "\nThese changes would be made to your Argo CD configuration:\n%s", + argocd.AccountPatchPlan(opts.Instance.Namespace, status)) + message = "Apply these changes and generate a token?" + help = "Existing accounts and RBAC rules are left alone; only the entries shown above are added." + } + + return opts.Ask(&survey.Confirm{Message: message, Default: true, Help: help}, &opts.ConfigureArgoCDAccount.Value) +} + +func askForTokenValue(opts *InstallOptions) error { + return opts.Ask(&survey.Password{ + Message: "Argo CD authentication token", + Help: "A JWT for an Argo CD account that can read applications, clusters and logs.", + }, &opts.ArgoCDToken.Value, survey.WithValidator(survey.Required)) +} + +// printManualTokenInstructions makes declining the automation a real choice +// rather than a dead end. +func printManualTokenInstructions(opts *InstallOptions, status argocd.AccountStatus) { + if status.IsComplete() { + fmt.Fprintf(opts.Out, "\nGenerate a token with:\n %s\n\n", + output.Cyan(fmt.Sprintf("argocd account generate-token --account %s", status.Spec.Name))) + return + } + + namespace := opts.Instance.Namespace + fmt.Fprintf(opts.Out, "\nTo set this up by hand:\n") + if !status.HasAPIKeyCapability || status.Disabled { + fmt.Fprintf(opts.Out, " %s\n", output.Cyan(fmt.Sprintf( + "kubectl patch cm %s -n %s --type merge -p '{\"data\":{\"accounts.%s\":\"apiKey\",\"accounts.%s.enabled\":\"true\"}}'", + argocd.ConfigMapName, namespace, status.Spec.Name, status.Spec.Name))) + } + if len(status.MissingPolicies) > 0 { + fmt.Fprintf(opts.Out, " %s\n", output.Dim(fmt.Sprintf( + "# add these lines to policy.csv in the %s/%s ConfigMap:", namespace, argocd.RBACConfigMapName))) + for _, p := range status.MissingPolicies { + fmt.Fprintf(opts.Out, " %s\n", output.Cyan(" "+p)) + } + } + fmt.Fprintf(opts.Out, " %s\n\n", output.Cyan(fmt.Sprintf("argocd account generate-token --account %s", status.Spec.Name))) +} + +func promptForProjectTokens(opts *InstallOptions) error { + if len(opts.ArgoCDProjectTokens.Value) > 0 { + return nil + } + + projects, err := prepareProjectRoles(opts) + if err != nil { + return err + } + + printProjectTokenPreamble(opts) + + if len(projects) == 0 { + return promptForUnknownProjectTokens(opts) + } + + for _, project := range projects { + if err := promptForProjectToken(opts, project); err != nil { + return err + } + } + return nil +} + +// promptForProjectToken links straight at the role that needs the token, then +// takes it. +func promptForProjectToken(opts *InstallOptions, project string) error { + role := opts.accountName() + + fmt.Fprintf(opts.Out, "\n%s\n", output.Bold("Project "+project)) + if url := argocd.ProjectRolePageURL(opts.Instance.WebUIURL, project, role); url != "" { + fmt.Fprintf(opts.Out, " %s\n", output.Blue(url)) + } + fmt.Fprintf(opts.Out, " %s\n", + output.Dimf("or: argocd proj role create-token %s %s", project, role)) + + for { + token := "" + if err := opts.Ask(&survey.Password{ + Message: fmt.Sprintf("Token for project %s", project), + }, &token, survey.WithValidator(survey.Required)); err != nil { + return err + } + + claims, err := argocd.ParseProjectToken(token) + switch { + case err != nil: + fmt.Fprintf(opts.Out, " %s %v\n", output.Red("✘"), err) + continue + case claims.Project != project: + fmt.Fprintf(opts.Out, " %s That token is for project %s, not %s.\n", + output.Red("✘"), output.Cyan(claims.Project), output.Cyan(project)) + continue + case claims.Expired(): + fmt.Fprintf(opts.Out, " %s That token expired on %s.\n", + output.Red("✘"), claims.Expires.Format("2 Jan 2006")) + continue + } + + opts.ArgoCDProjectTokens.Value = append(opts.ArgoCDProjectTokens.Value, token) + return nil + } +} + +// promptForUnknownProjectTokens is the fallback for an Argo CD whose projects +// could not be read, where the project can only come from the token itself. +func promptForUnknownProjectTokens(opts *InstallOptions) error { + fmt.Fprintf(opts.Out, " %s\n\n", output.Dimf( + "argocd proj role create-token %s", opts.ArgoCDAccountName.Value)) + + for { + token := "" + if err := opts.Ask(&survey.Password{ + Message: "Argo CD project role token", + Help: "Which project it belongs to is read from the token itself.", + }, &token, survey.WithValidator(survey.Required)); err != nil { + return err + } + + if err := opts.addProjectToken(token); err != nil { + fmt.Fprintf(opts.Out, " %s %v\n", output.Red("✘"), err) + continue + } + + another := false + if err := opts.Ask(&survey.Confirm{ + Message: "Add a token for another project?", + Default: false, + }, &another); err != nil { + return err + } + if !another { + return nil + } + } +} + +// prepareProjectRoles creates the role Octopus authenticates as on the chosen +// projects, and reports which they are. AWS signs the tokens themselves, but +// the role and its policies live in the AppProject in the cluster. +func prepareProjectRoles(opts *InstallOptions) ([]string, error) { + ctx := context.Background() + + projects, err := argocd.ListProjects(ctx, opts.Cluster, opts.Instance.Namespace) + if err != nil || len(projects) == 0 { + // Without the projects there is nothing to offer; the tokens can still + // be pasted in. + return nil, err + } + + selected, err := question.MultiSelectMap(opts.Ask, + "Which Argo CD projects should Octopus see?", projects, + func(p argocd.Project) string { return p.Display() }, true) + if err != nil { + return nil, err + } + + names := make([]string, 0, len(selected)) + statuses := make([]argocd.ProjectRoleStatus, 0, len(selected)) + for _, project := range selected { + names = append(names, project.Name) + + status, err := argocd.InspectProjectRole(ctx, opts.Cluster, opts.Instance.Namespace, + argocd.ProjectRoleSpec{ + Project: project.Name, + Role: opts.accountName(), + AllowSync: opts.AllowSync.Value, + }) + if err != nil { + return nil, err + } + statuses = append(statuses, status) + } + + plan := argocd.ProjectRolePatchPlan(opts.Instance.Namespace, statuses) + if plan == "" { + fmt.Fprintf(opts.Out, "\nEvery chosen project already grants Octopus what it needs.\n") + return names, nil + } + + fmt.Fprintf(opts.Out, "\nThese changes would be made to your Argo CD projects:\n%s", plan) + + proceed := false + if err := opts.Ask(&survey.Confirm{ + Message: "Apply these?", + Default: true, + Help: "Other roles on these projects are left alone.", + }, &proceed); err != nil { + return nil, err + } + if !proceed { + return names, nil + } + + for _, status := range statuses { + if err := argocd.EnsureProjectRole(ctx, opts.Cluster, opts.Instance.Namespace, status); err != nil { + return nil, err + } + } + fmt.Fprintf(opts.Out, "%s Argo CD projects updated\n", output.Green("✔")) + return names, nil +} + +func printProjectTokenPreamble(opts *InstallOptions) { + fmt.Fprintf(opts.Out, "\nAWS signs Argo CD tokens in its own control plane, so Octopus cannot generate\n"+ + "these for you. Each one is a project role token, because AWS caps account\n"+ + "tokens at 12 hours.\n") +} + +// PromptForProjectTokenForTest exposes the per-project prompt so its output can +// be asserted on. +func PromptForProjectTokenForTest(opts *InstallOptions, project string) error { + return promptForProjectToken(opts, project) +} diff --git a/pkg/cmd/kubernetes/gateway/install/review.go b/pkg/cmd/kubernetes/gateway/install/review.go new file mode 100644 index 00000000..23af0287 --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/review.go @@ -0,0 +1,403 @@ +package install + +import ( + "context" + "errors" + "fmt" + "strings" + + "github.com/AlecAivazis/survey/v2" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/question" +) + +type reviewItem struct { + Label string + Value string + // Source distinguishes a detected value from one that was typed. + Source string + // A nil Edit means the value can only be changed by starting again. + Edit func(context.Context, *InstallOptions) error +} + +type reviewGroup struct { + Title string + Items []reviewItem +} + +// Confirm shows every setting, detected or chosen. Most are worked out rather +// than asked for, which is the point of the wizard, but it also means nobody +// sees them unless they are shown. +func Confirm(ctx context.Context, opts *InstallOptions) error { + for { + groups := reviewGroups(opts) + printReview(opts, groups) + + const ( + install = "Install" + change = "Change a setting" + cancel = "Cancel" + ) + + answer := "" + if err := opts.Ask(&survey.Select{ + Message: "Ready to install?", + Options: []string{install, change, cancel}, + }, &answer); err != nil { + return err + } + + switch answer { + case install: + return nil + case cancel: + return errors.New("install cancelled") + } + + if err := editSetting(ctx, opts, groups); err != nil { + return err + } + } +} + +func editSetting(ctx context.Context, opts *InstallOptions, groups []reviewGroup) error { + type editable struct { + label string + edit func(context.Context, *InstallOptions) error + } + + var choices []editable + for _, group := range groups { + for _, item := range group.Items { + if item.Edit != nil { + choices = append(choices, editable{label: group.Title + ": " + item.Label, edit: item.Edit}) + } + } + } + + selected, err := question.SelectMap(opts.Ask, "Which setting?", choices, + func(e editable) string { return e.label }) + if err != nil { + return err + } + + if err := selected.edit(ctx, opts); err != nil { + return err + } + + // The namespace and release name follow the instance name unless set + // explicitly, so they need working out again. + return opts.resolveNames() +} + +func printReview(opts *InstallOptions, groups []reviewGroup) { + width := 0 + for _, group := range groups { + for _, item := range group.Items { + if len(item.Label) > width { + width = len(item.Label) + } + } + } + + fmt.Fprintf(opts.Out, "\n%s\n", output.Bold("Review the installation")) + for _, group := range groups { + fmt.Fprintf(opts.Out, "\n %s\n", output.Bold(group.Title)) + for _, item := range group.Items { + fmt.Fprintf(opts.Out, " %-*s %s", width, item.Label, output.Cyan(item.Value)) + // An unset value has no source worth claiming. + if item.Source != "" && !strings.HasPrefix(item.Value, "(") { + fmt.Fprintf(opts.Out, " %s", output.Dimf("(%s)", item.Source)) + } + fmt.Fprintln(opts.Out) + } + } + fmt.Fprintln(opts.Out) +} + +func reviewGroups(opts *InstallOptions) []reviewGroup { + return []reviewGroup{ + {Title: "Cluster", Items: clusterItems(opts)}, + {Title: "Octopus", Items: octopusItems(opts)}, + {Title: "Argo CD", Items: argoItems(opts)}, + {Title: "Helm", Items: helmItems(opts)}, + } +} + +func clusterItems(opts *InstallOptions) []reviewItem { + context := opts.KubeContextInfo + source := "current context" + if opts.KubeContext.Value != "" && !context.IsCurrent { + source = "chosen" + } + + return []reviewItem{ + { + Label: "Kubernetes context", + Value: opts.KubeContext.Value, + Source: source, + // Changing cluster invalidates everything discovered from it. + Edit: nil, + }, + {Label: "Cluster address", Value: context.Server, Source: "from the kubeconfig"}, + { + Label: "Namespace", + Value: opts.TargetNamespace, + Source: derivedOrSet(opts.Namespace.Value, "derived from the name"), + Edit: editText(&opts.Namespace.Value, "Namespace to install into", func(o *InstallOptions) string { return o.TargetNamespace }), + }, + { + Label: "Helm release", + Value: opts.TargetRelease, + Source: derivedOrSet(opts.ReleaseName.Value, "derived from the name"), + Edit: editText(&opts.ReleaseName.Value, "Helm release name", func(o *InstallOptions) string { return o.TargetRelease }), + }, + } +} + +func octopusItems(opts *InstallOptions) []reviewItem { + return []reviewItem{ + { + Label: "Name", Value: opts.Name.Value, Source: "chosen", + Edit: func(_ context.Context, o *InstallOptions) error { + o.Name.Value = "" + return question.AskName(o.Ask, "", "Argo CD instance", &o.Name.Value) + }, + }, + { + Label: "Environments", Value: strings.Join(opts.Environments.Value, ", "), Source: "chosen", + Edit: func(_ context.Context, o *InstallOptions) error { + o.Environments.Value = nil + return promptForEnvironments(o) + }, + }, + {Label: "Server", Value: opts.Host, Source: "from your login"}, + {Label: "Space", Value: opts.Space.Name, Source: "from your login"}, + { + Label: "gRPC address", Value: opts.OctopusGRPCURL.Value, Source: "derived from the server address", + Edit: editText(&opts.OctopusGRPCURL.Value, "Octopus Server gRPC address", + func(o *InstallOptions) string { return o.OctopusGRPCURL.Value }), + }, + } +} + +func argoItems(opts *InstallOptions) []reviewItem { + instance := opts.Instance + + items := []reviewItem{ + {Label: "Instance", Value: instance.Display(), Source: instanceSource(instance)}, + { + Label: "Address", Value: opts.ArgoCDServerGRPCURL.Value, Source: "found in the cluster", + Edit: editText(&opts.ArgoCDServerGRPCURL.Value, "Argo CD address", + func(o *InstallOptions) string { return o.ArgoCDServerGRPCURL.Value }), + }, + { + Label: "Connection", Value: connectionSummary(opts), Source: "matched to the instance", + Edit: editConnection, + }, + { + Label: "Web UI", Value: orNotSet(opts.ArgoCDWebUIURL.Value), Source: "found in the cluster", + Edit: editText(&opts.ArgoCDWebUIURL.Value, "Argo CD web UI address (optional)", + func(o *InstallOptions) string { return o.ArgoCDWebUIURL.Value }), + }, + } + + if instance.IsManaged() { + items = append(items, reviewItem{ + Label: "Project tokens", + Value: projectTokenSummary(opts), + Source: "AWS caps account tokens at 12 hours", + Edit: func(_ context.Context, o *InstallOptions) error { + o.ArgoCDProjectTokens.Value = nil + return promptForProjectTokens(o) + }, + }) + return items + } + + return append(items, + reviewItem{ + Label: "Account", + Value: opts.ArgoCDAccountName.Value, + Source: accountSource(opts), + }, + reviewItem{ + Label: "Token", + Value: maskedToken(opts.ArgoCDToken.Value), + Source: tokenSource(opts), + Edit: func(_ context.Context, o *InstallOptions) error { + o.ArgoCDToken.Value = "" + return askForTokenValue(o) + }, + }, + ) +} + +func helmItems(opts *InstallOptions) []reviewItem { + return []reviewItem{ + { + Label: "Chart", Value: ChartRef.Ref, Source: "", + }, + { + Label: "Chart version", Value: orDefault(opts.ChartVersion.Value, "latest"), Source: "", + Edit: editText(&opts.ChartVersion.Value, "Chart version (blank for the latest)", + func(o *InstallOptions) string { return o.ChartVersion.Value }), + }, + { + Label: "Credentials", Value: credentialPlacement(opts), Source: "", + Edit: func(_ context.Context, o *InstallOptions) error { + return o.Ask(&survey.Confirm{ + Message: "Put credentials directly in the Helm values instead of Kubernetes Secrets?", + Default: o.InlineSecrets.Value, + Help: "Secrets keep credentials out of the Helm release and out of any file written with --output-values.", + }, &o.InlineSecrets.Value) + }, + }, + { + Label: "Timeout", Value: orDefault(opts.Timeout.Value, octoK8s.DefaultTimeout.String()), Source: "", + Edit: editText(&opts.Timeout.Value, "How long to wait for the release to become ready", + func(o *InstallOptions) string { return o.Timeout.Value }), + }, + } +} + +func editText(target *string, message string, current func(*InstallOptions) string) func(context.Context, *InstallOptions) error { + return func(_ context.Context, o *InstallOptions) error { + value := current(o) + if err := o.Ask(&survey.Input{Message: message, Default: value}, &value); err != nil { + return err + } + *target = strings.TrimSpace(value) + return nil + } +} + +// editConnection covers the three settings that are the documented cause of a +// gateway that installs and then never connects. +func editConnection(_ context.Context, o *InstallOptions) error { + const ( + plaintext = "Argo CD is served without TLS" + selfSign = "Argo CD uses a certificate that is not publicly trusted" + grpcWeb = "Tunnel gRPC over HTTP/1.1 (needed when a load balancer has no HTTP/2)" + ) + + var current []string + if o.Instance.Plaintext { + current = append(current, plaintext) + } + if o.Instance.SelfSignedTLS { + current = append(current, selfSign) + } + if o.useGRPCWeb() { + current = append(current, grpcWeb) + } + + var chosen []string + prompt := &survey.MultiSelect{ + Message: "How does the gateway reach Argo CD?", + Options: []string{plaintext, selfSign, grpcWeb}, + Default: current, + } + if err := o.Ask(prompt, &chosen); err != nil { + return err + } + + selected := map[string]bool{} + for _, c := range chosen { + selected[c] = true + } + + o.Instance.Plaintext = selected[plaintext] + o.Instance.SelfSignedTLS = selected[selfSign] + o.Instance.GRPCWeb = selected[grpcWeb] + o.ArgoCDGRPCWeb.Value = selected[grpcWeb] + return nil +} + +func connectionSummary(opts *InstallOptions) string { + var parts []string + if opts.Instance.Plaintext { + parts = append(parts, "no TLS") + } else if opts.Instance.SelfSignedTLS { + parts = append(parts, "TLS, certificate not verified") + } else { + parts = append(parts, "TLS, certificate verified") + } + if opts.useGRPCWeb() { + parts = append(parts, "gRPC-Web") + } + return strings.Join(parts, ", ") +} + +func instanceSource(instance argocd.Instance) string { + if instance.IsManaged() { + return "AWS managed, found through the EKS API" + } + return "found in the cluster" +} + +func accountSource(opts *InstallOptions) string { + if opts.ConfigureArgoCDAccount.Value { + return "created by Octopus" + } + return "existing" +} + +func tokenSource(opts *InstallOptions) string { + if opts.ConfigureArgoCDAccount.Value { + return "generated" + } + return "supplied" +} + +func projectTokenSummary(opts *InstallOptions) string { + tokens, err := opts.ProjectTokens() + if err != nil || len(tokens) == 0 { + return "(none)" + } + + projects := make([]string, 0, len(tokens)) + for _, t := range tokens { + projects = append(projects, t.Project) + } + return strings.Join(projects, ", ") +} + +func credentialPlacement(opts *InstallOptions) string { + if opts.InlineSecrets.Value { + return "in the Helm values" + } + return "in Kubernetes Secrets" +} + +func maskedToken(token string) string { + if token == "" { + return "(not set)" + } + return "***" +} + +func derivedOrSet(explicit, derivedDescription string) string { + if explicit != "" { + return "set" + } + return derivedDescription +} + +func orNotSet(value string) string { + return orDefault(value, "(not set)") +} + +func orDefault(value, fallback string) string { + if strings.TrimSpace(value) == "" { + return fallback + } + return value +} + +func RenderReviewForDemo(opts *InstallOptions) { + _ = opts.resolveNames() + printReview(opts, reviewGroups(opts)) +} diff --git a/pkg/cmd/kubernetes/gateway/install/review_test.go b/pkg/cmd/kubernetes/gateway/install/review_test.go new file mode 100644 index 00000000..f16667e5 --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/review_test.go @@ -0,0 +1,211 @@ +package install_test + +import ( + "bytes" + "encoding/base64" + "encoding/json" + "strings" + "testing" + + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway/install" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/OctopusDeploy/cli/test/testutil" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/spaces" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func reviewOf(t *testing.T, opts *install.InstallOptions) string { + t.Helper() + + out := &bytes.Buffer{} + opts.Out = out + install.RenderReviewForDemo(opts) + return out.String() +} + +func reviewOptions(t *testing.T) *install.InstallOptions { + t.Helper() + + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.Name.Value = "Production" + flags.Environments.Value = []string{"production", "staging"} + flags.KubeContext.Value = "colima-k8s" + flags.OctopusGRPCURL.Value = "grpc://my.octopus.app:8443" + flags.ArgoCDServerGRPCURL.Value = "grpc://argocd-server.argocd.svc.cluster.local" + flags.ArgoCDToken.Value = "eyJhbGciOiJIUzI1NiJ9.super-secret-token" + flags.ArgoCDAccountName.Value = argocd.DefaultAccountName + + space := &spaces.Space{Name: "Default"} + space.ID = "Spaces-1" + + opts := &install.InstallOptions{ + InstallFlags: flags, + Dependencies: &cmd.Dependencies{Ask: asker, Out: &bytes.Buffer{}, Host: "https://my.octopus.app", Space: space}, + Instance: stockInstance(), + KubeContextInfo: octoK8s.Context{ + Name: "colima-k8s", Server: "https://192.168.64.4:52409", IsCurrent: true, + }, + } + return opts +} + +// Almost everything here is worked out rather than asked for, so the review is +// the only place a person sees it before anything is created. +func TestReview_ShowsEveryDetectedSetting(t *testing.T) { + review := reviewOf(t, reviewOptions(t)) + + for _, expected := range []string{ + "colima-k8s", // chosen cluster + "https://192.168.64.4:52409", // detected cluster address + "octo-argo-gateway-production", // derived namespace + "production", // derived release name + "https://my.octopus.app", // from the login + "Default", // space + "grpc://my.octopus.app:8443", // derived + "grpc://argocd-server.argocd.svc.cluster.local", // detected + "v3.4.2", // detected Argo CD version + "TLS, certificate not verified", // detected TLS posture + "in Kubernetes Secrets", // where credentials go + } { + assert.Contains(t, review, expected) + } +} + +// The review is printed to the terminal, so a token must not appear in it. +func TestReview_MasksTheToken(t *testing.T) { + review := reviewOf(t, reviewOptions(t)) + + assert.NotContains(t, review, "super-secret-token") + assert.Contains(t, review, "***") +} + +// Saying where a value came from is what lets someone spot a wrong guess. +func TestReview_SaysWhereValuesCameFrom(t *testing.T) { + review := reviewOf(t, reviewOptions(t)) + + assert.Contains(t, review, "(derived from the name)") + assert.Contains(t, review, "(found in the cluster)") + assert.Contains(t, review, "(from your login)") +} + +// Claiming a source for something that was never found reads as a detection +// that succeeded. +func TestReview_ClaimsNoSourceForAnUnsetValue(t *testing.T) { + review := reviewOf(t, reviewOptions(t)) + + for _, line := range strings.Split(review, "\n") { + if strings.Contains(line, "Web UI") { + assert.Contains(t, line, "(not set)") + assert.NotContains(t, line, "found in the cluster") + } + } +} + +func TestReview_ManagedArgoCDShowsProjectTokensNotAnAccount(t *testing.T) { + opts := reviewOptions(t) + opts.Instance = argocd.NewManagedInstance("abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com") + opts.ArgoCDServerGRPCURL.Value = opts.Instance.ServerGRPCURL + opts.ArgoCDProjectTokens.Value = []string{"default=token-a", "team-a=token-b"} + + review := reviewOf(t, opts) + + assert.Contains(t, review, "AWS managed") + assert.Contains(t, review, "gRPC-Web") + assert.Contains(t, review, "default, team-a", "the projects are listed") + assert.NotContains(t, review, "token-a", "the tokens themselves are not") + assert.NotContains(t, review, "Account", "a managed instance has no Octopus-managed account") +} + +func TestReview_DistinguishesAnExplicitNamespace(t *testing.T) { + opts := reviewOptions(t) + opts.Namespace.Value = "my-own-namespace" + + review := reviewOf(t, opts) + + assert.Contains(t, review, "my-own-namespace") + for _, line := range strings.Split(review, "\n") { + if strings.Contains(line, "Namespace") { + assert.NotContains(t, line, "derived") + } + } +} + +// Linking at the instance leaves someone to find the project and role +// themselves, which is the whole point of the link. +func TestPromptForProjectToken_LinksAtTheRoleNotTheInstance(t *testing.T) { + const endpoint = "abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com" + + out := &bytes.Buffer{} + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewPasswordPrompt("Token for project team-a", "", projectJWT(t, "proj:team-a:octopus")), + }) + + opts := reviewOptions(t) + opts.Ask = asker + opts.Out = out + opts.Instance = argocd.NewManagedInstance(endpoint) + opts.Instance.WebUIURL = "https://" + endpoint + + require.NoError(t, install.PromptForProjectTokenForTest(opts, "team-a")) + checkRemainingPrompts() + + assert.Contains(t, out.String(), + "https://"+endpoint+"/settings/projects/team-a?editRole=octopus&tab=roles") + assert.Contains(t, out.String(), "argocd proj role create-token team-a octopus") +} + +// The account name is defaulted during discovery, but a blank one must not +// silently degrade the link back to the instance. +func TestPromptForProjectToken_LinksCorrectlyWithoutAnExplicitAccountName(t *testing.T) { + out := &bytes.Buffer{} + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewPasswordPrompt("Token for project default", "", projectJWT(t, "proj:default:octopus")), + }) + + opts := reviewOptions(t) + opts.Ask = asker + opts.Out = out + opts.ArgoCDAccountName.Value = "" + opts.Instance = argocd.NewManagedInstance("x.example.com") + opts.Instance.WebUIURL = "https://x.example.com" + + require.NoError(t, install.PromptForProjectTokenForTest(opts, "default")) + + assert.Contains(t, out.String(), "?editRole=octopus&tab=roles") +} + +// A token pasted for the wrong project is caught rather than stored. +func TestPromptForProjectToken_RejectsATokenForAnotherProject(t *testing.T) { + out := &bytes.Buffer{} + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewPasswordPrompt("Token for project team-a", "", projectJWT(t, "proj:team-b:octopus")), + testutil.NewPasswordPrompt("Token for project team-a", "", projectJWT(t, "proj:team-a:octopus")), + }) + + opts := reviewOptions(t) + opts.Ask = asker + opts.Out = out + opts.Instance = argocd.NewManagedInstance("x.example.com") + opts.Instance.WebUIURL = "https://x.example.com" + + require.NoError(t, install.PromptForProjectTokenForTest(opts, "team-a")) + checkRemainingPrompts() + + assert.Contains(t, out.String(), "That token is for project") + require.Len(t, opts.ArgoCDProjectTokens.Value, 1) +} + +func projectJWT(t *testing.T, subject string) string { + t.Helper() + + payload, err := json.Marshal(map[string]any{"iss": "argocd", "sub": subject}) + require.NoError(t, err) + + enc := base64.RawURLEncoding.EncodeToString + return enc([]byte(`{"alg":"HS256"}`)) + "." + enc(payload) + ".c2ln" +} diff --git a/pkg/cmd/kubernetes/gateway/install/signin_test.go b/pkg/cmd/kubernetes/gateway/install/signin_test.go new file mode 100644 index 00000000..48b66b74 --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/signin_test.go @@ -0,0 +1,117 @@ +package install_test + +import ( + "context" + "errors" + "io" + "testing" + + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway/install" + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// acceptOnly refuses every credential except the one it is given, standing in +// for an Argo CD that no longer accepts the initial admin password. +type acceptOnly struct { + password string + tried []string +} + +func (a *acceptOnly) Login(_ context.Context, credentials argocd.Credentials) error { + a.tried = append(a.tried, credentials.Username) + if credentials.Password != a.password { + return errors.New("Argo CD returned 401 Unauthorized: Invalid username or password") + } + return nil +} + +func strategy(name, username, password string, reverted *bool) install.LoginStrategy { + return install.LoginStrategy{ + Describe: name, + Begin: func(context.Context) (argocd.Credentials, func(), error) { + return argocd.Credentials{Username: username, Password: password}, + func() { *reverted = true }, nil + }, + } +} + +// Argo CD leaves argocd-initial-admin-secret in place when the admin password +// is changed, so a rejection there must not end the whole install. +func TestSignIn_MovesOnWhenACredentialIsRejected(t *testing.T) { + client := &acceptOnly{password: "the-real-one"} + var firstReverted, secondReverted bool + + revert, err := install.SignIn(context.Background(), io.Discard, client, []install.LoginStrategy{ + strategy("the initial admin password", "admin", "stale", &firstReverted), + strategy("a temporary password on the octopus account", "octopus", "the-real-one", &secondReverted), + }) + + require.NoError(t, err) + assert.Equal(t, []string{"admin", "octopus"}, client.tried) + + // A strategy that was tried and turned away has to undo itself; the one + // that worked is undone by the caller once it is finished with. + assert.True(t, firstReverted, "a rejected strategy must clean up after itself") + assert.False(t, secondReverted) + + require.NotNil(t, revert) + revert() + assert.True(t, secondReverted) +} + +// A strategy that cannot even produce a credential is skipped just the same. +func TestSignIn_MovesOnWhenAStrategyCannotStart(t *testing.T) { + client := &acceptOnly{password: "the-real-one"} + var reverted bool + + _, err := install.SignIn(context.Background(), io.Discard, client, []install.LoginStrategy{ + { + Describe: "the initial admin password", + Begin: func(context.Context) (argocd.Credentials, func(), error) { + return argocd.Credentials{}, nil, errors.New("the secret is not present") + }, + }, + strategy("a temporary password", "octopus", "the-real-one", &reverted), + }) + + require.NoError(t, err) + assert.Equal(t, []string{"octopus"}, client.tried) +} + +// When nothing is accepted, every attempt is reported rather than just the last. +func TestSignIn_ReportsEveryAttempt(t *testing.T) { + client := &acceptOnly{password: "nothing matches this"} + var reverted bool + + _, err := install.SignIn(context.Background(), io.Discard, client, []install.LoginStrategy{ + strategy("the initial admin password", "admin", "stale", &reverted), + { + Describe: "a temporary password on the octopus account", + Begin: func(context.Context) (argocd.Credentials, func(), error) { + return argocd.Credentials{}, nil, errors.New("this Argo CD is managed by an operator") + }, + }, + }) + + require.Error(t, err) + assert.Contains(t, err.Error(), "the initial admin password") + assert.Contains(t, err.Error(), "Invalid username or password") + assert.Contains(t, err.Error(), "managed by an operator") + assert.True(t, reverted) +} + +func TestSignIn_StopsAtTheFirstThatWorks(t *testing.T) { + client := &acceptOnly{password: "the-real-one"} + var firstReverted, secondReverted bool + + _, err := install.SignIn(context.Background(), io.Discard, client, []install.LoginStrategy{ + strategy("the initial admin password", "admin", "the-real-one", &firstReverted), + strategy("a temporary password", "octopus", "the-real-one", &secondReverted), + }) + + require.NoError(t, err) + assert.Equal(t, []string{"admin"}, client.tried, "no further credentials should be tried") + assert.False(t, firstReverted) +} diff --git a/pkg/cmd/kubernetes/gateway/rotatetoken/rotate.go b/pkg/cmd/kubernetes/gateway/rotatetoken/rotate.go new file mode 100644 index 00000000..ea036284 --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/rotatetoken/rotate.go @@ -0,0 +1,459 @@ +package rotatetoken + +import ( + "context" + "errors" + "fmt" + "strings" + + "github.com/AlecAivazis/survey/v2" + "github.com/MakeNowJust/heredoc/v2" + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/constants" + "github.com/OctopusDeploy/cli/pkg/factory" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/question" + "github.com/OctopusDeploy/cli/pkg/util/flag" + "github.com/spf13/cobra" +) + +const ( + FlagRelease = "release" + FlagRestart = "restart" + gatewayChart = "octopus-argocd-gateway-chart" + // gatewaySelector matches the gateway deployment the chart installs. + gatewaySelector = "app.kubernetes.io/name=octopus-argocd-gateway" + + // The chart reads project tokens from Secret keys of this shape, with the + // OCTOPUS_ARGOCD_ prefix added by envFrom. + projectTokenEnvPrefix = "PROJECT_AUTH_TOKEN_" + accountTokenEnvName = "OCTOPUS_ARGOCD_AUTH_TOKEN" +) + +type RotateFlags struct { + Release *flag.Flag[string] + Restart *flag.Flag[bool] + + *octoK8s.CommonFlags +} + +func NewRotateFlags() *RotateFlags { + return &RotateFlags{ + Release: flag.New[string](FlagRelease, false), + Restart: flag.New[bool](FlagRestart, false), + CommonFlags: octoK8s.NewCommonFlags(), + } +} + +type RotateOptions struct { + *RotateFlags + *cmd.Dependencies + + Cluster *octoK8s.Cluster + Runner *helm.Runner + + release helm.Release + deployment string + instance argocd.Instance +} + +func NewCmdRotateToken(f factory.Factory) *cobra.Command { + rotateFlags := NewRotateFlags() + + command := &cobra.Command{ + Use: "rotate-token", + Short: "Replace the Argo CD tokens an installed gateway uses", + Long: heredoc.Doc(` + Replace the Argo CD tokens an installed gateway uses. + + Shows every token the gateway holds and when it expires, links to where a + replacement is generated, then checks the new one works against Argo CD before + saving it. + `), + Example: heredoc.Docf("$ %s kubernetes gateway rotate-token", constants.ExecutableName), + RunE: func(c *cobra.Command, _ []string) error { + opts := &RotateOptions{ + RotateFlags: rotateFlags, + Dependencies: cmd.NewDependencies(f, c), + } + return rotateRun(c.Context(), opts) + }, + } + + flags := command.Flags() + flags.SortFlags = false + flags.StringVar(&rotateFlags.Release.Value, FlagRelease, "", "The gateway's Helm release name. Only needed when a cluster has more than one.") + flags.BoolVar(&rotateFlags.Restart.Value, FlagRestart, true, "Restart the gateway so it picks up the new token.") + octoK8s.RegisterCommonFlags(command, rotateFlags.CommonFlags) + + return command +} + +func rotateRun(ctx context.Context, opts *RotateOptions) error { + if ctx == nil { + ctx = context.Background() + } + if opts.NoPrompt { + return errors.New("rotate-token replaces tokens that have to be generated in Argo CD by hand, so it cannot run with prompting disabled") + } + + if err := opts.connect(ctx); err != nil { + return err + } + if err := opts.selectRelease(); err != nil { + return err + } + if err := opts.describeGateway(ctx); err != nil { + return err + } + + holdings, err := opts.currentTokens(ctx) + if err != nil { + return err + } + if len(holdings) == 0 { + return fmt.Errorf("the %s gateway does not hold any Argo CD tokens to replace", opts.release.Name) + } + + chosen, err := opts.selectTokens(holdings) + if err != nil || len(chosen) == 0 { + return err + } + + for _, holding := range chosen { + if err := opts.rotate(ctx, holding); err != nil { + return err + } + } + + return opts.restart(ctx) +} + +func (opts *RotateOptions) connect(ctx context.Context) error { + kubeConfig, err := octoK8s.LoadKubeConfig(opts.KubeConfig.Value) + if err != nil { + return err + } + + if opts.KubeContext.Value == "" { + current, ok := kubeConfig.CurrentContext() + if !ok { + return fmt.Errorf("your kubeconfig has no current context, so --%s must be specified", octoK8s.FlagKubeContext) + } + opts.KubeContext.Value = current.Name + } + + cluster, err := octoK8s.Connect(kubeConfig, opts.KubeContext.Value) + if err != nil { + return err + } + opts.Cluster = cluster + + runner, err := helm.NewRunner(opts.KubeConfig.Value, opts.KubeContext.Value, opts.Out) + if err != nil { + return err + } + opts.Runner = runner + return nil +} + +func (opts *RotateOptions) selectRelease() error { + releases, err := opts.Runner.FindByChart(gatewayChart) + if err != nil { + return err + } + + switch { + case len(releases) == 0: + return fmt.Errorf("no Octopus Argo CD gateway is installed in the %s cluster", opts.KubeContext.Value) + case opts.Release.Value != "": + for _, r := range releases { + if r.Name == opts.Release.Value { + opts.release = r + return nil + } + } + return fmt.Errorf("no gateway release named %q is installed in this cluster", opts.Release.Value) + case len(releases) == 1: + opts.release = releases[0] + return nil + } + + selected, err := question.SelectMap(opts.Ask, "Which gateway?", releases, + func(r helm.Release) string { return fmt.Sprintf("%s (namespace %s)", r.Name, r.Namespace) }) + if err != nil { + return err + } + opts.release = selected + return nil +} + +// describeGateway reads the gateway's own configuration back out of the +// cluster, so a token can be replaced without knowing how it was installed. +func (opts *RotateOptions) describeGateway(ctx context.Context) error { + deployment, found, err := opts.Cluster.FindDeployment(ctx, opts.release.Namespace, gatewaySelector) + if err != nil { + return err + } + if !found { + return fmt.Errorf("the %s release has no gateway deployment in namespace %s", opts.release.Name, opts.release.Namespace) + } + opts.deployment = deployment.Name + + values, err := opts.Runner.GetValues(opts.release.Name, opts.release.Namespace) + if err != nil { + return err + } + opts.instance = instanceFromValues(values) + + fmt.Fprintf(opts.Out, "Gateway %s in namespace %s, connected to %s\n", + output.Cyan(opts.release.Name), output.Cyan(opts.release.Namespace), + output.Cyan(orUnknown(opts.instance.ServerGRPCURL))) + return nil +} + +// tokenHolding is one token the gateway reads, and where it is stored. +type tokenHolding struct { + // Project is empty for the single account token an in-cluster gateway uses. + Project string + SecretName string + SecretKey string + Claims argocd.ProjectTokenClaims + // Parsed is false when the stored value is not a token this can read, which + // is not a reason to refuse to replace it. + Parsed bool +} + +func (h tokenHolding) Display() string { + name := h.Project + if name == "" { + name = "account token" + } + if !h.Parsed { + return name + } + + switch { + case h.Claims.Expired(): + return fmt.Sprintf("%s - expired %s", name, h.Claims.Expires.Format("2 Jan 2006")) + case !h.Claims.Expires.IsZero(): + return fmt.Sprintf("%s - expires %s", name, h.Claims.Expires.Format("2 Jan 2006")) + default: + return fmt.Sprintf("%s - does not expire", name) + } +} + +// currentTokens reads the gateway's deployment to find which Secrets hold its +// tokens. Taking it from the running workload rather than the Helm values means +// this works however the gateway was installed. +func (opts *RotateOptions) currentTokens(ctx context.Context) ([]tokenHolding, error) { + deployment, found, err := opts.Cluster.FindDeployment(ctx, opts.release.Namespace, gatewaySelector) + if err != nil || !found { + return nil, err + } + + var holdings []tokenHolding + for _, container := range deployment.Spec.Template.Spec.Containers { + for _, env := range container.Env { + ref := env.ValueFrom + if env.Name != accountTokenEnvName || ref == nil || ref.SecretKeyRef == nil { + continue + } + holdings = append(holdings, opts.readHolding(ctx, "", ref.SecretKeyRef.Name, ref.SecretKeyRef.Key)) + } + + for _, envFrom := range container.EnvFrom { + if envFrom.SecretRef == nil { + continue + } + holdings = append(holdings, opts.readProjectHoldings(ctx, envFrom.SecretRef.Name)...) + } + } + return holdings, nil +} + +func (opts *RotateOptions) readProjectHoldings(ctx context.Context, secretName string) []tokenHolding { + secret, found, err := opts.Cluster.GetSecret(ctx, opts.release.Namespace, secretName) + if err != nil || !found { + return nil + } + + var holdings []tokenHolding + for key := range secret.Data { + project, isProjectToken := strings.CutPrefix(key, projectTokenEnvPrefix) + if !isProjectToken { + continue + } + holding := opts.readHolding(ctx, project, secretName, key) + holdings = append(holdings, holding) + } + return holdings +} + +func (opts *RotateOptions) readHolding(ctx context.Context, project, secretName, secretKey string) tokenHolding { + holding := tokenHolding{Project: project, SecretName: secretName, SecretKey: secretKey} + + value, found, err := opts.Cluster.SecretKey(ctx, opts.release.Namespace, secretName, secretKey) + if err != nil || !found || value == "" { + return holding + } + + if claims, err := argocd.ParseProjectToken(value); err == nil { + holding.Claims, holding.Parsed = claims, true + if holding.Project == "" { + holding.Project = claims.Project + } + } + return holding +} + +func (opts *RotateOptions) selectTokens(holdings []tokenHolding) ([]tokenHolding, error) { + if len(holdings) == 1 { + return holdings, nil + } + return question.MultiSelectMap(opts.Ask, "Which tokens would you like to replace?", holdings, + func(h tokenHolding) string { return h.Display() }, true) +} + +func (opts *RotateOptions) rotate(ctx context.Context, holding tokenHolding) error { + opts.printWhereToGenerate(holding) + + for { + token := "" + if err := opts.Ask(&survey.Password{ + Message: fmt.Sprintf("New token for %s", holdingName(holding)), + Help: "Paste the token Argo CD gave you.", + }, &token, survey.WithValidator(survey.Required)); err != nil { + return err + } + + if err := opts.validate(ctx, holding, token); err != nil { + fmt.Fprintf(opts.Out, " %s %v\n", output.Red("✘"), err) + continue + } + + err := opts.Cluster.MergeSecretKeys(ctx, opts.release.Namespace, holding.SecretName, + map[string]string{holding.SecretKey: token}, nil) + if err != nil { + return err + } + + fmt.Fprintf(opts.Out, " %s Saved\n", output.Green("✔")) + return nil + } +} + +func (opts *RotateOptions) printWhereToGenerate(holding tokenHolding) { + fmt.Fprintf(opts.Out, "\n%s\n", output.Bold(holdingName(holding))) + + role := holding.Claims.Role + if role == "" { + role = argocd.DefaultAccountName + } + + switch { + case holding.Project != "": + if url := argocd.ProjectRolePageURL(opts.instance.WebUIURL, holding.Project, role); url != "" { + fmt.Fprintf(opts.Out, " Generate a token for role %s at\n %s\n", output.Cyan(role), output.Blue(url)) + } + fmt.Fprintf(opts.Out, " Or: %s\n", + output.Cyan(fmt.Sprintf("argocd proj role create-token %s %s", holding.Project, role))) + default: + if opts.instance.WebUIURL != "" { + fmt.Fprintf(opts.Out, " Generate a token under Settings > Accounts > %s at\n %s\n", + output.Cyan(role), output.Blue(opts.instance.WebUIURL+"/settings/accounts")) + } + fmt.Fprintf(opts.Out, " Or: %s\n", + output.Cyan(fmt.Sprintf("argocd account generate-token --account %s", role))) + } +} + +// validate checks the replacement before it is stored, so a bad paste is caught +// here rather than by a gateway that silently stops working. +func (opts *RotateOptions) validate(ctx context.Context, holding tokenHolding, token string) error { + claims, err := argocd.ParseProjectToken(token) + switch { + case err != nil && holding.Project != "": + return err + case err != nil: + // An account token has a different subject shape, and cannot be + // checked any further without reaching Argo CD. + return opts.verifyAgainstArgoCD(ctx, token) + } + + if claims.Expired() { + return fmt.Errorf("this token expired on %s", claims.Expires.Format("2 Jan 2006")) + } + if holding.Project != "" && claims.Project != holding.Project { + return fmt.Errorf("this token is for project %q, but %q is being replaced", claims.Project, holding.Project) + } + + return opts.verifyAgainstArgoCD(ctx, token) +} + +// verifyAgainstArgoCD proves the token actually works. Argo CD answers an +// under-privileged request with an empty list rather than a refusal, so a token +// that parses can still see nothing. +func (opts *RotateOptions) verifyAgainstArgoCD(ctx context.Context, token string) error { + if opts.instance.WebUIURL == "" { + return nil + } + + client := argocd.NewClientForURL(opts.instance.WebUIURL) + client.UseToken(token) + + access := client.VerifyAccess(ctx) + if !access.Readable() { + fmt.Fprintf(opts.Out, " %s Argo CD would not let this token read applications. Saving it anyway.\n", + output.Yellow("!")) + return nil + } + + fmt.Fprintf(opts.Out, " %s\n", output.Dimf("Checked against Argo CD: reads %d %s.", + access.Applications, octoK8s.Pluralise("application", "applications", access.Applications))) + return nil +} + +func (opts *RotateOptions) restart(ctx context.Context) error { + if !opts.Restart.Value { + fmt.Fprintf(opts.Out, "\nRestart the gateway for the new tokens to take effect:\n %s\n", + output.Cyan(fmt.Sprintf("kubectl rollout restart deploy/%s -n %s", opts.deployment, opts.release.Namespace))) + return nil + } + + if err := opts.Cluster.RestartDeployment(ctx, opts.release.Namespace, opts.deployment); err != nil { + return err + } + fmt.Fprintf(opts.Out, "\n%s Restarted %s so it picks up the new tokens.\n", + output.Green("✔"), output.Cyan(opts.deployment)) + return nil +} + +func holdingName(holding tokenHolding) string { + if holding.Project == "" { + return "the gateway's Argo CD account token" + } + return "project " + holding.Project +} + +func instanceFromValues(values map[string]any) argocd.Instance { + gateway, _ := values["gateway"].(map[string]any) + argo, _ := gateway["argocd"].(map[string]any) + registration, _ := values["registration"].(map[string]any) + registrationArgo, _ := registration["argocd"].(map[string]any) + + instance := argocd.Instance{} + instance.ServerGRPCURL, _ = argo["serverGrpcUrl"].(string) + instance.WebUIURL, _ = registrationArgo["webUiUrl"].(string) + return instance +} + +func orUnknown(value string) string { + if value == "" { + return "an unknown Argo CD" + } + return value +} diff --git a/pkg/cmd/kubernetes/install/install.go b/pkg/cmd/kubernetes/install/install.go new file mode 100644 index 00000000..2f1c82c1 --- /dev/null +++ b/pkg/cmd/kubernetes/install/install.go @@ -0,0 +1,73 @@ +package install + +import ( + "fmt" + "strings" + + "github.com/MakeNowJust/heredoc/v2" + "github.com/OctopusDeploy/cli/pkg/cmd" + gatewayInstall "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway/install" + "github.com/OctopusDeploy/cli/pkg/constants" + "github.com/OctopusDeploy/cli/pkg/factory" + "github.com/OctopusDeploy/cli/pkg/question" + "github.com/spf13/cobra" +) + +// component delegates to its own subcommand, so the wizard stays a router and +// every component remains independently scriptable. +type component struct { + display string + cmdPath string + install func(f factory.Factory, dependencies *cmd.Dependencies, cmdPath string) error +} + +func components() []component { + return []component{ + { + display: "Argo CD gateway - connect an Argo CD instance to Octopus", + cmdPath: constants.ExecutableName + " kubernetes gateway install", + install: func(f factory.Factory, dependencies *cmd.Dependencies, cmdPath string) error { + return gatewayInstall.Run(f, cmd.NewDependenciesFromExisting(dependencies, cmdPath)) + }, + }, + } +} + +func NewCmdInstall(f factory.Factory) *cobra.Command { + return &cobra.Command{ + Use: "install", + Short: "Install an Octopus component into a Kubernetes cluster", + Long: heredoc.Doc(` + Install an Octopus component into a Kubernetes cluster. + + Asks which component to install and then runs its installer. Each component also has + its own command, which is what to use in a script. + `), + Example: heredoc.Docf("$ %s kubernetes install", constants.ExecutableName), + RunE: func(c *cobra.Command, _ []string) error { + dependencies := cmd.NewDependencies(f, c) + available := components() + + if dependencies.NoPrompt { + return noPromptError(available) + } + + selected, err := question.SelectMap(dependencies.Ask, "What would you like to install?", available, + func(item component) string { return item.display }) + if err != nil { + return err + } + + return selected.install(f, dependencies, selected.cmdPath) + }, + } +} + +func noPromptError(available []component) error { + paths := make([]string, 0, len(available)) + for _, c := range available { + paths = append(paths, " "+c.cmdPath) + } + return fmt.Errorf("%s cannot ask which component to install while prompting is disabled. Run one of these instead:\n%s", + constants.ExecutableName+" kubernetes install", strings.Join(paths, "\n")) +} diff --git a/pkg/cmd/kubernetes/kubernetes.go b/pkg/cmd/kubernetes/kubernetes.go new file mode 100644 index 00000000..5af3d087 --- /dev/null +++ b/pkg/cmd/kubernetes/kubernetes.go @@ -0,0 +1,31 @@ +package kubernetes + +import ( + "github.com/MakeNowJust/heredoc/v2" + cmdGateway "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway" + cmdInstall "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/install" + "github.com/OctopusDeploy/cli/pkg/constants" + "github.com/OctopusDeploy/cli/pkg/constants/annotations" + "github.com/OctopusDeploy/cli/pkg/factory" + "github.com/spf13/cobra" +) + +func NewCmdKubernetes(f factory.Factory) *cobra.Command { + cmd := &cobra.Command{ + Use: "kubernetes ", + Short: "Manage Kubernetes infrastructure", + Long: heredoc.Doc(` + Install and manage the Octopus components that run in a Kubernetes cluster. + `), + Example: heredoc.Docf("$ %s kubernetes install", constants.ExecutableName), + Aliases: []string{"k8s"}, + Annotations: map[string]string{ + annotations.IsInfrastructure: "true", + }, + } + + cmd.AddCommand(cmdInstall.NewCmdInstall(f)) + cmd.AddCommand(cmdGateway.NewCmdGateway(f)) + + return cmd +} diff --git a/pkg/cmd/root/root.go b/pkg/cmd/root/root.go index 05106062..b83af316 100644 --- a/pkg/cmd/root/root.go +++ b/pkg/cmd/root/root.go @@ -9,6 +9,7 @@ import ( configCmd "github.com/OctopusDeploy/cli/pkg/cmd/config" environmentCmd "github.com/OctopusDeploy/cli/pkg/cmd/environment" ephemeralEnvironmentCmd "github.com/OctopusDeploy/cli/pkg/cmd/ephemeralenvironment" + kubernetesCmd "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes" loginCmd "github.com/OctopusDeploy/cli/pkg/cmd/login" logoutCmd "github.com/OctopusDeploy/cli/pkg/cmd/logout" packageCmd "github.com/OctopusDeploy/cli/pkg/cmd/package" @@ -54,6 +55,7 @@ func NewCmdRoot(f factory.Factory, clientFactory apiclient.ClientFactory, askPro cmd.AddCommand(accountCmd.NewCmdAccount(f)) cmd.AddCommand(environmentCmd.NewCmdEnvironment(f)) cmd.AddCommand(ephemeralEnvironmentCmd.NewCmdEphemeralEnvironment(f)) + cmd.AddCommand(kubernetesCmd.NewCmdKubernetes(f)) cmd.AddCommand(packageCmd.NewCmdPackage(f)) cmd.AddCommand(buildInfoCmd.NewCmdBuildInformation(f)) cmd.AddCommand(deploymentTargetCmd.NewCmdDeploymentTarget(f)) diff --git a/pkg/kubernetes/argocd/account.go b/pkg/kubernetes/argocd/account.go new file mode 100644 index 00000000..2e0374d5 --- /dev/null +++ b/pkg/kubernetes/argocd/account.go @@ -0,0 +1,331 @@ +package argocd + +import ( + "context" + "fmt" + "sort" + "strings" + + corev1 "k8s.io/api/core/v1" + apierrors "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" +) + +// DefaultAccountName is a local account: Argo CD has no service-account +// concept. With only the apiKey capability it cannot log in to the web UI. +const DefaultAccountName = "octopus" + +const accountEnabledSuffix = "enabled" + +type AccountSpec struct { + Name string + // AllowSync lets Octopus deploy through Argo CD rather than only observe it. + AllowSync bool +} + +func (s AccountSpec) RequiredPolicies() []string { + policies := []string{ + fmt.Sprintf("p, %s, applications, get, *, allow", s.Name), + fmt.Sprintf("p, %s, clusters, get, *, allow", s.Name), + fmt.Sprintf("p, %s, logs, get, */*, allow", s.Name), + } + if s.AllowSync { + policies = append(policies, fmt.Sprintf("p, %s, applications, sync, *, allow", s.Name)) + } + sort.Strings(policies) + return policies +} + +type AccountStatus struct { + Spec AccountSpec + HasAPIKeyCapability bool + Disabled bool + MissingPolicies []string + // Operator is set when an operator generates Argo CD's ConfigMaps, in which + // case the changes belong on its resource instead. + Operator *OperatorInstance +} + +func (s AccountStatus) IsComplete() bool { + return s.HasAPIKeyCapability && !s.Disabled && len(s.MissingPolicies) == 0 +} + +func (s AccountStatus) Summary() string { + if s.IsComplete() { + return fmt.Sprintf("Argo CD account %q exists with the permissions Octopus needs", s.Spec.Name) + } + + var missing []string + if !s.HasAPIKeyCapability { + missing = append(missing, fmt.Sprintf("the %q account with the apiKey capability", s.Spec.Name)) + } else if s.Disabled { + missing = append(missing, fmt.Sprintf("the %q account is disabled", s.Spec.Name)) + } + if len(s.MissingPolicies) > 0 { + missing = append(missing, fmt.Sprintf("%d RBAC %s", len(s.MissingPolicies), octoK8s.Pluralise("policy", "policies", len(s.MissingPolicies)))) + } + return "Argo CD is missing " + strings.Join(missing, " and ") +} + +func InspectAccount(ctx context.Context, c *octoK8s.Cluster, instance Instance, spec AccountSpec) (AccountStatus, error) { + namespace := instance.Namespace + status := AccountStatus{Spec: spec, Operator: instance.Operator} + + cm, found, err := c.GetConfigMap(ctx, namespace, ConfigMapName) + if err != nil { + return AccountStatus{}, err + } + if found { + capabilities := cm.Data["accounts."+spec.Name] + status.HasAPIKeyCapability = containsCapability(capabilities, capabilityAPIKey) + status.Disabled = strings.EqualFold(strings.TrimSpace(cm.Data["accounts."+spec.Name+".enabled"]), "false") + } + + rbac, found, err := c.GetConfigMap(ctx, namespace, RBACConfigMapName) + if err != nil { + return AccountStatus{}, err + } + existing := "" + if found { + existing = rbac.Data["policy.csv"] + } + status.MissingPolicies = missingPolicies(existing, spec.RequiredPolicies()) + + return status, nil +} + +// AccountPatchPlan shows exactly what ConfigureAccount would write, for the +// user to agree to first. +func AccountPatchPlan(namespace string, status AccountStatus) string { + var b strings.Builder + + if !status.HasAPIKeyCapability || status.Disabled { + fmt.Fprintf(&b, " %s/%s\n", namespace, ConfigMapName) + fmt.Fprintf(&b, " + accounts.%s: apiKey\n", status.Spec.Name) + fmt.Fprintf(&b, " + accounts.%s.enabled: \"true\"\n", status.Spec.Name) + } + + if len(status.MissingPolicies) > 0 { + fmt.Fprintf(&b, " %s/%s\n", namespace, RBACConfigMapName) + for _, p := range status.MissingPolicies { + fmt.Fprintf(&b, " + %s\n", p) + } + } + + return b.String() +} + +// ConfigureAccount is safe against a partly configured Argo CD: existing +// accounts and policies are left alone. +func ConfigureAccount(ctx context.Context, c *octoK8s.Cluster, instance Instance, status AccountStatus) error { + if status.Operator != nil { + return configureViaOperator(ctx, c, instance, status) + } + + namespace := instance.Namespace + if !status.HasAPIKeyCapability || status.Disabled { + if err := grantAPIKeyCapability(ctx, c, namespace, status.Spec.Name); err != nil { + return err + } + } + if len(status.MissingPolicies) > 0 { + if err := addPolicies(ctx, c, namespace, status.MissingPolicies); err != nil { + return err + } + } + return nil +} + +// configureViaOperator writes to the ArgoCD resource rather than the ConfigMaps +// it generates. Anything written straight to argocd-cm or argocd-rbac-cm is +// reverted the next time the operator reconciles. +func configureViaOperator(ctx context.Context, c *octoK8s.Cluster, instance Instance, status AccountStatus) error { + resource := c.Dynamic.Resource(status.Operator.Resource).Namespace(instance.Namespace) + + argoCD, err := resource.Get(ctx, status.Operator.Name, metav1.GetOptions{}) + if err != nil { + return fmt.Errorf("could not read the %s ArgoCD resource: %w", status.Operator.Name, err) + } + + if !status.HasAPIKeyCapability || status.Disabled { + extraConfig, _, err := unstructured.NestedStringMap(argoCD.Object, "spec", "extraConfig") + if err != nil { + return fmt.Errorf("could not read spec.extraConfig from the %s ArgoCD resource: %w", status.Operator.Name, err) + } + if extraConfig == nil { + extraConfig = map[string]string{} + } + + key := accountsKeyPrefix + status.Spec.Name + extraConfig[key] = addCapability(extraConfig[key], capabilityAPIKey) + extraConfig[key+"."+accountEnabledSuffix] = "true" + + if err := unstructured.SetNestedStringMap(argoCD.Object, extraConfig, "spec", "extraConfig"); err != nil { + return err + } + } + + if len(status.MissingPolicies) > 0 { + existing, _, err := unstructured.NestedString(argoCD.Object, "spec", "rbac", "policy") + if err != nil { + return fmt.Errorf("could not read spec.rbac.policy from the %s ArgoCD resource: %w", status.Operator.Name, err) + } + if err := unstructured.SetNestedField(argoCD.Object, + appendPolicies(existing, status.MissingPolicies), "spec", "rbac", "policy"); err != nil { + return err + } + } + + if _, err := resource.Update(ctx, argoCD, metav1.UpdateOptions{}); err != nil { + if apierrors.IsConflict(err) { + return fmt.Errorf("the %s ArgoCD resource changed while it was being updated; try again", status.Operator.Name) + } + return fmt.Errorf("could not update the %s ArgoCD resource: %w", status.Operator.Name, err) + } + return nil +} + +// grantAPIKeyCapability sends only the two keys Octopus owns, so nothing else +// in the ConfigMap can be disturbed. +func grantAPIKeyCapability(ctx context.Context, c *octoK8s.Cluster, namespace, accountName string) error { + cm, found, err := c.GetConfigMap(ctx, namespace, ConfigMapName) + if err != nil { + return err + } + if !found { + return fmt.Errorf("ConfigMap %s/%s does not exist, so this does not look like a complete Argo CD installation", namespace, ConfigMapName) + } + + updated := cm.DeepCopy() + if updated.Data == nil { + updated.Data = map[string]string{} + } + + capabilities := updated.Data["accounts."+accountName] + if !containsCapability(capabilities, capabilityAPIKey) { + updated.Data["accounts."+accountName] = addCapability(capabilities, capabilityAPIKey) + } + updated.Data["accounts."+accountName+".enabled"] = "true" + + if err := updateConfigMap(ctx, c, updated); err != nil { + return fmt.Errorf("could not add the %q account to %s/%s: %w", accountName, namespace, ConfigMapName, err) + } + return nil +} + +// updateConfigMap relies on the resourceVersion that was read, so a concurrent +// change conflicts rather than being silently overwritten. +func updateConfigMap(ctx context.Context, c *octoK8s.Cluster, cm *corev1.ConfigMap) error { + _, err := c.Clientset.CoreV1().ConfigMaps(cm.Namespace).Update(ctx, cm, metav1.UpdateOptions{}) + if apierrors.IsConflict(err) { + return fmt.Errorf("%s/%s changed while it was being updated; try again", cm.Namespace, cm.Name) + } + return err +} + +// addPolicies is a read-modify-write rather than a patch because policy.csv is +// one multi-line value: a patch would replace every rule in it, including rules +// Octopus did not write. +func addPolicies(ctx context.Context, c *octoK8s.Cluster, namespace string, policies []string) error { + configMaps := c.Clientset.CoreV1().ConfigMaps(namespace) + + cm, found, err := c.GetConfigMap(ctx, namespace, RBACConfigMapName) + if err != nil { + return err + } + + if !found { + created := &corev1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{Name: RBACConfigMapName, Namespace: namespace}, + Data: map[string]string{"policy.csv": strings.Join(policies, "\n") + "\n"}, + } + if _, err := configMaps.Create(ctx, created, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) { + return fmt.Errorf("could not create %s/%s: %w", namespace, RBACConfigMapName, err) + } + return nil + } + + updated := cm.DeepCopy() + if updated.Data == nil { + updated.Data = map[string]string{} + } + updated.Data["policy.csv"] = appendPolicies(updated.Data["policy.csv"], policies) + + // The resourceVersion that was read makes a concurrent edit conflict rather + // than silently discard someone else's rules. + if _, err := configMaps.Update(ctx, updated, metav1.UpdateOptions{}); err != nil { + if apierrors.IsConflict(err) { + return fmt.Errorf("%s/%s changed while it was being updated; re-run the install to try again", namespace, RBACConfigMapName) + } + return fmt.Errorf("could not add RBAC policies to %s/%s: %w", namespace, RBACConfigMapName, err) + } + return nil +} + +func appendPolicies(existing string, policies []string) string { + trimmed := strings.TrimRight(existing, "\n") + if trimmed == "" { + return strings.Join(policies, "\n") + "\n" + } + return trimmed + "\n" + strings.Join(policies, "\n") + "\n" +} + +// missingPolicies compares on normalised whitespace, so formatting differences +// do not produce duplicate rules. +func missingPolicies(policyCSV string, required []string) []string { + existing := map[string]bool{} + for _, line := range strings.Split(policyCSV, "\n") { + if normalised := normalisePolicy(line); normalised != "" { + existing[normalised] = true + } + } + + var missing []string + for _, r := range required { + if !existing[normalisePolicy(r)] { + missing = append(missing, r) + } + } + return missing +} + +func normalisePolicy(line string) string { + line = strings.TrimSpace(line) + if line == "" || strings.HasPrefix(line, "#") { + return "" + } + fields := strings.Split(line, ",") + for i, f := range fields { + fields[i] = strings.TrimSpace(f) + } + return strings.Join(fields, ",") +} + +func containsCapability(capabilities, wanted string) bool { + for _, c := range strings.Split(capabilities, ",") { + if strings.EqualFold(strings.TrimSpace(c), wanted) { + return true + } + } + return false +} + +func addCapability(capabilities, wanted string) string { + if strings.TrimSpace(capabilities) == "" { + return wanted + } + return strings.TrimSpace(capabilities) + ", " + wanted +} + +func removeCapability(capabilities, unwanted string) string { + var kept []string + for _, c := range strings.Split(capabilities, ",") { + if trimmed := strings.TrimSpace(c); trimmed != "" && !strings.EqualFold(trimmed, unwanted) { + kept = append(kept, trimmed) + } + } + return strings.Join(kept, ", ") +} diff --git a/pkg/kubernetes/argocd/account_test.go b/pkg/kubernetes/argocd/account_test.go new file mode 100644 index 00000000..2d7e6533 --- /dev/null +++ b/pkg/kubernetes/argocd/account_test.go @@ -0,0 +1,287 @@ +package argocd_test + +import ( + "context" + "testing" + + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" + dynamicfake "k8s.io/client-go/dynamic/fake" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func cm(name string, data map[string]string) *corev1.ConfigMap { + return &corev1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: "argocd"}, + Data: data, + } +} + +// inClusterInstance is an Argo CD installed straight into the cluster, where +// the ConfigMaps are the source of truth. +func inClusterInstance() argocd.Instance { + return argocd.Instance{Kind: argocd.KindInCluster, Namespace: "argocd"} +} + +func readOnlySpec() argocd.AccountSpec { + return argocd.AccountSpec{Name: "octopus", AllowSync: false} +} + +func TestInspectAccount_NothingConfigured(t *testing.T) { + c := clusterWith(cm(argocd.ConfigMapName, map[string]string{})) + + status, err := argocd.InspectAccount(context.Background(), c, inClusterInstance(), readOnlySpec()) + require.NoError(t, err) + + assert.False(t, status.HasAPIKeyCapability) + assert.Len(t, status.MissingPolicies, 3) + assert.False(t, status.IsComplete()) +} + +func TestInspectAccount_FullyConfigured(t *testing.T) { + c := clusterWith( + cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey"}), + cm(argocd.RBACConfigMapName, map[string]string{"policy.csv": ` +p, octopus, applications, get, *, allow +p, octopus, clusters, get, *, allow +p, octopus, logs, get, */*, allow +`}), + ) + + status, err := argocd.InspectAccount(context.Background(), c, inClusterInstance(), readOnlySpec()) + require.NoError(t, err) + assert.True(t, status.IsComplete()) +} + +func TestInspectAccount_SyncNeedsAnExtraPolicy(t *testing.T) { + c := clusterWith( + cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey"}), + cm(argocd.RBACConfigMapName, map[string]string{"policy.csv": ` +p, octopus, applications, get, *, allow +p, octopus, clusters, get, *, allow +p, octopus, logs, get, */*, allow +`}), + ) + + status, err := argocd.InspectAccount(context.Background(), c, inClusterInstance(), + argocd.AccountSpec{Name: "octopus", AllowSync: true}) + require.NoError(t, err) + + require.Len(t, status.MissingPolicies, 1) + assert.Contains(t, status.MissingPolicies[0], "sync") +} + +// Whitespace in policy.csv is a formatting choice, not a difference in meaning, +// so it must not cause a duplicate rule to be added. +func TestInspectAccount_PolicyMatchingIgnoresWhitespace(t *testing.T) { + c := clusterWith( + cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey"}), + cm(argocd.RBACConfigMapName, map[string]string{"policy.csv": "p,octopus,applications,get,*,allow\n" + + "p, octopus, clusters, get, *, allow\n" + + "p, octopus, logs, get, */*, allow"}), + ) + + status, err := argocd.InspectAccount(context.Background(), c, inClusterInstance(), readOnlySpec()) + require.NoError(t, err) + assert.Empty(t, status.MissingPolicies) +} + +func TestInspectAccount_DisabledAccountIsNotComplete(t *testing.T) { + c := clusterWith(cm(argocd.ConfigMapName, map[string]string{ + "accounts.octopus": "apiKey", + "accounts.octopus.enabled": "false", + })) + + status, err := argocd.InspectAccount(context.Background(), c, inClusterInstance(), readOnlySpec()) + require.NoError(t, err) + + assert.True(t, status.HasAPIKeyCapability) + assert.True(t, status.Disabled) + assert.False(t, status.IsComplete()) +} + +func TestConfigureAccount_LeavesOtherAccountsAndPoliciesAlone(t *testing.T) { + ctx := context.Background() + c := clusterWith( + cm(argocd.ConfigMapName, map[string]string{ + "accounts.alice": "login, apiKey", + "url": "https://argo.example.com", + }), + cm(argocd.RBACConfigMapName, map[string]string{ + "policy.csv": "p, alice, applications, *, *, allow\n", + "policy.default": "role:readonly", + }), + ) + + status, err := argocd.InspectAccount(ctx, c, inClusterInstance(), readOnlySpec()) + require.NoError(t, err) + require.NoError(t, argocd.ConfigureAccount(ctx, c, inClusterInstance(), status)) + + config, found, err := c.GetConfigMap(ctx, "argocd", argocd.ConfigMapName) + require.NoError(t, err) + require.True(t, found) + assert.Equal(t, "apiKey", config.Data["accounts.octopus"]) + assert.Equal(t, "true", config.Data["accounts.octopus.enabled"]) + assert.Equal(t, "login, apiKey", config.Data["accounts.alice"], "another account must not be disturbed") + assert.Equal(t, "https://argo.example.com", config.Data["url"], "unrelated keys must not be disturbed") + + rbac, found, err := c.GetConfigMap(ctx, "argocd", argocd.RBACConfigMapName) + require.NoError(t, err) + require.True(t, found) + assert.Contains(t, rbac.Data["policy.csv"], "p, alice, applications, *, *, allow", "an existing rule must survive") + assert.Contains(t, rbac.Data["policy.csv"], "p, octopus, clusters, get, *, allow") + assert.Equal(t, "role:readonly", rbac.Data["policy.default"]) + + // Running it a second time must not duplicate anything. + status, err = argocd.InspectAccount(ctx, c, inClusterInstance(), readOnlySpec()) + require.NoError(t, err) + assert.True(t, status.IsComplete()) +} + +func TestConfigureAccount_CreatesTheRBACConfigMapWhenMissing(t *testing.T) { + ctx := context.Background() + c := clusterWith(cm(argocd.ConfigMapName, map[string]string{})) + + status, err := argocd.InspectAccount(ctx, c, inClusterInstance(), readOnlySpec()) + require.NoError(t, err) + require.NoError(t, argocd.ConfigureAccount(ctx, c, inClusterInstance(), status)) + + rbac, found, err := c.GetConfigMap(ctx, "argocd", argocd.RBACConfigMapName) + require.NoError(t, err) + require.True(t, found) + assert.Contains(t, rbac.Data["policy.csv"], "p, octopus, applications, get, *, allow") +} + +func TestConfigureAccount_PreservesExistingCapabilities(t *testing.T) { + ctx := context.Background() + c := clusterWith(cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "login"})) + + status, err := argocd.InspectAccount(ctx, c, inClusterInstance(), readOnlySpec()) + require.NoError(t, err) + require.NoError(t, argocd.ConfigureAccount(ctx, c, inClusterInstance(), status)) + + config, _, err := c.GetConfigMap(ctx, "argocd", argocd.ConfigMapName) + require.NoError(t, err) + assert.Equal(t, "login, apiKey", config.Data["accounts.octopus"]) +} + +func TestAccountPatchPlan_ShowsOnlyWhatIsMissing(t *testing.T) { + ctx := context.Background() + c := clusterWith(cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey"})) + + status, err := argocd.InspectAccount(ctx, c, inClusterInstance(), readOnlySpec()) + require.NoError(t, err) + + plan := argocd.AccountPatchPlan("argocd", status) + assert.NotContains(t, plan, argocd.ConfigMapName, "the account already exists, so argocd-cm needs no change") + assert.Contains(t, plan, argocd.RBACConfigMapName) + assert.Contains(t, plan, "p, octopus, clusters, get, *, allow") +} + +func argoCDResource(name, namespace string) *unstructured.Unstructured { + return &unstructured.Unstructured{Object: map[string]any{ + "apiVersion": "argoproj.io/v1beta1", + "kind": "ArgoCD", + "metadata": map[string]any{"name": name, "namespace": namespace}, + "spec": map[string]any{}, + }} +} + +func operatorInstance() argocd.Instance { + return argocd.Instance{ + Kind: argocd.KindInCluster, + Namespace: "openshift-gitops", + Operator: &argocd.OperatorInstance{ + Name: "openshift-gitops", + Resource: schema.GroupVersionResource{Group: "argoproj.io", Version: "v1beta1", Resource: "argocds"}, + }, + } +} + +func operatorCluster(objects ...runtime.Object) *octoK8s.Cluster { + gvr := schema.GroupVersionResource{Group: "argoproj.io", Version: "v1beta1", Resource: "argocds"} + listKinds := map[schema.GroupVersionResource]string{gvr: "ArgoCDList"} + + c := clusterWith( + &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: argocd.ConfigMapName, Namespace: "openshift-gitops"}}, + ) + return c.WithDynamic(dynamicfake.NewSimpleDynamicClientWithCustomListKinds(runtime.NewScheme(), listKinds, objects...)) +} + +// An operator generates argocd-cm and argocd-rbac-cm from its own resource, so +// anything written straight to them is reverted on the next reconcile. +func TestConfigureAccount_OperatorManagedWritesToTheArgoCDResource(t *testing.T) { + ctx := context.Background() + instance := operatorInstance() + c := operatorCluster(argoCDResource("openshift-gitops", "openshift-gitops")) + + status, err := argocd.InspectAccount(ctx, c, instance, readOnlySpec()) + require.NoError(t, err) + require.NoError(t, argocd.ConfigureAccount(ctx, c, instance, status)) + + argoCD, err := c.Dynamic.Resource(instance.Operator.Resource).Namespace(instance.Namespace). + Get(ctx, instance.Operator.Name, metav1.GetOptions{}) + require.NoError(t, err) + + extraConfig, _, err := unstructured.NestedStringMap(argoCD.Object, "spec", "extraConfig") + require.NoError(t, err) + assert.Equal(t, "apiKey", extraConfig["accounts.octopus"]) + assert.Equal(t, "true", extraConfig["accounts.octopus.enabled"]) + + policy, _, err := unstructured.NestedString(argoCD.Object, "spec", "rbac", "policy") + require.NoError(t, err) + assert.Contains(t, policy, "p, octopus, applications, get, *, allow") + + // The ConfigMap must be left alone; the operator owns it. + cm, _, err := c.GetConfigMap(ctx, instance.Namespace, argocd.ConfigMapName) + require.NoError(t, err) + assert.NotContains(t, cm.Data, "accounts.octopus") +} + +func TestConfigureAccount_OperatorManagedPreservesExistingConfig(t *testing.T) { + ctx := context.Background() + instance := operatorInstance() + + existing := argoCDResource("openshift-gitops", "openshift-gitops") + require.NoError(t, unstructured.SetNestedStringMap(existing.Object, + map[string]string{"timeout.reconciliation": "180s"}, "spec", "extraConfig")) + require.NoError(t, unstructured.SetNestedField(existing.Object, + "p, alice, applications, *, */*, allow\n", "spec", "rbac", "policy")) + + c := operatorCluster(existing) + + status, err := argocd.InspectAccount(ctx, c, instance, readOnlySpec()) + require.NoError(t, err) + require.NoError(t, argocd.ConfigureAccount(ctx, c, instance, status)) + + argoCD, err := c.Dynamic.Resource(instance.Operator.Resource).Namespace(instance.Namespace). + Get(ctx, instance.Operator.Name, metav1.GetOptions{}) + require.NoError(t, err) + + extraConfig, _, _ := unstructured.NestedStringMap(argoCD.Object, "spec", "extraConfig") + assert.Equal(t, "180s", extraConfig["timeout.reconciliation"]) + + policy, _, _ := unstructured.NestedString(argoCD.Object, "spec", "rbac", "policy") + assert.Contains(t, policy, "p, alice, applications, *, */*, allow") + assert.Contains(t, policy, "p, octopus, clusters, get, *, allow") +} + +// The operator regenerates argocd-secret, so a temporary password written there +// would be taken away, possibly mid-sign-in. +func TestBeginBootstrapLogin_RefusedForOperatorManagedArgoCD(t *testing.T) { + c := operatorCluster(argoCDResource("openshift-gitops", "openshift-gitops")) + + _, err := argocd.BeginBootstrapLogin(context.Background(), c, operatorInstance(), + argocd.AccountSpec{Name: "octopus"}) + + require.Error(t, err) + assert.Contains(t, err.Error(), "managed by an operator") +} diff --git a/pkg/kubernetes/argocd/bootstrap.go b/pkg/kubernetes/argocd/bootstrap.go new file mode 100644 index 00000000..3e193c9a --- /dev/null +++ b/pkg/kubernetes/argocd/bootstrap.go @@ -0,0 +1,224 @@ +package argocd + +import ( + "context" + "crypto/rand" + "encoding/base64" + "fmt" + "strings" + "time" + + "golang.org/x/crypto/bcrypt" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" +) + +const ( + accountPasswordKeySuffix = ".password" + accountPasswordMtimeKeySuffix = ".passwordMtime" + accountsKeyPrefix = "accounts." +) + +type AuthDiagnosis struct { + // Argo CD tells administrators to delete the initial admin Secret once they + // have logged in, so an established installation usually has none. + HasInitialAdminSecret bool + // Commonly false once an installation is wired up to an identity provider. + AdminEnabled bool +} + +func (d AuthDiagnosis) Explain() string { + switch { + case !d.AdminEnabled: + return "admin login is disabled on this Argo CD (admin.enabled is false in " + ConfigMapName + ")" + case !d.HasInitialAdminSecret: + return "the " + InitialAdminSecretName + " Secret is no longer present, which is normal once someone has logged in to Argo CD" + default: + return "the initial admin password is available, though Argo CD leaves that Secret in place when the admin " + + "password is changed, so it may no longer be the right one" + } +} + +// DiagnoseAuth lets a failure say what is actually wrong rather than just that +// login failed. +func DiagnoseAuth(ctx context.Context, c *octoK8s.Cluster, instance Instance) (AuthDiagnosis, error) { + namespace := instance.Namespace + diagnosis := AuthDiagnosis{AdminEnabled: true} + + _, found, err := c.GetSecret(ctx, namespace, InitialAdminSecretName) + if err != nil { + return AuthDiagnosis{}, err + } + diagnosis.HasInitialAdminSecret = found + + cm, found, err := c.GetConfigMap(ctx, namespace, ConfigMapName) + if err != nil { + return AuthDiagnosis{}, err + } + if found && strings.EqualFold(strings.TrimSpace(cm.Data["admin.enabled"]), "false") { + diagnosis.AdminEnabled = false + } + + return diagnosis, nil +} + +// BootstrapLogin obtains a token when no administrator password is available. +// Argo CD keeps local account passwords in argocd-secret, so cluster access is +// enough to set one; signing in as the Octopus account means Argo CD mints the +// token itself, so nothing is forged and the administrator's password is never +// read or changed. +// +// Revert must be called to undo it. +type BootstrapLogin struct { + cluster *octoK8s.Cluster + namespace string + accountName string + password string + + // Captured before anything changed, to put back afterwards. + grantedLogin bool + previousPassword *string + previousMtime *string +} + +func (b *BootstrapLogin) Credentials() Credentials { + return Credentials{Username: b.accountName, Password: b.password} +} + +// BeginBootstrapLogin grants a temporary password and, if the account lacks it, +// the ability to log in. +func BeginBootstrapLogin(ctx context.Context, c *octoK8s.Cluster, instance Instance, spec AccountSpec) (*BootstrapLogin, error) { + namespace := instance.Namespace + + // An operator reconciles argocd-secret from its own resource, so a password + // written here would be taken away again, possibly mid-sign-in. + if instance.Operator != nil { + return nil, fmt.Errorf( + "this Argo CD is managed by an operator (the %s ArgoCD resource), which regenerates its Secret, "+ + "so Octopus cannot give an account a temporary password here", instance.Operator.Name) + } + + password, err := randomPassword() + if err != nil { + return nil, err + } + + hash, err := bcrypt.GenerateFromPassword([]byte(password), bcrypt.DefaultCost) + if err != nil { + return nil, fmt.Errorf("could not prepare a temporary Argo CD password: %w", err) + } + + bootstrap := &BootstrapLogin{ + cluster: c, + namespace: namespace, + accountName: spec.Name, + password: password, + } + + granted, err := grantLoginCapability(ctx, c, namespace, spec.Name) + if err != nil { + return nil, err + } + bootstrap.grantedLogin = granted + + // Put back exactly whatever was there, rather than replacing it with nothing. + passwordKey := accountsKeyPrefix + spec.Name + accountPasswordKeySuffix + mtimeKey := accountsKeyPrefix + spec.Name + accountPasswordMtimeKeySuffix + + if value, found, err := c.SecretKey(ctx, namespace, SecretName, passwordKey); err != nil { + return nil, err + } else if found { + bootstrap.previousPassword = &value + } + if value, found, err := c.SecretKey(ctx, namespace, SecretName, mtimeKey); err != nil { + return nil, err + } else if found { + bootstrap.previousMtime = &value + } + + err = c.MergeSecretKeys(ctx, namespace, SecretName, map[string]string{ + passwordKey: string(hash), + mtimeKey: time.Now().UTC().Format(time.RFC3339), + }, nil) + if err != nil { + // Leave nothing behind on the way out. + _ = bootstrap.Revert(ctx) + return nil, err + } + + return bootstrap, nil +} + +// Revert leaves any token minted in between working: an API token is validated +// against the account's token list, not its password. +func (b *BootstrapLogin) Revert(ctx context.Context) error { + passwordKey := accountsKeyPrefix + b.accountName + accountPasswordKeySuffix + mtimeKey := accountsKeyPrefix + b.accountName + accountPasswordMtimeKeySuffix + + set := map[string]string{} + var remove []string + + if b.previousPassword != nil { + set[passwordKey] = *b.previousPassword + } else { + remove = append(remove, passwordKey) + } + if b.previousMtime != nil { + set[mtimeKey] = *b.previousMtime + } else { + remove = append(remove, mtimeKey) + } + + if err := b.cluster.MergeSecretKeys(ctx, b.namespace, SecretName, set, remove); err != nil { + return err + } + + if b.grantedLogin { + return revokeLoginCapability(ctx, b.cluster, b.namespace, b.accountName) + } + return nil +} + +// grantLoginCapability reports whether it had to, so reverting does not take +// away a capability the user configured themselves. +func grantLoginCapability(ctx context.Context, c *octoK8s.Cluster, namespace, accountName string) (bool, error) { + cm, found, err := c.GetConfigMap(ctx, namespace, ConfigMapName) + if err != nil { + return false, err + } + if !found { + return false, fmt.Errorf("ConfigMap %s/%s does not exist", namespace, ConfigMapName) + } + + key := accountsKeyPrefix + accountName + if containsCapability(cm.Data[key], capabilityLogin) { + return false, nil + } + + updated := cm.DeepCopy() + updated.Data[key] = addCapability(updated.Data[key], capabilityLogin) + if err := updateConfigMap(ctx, c, updated); err != nil { + return false, err + } + return true, nil +} + +func revokeLoginCapability(ctx context.Context, c *octoK8s.Cluster, namespace, accountName string) error { + cm, found, err := c.GetConfigMap(ctx, namespace, ConfigMapName) + if err != nil || !found { + return err + } + + key := accountsKeyPrefix + accountName + updated := cm.DeepCopy() + updated.Data[key] = removeCapability(updated.Data[key], capabilityLogin) + return updateConfigMap(ctx, c, updated) +} + +func randomPassword() (string, error) { + buf := make([]byte, 32) + if _, err := rand.Read(buf); err != nil { + return "", fmt.Errorf("could not generate a temporary Argo CD password: %w", err) + } + return base64.RawURLEncoding.EncodeToString(buf), nil +} diff --git a/pkg/kubernetes/argocd/bootstrap_test.go b/pkg/kubernetes/argocd/bootstrap_test.go new file mode 100644 index 00000000..d73d0ff5 --- /dev/null +++ b/pkg/kubernetes/argocd/bootstrap_test.go @@ -0,0 +1,205 @@ +package argocd_test + +import ( + "context" + "testing" + + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + "golang.org/x/crypto/bcrypt" +) + +// argoSecret stands in for Argo CD's own Secret, which holds its TLS and +// session signing keys alongside anything Octopus writes there. +func argoSecret(data map[string][]byte) *corev1.Secret { + base := map[string][]byte{ + "server.secretkey": []byte("signing-key"), + "tls.crt": []byte("cert"), + "tls.key": []byte("key"), + "admin.password": []byte("$2a$10$adminhash"), + } + for k, v := range data { + base[k] = v + } + return &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{Name: argocd.SecretName, Namespace: "argocd"}, + Data: base, + } +} + +func bootstrapSpec() argocd.AccountSpec { + return argocd.AccountSpec{Name: "octopus", AllowSync: true} +} + +func TestDiagnoseAuth_InitialSecretPresent(t *testing.T) { + c := clusterWith( + cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey"}), + &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{Name: argocd.InitialAdminSecretName, Namespace: "argocd"}, + Data: map[string][]byte{"password": []byte("hunter2")}, + }, + ) + + diagnosis, err := argocd.DiagnoseAuth(context.Background(), c, inClusterInstance()) + require.NoError(t, err) + + assert.True(t, diagnosis.HasInitialAdminSecret) + assert.True(t, diagnosis.AdminEnabled) + assert.Contains(t, diagnosis.Explain(), "available") +} + +// Argo CD tells administrators to delete the initial secret once they have +// logged in, so this is the ordinary state of an established installation. +func TestDiagnoseAuth_InitialSecretDeleted(t *testing.T) { + c := clusterWith(cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey"})) + + diagnosis, err := argocd.DiagnoseAuth(context.Background(), c, inClusterInstance()) + require.NoError(t, err) + + assert.False(t, diagnosis.HasInitialAdminSecret) + assert.Contains(t, diagnosis.Explain(), argocd.InitialAdminSecretName) +} + +func TestDiagnoseAuth_AdminLoginDisabled(t *testing.T) { + c := clusterWith(cm(argocd.ConfigMapName, map[string]string{ + "accounts.octopus": "apiKey", + "admin.enabled": "false", + })) + + diagnosis, err := argocd.DiagnoseAuth(context.Background(), c, inClusterInstance()) + require.NoError(t, err) + + assert.False(t, diagnosis.AdminEnabled) + assert.Contains(t, diagnosis.Explain(), "admin login is disabled") +} + +func TestBootstrapLogin_SetsAUsablePasswordThenRemovesIt(t *testing.T) { + ctx := context.Background() + c := clusterWith( + cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey"}), + argoSecret(nil), + ) + + bootstrap, err := argocd.BeginBootstrapLogin(ctx, c, inClusterInstance(), bootstrapSpec()) + require.NoError(t, err) + + credentials := bootstrap.Credentials() + assert.Equal(t, "octopus", credentials.Username) + assert.NotEmpty(t, credentials.Password) + + // The stored hash has to match the password handed back, or the sign-in + // that follows cannot work. + hash, found, err := c.SecretKey(ctx, "argocd", argocd.SecretName, "accounts.octopus.password") + require.NoError(t, err) + require.True(t, found) + assert.NoError(t, bcrypt.CompareHashAndPassword([]byte(hash), []byte(credentials.Password))) + + // Signing in needs the login capability, which the account did not have. + config, _, err := c.GetConfigMap(ctx, "argocd", argocd.ConfigMapName) + require.NoError(t, err) + assert.Contains(t, config.Data["accounts.octopus"], "login") + + require.NoError(t, bootstrap.Revert(ctx)) + + _, found, err = c.SecretKey(ctx, "argocd", argocd.SecretName, "accounts.octopus.password") + require.NoError(t, err) + assert.False(t, found, "the temporary password must not be left behind") + + config, _, err = c.GetConfigMap(ctx, "argocd", argocd.ConfigMapName) + require.NoError(t, err) + assert.Equal(t, "apiKey", config.Data["accounts.octopus"], "the login capability must be handed back") +} + +// Argo CD's own keys live in the same Secret. Losing them would break the +// installation, so the write has to be key by key. +func TestBootstrapLogin_LeavesArgoCDsOwnKeysAlone(t *testing.T) { + ctx := context.Background() + c := clusterWith( + cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey"}), + argoSecret(nil), + ) + + bootstrap, err := argocd.BeginBootstrapLogin(ctx, c, inClusterInstance(), bootstrapSpec()) + require.NoError(t, err) + require.NoError(t, bootstrap.Revert(ctx)) + + secret, found, err := c.GetSecret(ctx, "argocd", argocd.SecretName) + require.NoError(t, err) + require.True(t, found) + + for key, want := range map[string]string{ + "server.secretkey": "signing-key", + "tls.crt": "cert", + "tls.key": "key", + "admin.password": "$2a$10$adminhash", + } { + assert.Equal(t, want, string(secret.Data[key]), "%s must survive untouched", key) + } +} + +func TestBootstrapLogin_RestoresAPasswordThatWasAlreadyThere(t *testing.T) { + ctx := context.Background() + c := clusterWith( + cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey, login"}), + argoSecret(map[string][]byte{ + "accounts.octopus.password": []byte("$2a$10$originalhash"), + "accounts.octopus.passwordMtime": []byte("2026-01-01T00:00:00Z"), + }), + ) + + bootstrap, err := argocd.BeginBootstrapLogin(ctx, c, inClusterInstance(), bootstrapSpec()) + require.NoError(t, err) + + hash, _, err := c.SecretKey(ctx, "argocd", argocd.SecretName, "accounts.octopus.password") + require.NoError(t, err) + assert.NotEqual(t, "$2a$10$originalhash", hash, "a temporary password is in force during the bootstrap") + + require.NoError(t, bootstrap.Revert(ctx)) + + hash, found, err := c.SecretKey(ctx, "argocd", argocd.SecretName, "accounts.octopus.password") + require.NoError(t, err) + require.True(t, found) + assert.Equal(t, "$2a$10$originalhash", hash, "the original password must be put back exactly") + + mtime, _, err := c.SecretKey(ctx, "argocd", argocd.SecretName, "accounts.octopus.passwordMtime") + require.NoError(t, err) + assert.Equal(t, "2026-01-01T00:00:00Z", mtime) +} + +func TestBootstrapLogin_DoesNotRevokeACapabilityItDidNotGrant(t *testing.T) { + ctx := context.Background() + c := clusterWith( + cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey, login"}), + argoSecret(nil), + ) + + bootstrap, err := argocd.BeginBootstrapLogin(ctx, c, inClusterInstance(), bootstrapSpec()) + require.NoError(t, err) + require.NoError(t, bootstrap.Revert(ctx)) + + config, _, err := c.GetConfigMap(ctx, "argocd", argocd.ConfigMapName) + require.NoError(t, err) + assert.Contains(t, config.Data["accounts.octopus"], "login") + assert.Contains(t, config.Data["accounts.octopus"], "apiKey") +} + +func TestBootstrapLogin_PasswordIsNotReused(t *testing.T) { + ctx := context.Background() + + passwords := map[string]bool{} + for range 5 { + c := clusterWith( + cm(argocd.ConfigMapName, map[string]string{"accounts.octopus": "apiKey"}), + argoSecret(nil), + ) + bootstrap, err := argocd.BeginBootstrapLogin(ctx, c, inClusterInstance(), bootstrapSpec()) + require.NoError(t, err) + passwords[bootstrap.Credentials().Password] = true + } + + assert.Len(t, passwords, 5) +} diff --git a/pkg/kubernetes/argocd/discover.go b/pkg/kubernetes/argocd/discover.go new file mode 100644 index 00000000..7713a850 --- /dev/null +++ b/pkg/kubernetes/argocd/discover.go @@ -0,0 +1,462 @@ +// Package argocd discovers an Argo CD installation in a cluster and, on +// request, prepares the Octopus account the gateway authenticates as. +package argocd + +import ( + "context" + "fmt" + "sort" + "strings" + + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime/schema" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" +) + +const ( + // ConfigMapName is also how an installation is recognised when its labels + // do not match anything expected: Argo CD reads its configuration from a + // ConfigMap of exactly this name, so every installation has one. + + ConfigMapName = "argocd-cm" + RBACConfigMapName = "argocd-rbac-cm" + ParamsConfigMapName = "argocd-cmd-params-cm" + + // Argo CD generates this at install time, and tells administrators to + // delete it once they have logged in. + InitialAdminSecretName = "argocd-initial-admin-secret" + + // Holds Argo CD's TLS and session signing keys alongside local account + // credentials, so it must only ever be edited key by key, never replaced. + SecretName = "argocd-secret" +) + +const ( + capabilityAPIKey = "apiKey" + capabilityLogin = "login" +) + +// Kind changes almost every connection setting the gateway needs. +// OperatorInstance is the ArgoCD custom resource an operator manages an +// installation from, as used by the Argo CD operator and OpenShift GitOps. +type OperatorInstance struct { + Name string + Resource schema.GroupVersionResource +} + +type Kind string + +const ( + KindInCluster Kind = "in-cluster" + // AWS runs Argo CD in its own control plane and exposes it publicly. + KindEKSManaged Kind = "eks-managed" +) + +type Instance struct { + Kind Kind + + // Name is set where an instance has its own, such as the EKS capability + // name. In-cluster installs are identified by their namespace instead. + Name string + // Status is reported by managed instances only. + Status string + // Operator names the resource an operator reconciles this instance from, + // when one does. Argo CD's ConfigMaps are then generated, so changes + // written straight to them are reverted. + Operator *OperatorInstance + + Namespace string + ServiceName string + Version string + ServerGRPCURL string + // Plaintext means Argo CD serves the API without TLS, which is what + // `server.insecure` does. Maps to gateway.argocd.plaintext. + Plaintext bool + // SelfSignedTLS maps to gateway.argocd.insecure. + SelfSignedTLS bool + // GRPCWeb tunnels gRPC over HTTP/1.1, which AWS's load balancer requires + // because it does not speak HTTP/2. + GRPCWeb bool + GRPCWebRootPath string + WebUIURL string +} + +// IsManaged means Argo CD is hosted outside the cluster, so the account and +// RBAC automation does not apply. +func (i Instance) IsManaged() bool { + return i.Kind == KindEKSManaged +} + +func (i Instance) Display() string { + if i.IsManaged() { + s := "AWS managed Argo CD" + if i.Name != "" { + s = fmt.Sprintf("%s %s", s, i.Name) + } + if i.Version != "" { + s = fmt.Sprintf("%s, %s", s, i.Version) + } + return fmt.Sprintf("%s (%s)", s, i.ServerGRPCURL) + } + + s := fmt.Sprintf("%s (namespace %s)", i.ServiceName, i.Namespace) + if i.Version != "" { + s = fmt.Sprintf("%s, %s", s, i.Version) + } + return s +} + +type ErrNoInstances struct { + // Skipped explains any candidate that was found but could not be used. + Skipped []string +} + +func (e ErrNoInstances) Error() string { + message := "no Argo CD API server was found in this cluster. Octopus looked for a deployment labelled as one, and in every " + + "namespace holding an " + ConfigMapName + " ConfigMap. If Argo CD is there under different labels, name its namespace with " + + "--argocd-namespace; if it runs outside this cluster, give its address with --argocd-server-grpc-url. Note that an Argo CD " + + "running in core mode has no API server for the gateway to connect to" + + if len(e.Skipped) > 0 { + message += "\n\nThese were found but could not be used:\n " + strings.Join(e.Skipped, "\n ") + } + return message +} + +// argoCDSelectors find resources belonging to an Argo CD installation. Every +// one names Argo CD: a selector like component=server on its own matches any +// application in the cluster that happens to have a server. +var argoCDSelectors = []string{ + "app.kubernetes.io/part-of=argocd", + "app.kubernetes.io/name=argocd-server", + "app=argocd-server", +} + +// nonAPIServerComponents are Argo CD's other workloads. They carry the same +// part-of label as the API server, and some of them are also named "-server". +var nonAPIServerComponents = []string{ + "repo-server", "dex-server", "redis", "application-controller", + "applicationset-controller", "notifications-controller", "commit-server", +} + +func Discover(ctx context.Context, c *octoK8s.Cluster) ([]Instance, error) { + deployments, err := findServerDeployments(ctx, c) + if err != nil { + return nil, err + } + + instances := make([]Instance, 0, len(deployments)) + var skipped []string + for i := range deployments { + d := &deployments[i] + + instance, err := describe(ctx, c, d.Namespace, d.Name, imageOf(d.Spec.Template.Spec.Containers)) + if err != nil { + // One unusable candidate must not hide a working installation + // elsewhere in the cluster, but the reason is worth keeping in case + // it turns out to be the only one. + skipped = append(skipped, err.Error()) + continue + } + instances = append(instances, instance) + } + + if len(instances) == 0 { + return nil, ErrNoInstances{Skipped: skipped} + } + + sort.Slice(instances, func(i, j int) bool { return instances[i].Namespace < instances[j].Namespace }) + return instances, nil +} + +// DiscoverInNamespace finds Argo CD in one namespace, for when its labels are +// not what any of the selectors expect and the namespace was given explicitly. +func DiscoverInNamespace(ctx context.Context, c *octoK8s.Cluster, namespace string) (Instance, error) { + deployments, err := c.Clientset.AppsV1().Deployments(namespace).List(ctx, metav1.ListOptions{}) + if err != nil { + return Instance{}, fmt.Errorf("could not read deployments in namespace %s: %w", namespace, err) + } + + for i := range deployments.Items { + d := &deployments.Items[i] + if !isAPIServer(d) { + continue + } + return describe(ctx, c, d.Namespace, d.Name, imageOf(d.Spec.Template.Spec.Containers)) + } + + return Instance{}, fmt.Errorf( + "namespace %s does not contain an Argo CD API server. The gateway connects to Argo CD's API server, "+ + "so it cannot be used with an Argo CD running in core mode", namespace) +} + +// findServerDeployments works through the selectors, then falls back to the +// namespaces holding an Argo CD ConfigMap. +func findServerDeployments(ctx context.Context, c *octoK8s.Cluster) ([]appsv1.Deployment, error) { + seen := map[string]bool{} + var found []appsv1.Deployment + + add := func(d appsv1.Deployment) { + key := d.Namespace + "/" + d.Name + if !seen[key] && isAPIServer(&d) { + seen[key] = true + found = append(found, d) + } + } + + for _, selector := range argoCDSelectors { + list, err := c.Clientset.AppsV1().Deployments(metav1.NamespaceAll). + List(ctx, metav1.ListOptions{LabelSelector: selector}) + if err != nil { + return nil, fmt.Errorf("could not search the cluster for Argo CD: %w", err) + } + for i := range list.Items { + add(list.Items[i]) + } + } + + if len(found) > 0 { + return found, nil + } + + // Nothing carried a label naming Argo CD, so fall back to the namespaces + // that hold its ConfigMap and require the workload to run an Argo CD image. + for _, namespace := range namespacesWithArgoConfig(ctx, c) { + list, err := c.Clientset.AppsV1().Deployments(namespace).List(ctx, metav1.ListOptions{}) + if err != nil { + continue + } + for i := range list.Items { + if runsArgoCD(&list.Items[i]) { + add(list.Items[i]) + } + } + } + + return found, nil +} + +// isAPIServer distinguishes the API server from Argo CD's other workloads, +// which share its labels and are sometimes also named "-server". +func isAPIServer(d *appsv1.Deployment) bool { + if component := d.Labels["app.kubernetes.io/component"]; component != "" { + return component == "server" + } + + name := d.Name + if !strings.HasSuffix(name, "-server") { + return false + } + for _, other := range nonAPIServerComponents { + if strings.HasSuffix(name, other) { + return false + } + } + return true +} + +func runsArgoCD(d *appsv1.Deployment) bool { + for _, container := range d.Spec.Template.Spec.Containers { + if strings.Contains(container.Image, "argocd") || strings.Contains(container.Image, "argo-cd") { + return true + } + } + return false +} + +// namespacesWithArgoConfig finds installations whose labels name nothing +// recognisable. Argo CD reads its configuration from a ConfigMap of a fixed +// name, so the namespaces holding one are where to look. +func namespacesWithArgoConfig(ctx context.Context, c *octoK8s.Cluster) []string { + namespaces, err := c.Clientset.CoreV1().Namespaces().List(ctx, metav1.ListOptions{}) + if err != nil { + return nil + } + + var found []string + for _, namespace := range namespaces.Items { + if _, ok, err := c.GetConfigMap(ctx, namespace.Name, ConfigMapName); err == nil && ok { + found = append(found, namespace.Name) + } + } + return found +} + +func describe(ctx context.Context, c *octoK8s.Cluster, namespace, deploymentName, image string) (Instance, error) { + instance := Instance{ + Kind: KindInCluster, + Namespace: namespace, + ServiceName: deploymentName, + Version: versionFromImage(image), + } + + service, err := c.Clientset.CoreV1().Services(namespace).Get(ctx, deploymentName, metav1.GetOptions{}) + if err != nil { + return Instance{}, fmt.Errorf("found an Argo CD API server in namespace %s but could not read its Service %q: %w", namespace, deploymentName, err) + } + + // `server.insecure` makes Argo CD serve the API without TLS. Otherwise it + // serves TLS, by default with a self-signed certificate - both of which the + // gateway has to be told about explicitly or it will refuse to connect. + instance.Plaintext = isInsecureMode(ctx, c, namespace) + instance.SelfSignedTLS = !instance.Plaintext + + instance.ServerGRPCURL = grpcURL(service, instance.Plaintext) + instance.WebUIURL = webUIURL(ctx, c, namespace, service) + instance.Operator = findOperatorInstance(ctx, c, namespace) + + return instance, nil +} + +// grpcURL is always a Service DNS name: the gateway runs inside the cluster. +func grpcURL(service *corev1.Service, plaintext bool) string { + port := servicePort(service, plaintext) + host := fmt.Sprintf("%s.%s.svc.cluster.local", service.Name, service.Namespace) + + // Default ports carry no information, so leave them off. + if (plaintext && port == 80) || (!plaintext && port == 443) { + return "grpc://" + host + } + return fmt.Sprintf("grpc://%s:%d", host, port) +} + +func servicePort(service *corev1.Service, plaintext bool) int32 { + wanted := "https" + fallback := int32(443) + if plaintext { + wanted, fallback = "http", 80 + } + + for _, p := range service.Spec.Ports { + if p.Name == wanted { + return p.Port + } + } + for _, p := range service.Spec.Ports { + if p.Port == fallback { + return p.Port + } + } + if len(service.Spec.Ports) > 0 { + return service.Spec.Ports[0].Port + } + return fallback +} + +func isInsecureMode(ctx context.Context, c *octoK8s.Cluster, namespace string) bool { + cm, found, err := c.GetConfigMap(ctx, namespace, ParamsConfigMapName) + if err != nil || !found { + return false + } + return strings.EqualFold(strings.TrimSpace(cm.Data["server.insecure"]), "true") +} + +// webUIURL is a convenience for linking from Octopus, so every lookup degrades +// to an empty string. +func webUIURL(ctx context.Context, c *octoK8s.Cluster, namespace string, service *corev1.Service) string { + if cm, found, err := c.GetConfigMap(ctx, namespace, ConfigMapName); err == nil && found { + if url := strings.TrimSpace(cm.Data["url"]); url != "" { + return url + } + } + + if url := ingressURL(ctx, c, namespace, service.Name); url != "" { + return url + } + + return loadBalancerURL(service) +} + +func ingressURL(ctx context.Context, c *octoK8s.Cluster, namespace, serviceName string) string { + ingresses, err := c.Clientset.NetworkingV1().Ingresses(namespace).List(ctx, metav1.ListOptions{}) + if err != nil { + return "" + } + + for _, ing := range ingresses.Items { + for _, rule := range ing.Spec.Rules { + if rule.Host == "" || rule.HTTP == nil { + continue + } + for _, path := range rule.HTTP.Paths { + if path.Backend.Service != nil && path.Backend.Service.Name == serviceName { + return "https://" + rule.Host + } + } + } + } + return "" +} + +func loadBalancerURL(service *corev1.Service) string { + if service.Spec.Type != corev1.ServiceTypeLoadBalancer { + return "" + } + for _, ing := range service.Status.LoadBalancer.Ingress { + if ing.Hostname != "" { + return "https://" + ing.Hostname + } + if ing.IP != "" { + return "https://" + ing.IP + } + } + return "" +} + +func imageOf(containers []corev1.Container) string { + for _, c := range containers { + if strings.Contains(c.Image, "argocd") { + return c.Image + } + } + if len(containers) > 0 { + return containers[0].Image + } + return "" +} + +// versionFromImage turns quay.io/argoproj/argocd:v3.4.2 into v3.4.2. +func versionFromImage(image string) string { + if image == "" { + return "" + } + // Strip any digest first so the tag search cannot hit it. + if at := strings.Index(image, "@"); at >= 0 { + image = image[:at] + } + colon := strings.LastIndex(image, ":") + if colon < 0 { + return "" + } + // A colon before the last slash is a registry port, not a tag. + if strings.Contains(image[colon:], "/") { + return "" + } + return image[colon+1:] +} + +// argoCDResources are the ArgoCD custom resource versions an operator may use. +var argoCDResources = []schema.GroupVersionResource{ + {Group: "argoproj.io", Version: "v1beta1", Resource: "argocds"}, + {Group: "argoproj.io", Version: "v1alpha1", Resource: "argocds"}, +} + +// findOperatorInstance looks for the resource an operator reconciles this +// installation from. A cluster without the CRD simply has none. +func findOperatorInstance(ctx context.Context, c *octoK8s.Cluster, namespace string) *OperatorInstance { + if c.Dynamic == nil { + return nil + } + + for _, gvr := range argoCDResources { + list, err := c.Dynamic.Resource(gvr).Namespace(namespace).List(ctx, metav1.ListOptions{}) + if err != nil || len(list.Items) == 0 { + continue + } + return &OperatorInstance{Name: list.Items[0].GetName(), Resource: gvr} + } + return nil +} diff --git a/pkg/kubernetes/argocd/discover_test.go b/pkg/kubernetes/argocd/discover_test.go new file mode 100644 index 00000000..f895da7a --- /dev/null +++ b/pkg/kubernetes/argocd/discover_test.go @@ -0,0 +1,376 @@ +package argocd_test + +import ( + "context" + "testing" + + appsv1 "k8s.io/api/apps/v1" + corev1 "k8s.io/api/core/v1" + networkingv1 "k8s.io/api/networking/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/client-go/kubernetes/fake" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// argoCDLabels are what every Argo CD install puts on its API server. The name +// varies with how it was installed - an operator names resources after its +// ArgoCD resource - so discovery matches on part-of and component instead. +func argoCDLabels(name string) map[string]string { + return map[string]string{ + "app.kubernetes.io/name": name, + "app.kubernetes.io/part-of": "argocd", + "app.kubernetes.io/component": "server", + } +} + +func serverDeployment(namespace, image string) *appsv1.Deployment { + return namedServerDeployment(namespace, "argocd-server", image) +} + +func namedServerDeployment(namespace, name, image string) *appsv1.Deployment { + return &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Namespace: namespace, + Labels: argoCDLabels(name), + }, + Spec: appsv1.DeploymentSpec{ + Template: corev1.PodTemplateSpec{ + Spec: corev1.PodSpec{Containers: []corev1.Container{{Name: "argocd-server", Image: image}}}, + }, + }, + } +} + +// serverService mirrors the Service a stock Argo CD install creates. +func serverService(namespace string) *corev1.Service { + return namedServerService(namespace, "argocd-server") +} + +func namedServerService(namespace, name string) *corev1.Service { + return &corev1.Service{ + ObjectMeta: metav1.ObjectMeta{Name: name, Namespace: namespace, Labels: argoCDLabels(name)}, + Spec: corev1.ServiceSpec{ + Type: corev1.ServiceTypeClusterIP, + Ports: []corev1.ServicePort{ + {Name: "http", Port: 80}, + {Name: "https", Port: 443}, + }, + }, + } +} + +func clusterWith(objects ...runtime.Object) *octoK8s.Cluster { + return octoK8s.NewClusterForTesting(fake.NewSimpleClientset(objects...), "test", "https://cluster") +} + +func TestDiscover_StockInstall(t *testing.T) { + c := clusterWith( + serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), + serverService("argocd"), + ) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + require.Len(t, instances, 1) + + got := instances[0] + assert.Equal(t, "argocd", got.Namespace) + assert.Equal(t, "argocd-server", got.ServiceName) + assert.Equal(t, "v3.4.2", got.Version) + // A stock install serves TLS with a self-signed certificate, so the gateway + // has to be told to skip verification but keep TLS on. + assert.Equal(t, "grpc://argocd-server.argocd.svc.cluster.local", got.ServerGRPCURL) + assert.False(t, got.Plaintext) + assert.True(t, got.SelfSignedTLS) +} + +func TestDiscover_InsecureMode(t *testing.T) { + c := clusterWith( + serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), + serverService("argocd"), + &corev1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{Name: argocd.ParamsConfigMapName, Namespace: "argocd"}, + Data: map[string]string{"server.insecure": "true"}, + }, + ) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + require.Len(t, instances, 1) + + assert.True(t, instances[0].Plaintext) + assert.False(t, instances[0].SelfSignedTLS) + assert.Equal(t, "grpc://argocd-server.argocd.svc.cluster.local", instances[0].ServerGRPCURL) +} + +func TestDiscover_NonDefaultPort(t *testing.T) { + svc := serverService("argocd") + svc.Spec.Ports = []corev1.ServicePort{{Name: "https", Port: 8443}} + + c := clusterWith(serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), svc) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + assert.Equal(t, "grpc://argocd-server.argocd.svc.cluster.local:8443", instances[0].ServerGRPCURL) +} + +func TestDiscover_NoArgoCD(t *testing.T) { + _, err := argocd.Discover(context.Background(), clusterWith()) + assert.ErrorAs(t, err, &argocd.ErrNoInstances{}) +} + +func TestDiscover_MultipleInstancesSortedByNamespace(t *testing.T) { + c := clusterWith( + serverDeployment("team-b", "quay.io/argoproj/argocd:v3.4.2"), serverService("team-b"), + serverDeployment("team-a", "quay.io/argoproj/argocd:v3.3.0"), serverService("team-a"), + ) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + require.Len(t, instances, 2) + assert.Equal(t, "team-a", instances[0].Namespace) + assert.Equal(t, "team-b", instances[1].Namespace) +} + +func TestDiscover_WebUIURLFromConfigMap(t *testing.T) { + c := clusterWith( + serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), + serverService("argocd"), + &corev1.ConfigMap{ + ObjectMeta: metav1.ObjectMeta{Name: argocd.ConfigMapName, Namespace: "argocd"}, + Data: map[string]string{"url": "https://argo.example.com"}, + }, + ) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + assert.Equal(t, "https://argo.example.com", instances[0].WebUIURL) +} + +func TestDiscover_WebUIURLFromIngress(t *testing.T) { + pathType := networkingv1.PathTypePrefix + c := clusterWith( + serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), + serverService("argocd"), + &networkingv1.Ingress{ + ObjectMeta: metav1.ObjectMeta{Name: "argocd-server", Namespace: "argocd"}, + Spec: networkingv1.IngressSpec{ + Rules: []networkingv1.IngressRule{{ + Host: "argo.example.com", + IngressRuleValue: networkingv1.IngressRuleValue{ + HTTP: &networkingv1.HTTPIngressRuleValue{ + Paths: []networkingv1.HTTPIngressPath{{ + Path: "/", + PathType: &pathType, + Backend: networkingv1.IngressBackend{ + Service: &networkingv1.IngressServiceBackend{Name: "argocd-server"}, + }, + }}, + }, + }, + }}, + }, + }, + ) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + assert.Equal(t, "https://argo.example.com", instances[0].WebUIURL) +} + +func TestDiscover_NoWebUIURLIsNotAnError(t *testing.T) { + c := clusterWith(serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), serverService("argocd")) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + assert.Empty(t, instances[0].WebUIURL) +} + +// When the only candidate cannot be used, its reason must survive rather than +// being reported as though nothing was there. +func TestDiscover_ReportsWhyTheOnlyCandidateWasUnusable(t *testing.T) { + c := clusterWith(serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2")) + + _, err := argocd.Discover(context.Background(), c) + require.Error(t, err) + assert.ErrorAs(t, err, &argocd.ErrNoInstances{}) + assert.Contains(t, err.Error(), "could not read its Service") +} + +// OpenShift GitOps and the Argo CD operator name every resource after their +// ArgoCD resource, so nothing is called argocd-server. +func TestDiscover_OperatorNamedInstall(t *testing.T) { + c := clusterWith( + namedServerDeployment("openshift-gitops", "openshift-gitops-server", "quay.io/argoproj/argocd:v3.4.2"), + namedServerService("openshift-gitops", "openshift-gitops-server"), + ) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + require.Len(t, instances, 1) + + assert.Equal(t, "openshift-gitops", instances[0].Namespace) + assert.Equal(t, "openshift-gitops-server", instances[0].ServiceName) + assert.Equal(t, "grpc://openshift-gitops-server.openshift-gitops.svc.cluster.local", instances[0].ServerGRPCURL) +} + +// An installation whose labels match nothing expected is still found, because +// Argo CD reads its configuration from a ConfigMap of a fixed name. +func TestDiscover_FallsBackToTheArgoCDConfigMap(t *testing.T) { + unlabelled := &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{Name: "gitops-server", Namespace: "tools"}, + Spec: appsv1.DeploymentSpec{ + Template: corev1.PodTemplateSpec{ + Spec: corev1.PodSpec{Containers: []corev1.Container{{Image: "quay.io/argoproj/argocd:v3.4.2"}}}, + }, + }, + } + + c := clusterWith( + &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "tools"}}, + &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: argocd.ConfigMapName, Namespace: "tools"}}, + unlabelled, + namedServerService("tools", "gitops-server"), + ) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + require.Len(t, instances, 1) + assert.Equal(t, "gitops-server", instances[0].ServiceName) +} + +// Argo CD's other workloads share the API server's labels, so the repo server +// must not be mistaken for it. +func TestDiscover_IgnoresTheRepoServer(t *testing.T) { + repoServer := namedServerDeployment("argocd", "argocd-repo-server", "quay.io/argoproj/argocd:v3.4.2") + repoServer.Labels["app.kubernetes.io/component"] = "repo-server" + + c := clusterWith( + serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), + serverService("argocd"), + repoServer, + ) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + require.Len(t, instances, 1) + assert.Equal(t, "argocd-server", instances[0].ServiceName) +} + +// The same installation matching more than one selector must not appear twice. +func TestDiscover_DoesNotDuplicateAcrossSelectors(t *testing.T) { + c := clusterWith(serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), serverService("argocd")) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + assert.Len(t, instances, 1) +} + +func TestDiscoverInNamespace(t *testing.T) { + c := clusterWith( + namedServerDeployment("gitops", "my-argo-server", "quay.io/argoproj/argocd:v3.4.2"), + namedServerService("gitops", "my-argo-server"), + ) + + instance, err := argocd.DiscoverInNamespace(context.Background(), c, "gitops") + require.NoError(t, err) + assert.Equal(t, "my-argo-server", instance.ServiceName) + + _, err = argocd.DiscoverInNamespace(context.Background(), c, "empty") + assert.ErrorContains(t, err, "does not contain an Argo CD API server") +} + +// A selector like component=server matches anything in the cluster with a +// server, so an unrelated application must not be mistaken for Argo CD. +func TestDiscover_IgnoresUnrelatedServers(t *testing.T) { + unrelated := &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{ + Name: "model-catalog-server", + Namespace: "kubeflow", + Labels: map[string]string{ + "app.kubernetes.io/name": "model-catalog", + "app.kubernetes.io/component": "server", + }, + }, + Spec: appsv1.DeploymentSpec{ + Template: corev1.PodTemplateSpec{ + Spec: corev1.PodSpec{Containers: []corev1.Container{{Image: "kubeflow/model-catalog:1.0"}}}, + }, + }, + } + + c := clusterWith( + unrelated, + serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), + serverService("argocd"), + ) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + require.Len(t, instances, 1) + assert.Equal(t, "argocd", instances[0].Namespace) +} + +// An unrelated deployment with no Service of its own must not abort the search +// before the real Argo CD is reached. +func TestDiscover_OneUnusableCandidateDoesNotHideTheRest(t *testing.T) { + strayArgo := namedServerDeployment("stray", "argocd-server", "quay.io/argoproj/argocd:v3.4.2") + + c := clusterWith( + strayArgo, // deliberately has no Service + serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), + serverService("argocd"), + ) + + instances, err := argocd.Discover(context.Background(), c) + require.NoError(t, err) + require.Len(t, instances, 1) + assert.Equal(t, "argocd", instances[0].Namespace) +} + +// Argo CD's other workloads carry the same part-of label, and dex is also +// named "-server". +func TestDiscover_IgnoresArgoCDsOtherWorkloads(t *testing.T) { + objects := []runtime.Object{ + serverDeployment("argocd", "quay.io/argoproj/argocd:v3.4.2"), + serverService("argocd"), + } + for _, name := range []string{"argocd-repo-server", "argocd-dex-server", "argocd-applicationset-controller"} { + d := namedServerDeployment("argocd", name, "quay.io/argoproj/argocd:v3.4.2") + delete(d.Labels, "app.kubernetes.io/component") + objects = append(objects, d) + } + + instances, err := argocd.Discover(context.Background(), clusterWith(objects...)) + require.NoError(t, err) + require.Len(t, instances, 1) + assert.Equal(t, "argocd-server", instances[0].ServiceName) +} + +// The ConfigMap fallback must not sweep up whatever else lives in that +// namespace. +func TestDiscover_ConfigMapFallbackRequiresAnArgoCDImage(t *testing.T) { + notArgo := &appsv1.Deployment{ + ObjectMeta: metav1.ObjectMeta{Name: "some-server", Namespace: "tools"}, + Spec: appsv1.DeploymentSpec{ + Template: corev1.PodTemplateSpec{ + Spec: corev1.PodSpec{Containers: []corev1.Container{{Image: "nginx:1.27"}}}, + }, + }, + } + + c := clusterWith( + &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: "tools"}}, + &corev1.ConfigMap{ObjectMeta: metav1.ObjectMeta{Name: argocd.ConfigMapName, Namespace: "tools"}}, + notArgo, + ) + + _, err := argocd.Discover(context.Background(), c) + assert.ErrorAs(t, err, &argocd.ErrNoInstances{}) +} diff --git a/pkg/kubernetes/argocd/eks.go b/pkg/kubernetes/argocd/eks.go new file mode 100644 index 00000000..df221289 --- /dev/null +++ b/pkg/kubernetes/argocd/eks.go @@ -0,0 +1,284 @@ +package argocd + +import ( + "context" + "encoding/base64" + "encoding/json" + "fmt" + "os" + "os/exec" + "strings" + "time" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" +) + +// awsTimeout keeps a stale SSO session showing up as a prompt for the endpoint +// rather than a hang. +const awsTimeout = 30 * time.Second + +const argoCapabilityType = "ARGOCD" + +// UnscopedProject names the token the gateway falls back on for Argo CD calls +// that are not project-scoped. +const UnscopedProject = "octo-gateway-unscoped" + +// ProjectToken is a project role token. AWS caps account token lifetimes at 12 +// hours, so managed instances authenticate per project instead. +type ProjectToken struct { + Project string `json:"project"` + Token string `json:"token"` +} + +// DiscoverEKSManaged asks AWS because the EKS capability runs Argo CD in the +// AWS control plane, not on the cluster's nodes - there is nothing in the +// cluster to find. The AWS CLI is already required for the kubeconfig context +// to authenticate, so calling it adds no new prerequisite. +func DiscoverEKSManaged(ctx context.Context, eks *octoK8s.EKSContext) (Instance, bool, error) { + if eks == nil { + return Instance{}, false, nil + } + if _, err := exec.LookPath("aws"); err != nil { + return Instance{}, false, nil + } + + capabilities, err := listArgoCapabilities(ctx, eks) + if err != nil { + return Instance{}, false, err + } + + for _, capability := range capabilities { + instance, found, err := describeArgoCapability(ctx, eks, capability) + if err != nil { + return Instance{}, false, err + } + if found { + return instance, true, nil + } + } + return Instance{}, false, nil +} + +// NewManagedInstance keeps TLS verification on and tunnels gRPC over HTTP/1.1: +// AWS serves managed Argo CD with a publicly trusted certificate, behind a load +// balancer that does not support HTTP/2. +func NewManagedInstance(endpoint string) Instance { + return Instance{ + Kind: KindEKSManaged, + ServerGRPCURL: normaliseGRPCURL(endpoint), + Plaintext: false, + SelfSignedTLS: false, + GRPCWeb: true, + } +} + +type capabilitySummary struct { + CapabilityName string `json:"capabilityName"` + Type string `json:"type"` + Status string `json:"status"` + Version string `json:"version"` +} + +func listArgoCapabilities(ctx context.Context, eks *octoK8s.EKSContext) ([]capabilitySummary, error) { + out, err := runAWS(ctx, eks, "eks", "list-capabilities", "--cluster-name", eks.ClusterName) + if err != nil { + return nil, err + } + + capabilities, err := parseCapabilityList(out) + if err != nil { + return nil, fmt.Errorf("could not read the EKS capabilities for cluster %s: %w", eks.ClusterName, err) + } + return capabilities, nil +} + +// parseCapabilityList picks out the Argo CD entries. The listing carries the +// type and version, so only those need a follow-up describe call. +func parseCapabilityList(out []byte) ([]capabilitySummary, error) { + var response struct { + Capabilities []capabilitySummary `json:"capabilities"` + } + if err := json.Unmarshal(out, &response); err != nil { + return nil, err + } + + var argo []capabilitySummary + for _, c := range response.Capabilities { + if strings.EqualFold(c.Type, argoCapabilityType) { + argo = append(argo, c) + } + } + return argo, nil +} + +func describeArgoCapability(ctx context.Context, eks *octoK8s.EKSContext, summary capabilitySummary) (Instance, bool, error) { + out, err := runAWS(ctx, eks, "eks", "describe-capability", + "--cluster-name", eks.ClusterName, "--capability-name", summary.CapabilityName) + if err != nil { + return Instance{}, false, err + } + + instance, found, err := parseCapabilityDescription(out, summary) + if err != nil { + return Instance{}, false, fmt.Errorf("could not read the %s capability on cluster %s: %w", + summary.CapabilityName, eks.ClusterName, err) + } + return instance, found, nil +} + +// parseCapabilityDescription reads the address out of `aws eks +// describe-capability`. +func parseCapabilityDescription(out []byte, summary capabilitySummary) (Instance, bool, error) { + var response struct { + Capability struct { + Status string `json:"status"` + Version string `json:"version"` + Configuration struct { + ArgoCD struct { + Namespace string `json:"namespace"` + ServerURL string `json:"serverUrl"` + } `json:"argoCd"` + } `json:"configuration"` + } `json:"capability"` + } + if err := json.Unmarshal(out, &response); err != nil { + return Instance{}, false, err + } + + argo := response.Capability.Configuration.ArgoCD + if strings.TrimSpace(argo.ServerURL) == "" { + // No address yet, which is what a still-provisioning capability looks like. + return Instance{}, false, nil + } + + instance := NewManagedInstance(argo.ServerURL) + instance.Name = summary.CapabilityName + instance.Namespace = argo.Namespace + instance.Version = firstNonEmpty(response.Capability.Version, summary.Version) + instance.Status = firstNonEmpty(response.Capability.Status, summary.Status) + instance.WebUIURL = webURLFor(argo.ServerURL) + return instance, true, nil +} + +func runAWS(ctx context.Context, eks *octoK8s.EKSContext, args ...string) ([]byte, error) { + ctx, cancel := context.WithTimeout(ctx, awsTimeout) + defer cancel() + + full := append([]string{}, args...) + if eks.Region != "" { + full = append(full, "--region", eks.Region) + } + full = append(full, "--output", "json") + + cmd := exec.CommandContext(ctx, "aws", full...) + cmd.Env = os.Environ() + if eks.Profile != "" { + cmd.Env = append(cmd.Env, "AWS_PROFILE="+eks.Profile) + } + + var stderr strings.Builder + cmd.Stderr = &stderr + + out, err := cmd.Output() + if err != nil { + return nil, fmt.Errorf("aws %s failed: %w: %s", strings.Join(args, " "), err, strings.TrimSpace(stderr.String())) + } + return out, nil +} + +// normaliseGRPCURL produces the grpc:// URL the chart expects. AWS reports the +// endpoint as a bare hostname or an https:// URL depending where it is read from. +func normaliseGRPCURL(endpoint string) string { + endpoint = strings.TrimSpace(endpoint) + if endpoint == "" { + return "" + } + if strings.HasPrefix(endpoint, "grpc://") { + return endpoint + } + + host := endpoint + for _, prefix := range []string{"https://", "http://"} { + host = strings.TrimPrefix(host, prefix) + } + return "grpc://" + strings.TrimSuffix(host, "/") +} + +func webURLFor(endpoint string) string { + host := strings.TrimPrefix(normaliseGRPCURL(endpoint), "grpc://") + if host == "" { + return "" + } + return "https://" + host +} + +func firstNonEmpty(values ...string) string { + for _, v := range values { + if strings.TrimSpace(v) != "" { + return strings.TrimSpace(v) + } + } + return "" +} + +// ProjectTokenClaims are the parts of an Argo CD project role token Octopus +// needs to know. +type ProjectTokenClaims struct { + Project string + Role string + // Expires is zero for a token that does not expire. + Expires time.Time +} + +// Expired reports whether the token has already lapsed. +func (c ProjectTokenClaims) Expired() bool { + return !c.Expires.IsZero() && c.Expires.Before(time.Now()) +} + +// ParseProjectToken reads the project and role out of a token without verifying +// it. Only Argo CD can verify one, and all that is needed here is the subject, +// which Argo CD sets to proj:: - so a person pasting a token +// does not also have to say which project it belongs to. +func ParseProjectToken(token string) (ProjectTokenClaims, error) { + parts := strings.Split(strings.TrimSpace(token), ".") + if len(parts) != 3 { + return ProjectTokenClaims{}, fmt.Errorf("this does not look like an Argo CD token") + } + + payload, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(parts[1], "=")) + if err != nil { + return ProjectTokenClaims{}, fmt.Errorf("this does not look like an Argo CD token") + } + + var claims struct { + Subject string `json:"sub"` + Expires int64 `json:"exp"` + } + if err := json.Unmarshal(payload, &claims); err != nil { + return ProjectTokenClaims{}, fmt.Errorf("this does not look like an Argo CD token") + } + + project, role, err := splitProjectSubject(claims.Subject) + if err != nil { + return ProjectTokenClaims{}, err + } + + parsed := ProjectTokenClaims{Project: project, Role: role} + if claims.Expires > 0 { + parsed.Expires = time.Unix(claims.Expires, 0) + } + return parsed, nil +} + +// splitProjectSubject rejects anything that is not a project role token. An +// account token has a subject of the form :apiKey, and AWS caps those +// at 12 hours, so one here would stop working within the day. +func splitProjectSubject(subject string) (project, role string, err error) { + parts := strings.Split(subject, ":") + if len(parts) != 3 || parts[0] != "proj" || parts[1] == "" || parts[2] == "" { + return "", "", fmt.Errorf( + "this is not an Argo CD project role token (its subject is %q). Generate one with "+ + "`argocd proj role create-token `, or from Settings > Projects in the Argo CD UI", subject) + } + return parts[1], parts[2], nil +} diff --git a/pkg/kubernetes/argocd/eks_internal_test.go b/pkg/kubernetes/argocd/eks_internal_test.go new file mode 100644 index 00000000..9da20c78 --- /dev/null +++ b/pkg/kubernetes/argocd/eks_internal_test.go @@ -0,0 +1,104 @@ +package argocd + +import ( + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// The fixtures below are real `aws eks` responses, captured from an EKS cluster +// running the Argo CD capability. The field names are not obvious - the address +// lives at configuration.argoCd.serverUrl, and the listing key is +// capabilityName rather than name - so they are pinned here. + +const listCapabilitiesResponse = `{ + "capabilities": [ + { + "capabilityName": "travisl-argocd", + "arn": "arn:aws:eks:ap-southeast-2:111122223333:capability/travisl/argocd/travisl-argocd/f4ce5b2d", + "type": "ARGOCD", + "status": "ACTIVE", + "version": "3.3.10-eks-6", + "createdAt": "2026-03-04T10:58:00.239000+10:00", + "modifiedAt": "2026-07-03T15:56:41.867000+10:00" + } + ] +}` + +const describeCapabilityResponse = `{ + "capability": { + "capabilityName": "travisl-argocd", + "clusterName": "travisl", + "type": "ARGOCD", + "roleArn": "arn:aws:iam::111122223333:role/ArgoCDCapabilityRole", + "status": "ACTIVE", + "version": "3.3.10-eks-6", + "configuration": { + "argoCd": { + "namespace": "argocd", + "networkAccess": {"vpceIds": []}, + "serverUrl": "https://1dddc569b37fd006.eks-capabilities.ap-southeast-2.amazonaws.com" + } + }, + "health": {"issues": []} + } +}` + +func TestParseCapabilityList(t *testing.T) { + capabilities, err := parseCapabilityList([]byte(listCapabilitiesResponse)) + require.NoError(t, err) + require.Len(t, capabilities, 1) + + assert.Equal(t, "travisl-argocd", capabilities[0].CapabilityName) + assert.Equal(t, "ARGOCD", capabilities[0].Type) + assert.Equal(t, "3.3.10-eks-6", capabilities[0].Version) + assert.Equal(t, "ACTIVE", capabilities[0].Status) +} + +func TestParseCapabilityList_IgnoresOtherCapabilityTypes(t *testing.T) { + capabilities, err := parseCapabilityList([]byte(`{"capabilities":[ + {"capabilityName":"my-ack","type":"ACK","status":"ACTIVE"}, + {"capabilityName":"my-kro","type":"KRO","status":"ACTIVE"} + ]}`)) + require.NoError(t, err) + assert.Empty(t, capabilities) +} + +func TestParseCapabilityList_EmptyOnClusterWithNoCapabilities(t *testing.T) { + capabilities, err := parseCapabilityList([]byte(`{"capabilities": []}`)) + require.NoError(t, err) + assert.Empty(t, capabilities) +} + +func TestParseCapabilityDescription(t *testing.T) { + summary := capabilitySummary{CapabilityName: "travisl-argocd", Version: "3.3.10-eks-6", Status: "ACTIVE"} + + instance, found, err := parseCapabilityDescription([]byte(describeCapabilityResponse), summary) + require.NoError(t, err) + require.True(t, found) + + assert.Equal(t, KindEKSManaged, instance.Kind) + assert.Equal(t, "travisl-argocd", instance.Name) + assert.Equal(t, "argocd", instance.Namespace) + assert.Equal(t, "3.3.10-eks-6", instance.Version) + assert.Equal(t, "ACTIVE", instance.Status) + assert.Equal(t, "grpc://1dddc569b37fd006.eks-capabilities.ap-southeast-2.amazonaws.com", instance.ServerGRPCURL) + assert.Equal(t, "https://1dddc569b37fd006.eks-capabilities.ap-southeast-2.amazonaws.com", instance.WebUIURL) + + assert.True(t, instance.GRPCWeb) + assert.False(t, instance.SelfSignedTLS) + assert.False(t, instance.Plaintext) +} + +// A capability that is still provisioning has no address yet, which is a +// "nothing found" rather than a failure. +func TestParseCapabilityDescription_NoAddressYet(t *testing.T) { + _, found, err := parseCapabilityDescription([]byte(`{"capability":{ + "capabilityName":"new-argocd","type":"ARGOCD","status":"CREATING", + "configuration":{"argoCd":{"namespace":"argocd"}} + }}`), capabilitySummary{CapabilityName: "new-argocd"}) + + require.NoError(t, err) + assert.False(t, found) +} diff --git a/pkg/kubernetes/argocd/eks_test.go b/pkg/kubernetes/argocd/eks_test.go new file mode 100644 index 00000000..8713652f --- /dev/null +++ b/pkg/kubernetes/argocd/eks_test.go @@ -0,0 +1,104 @@ +package argocd_test + +import ( + "encoding/base64" + "encoding/json" + "testing" + + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// AWS reports the capability endpoint as a bare hostname in some places and a +// URL in others; the chart always wants a grpc:// URL. +func TestNewManagedInstance_NormalisesTheEndpoint(t *testing.T) { + want := "grpc://abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com" + + for _, endpoint := range []string{ + "abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com", + "https://abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com", + "https://abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com/", + "grpc://abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com", + " abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com ", + } { + t.Run(endpoint, func(t *testing.T) { + assert.Equal(t, want, argocd.NewManagedInstance(endpoint).ServerGRPCURL) + }) + } +} + +// AWS serves managed Argo CD with a publicly trusted certificate through a load +// balancer that does not speak HTTP/2 - the opposite of a stock in-cluster +// install on both counts. +func TestNewManagedInstance_ConnectionSettings(t *testing.T) { + instance := argocd.NewManagedInstance("abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com") + + assert.Equal(t, argocd.KindEKSManaged, instance.Kind) + assert.True(t, instance.IsManaged()) + assert.True(t, instance.GRPCWeb, "AWS's load balancer does not support HTTP/2") + assert.False(t, instance.SelfSignedTLS, "AWS uses a publicly trusted certificate") + assert.False(t, instance.Plaintext) +} + +func TestInstance_DisplayDistinguishesManaged(t *testing.T) { + managed := argocd.NewManagedInstance("abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com") + assert.Contains(t, managed.Display(), "AWS managed") + + inCluster := argocd.Instance{Kind: argocd.KindInCluster, ServiceName: "argocd-server", Namespace: "argocd", Version: "v3.4.2"} + assert.Contains(t, inCluster.Display(), "namespace argocd") + assert.False(t, inCluster.IsManaged()) +} + +// projectToken builds a token the way Argo CD does: the payload is base64url +// JSON, and the subject carries the project and role. +func projectToken(t *testing.T, subject string, expires int64) string { + t.Helper() + + claims := map[string]any{"iss": "argocd", "sub": subject, "iat": 1783040347} + if expires > 0 { + claims["exp"] = expires + } + payload, err := json.Marshal(claims) + require.NoError(t, err) + + enc := base64.RawURLEncoding.EncodeToString + return enc([]byte(`{"alg":"HS256","typ":"JWT"}`)) + "." + enc(payload) + ".c2lnbmF0dXJl" +} + +// A person pasting a token should not also have to say which project it is for. +func TestParseProjectToken(t *testing.T) { + claims, err := argocd.ParseProjectToken(projectToken(t, "proj:team-a:octopus", 0)) + require.NoError(t, err) + + assert.Equal(t, "team-a", claims.Project) + assert.Equal(t, "octopus", claims.Role) + assert.True(t, claims.Expires.IsZero()) + assert.False(t, claims.Expired()) +} + +func TestParseProjectToken_Expiry(t *testing.T) { + expired, err := argocd.ParseProjectToken(projectToken(t, "proj:team-a:octopus", 1000000000)) + require.NoError(t, err) + assert.True(t, expired.Expired()) + + future, err := argocd.ParseProjectToken(projectToken(t, "proj:team-a:octopus", 4102444800)) + require.NoError(t, err) + assert.False(t, future.Expired()) +} + +// An account token is the easy mistake to make, and AWS caps those at 12 hours +// so one would stop working within the day. +func TestParseProjectToken_RejectsAnAccountToken(t *testing.T) { + _, err := argocd.ParseProjectToken(projectToken(t, "admin:apiKey", 0)) + require.Error(t, err) + assert.Contains(t, err.Error(), "not an Argo CD project role token") + assert.Contains(t, err.Error(), "admin:apiKey") +} + +func TestParseProjectToken_RejectsRubbish(t *testing.T) { + for _, input := range []string{"", "not-a-token", "a.b", "a.b.c.d", "abc.!!!notbase64!!!.xyz"} { + _, err := argocd.ParseProjectToken(input) + assert.Error(t, err, "expected %q to be rejected", input) + } +} diff --git a/pkg/kubernetes/argocd/projects.go b/pkg/kubernetes/argocd/projects.go new file mode 100644 index 00000000..7cf8ce6b --- /dev/null +++ b/pkg/kubernetes/argocd/projects.go @@ -0,0 +1,273 @@ +package argocd + +import ( + "context" + "fmt" + "net/url" + "sort" + "strings" + + apierrors "k8s.io/apimachinery/pkg/api/errors" + "k8s.io/apimachinery/pkg/api/meta" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/runtime/schema" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" +) + +// AppProjects live in the cluster even when Argo CD itself runs outside it, +// which is what makes them reachable for the AWS managed capability. +var appProjectGVR = schema.GroupVersionResource{ + Group: "argoproj.io", Version: "v1alpha1", Resource: "appprojects", +} + +type Project struct { + Name string + Roles []string +} + +func (p Project) Display() string { + if len(p.Roles) == 0 { + return p.Name + } + return fmt.Sprintf("%s (roles: %s)", p.Name, strings.Join(p.Roles, ", ")) +} + +// ListProjects returns none rather than failing when Argo CD's CRDs are absent +// or unreadable, since that only means there is nothing to offer. +func ListProjects(ctx context.Context, c *octoK8s.Cluster, namespace string) ([]Project, error) { + if c.Dynamic == nil { + return nil, nil + } + + list, err := c.Dynamic.Resource(appProjectGVR).Namespace(namespace).List(ctx, metav1.ListOptions{}) + if err != nil { + if apierrors.IsNotFound(err) || apierrors.IsForbidden(err) || meta.IsNoMatchError(err) { + return nil, nil + } + return nil, fmt.Errorf("could not list Argo CD projects in namespace %s: %w", namespace, err) + } + + projects := make([]Project, 0, len(list.Items)) + for i := range list.Items { + projects = append(projects, Project{ + Name: list.Items[i].GetName(), + Roles: roleNames(&list.Items[i]), + }) + } + + sort.Slice(projects, func(i, j int) bool { return projects[i].Name < projects[j].Name }) + return projects, nil +} + +type ProjectRoleSpec struct { + Project string + Role string + AllowSync bool +} + +// Policies are scoped to the project, because a project role token cannot be +// granted anything outside it. Cluster resources are deliberately absent: they +// are not project-scoped, so a project role can never read them. +func (s ProjectRoleSpec) Policies() []string { + subject := fmt.Sprintf("proj:%s:%s", s.Project, s.Role) + + policies := []string{ + fmt.Sprintf("p, %s, applications, get, %s/*, allow", subject, s.Project), + fmt.Sprintf("p, %s, logs, get, %s/*, allow", subject, s.Project), + } + if s.AllowSync { + policies = append(policies, fmt.Sprintf("p, %s, applications, sync, %s/*, allow", subject, s.Project)) + } + sort.Strings(policies) + return policies +} + +type ProjectRoleStatus struct { + Spec ProjectRoleSpec + Exists bool + MissingPolicies []string +} + +func (s ProjectRoleStatus) IsComplete() bool { + return s.Exists && len(s.MissingPolicies) == 0 +} + +func InspectProjectRole(ctx context.Context, c *octoK8s.Cluster, namespace string, spec ProjectRoleSpec) (ProjectRoleStatus, error) { + status := ProjectRoleStatus{Spec: spec, MissingPolicies: spec.Policies()} + + project, err := getProject(ctx, c, namespace, spec.Project) + if err != nil { + return ProjectRoleStatus{}, err + } + + role, found := findRole(project, spec.Role) + if !found { + return status, nil + } + + status.Exists = true + status.MissingPolicies = missingPolicies(strings.Join(stringSlice(role, "policies"), "\n"), spec.Policies()) + return status, nil +} + +// ProjectRolePatchPlan shows what EnsureProjectRole would add, for the user to +// agree to first. +func ProjectRolePatchPlan(namespace string, statuses []ProjectRoleStatus) string { + var b strings.Builder + + for _, status := range statuses { + if status.IsComplete() { + continue + } + + fmt.Fprintf(&b, " %s appproject/%s\n", namespace, status.Spec.Project) + if !status.Exists { + fmt.Fprintf(&b, " + role %s\n", status.Spec.Role) + } + for _, p := range status.MissingPolicies { + fmt.Fprintf(&b, " + %s\n", p) + } + } + + return b.String() +} + +// EnsureProjectRole leaves every other role on the project alone. +func EnsureProjectRole(ctx context.Context, c *octoK8s.Cluster, namespace string, status ProjectRoleStatus) error { + if status.IsComplete() { + return nil + } + + project, err := getProject(ctx, c, namespace, status.Spec.Project) + if err != nil { + return err + } + + roles := roleList(project) + index := -1 + for i, role := range roles { + if name, _ := role["name"].(string); name == status.Spec.Role { + index = i + break + } + } + + if index < 0 { + roles = append(roles, map[string]any{ + "name": status.Spec.Role, + "description": "Read access for Octopus Deploy", + "policies": toAnySlice(status.Spec.Policies()), + }) + } else { + roles[index]["policies"] = toAnySlice(append(stringSlice(roles[index], "policies"), status.MissingPolicies...)) + } + + if err := unstructured.SetNestedSlice(project.Object, toAnySliceOfMaps(roles), "spec", "roles"); err != nil { + return fmt.Errorf("could not update Argo CD project %s: %w", status.Spec.Project, err) + } + + _, err = c.Dynamic.Resource(appProjectGVR).Namespace(namespace).Update(ctx, project, metav1.UpdateOptions{}) + if err != nil { + if apierrors.IsConflict(err) { + return fmt.Errorf("Argo CD project %s changed while it was being updated; try again", status.Spec.Project) + } + return fmt.Errorf("could not add the %s role to Argo CD project %s: %w", status.Spec.Role, status.Spec.Project, err) + } + return nil +} + +func getProject(ctx context.Context, c *octoK8s.Cluster, namespace, name string) (*unstructured.Unstructured, error) { + if c.Dynamic == nil { + return nil, fmt.Errorf("no Kubernetes client is available to read Argo CD projects") + } + + project, err := c.Dynamic.Resource(appProjectGVR).Namespace(namespace).Get(ctx, name, metav1.GetOptions{}) + if err != nil { + return nil, fmt.Errorf("could not read Argo CD project %s in namespace %s: %w", name, namespace, err) + } + return project, nil +} + +func findRole(project *unstructured.Unstructured, name string) (map[string]any, bool) { + for _, role := range roleList(project) { + if roleName, _ := role["name"].(string); roleName == name { + return role, true + } + } + return nil, false +} + +func roleNames(project *unstructured.Unstructured) []string { + var names []string + for _, role := range roleList(project) { + if name, _ := role["name"].(string); name != "" { + names = append(names, name) + } + } + sort.Strings(names) + return names +} + +func roleList(project *unstructured.Unstructured) []map[string]any { + raw, found, err := unstructured.NestedSlice(project.Object, "spec", "roles") + if err != nil || !found { + return nil + } + + roles := make([]map[string]any, 0, len(raw)) + for _, item := range raw { + if role, ok := item.(map[string]any); ok { + roles = append(roles, role) + } + } + return roles +} + +func stringSlice(object map[string]any, field string) []string { + raw, ok := object[field].([]any) + if !ok { + return nil + } + + values := make([]string, 0, len(raw)) + for _, item := range raw { + if s, ok := item.(string); ok { + values = append(values, s) + } + } + return values +} + +func toAnySlice(values []string) []any { + out := make([]any, len(values)) + for i, v := range values { + out[i] = v + } + return out +} + +func toAnySliceOfMaps(values []map[string]any) []any { + out := make([]any, len(values)) + for i, v := range values { + out[i] = v + } + return out +} + +// ProjectRolePageURL opens the role's own editor rather than the project page, +// so the token can be generated without hunting through tabs. +func ProjectRolePageURL(webUIURL, project, role string) string { + if webUIURL == "" { + return "" + } + + base := fmt.Sprintf("%s/settings/projects/%s", strings.TrimSuffix(webUIURL, "/"), url.PathEscape(project)) + if role == "" { + return base + } + + query := url.Values{"tab": {"roles"}, "editRole": {role}} + return base + "?" + query.Encode() +} diff --git a/pkg/kubernetes/argocd/projects_test.go b/pkg/kubernetes/argocd/projects_test.go new file mode 100644 index 00000000..3ae61d47 --- /dev/null +++ b/pkg/kubernetes/argocd/projects_test.go @@ -0,0 +1,193 @@ +package argocd_test + +import ( + "context" + "testing" + + "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/apimachinery/pkg/runtime/schema" + dynamicfake "k8s.io/client-go/dynamic/fake" + "k8s.io/client-go/kubernetes/fake" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +var appProjectGVR = schema.GroupVersionResource{ + Group: "argoproj.io", Version: "v1alpha1", Resource: "appprojects", +} + +func appProject(name string, roles ...map[string]any) *unstructured.Unstructured { + spec := map[string]any{} + if len(roles) > 0 { + items := make([]any, len(roles)) + for i, r := range roles { + items[i] = r + } + spec["roles"] = items + } + + return &unstructured.Unstructured{Object: map[string]any{ + "apiVersion": "argoproj.io/v1alpha1", + "kind": "AppProject", + "metadata": map[string]any{"name": name, "namespace": "argocd"}, + "spec": spec, + }} +} + +func role(name string, policies ...string) map[string]any { + items := make([]any, len(policies)) + for i, p := range policies { + items[i] = p + } + return map[string]any{"name": name, "policies": items} +} + +func clusterWithProjects(objects ...runtime.Object) *octoK8s.Cluster { + scheme := runtime.NewScheme() + listKinds := map[schema.GroupVersionResource]string{appProjectGVR: "AppProjectList"} + + return octoK8s.NewClusterForTesting(fake.NewSimpleClientset(), "test", "https://cluster"). + WithDynamic(dynamicfake.NewSimpleDynamicClientWithCustomListKinds(scheme, listKinds, objects...)) +} + +func octopusRole() argocd.ProjectRoleSpec { + return argocd.ProjectRoleSpec{Project: "default", Role: "octopus", AllowSync: true} +} + +func TestListProjects(t *testing.T) { + c := clusterWithProjects( + appProject("foo"), + appProject("default", role("admin", "p, proj:default:admin, applications, *, default/*, allow")), + ) + + projects, err := argocd.ListProjects(context.Background(), c, "argocd") + require.NoError(t, err) + require.Len(t, projects, 2) + + assert.Equal(t, "default", projects[0].Name) + assert.Equal(t, []string{"admin"}, projects[0].Roles) + assert.Equal(t, "foo", projects[1].Name) + assert.Contains(t, projects[0].Display(), "admin") +} + +// A cluster where Argo CD is not managing anything has no CRDs, which is not a +// failure worth stopping the install for. +func TestListProjects_NoArgoCDCRDs(t *testing.T) { + projects, err := argocd.ListProjects(context.Background(), clusterWithProjects(), "argocd") + require.NoError(t, err) + assert.Empty(t, projects) +} + +// A project role token can only ever be granted things inside its project, so +// the policies are scoped and cluster resources are left out entirely. +func TestProjectRoleSpec_Policies(t *testing.T) { + policies := octopusRole().Policies() + + assert.Contains(t, policies, "p, proj:default:octopus, applications, get, default/*, allow") + assert.Contains(t, policies, "p, proj:default:octopus, applications, sync, default/*, allow") + assert.Contains(t, policies, "p, proj:default:octopus, logs, get, default/*, allow") + + for _, p := range policies { + assert.NotContains(t, p, "clusters", "a project role can never read cluster resources") + } +} + +func TestProjectRoleSpec_ReadOnlyOmitsSync(t *testing.T) { + spec := octopusRole() + spec.AllowSync = false + + for _, p := range spec.Policies() { + assert.NotContains(t, p, "sync") + } +} + +func TestEnsureProjectRole_AddsTheRole(t *testing.T) { + ctx := context.Background() + c := clusterWithProjects(appProject("default", role("admin", "p, proj:default:admin, applications, *, default/*, allow"))) + + status, err := argocd.InspectProjectRole(ctx, c, "argocd", octopusRole()) + require.NoError(t, err) + assert.False(t, status.Exists) + + require.NoError(t, argocd.EnsureProjectRole(ctx, c, "argocd", status)) + + after, err := argocd.InspectProjectRole(ctx, c, "argocd", octopusRole()) + require.NoError(t, err) + assert.True(t, after.IsComplete()) + + projects, err := argocd.ListProjects(ctx, c, "argocd") + require.NoError(t, err) + assert.Equal(t, []string{"admin", "octopus"}, projects[0].Roles, "the existing role must survive") +} + +func TestEnsureProjectRole_TopsUpMissingPolicies(t *testing.T) { + ctx := context.Background() + c := clusterWithProjects(appProject("default", + role("octopus", "p, proj:default:octopus, applications, get, default/*, allow"))) + + status, err := argocd.InspectProjectRole(ctx, c, "argocd", octopusRole()) + require.NoError(t, err) + assert.True(t, status.Exists) + assert.Len(t, status.MissingPolicies, 2) + + require.NoError(t, argocd.EnsureProjectRole(ctx, c, "argocd", status)) + + after, err := argocd.InspectProjectRole(ctx, c, "argocd", octopusRole()) + require.NoError(t, err) + assert.True(t, after.IsComplete()) +} + +func TestEnsureProjectRole_IsIdempotent(t *testing.T) { + ctx := context.Background() + c := clusterWithProjects(appProject("default")) + + for range 3 { + status, err := argocd.InspectProjectRole(ctx, c, "argocd", octopusRole()) + require.NoError(t, err) + require.NoError(t, argocd.EnsureProjectRole(ctx, c, "argocd", status)) + } + + status, err := argocd.InspectProjectRole(ctx, c, "argocd", octopusRole()) + require.NoError(t, err) + assert.Len(t, status.Spec.Policies(), 3) + assert.True(t, status.IsComplete()) +} + +func TestProjectRolePatchPlan_ShowsOnlyWhatIsMissing(t *testing.T) { + ctx := context.Background() + c := clusterWithProjects( + appProject("default"), + appProject("done", role("octopus", octopusRoleFor("done")...)), + ) + + var statuses []argocd.ProjectRoleStatus + for _, name := range []string{"default", "done"} { + spec := argocd.ProjectRoleSpec{Project: name, Role: "octopus", AllowSync: true} + status, err := argocd.InspectProjectRole(ctx, c, "argocd", spec) + require.NoError(t, err) + statuses = append(statuses, status) + } + + plan := argocd.ProjectRolePatchPlan("argocd", statuses) + assert.Contains(t, plan, "appproject/default") + assert.NotContains(t, plan, "appproject/done", "a project that already grants everything needs no change") +} + +func octopusRoleFor(project string) []string { + return argocd.ProjectRoleSpec{Project: project, Role: "octopus", AllowSync: true}.Policies() +} + +// Linking at the project alone leaves someone hunting through tabs for the +// role that actually needs a token. +func TestProjectRolePageURL(t *testing.T) { + url := argocd.ProjectRolePageURL("https://argo.example.com", "default", "admin") + assert.Equal(t, "https://argo.example.com/settings/projects/default?editRole=admin&tab=roles", url) + + assert.Equal(t, "https://argo.example.com/settings/projects/default", + argocd.ProjectRolePageURL("https://argo.example.com/", "default", "")) + assert.Empty(t, argocd.ProjectRolePageURL("", "default", "admin")) +} diff --git a/pkg/kubernetes/argocd/token.go b/pkg/kubernetes/argocd/token.go new file mode 100644 index 00000000..5a199534 --- /dev/null +++ b/pkg/kubernetes/argocd/token.go @@ -0,0 +1,366 @@ +package argocd + +import ( + "bytes" + "context" + "crypto/tls" + "encoding/json" + "fmt" + "io" + "net/http" + "net/url" + "strings" + "time" + + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/labels" + "k8s.io/apimachinery/pkg/util/wait" + "k8s.io/client-go/rest" + "k8s.io/client-go/tools/portforward" + "k8s.io/client-go/transport/spdy" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" +) + +type Credentials struct { + Username string + Password string +} + +const AdminUsername = "admin" + +// Argo CD watches argocd-cm and reloads it in place, so noticing a change is +// normally immediate. +const accountPropagationTimeout = 60 * time.Second + +// InitialAdminPassword treats a missing Secret as an ordinary outcome: Argo CD +// tells administrators to delete it once they have logged in. +func InitialAdminPassword(ctx context.Context, c *octoK8s.Cluster, namespace string) (string, bool, error) { + secret, found, err := c.GetSecret(ctx, namespace, InitialAdminSecretName) + if err != nil || !found { + return "", false, err + } + password, ok := secret.Data["password"] + if !ok || len(password) == 0 { + return "", false, nil + } + return string(password), true, nil +} + +type Client struct { + baseURL string + http *http.Client + token string +} + +// Dial port-forwards to the API server pod rather than requiring an ingress, +// because a stock Argo CD exposes its API in-cluster only. The returned +// function tears the port-forward down. +func Dial(ctx context.Context, c *octoK8s.Cluster, restConfig *rest.Config, instance Instance) (*Client, func(), error) { + forwarder, localPort, err := startPortForward(ctx, c, restConfig, instance) + if err != nil { + return nil, nil, err + } + + client := &Client{ + baseURL: fmt.Sprintf("https://127.0.0.1:%d", localPort), + http: &http.Client{ + Timeout: 30 * time.Second, + Transport: &http.Transport{ + // A local port-forward to a certificate that is self-signed by + // default: there is nothing here worth verifying. + TLSClientConfig: &tls.Config{InsecureSkipVerify: true}, //nolint:gosec + }, + }, + } + if instance.Plaintext { + client.baseURL = fmt.Sprintf("http://127.0.0.1:%d", localPort) + } + + return client, forwarder, nil +} + +func startPortForward(ctx context.Context, c *octoK8s.Cluster, restConfig *rest.Config, instance Instance) (func(), int, error) { + // Match the pods of the deployment discovery already found, rather than + // guessing at labels again. + deployment, err := c.Clientset.AppsV1().Deployments(instance.Namespace). + Get(ctx, instance.ServiceName, metav1.GetOptions{}) + if err != nil { + return nil, 0, fmt.Errorf("could not find the Argo CD API server: %w", err) + } + + selector := labels.Set(deployment.Spec.Selector.MatchLabels).String() + pods, err := c.Clientset.CoreV1().Pods(instance.Namespace). + List(ctx, metav1.ListOptions{LabelSelector: selector}) + if err != nil { + return nil, 0, fmt.Errorf("could not find the Argo CD API server pod: %w", err) + } + + podName := "" + for _, p := range pods.Items { + if p.Status.Phase == "Running" { + podName = p.Name + break + } + } + if podName == "" { + return nil, 0, fmt.Errorf("no running Argo CD API server pod was found in namespace %s", instance.Namespace) + } + + // argocd-server listens on 8080 inside the pod whether or not it serves + // TLS; the Service maps 80/443 onto it. + const targetPort = 8080 + + transport, upgrader, err := spdy.RoundTripperFor(restConfig) + if err != nil { + return nil, 0, fmt.Errorf("could not prepare a port-forward to Argo CD: %w", err) + } + + host := strings.TrimPrefix(strings.TrimPrefix(restConfig.Host, "https://"), "http://") + forwardURL := &url.URL{ + Scheme: "https", + Path: fmt.Sprintf("/api/v1/namespaces/%s/pods/%s/portforward", instance.Namespace, podName), + Host: host, + } + + stopCh := make(chan struct{}, 1) + readyCh := make(chan struct{}) + + dialer := spdy.NewDialer(upgrader, &http.Client{Transport: transport}, http.MethodPost, forwardURL) + forwarder, err := portforward.New( + dialer, + []string{fmt.Sprintf(":%d", targetPort)}, // empty local port: let the OS pick + stopCh, readyCh, io.Discard, io.Discard, + ) + if err != nil { + return nil, 0, fmt.Errorf("could not prepare a port-forward to Argo CD: %w", err) + } + + errCh := make(chan error, 1) + go func() { errCh <- forwarder.ForwardPorts() }() + + select { + case <-readyCh: + case err := <-errCh: + return nil, 0, fmt.Errorf("could not port-forward to Argo CD: %w", err) + case <-time.After(30 * time.Second): + close(stopCh) + return nil, 0, fmt.Errorf("timed out port-forwarding to Argo CD in namespace %s", instance.Namespace) + case <-ctx.Done(): + close(stopCh) + return nil, 0, ctx.Err() + } + + ports, err := forwarder.GetPorts() + if err != nil || len(ports) == 0 { + close(stopCh) + return nil, 0, fmt.Errorf("could not determine the local port-forward port: %w", err) + } + + return func() { close(stopCh) }, int(ports[0].Local), nil +} + +func (c *Client) Login(ctx context.Context, creds Credentials) error { + var response struct { + Token string `json:"token"` + } + + body := map[string]string{"username": creds.Username, "password": creds.Password} + if err := c.do(ctx, http.MethodPost, "/api/v1/session", body, &response); err != nil { + return fmt.Errorf("could not sign in to Argo CD as %q: %w", creds.Username, err) + } + if response.Token == "" { + return fmt.Errorf("Argo CD did not return a session token for %q", creds.Username) + } + + c.token = response.Token + return nil +} + +// AccountExists can be false for a moment after the account is added: Argo CD +// reloads argocd-cm in the background. +func (c *Client) AccountExists(ctx context.Context, name string) (bool, error) { + var response struct { + Items []struct { + Name string `json:"name"` + Enabled bool `json:"enabled"` + Capabilities []string `json:"capabilities"` + } `json:"items"` + } + + if err := c.do(ctx, http.MethodGet, "/api/v1/account", nil, &response); err != nil { + return false, err + } + + for _, a := range response.Items { + if a.Name != name { + continue + } + for _, capability := range a.Capabilities { + if strings.EqualFold(capability, "apiKey") { + return a.Enabled, nil + } + } + } + return false, nil +} + +func (c *Client) WaitForAccount(ctx context.Context, name string) error { + ctx, cancel := context.WithTimeout(ctx, accountPropagationTimeout) + defer cancel() + + err := wait.PollUntilContextCancel(ctx, 2*time.Second, true, func(ctx context.Context) (bool, error) { + // Errors are expected while argocd-server reloads its configuration. + exists, err := c.AccountExists(ctx, name) + if err != nil { + return false, nil + } + return exists, nil + }) + + if err != nil { + return fmt.Errorf("Argo CD did not pick up the %q account within %s. "+ + "Restarting the argocd-server deployment usually resolves this", name, accountPropagationTimeout) + } + return nil +} + +// GenerateToken mints a non-expiring API key, matching +// `argocd account generate-token`. +func (c *Client) GenerateToken(ctx context.Context, accountName string) (string, error) { + var response struct { + Token string `json:"token"` + } + + path := fmt.Sprintf("/api/v1/account/%s/token", url.PathEscape(accountName)) + if err := c.do(ctx, http.MethodPost, path, map[string]any{}, &response); err != nil { + return "", fmt.Errorf("could not generate an Argo CD token for %q: %w", accountName, err) + } + if response.Token == "" { + return "", fmt.Errorf("Argo CD did not return a token for %q", accountName) + } + return response.Token, nil +} + +func (c *Client) do(ctx context.Context, method, path string, body any, out any) error { + var reader io.Reader + if body != nil { + encoded, err := json.Marshal(body) + if err != nil { + return err + } + reader = bytes.NewReader(encoded) + } + + req, err := http.NewRequestWithContext(ctx, method, c.baseURL+path, reader) + if err != nil { + return err + } + req.Header.Set("Content-Type", "application/json") + if c.token != "" { + req.Header.Set("Authorization", "Bearer "+c.token) + } + + resp, err := c.http.Do(req) + if err != nil { + return fmt.Errorf("could not reach the Argo CD API: %w", err) + } + defer resp.Body.Close() + + responseBody, err := io.ReadAll(resp.Body) + if err != nil { + return err + } + + if resp.StatusCode < 200 || resp.StatusCode >= 300 { + return fmt.Errorf("Argo CD returned %s: %s", resp.Status, argoErrorMessage(responseBody)) + } + + if out == nil { + return nil + } + return json.Unmarshal(responseBody, out) +} + +// argoErrorMessage falls back to the raw body when the envelope has no message. +func argoErrorMessage(body []byte) string { + var envelope struct { + Error string `json:"error"` + Message string `json:"message"` + } + if err := json.Unmarshal(body, &envelope); err == nil { + if envelope.Message != "" { + return envelope.Message + } + if envelope.Error != "" { + return envelope.Error + } + } + return strings.TrimSpace(string(body)) +} + +func (c *Client) UseToken(token string) { + c.token = token +} + +type AccessCheck struct { + Applications int + Clusters int + ApplicationsErr error + ClustersErr error +} + +func (a AccessCheck) Readable() bool { + return a.ApplicationsErr == nil && a.ClustersErr == nil +} + +// VerifyAccess exists because Argo CD answers an under-privileged request with +// an empty list rather than an error, so a gateway can connect happily and then +// show nothing at all. +func (c *Client) VerifyAccess(ctx context.Context) AccessCheck { + var check AccessCheck + + applications, err := c.listNames(ctx, "/api/v1/applications") + check.Applications, check.ApplicationsErr = len(applications), err + + clusters, err := c.listNames(ctx, "/api/v1/clusters") + check.Clusters, check.ClustersErr = len(clusters), err + + return check +} + +func (c *Client) ListApplicationNames(ctx context.Context) ([]string, error) { + return c.listNames(ctx, "/api/v1/applications") +} + +func (c *Client) listNames(ctx context.Context, path string) ([]string, error) { + var response struct { + Items []struct { + Name string `json:"name"` + Metadata struct { + Name string `json:"name"` + } `json:"metadata"` + } `json:"items"` + } + if err := c.do(ctx, http.MethodGet, path, nil, &response); err != nil { + return nil, err + } + + names := make([]string, 0, len(response.Items)) + for _, item := range response.Items { + names = append(names, firstNonEmpty(item.Metadata.Name, item.Name)) + } + return names, nil +} + +// NewClientForURL talks to an Argo CD that is already reachable, which is the +// case for the AWS managed capability. An in-cluster Argo CD needs Dial. +func NewClientForURL(baseURL string) *Client { + return &Client{ + baseURL: strings.TrimSuffix(strings.TrimSpace(baseURL), "/"), + http: &http.Client{ + Timeout: 30 * time.Second, + Transport: &http.Transport{TLSClientConfig: &tls.Config{MinVersion: tls.VersionTLS12}}, + }, + } +} diff --git a/pkg/kubernetes/cluster.go b/pkg/kubernetes/cluster.go new file mode 100644 index 00000000..93e45d79 --- /dev/null +++ b/pkg/kubernetes/cluster.go @@ -0,0 +1,314 @@ +package kubernetes + +import ( + "context" + "fmt" + "sort" + "time" + + appsv1 "k8s.io/api/apps/v1" + authzv1 "k8s.io/api/authorization/v1" + corev1 "k8s.io/api/core/v1" + apierrors "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/types" + "k8s.io/client-go/dynamic" + "k8s.io/client-go/kubernetes" + "k8s.io/client-go/rest" +) + +type Cluster struct { + Clientset kubernetes.Interface + // Dynamic reaches CRD-backed resources, such as Argo CD's AppProjects. + Dynamic dynamic.Interface + ContextName string + Server string +} + +func Connect(kubeConfig *KubeConfig, contextName string) (*Cluster, error) { + restConfig, err := kubeConfig.RestConfig(contextName) + if err != nil { + return nil, err + } + return connectWithConfig(kubeConfig, contextName, restConfig) +} + +func connectWithConfig(kubeConfig *KubeConfig, contextName string, restConfig *rest.Config) (*Cluster, error) { + clientset, err := kubernetes.NewForConfig(restConfig) + if err != nil { + return nil, fmt.Errorf("could not build a Kubernetes client: %w", err) + } + + dynamicClient, err := dynamic.NewForConfig(restConfig) + if err != nil { + return nil, fmt.Errorf("could not build a Kubernetes client: %w", err) + } + + resolved := contextName + if resolved == "" { + if current, ok := kubeConfig.CurrentContext(); ok { + resolved = current.Name + } + } + + return &Cluster{Clientset: clientset, Dynamic: dynamicClient, ContextName: resolved, Server: restConfig.Host}, nil +} + +// NewClusterForTesting lets discovery be exercised against +// k8s.io/client-go/kubernetes/fake. +func NewClusterForTesting(clientset kubernetes.Interface, contextName, server string) *Cluster { + return &Cluster{Clientset: clientset, ContextName: contextName, Server: server} +} + +func (c *Cluster) WithDynamic(dynamicClient dynamic.Interface) *Cluster { + c.Dynamic = dynamicClient + return c +} + +func (c *Cluster) ServerVersion() (string, error) { + info, err := c.Clientset.Discovery().ServerVersion() + if err != nil { + return "", fmt.Errorf("could not reach the Kubernetes API server: %w", err) + } + return info.GitVersion, nil +} + +// NodeArchitectures is advisory, so a cluster that will not let the caller list +// nodes reports none rather than failing. +func (c *Cluster) NodeArchitectures(ctx context.Context) ([]string, error) { + nodes, err := c.Clientset.CoreV1().Nodes().List(ctx, metav1.ListOptions{}) + if err != nil { + if apierrors.IsForbidden(err) { + return nil, nil + } + return nil, fmt.Errorf("could not list cluster nodes: %w", err) + } + + seen := map[string]bool{} + for _, n := range nodes.Items { + if arch := n.Status.NodeInfo.Architecture; arch != "" { + seen[arch] = true + } + } + + architectures := make([]string, 0, len(seen)) + for arch := range seen { + architectures = append(architectures, arch) + } + sort.Strings(architectures) + return architectures, nil +} + +func (c *Cluster) NamespaceExists(ctx context.Context, name string) (bool, error) { + _, err := c.Clientset.CoreV1().Namespaces().Get(ctx, name, metav1.GetOptions{}) + switch { + case err == nil: + return true, nil + case apierrors.IsNotFound(err): + return false, nil + default: + return false, fmt.Errorf("could not check whether namespace %q exists: %w", name, err) + } +} + +func (c *Cluster) GetConfigMap(ctx context.Context, namespace, name string) (*corev1.ConfigMap, bool, error) { + cm, err := c.Clientset.CoreV1().ConfigMaps(namespace).Get(ctx, name, metav1.GetOptions{}) + switch { + case err == nil: + return cm, true, nil + case apierrors.IsNotFound(err): + return nil, false, nil + default: + return nil, false, fmt.Errorf("could not read ConfigMap %s/%s: %w", namespace, name, err) + } +} + +func (c *Cluster) GetSecret(ctx context.Context, namespace, name string) (*corev1.Secret, bool, error) { + s, err := c.Clientset.CoreV1().Secrets(namespace).Get(ctx, name, metav1.GetOptions{}) + switch { + case err == nil: + return s, true, nil + case apierrors.IsNotFound(err): + return nil, false, nil + default: + return nil, false, fmt.Errorf("could not read Secret %s/%s: %w", namespace, name, err) + } +} + +type Permission struct { + Verb string + Group string + Resource string + Namespace string + Description string +} + +func (p Permission) String() string { + if p.Namespace != "" { + return fmt.Sprintf("%s %s in namespace %s", p.Verb, p.Resource, p.Namespace) + } + return fmt.Sprintf("%s %s", p.Verb, p.Resource) +} + +// InstallPermissions are the accesses a chart install needs. +func InstallPermissions(namespace string) []Permission { + return []Permission{ + {Verb: "create", Resource: "namespaces", Description: "create the install namespace"}, + {Verb: "create", Resource: "secrets", Namespace: namespace, Description: "store credentials for the chart"}, + {Verb: "create", Resource: "serviceaccounts", Namespace: namespace, Description: "create the chart's service account"}, + {Verb: "create", Group: "apps", Resource: "deployments", Namespace: namespace, Description: "deploy the chart's workloads"}, + {Verb: "create", Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Description: "grant the chart its cluster permissions"}, + {Verb: "create", Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Description: "bind the chart's cluster permissions"}, + } +} + +// CheckPermissions returns the permissions that were denied. Checking up front +// means a missing one surfaces before the user answers a page of questions, +// rather than halfway through a partly applied install. +func (c *Cluster) CheckPermissions(ctx context.Context, permissions []Permission) ([]Permission, error) { + var denied []Permission + + for _, p := range permissions { + review := &authzv1.SelfSubjectAccessReview{ + Spec: authzv1.SelfSubjectAccessReviewSpec{ + ResourceAttributes: &authzv1.ResourceAttributes{ + Namespace: p.Namespace, + Verb: p.Verb, + Group: p.Group, + Resource: p.Resource, + }, + }, + } + + result, err := c.Clientset.AuthorizationV1().SelfSubjectAccessReviews().Create(ctx, review, metav1.CreateOptions{}) + if err != nil { + return nil, fmt.Errorf("could not check whether you can %s: %w", p, err) + } + if !result.Status.Allowed { + denied = append(denied, p) + } + } + + return denied, nil +} + +func (c *Cluster) CreateNamespace(ctx context.Context, name string) error { + ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: name}} + + _, err := c.Clientset.CoreV1().Namespaces().Create(ctx, ns, metav1.CreateOptions{}) + if err != nil && !apierrors.IsAlreadyExists(err) { + return fmt.Errorf("could not create namespace %q: %w", name, err) + } + return nil +} + +// UpsertSecret replaces a Secret's contents wholesale, dropping any key it was +// not given. Only use it for Secrets Octopus owns; for anything else use +// MergeSecretKeys. +func (c *Cluster) UpsertSecret(ctx context.Context, namespace, name string, data map[string]string) error { + secrets := c.Clientset.CoreV1().Secrets(namespace) + + desired := &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Namespace: namespace, + Labels: map[string]string{"app.kubernetes.io/managed-by": "octopus-cli"}, + }, + Type: corev1.SecretTypeOpaque, + StringData: data, + } + + existing, found, err := c.GetSecret(ctx, namespace, name) + if err != nil { + return err + } + + if !found { + if _, err := secrets.Create(ctx, desired, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) { + return fmt.Errorf("could not create Secret %s/%s: %w", namespace, name, err) + } + return nil + } + + desired.ResourceVersion = existing.ResourceVersion + if _, err := secrets.Update(ctx, desired, metav1.UpdateOptions{}); err != nil { + return fmt.Errorf("could not update Secret %s/%s: %w", namespace, name, err) + } + return nil +} + +// MergeSecretKeys is the only safe way to edit a Secret Octopus does not own. +// argocd-secret holds Argo CD's TLS and signing keys alongside anything Octopus +// puts there, and replacing it wholesale would destroy the installation. +func (c *Cluster) MergeSecretKeys(ctx context.Context, namespace, name string, set map[string]string, remove []string) error { + secrets := c.Clientset.CoreV1().Secrets(namespace) + + existing, found, err := c.GetSecret(ctx, namespace, name) + if err != nil { + return err + } + if !found { + return fmt.Errorf("Secret %s/%s does not exist", namespace, name) + } + + updated := existing.DeepCopy() + if updated.Data == nil { + updated.Data = map[string][]byte{} + } + for key, value := range set { + updated.Data[key] = []byte(value) + } + for _, key := range remove { + delete(updated.Data, key) + } + + // The resourceVersion that was read makes a concurrent change conflict + // rather than be silently overwritten. + if _, err := secrets.Update(ctx, updated, metav1.UpdateOptions{}); err != nil { + if apierrors.IsConflict(err) { + return fmt.Errorf("%s/%s changed while it was being updated; try again", namespace, name) + } + return fmt.Errorf("could not update Secret %s/%s: %w", namespace, name, err) + } + return nil +} + +func (c *Cluster) SecretKey(ctx context.Context, namespace, name, key string) (string, bool, error) { + secret, found, err := c.GetSecret(ctx, namespace, name) + if err != nil || !found { + return "", false, err + } + value, ok := secret.Data[key] + if !ok { + return "", false, nil + } + return string(value), true, nil +} + +// FindDeployment returns the single deployment matching a label selector. +func (c *Cluster) FindDeployment(ctx context.Context, namespace, selector string) (*appsv1.Deployment, bool, error) { + list, err := c.Clientset.AppsV1().Deployments(namespace). + List(ctx, metav1.ListOptions{LabelSelector: selector}) + if err != nil { + return nil, false, fmt.Errorf("could not read deployments in namespace %s: %w", namespace, err) + } + if len(list.Items) == 0 { + return nil, false, nil + } + return &list.Items[0], true, nil +} + +// RestartDeployment rolls the pods so they pick up changed Secret values, which +// are only read at container start. +func (c *Cluster) RestartDeployment(ctx context.Context, namespace, name string) error { + patch := fmt.Sprintf( + `{"spec":{"template":{"metadata":{"annotations":{"octopus.com/restartedAt":%q}}}}}`, + time.Now().UTC().Format(time.RFC3339)) + + _, err := c.Clientset.AppsV1().Deployments(namespace). + Patch(ctx, name, types.StrategicMergePatchType, []byte(patch), metav1.PatchOptions{}) + if err != nil { + return fmt.Errorf("could not restart deployment %s/%s: %w", namespace, name, err) + } + return nil +} diff --git a/pkg/kubernetes/flags.go b/pkg/kubernetes/flags.go new file mode 100644 index 00000000..a3480bcd --- /dev/null +++ b/pkg/kubernetes/flags.go @@ -0,0 +1,103 @@ +package kubernetes + +import ( + "fmt" + "time" + + "github.com/OctopusDeploy/cli/pkg/util/flag" + "github.com/spf13/cobra" +) + +const ( + FlagKubeConfig = "kubeconfig" + FlagKubeContext = "kube-context" + FlagNamespace = "namespace" + FlagReleaseName = "release-name" + FlagChartVersion = "chart-version" + FlagDryRun = "dry-run" + FlagOutputValues = "output-values" + FlagTimeout = "timeout" + FlagAtomic = "atomic" + FlagWait = "wait" + FlagSkipPreflight = "skip-preflight" + FlagPreflightImage = "preflight-image" +) + +const DefaultTimeout = 10 * time.Minute + +// CommonFlags are embedded by each component's own flags struct. +type CommonFlags struct { + KubeConfig *flag.Flag[string] + KubeContext *flag.Flag[string] + Namespace *flag.Flag[string] + ReleaseName *flag.Flag[string] + ChartVersion *flag.Flag[string] + DryRun *flag.Flag[bool] + OutputValues *flag.Flag[string] + Timeout *flag.Flag[string] + Atomic *flag.Flag[bool] + Wait *flag.Flag[bool] + SkipPreflight *flag.Flag[bool] + PreflightImage *flag.Flag[string] +} + +func NewCommonFlags() *CommonFlags { + return &CommonFlags{ + KubeConfig: flag.New[string](FlagKubeConfig, false), + KubeContext: flag.New[string](FlagKubeContext, false), + Namespace: flag.New[string](FlagNamespace, false), + ReleaseName: flag.New[string](FlagReleaseName, false), + ChartVersion: flag.New[string](FlagChartVersion, false), + DryRun: flag.New[bool](FlagDryRun, false), + OutputValues: flag.New[string](FlagOutputValues, false), + Timeout: flag.New[string](FlagTimeout, false), + Atomic: flag.New[bool](FlagAtomic, false), + Wait: flag.New[bool](FlagWait, false), + SkipPreflight: flag.New[bool](FlagSkipPreflight, false), + PreflightImage: flag.New[string](FlagPreflightImage, false), + } +} + +func (f *CommonFlags) Generatable() []flag.Generatable { + return []flag.Generatable{ + f.KubeConfig, f.KubeContext, f.Namespace, f.ReleaseName, f.ChartVersion, + f.Timeout, f.Atomic, f.Wait, f.SkipPreflight, f.PreflightImage, + } +} + +func (f *CommonFlags) ResolveTimeout() (time.Duration, error) { + if f.Timeout.Value == "" { + return DefaultTimeout, nil + } + d, err := time.ParseDuration(f.Timeout.Value) + if err != nil { + return 0, fmt.Errorf("--%s must be a duration such as 5m or 90s: %w", FlagTimeout, err) + } + if d <= 0 { + return 0, fmt.Errorf("--%s must be greater than zero", FlagTimeout) + } + return d, nil +} + +func RegisterCommonFlags(cmd *cobra.Command, f *CommonFlags) { + flags := cmd.Flags() + flags.StringVar(&f.KubeConfig.Value, FlagKubeConfig, "", "Path to the kubeconfig file. Defaults to $KUBECONFIG, then ~/.kube/config.") + flags.StringVar(&f.KubeContext.Value, FlagKubeContext, "", "The kubeconfig context to install into. Defaults to the current context.") + flags.StringVar(&f.Namespace.Value, FlagNamespace, "", "The namespace to install into. Derived from the name if not set.") + flags.StringVar(&f.ReleaseName.Value, FlagReleaseName, "", "The Helm release name. Derived from the name if not set.") + flags.StringVar(&f.ChartVersion.Value, FlagChartVersion, "", "The chart version to install. Defaults to the latest compatible version.") + flags.BoolVar(&f.DryRun.Value, FlagDryRun, false, "Render the manifests that would be applied, without installing anything.") + flags.StringVarP(&f.OutputValues.Value, FlagOutputValues, "o", "", "Write the resolved Helm values to this file.") + flags.StringVar(&f.Timeout.Value, FlagTimeout, "", fmt.Sprintf("How long to wait for the release to become ready, e.g. 5m. Defaults to %s.", DefaultTimeout)) + flags.BoolVar(&f.Atomic.Value, FlagAtomic, true, "Roll the release back if it fails to become ready.") + flags.BoolVar(&f.Wait.Value, FlagWait, true, "Wait for the release's resources to become ready.") + flags.BoolVar(&f.SkipPreflight.Value, FlagSkipPreflight, false, "Skip the connectivity checks that run before installing.") + flags.StringVar(&f.PreflightImage.Value, FlagPreflightImage, DefaultPreflightImage, "The image used by the connectivity check pod.") +} + +func Pluralise(singular, plural string, n int) string { + if n == 1 { + return singular + } + return plural +} diff --git a/pkg/kubernetes/helm/runner.go b/pkg/kubernetes/helm/runner.go new file mode 100644 index 00000000..5944b3de --- /dev/null +++ b/pkg/kubernetes/helm/runner.go @@ -0,0 +1,297 @@ +// Package helm wraps the parts of the Helm SDK the Kubernetes installer needs, +// so command code deals in charts and values rather than Helm's action plumbing. +package helm + +import ( + "context" + "errors" + "fmt" + "io" + "time" + + "helm.sh/helm/v4/pkg/action" + "helm.sh/helm/v4/pkg/chart" + chartv2loader "helm.sh/helm/v4/pkg/chart/v2/loader" + "helm.sh/helm/v4/pkg/cli" + "helm.sh/helm/v4/pkg/kube" + "helm.sh/helm/v4/pkg/registry" + "helm.sh/helm/v4/pkg/release" + "helm.sh/helm/v4/pkg/storage/driver" +) + +const storageDriver = "secret" // Helm's default + +type ChartRef struct { + Ref string + Version string +} + +type Release struct { + Name string + Namespace string + Chart string + Version string + Revision int + Status string + Manifest string + Notes string +} + +type InstallSpec struct { + Chart ChartRef + ReleaseName string + Namespace string + Values map[string]any + CreateNamespace bool + Atomic bool + Wait bool + Timeout time.Duration + DryRun bool +} + +type Runner struct { + settings *cli.EnvSettings + registry *registry.Client +} + +// NewRunner takes an empty kubeContext to mean the kubeconfig's current +// context, and an empty kubeConfigPath to mean the default loading rules. +func NewRunner(kubeConfigPath, kubeContext string, out io.Writer) (*Runner, error) { + settings := cli.New() + settings.KubeContext = kubeContext + if kubeConfigPath != "" { + settings.KubeConfig = kubeConfigPath + } + + registryClient, err := registry.NewClient( + registry.ClientOptEnableCache(true), + registry.ClientOptWriter(out), + registry.ClientOptCredentialsFile(settings.RegistryConfig), + ) + if err != nil { + return nil, fmt.Errorf("could not create a Helm registry client: %w", err) + } + + return &Runner{settings: settings, registry: registryClient}, nil +} + +// configFor scopes Helm to a namespace. +// +// The namespace has to be set on the settings, not just passed to Init: the +// REST client getter built from them is what resolves the namespace for any +// manifest that does not name one, so without this a chart's resources are +// created in whatever namespace the kubeconfig context happens to point at +// rather than the one being installed into. +func (r *Runner) configFor(namespace string) (*action.Configuration, error) { + if namespace != "" { + r.settings.SetNamespace(namespace) + } + + cfg := new(action.Configuration) + if err := cfg.Init(r.settings.RESTClientGetter(), namespace, storageDriver); err != nil { + return nil, fmt.Errorf("could not initialise Helm: %w", err) + } + cfg.RegistryClient = r.registry + return cfg, nil +} + +func (r *Runner) List() ([]Release, error) { + cfg, err := r.configFor("") + if err != nil { + return nil, err + } + + list := action.NewList(cfg) + list.All = true + list.AllNamespaces = true + list.SetStateMask() + + results, err := list.Run() + if err != nil { + return nil, fmt.Errorf("could not list Helm releases: %w", err) + } + + releases := make([]Release, 0, len(results)) + for _, result := range results { + rel, err := toRelease(result) + if err != nil { + return nil, err + } + releases = append(releases, rel) + } + return releases, nil +} + +// GetValues returns a release's user-supplied values, so the installer can +// pre-populate its prompts from a previous install. +func (r *Runner) GetValues(releaseName, namespace string) (map[string]any, error) { + cfg, err := r.configFor(namespace) + if err != nil { + return nil, err + } + + values, err := action.NewGetValues(cfg).Run(releaseName) + if err != nil { + return nil, fmt.Errorf("could not read the values of release %q in namespace %q: %w", releaseName, namespace, err) + } + return values, nil +} + +// Install upgrades when a release of the same name already exists, matching +// `helm upgrade --install`. +func (r *Runner) Install(ctx context.Context, spec InstallSpec) (Release, error) { + cfg, err := r.configFor(spec.Namespace) + if err != nil { + return Release{}, err + } + + installed, err := r.releaseExists(cfg, spec.ReleaseName) + if err != nil { + return Release{}, err + } + if installed { + return r.upgrade(ctx, cfg, spec) + } + return r.install(ctx, cfg, spec) +} + +// Render backs --dry-run. +func (r *Runner) Render(ctx context.Context, spec InstallSpec) (string, error) { + spec.DryRun = true + rel, err := r.Install(ctx, spec) + if err != nil { + return "", err + } + return rel.Manifest, nil +} + +func (r *Runner) install(ctx context.Context, cfg *action.Configuration, spec InstallSpec) (Release, error) { + client := action.NewInstall(cfg) + client.ReleaseName = spec.ReleaseName + client.Namespace = spec.Namespace + client.CreateNamespace = spec.CreateNamespace + client.Version = spec.Chart.Version + client.Timeout = spec.Timeout + client.RollbackOnFailure = spec.Atomic + client.WaitStrategy = waitStrategy(spec) + client.SetRegistryClient(r.registry) + if spec.DryRun { + // Client-side only: a server-side dry run needs permissions the user + // may not have, and fails for a namespace that does not exist yet. + client.DryRunStrategy = action.DryRunClient + client.CreateNamespace = false + } + + chrt, err := r.loadChart(&client.ChartPathOptions, spec.Chart) + if err != nil { + return Release{}, err + } + + result, err := client.RunWithContext(ctx, chrt, spec.Values) + if err != nil { + return Release{}, fmt.Errorf("helm install of %q failed: %w", spec.ReleaseName, err) + } + return toRelease(result) +} + +func (r *Runner) upgrade(ctx context.Context, cfg *action.Configuration, spec InstallSpec) (Release, error) { + client := action.NewUpgrade(cfg) + client.Namespace = spec.Namespace + client.Version = spec.Chart.Version + client.Timeout = spec.Timeout + client.RollbackOnFailure = spec.Atomic + client.WaitStrategy = waitStrategy(spec) + client.SetRegistryClient(r.registry) + if spec.DryRun { + client.DryRunStrategy = action.DryRunClient + } + + chrt, err := r.loadChart(&client.ChartPathOptions, spec.Chart) + if err != nil { + return Release{}, err + } + + result, err := client.RunWithContext(ctx, spec.ReleaseName, chrt, spec.Values) + if err != nil { + return Release{}, fmt.Errorf("helm upgrade of %q failed: %w", spec.ReleaseName, err) + } + return toRelease(result) +} + +func (r *Runner) loadChart(pathOptions *action.ChartPathOptions, ref ChartRef) (chart.Charter, error) { + pathOptions.Version = ref.Version + + path, err := pathOptions.LocateChart(ref.Ref, r.settings) + if err != nil { + return nil, fmt.Errorf("could not pull chart %s: %w", ref.Ref, err) + } + + chrt, err := chartv2loader.Load(path) + if err != nil { + return nil, fmt.Errorf("could not load chart %s: %w", ref.Ref, err) + } + return chrt, nil +} + +func (r *Runner) releaseExists(cfg *action.Configuration, releaseName string) (bool, error) { + history := action.NewHistory(cfg) + history.Max = 1 + + switch _, err := history.Run(releaseName); { + case err == nil: + return true, nil + case errors.Is(err, driver.ErrReleaseNotFound): + return false, nil + default: + return false, fmt.Errorf("could not check for an existing release named %q: %w", releaseName, err) + } +} + +func waitStrategy(spec InstallSpec) kube.WaitStrategy { + // Atomic is meaningless without waiting - Helm has to know the release + // failed before it can roll it back. + if spec.Wait || spec.Atomic { + return kube.StatusWatcherStrategy + } + return kube.HookOnlyStrategy +} + +func toRelease(result release.Releaser) (Release, error) { + accessor, err := release.NewAccessor(result) + if err != nil { + return Release{}, fmt.Errorf("could not read the Helm release: %w", err) + } + + rel := Release{ + Name: accessor.Name(), + Namespace: accessor.Namespace(), + Revision: accessor.Version(), + Status: accessor.Status(), + Manifest: accessor.Manifest(), + Notes: accessor.Notes(), + } + + if chartAccessor, err := chart.NewDefaultAccessor(accessor.Chart()); err == nil { + if metadata := chartAccessor.MetadataAsMap(); metadata != nil { + rel.Chart, _ = metadata["Name"].(string) + rel.Version, _ = metadata["Version"].(string) + } + } + return rel, nil +} + +// FindByChart returns the installed releases of one chart, across all namespaces. +func (r *Runner) FindByChart(chartName string) ([]Release, error) { + all, err := r.List() + if err != nil { + return nil, err + } + + matches := make([]Release, 0, len(all)) + for _, release := range all { + if release.Chart == chartName { + matches = append(matches, release) + } + } + return matches, nil +} diff --git a/pkg/kubernetes/helm/runner_internal_test.go b/pkg/kubernetes/helm/runner_internal_test.go new file mode 100644 index 00000000..147e03c5 --- /dev/null +++ b/pkg/kubernetes/helm/runner_internal_test.go @@ -0,0 +1,37 @@ +package helm + +import ( + "io" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// Helm resolves the namespace for any manifest that does not name one from the +// REST client getter, not from the install action. Leaving it unset puts a +// chart's resources in whatever namespace the kubeconfig context points at: +// the release is recorded in one namespace while its resources are created in +// another, and the install then waits for something that is not there. +func TestConfigFor_ScopesTheSettingsToTheTargetNamespace(t *testing.T) { + runner, err := NewRunner("", "", io.Discard) + require.NoError(t, err) + + _, err = runner.configFor("octo-argo-gateway-production") + require.NoError(t, err) + + assert.Equal(t, "octo-argo-gateway-production", runner.settings.Namespace()) +} + +// Listing across namespaces passes no namespace, which must not be taken as a +// request to scope to the empty one. +func TestConfigFor_LeavesTheNamespaceAloneWhenNoneIsGiven(t *testing.T) { + runner, err := NewRunner("", "", io.Discard) + require.NoError(t, err) + + before := runner.settings.Namespace() + _, err = runner.configFor("") + require.NoError(t, err) + + assert.Equal(t, before, runner.settings.Namespace()) +} diff --git a/pkg/kubernetes/kubeconfig.go b/pkg/kubernetes/kubeconfig.go new file mode 100644 index 00000000..6c30cd92 --- /dev/null +++ b/pkg/kubernetes/kubeconfig.go @@ -0,0 +1,167 @@ +package kubernetes + +import ( + "fmt" + "path/filepath" + "sort" + + "k8s.io/client-go/rest" + "k8s.io/client-go/tools/clientcmd" + clientcmdapi "k8s.io/client-go/tools/clientcmd/api" +) + +type Context struct { + Name string + Cluster string + Server string + Namespace string + IsCurrent bool + // EKS is set when the context authenticates through the AWS CLI, which is + // how kubeconfig entries for EKS clusters are written. + EKS *EKSContext +} + +type EKSContext struct { + ClusterName string + Region string + Profile string +} + +func (c Context) Display() string { + s := c.Name + if c.Server != "" { + s = fmt.Sprintf("%s (%s)", s, c.Server) + } + if c.IsCurrent { + s += " [current]" + } + return s +} + +type KubeConfig struct { + path string + loader clientcmd.ClientConfigLoader + raw clientcmdapi.Config +} + +// LoadKubeConfig honours $KUBECONFIG and the default path when explicitPath is +// empty. +func LoadKubeConfig(explicitPath string) (*KubeConfig, error) { + rules := clientcmd.NewDefaultClientConfigLoadingRules() + if explicitPath != "" { + rules.ExplicitPath = explicitPath + } + + raw, err := rules.Load() + if err != nil { + return nil, fmt.Errorf("could not load kubeconfig: %w", err) + } + + return &KubeConfig{path: explicitPath, loader: rules, raw: *raw}, nil +} + +func (k *KubeConfig) Contexts() []Context { + contexts := make([]Context, 0, len(k.raw.Contexts)) + for name, ctx := range k.raw.Contexts { + c := Context{ + Name: name, + Cluster: ctx.Cluster, + Namespace: ctx.Namespace, + IsCurrent: name == k.raw.CurrentContext, + } + if cluster, ok := k.raw.Clusters[ctx.Cluster]; ok { + c.Server = cluster.Server + } + if authInfo, ok := k.raw.AuthInfos[ctx.AuthInfo]; ok { + c.EKS = eksContextFrom(authInfo) + } + contexts = append(contexts, c) + } + + sort.Slice(contexts, func(i, j int) bool { return contexts[i].Name < contexts[j].Name }) + return contexts +} + +func (k *KubeConfig) CurrentContext() (Context, bool) { + if k.raw.CurrentContext == "" { + return Context{}, false + } + for _, c := range k.Contexts() { + if c.Name == k.raw.CurrentContext { + return c, true + } + } + return Context{}, false +} + +func (k *KubeConfig) FindContext(name string) (Context, error) { + for _, c := range k.Contexts() { + if c.Name == name { + return c, nil + } + } + return Context{}, fmt.Errorf("no context named %q exists in the kubeconfig", name) +} + +func (k *KubeConfig) Path() string { + return k.path +} + +// RestConfig builds a client-go configuration. An empty contextName uses the +// kubeconfig's current context. +func (k *KubeConfig) RestConfig(contextName string) (*rest.Config, error) { + overrides := &clientcmd.ConfigOverrides{CurrentContext: contextName} + cfg, err := clientcmd.NewNonInteractiveDeferredLoadingClientConfig(k.loader, overrides).ClientConfig() + if err != nil { + return nil, fmt.Errorf("could not build a Kubernetes client for context %q: %w", k.contextNameOrCurrent(contextName), err) + } + return cfg, nil +} + +func (k *KubeConfig) contextNameOrCurrent(contextName string) string { + if contextName != "" { + return contextName + } + return k.raw.CurrentContext +} + +// eksContextFrom reads the cluster name and region out of the AWS CLI call the +// kubeconfig makes to get a token. The AWS CLI is already required for the +// context to authenticate at all. +func eksContextFrom(authInfo *clientcmdapi.AuthInfo) *EKSContext { + if authInfo == nil || authInfo.Exec == nil { + return nil + } + + command := filepath.Base(authInfo.Exec.Command) + if command != "aws" && command != "aws.exe" { + return nil + } + + eks := &EKSContext{} + args := authInfo.Exec.Args + for i := 0; i < len(args); i++ { + if i+1 >= len(args) { + break + } + switch args[i] { + case "--cluster-name": + eks.ClusterName = args[i+1] + case "--region": + eks.Region = args[i+1] + case "--profile": + eks.Profile = args[i+1] + } + } + + for _, env := range authInfo.Exec.Env { + if env.Name == "AWS_PROFILE" && eks.Profile == "" { + eks.Profile = env.Value + } + } + + if eks.ClusterName == "" { + return nil + } + return eks +} diff --git a/pkg/kubernetes/kubeconfig_test.go b/pkg/kubernetes/kubeconfig_test.go new file mode 100644 index 00000000..54fe6f0d --- /dev/null +++ b/pkg/kubernetes/kubeconfig_test.go @@ -0,0 +1,123 @@ +package kubernetes_test + +import ( + "os" + "path/filepath" + "testing" + + "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func writeKubeConfig(t *testing.T, contents string) *kubernetes.KubeConfig { + t.Helper() + + path := filepath.Join(t.TempDir(), "config") + require.NoError(t, os.WriteFile(path, []byte(contents), 0o600)) + + kubeConfig, err := kubernetes.LoadKubeConfig(path) + require.NoError(t, err) + return kubeConfig +} + +// An EKS kubeconfig authenticates by shelling out to the AWS CLI, which is +// where the cluster name and region come from. +func TestContexts_ReadsEKSDetailsFromTheExecPlugin(t *testing.T) { + kubeConfig := writeKubeConfig(t, ` +apiVersion: v1 +kind: Config +current-context: eks +contexts: + - name: eks + context: {cluster: eks, user: eks} +clusters: + - name: eks + cluster: {server: "https://ABC123.gr7.ap-southeast-2.eks.amazonaws.com"} +users: + - name: eks + user: + exec: + apiVersion: client.authentication.k8s.io/v1beta1 + command: aws + args: ["--region", "ap-southeast-2", "eks", "get-token", "--cluster-name", "my-cluster"] + env: + - name: AWS_PROFILE + value: DeveloperAccess-123 +`) + + contexts := kubeConfig.Contexts() + require.Len(t, contexts, 1) + + eks := contexts[0].EKS + require.NotNil(t, eks) + assert.Equal(t, "my-cluster", eks.ClusterName) + assert.Equal(t, "ap-southeast-2", eks.Region) + assert.Equal(t, "DeveloperAccess-123", eks.Profile) +} + +func TestContexts_NonEKSContextsHaveNoEKSDetails(t *testing.T) { + kubeConfig := writeKubeConfig(t, ` +apiVersion: v1 +kind: Config +current-context: local +contexts: + - name: local + context: {cluster: local, user: local, namespace: argocd} +clusters: + - name: local + cluster: {server: "https://127.0.0.1:6443"} +users: + - name: local + user: {token: abc} +`) + + contexts := kubeConfig.Contexts() + require.Len(t, contexts, 1) + assert.Nil(t, contexts[0].EKS) + assert.Equal(t, "argocd", contexts[0].Namespace) + assert.True(t, contexts[0].IsCurrent) +} + +func TestContexts_IgnoresNonAWSExecPlugins(t *testing.T) { + kubeConfig := writeKubeConfig(t, ` +apiVersion: v1 +kind: Config +current-context: gke +contexts: + - name: gke + context: {cluster: gke, user: gke} +clusters: + - name: gke + cluster: {server: "https://34.40.169.235"} +users: + - name: gke + user: + exec: + apiVersion: client.authentication.k8s.io/v1beta1 + command: gke-gcloud-auth-plugin +`) + + require.Len(t, kubeConfig.Contexts(), 1) + assert.Nil(t, kubeConfig.Contexts()[0].EKS) +} + +func TestFindContext_ReportsUnknownNames(t *testing.T) { + kubeConfig := writeKubeConfig(t, ` +apiVersion: v1 +kind: Config +current-context: local +contexts: + - name: local + context: {cluster: local, user: local} +clusters: + - name: local + cluster: {server: "https://127.0.0.1:6443"} +users: + - name: local + user: {token: abc} +`) + + _, err := kubeConfig.FindContext("nope") + assert.ErrorContains(t, err, `no context named "nope"`) +} diff --git a/pkg/kubernetes/naming.go b/pkg/kubernetes/naming.go new file mode 100644 index 00000000..da5f647e --- /dev/null +++ b/pkg/kubernetes/naming.go @@ -0,0 +1,66 @@ +package kubernetes + +import ( + "fmt" + "regexp" + "strings" +) + +// Namespaces match what the Octopus portal generates, so a CLI install and a +// portal install of the same name land in the same place. +const ( + ArgoCDGatewayNamespacePrefix = "octo-argo-gateway-" + AgentNamespacePrefix = "octopus-agent-" + + // Only one permissions controller can run per cluster, so this is fixed. + PermissionsControllerNamespace = "octopus-permissions-controller-system" +) + +const ( + dnsLabelMaxLen = 63 // Kubernetes limit for a namespace name (RFC 1123 label) + releaseNameMaxLen = 53 // Helm's own limit on release names +) + +var nonSlugChars = regexp.MustCompile(`[^a-z0-9]+`) + +func Slug(name string) (string, error) { + s := nonSlugChars.ReplaceAllString(strings.ToLower(name), "-") + s = strings.Trim(s, "-") + if s == "" { + return "", fmt.Errorf("%q does not contain any letters or digits, so a Kubernetes name cannot be derived from it", name) + } + return s, nil +} + +func ReleaseName(name string) (string, error) { + s, err := Slug(name) + if err != nil { + return "", err + } + return truncateSlug(s, releaseNameMaxLen), nil +} + +// DerivedNamespace is derived rather than prompted for because most people +// install each component into its own new namespace. --namespace overrides it. +func DerivedNamespace(prefix, name string) (string, error) { + if len(prefix) >= dnsLabelMaxLen { + return "", fmt.Errorf("namespace prefix %q is too long", prefix) + } + s, err := Slug(name) + if err != nil { + return "", err + } + return prefix + truncateSlug(s, dnsLabelMaxLen-len(prefix)), nil +} + +// truncateSlug cuts on a hyphen boundary where it can, to stay readable. +func truncateSlug(s string, max int) string { + if len(s) <= max { + return s + } + s = s[:max] + if i := strings.LastIndex(s, "-"); i > max/2 { + s = s[:i] + } + return strings.TrimRight(s, "-") +} diff --git a/pkg/kubernetes/naming_test.go b/pkg/kubernetes/naming_test.go new file mode 100644 index 00000000..a1c746a1 --- /dev/null +++ b/pkg/kubernetes/naming_test.go @@ -0,0 +1,96 @@ +package kubernetes_test + +import ( + "testing" + + "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestSlug(t *testing.T) { + tests := []struct { + name string + input string + want string + }{ + {"already a slug", "my-gateway", "my-gateway"}, + {"uppercase", "My Gateway", "my-gateway"}, + {"spaces collapse", "my gateway", "my-gateway"}, + {"punctuation", "prod (eu-west) #1", "prod-eu-west-1"}, + {"leading and trailing junk", " --Prod!! ", "prod"}, + {"underscores", "my_gateway_01", "my-gateway-01"}, + {"unicode is dropped", "gateway-café", "gateway-caf"}, + {"digits only", "123", "123"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got, err := kubernetes.Slug(tt.input) + require.NoError(t, err) + assert.Equal(t, tt.want, got) + }) + } +} + +func TestSlug_NoUsableCharacters(t *testing.T) { + for _, input := range []string{"", " ", "---", "!!!", "☃"} { + _, err := kubernetes.Slug(input) + assert.Error(t, err, "expected %q to be rejected", input) + } +} + +func TestDerivedNamespace(t *testing.T) { + tests := []struct { + name string + prefix string + input string + want string + }{ + {"gateway", kubernetes.ArgoCDGatewayNamespacePrefix, "verify", "octo-argo-gateway-verify"}, + {"agent", kubernetes.AgentNamespacePrefix, "colima", "octopus-agent-colima"}, + {"agent with spaces", kubernetes.AgentNamespacePrefix, "Nonproduction Agent", "octopus-agent-nonproduction-agent"}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + got, err := kubernetes.DerivedNamespace(tt.prefix, tt.input) + require.NoError(t, err) + assert.Equal(t, tt.want, got) + }) + } +} + +func TestDerivedNamespace_TruncatesToValidLabel(t *testing.T) { + // 45 characters is all the gateway prefix leaves of the 63-character limit. + long := "this-is-a-very-long-gateway-name-that-will-not-fit-in-a-namespace" + got, err := kubernetes.DerivedNamespace(kubernetes.ArgoCDGatewayNamespacePrefix, long) + require.NoError(t, err) + + assert.LessOrEqual(t, len(got), 63) + assert.Equal(t, "octo-argo-gateway-this-is-a-very-long-gateway-name-that-will", got) + assertValidDNSLabel(t, got) +} + +func TestDerivedNamespace_TruncationNeverLeavesTrailingHyphen(t *testing.T) { + // Chosen so the naive cut lands exactly on a hyphen. + got, err := kubernetes.DerivedNamespace(kubernetes.ArgoCDGatewayNamespacePrefix, "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa-bbbb") + require.NoError(t, err) + + assert.NotEmpty(t, got) + assertValidDNSLabel(t, got) +} + +func TestReleaseName_RespectsHelmLimit(t *testing.T) { + got, err := kubernetes.ReleaseName("this-is-a-very-long-gateway-name-that-exceeds-helms-fifty-three-character-limit") + require.NoError(t, err) + + assert.LessOrEqual(t, len(got), 53) + assertValidDNSLabel(t, got) +} + +func assertValidDNSLabel(t *testing.T, s string) { + t.Helper() + assert.Regexp(t, `^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`, s) + assert.LessOrEqual(t, len(s), 63) +} diff --git a/pkg/kubernetes/octopus.go b/pkg/kubernetes/octopus.go new file mode 100644 index 00000000..e8e2173c --- /dev/null +++ b/pkg/kubernetes/octopus.go @@ -0,0 +1,25 @@ +package kubernetes + +import ( + "fmt" + "net/url" + "strings" +) + +const DefaultOctopusGRPCPort = 8443 + +// DeriveGRPCURL is a starting point to confirm rather than a guarantee: a load +// balancer or proxy in front of Octopus often forwards only HTTPS. The +// connectivity preflight is what proves it. +func DeriveGRPCURL(serverURL string) string { + if serverURL == "" { + return "" + } + + parsed, err := url.Parse(strings.TrimSpace(serverURL)) + if err != nil || parsed.Hostname() == "" { + return "" + } + + return fmt.Sprintf("grpc://%s:%d", parsed.Hostname(), DefaultOctopusGRPCPort) +} diff --git a/pkg/kubernetes/octopus_test.go b/pkg/kubernetes/octopus_test.go new file mode 100644 index 00000000..b384ccb0 --- /dev/null +++ b/pkg/kubernetes/octopus_test.go @@ -0,0 +1,30 @@ +package kubernetes_test + +import ( + "testing" + + "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/stretchr/testify/assert" +) + +func TestDeriveGRPCURL(t *testing.T) { + tests := []struct { + name string + input string + want string + }{ + {"cloud instance", "https://my.octopus.app", "grpc://my.octopus.app:8443"}, + {"trailing slash", "https://my.octopus.app/", "grpc://my.octopus.app:8443"}, + {"self hosted with a port", "https://octopus.internal:8080/", "grpc://octopus.internal:8443"}, + {"http", "http://octopus.internal/", "grpc://octopus.internal:8443"}, + {"local", "http://localhost:8065/", "grpc://localhost:8443"}, + {"empty", "", ""}, + {"not a url", "://nope", ""}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert.Equal(t, tt.want, kubernetes.DeriveGRPCURL(tt.input)) + }) + } +} diff --git a/pkg/kubernetes/preflight.go b/pkg/kubernetes/preflight.go new file mode 100644 index 00000000..f61637a4 --- /dev/null +++ b/pkg/kubernetes/preflight.go @@ -0,0 +1,325 @@ +package kubernetes + +import ( + "context" + "fmt" + "io" + "net" + "net/url" + "strings" + "time" + + corev1 "k8s.io/api/core/v1" + apierrors "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/wait" +) + +// DefaultPreflightImage matches what the Octopus troubleshooting docs use for +// the same check by hand. +const DefaultPreflightImage = "busybox:1.37" + +const ( + preflightPodPrefix = "octopus-preflight-" + preflightTimeout = 2 * time.Minute + dialTimeout = 5 +) + +type CheckResult int + +const ( + CheckPassed CheckResult = iota + CheckFailed + // CheckSkipped means the check could not be run, which is not the same as + // the endpoint being unreachable. + CheckSkipped +) + +func (r CheckResult) String() string { + switch r { + case CheckPassed: + return "passed" + case CheckFailed: + return "failed" + default: + return "skipped" + } +} + +type Check struct { + Name string + Result CheckResult + Detail string + Remediation string +} + +type Target struct { + Name string + Address string + Remediation string +} + +type PreflightRequest struct { + Namespace string + Image string + Targets []Target +} + +// StaticChecks need no cluster access, and catch the most common local-cluster +// mistake, so they run even when the pod-based checks are skipped. +func StaticChecks(targets []Target) []Check { + checks := make([]Check, 0, len(targets)) + + for _, t := range targets { + host, _, err := splitTarget(t.Address) + if err != nil { + checks = append(checks, Check{ + Name: t.Name, + Result: CheckFailed, + Detail: fmt.Sprintf("%q is not a valid address: %v", t.Address, err), + Remediation: t.Remediation, + }) + continue + } + + if isLoopback(host) { + checks = append(checks, Check{ + Name: t.Name, + Result: CheckFailed, + Detail: fmt.Sprintf("%s resolves to this machine, not to a cluster-visible address", host), + Remediation: "A pod cannot reach the loopback address of the machine running the CLI. " + + "Use an address the cluster can resolve - local clusters usually provide a special hostname " + + "such as host.docker.internal or host.minikube.internal.", + }) + } + } + + return checks +} + +// RunPreflight covers only the pod-based targets; combine the result with +// StaticChecks. +func (c *Cluster) RunPreflight(ctx context.Context, req PreflightRequest) ([]Check, error) { + if len(req.Targets) == 0 { + return nil, nil + } + + image := req.Image + if image == "" { + image = DefaultPreflightImage + } + + pod, err := c.startPreflightPod(ctx, req, image) + if err != nil { + return nil, err + } + // Also on cancellation: a stray check pod left behind is our mess. + defer c.deletePreflightPod(pod.Namespace, pod.Name) + + if err := c.waitForPreflightPod(ctx, pod.Namespace, pod.Name); err != nil { + return skippedChecks(req.Targets, err), nil + } + + logs, err := c.preflightLogs(ctx, pod.Namespace, pod.Name) + if err != nil { + return skippedChecks(req.Targets, err), nil + } + + return parsePreflightLogs(req.Targets, logs), nil +} + +func (c *Cluster) startPreflightPod(ctx context.Context, req PreflightRequest, image string) (*corev1.Pod, error) { + pod := &corev1.Pod{ + ObjectMeta: metav1.ObjectMeta{ + GenerateName: preflightPodPrefix, + Namespace: req.Namespace, + Labels: map[string]string{"app.kubernetes.io/managed-by": "octopus-cli"}, + }, + Spec: corev1.PodSpec{ + RestartPolicy: corev1.RestartPolicyNever, + Containers: []corev1.Container{{ + Name: "preflight", + Image: image, + Command: []string{"sh", "-c", preflightScript(req.Targets)}, + }}, + }, + } + + created, err := c.Clientset.CoreV1().Pods(req.Namespace).Create(ctx, pod, metav1.CreateOptions{}) + if err != nil { + return nil, fmt.Errorf("could not start the connectivity check pod in namespace %s: %w", req.Namespace, err) + } + return created, nil +} + +// preflightScript emits one " REACHABLE|UNREACHABLE" line per target, so +// every endpoint is covered by a single scheduling round trip. +func preflightScript(targets []Target) string { + var b strings.Builder + for i, t := range targets { + host, port, err := splitTarget(t.Address) + if err != nil { + continue + } + fmt.Fprintf(&b, "nc -z -w %d %s %s >/dev/null 2>&1 && echo '%d REACHABLE' || echo '%d UNREACHABLE'\n", + dialTimeout, shellQuote(host), shellQuote(port), i, i) + } + return b.String() +} + +func (c *Cluster) waitForPreflightPod(ctx context.Context, namespace, name string) error { + ctx, cancel := context.WithTimeout(ctx, preflightTimeout) + defer cancel() + + return wait.PollUntilContextCancel(ctx, time.Second, true, func(ctx context.Context) (bool, error) { + pod, err := c.Clientset.CoreV1().Pods(namespace).Get(ctx, name, metav1.GetOptions{}) + if err != nil { + return false, err + } + + switch pod.Status.Phase { + case corev1.PodSucceeded, corev1.PodFailed: + return true, nil + case corev1.PodPending: + // A pod that cannot pull its image will never run, so do not wait + // out the timeout for it. + if reason := imagePullFailure(pod); reason != "" { + return false, fmt.Errorf("the connectivity check pod could not start: %s. "+ + "Use --%s to choose an image this cluster can pull", reason, FlagPreflightImage) + } + return false, nil + default: + return false, nil + } + }) +} + +func imagePullFailure(pod *corev1.Pod) string { + for _, cs := range pod.Status.ContainerStatuses { + w := cs.State.Waiting + if w == nil { + continue + } + if w.Reason == "ErrImagePull" || w.Reason == "ImagePullBackOff" || w.Reason == "InvalidImageName" { + return strings.TrimSpace(w.Reason + ": " + w.Message) + } + } + return "" +} + +func (c *Cluster) preflightLogs(ctx context.Context, namespace, name string) (string, error) { + stream, err := c.Clientset.CoreV1().Pods(namespace). + GetLogs(name, &corev1.PodLogOptions{}).Stream(ctx) + if err != nil { + return "", fmt.Errorf("could not read the connectivity check results: %w", err) + } + defer stream.Close() + + body, err := io.ReadAll(stream) + if err != nil { + return "", fmt.Errorf("could not read the connectivity check results: %w", err) + } + return string(body), nil +} + +func (c *Cluster) deletePreflightPod(namespace, name string) { + // A fresh context: the caller's may already be cancelled, and the pod still + // has to go. + ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) + defer cancel() + + grace := int64(0) + err := c.Clientset.CoreV1().Pods(namespace). + Delete(ctx, name, metav1.DeleteOptions{GracePeriodSeconds: &grace}) + if err != nil && !apierrors.IsNotFound(err) { + fmt.Printf("warning: could not delete the connectivity check pod %s/%s: %v\n", namespace, name, err) + } +} + +func parsePreflightLogs(targets []Target, logs string) []Check { + reachable := map[int]bool{} + for _, line := range strings.Split(logs, "\n") { + var index int + var status string + if _, err := fmt.Sscanf(strings.TrimSpace(line), "%d %s", &index, &status); err == nil { + reachable[index] = status == "REACHABLE" + } + } + + checks := make([]Check, 0, len(targets)) + for i, t := range targets { + ok, reported := reachable[i] + switch { + case !reported: + checks = append(checks, Check{ + Name: t.Name, + Result: CheckSkipped, + Detail: "the check pod did not report a result for this endpoint", + }) + case ok: + checks = append(checks, Check{Name: t.Name, Result: CheckPassed, Detail: t.Address}) + default: + checks = append(checks, Check{ + Name: t.Name, + Result: CheckFailed, + Detail: fmt.Sprintf("%s is not reachable from inside the cluster", t.Address), + Remediation: t.Remediation, + }) + } + } + return checks +} + +func skippedChecks(targets []Target, err error) []Check { + checks := make([]Check, 0, len(targets)) + for _, t := range targets { + checks = append(checks, Check{Name: t.Name, Result: CheckSkipped, Detail: err.Error()}) + } + return checks +} + +// splitTarget accepts either a URL or a host:port. +func splitTarget(address string) (host string, port string, err error) { + if strings.Contains(address, "://") { + u, parseErr := url.Parse(address) + if parseErr != nil { + return "", "", parseErr + } + if u.Hostname() == "" { + return "", "", fmt.Errorf("no host") + } + if p := u.Port(); p != "" { + return u.Hostname(), p, nil + } + return u.Hostname(), defaultPortForScheme(u.Scheme), nil + } + + host, port, err = net.SplitHostPort(address) + if err != nil { + return "", "", err + } + return host, port, nil +} + +func defaultPortForScheme(scheme string) string { + switch strings.ToLower(scheme) { + case "http", "grpc": + return "80" + default: + return "443" + } +} + +func isLoopback(host string) bool { + if strings.EqualFold(host, "localhost") { + return true + } + if ip := net.ParseIP(host); ip != nil { + return ip.IsLoopback() || ip.IsUnspecified() + } + return false +} + +func shellQuote(s string) string { + return "'" + strings.ReplaceAll(s, "'", `'\''`) + "'" +} diff --git a/pkg/kubernetes/preflight_test.go b/pkg/kubernetes/preflight_test.go new file mode 100644 index 00000000..a9bf1341 --- /dev/null +++ b/pkg/kubernetes/preflight_test.go @@ -0,0 +1,48 @@ +package kubernetes_test + +import ( + "testing" + + "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// A loopback address can never resolve from inside a pod, so it is worth +// catching before scheduling anything. Local clusters are the common case here. +func TestStaticChecks_RejectsLoopbackAddresses(t *testing.T) { + for _, address := range []string{ + "http://localhost:8065/", + "https://127.0.0.1:8443", + "grpc://localhost:8443", + "0.0.0.0:8443", + } { + t.Run(address, func(t *testing.T) { + checks := kubernetes.StaticChecks([]kubernetes.Target{{Name: "Octopus", Address: address}}) + require.Len(t, checks, 1) + assert.Equal(t, kubernetes.CheckFailed, checks[0].Result) + assert.Contains(t, checks[0].Remediation, "host.docker.internal") + }) + } +} + +func TestStaticChecks_AllowsRoutableAddresses(t *testing.T) { + for _, address := range []string{ + "https://my.octopus.app", + "grpc://my.octopus.app:8443", + "https://octopus.internal:8080/", + "host.docker.internal:8443", + "10.0.0.5:8443", + } { + t.Run(address, func(t *testing.T) { + checks := kubernetes.StaticChecks([]kubernetes.Target{{Name: "Octopus", Address: address}}) + assert.Empty(t, checks, "a routable address should raise nothing") + }) + } +} + +func TestStaticChecks_ReportsUnparseableAddresses(t *testing.T) { + checks := kubernetes.StaticChecks([]kubernetes.Target{{Name: "Octopus", Address: "not a url"}}) + require.Len(t, checks, 1) + assert.Equal(t, kubernetes.CheckFailed, checks[0].Result) +} diff --git a/pkg/surveyext/asker.go b/pkg/surveyext/asker.go new file mode 100644 index 00000000..13236583 --- /dev/null +++ b/pkg/surveyext/asker.go @@ -0,0 +1,39 @@ +package surveyext + +import ( + "fmt" + "os" + "strings" + + "github.com/AlecAivazis/survey/v2" +) + +const maxTerminalRetries = 3 + +// AskOne recovers from key sequences survey cannot parse. Survey aborts the +// prompt for any escape sequence outside the handful it understands, which on +// its own ends the whole command and discards every answer given so far. +func AskOne(p survey.Prompt, response any, opts ...survey.AskOpt) error { + opts = append([]survey.AskOpt{withTranslatedStdio()}, opts...) + + var err error + for attempt := 0; attempt <= maxTerminalRetries; attempt++ { + err = survey.AskOne(p, response, opts...) + if !isUnparsedKeyError(err) { + return err + } + + fmt.Fprintf(os.Stderr, "\nThat key isn't supported here. Please try again.\n") + } + return err +} + +func withTranslatedStdio() survey.AskOpt { + return survey.WithStdio(NewTranslatedStdin(os.Stdin), os.Stdout, os.Stderr) +} + +// isUnparsedKeyError matches on the message because survey builds this with +// fmt.Errorf and exports no type for it. +func isUnparsedKeyError(err error) bool { + return err != nil && strings.Contains(err.Error(), "unexpected escape sequence from terminal") +} diff --git a/pkg/surveyext/editor.go b/pkg/surveyext/editor.go index e21766b3..68fbc3df 100644 --- a/pkg/surveyext/editor.go +++ b/pkg/surveyext/editor.go @@ -171,7 +171,13 @@ func (e *OctoEditor) prompt(initialValue string, config *survey.PromptConfig) (i // open the editor cmd := exec.Command(args[0], args[1:]...) - cmd.Stdin = stdio.In + // The terminal itself, not whatever survey reads through: os/exec only + // passes a descriptor straight to the child when given an *os.File. + if terminal, ok := TerminalFile(stdio.In); ok { + cmd.Stdin = terminal + } else { + cmd.Stdin = stdio.In + } cmd.Stdout = stdio.Out cmd.Stderr = stdio.Err cursor.Show() diff --git a/pkg/surveyext/pty_test.go b/pkg/surveyext/pty_test.go new file mode 100644 index 00000000..7598c190 --- /dev/null +++ b/pkg/surveyext/pty_test.go @@ -0,0 +1,156 @@ +package surveyext_test + +import ( + "bytes" + "io" + "os" + "strings" + "sync" + "testing" + "time" + + "github.com/AlecAivazis/survey/v2" + "github.com/OctopusDeploy/cli/pkg/surveyext" + "github.com/creack/pty" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// cursorPositionRequest is the escape sequence survey uses to locate the +// cursor. A real terminal answers it; a bare pty has nobody to, so a test +// driving survey through one has to answer on the terminal's behalf or every +// prompt hangs. +var cursorPositionRequest = []byte("\x1b[6n") + +type fakeTerminal struct { + master *os.File + slave *os.File + + mu sync.Mutex + output bytes.Buffer +} + +func newFakeTerminal(t *testing.T) *fakeTerminal { + t.Helper() + + master, slave, err := pty.Open() + require.NoError(t, err) + + term := &fakeTerminal{master: master, slave: slave} + t.Cleanup(func() { + _ = master.Close() + _ = slave.Close() + }) + + go term.pump() + return term +} + +func (f *fakeTerminal) pump() { + buf := make([]byte, 1024) + for { + n, err := f.master.Read(buf) + if n > 0 { + chunk := buf[:n] + + f.mu.Lock() + f.output.Write(chunk) + f.mu.Unlock() + + for i := 0; i < bytes.Count(chunk, cursorPositionRequest); i++ { + _, _ = f.master.Write([]byte("\x1b[1;1R")) + } + } + if err != nil { + return + } + } +} + +func (f *fakeTerminal) typeKeys(t *testing.T, keys string) { + t.Helper() + // Let the prompt render before typing at it. + require.Eventually(t, func() bool { + f.mu.Lock() + defer f.mu.Unlock() + return f.output.Len() > 0 + }, 5*time.Second, 20*time.Millisecond, "the prompt never rendered") + + _, err := f.master.Write([]byte(keys)) + require.NoError(t, err) +} + +func (f *fakeTerminal) ask(translate bool) (<-chan string, <-chan error) { + answer := make(chan string, 1) + errs := make(chan error, 1) + + var in survey.AskOpt + if translate { + in = survey.WithStdio(surveyext.NewTranslatedStdin(f.slave), f.slave, io.Discard) + } else { + in = survey.WithStdio(f.slave, f.slave, io.Discard) + } + + go func() { + var response string + if err := survey.AskOne(&survey.Input{Message: "Name"}, &response, in); err != nil { + errs <- err + return + } + answer <- response + }() + + return answer, errs +} + +// This is the reported bug: Option+Backspace sends ESC DEL, survey's rune +// reader rejects it, and the prompt aborts - taking the whole command with it. +func TestAskOne_UntranslatedOptionBackspaceIsRejectedBySurvey(t *testing.T) { + term := newFakeTerminal(t) + _, errs := term.ask(false) + + term.typeKeys(t, "liam mackie\x1b\x7f\r") + + select { + case err := <-errs: + require.Error(t, err) + assert.True(t, strings.Contains(err.Error(), "unexpected escape sequence from terminal"), + "expected survey to reject the sequence, got: %v", err) + case <-time.After(10 * time.Second): + t.Fatal("timed out waiting for the prompt") + } +} + +// Translated, the same keypress does what it does everywhere else: delete the +// previous word. +func TestAskOne_OptionBackspaceDeletesAWord(t *testing.T) { + term := newFakeTerminal(t) + answer, errs := term.ask(true) + + term.typeKeys(t, "liam mackie\x1b\x7f\r") + + select { + case got := <-answer: + assert.Equal(t, "liam ", got) + case err := <-errs: + t.Fatalf("prompt aborted: %v", err) + case <-time.After(10 * time.Second): + t.Fatal("timed out waiting for the prompt") + } +} + +func TestAskOne_NormalInputIsUnaffected(t *testing.T) { + term := newFakeTerminal(t) + answer, errs := term.ask(true) + + term.typeKeys(t, "liam-mackie\r") + + select { + case got := <-answer: + assert.Equal(t, "liam-mackie", got) + case err := <-errs: + t.Fatalf("prompt aborted: %v", err) + case <-time.After(10 * time.Second): + t.Fatal("timed out waiting for the prompt") + } +} diff --git a/pkg/surveyext/stdin.go b/pkg/surveyext/stdin.go new file mode 100644 index 00000000..1e7d9ef2 --- /dev/null +++ b/pkg/surveyext/stdin.go @@ -0,0 +1,233 @@ +package surveyext + +import ( + "io" + "os" + "unicode" + "unicode/utf8" +) + +const ( + keyEscape = 0x1b + keyDelete = 0x7f + keyBackspace = 0x08 + keyInterrupt = 0x03 + keyCR = '\r' + keyLF = '\n' + + csiIntroducer = '[' + ss3Introducer = 'O' +) + +// TranslatedStdin exists for Option/Alt+Backspace. Terminals send that as +// ESC DEL, which survey's rune reader rejects outright, ending the prompt and +// with it the whole command. Survey has no delete-word handling in its line +// editor either, so the sequence is rewritten into the right number of plain +// backspaces. +// +// It embeds the real file because survey puts the terminal into raw mode with +// an ioctl against Fd(). +type TranslatedStdin struct { + file *os.File + + // line models what has been typed since the prompt last accepted a line, + // so a word deletion knows how far back to reach. + line []rune + // lineUnknown records that something happened this line the model does not + // follow. Deleting a guessed number of characters would corrupt the input, + // so word deletion falls back to removing one character. + lineUnknown bool + // pendingEscape holds back a trailing ESC: a terminal may split an escape + // sequence across reads, and an ESC released early reaches survey as the + // malformed sequence this type exists to prevent. The cost is that a bare + // Escape keypress is not seen until the next byte arrives, which only + // happens when a read ends exactly on an ESC. + pendingEscape bool + // overflow holds translated bytes that did not fit in the caller's buffer, + // since one keypress can expand into several backspaces. + overflow []byte +} + +func NewTranslatedStdin(file *os.File) *TranslatedStdin { + return &TranslatedStdin{file: file} +} + +func (s *TranslatedStdin) Fd() uintptr { return s.file.Fd() } + +func (s *TranslatedStdin) File() *os.File { return s.file } + +// TerminalFile unwraps a reader to the terminal behind it. Anything handing +// stdin to a child process needs the real file: os/exec only passes a +// descriptor straight through when given an *os.File, and otherwise copies +// through a pipe, leaving a full-screen editor without a terminal to drive. +func TerminalFile(reader io.Reader) (*os.File, bool) { + switch r := reader.(type) { + case *os.File: + return r, true + case *TranslatedStdin: + return r.File(), true + default: + return nil, false + } +} + +func (s *TranslatedStdin) Read(p []byte) (int, error) { + if len(s.overflow) > 0 { + n := copy(p, s.overflow) + s.overflow = s.overflow[n:] + return n, nil + } + + n, err := s.file.Read(p) + if n <= 0 { + if s.pendingEscape && len(p) > 0 { + s.pendingEscape = false + p[0] = keyEscape + return 1, err + } + return n, err + } + + translated := s.translate(p[:n]) + + copied := copy(p, translated) + if copied < len(translated) { + s.overflow = append(s.overflow, translated[copied:]...) + } + return copied, err +} + +func (s *TranslatedStdin) translate(in []byte) []byte { + out := make([]byte, 0, len(in)) + + for i := 0; i < len(in); { + b := in[i] + + if s.pendingEscape { + s.pendingEscape = false + if consumed, replacement, ok := s.escapeSequence(in[i:]); ok { + out = append(out, replacement...) + i += consumed + continue + } + out = append(out, keyEscape) + } + + if b == keyEscape { + if i == len(in)-1 { + s.pendingEscape = true + i++ + continue + } + if consumed, replacement, ok := s.escapeSequence(in[i+1:]); ok { + out = append(out, replacement...) + i += 1 + consumed + continue + } + s.lineUnknown = true + out = append(out, b) + i++ + continue + } + + r, size := utf8.DecodeRune(in[i:]) + s.observe(r) + out = append(out, in[i:i+size]...) + i += size + } + + return out +} + +func (s *TranslatedStdin) escapeSequence(rest []byte) (consumed int, replacement []byte, ok bool) { + if len(rest) == 0 { + return 0, nil, false + } + + switch rest[0] { + case keyDelete, keyBackspace: + return 1, s.deleteWord(), true + case csiIntroducer: + return s.controlSequence(rest) + case ss3Introducer: + if len(rest) < 2 { + return 0, nil, false + } + s.lineUnknown = true + return 2, append([]byte{keyEscape}, rest[:2]...), true + default: + return 0, nil, false + } +} + +// controlSequence consumes a CSI sequence whole so its payload never reaches +// the line model as typed characters. The terminal's own replies arrive on the +// input stream: survey asks for the cursor position on every render, and the +// answer comes back as ESC [ row ; col R. +func (s *TranslatedStdin) controlSequence(rest []byte) (consumed int, replacement []byte, ok bool) { + end := 1 + for end < len(rest) && !isCSIFinalByte(rest[end]) { + end++ + } + if end == len(rest) { + // Split across reads; leave it for survey rather than half-consuming it. + s.lineUnknown = true + return 0, nil, false + } + + if movesCursor(rest[end]) { + s.lineUnknown = true + } + + consumed = end + 1 + return consumed, append([]byte{keyEscape}, rest[:consumed]...), true +} + +func isCSIFinalByte(b byte) bool { return b >= 0x40 && b <= 0x7e } + +func movesCursor(final byte) bool { + switch final { + case 'R', 'c', 'n': // replies from the terminal, not keys the user pressed + return false + default: + return true + } +} + +func (s *TranslatedStdin) deleteWord() []byte { + if s.lineUnknown || len(s.line) == 0 { + return []byte{keyDelete} + } + + count := 0 + for len(s.line)-count > 0 && unicode.IsSpace(s.line[len(s.line)-count-1]) { + count++ + } + for len(s.line)-count > 0 && !unicode.IsSpace(s.line[len(s.line)-count-1]) { + count++ + } + + s.line = s.line[:len(s.line)-count] + + backspaces := make([]byte, count) + for i := range backspaces { + backspaces[i] = keyDelete + } + return backspaces +} + +func (s *TranslatedStdin) observe(r rune) { + switch { + case r == keyCR || r == keyLF || r == keyInterrupt: + s.line = s.line[:0] + s.lineUnknown = false + case r == keyDelete || r == keyBackspace: + if len(s.line) > 0 { + s.line = s.line[:len(s.line)-1] + } + case unicode.IsPrint(r): + s.line = append(s.line, r) + default: + s.lineUnknown = true + } +} diff --git a/pkg/surveyext/stdin_test.go b/pkg/surveyext/stdin_test.go new file mode 100644 index 00000000..0c27a3f7 --- /dev/null +++ b/pkg/surveyext/stdin_test.go @@ -0,0 +1,177 @@ +package surveyext + +import ( + "bytes" + "os" + "strings" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +const ( + optionBackspace = "\x1b\x7f" + del = "\x7f" +) + +// translateAll includes anything the translator holds back as overflow. +func translateAll(t *testing.T, chunks ...string) string { + t.Helper() + + s := &TranslatedStdin{} + var out strings.Builder + for _, chunk := range chunks { + out.Write(s.translate([]byte(chunk))) + } + return out.String() +} + +// Survey's line editor only understands plain backspaces, so a word deletion +// has to become the right number of those. +func TestTranslate_OptionBackspaceDeletesAWord(t *testing.T) { + tests := []struct { + name string + input string + want string + }{ + {"one word", "liam" + optionBackspace, "liam" + strings.Repeat(del, 4)}, + {"last of two words", "liam mackie" + optionBackspace, "liam mackie" + strings.Repeat(del, 6)}, + {"trailing space is consumed with the word", "liam mackie " + optionBackspace, "liam mackie " + strings.Repeat(del, 7)}, + {"hyphens are part of a word", "my-gateway" + optionBackspace, "my-gateway" + strings.Repeat(del, 10)}, + {"nothing typed yet", optionBackspace, del}, + {"the backspace variant behaves the same", "liam\x1b\x08", "liam" + strings.Repeat(del, 4)}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert.Equal(t, tt.want, translateAll(t, tt.input)) + }) + } +} + +func TestTranslate_RepeatedWordDeletes(t *testing.T) { + got := translateAll(t, "octopus argo gateway"+optionBackspace+optionBackspace) + assert.Equal(t, "octopus argo gateway"+strings.Repeat(del, 7)+strings.Repeat(del, 5), got) +} + +// Backspaces the user types themselves have to move the model too, or the next +// word deletion reaches too far. +func TestTranslate_TracksManualBackspaces(t *testing.T) { + got := translateAll(t, "liam mackie"+del+del+optionBackspace) + assert.Equal(t, "liam mackie"+del+del+strings.Repeat(del, 4), got, "mack remains, so four backspaces") +} + +func TestTranslate_ResetsOnNewline(t *testing.T) { + got := translateAll(t, "first answer\rsecond"+optionBackspace) + assert.Equal(t, "first answer\rsecond"+strings.Repeat(del, 6), got) +} + +// A cursor movement puts the model out of step with the real line. Guessing a +// word boundary then would eat text the user meant to keep, so fall back to +// removing a single character. +func TestTranslate_FallsBackAfterCursorMovement(t *testing.T) { + arrowLeft := "\x1b[D" + got := translateAll(t, "liam mackie"+arrowLeft+optionBackspace) + assert.Equal(t, "liam mackie"+arrowLeft+del, got) +} + +func TestTranslate_FallsBackAfterAnUnmodelledControlKey(t *testing.T) { + ctrlA := "\x01" + got := translateAll(t, "liam mackie"+ctrlA+optionBackspace) + assert.Equal(t, "liam mackie"+ctrlA+del, got) +} + +func TestTranslate_PassesThroughSurveysOwnSequences(t *testing.T) { + // A trailing character is added so nothing is held back waiting to see what + // follows the escape. + for _, seq := range []string{"\x1b[A", "\x1b[B", "\x1b[C", "\x1b[D", "\x1bOA", "\x1b[3~", "\x1b[1;1R"} { + assert.Equal(t, seq+"x", translateAll(t, seq+"x"), "%q must reach survey unchanged", seq) + } +} + +// Survey asks the terminal for the cursor position on every render, and the +// answer arrives on the input stream. Treating that reply as typing would +// corrupt the line model and make word deletion fall back to one character. +func TestTranslate_CursorPositionReplyDoesNotDisturbTheLineModel(t *testing.T) { + cursorReply := "\x1b[1;1R" + got := translateAll(t, cursorReply+"liam mackie"+optionBackspace) + assert.Equal(t, cursorReply+"liam mackie"+strings.Repeat(del, 6), got) +} + +func TestTranslate_LeavesOrdinaryTypingAlone(t *testing.T) { + for _, input := range []string{"liam-mackie", "Production", "grpc://host:8443", ""} { + assert.Equal(t, input, translateAll(t, input)) + } +} + +// A terminal may split an escape sequence across reads. Releasing the ESC +// before knowing what follows would hand survey the very sequence it rejects. +func TestTranslate_HandlesSplitEscapeSequences(t *testing.T) { + s := &TranslatedStdin{} + first := string(s.translate([]byte("liam mackie\x1b"))) + second := string(s.translate([]byte("\x7f"))) + + assert.Equal(t, "liam mackie", first, "the ESC is held until what follows it is known") + assert.Equal(t, strings.Repeat(del, 6), second) + assert.NotContains(t, first+second, "\x1b", "survey must never see the sequence it cannot parse") +} + +func TestTranslate_ReleasesAHeldEscapeWhenItWasNotASequence(t *testing.T) { + s := &TranslatedStdin{} + first := string(s.translate([]byte("\x1b"))) + second := string(s.translate([]byte("a"))) + + assert.Empty(t, first) + assert.Equal(t, "\x1ba", second) +} + +func TestTranslate_MultiByteRunesCountAsOneCharacter(t *testing.T) { + got := translateAll(t, "café"+optionBackspace) + assert.Equal(t, "café"+strings.Repeat(del, 4), got, "é is one character to delete, not two bytes") +} + +// One keypress can expand past the caller's buffer, and no keystroke may be +// dropped when it does. +func TestRead_HoldsOverflowForTheNextRead(t *testing.T) { + reader, writer, err := os.Pipe() + require.NoError(t, err) + defer reader.Close() + + go func() { + defer writer.Close() + _, _ = writer.Write([]byte("liam mackie" + optionBackspace)) + }() + + stdin := NewTranslatedStdin(reader) + + var got bytes.Buffer + buf := make([]byte, 4) + for got.Len() < len("liam mackie")+6 { + n, err := stdin.Read(buf) + got.Write(buf[:n]) + if err != nil { + break + } + } + + assert.Equal(t, "liam mackie"+strings.Repeat(del, 6), got.String()) +} + +func TestTerminalFile_Unwraps(t *testing.T) { + reader, writer, err := os.Pipe() + require.NoError(t, err) + defer reader.Close() + defer writer.Close() + + got, ok := TerminalFile(NewTranslatedStdin(reader)) + assert.True(t, ok) + assert.Same(t, reader, got) + + got, ok = TerminalFile(reader) + assert.True(t, ok) + assert.Same(t, reader, got) + + _, ok = TerminalFile(bytes.NewBufferString("not a terminal")) + assert.False(t, ok) +} From c2d3a19f73aa7fedfc17b00765f5a1f25169d84c Mon Sep 17 00:00:00 2001 From: Liam Mackie Date: Thu, 27 Aug 2026 17:46:24 +1000 Subject: [PATCH 2/7] preregister --- examples.md | 10 +- pkg/argocdgateways/argocdgateways.go | 113 ++++++++++++++++++ pkg/cmd/kubernetes/gateway/install/commit.go | 113 ++++++++++++++++-- pkg/cmd/kubernetes/gateway/install/install.go | 73 ++++------- .../gateway/install/install_test.go | 29 +++-- .../gateway/install/registration_test.go | 111 +++++++++++++++++ pkg/cmd/kubernetes/gateway/install/review.go | 5 +- .../kubernetes/gateway/install/review_test.go | 15 ++- 8 files changed, 390 insertions(+), 79 deletions(-) create mode 100644 pkg/argocdgateways/argocdgateways.go create mode 100644 pkg/cmd/kubernetes/gateway/install/registration_test.go diff --git a/examples.md b/examples.md index 2ac517ec..c0ec7f35 100644 --- a/examples.md +++ b/examples.md @@ -220,9 +220,13 @@ octopus kubernetes gateway install \ --no-prompt ``` -The Argo CD token and the Octopus credential are written to Kubernetes Secrets and referenced -from the chart, so neither appears in the Helm release values or in a file written by `-o`. -Pass `--inline-secrets` if you would rather have them in the values. +Octopus registers the gateway itself before installing the chart, and puts only the gateway's +own credential into the cluster — your Octopus API key is never stored there. If the install +fails, the registration is removed again so you are not left with a gateway that never connects. + +The Argo CD token is written to a Kubernetes Secret and referenced from the chart, so it does +not appear in the Helm release values or in a file written by `-o`. Pass `--inline-secrets` if +you would rather have it in the values. # Let the CLI create the Argo CD account it needs diff --git a/pkg/argocdgateways/argocdgateways.go b/pkg/argocdgateways/argocdgateways.go new file mode 100644 index 00000000..18f2e387 --- /dev/null +++ b/pkg/argocdgateways/argocdgateways.go @@ -0,0 +1,113 @@ +// Package argocdgateways registers Argo CD gateways with Octopus Server. +// +// The gateway chart can register itself, but only if it is given an Octopus +// credential to do it with, which then lives in the cluster for as long as the +// gateway does. Registering from the CLI instead means only the gateway's own +// credential ever reaches the cluster. +package argocdgateways + +import ( + "fmt" + "strings" + + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/newclient" +) + +const template = "/api/{spaceId}/argocdgateways" + +// RegisterCommand asks Octopus to register a gateway. +type RegisterCommand struct { + SpaceID string `json:"SpaceId"` + Name string `json:"Name"` + Environments []string `json:"Environments"` + // ClientID re-registers an existing gateway, which is how one gateway is + // shared across spaces. + ClientID string `json:"ClientId,omitempty"` + // PreserveAuthenticationToken keeps the gateway's existing credential when + // re-registering. The response then carries no token. + PreserveAuthenticationToken bool `json:"PreserveAuthenticationToken,omitempty"` +} + +// Registration is what Octopus hands back, and is everything the gateway needs +// to connect. The credential is shown once. +type Registration struct { + ID string `json:"Id"` + Name string `json:"Name"` + SpaceID string `json:"SpaceId"` + ClientID string `json:"ClientId"` + // AuthenticationToken is empty when re-registering with + // PreserveAuthenticationToken. + AuthenticationToken string `json:"AuthenticationToken"` + // CertificateThumbprint identifies the Octopus Server the gateway should + // expect. Octopus has spelled this field both ways. + CertificateThumbprint string `json:"CertificateThumbprint"` + Thumbprint string `json:"Thumbprint"` +} + +// Thumb returns whichever spelling of the thumbprint the server used. +func (r Registration) Thumb() string { + if r.CertificateThumbprint != "" { + return r.CertificateThumbprint + } + return r.Thumbprint +} + +func Register(client newclient.Client, command RegisterCommand) (*Registration, error) { + if strings.TrimSpace(command.Name) == "" { + return nil, fmt.Errorf("a gateway name is required") + } + + path, err := expand(client, command.SpaceID) + if err != nil { + return nil, err + } + + registration, err := newclient.Post[Registration](client.HttpSession(), path, command) + if err != nil { + return nil, fmt.Errorf("could not register the Argo CD gateway with Octopus: %w", err) + } + return registration, nil +} + +// DeleteByID removes a registration. Used to undo one when the install that +// followed it did not work, so a failed attempt does not leave a gateway in +// Octopus that will never connect. +func DeleteByID(client newclient.Client, spaceID, id string) error { + path, err := expand(client, spaceID) + if err != nil { + return err + } + return newclient.Delete(client.HttpSession(), path+"/"+id) +} + +// List returns the gateways already registered in a space, so a name collision +// can be reported before it silently takes over an existing gateway. +func List(client newclient.Client, spaceID string) ([]Registration, error) { + path, err := expand(client, spaceID) + if err != nil { + return nil, err + } + + var response struct { + Items []Registration `json:"Items"` + } + page, err := newclient.Get[struct { + Items []Registration `json:"Items"` + }](client.HttpSession(), path) + if err != nil { + return nil, fmt.Errorf("could not list the Argo CD gateways in this space: %w", err) + } + response = *page + return response.Items, nil +} + +func expand(client newclient.Client, spaceID string) (string, error) { + if spaceID == "" { + spaceID = client.GetSpaceID() + } + path, err := client.URITemplateCache().Expand(template, map[string]any{"spaceId": spaceID}) + if err != nil { + return "", err + } + return path, nil +} diff --git a/pkg/cmd/kubernetes/gateway/install/commit.go b/pkg/cmd/kubernetes/gateway/install/commit.go index 241fd847..b5f29787 100644 --- a/pkg/cmd/kubernetes/gateway/install/commit.go +++ b/pkg/cmd/kubernetes/gateway/install/commit.go @@ -9,6 +9,7 @@ import ( "time" "github.com/AlecAivazis/survey/v2" + "github.com/OctopusDeploy/cli/pkg/argocdgateways" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" "github.com/OctopusDeploy/cli/pkg/output" @@ -47,10 +48,14 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { return err } - if err := opts.storeCredentials(ctx); err != nil { + if err := opts.register(); err != nil { return err } + if err := opts.storeCredentials(ctx); err != nil { + return opts.deregister(err) + } + fmt.Fprintf(opts.Out, "\nInstalling the Argo CD gateway into %s...\n", output.Cyan(opts.TargetNamespace)) if opts.Wait.Value || opts.Atomic.Value { // The gateway registers with Octopus from a job before it starts, so @@ -69,13 +74,61 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { Timeout: timeout, }) if err != nil { - return err + return opts.deregister(err) } opts.reportSuccess(release) return nil } +// register obtains the gateway's own credential from Octopus, so the chart does +// not have to be given one of the user's to register itself with. +func (opts *InstallOptions) register() error { + if opts.RegisterCallback == nil { + return errors.New("no way to register the gateway with Octopus was configured") + } + + environments := opts.Environments.Value + if environments == nil { + environments = []string{} + } + + registration, err := opts.RegisterCallback(argocdgateways.RegisterCommand{ + SpaceID: opts.Space.ID, + Name: opts.Name.Value, + Environments: environments, + }) + if err != nil { + return err + } + if registration.AuthenticationToken == "" { + return errors.New("Octopus registered the gateway but returned no credential for it") + } + + opts.Registration = registration + fmt.Fprintf(opts.Out, "%s Registered %s with Octopus\n", output.Green("✔"), output.Cyan(opts.Name.Value)) + return nil +} + +// deregister removes the registration when the install it was for did not +// happen, so a failed attempt does not leave a gateway in Octopus that will +// never connect. +func (opts *InstallOptions) deregister(cause error) error { + if opts.Registration == nil || opts.DeregisterCallback == nil { + return cause + } + + if err := opts.DeregisterCallback(opts.Registration.ID); err != nil { + fmt.Fprintf(opts.Out, "%s The install failed, and the gateway registration in Octopus could not be removed: %v\n"+ + " Delete %s under Infrastructure > Argo CD Instances before trying again.\n", + output.Yellow("!"), err, output.Cyan(opts.Name.Value)) + return cause + } + + fmt.Fprintf(opts.Out, " %s\n", output.Dim("Removed the gateway registration from Octopus.")) + return cause +} + func (opts *InstallOptions) chartRef() helm.ChartRef { ref := ChartRef ref.Version = opts.ChartVersion.Value @@ -93,6 +146,9 @@ func (opts *InstallOptions) BuildValues() (map[string]any, error) { return nil, errors.New("the Octopus gRPC address could not be determined; specify --" + FlagOctopusGRPCURL) } + // register is off: Octopus registers the gateway before the chart is + // installed, so no Octopus credential of the user's ever reaches the + // cluster. The chart still wants these for its own configuration. registrationOctopus := map[string]any{ "name": opts.Name.Value, "serverApiUrl": opts.Host, @@ -117,13 +173,6 @@ func (opts *InstallOptions) BuildValues() (map[string]any, error) { return nil, err } - if opts.InlineSecrets.Value { - registrationOctopus["serverAccessToken"] = opts.OctopusCredential - } else { - registrationOctopus["serverAccessTokenSecretName"] = octopusTokenSecretName - registrationOctopus["serverAccessTokenSecretKey"] = octopusTokenSecretKey - } - switch { case len(projectTokens) > 0: // AWS caps account tokens at 12 hours, so managed Argo CD authenticates @@ -140,7 +189,7 @@ func (opts *InstallOptions) BuildValues() (map[string]any, error) { gatewayArgoCD["authenticationTokenSecretKey"] = argoTokenSecretKey } - registration := map[string]any{"octopus": registrationOctopus} + registration := map[string]any{"register": false, "octopus": registrationOctopus} if opts.ArgoCDWebUIURL.Value != "" { registration["argocd"] = map[string]any{"webUiUrl": opts.ArgoCDWebUIURL.Value} } @@ -328,9 +377,33 @@ func (opts *InstallOptions) storeCredentials(ctx context.Context) error { return err } - return opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, octopusTokenSecretName, map[string]string{ - octopusTokenSecretKey: opts.OctopusCredential, - }) + return opts.storeRegistration(ctx) +} + +// storeRegistration writes the gateway's own credential in the shape the chart +// expects, taking the place of the registration job it would otherwise run. +func (opts *InstallOptions) storeRegistration(ctx context.Context) error { + contents, err := opts.registrationSecretContents() + if err != nil { + return err + } + + return opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, registrationSecretName, + map[string]string{registrationSecretKey: contents}) +} + +func (opts *InstallOptions) registrationSecretContents() (string, error) { + if opts.Registration == nil { + return "", errors.New("the gateway was not registered with Octopus") + } + + var b strings.Builder + fmt.Fprintf(&b, "octopus-grpc-authentication-token: %q\n", opts.Registration.AuthenticationToken) + fmt.Fprintf(&b, "octopus-grpc-client-id: %q\n", opts.Registration.ClientID) + if thumbprint := opts.Registration.Thumb(); thumbprint != "" { + fmt.Fprintf(&b, "octopus-grpc-thumbprint: %q\n", thumbprint) + } + return b.String(), nil } func (opts *InstallOptions) renderOnly(ctx context.Context, values map[string]any, timeout time.Duration) error { @@ -382,3 +455,17 @@ func (opts *InstallOptions) reportSuccess(release helm.Release) { autoCmd := flag.GenerateAutomationCmd(opts.CmdPath, opts.GetSpaceNameOrEmpty(), generatable...) fmt.Fprintf(opts.Out, "\nAutomation Command: %s\n", autoCmd) } + +// ErrForTest is a sentinel used by tests to check error propagation. +var ErrForTest = errors.New("install failed") + +// RegistrationSecretForTest renders the credential file written for the chart. +func (opts *InstallOptions) RegistrationSecretForTest() (string, error) { + return opts.registrationSecretContents() +} + +// RegisterForTest exposes the registration step. +func (opts *InstallOptions) RegisterForTest() error { return opts.register() } + +// DeregisterForTest exposes the rollback step. +func (opts *InstallOptions) DeregisterForTest(cause error) error { return opts.deregister(cause) } diff --git a/pkg/cmd/kubernetes/gateway/install/install.go b/pkg/cmd/kubernetes/gateway/install/install.go index 74ee0786..5438db65 100644 --- a/pkg/cmd/kubernetes/gateway/install/install.go +++ b/pkg/cmd/kubernetes/gateway/install/install.go @@ -8,6 +8,7 @@ import ( "github.com/AlecAivazis/survey/v2" "github.com/MakeNowJust/heredoc/v2" + "github.com/OctopusDeploy/cli/pkg/argocdgateways" "github.com/OctopusDeploy/cli/pkg/cmd" "github.com/OctopusDeploy/cli/pkg/constants" "github.com/OctopusDeploy/cli/pkg/factory" @@ -46,9 +47,13 @@ const ( const ( argoTokenSecretName = "octopus-argocd-gateway-argocd-token" argoTokenSecretKey = "ARGOCD_AUTH_TOKEN" - octopusTokenSecretName = "octopus-argocd-gateway-server-token" - octopusTokenSecretKey = "OCTOPUS_SERVER_ACCESS_TOKEN" projectTokenSecretName = "octopus-argocd-gateway-project-tokens" + + // The chart's own registration job would write these, and the gateway + // reads them from its projected configuration volume. Octopus writes them + // instead, so no Octopus credential of the user's ever enters the cluster. + registrationSecretName = "octopus-argocd-gateway-octopus-auth-secret" + registrationSecretKey = "octopus-argocd-gateway-octopus-authentication-secret.yaml" ) type InstallFlags struct { @@ -94,8 +99,13 @@ type InstallOptions struct { *InstallFlags *cmd.Dependencies - GetAllEnvironmentsCallback selectors.GetAllEnvironmentsCallback - GetOctopusCredentialCallback func() (string, error) + GetAllEnvironmentsCallback selectors.GetAllEnvironmentsCallback + // RegisterCallback registers the gateway with Octopus and returns its own + // credential. Injected so the flow can be tested without a server. + RegisterCallback func(argocdgateways.RegisterCommand) (*argocdgateways.Registration, error) + // DeregisterCallback undoes a registration when the install that followed + // it did not work. + DeregisterCallback func(id string) error // Populated by Discover before prompting. Exported so tests can drive the // prompt flow against a fake cluster. @@ -105,9 +115,9 @@ type InstallOptions struct { Runner *helm.Runner KubeContextInfo octoK8s.Context - TargetNamespace string - TargetRelease string - OctopusCredential string + TargetNamespace string + TargetRelease string + Registration *argocdgateways.Registration } func NewInstallOptions(installFlags *InstallFlags, dependencies *cmd.Dependencies) *InstallOptions { @@ -117,6 +127,12 @@ func NewInstallOptions(installFlags *InstallFlags, dependencies *cmd.Dependencie GetAllEnvironmentsCallback: func() ([]*environments.Environment, error) { return selectors.GetAllEnvironments(dependencies.Client) }, + RegisterCallback: func(command argocdgateways.RegisterCommand) (*argocdgateways.Registration, error) { + return argocdgateways.Register(dependencies.Client, command) + }, + DeregisterCallback: func(id string) error { + return argocdgateways.DeleteByID(dependencies.Client, dependencies.Space.ID, id) + }, } } @@ -144,7 +160,6 @@ func NewCmdInstall(f factory.Factory) *cobra.Command { `, constants.ExecutableName), RunE: func(c *cobra.Command, _ []string) error { opts := NewInstallOptions(installFlags, cmd.NewDependencies(f, c)) - opts.GetOctopusCredentialCallback = func() (string, error) { return octopusCredential(f) } return installRun(c.Context(), opts) }, } @@ -175,10 +190,6 @@ func installRun(ctx context.Context, opts *InstallOptions) error { ctx = context.Background() } - if err := opts.resolveOctopusCredential(); err != nil { - return err - } - if err := opts.Discover(ctx); err != nil { return err } @@ -518,45 +529,11 @@ func (opts *InstallOptions) resolveNames() error { return nil } -// octopusCredential is used once by the chart's registration job; from then on -// the gateway uses its own credential. -func octopusCredential(f factory.Factory) (string, error) { - configProvider, err := f.GetConfigProvider() - if err != nil { - return "", err - } - - if apiKey := configProvider.Get(constants.ConfigApiKey); apiKey != "" { - return apiKey, nil - } - if accessToken := configProvider.Get(constants.ConfigAccessToken); accessToken != "" { - return accessToken, nil - } - - return "", fmt.Errorf("no Octopus credential is configured. Run %s login, or set %s", - constants.ExecutableName, constants.EnvOctopusApiKey) -} - -func (opts *InstallOptions) resolveOctopusCredential() error { - if opts.GetOctopusCredentialCallback == nil { - return errors.New("no Octopus credential source was configured") - } - - credential, err := opts.GetOctopusCredentialCallback() - if err != nil { - return err - } - opts.OctopusCredential = credential - return nil -} - // Run installs the gateway using an existing set of dependencies. The // `kubernetes install` wizard uses this to hand off after the user picks a // component, so the two entry points share one implementation. -func Run(f factory.Factory, dependencies *cmd.Dependencies) error { - opts := NewInstallOptions(NewInstallFlags(), dependencies) - opts.GetOctopusCredentialCallback = func() (string, error) { return octopusCredential(f) } - return installRun(context.Background(), opts) +func Run(_ factory.Factory, dependencies *cmd.Dependencies) error { + return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies)) } // accountName is the Argo CD account, or role, Octopus authenticates as. diff --git a/pkg/cmd/kubernetes/gateway/install/install_test.go b/pkg/cmd/kubernetes/gateway/install/install_test.go index 7106ce2a..62fccb4b 100644 --- a/pkg/cmd/kubernetes/gateway/install/install_test.go +++ b/pkg/cmd/kubernetes/gateway/install/install_test.go @@ -205,21 +205,34 @@ func TestBuildValues_TLSSettingsFollowTheCluster(t *testing.T) { } } -func TestBuildValues_CredentialsGoIntoSecretsByDefault(t *testing.T) { +func TestBuildValues_ArgoCDTokenGoesIntoASecretByDefault(t *testing.T) { opts := completedOptions(t) values, err := opts.BuildValues() require.NoError(t, err) argo := values["gateway"].(map[string]any)["argocd"].(map[string]any) - octopus := values["registration"].(map[string]any)["octopus"].(map[string]any) - assert.Equal(t, "octopus-argocd-gateway-argocd-token", argo["authenticationTokenSecretName"]) assert.Equal(t, "ARGOCD_AUTH_TOKEN", argo["authenticationTokenSecretKey"]) - assert.Equal(t, "octopus-argocd-gateway-server-token", octopus["serverAccessTokenSecretName"]) - assert.NotContains(t, argo, "authenticationToken", "the Argo CD JWT must not reach the Helm values") - assert.NotContains(t, octopus, "serverAccessToken", "the Octopus credential must not reach the Helm values") +} + +// Octopus registers the gateway before the chart is installed, so the chart has +// no reason to hold an Octopus credential and no reason to register itself. +func TestBuildValues_NoOctopusCredentialReachesTheCluster(t *testing.T) { + opts := completedOptions(t) + opts.InlineSecrets.Value = true // even here, there is nothing to inline + + values, err := opts.BuildValues() + require.NoError(t, err) + + registration := values["registration"].(map[string]any) + assert.Equal(t, false, registration["register"], "the chart must not register itself") + + octopus := registration["octopus"].(map[string]any) + for _, key := range []string{"serverAccessToken", "serverAccessTokenSecretName", "serverAccessTokenSecretKey"} { + assert.NotContains(t, octopus, key) + } } func TestBuildValues_InlineSecretsOptsIn(t *testing.T) { @@ -230,10 +243,8 @@ func TestBuildValues_InlineSecretsOptsIn(t *testing.T) { require.NoError(t, err) argo := values["gateway"].(map[string]any)["argocd"].(map[string]any) - octopus := values["registration"].(map[string]any)["octopus"].(map[string]any) assert.Equal(t, "eyJhbGciOiJIUzI1NiJ9.token", argo["authenticationToken"]) - assert.Equal(t, "API-TESTKEY", octopus["serverAccessToken"]) assert.NotContains(t, argo, "authenticationTokenSecretName") } @@ -279,7 +290,6 @@ func completedOptions(t *testing.T) *install.InstallOptions { opts := newOptions(t, flags, asker) opts.Instance = stockInstance() - opts.OctopusCredential = "API-TESTKEY" return opts } @@ -296,7 +306,6 @@ func managedOptions(t *testing.T) *install.InstallOptions { opts := newOptions(t, flags, asker) opts.Instance = argocd.NewManagedInstance("abcd1234.eks-capabilities.ap-southeast-2.amazonaws.com") opts.Instances = []argocd.Instance{opts.Instance} - opts.OctopusCredential = "API-TESTKEY" return opts } diff --git a/pkg/cmd/kubernetes/gateway/install/registration_test.go b/pkg/cmd/kubernetes/gateway/install/registration_test.go new file mode 100644 index 00000000..7d0cb956 --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/registration_test.go @@ -0,0 +1,111 @@ +package install_test + +import ( + "strings" + "testing" + + "github.com/OctopusDeploy/cli/pkg/argocdgateways" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway/install" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func registeredOptions(t *testing.T) *install.InstallOptions { + t.Helper() + + opts := completedOptions(t) + opts.Registration = &argocdgateways.Registration{ + ID: "ArgoCDGateways-1", + ClientID: "3f2504e0-4f89-11d3-9a0c-0305e82c3301", + AuthenticationToken: "gateway-own-credential", + CertificateThumbprint: "AABBCCDDEEFF00112233445566778899AABBCCDD", + } + return opts +} + +// The point of registering from the CLI: the credential the chart would have +// used to register itself never has to exist in the cluster. +func TestRegistrationSecret_HoldsOnlyTheGatewaysOwnCredential(t *testing.T) { + contents, err := registeredOptions(t).RegistrationSecretForTest() + require.NoError(t, err) + + assert.Contains(t, contents, `octopus-grpc-authentication-token: "gateway-own-credential"`) + assert.Contains(t, contents, `octopus-grpc-client-id: "3f2504e0-4f89-11d3-9a0c-0305e82c3301"`) + assert.Contains(t, contents, `octopus-grpc-thumbprint: "AABBCCDDEEFF00112233445566778899AABBCCDD"`) +} + +// Octopus has spelled the thumbprint both ways. +func TestRegistrationSecret_AcceptsEitherThumbprintSpelling(t *testing.T) { + opts := registeredOptions(t) + opts.Registration.CertificateThumbprint = "" + opts.Registration.Thumbprint = "1122334455" + + contents, err := opts.RegistrationSecretForTest() + require.NoError(t, err) + assert.Contains(t, contents, `octopus-grpc-thumbprint: "1122334455"`) +} + +// A server that returns no thumbprint should not produce an empty setting. +func TestRegistrationSecret_OmitsAnAbsentThumbprint(t *testing.T) { + opts := registeredOptions(t) + opts.Registration.CertificateThumbprint = "" + opts.Registration.Thumbprint = "" + + contents, err := opts.RegistrationSecretForTest() + require.NoError(t, err) + assert.NotContains(t, contents, "octopus-grpc-thumbprint") + assert.Equal(t, 2, strings.Count(contents, "\n")) +} + +func TestRegister_SendsTheNameSpaceAndEnvironments(t *testing.T) { + var sent argocdgateways.RegisterCommand + + opts := completedOptions(t) + opts.RegisterCallback = func(c argocdgateways.RegisterCommand) (*argocdgateways.Registration, error) { + sent = c + return &argocdgateways.Registration{ID: "ArgoCDGateways-1", AuthenticationToken: "t"}, nil + } + + require.NoError(t, opts.RegisterForTest()) + + assert.Equal(t, "Production", sent.Name) + assert.Equal(t, "Spaces-1", sent.SpaceID) + assert.Equal(t, []string{"production"}, sent.Environments) +} + +// A registration Octopus accepted but returned no credential for would produce +// a gateway that can never connect. +func TestRegister_RejectsARegistrationWithNoCredential(t *testing.T) { + opts := completedOptions(t) + opts.RegisterCallback = func(argocdgateways.RegisterCommand) (*argocdgateways.Registration, error) { + return &argocdgateways.Registration{ID: "ArgoCDGateways-1"}, nil + } + + assert.ErrorContains(t, opts.RegisterForTest(), "no credential") +} + +// Registering happens before the install, so a failed install must take the +// registration back out rather than leave a gateway that never connects. +func TestDeregister_RemovesTheRegistrationWhenTheInstallFails(t *testing.T) { + var deleted string + + opts := registeredOptions(t) + opts.DeregisterCallback = func(id string) error { + deleted = id + return nil + } + + cause := assert.AnError + assert.Equal(t, cause, opts.DeregisterForTest(cause), "the original failure is what the caller sees") + assert.Equal(t, "ArgoCDGateways-1", deleted) +} + +// Failing to clean up must not replace the real reason the install failed. +func TestDeregister_KeepsTheOriginalFailureWhenCleanupFails(t *testing.T) { + opts := registeredOptions(t) + opts.DeregisterCallback = func(string) error { return assert.AnError } + + cause := install.ErrForTest + assert.Equal(t, cause, opts.DeregisterForTest(cause)) + assert.Contains(t, opts.Out.(interface{ String() string }).String(), "could not be removed") +} diff --git a/pkg/cmd/kubernetes/gateway/install/review.go b/pkg/cmd/kubernetes/gateway/install/review.go index 23af0287..90c6a2be 100644 --- a/pkg/cmd/kubernetes/gateway/install/review.go +++ b/pkg/cmd/kubernetes/gateway/install/review.go @@ -174,6 +174,7 @@ func octopusItems(opts *InstallOptions) []reviewItem { }, }, {Label: "Server", Value: opts.Host, Source: "from your login"}, + {Label: "Registration", Value: "Octopus registers the gateway before installing", Source: "no Octopus credential is stored in the cluster"}, {Label: "Space", Value: opts.Space.Name, Source: "from your login"}, { Label: "gRPC address", Value: opts.OctopusGRPCURL.Value, Source: "derived from the server address", @@ -367,9 +368,9 @@ func projectTokenSummary(opts *InstallOptions) string { func credentialPlacement(opts *InstallOptions) string { if opts.InlineSecrets.Value { - return "in the Helm values" + return "Argo CD token in the Helm values" } - return "in Kubernetes Secrets" + return "Argo CD token in a Kubernetes Secret" } func maskedToken(token string) string { diff --git a/pkg/cmd/kubernetes/gateway/install/review_test.go b/pkg/cmd/kubernetes/gateway/install/review_test.go index f16667e5..816b497e 100644 --- a/pkg/cmd/kubernetes/gateway/install/review_test.go +++ b/pkg/cmd/kubernetes/gateway/install/review_test.go @@ -68,14 +68,23 @@ func TestReview_ShowsEveryDetectedSetting(t *testing.T) { "Default", // space "grpc://my.octopus.app:8443", // derived "grpc://argocd-server.argocd.svc.cluster.local", // detected - "v3.4.2", // detected Argo CD version - "TLS, certificate not verified", // detected TLS posture - "in Kubernetes Secrets", // where credentials go + "v3.4.2", // detected Argo CD version + "TLS, certificate not verified", // detected TLS posture + "Argo CD token in a Kubernetes Secret", // where the credential goes } { assert.Contains(t, review, expected) } } +// Registering from Octopus rather than from the cluster is a security property +// worth stating on the screen someone approves. +func TestReview_SaysNoOctopusCredentialIsStoredInTheCluster(t *testing.T) { + review := reviewOf(t, reviewOptions(t)) + + assert.Contains(t, review, "Registration") + assert.Contains(t, review, "no Octopus credential is stored in the cluster") +} + // The review is printed to the terminal, so a token must not appear in it. func TestReview_MasksTheToken(t *testing.T) { review := reviewOf(t, reviewOptions(t)) From c5eb5d0589aaafa534942e367c92ebdb2f1d6beb Mon Sep 17 00:00:00 2001 From: Liam Mackie Date: Thu, 27 Aug 2026 18:39:30 +1000 Subject: [PATCH 3/7] cleanup --- pkg/apiclient/remember_space_test.go | 1 - pkg/argocdgateways/argocdgateways.go | 1 - pkg/cmd/kubernetes/gateway/install/commit.go | 4 ---- pkg/cmd/kubernetes/gateway/install/install.go | 4 ---- pkg/cmd/kubernetes/gateway/install/prompt.go | 8 ++------ pkg/kubernetes/argocd/bootstrap.go | 1 - pkg/kubernetes/argocd/discover.go | 4 +--- pkg/kubernetes/argocd/eks.go | 3 --- pkg/kubernetes/cluster.go | 4 ---- 9 files changed, 3 insertions(+), 27 deletions(-) diff --git a/pkg/apiclient/remember_space_test.go b/pkg/apiclient/remember_space_test.go index f8014cac..6f700be9 100644 --- a/pkg/apiclient/remember_space_test.go +++ b/pkg/apiclient/remember_space_test.go @@ -19,7 +19,6 @@ func newSpace(id, name string) *spaces.Space { return space } -// rememberingFactory records whatever space the factory decides to save. func rememberingFactory(t *testing.T, api *testutil.MockHttpServer, asker *testutil.AskMocker, saved *string) apiclient.ClientFactory { t.Helper() diff --git a/pkg/argocdgateways/argocdgateways.go b/pkg/argocdgateways/argocdgateways.go index 18f2e387..435089ba 100644 --- a/pkg/argocdgateways/argocdgateways.go +++ b/pkg/argocdgateways/argocdgateways.go @@ -15,7 +15,6 @@ import ( const template = "/api/{spaceId}/argocdgateways" -// RegisterCommand asks Octopus to register a gateway. type RegisterCommand struct { SpaceID string `json:"SpaceId"` Name string `json:"Name"` diff --git a/pkg/cmd/kubernetes/gateway/install/commit.go b/pkg/cmd/kubernetes/gateway/install/commit.go index b5f29787..d214213e 100644 --- a/pkg/cmd/kubernetes/gateway/install/commit.go +++ b/pkg/cmd/kubernetes/gateway/install/commit.go @@ -456,16 +456,12 @@ func (opts *InstallOptions) reportSuccess(release helm.Release) { fmt.Fprintf(opts.Out, "\nAutomation Command: %s\n", autoCmd) } -// ErrForTest is a sentinel used by tests to check error propagation. var ErrForTest = errors.New("install failed") -// RegistrationSecretForTest renders the credential file written for the chart. func (opts *InstallOptions) RegistrationSecretForTest() (string, error) { return opts.registrationSecretContents() } -// RegisterForTest exposes the registration step. func (opts *InstallOptions) RegisterForTest() error { return opts.register() } -// DeregisterForTest exposes the rollback step. func (opts *InstallOptions) DeregisterForTest(cause error) error { return opts.deregister(cause) } diff --git a/pkg/cmd/kubernetes/gateway/install/install.go b/pkg/cmd/kubernetes/gateway/install/install.go index 5438db65..657c42a8 100644 --- a/pkg/cmd/kubernetes/gateway/install/install.go +++ b/pkg/cmd/kubernetes/gateway/install/install.go @@ -488,7 +488,6 @@ func (opts *InstallOptions) selectInstanceByFlag() (argocd.Instance, error) { return opts.Instances[0], nil } -// applyInstanceDefaults fills in whatever the user did not override. func (opts *InstallOptions) applyInstanceDefaults() { opts.ArgoCDNamespace.Value = opts.Instance.Namespace if opts.ArgoCDServerGRPCURL.Value == "" { @@ -505,7 +504,6 @@ func (opts *InstallOptions) applyInstanceDefaults() { } } -// resolveNames works the namespace and release name out from the display name. func (opts *InstallOptions) resolveNames() error { if opts.Namespace.Value != "" { opts.TargetNamespace = opts.Namespace.Value @@ -593,8 +591,6 @@ func looksLikeToken(value string) bool { return strings.Count(value, ".") == 2 } -// addProjectToken records a token, working out which project it belongs to from -// the token itself. func (opts *InstallOptions) addProjectToken(token string) error { claims, err := argocd.ParseProjectToken(token) if err != nil { diff --git a/pkg/cmd/kubernetes/gateway/install/prompt.go b/pkg/cmd/kubernetes/gateway/install/prompt.go index 12f22969..76649594 100644 --- a/pkg/cmd/kubernetes/gateway/install/prompt.go +++ b/pkg/cmd/kubernetes/gateway/install/prompt.go @@ -110,8 +110,6 @@ func promptForInstance(opts *InstallOptions) error { return nil } -// tlsDescription is shown rather than decided silently: getting these wrong is -// a documented cause of a gateway that installs but never connects. // promptForManagedEndpoint asks for the address of an Argo CD that is not // running in this cluster, which is how the EKS capability for Argo CD works. func promptForManagedEndpoint(opts *InstallOptions) error { @@ -134,6 +132,8 @@ func promptForManagedEndpoint(opts *InstallOptions) error { return nil } +// tlsDescription is shown rather than decided silently: getting these wrong is +// a documented cause of a gateway that installs but never connects. func tlsDescription(instance argocd.Instance) string { switch { case instance.Plaintext: @@ -276,8 +276,6 @@ func promptForProjectTokens(opts *InstallOptions) error { return nil } -// promptForProjectToken links straight at the role that needs the token, then -// takes it. func promptForProjectToken(opts *InstallOptions, project string) error { role := opts.accountName() @@ -421,8 +419,6 @@ func printProjectTokenPreamble(opts *InstallOptions) { "tokens at 12 hours.\n") } -// PromptForProjectTokenForTest exposes the per-project prompt so its output can -// be asserted on. func PromptForProjectTokenForTest(opts *InstallOptions, project string) error { return promptForProjectToken(opts, project) } diff --git a/pkg/kubernetes/argocd/bootstrap.go b/pkg/kubernetes/argocd/bootstrap.go index 3e193c9a..1e4debe7 100644 --- a/pkg/kubernetes/argocd/bootstrap.go +++ b/pkg/kubernetes/argocd/bootstrap.go @@ -141,7 +141,6 @@ func BeginBootstrapLogin(ctx context.Context, c *octoK8s.Cluster, instance Insta mtimeKey: time.Now().UTC().Format(time.RFC3339), }, nil) if err != nil { - // Leave nothing behind on the way out. _ = bootstrap.Revert(ctx) return nil, err } diff --git a/pkg/kubernetes/argocd/discover.go b/pkg/kubernetes/argocd/discover.go index 7713a850..28be921f 100644 --- a/pkg/kubernetes/argocd/discover.go +++ b/pkg/kubernetes/argocd/discover.go @@ -39,7 +39,6 @@ const ( capabilityLogin = "login" ) -// Kind changes almost every connection setting the gateway needs. // OperatorInstance is the ArgoCD custom resource an operator manages an // installation from, as used by the Argo CD operator and OpenShift GitOps. type OperatorInstance struct { @@ -47,6 +46,7 @@ type OperatorInstance struct { Resource schema.GroupVersionResource } +// Kind changes almost every connection setting the gateway needs. type Kind string const ( @@ -193,8 +193,6 @@ func DiscoverInNamespace(ctx context.Context, c *octoK8s.Cluster, namespace stri "so it cannot be used with an Argo CD running in core mode", namespace) } -// findServerDeployments works through the selectors, then falls back to the -// namespaces holding an Argo CD ConfigMap. func findServerDeployments(ctx context.Context, c *octoK8s.Cluster) ([]appsv1.Deployment, error) { seen := map[string]bool{} var found []appsv1.Deployment diff --git a/pkg/kubernetes/argocd/eks.go b/pkg/kubernetes/argocd/eks.go index df221289..d247e6d5 100644 --- a/pkg/kubernetes/argocd/eks.go +++ b/pkg/kubernetes/argocd/eks.go @@ -221,8 +221,6 @@ func firstNonEmpty(values ...string) string { return "" } -// ProjectTokenClaims are the parts of an Argo CD project role token Octopus -// needs to know. type ProjectTokenClaims struct { Project string Role string @@ -230,7 +228,6 @@ type ProjectTokenClaims struct { Expires time.Time } -// Expired reports whether the token has already lapsed. func (c ProjectTokenClaims) Expired() bool { return !c.Expires.IsZero() && c.Expires.Before(time.Now()) } diff --git a/pkg/kubernetes/cluster.go b/pkg/kubernetes/cluster.go index 93e45d79..89dcfca0 100644 --- a/pkg/kubernetes/cluster.go +++ b/pkg/kubernetes/cluster.go @@ -54,8 +54,6 @@ func connectWithConfig(kubeConfig *KubeConfig, contextName string, restConfig *r return &Cluster{Clientset: clientset, Dynamic: dynamicClient, ContextName: resolved, Server: restConfig.Host}, nil } -// NewClusterForTesting lets discovery be exercised against -// k8s.io/client-go/kubernetes/fake. func NewClusterForTesting(clientset kubernetes.Interface, contextName, server string) *Cluster { return &Cluster{Clientset: clientset, ContextName: contextName, Server: server} } @@ -150,7 +148,6 @@ func (p Permission) String() string { return fmt.Sprintf("%s %s", p.Verb, p.Resource) } -// InstallPermissions are the accesses a chart install needs. func InstallPermissions(namespace string) []Permission { return []Permission{ {Verb: "create", Resource: "namespaces", Description: "create the install namespace"}, @@ -285,7 +282,6 @@ func (c *Cluster) SecretKey(ctx context.Context, namespace, name, key string) (s return string(value), true, nil } -// FindDeployment returns the single deployment matching a label selector. func (c *Cluster) FindDeployment(ctx context.Context, namespace, selector string) (*appsv1.Deployment, bool, error) { list, err := c.Clientset.AppsV1().Deployments(namespace). List(ctx, metav1.ListOptions{LabelSelector: selector}) From 1e6125ad016eac3c8d8c805142b3fecdca4ef6fd Mon Sep 17 00:00:00 2001 From: Liam Mackie Date: Tue, 1 Sep 2026 09:57:09 +1000 Subject: [PATCH 4/7] things --- README.md | 1 + examples.md | 194 ++++ pkg/accesstokens/accesstokens.go | 75 ++ pkg/accesstokens/accesstokens_test.go | 54 ++ pkg/cmd/kubernetes/agent/agent.go | 25 + pkg/cmd/kubernetes/agent/install/commit.go | 392 ++++++++ pkg/cmd/kubernetes/agent/install/install.go | 777 ++++++++++++++++ .../kubernetes/agent/install/install_test.go | 878 ++++++++++++++++++ pkg/cmd/kubernetes/agent/install/prompt.go | 321 +++++++ pkg/cmd/kubernetes/agent/install/review.go | 352 +++++++ .../kubernetes/agent/install/review_test.go | 249 +++++ pkg/cmd/kubernetes/gateway/install/commit.go | 159 +--- pkg/cmd/kubernetes/gateway/install/install.go | 159 +--- pkg/cmd/kubernetes/gateway/install/review.go | 321 ++----- pkg/cmd/kubernetes/install/install.go | 23 + pkg/cmd/kubernetes/kubernetes.go | 6 + .../permissionscontroller/install/commit.go | 290 ++++++ .../permissionscontroller/install/install.go | 313 +++++++ .../install/install_test.go | 486 ++++++++++ .../permissionscontroller/install/prompt.go | 141 +++ .../permissionscontroller/install/review.go | 186 ++++ .../install/review_test.go | 162 ++++ .../permissionscontroller.go | 26 + pkg/cmd/kubernetes/shared/cluster.go | 198 ++++ pkg/cmd/kubernetes/shared/preflight.go | 150 +++ pkg/cmd/kubernetes/shared/review.go | 185 ++++ pkg/cmd/kubernetes/worker/worker.go | 28 + pkg/cmd/target/shared/role.go | 44 +- pkg/cmd/target/shared/tenant.go | 5 + pkg/kubernetes/agent/agent.go | 183 ++++ pkg/kubernetes/agent/agent_internal_test.go | 58 ++ pkg/kubernetes/agent/agent_test.go | 219 +++++ pkg/kubernetes/cluster.go | 270 ++++++ pkg/kubernetes/octopus.go | 34 + pkg/kubernetes/octopus_test.go | 21 + pkg/question/helpers_test.go | 1 - pkg/question/select.go | 7 +- pkg/surveyext/multiselectwithadd.go | 37 +- pkg/surveyext/select.go | 1 + test/testutil/fakesurvey.go | 17 +- 40 files changed, 6535 insertions(+), 513 deletions(-) create mode 100644 pkg/accesstokens/accesstokens.go create mode 100644 pkg/accesstokens/accesstokens_test.go create mode 100644 pkg/cmd/kubernetes/agent/agent.go create mode 100644 pkg/cmd/kubernetes/agent/install/commit.go create mode 100644 pkg/cmd/kubernetes/agent/install/install.go create mode 100644 pkg/cmd/kubernetes/agent/install/install_test.go create mode 100644 pkg/cmd/kubernetes/agent/install/prompt.go create mode 100644 pkg/cmd/kubernetes/agent/install/review.go create mode 100644 pkg/cmd/kubernetes/agent/install/review_test.go create mode 100644 pkg/cmd/kubernetes/permissionscontroller/install/commit.go create mode 100644 pkg/cmd/kubernetes/permissionscontroller/install/install.go create mode 100644 pkg/cmd/kubernetes/permissionscontroller/install/install_test.go create mode 100644 pkg/cmd/kubernetes/permissionscontroller/install/prompt.go create mode 100644 pkg/cmd/kubernetes/permissionscontroller/install/review.go create mode 100644 pkg/cmd/kubernetes/permissionscontroller/install/review_test.go create mode 100644 pkg/cmd/kubernetes/permissionscontroller/permissionscontroller.go create mode 100644 pkg/cmd/kubernetes/shared/cluster.go create mode 100644 pkg/cmd/kubernetes/shared/preflight.go create mode 100644 pkg/cmd/kubernetes/shared/review.go create mode 100644 pkg/cmd/kubernetes/worker/worker.go create mode 100644 pkg/kubernetes/agent/agent.go create mode 100644 pkg/kubernetes/agent/agent_internal_test.go create mode 100644 pkg/kubernetes/agent/agent_test.go diff --git a/README.md b/README.md index 03932a9a..37065c74 100644 --- a/README.md +++ b/README.md @@ -276,6 +276,7 @@ cmd/ octopus/ # Contains the octopus binary pkg/ + accesstokens/ # mints short-lived Octopus credentials for a component that registers itself from a cluster apiclient/ # Utility code used to manage authentication/connection to the octopus server cmd/ # contains sub-packages for each cobra command account/ # contains commands related to accounts diff --git a/examples.md b/examples.md index c0ec7f35..eadcfbf5 100644 --- a/examples.md +++ b/examples.md @@ -188,6 +188,17 @@ octopus project variables update BlueGreenTarget --project "Random Quotes" --id octopus release create --version 1.0.1 --project "Random Quotes" --no-prompt ``` +# Install an Octopus component into a Kubernetes cluster + +``` +octopus kubernetes install +``` + +Asks which component you want and then runs its installer: the Kubernetes agent as a deployment +target, the Kubernetes agent as a worker, the Argo CD gateway, or the Octopus permissions +controller. Each of those has its own command as well, which is what to use in a script, and +the wizard names them all if you run it with `--no-prompt`. + # Install the Octopus Argo CD gateway The gateway connects an Argo CD instance to Octopus. Run it with no arguments and the CLI reads @@ -280,3 +291,186 @@ octopus kubernetes gateway install \ Use the project name `octo-gateway-unscoped` for a token to fall back on for Argo CD calls that are not project-scoped. If your Argo CD API is not served at the root, add `--argocd-grpc-web-root-path /argo/api`. + +# Install the Kubernetes agent as a deployment target + +The agent runs Kubernetes steps from inside the cluster, so Octopus does not need cluster +credentials and the cluster does not need to be reachable from outside. Run it with no +arguments and the CLI works out what it can before asking anything: + +``` +octopus kubernetes agent install +``` + +It reads the cluster's node architectures (the agent runs on linux/amd64 and linux/arm64 only), +its storage classes, the Kubernetes agents already installed, and whether the Octopus +permissions controller is present. It also checks whether Octopus already has a deployment +target of that name, because the agent registers by name and would take that one over. The +install namespace is the name you give it prefixed with `octopus-agent-`, and the Helm release +takes the name itself. + +The agent polls Octopus for work over TCP, on port 10943 by default for a self-hosted server, +and on its own hostname for Octopus Cloud (`https://polling.your-instance.octopus.app`). The +CLI derives that address from the server you are logged in to and asks you to confirm it, then +runs a connectivity check from inside the cluster before installing. SSL offloading is not +supported on that connection, so the address has to reach Octopus intact. + +# Install the Kubernetes agent unattended + +``` +octopus kubernetes agent install \ + --name production \ + --environment Production \ + --role k8s \ + --accept-eula \ + --no-prompt +``` + +With prompting disabled the CLI needs `--name`, at least one `--environment`, at least one +target tag, and `--accept-eula`, which accepts the +[Octopus Customer Agreement](https://octopus.com/company/legal). The chart will not install +without it. Add `--default-namespace` or `--machine-policy` to fill in the rest of +the registration. + +The CLI does not ask about tenanted deployments, and neither does the Octopus portal's own +agent wizard: an agent registers as untenanted, and you attach tenants afterwards from the +target's settings in Octopus. `--tenanted-mode`, `--tenant` and `--tenant-tag` set them at +registration time where you would rather script it. + +Target tags come from `--role`, which takes a plain tag name, or `--tag`, which takes the +canonical `TagSetName/TagName` form and is checked against the space's target tag sets. Either +can be repeated. Interactively the CLI asks once for target tags, offering every tag in the +space rather than one question per tag set, and you can type a tag that does not exist yet: +Octopus creates a target tag as soon as an agent registers with it, and the review screen says +which of the tags you picked are new. + +The agent registers itself with Octopus from a pre-install pod, so an Octopus credential has to +reach the cluster. The CLI mints a short-lived access token for the signed-in user, good for +about an hour, writes it to a Kubernetes Secret named `octopus-agent-registration-token`, and +points the chart at that Secret. No long-lived API key of yours is left in the cluster, and the +token stays out of the Helm release values and out of any file written by `-o`. Pass +`--inline-secrets` if you would rather have it in the values. + +# Install the Kubernetes agent as a worker + +The same agent, registered as a worker rather than a deployment target, so it runs Octopus +steps in the cluster, one pod per task, and releases the compute again when each task finishes: + +``` +octopus kubernetes worker install \ + --name cluster-worker \ + --worker-pool "Kubernetes Pool" \ + --accept-eula \ + --no-prompt +``` + +`--worker-pool` takes the place of the deployment target's `--environment` and `--role`, and +can be repeated. One agent is either a deployment target or a worker, never both, and both +modes derive their namespace from the same `octopus-agent-` prefix, so an agent and a worker of +the same name land on the same release in the same namespace. Give them different names. +Interactively, the CLI tells you when the release it would install into is already the other +kind. + +# Choose where the agent's storage comes from + +``` +octopus kubernetes agent install \ + --name production \ + --environment Production \ + --role k8s \ + --storage-class azurefile-csi \ + --accept-eula \ + --no-prompt +``` + +With no `--storage-class` the volume comes from the cluster's default storage class. That is +the only storage question the CLI asks, and interactively it lists the classes the cluster has. +Azure Files serves a shared filesystem, so the install above needs nothing else said about it. + +The access mode follows from the class rather than being a separate decision. A class backed by +a shared filesystem, such as Amazon EFS, Google Filestore or Azure Files, gets a ReadWriteMany +volume, so script pods can run on any node. Anything else gets ReadWriteOnce, which schedules +every script pod on the agent's own node. The review screen names the provisioner it read that +from. + +`--read-write-many` overrides that. It warns when the class is not one the CLI recognises as a +shared filesystem, because if the class cannot serve one, the volume never binds and the agent +stays pending. + +# Install the Octopus permissions controller + +The controller decides which service account a Kubernetes agent's script pods run as, matching +each deployment against the `WorkloadServiceAccount` resources in the namespace it deploys to: + +``` +octopus kubernetes permissions-controller install +``` + +It runs entirely inside the cluster and never contacts Octopus, so this command works whether +or not you are logged in. One controller serves the whole cluster: it installs into +`octopus-permissions-controller-system` as the release `octopus-permissions-controller`, and +running the command again upgrades whatever is already there. It needs cert-manager for its +mutating admission webhook's certificate, so pass `--cert-manager=false` if you supply that +yourself, and Kubernetes agent v2.28.1 or newer to have any effect. `opc` is an alias for +`permissions-controller`. + +Installing it adds the `WorkloadServiceAccount` and `ClusterWorkloadServiceAccount` custom +resource definitions (`agent.octopus.com/v1beta1`). A `WorkloadServiceAccount` lives in the +namespace you deploy to; use the cluster-scoped one where the permissions a deployment needs are +not namespaced. + +By default the controller manages permissions in every namespace. `--target-namespace` narrows +that to the ones you name and can be repeated, and `--target-namespace-regex` matches namespace +names, which also covers namespaces that do not exist yet. `--namespaced-rbac` gives the +controller permissions in its own namespace only, rather than across the cluster. + +# Lock down what an agent's script pods can do + +``` +octopus kubernetes agent install \ + --name production \ + --environment Production \ + --role k8s \ + --restrict-script-pod-permissions \ + --accept-eula \ + --no-prompt +``` + +Script pod permissions are the fallback. Where a `WorkloadServiceAccount` matches the space, +project, environment or tenant a deployment is for, the permissions controller grants that +instead and the fallback is never used. Left alone, the chart gives script pods the run of the +cluster, which is why the controller is worth pairing with a narrower default. + +There are three answers, and the CLI asks the question only when it finds the controller in the +cluster, defaulting to granting nothing. `--restrict-script-pod-permissions` is that answer: +it sets `scriptPods.serviceAccount.clusterRole.enabled=false`, so a workload no +`WorkloadServiceAccount` matches fails rather than running with more access than it should +have. Passing neither flag keeps the chart's default of the whole cluster. + +`--script-pod-role` is the middle ground. It copies the rules of a role that already exists, +so `--script-pod-role edit` gives script pods what Kubernetes' built-in `edit` role grants. +Name a cluster role on its own, or a role in a namespace as `namespace/name`, and repeat the +flag to combine several: RBAC is additive, so the rules are gathered into one list with the +duplicates dropped. Interactively the CLI lists both kinds together for you to filter and pick +from, leaving out the seventy or so `system:` roles Kubernetes ships and the control plane's +own, and saying which of them grant the whole cluster so copying one does not look like a +restriction. The rules are copied at install time and not followed afterwards, so changing a +role later means upgrading the agent. + +The pairing works in the other direction too. After installing the controller, the CLI prints a +`WorkloadServiceAccount` to start from and a `helm upgrade` command for each agent in the +cluster whose script pods still hold those cluster-wide defaults. It prints those commands +rather than running them, because they change releases it does not own. + +# Preview a Kubernetes agent install without changing anything + +``` +octopus kubernetes agent install --name production --environment Production --role k8s --dry-run +``` + +`--dry-run` renders the manifests Helm would apply without installing them, skips the checks +that need to run a pod in the cluster, and creates no Octopus access token. Add +`-o values.yaml` to also write out the resolved Helm values. + +A dry run does not need `--accept-eula`, but without it the rendered values decline the Octopus +Customer Agreement, and the CLI says so. Add the flag to render values that can be installed. diff --git a/pkg/accesstokens/accesstokens.go b/pkg/accesstokens/accesstokens.go new file mode 100644 index 00000000..c82cce9e --- /dev/null +++ b/pkg/accesstokens/accesstokens.go @@ -0,0 +1,75 @@ +// Package accesstokens mints short-lived Octopus credentials for a component +// that has to register itself with Octopus from inside a cluster. +// +// The Kubernetes agent registers itself, which means an Octopus credential has +// to reach the cluster. An access token is the least dangerous one available: +// it lasts about an hour, which is long enough to register and too short to be +// worth stealing, so no long-lived credential of the user's is left behind. +package accesstokens + +import ( + "encoding/base64" + "encoding/json" + "errors" + "fmt" + "strings" + "time" + + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/newclient" +) + +const path = "/api/users/access-token" + +// Token is a bearer token for the signed-in user. +type Token struct { + Value string + // Expires is zero when the token does not say when it expires. + Expires time.Time +} + +// Describe reports how long the token is good for, for a review screen that +// must not show the token itself. +func (t Token) Describe() string { + if t.Expires.IsZero() { + return "short-lived access token for your Octopus user" + } + return fmt.Sprintf("access token for your Octopus user, expires %s", t.Expires.Local().Format("15:04")) +} + +// Generate asks Octopus for an access token for the signed-in user. +func Generate(client newclient.Client) (Token, error) { + response, err := newclient.Post[struct { + AccessToken string `json:"AccessToken"` + }](client.HttpSession(), path, struct{}{}) + if err != nil { + return Token{}, fmt.Errorf("could not get an access token from Octopus: %w", err) + } + if response.AccessToken == "" { + return Token{}, errors.New("Octopus returned an empty access token") + } + + return Token{Value: response.AccessToken, Expires: expiry(response.AccessToken)}, nil +} + +// expiry reads the exp claim without verifying the token, which only Octopus +// can do. A token that cannot be read is still usable, so this reports no +// expiry rather than an error. +func expiry(token string) time.Time { + parts := strings.Split(strings.TrimSpace(token), ".") + if len(parts) != 3 { + return time.Time{} + } + + payload, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(parts[1], "=")) + if err != nil { + return time.Time{} + } + + var claims struct { + Expires int64 `json:"exp"` + } + if err := json.Unmarshal(payload, &claims); err != nil || claims.Expires <= 0 { + return time.Time{} + } + return time.Unix(claims.Expires, 0) +} diff --git a/pkg/accesstokens/accesstokens_test.go b/pkg/accesstokens/accesstokens_test.go new file mode 100644 index 00000000..08b00247 --- /dev/null +++ b/pkg/accesstokens/accesstokens_test.go @@ -0,0 +1,54 @@ +package accesstokens + +import ( + "encoding/base64" + "encoding/json" + "testing" + "time" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func TestExpiry_ReadsTheExpClaim(t *testing.T) { + expires := time.Now().Add(time.Hour).Truncate(time.Second) + + assert.Equal(t, expires, expiry(jwtWith(t, map[string]any{"exp": expires.Unix()}))) +} + +// A token that cannot be read is still a usable token, so an unreadable one +// reports no expiry rather than an error. +func TestExpiry_UnreadableTokensReportNothing(t *testing.T) { + for name, token := range map[string]string{ + "not a JWT": "API-XXXXXXXX", + "no payload": "a.b", + "payload is not base64": "a.!!!.c", + "payload is not JSON": "a." + base64.RawURLEncoding.EncodeToString([]byte("nonsense")) + ".c", + "no exp claim": jwtWith(t, map[string]any{"sub": "users-1"}), + "an exp of zero": jwtWith(t, map[string]any{"exp": 0}), + } { + t.Run(name, func(t *testing.T) { + assert.True(t, expiry(token).IsZero()) + }) + } +} + +func TestDescribe_NeverIncludesTheToken(t *testing.T) { + expires := time.Unix(1750000000, 0) + + described := Token{Value: "eyJhbGciOiJIUzI1NiJ9.secret", Expires: expires}.Describe() + assert.NotContains(t, described, "secret") + assert.Contains(t, described, expires.Local().Format("15:04")) + + assert.Equal(t, "short-lived access token for your Octopus user", Token{Value: "x"}.Describe()) +} + +func jwtWith(t *testing.T, claims map[string]any) string { + t.Helper() + + payload, err := json.Marshal(claims) + require.NoError(t, err) + + encode := base64.RawURLEncoding.EncodeToString + return encode([]byte(`{"alg":"HS256"}`)) + "." + encode(payload) + ".signature" +} diff --git a/pkg/cmd/kubernetes/agent/agent.go b/pkg/cmd/kubernetes/agent/agent.go new file mode 100644 index 00000000..dd0a7259 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/agent.go @@ -0,0 +1,25 @@ +package agent + +import ( + "github.com/MakeNowJust/heredoc/v2" + cmdInstall "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/agent/install" + "github.com/OctopusDeploy/cli/pkg/constants" + "github.com/OctopusDeploy/cli/pkg/factory" + "github.com/spf13/cobra" +) + +func NewCmdAgent(f factory.Factory) *cobra.Command { + cmd := &cobra.Command{ + Use: "agent ", + Short: "Manage the Octopus Kubernetes agent", + Long: heredoc.Doc(` + Manage the Octopus Kubernetes agent, which runs Kubernetes deployments from inside + the cluster they target. + `), + Example: heredoc.Docf("$ %s kubernetes agent install", constants.ExecutableName), + } + + cmd.AddCommand(cmdInstall.NewCmdInstall(f)) + + return cmd +} diff --git a/pkg/cmd/kubernetes/agent/install/commit.go b/pkg/cmd/kubernetes/agent/install/commit.go new file mode 100644 index 00000000..222b6915 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/commit.go @@ -0,0 +1,392 @@ +package install + +import ( + "context" + "errors" + "fmt" + "os" + "time" + + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" + sharedTarget "github.com/OctopusDeploy/cli/pkg/cmd/target/shared" + "github.com/OctopusDeploy/cli/pkg/constants" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/util/flag" + "sigs.k8s.io/yaml" +) + +func (opts *InstallOptions) Commit(ctx context.Context) error { + timeout, err := opts.ResolveTimeout() + if err != nil { + return err + } + + if err := shared.CheckPermissions(ctx, opts.Dependencies, opts.Cluster, opts.TargetNamespace, opts.DryRun.Value); err != nil { + return err + } + + if opts.DryRun.Value { + return opts.renderOnly(ctx, timeout) + } + + if err := shared.EnsureNamespace(ctx, opts.Dependencies, opts.Cluster, opts.TargetNamespace); err != nil { + return err + } + + if err := opts.preflight().Run(ctx); err != nil { + return err + } + + // Asked before the chart runs, so a registration that appears afterwards can + // be told apart from one that was always there. + _, _ = opts.alreadyRegistered() + + if err := opts.authenticate(ctx); err != nil { + return err + } + + values, err := opts.BuildValues() + if err != nil { + return err + } + if err := opts.writeValuesFile(values); err != nil { + return err + } + + fmt.Fprintf(opts.Out, "\nInstalling the Octopus %s into %s...\n", opts.installedThing(), output.Cyan(opts.TargetNamespace)) + if opts.Wait.Value || opts.Atomic.Value { + // The chart registers the agent from a pod before the agent itself + // starts, so there is a long quiet stretch here. Say so rather than + // look stalled. + fmt.Fprintf(opts.Out, " %s\n", output.Dimf( + "Waiting for it to register with Octopus and become ready. This can take a few minutes, and gives up after %s.", timeout)) + } + + release, err := opts.Runner.Install(ctx, helm.InstallSpec{ + Chart: opts.chartRef(), + ReleaseName: opts.TargetRelease, + Namespace: opts.TargetNamespace, + Values: values, + Atomic: opts.Atomic.Value, + Wait: opts.Wait.Value, + Timeout: timeout, + }) + if err != nil { + return opts.reportFailure(err) + } + + opts.reportSuccess(release) + return nil +} + +// authenticate gets the credential the chart registers the agent with. An +// access token is used rather than an API key because it expires within the +// hour, so nothing worth stealing is left in the cluster afterwards. +func (opts *InstallOptions) authenticate(ctx context.Context) error { + if opts.AccessTokenCallback == nil { + return errors.New("no way to get an Octopus access token was configured") + } + + token, err := opts.AccessTokenCallback() + if err != nil { + return err + } + opts.Token = token + + if opts.InlineSecrets.Value { + return nil + } + return opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, tokenSecretName, + map[string]string{tokenSecretKey: token.Value}) +} + +// BuildValues passes the credential by Secret reference unless +// --inline-secrets was given, so it stays out of the release values and out of +// any file written by --output-values. +func (opts *InstallOptions) BuildValues() (map[string]any, error) { + if opts.ServerCommsAddress.Value == "" { + return nil, errors.New("the Octopus polling address could not be determined; specify --" + FlagServerCommsAddress) + } + + agentValues := map[string]any{ + "name": opts.Name.Value, + "acceptEula": eulaValue(opts.AcceptEula.Value), + "serverUrl": opts.Host, + "serverCommsAddress": opts.ServerCommsAddress.Value, + "space": opts.spaceName(), + } + + if opts.MachinePolicy.Value != "" { + agentValues["machinePolicyName"] = opts.MachinePolicy.Value + } + if opts.ServerCertificate.Value != "" { + agentValues["serverCertificate"] = opts.ServerCertificate.Value + } + + // A dry run never asks Octopus for a token, so there is nothing to inline + // and the Secret reference is what the real install would use anyway. + if opts.InlineSecrets.Value && opts.Token.Value != "" { + agentValues["bearerToken"] = opts.Token.Value + } else { + agentValues["bearerTokenSecretName"] = tokenSecretName + } + + registration, err := opts.registrationValues() + if err != nil { + return nil, err + } + for key, value := range registration { + agentValues[key] = value + } + + values := map[string]any{"agent": agentValues} + + if persistence := opts.persistenceValues(); len(persistence) > 0 { + values["persistence"] = persistence + } + if scriptPods := opts.scriptPodValues(); len(scriptPods) > 0 { + values["scriptPods"] = scriptPods + } + + return values, nil +} + +// TargetTags is the one list of tags the agent registers with. Octopus builds it +// from plain role names and from tag set entries, which are given in canonical +// TagSetName/TagName form and sent as the tag name alone. +func (opts *InstallOptions) TargetTags() ([]string, error) { + return sharedTarget.CombineRolesAndTags(opts.Client, opts.Roles.Value, opts.Tags.Value) +} + +// scriptPodValues decides what a deployment can do when no +// WorkloadServiceAccount matches it. Left out entirely, the chart grants script +// pods the whole cluster. +func (opts *InstallOptions) scriptPodValues() map[string]any { + clusterRole := map[string]any{} + switch { + case opts.RestrictScriptPods.Value: + // No ClusterRole at all is what makes an unmatched deployment fail + // rather than run with more access than it should have. + clusterRole["enabled"] = false + case len(opts.ScriptPodRules) > 0: + clusterRole["rules"] = opts.ScriptPodRules + default: + return nil + } + + return map[string]any{"serviceAccount": map[string]any{"clusterRole": clusterRole}} +} + +// registrationValues fills in one half of the chart: an agent registers as a +// deployment target or as a worker, never both. +func (opts *InstallOptions) registrationValues() (map[string]any, error) { + if opts.isWorker() { + return map[string]any{ + "worker": map[string]any{ + "enabled": true, + "initial": map[string]any{"workerPools": opts.WorkerPools.Value}, + }, + }, nil + } + + tags, err := opts.TargetTags() + if err != nil { + return nil, err + } + + initial := map[string]any{ + "environments": opts.Environments.Value, + "tags": tags, + "tenantedDeploymentParticipation": opts.tenantedParticipation(), + } + if opts.DefaultNamespace.Value != "" { + initial["defaultNamespace"] = opts.DefaultNamespace.Value + } + if len(opts.Tenants.Value) > 0 { + initial["tenants"] = opts.Tenants.Value + } + if len(opts.TenantTags.Value) > 0 { + initial["tenantTags"] = opts.TenantTags.Value + } + + return map[string]any{ + "deploymentTarget": map[string]any{"enabled": true, "initial": initial}, + }, nil +} + +func (opts *InstallOptions) tenantedParticipation() string { + if opts.TenantedDeploymentMode.Value == "" { + return sharedTarget.Untenanted + } + return opts.TenantedDeploymentMode.Value +} + +// persistenceValues is left out entirely unless something was chosen, so the +// chart's own defaults apply: the cluster's default storage class, mounted +// ReadWriteOnce. +func (opts *InstallOptions) persistenceValues() map[string]any { + persistence := map[string]any{} + if opts.StorageClass.Value != "" { + persistence["storageClassName"] = opts.StorageClass.Value + } + if opts.ReadWriteMany.Value { + persistence["accessModes"] = []string{"ReadWriteMany"} + } + return persistence +} + +func eulaValue(accepted bool) string { + if accepted { + return "Y" + } + return "N" +} + +func (opts *InstallOptions) preflight() *shared.Preflight { + return &shared.Preflight{ + Dependencies: opts.Dependencies, + CommonFlags: opts.CommonFlags, + Cluster: opts.Cluster, + Namespace: opts.TargetNamespace, + Targets: []octoK8s.Target{ + { + Name: "Octopus REST API", + Address: opts.Host, + Remediation: "The chart registers the agent with Octopus over the REST API, from a pod in the cluster. " + + "Confirm this address is reachable from inside the cluster.", + }, + { + Name: "Octopus polling endpoint", + Address: opts.ServerCommsAddress.Value, + Remediation: fmt.Sprintf("The running agent polls Octopus over TCP on this address, on port %d by default and separately from the REST API. "+ + "A firewall or proxy that only allows HTTPS is the usual cause. The connection also has to reach Octopus intact, so SSL offloading will not work.", + octoK8s.DefaultPollingPort), + }, + }, + ProceedHelp: "The agent is likely to install and then fail to register.", + } +} + +func (opts *InstallOptions) writeValuesFile(values map[string]any) error { + if opts.OutputValues.Value == "" { + return nil + } + + encoded, err := yaml.Marshal(values) + if err != nil { + return fmt.Errorf("could not encode the Helm values: %w", err) + } + if err := os.WriteFile(opts.OutputValues.Value, encoded, 0o600); err != nil { + return fmt.Errorf("could not write %s: %w", opts.OutputValues.Value, err) + } + + fmt.Fprintf(opts.Out, "Wrote Helm values to %s\n", output.Cyan(opts.OutputValues.Value)) + if opts.InlineSecrets.Value && opts.Token.Value != "" { + fmt.Fprintf(opts.Out, "%s This file contains an Octopus access token in plain text.\n", output.Yellow("!")) + } + return nil +} + +func (opts *InstallOptions) renderOnly(ctx context.Context, timeout time.Duration) error { + fmt.Fprintf(opts.Out, "\n%s Rendering only. Nothing will be installed, no Octopus access token is created, and the connectivity checks that need a pod in the cluster are skipped.\n", + output.Dim("--"+octoK8s.FlagDryRun)) + + // The rendered manifests carry acceptEula, and an agent given "N" starts and + // then refuses to run, so values taken from here would not work as they are. + if !opts.AcceptEula.Value { + fmt.Fprintf(opts.Out, "%s These values decline the Octopus Customer Agreement. Add --%s to render values that can be installed.\n", + output.Yellow("!"), FlagAcceptEula) + } + + values, err := opts.BuildValues() + if err != nil { + return err + } + if err := opts.writeValuesFile(values); err != nil { + return err + } + + // Report only: there is no install to abandon. + opts.preflight().ReportStatic() + + manifest, err := opts.Runner.Render(ctx, helm.InstallSpec{ + Chart: opts.chartRef(), + ReleaseName: opts.TargetRelease, + Namespace: opts.TargetNamespace, + Values: values, + Timeout: timeout, + }) + if err != nil { + return err + } + + fmt.Fprintln(opts.Out, manifest) + return nil +} + +// reportFailure covers the case Helm cannot undo. The chart registers the agent +// from a pre-install hook, so a rollback leaves the registration behind, and an +// agent in Octopus that will never connect is worse than none. +func (opts *InstallOptions) reportFailure(cause error) error { + if opts.RegisteredCallback == nil || opts.registeredBefore { + return cause + } + + opts.registrationCheckedFor = "" + taken, err := opts.alreadyRegistered() + if err != nil || !taken { + return cause + } + + fmt.Fprintf(opts.Out, "\n%s The install failed after the agent had registered itself, so Octopus now has a %s named %s that will never connect.\n", + output.Yellow("!"), opts.Mode, output.Cyan(opts.Name.Value)) + fmt.Fprintf(opts.Out, " Remove it with %s before trying again.\n", output.Cyan(opts.removeCommand())) + return cause +} + +func (opts *InstallOptions) removeCommand() string { + if opts.isWorker() { + return fmt.Sprintf("%s worker delete %q", constants.ExecutableName, opts.Name.Value) + } + return fmt.Sprintf("%s deployment-target delete %q", constants.ExecutableName, opts.Name.Value) +} + +func (opts *InstallOptions) reportSuccess(release helm.Release) { + fmt.Fprintf(opts.Out, "\n%s Installed %s %s as release %s in namespace %s.\n", + output.Green("✔"), release.Chart, release.Version, + output.Cyan(release.Name), output.Cyan(release.Namespace)) + fmt.Fprintf(opts.Out, " The agent polls Octopus for work. It appears under %s once its first health check passes.\n", + opts.portalLocation()) + + if opts.NoPrompt { + return + } + + autoCmd := flag.GenerateAutomationCmd(opts.CmdPath, opts.GetSpaceNameOrEmpty(), opts.generatable()...) + fmt.Fprintf(opts.Out, "\nAutomation Command: %s\n", autoCmd) +} + +func (opts *InstallOptions) portalLocation() string { + if opts.isWorker() { + return "Infrastructure > Worker Pools" + } + return "Infrastructure > Deployment Targets" +} + +func (opts *InstallOptions) generatable() []flag.Generatable { + generatable := []flag.Generatable{opts.Name} + + if opts.isWorker() { + generatable = append(generatable, opts.WorkerPools) + } else { + generatable = append(generatable, opts.Environments, opts.Roles, opts.Tags, + opts.TenantedDeploymentMode, opts.Tenants, opts.TenantTags, opts.DefaultNamespace) + } + + generatable = append(generatable, opts.MachinePolicy, opts.ServerCommsAddress, opts.ServerCertificate, + opts.StorageClass, opts.ReadWriteMany, opts.AcceptEula, opts.InlineSecrets, + opts.RestrictScriptPods, opts.ScriptPodRoles) + return append(generatable, opts.CommonFlags.Generatable()...) +} diff --git a/pkg/cmd/kubernetes/agent/install/install.go b/pkg/cmd/kubernetes/agent/install/install.go new file mode 100644 index 00000000..41ee227f --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/install.go @@ -0,0 +1,777 @@ +package install + +import ( + "context" + "errors" + "fmt" + "strings" + + "github.com/MakeNowJust/heredoc/v2" + "github.com/OctopusDeploy/cli/pkg/accesstokens" + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" + sharedTarget "github.com/OctopusDeploy/cli/pkg/cmd/target/shared" + sharedWorker "github.com/OctopusDeploy/cli/pkg/cmd/worker/shared" + "github.com/OctopusDeploy/cli/pkg/constants" + "github.com/OctopusDeploy/cli/pkg/factory" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/machinescommon" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/util/flag" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/machines" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/workers" + "github.com/spf13/cobra" +) + +var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/kubernetes-agent"} + +const ( + FlagName = "name" + FlagServerCommsAddress = "server-comms-address" + FlagServerCertificate = "server-certificate" + FlagDefaultNamespace = "default-namespace" + FlagStorageClass = "storage-class" + FlagReadWriteMany = "read-write-many" + FlagAcceptEula = "accept-eula" + FlagInlineSecrets = "inline-secrets" + FlagRestrictScriptPods = "restrict-script-pod-permissions" + FlagScriptPodRole = "script-pod-role" +) + +// The agent registers itself, so an Octopus credential has to reach the +// cluster. Passing it by Secret reference keeps it out of the Helm release +// values, out of any file written by --output-values, and out of the process +// table. The key name is the chart's contract. +const ( + tokenSecretName = "octopus-agent-registration-token" + tokenSecretKey = "bearer-token" +) + +// eulaURL is shown rather than assumed: the chart will not install without +// acceptEula, and nobody should be accepting an agreement they were not offered. +const eulaURL = "https://octopus.com/company/legal" + +type InstallFlags struct { + Name *flag.Flag[string] + ServerCommsAddress *flag.Flag[string] + ServerCertificate *flag.Flag[string] + DefaultNamespace *flag.Flag[string] + StorageClass *flag.Flag[string] + ReadWriteMany *flag.Flag[bool] + AcceptEula *flag.Flag[bool] + InlineSecrets *flag.Flag[bool] + RestrictScriptPods *flag.Flag[bool] + ScriptPodRoles *flag.Flag[[]string] + + *sharedTarget.CreateTargetEnvironmentFlags + *sharedTarget.CreateTargetRoleFlags + *sharedTarget.CreateTargetTenantFlags + *machinescommon.CreateTargetMachinePolicyFlags + *sharedWorker.WorkerPoolFlags + *octoK8s.CommonFlags +} + +func NewInstallFlags() *InstallFlags { + return &InstallFlags{ + Name: flag.New[string](FlagName, false), + ServerCommsAddress: flag.New[string](FlagServerCommsAddress, false), + ServerCertificate: flag.New[string](FlagServerCertificate, false), + DefaultNamespace: flag.New[string](FlagDefaultNamespace, false), + StorageClass: flag.New[string](FlagStorageClass, false), + ReadWriteMany: flag.New[bool](FlagReadWriteMany, false), + AcceptEula: flag.New[bool](FlagAcceptEula, false), + InlineSecrets: flag.New[bool](FlagInlineSecrets, false), + RestrictScriptPods: flag.New[bool](FlagRestrictScriptPods, false), + ScriptPodRoles: flag.New[[]string](FlagScriptPodRole, false), + + CreateTargetEnvironmentFlags: sharedTarget.NewCreateTargetEnvironmentFlags(), + CreateTargetRoleFlags: sharedTarget.NewCreateTargetRoleFlags(), + CreateTargetTenantFlags: sharedTarget.NewCreateTargetTenantFlags(), + CreateTargetMachinePolicyFlags: machinescommon.NewCreateTargetMachinePolicyFlags(), + WorkerPoolFlags: sharedWorker.NewWorkerPoolFlags(), + CommonFlags: octoK8s.NewCommonFlags(), + } +} + +type InstallOptions struct { + *InstallFlags + *cmd.Dependencies + + // Mode decides what the agent registers as, which questions are asked, and + // which half of the chart's values are filled in. One agent is either a + // deployment target or a worker; the chart registers it one way or the other. + Mode agentK8s.Mode + + *sharedTarget.CreateTargetEnvironmentOptions + *machinescommon.CreateTargetMachinePolicyOptions + *sharedWorker.WorkerPoolOptions + + // AccessTokenCallback gets the credential the agent registers itself with. + // Injected so the flow can be tested without a server. + AccessTokenCallback func() (accesstokens.Token, error) + // RegisteredCallback reports whether Octopus already has a deployment target + // or worker of this name, which is how a clash is caught before installing + // and an orphan is caught after a failure. + RegisteredCallback func(name string) (bool, error) + // TargetTagsCallback lists the target tags the space already knows about. + TargetTagsCallback func() ([]string, error) + + // Populated by Discover before prompting. Exported so tests can drive the + // prompt flow against a fake cluster. + Cluster *octoK8s.Cluster + Runner *helm.Runner + KubeContextInfo octoK8s.Context + StorageClasses []octoK8s.StorageClass + NodeArchitectures []string + // KnownTargetTags is what the space already had, so the review can say which + // of the chosen tags are new. + KnownTargetTags []string + Installations []agentK8s.Installation + PermissionsController bool + // ScriptPodRules are the rules copied from ScriptPodRole, in the plain shape + // a Helm value has to be. + ScriptPodRules []any + + // AccessModeChosen records that --read-write-many was given explicitly, so + // the storage class does not get to decide. + AccessModeChosen bool + + TargetNamespace string + TargetRelease string + Token accesstokens.Token + + // registeredBefore is the answer to RegisteredCallback for + // registrationCheckedFor, kept so the same question is not asked of Octopus + // three times in one run. + registeredBefore bool + registrationCheckedFor string +} + +// alreadyRegistered answers whether Octopus already has an agent of this name. +// It is asked before installing, to warn that a name is taken, and again after +// a failure, to tell an orphaned registration from one that was always there. +func (opts *InstallOptions) alreadyRegistered() (bool, error) { + if opts.registrationCheckedFor == opts.Name.Value { + return opts.registeredBefore, nil + } + if opts.RegisteredCallback == nil { + return false, nil + } + + taken, err := opts.RegisteredCallback(opts.Name.Value) + if err != nil { + return false, err + } + opts.registeredBefore = taken + opts.registrationCheckedFor = opts.Name.Value + return taken, nil +} + +func NewInstallOptions(installFlags *InstallFlags, dependencies *cmd.Dependencies, mode agentK8s.Mode) *InstallOptions { + return &InstallOptions{ + InstallFlags: installFlags, + Dependencies: dependencies, + Mode: mode, + + CreateTargetEnvironmentOptions: sharedTarget.NewCreateTargetEnvironmentOptions(dependencies), + CreateTargetMachinePolicyOptions: machinescommon.NewCreateTargetMachinePolicyOptions(dependencies), + WorkerPoolOptions: sharedWorker.NewWorkerPoolOptions(dependencies), + + AccessTokenCallback: func() (accesstokens.Token, error) { + return accesstokens.Generate(dependencies.Client) + }, + RegisteredCallback: func(name string) (bool, error) { + return registered(dependencies, mode, name) + }, + TargetTagsCallback: func() ([]string, error) { + return sharedTarget.TargetTagNames(dependencies.Client) + }, + } +} + +func NewCmdInstall(f factory.Factory) *cobra.Command { + return newCmdInstall(f, agentK8s.ModeDeploymentTarget) +} + +func NewCmdWorkerInstall(f factory.Factory) *cobra.Command { + return newCmdInstall(f, agentK8s.ModeWorker) +} + +func newCmdInstall(f factory.Factory, mode agentK8s.Mode) *cobra.Command { + installFlags := NewInstallFlags() + + command := &cobra.Command{ + Use: "install", + Short: shortDescription(mode), + Long: longDescription(mode), + Example: examples(mode), + RunE: func(c *cobra.Command, _ []string) error { + opts := NewInstallOptions(installFlags, cmd.NewDependencies(f, c), mode) + opts.AccessModeChosen = c.Flags().Changed(FlagReadWriteMany) + return installRun(c.Context(), opts) + }, + } + + flags := command.Flags() + flags.SortFlags = false + flags.StringVarP(&installFlags.Name.Value, FlagName, "n", "", fmt.Sprintf( + "Name for the %s in Octopus. The namespace and Helm release name are derived from it.", mode)) + registerModeFlags(command, installFlags, mode) + flags.StringVar(&installFlags.MachinePolicy.Value, machinescommon.FlagMachinePolicy, "", fmt.Sprintf( + "Machine policy the %s is registered with. Uses the default machine policy if not set.", mode)) + flags.StringVar(&installFlags.ServerCommsAddress.Value, FlagServerCommsAddress, "", "Polling address of your Octopus Server. Derived from the configured server URL if not set.") + flags.StringVar(&installFlags.ServerCertificate.Value, FlagServerCertificate, "", "Base64-encoded PEM certificate to trust when Octopus is not served by a publicly trusted certificate.") + flags.StringVar(&installFlags.StorageClass.Value, FlagStorageClass, "", "Storage class for the agent's volume. Uses the cluster's default storage class if not set.") + flags.BoolVar(&installFlags.ReadWriteMany.Value, FlagReadWriteMany, false, "Request a ReadWriteMany volume, so script pods can run on any node. Read from the storage class if not set.") + flags.BoolVar(&installFlags.AcceptEula.Value, FlagAcceptEula, false, "Accept the Octopus Customer Agreement ("+eulaURL+"). Required to install.") + flags.BoolVar(&installFlags.InlineSecrets.Value, FlagInlineSecrets, false, "Put the registration credential directly in the Helm values instead of in a Kubernetes Secret.") + flags.BoolVar(&installFlags.RestrictScriptPods.Value, FlagRestrictScriptPods, false, "Give script pods no permissions of their own, leaving every deployment to the Octopus permissions controller.") + flags.StringArrayVar(&installFlags.ScriptPodRoles.Value, FlagScriptPodRole, nil, + "Give script pods the rules of this role, copied in at install time. Name a cluster role, or a role in a namespace as namespace/name. Repeat for more than one.") + octoK8s.RegisterCommonFlags(command, installFlags.CommonFlags) + + return command +} + +// registerModeFlags keeps a worker from advertising deployment target settings +// it cannot use, and the other way round. +func registerModeFlags(command *cobra.Command, installFlags *InstallFlags, mode agentK8s.Mode) { + if mode == agentK8s.ModeWorker { + sharedWorker.RegisterCreateWorkerWorkerPoolFlags(command, installFlags.WorkerPoolFlags) + return + } + + sharedTarget.RegisterCreateTargetEnvironmentFlags(command, installFlags.CreateTargetEnvironmentFlags) + registerTargetTagFlags(command, installFlags) + sharedTarget.RegisterCreateTargetTenantFlags(command, installFlags.CreateTargetTenantFlags) + command.Flags().StringVar(&installFlags.DefaultNamespace.Value, FlagDefaultNamespace, "", + "Namespace deployments go to when the step or the manifest does not name one.") +} + +// registerTargetTagFlags describes these as target tags rather than roles. +// Octopus renamed them, and a tag that does not exist yet is a normal thing to +// give an agent: Octopus creates it when the agent registers. +func registerTargetTagFlags(command *cobra.Command, installFlags *InstallFlags) { + flags := command.Flags() + flags.StringSliceVar(&installFlags.Roles.Value, sharedTarget.FlagRole, nil, + "Target tag for the deployment target. Repeat for more than one. A tag that does not exist yet is created when the agent registers.") + flags.StringSliceVar(&installFlags.Tags.Value, sharedTarget.FlagTag, nil, + "Target tag in canonical TagSetName/TagName form, checked against the tag sets. Repeat for more than one.") +} + +func installRun(ctx context.Context, opts *InstallOptions) error { + if ctx == nil { + ctx = context.Background() + } + + if err := opts.Discover(ctx); err != nil { + return err + } + + if opts.NoPrompt { + if err := opts.ValidateForAutomation(); err != nil { + return err + } + if err := opts.ResolveWithoutPrompting(); err != nil { + return err + } + } else { + if err := PromptMissing(ctx, opts); err != nil { + return err + } + // Most of this was worked out rather than asked for, so show all of it + // before anything is created. + if err := Confirm(ctx, opts); err != nil { + return err + } + } + + return opts.Commit(ctx) +} + +// Run installs using an existing set of dependencies. The `kubernetes install` +// wizard uses this to hand off after the user picks a component, so the two +// entry points share one implementation. +func Run(_ factory.Factory, dependencies *cmd.Dependencies) error { + return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies, agentK8s.ModeDeploymentTarget)) +} + +func RunWorker(_ factory.Factory, dependencies *cmd.Dependencies) error { + return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies, agentK8s.ModeWorker)) +} + +func (opts *InstallOptions) Discover(ctx context.Context) error { + connector := opts.connector() + session, err := connector.Connect(ctx) + if err != nil { + return err + } + + opts.Cluster = session.Cluster + opts.Runner = session.Runner + opts.KubeContextInfo = session.Context + return nil +} + +func (opts *InstallOptions) connector() *shared.Connector { + return &shared.Connector{ + Dependencies: opts.Dependencies, + CommonFlags: opts.CommonFlags, + SelectMessage: fmt.Sprintf("Which cluster should the %s be installed into?", opts.installedThing()), + Discover: opts.discoverCluster, + Unrecoverable: func(cause error, kubeConfig *octoK8s.KubeConfig) bool { + // Nothing to retry, and no other cluster to move to. + return errors.As(cause, &agentK8s.ErrUnsupportedNodes{}) && len(kubeConfig.Contexts()) == 1 + }, + } +} + +// discoverCluster reads everything the questions and the review screen are +// filled in from, so a credential problem anywhere in it can be fixed and +// retried as one unit. +func (opts *InstallOptions) discoverCluster(ctx context.Context, session *shared.Session) error { + architectures, err := session.Cluster.NodeArchitectures(ctx) + if err != nil { + return err + } + opts.NodeArchitectures = architectures + + if !agentK8s.RunnableArchitecture(architectures) { + return agentK8s.ErrUnsupportedNodes{Architectures: architectures} + } + + classes, err := session.Cluster.StorageClasses(ctx) + if err != nil { + return err + } + opts.StorageClasses = classes + + installations, err := agentK8s.Installations(session.Runner) + if err != nil { + return err + } + opts.Installations = installations + + present, err := agentK8s.PermissionsControllerPresent(session.Cluster) + if err != nil { + return err + } + opts.PermissionsController = present + + return nil +} + +// ConfirmRetry is the recovery prompt for a cluster that could not be read, +// which is nearly always an expired cloud credential. +func (opts *InstallOptions) ConfirmRetry(kubeConfig *octoK8s.KubeConfig, cause error) (bool, error) { + return opts.connector().ConfirmRetry(kubeConfig, cause) +} + +func (opts *InstallOptions) ValidateForAutomation() error { + var missing []string + if opts.Name.Value == "" { + missing = append(missing, "--"+FlagName) + } + + if opts.Mode == agentK8s.ModeWorker { + if len(opts.WorkerPools.Value) == 0 { + missing = append(missing, "--"+sharedWorker.FlagWorkerPool) + } + } else { + if len(opts.Environments.Value) == 0 { + missing = append(missing, "--"+sharedTarget.FlagEnvironment) + } + if len(opts.Roles.Value) == 0 && len(opts.Tags.Value) == 0 { + missing = append(missing, fmt.Sprintf("--%s or --%s", sharedTarget.FlagRole, sharedTarget.FlagTag)) + } + } + + // A dry run renders manifests without registering anything, so there is no + // agreement being entered into. + if !opts.AcceptEula.Value && !opts.DryRun.Value { + missing = append(missing, "--"+FlagAcceptEula) + } + + if len(missing) > 0 { + return fmt.Errorf("%s must be specified when prompting is disabled", strings.Join(missing, ", ")) + } + return nil +} + +func (opts *InstallOptions) ResolveWithoutPrompting() error { + opts.applyDefaults() + + if err := opts.resolveNames(); err != nil { + return err + } + + if err := opts.validateMachinePolicy(); err != nil { + return err + } + + if err := opts.validateWorkerPools(); err != nil { + return err + } + + if err := opts.resolveScriptPodRoles(context.Background()); err != nil { + return err + } + + opts.deriveAccessMode() + opts.warnAboutAccessMode() + return nil +} + +// validateWorkerPools catches a pool that cannot hold a worker before the agent +// tries to register with it. A dynamic pool is the likely mistake: Octopus runs +// those on its own machines, so a worker cannot join one. +func (opts *InstallOptions) validateWorkerPools() error { + if !opts.isWorker() || len(opts.WorkerPools.Value) == 0 { + return nil + } + + pools, err := opts.GetAllWorkerPoolsCallback() + if err != nil { + return err + } + + known := map[string]bool{} + for _, pool := range pools { + known[strings.ToLower(pool.Name)] = true + known[strings.ToLower(pool.ID)] = true + } + + var unknown []string + for _, given := range opts.WorkerPools.Value { + if !known[strings.ToLower(strings.TrimSpace(given))] { + unknown = append(unknown, given) + } + } + if len(unknown) == 0 { + return nil + } + + return fmt.Errorf("no worker pool named %s in space %s can hold a worker. %s", + strings.Join(unknown, ", "), opts.spaceName(), staticPoolAdvice()) +} + +// staticPoolAdvice is worth spelling out because a space can easily have only +// dynamic pools, which is the default on Octopus Cloud. +func staticPoolAdvice() string { + return fmt.Sprintf("A Kubernetes worker joins a static worker pool; create one with `%s worker-pool static create`", + constants.ExecutableName) +} + +// validateMachinePolicy checks the name before anything is created, so a typo +// surfaces here rather than in a registration that fails inside the cluster. +func (opts *InstallOptions) validateMachinePolicy() error { + if opts.MachinePolicy.Value == "" { + return nil + } + _, err := machinescommon.FindMachinePolicy(opts.GetAllMachinePoliciesCallback, opts.MachinePolicy.Value) + return err +} + +// resolveScriptPodRoles copies the rules out of the named roles. They are +// copied rather than referenced because the chart takes rules, so this is a +// snapshot: the agent does not follow the roles afterwards. +func (opts *InstallOptions) resolveScriptPodRoles(ctx context.Context) error { + if len(opts.ScriptPodRoles.Value) == 0 { + return nil + } + if opts.RestrictScriptPods.Value { + return fmt.Errorf("--%s and --%s ask for opposite things; script pods either have no permissions of their own or the ones copied from %s", + FlagRestrictScriptPods, FlagScriptPodRole, strings.Join(opts.ScriptPodRoles.Value, ", ")) + } + + roles := make([]octoK8s.Role, 0, len(opts.ScriptPodRoles.Value)) + for _, reference := range opts.ScriptPodRoles.Value { + role, err := opts.Cluster.FindRole(ctx, reference) + if err != nil { + return err + } + roles = append(roles, role) + } + + opts.ScriptPodRules = octoK8s.MergePolicyRules(roles) + if len(opts.ScriptPodRules) == 0 { + return fmt.Errorf("%s grants nothing, so copying it would leave script pods unable to deploy. "+ + "Use --%s if that is what you want", strings.Join(opts.ScriptPodRoles.Value, ", "), FlagRestrictScriptPods) + } + return nil +} + +// resolvedStorageClass is where the volume actually comes from: the class that +// was chosen, or the cluster's default when none was. +func (opts *InstallOptions) resolvedStorageClass() (octoK8s.StorageClass, bool) { + for _, class := range opts.StorageClasses { + if opts.StorageClass.Value == "" { + if class.IsDefault { + return class, true + } + continue + } + if class.Name == opts.StorageClass.Value { + return class, true + } + } + return octoK8s.StorageClass{}, false +} + +// deriveAccessMode reads the access mode off the storage class rather than +// asking for it. Whether script pods can spread across nodes follows from +// whether the class serves a shared filesystem, which is not a separate +// decision anybody should have to make. +func (opts *InstallOptions) deriveAccessMode() { + if opts.AccessModeChosen { + return + } + class, found := opts.resolvedStorageClass() + opts.ReadWriteMany.Value = found && class.SupportsReadWriteMany() +} + +// warnAboutAccessMode is a warning rather than a refusal: the provisioner is +// only a signal, and a class this does not recognise may well serve a shared +// filesystem. +func (opts *InstallOptions) warnAboutAccessMode() { + if !opts.ReadWriteMany.Value || !opts.AccessModeChosen { + return + } + + class, found := opts.resolvedStorageClass() + if found && class.SupportsReadWriteMany() { + return + } + + fmt.Fprintf(opts.Out, "%s --%s asks for a ReadWriteMany volume from %s, which is not known to serve one. "+ + "If it cannot, the volume never binds and the agent stays pending.\n", + output.Yellow("!"), FlagReadWriteMany, storageClassDescription(class, found, opts.StorageClass.Value)) +} + +func storageClassDescription(class octoK8s.StorageClass, found bool, requested string) string { + switch { + case found && class.Provisioner != "": + return fmt.Sprintf("%s (%s)", class.Name, class.Provisioner) + case requested != "": + return requested + default: + return "the cluster's default storage class" + } +} + +func (opts *InstallOptions) applyDefaults() { + if opts.ServerCommsAddress.Value == "" { + opts.ServerCommsAddress.Value = octoK8s.DerivePollingURL(opts.Host) + } +} + +func (opts *InstallOptions) resolveNames() error { + if opts.Namespace.Value != "" { + opts.TargetNamespace = opts.Namespace.Value + } else { + derived, err := octoK8s.DerivedNamespace(octoK8s.AgentNamespacePrefix, opts.Name.Value) + if err != nil { + return err + } + opts.TargetNamespace = derived + } + + if opts.ReleaseName.Value != "" { + opts.TargetRelease = opts.ReleaseName.Value + } else { + derived, err := octoK8s.ReleaseName(opts.Name.Value) + if err != nil { + return err + } + opts.TargetRelease = derived + } + return nil +} + +func (opts *InstallOptions) spaceName() string { + if name := opts.GetSpaceNameOrEmpty(); name != "" { + return name + } + return "Default" +} + +func (opts *InstallOptions) isWorker() bool { + return opts.Mode == agentK8s.ModeWorker +} + +// installedThing names what goes into the cluster, which is one chart either +// way. Mode names what Octopus ends up with, which is what a name or a +// registration belongs to. +func (opts *InstallOptions) installedThing() string { + if opts.isWorker() { + return "Kubernetes worker" + } + return "Kubernetes agent" +} + +// existingRelease is the agent this install would replace, which is worth +// saying: a Helm release name is derived from the agent name, so reusing a name +// upgrades an agent rather than adding one. +func (opts *InstallOptions) existingRelease() (agentK8s.Installation, bool) { + for _, installation := range opts.Installations { + if installation.Release.Name == opts.TargetRelease && installation.Release.Namespace == opts.TargetNamespace { + return installation, true + } + } + return agentK8s.Installation{}, false +} + +// registered answers whether Octopus already has an agent of this name. +// Registration matches on name, so an existing one is taken over rather than +// added to. +func registered(dependencies *cmd.Dependencies, mode agentK8s.Mode, name string) (bool, error) { + if dependencies.Client == nil || strings.TrimSpace(name) == "" { + return false, nil + } + spaceID := "" + if dependencies.Space != nil { + spaceID = dependencies.Space.ID + } + + if mode == agentK8s.ModeWorker { + page, err := workers.Get(dependencies.Client, spaceID, machines.WorkersQuery{PartialName: name}) + if err != nil { + return false, err + } + for _, worker := range page.Items { + if strings.EqualFold(worker.Name, name) { + return true, nil + } + } + return false, nil + } + + page, err := machines.Get(dependencies.Client, spaceID, machines.MachinesQuery{PartialName: name}) + if err != nil { + return false, err + } + for _, target := range page.Items { + if strings.EqualFold(target.Name, name) { + return true, nil + } + } + return false, nil +} + +// knownTargetTags is read once and kept, so the review can tell a tag the space +// already had from one that will be created. +func (opts *InstallOptions) knownTargetTags() ([]string, error) { + if opts.KnownTargetTags != nil || opts.TargetTagsCallback == nil { + return opts.KnownTargetTags, nil + } + + tags, err := opts.TargetTagsCallback() + if err != nil { + return nil, err + } + if tags == nil { + tags = []string{} + } + opts.KnownTargetTags = tags + return tags, nil +} + +// newTargetTags are the chosen tags Octopus has never seen, which it creates +// when the agent registers. Tags that came from a flag are taken at face value: +// nothing was read, so nothing can be called new. +func (opts *InstallOptions) newTargetTags() []string { + if opts.KnownTargetTags == nil { + return nil + } + + known := map[string]bool{} + for _, tag := range opts.KnownTargetTags { + known[tag] = true + } + + var created []string + for _, tag := range opts.Roles.Value { + if !known[tag] { + created = append(created, tag) + } + } + return created +} + +func shortDescription(mode agentK8s.Mode) string { + if mode == agentK8s.ModeWorker { + return "Install the Octopus Kubernetes agent as a worker" + } + return "Install the Octopus Kubernetes agent as a deployment target" +} + +func longDescription(mode agentK8s.Mode) string { + if mode == agentK8s.ModeWorker { + return heredoc.Doc(` + Install the Octopus Kubernetes agent into a Kubernetes cluster as a worker. + + The worker runs Octopus steps in the cluster, one pod per task, and releases the + compute again when the task finishes. It polls Octopus for work, so the cluster does + not need to be reachable from outside. + + Run without arguments to be prompted. Anything that can be read from the cluster or + from Octopus is filled in for you: the Octopus server, space and polling address, the + cluster's storage classes, and the install namespace. + `) + } + + return heredoc.Doc(` + Install the Octopus Kubernetes agent into a Kubernetes cluster as a deployment target. + + The agent runs Kubernetes steps from inside the cluster, so Octopus does not need + cluster credentials and the cluster does not need to be reachable from outside - the + agent polls Octopus for work. + + Run without arguments to be prompted. Anything that can be read from the cluster or + from Octopus is filled in for you: the Octopus server, space and polling address, the + cluster's storage classes, and the install namespace. + `) +} + +func examples(mode agentK8s.Mode) string { + if mode == agentK8s.ModeWorker { + return heredoc.Docf(` + $ %[1]s kubernetes worker install + $ %[1]s kubernetes worker install --name cluster-worker --worker-pool "Kubernetes Pool" --dry-run + $ %[1]s kubernetes worker install --name cluster-worker --worker-pool "Kubernetes Pool" --accept-eula --no-prompt + `, constants.ExecutableName) + } + + return heredoc.Docf(` + $ %[1]s kubernetes agent install + $ %[1]s kubernetes agent install --name production --environment Production --role k8s --dry-run + $ %[1]s kubernetes agent install --name production --environment Production --role k8s --accept-eula --no-prompt + `, constants.ExecutableName) +} + +func (opts *InstallOptions) chartRef() helm.ChartRef { + ref := ChartRef + ref.Version = opts.ChartVersion.Value + return ref +} + +var errEulaDeclined = errors.New("the Octopus Customer Agreement has to be accepted to install the agent") + +func (opts *InstallOptions) reportUnsupportedNodes() { + unsupported := agentK8s.UnsupportedArchitectures(opts.NodeArchitectures) + if len(unsupported) == 0 { + return + } + fmt.Fprintf(opts.Out, "%s This cluster has %s nodes, which the agent cannot run on. It will only schedule on the linux/amd64 and linux/arm64 nodes.\n", + output.Yellow("!"), strings.Join(unsupported, " and ")) +} + +func (opts *InstallOptions) NewTargetTagsForTest() []string { + return opts.newTargetTags() +} + +func (opts *InstallOptions) DeriveAccessModeForTest() { + opts.deriveAccessMode() +} diff --git a/pkg/cmd/kubernetes/agent/install/install_test.go b/pkg/cmd/kubernetes/agent/install/install_test.go new file mode 100644 index 00000000..223bc56c --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/install_test.go @@ -0,0 +1,878 @@ +package install_test + +import ( + "bytes" + "context" + "testing" + + "github.com/AlecAivazis/survey/v2" + "github.com/OctopusDeploy/cli/pkg/accesstokens" + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/agent/install" + sharedTarget "github.com/OctopusDeploy/cli/pkg/cmd/target/shared" + sharedWorker "github.com/OctopusDeploy/cli/pkg/cmd/worker/shared" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/machinescommon" + "github.com/OctopusDeploy/cli/test/testutil" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/environments" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/machines" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/spaces" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/workerpools" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + rbacv1 "k8s.io/api/rbac/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/client-go/kubernetes/fake" +) + +const octopusHost = "https://my.octopus.app" + +// pollingAddress is what DerivePollingURL makes of octopusHost: Octopus Cloud +// serves polling Tentacles on their own hostname. +const pollingAddress = "https://polling.my.octopus.app" + +func storageClasses() []octoK8s.StorageClass { + return []octoK8s.StorageClass{ + {Name: "standard", Provisioner: "kubernetes.io/gce-pd", IsDefault: true}, + {Name: "filestore", Provisioner: "filestore.csi.storage.gke.io"}, + } +} + +// clusterRoles are what an agent's script pods could be given the rules of. The +// system: roles Kubernetes ships are left out of the list the installer offers. +func clusterRoles() []runtime.Object { + return []runtime.Object{ + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{Name: "deployer"}, + Rules: []rbacv1.PolicyRule{ + {APIGroups: []string{"apps"}, Resources: []string{"deployments"}, Verbs: []string{"get", "list", "create", "update"}}, + }, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{Name: "cluster-admin"}, + Rules: []rbacv1.PolicyRule{{APIGroups: []string{"*"}, Resources: []string{"*"}, Verbs: []string{"*"}}}, + }, + &rbacv1.ClusterRole{ + ObjectMeta: metav1.ObjectMeta{Name: "system:discovery"}, + Rules: []rbacv1.PolicyRule{{NonResourceURLs: []string{"/healthz"}, Verbs: []string{"get"}}}, + }, + &rbacv1.Role{ + ObjectMeta: metav1.ObjectMeta{Name: "reader", Namespace: "monitoring"}, + Rules: []rbacv1.PolicyRule{{APIGroups: []string{""}, Resources: []string{"pods"}, Verbs: []string{"get"}}}, + }, + &rbacv1.Role{ + ObjectMeta: metav1.ObjectMeta{Name: "bootstrap-signer", Namespace: "kube-system"}, + Rules: []rbacv1.PolicyRule{{APIGroups: []string{""}, Resources: []string{"secrets"}, Verbs: []string{"get"}}}, + }, + } +} + +func newOptions(t *testing.T, flags *install.InstallFlags, mode agentK8s.Mode, asker func(p survey.Prompt, response interface{}, opts ...survey.AskOpt) error) *install.InstallOptions { + t.Helper() + + dependencies := &cmd.Dependencies{ + Ask: asker, + Out: &bytes.Buffer{}, + Host: octopusHost, + Space: &spaces.Space{Name: "Default"}, + } + dependencies.Space.ID = "Spaces-1" + + opts := &install.InstallOptions{ + InstallFlags: flags, + Dependencies: dependencies, + Mode: mode, + + CreateTargetEnvironmentOptions: &sharedTarget.CreateTargetEnvironmentOptions{ + Dependencies: dependencies, + GetAllEnvironmentsCallback: func() ([]*environments.Environment, error) { + return []*environments.Environment{environments.NewEnvironment("Development"), environments.NewEnvironment("Production")}, nil + }, + }, + CreateTargetMachinePolicyOptions: &machinescommon.CreateTargetMachinePolicyOptions{ + Dependencies: dependencies, + GetAllMachinePoliciesCallback: func() ([]*machines.MachinePolicy, error) { + return []*machines.MachinePolicy{machines.NewMachinePolicy("Default Machine Policy")}, nil + }, + }, + WorkerPoolOptions: &sharedWorker.WorkerPoolOptions{ + Dependencies: dependencies, + GetAllWorkerPoolsCallback: func() ([]*workerpools.WorkerPoolListResult, error) { + return []*workerpools.WorkerPoolListResult{ + {Name: "Default Worker Pool", CanAddWorkers: true}, + {Name: "Kubernetes Pool", CanAddWorkers: true}, + }, nil + }, + }, + + AccessTokenCallback: func() (accesstokens.Token, error) { + return accesstokens.Token{Value: "eyJhbGciOiJIUzI1NiJ9.token"}, nil + }, + RegisteredCallback: func(string) (bool, error) { return false, nil }, + TargetTagsCallback: func() ([]string, error) { return []string{"k8s", "web"}, nil }, + + Cluster: octoK8s.NewClusterForTesting(fake.NewSimpleClientset(clusterRoles()...), "test", "https://cluster"), + StorageClasses: storageClasses(), + NodeArchitectures: []string{"amd64"}, + } + return opts +} + +func TestPromptMissing_DeploymentTargetWithNothingSupplied(t *testing.T) { + pa := []*testutil.PA{ + testutil.NewConfirmPromptWithDefault("Do you accept it?", "", true, true), + testutil.NewInputPrompt("Name", "A short, memorable, unique name for this deployment target.", "Production"), + testutil.NewMultiSelectPrompt("Choose at least one environment for the deployment target.\n", "", + []string{"Development", "Production"}, []string{"Production"}), + testutil.NewMultiSelectWithAddPrompt("Which target tags should this deployment target have?\n", "", + []string{"k8s", "web"}, []string{"k8s"}, "tag"), + testutil.NewInputPrompt("Default namespace for deployments (optional)", + "Used only when neither the step nor the manifest names a namespace. "+ + "Leave it blank to make every step say where it deploys to.", ""), + testutil.NewInputPromptWithDefault("Octopus Server polling address", + "The agent polls Octopus over TCP, on port 10943 by default, separately from the REST API on 443. "+ + "Octopus Cloud serves this on its own hostname over 443. The connection has to reach Octopus intact - SSL offloading does not work.", + pollingAddress, pollingAddress), + testutil.NewSelectPrompt("Which storage class should the agent use?", "", + []string{ + "Use the cluster's default storage class", + "standard (cluster default, kubernetes.io/gce-pd)", + "filestore (filestore.csi.storage.gke.io)", + }, "Use the cluster's default storage class"), + } + asker, checkRemainingPrompts := testutil.NewMockAsker(t, pa) + + flags := install.NewInstallFlags() + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Equal(t, "Production", flags.Name.Value) + assert.Equal(t, []string{"Production"}, flags.Environments.Value) + assert.Equal(t, []string{"k8s"}, flags.Roles.Value) + assert.Empty(t, flags.TenantedDeploymentMode.Value, "tenanted deployments are not asked about, and default to untenanted") + assert.Equal(t, pollingAddress, flags.ServerCommsAddress.Value) + assert.True(t, flags.AcceptEula.Value) + + // Derived rather than asked for. + assert.Equal(t, "octopus-agent-production", opts.TargetNamespace) + assert.Equal(t, "production", opts.TargetRelease) + assert.Empty(t, flags.StorageClass.Value, "the cluster default leaves the chart's own default in place") +} + +// Whether script pods can spread across nodes follows from the storage class, +// so it is worked out rather than asked about. +func TestPromptMissing_AccessModeFollowsTheStorageClass(t *testing.T) { + tests := []struct { + name string + answer string + storageClass string + readWriteMany bool + }{ + {"a shared filesystem", "filestore (filestore.csi.storage.gke.io)", "filestore", true}, + {"a block device", "standard (cluster default, kubernetes.io/gce-pd)", "standard", false}, + {"the cluster default is read the same way", "Use the cluster's default storage class", "", false}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPrompt("Which storage class should the agent use?", "", + []string{ + "Use the cluster's default storage class", + "standard (cluster default, kubernetes.io/gce-pd)", + "filestore (filestore.csi.storage.gke.io)", + }, tt.answer), + }) + + flags := allSuppliedTargetFlags() + flags.StorageClass.Value = "" + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Equal(t, tt.storageClass, flags.StorageClass.Value) + assert.Equal(t, tt.readWriteMany, flags.ReadWriteMany.Value) + }) + } +} + +// A shared filesystem is only worth having if the volume can be mounted from +// more than one node, so --read-write-many still wins where it is given. +func TestResolveWithoutPrompting_ReadWriteManyOverridesTheStorageClass(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.StorageClass.Value = "standard" + flags.ReadWriteMany.Value = true + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.AccessModeChosen = true + + out := &bytes.Buffer{} + opts.Out = out + + require.NoError(t, opts.ResolveWithoutPrompting()) + assert.True(t, flags.ReadWriteMany.Value) + assert.Contains(t, out.String(), "not known to serve one", "a class that cannot do it is worth a warning") +} + +func TestResolveWithoutPrompting_ReadWriteManyOnASharedFilesystemIsNotWarnedAbout(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.StorageClass.Value = "filestore" + flags.ReadWriteMany.Value = true + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.AccessModeChosen = true + + out := &bytes.Buffer{} + opts.Out = out + + require.NoError(t, opts.ResolveWithoutPrompting()) + assert.NotContains(t, out.String(), "not known to serve one") +} + +func TestPromptMissing_NoStorageClassesAsksNothing(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.StorageClass.Value = "" + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.StorageClasses = nil + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + assert.Empty(t, flags.StorageClass.Value) +} + +func TestPromptMissing_AllOptionsSupplied(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{}) + + opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() +} + +func TestPromptMissing_WorkerAsksAboutPoolsInsteadOfEnvironments(t *testing.T) { + pa := []*testutil.PA{ + testutil.NewConfirmPromptWithDefault("Do you accept it?", "", true, true), + testutil.NewInputPrompt("Name", "A short, memorable, unique name for this worker.", "Cluster Worker"), + testutil.NewMultiSelectPrompt("Select the worker pools to assign to the worker", "", + []string{"Default Worker Pool", "Kubernetes Pool"}, []string{"Kubernetes Pool"}), + testutil.NewInputPromptWithDefault("Octopus Server polling address", + "The agent polls Octopus over TCP, on port 10943 by default, separately from the REST API on 443. "+ + "Octopus Cloud serves this on its own hostname over 443. The connection has to reach Octopus intact - SSL offloading does not work.", + pollingAddress, pollingAddress), + testutil.NewSelectPrompt("Which storage class should the agent use?", "", + []string{ + "Use the cluster's default storage class", + "standard (cluster default, kubernetes.io/gce-pd)", + "filestore (filestore.csi.storage.gke.io)", + }, "Use the cluster's default storage class"), + } + asker, checkRemainingPrompts := testutil.NewMockAsker(t, pa) + + flags := install.NewInstallFlags() + opts := newOptions(t, flags, agentK8s.ModeWorker, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Equal(t, []string{"Kubernetes Pool"}, flags.WorkerPools.Value) + assert.Empty(t, flags.Environments.Value, "a worker has no environments") + assert.Equal(t, "octopus-agent-cluster-worker", opts.TargetNamespace) +} + +const permissionsQuestion = "What permissions should be used by workloads out of any WSA scope?" + +const permissionsHelp = "A workload that no WorkloadServiceAccount matches falls back to these. Granting nothing means such a " + + "workload fails rather than running with more access than it should have; anything is the chart's own " + + "default of the whole cluster." + +var permissionsOptions = []string{"Nothing", "Anything", "Copy an existing role"} + +// The permissions controller is the only thing that can grant a script pod +// permissions once the chart's own default is taken away, so the question is +// only worth asking where it is installed. +func TestPromptMissing_ScriptPodPermissionsAreNotAskedAboutWithoutTheController(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{}) + + opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + assert.False(t, opts.RestrictScriptPods.Value) +} + +func TestPromptMissing_ScriptPodPermissionsGrantNothing(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPromptWithDefault(permissionsQuestion, permissionsHelp, permissionsOptions, "Nothing", "Nothing"), + }) + + opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) + opts.PermissionsController = true + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + assert.True(t, opts.RestrictScriptPods.Value) + assert.Empty(t, opts.ScriptPodRules) +} + +func TestPromptMissing_ScriptPodPermissionsKeepTheChartDefault(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPromptWithDefault(permissionsQuestion, permissionsHelp, permissionsOptions, "Nothing", "Anything"), + }) + + opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) + opts.PermissionsController = true + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + assert.False(t, opts.RestrictScriptPods.Value) + assert.Empty(t, opts.ScriptPodRules) +} + +// The rules are copied rather than referenced, because that is what the chart +// takes. The roles Kubernetes ships are not worth offering. +func TestPromptMissing_ScriptPodPermissionsCopiedFromAClusterRole(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPromptWithDefault(permissionsQuestion, permissionsHelp, permissionsOptions, "Nothing", "Copy an existing role"), + testutil.NewMultiSelectPrompt("Which roles should they be given the rules of?", "", + []string{ + "cluster-admin (cluster role, full access to the cluster)", + "deployer (cluster role, 1 rule)", + "monitoring/reader (role, 1 rule)", + }, + []string{"deployer (cluster role, 1 rule)", "monitoring/reader (role, 1 rule)"}), + }) + + opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) + opts.PermissionsController = true + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.False(t, opts.RestrictScriptPods.Value) + assert.Equal(t, []string{"deployer", "monitoring/reader"}, opts.ScriptPodRoles.Value) + assert.Equal(t, []any{ + map[string]any{ + "apiGroups": []string{"apps"}, + "resources": []string{"deployments"}, + "verbs": []string{"get", "list", "create", "update"}, + }, + map[string]any{ + "apiGroups": []string{""}, + "resources": []string{"pods"}, + "verbs": []string{"get"}, + }, + }, opts.ScriptPodRules, "the rules of every chosen role are gathered into one list") +} + +func TestResolveScriptPodRole_CopiesTheRulesByName(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.ScriptPodRoles.Value = []string{"deployer"} + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + require.NoError(t, opts.ResolveWithoutPrompting()) + assert.Len(t, opts.ScriptPodRules, 1) +} + +func TestResolveScriptPodRole_RejectsAnUnknownRole(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.ScriptPodRoles.Value = []string{"does-not-exist"} + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + assert.ErrorContains(t, opts.ResolveWithoutPrompting(), "does-not-exist") +} + +// Granting nothing and granting a role's rules are opposite answers to the same +// question, so asking for both is a mistake worth naming. +func TestResolveScriptPodRole_RejectsBothWaysAtOnce(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.ScriptPodRoles.Value = []string{"deployer"} + flags.RestrictScriptPods.Value = true + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + err := opts.ResolveWithoutPrompting() + require.Error(t, err) + assert.Contains(t, err.Error(), install.FlagRestrictScriptPods) + assert.Contains(t, err.Error(), install.FlagScriptPodRole) +} + +func TestPromptMissing_DecliningTheAgreementStops(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewConfirmPromptWithDefault("Do you accept it?", "", false, true), + }) + + opts := newOptions(t, install.NewInstallFlags(), agentK8s.ModeDeploymentTarget, asker) + + err := install.PromptMissing(context.Background(), opts) + assert.ErrorContains(t, err, "Customer Agreement") +} + +func TestPromptMissing_DerivesNamespaceFromName(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.Name.Value = "EU West Production" + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + assert.Equal(t, "octopus-agent-eu-west-production", opts.TargetNamespace) + assert.Equal(t, "eu-west-production", opts.TargetRelease) +} + +func allSuppliedTargetFlags() *install.InstallFlags { + flags := install.NewInstallFlags() + flags.Name.Value = "Production" + flags.Environments.Value = []string{"Production"} + flags.Roles.Value = []string{"k8s"} + flags.TenantedDeploymentMode.Value = sharedTarget.Untenanted + flags.DefaultNamespace.Value = "production" + flags.ServerCommsAddress.Value = pollingAddress + flags.StorageClass.Value = "standard" + flags.AcceptEula.Value = true + return flags +} + +func allSuppliedWorkerFlags() *install.InstallFlags { + flags := install.NewInstallFlags() + flags.Name.Value = "Cluster Worker" + flags.WorkerPools.Value = []string{"Kubernetes Pool"} + flags.ServerCommsAddress.Value = pollingAddress + flags.AcceptEula.Value = true + return flags +} + +func completedTargetOptions(t *testing.T) *install.InstallOptions { + t.Helper() + + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) + require.NoError(t, opts.ResolveWithoutPrompting()) + return opts +} + +func completedWorkerOptions(t *testing.T) *install.InstallOptions { + t.Helper() + + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + opts := newOptions(t, allSuppliedWorkerFlags(), agentK8s.ModeWorker, asker) + require.NoError(t, opts.ResolveWithoutPrompting()) + return opts +} + +func TestBuildValues_DeploymentTargetRegistration(t *testing.T) { + opts := completedTargetOptions(t) + + values, err := opts.BuildValues() + require.NoError(t, err) + + agentValues := values["agent"].(map[string]any) + assert.Equal(t, "Production", agentValues["name"]) + assert.Equal(t, "Y", agentValues["acceptEula"]) + assert.Equal(t, octopusHost, agentValues["serverUrl"]) + assert.Equal(t, pollingAddress, agentValues["serverCommsAddress"]) + assert.Equal(t, "Default", agentValues["space"]) + assert.NotContains(t, agentValues, "worker", "a deployment target does not register as a worker") + + target := agentValues["deploymentTarget"].(map[string]any) + assert.Equal(t, true, target["enabled"]) + + initial := target["initial"].(map[string]any) + assert.Equal(t, []string{"Production"}, initial["environments"]) + assert.Equal(t, []string{"k8s"}, initial["tags"]) + assert.Equal(t, "Untenanted", initial["tenantedDeploymentParticipation"]) + assert.Equal(t, "production", initial["defaultNamespace"]) + assert.NotContains(t, initial, "tenants") + assert.NotContains(t, initial, "tenantTags") +} + +func TestBuildValues_WorkerRegistration(t *testing.T) { + opts := completedWorkerOptions(t) + + values, err := opts.BuildValues() + require.NoError(t, err) + + agentValues := values["agent"].(map[string]any) + assert.NotContains(t, agentValues, "deploymentTarget", "a worker does not register as a deployment target") + + worker := agentValues["worker"].(map[string]any) + assert.Equal(t, true, worker["enabled"]) + assert.Equal(t, []string{"Kubernetes Pool"}, worker["initial"].(map[string]any)["workerPools"]) +} + +func TestBuildValues_TenantsAreOnlySentWhenChosen(t *testing.T) { + opts := completedTargetOptions(t) + opts.TenantedDeploymentMode.Value = sharedTarget.TenantedOrUntenanted + opts.Tenants.Value = []string{"Valley Veterinary Clinic"} + opts.TenantTags.Value = []string{"Importance/VIP"} + + values, err := opts.BuildValues() + require.NoError(t, err) + + initial := values["agent"].(map[string]any)["deploymentTarget"].(map[string]any)["initial"].(map[string]any) + assert.Equal(t, "TenantedOrUntenanted", initial["tenantedDeploymentParticipation"]) + assert.Equal(t, []string{"Valley Veterinary Clinic"}, initial["tenants"]) + assert.Equal(t, []string{"Importance/VIP"}, initial["tenantTags"]) +} + +func TestBuildValues_AccessTokenGoesIntoASecretByDefault(t *testing.T) { + opts := completedTargetOptions(t) + opts.Token = accesstokens.Token{Value: "eyJhbGciOiJIUzI1NiJ9.token"} + + values, err := opts.BuildValues() + require.NoError(t, err) + + agentValues := values["agent"].(map[string]any) + assert.Equal(t, "octopus-agent-registration-token", agentValues["bearerTokenSecretName"]) + assert.NotContains(t, agentValues, "bearerToken", "the access token must not reach the Helm values") + for _, key := range []string{"serverApiKey", "serverApiKeySecretName", "username", "password"} { + assert.NotContains(t, agentValues, key, "no long-lived credential belongs in the cluster") + } +} + +func TestBuildValues_InlineSecretsOptsIn(t *testing.T) { + opts := completedTargetOptions(t) + opts.InlineSecrets.Value = true + opts.Token = accesstokens.Token{Value: "eyJhbGciOiJIUzI1NiJ9.token"} + + values, err := opts.BuildValues() + require.NoError(t, err) + + agentValues := values["agent"].(map[string]any) + assert.Equal(t, "eyJhbGciOiJIUzI1NiJ9.token", agentValues["bearerToken"]) + assert.NotContains(t, agentValues, "bearerTokenSecretName") +} + +// A dry run never asks Octopus for a token, so the values it renders have to +// reference the Secret a real install would write. +func TestBuildValues_DryRunWithInlineSecretsStillReferencesTheSecret(t *testing.T) { + opts := completedTargetOptions(t) + opts.InlineSecrets.Value = true + + values, err := opts.BuildValues() + require.NoError(t, err) + + agentValues := values["agent"].(map[string]any) + assert.Equal(t, "octopus-agent-registration-token", agentValues["bearerTokenSecretName"]) + assert.NotContains(t, agentValues, "bearerToken") +} + +func TestBuildValues_StorageFollowsWhatWasChosen(t *testing.T) { + tests := []struct { + name string + storageClass string + readWriteMany bool + expected map[string]any + }{ + {"the cluster default leaves persistence alone", "", false, nil}, + {"a storage class on its own", "filestore", false, map[string]any{"storageClassName": "filestore"}}, + {"ReadWriteMany for script pods on any node", "filestore", true, map[string]any{ + "storageClassName": "filestore", + "accessModes": []string{"ReadWriteMany"}, + }}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + opts := completedTargetOptions(t) + opts.StorageClass.Value = tt.storageClass + opts.ReadWriteMany.Value = tt.readWriteMany + + values, err := opts.BuildValues() + require.NoError(t, err) + + if tt.expected == nil { + assert.NotContains(t, values, "persistence") + return + } + assert.Equal(t, tt.expected, values["persistence"]) + }) + } +} + +func TestBuildValues_RestrictedScriptPodsGiveUpTheClusterRole(t *testing.T) { + opts := completedTargetOptions(t) + assert.NotContains(t, mustBuild(t, opts), "scriptPods") + + opts.RestrictScriptPods.Value = true + scriptPods := mustBuild(t, opts)["scriptPods"].(map[string]any) + assert.Equal(t, false, + scriptPods["serviceAccount"].(map[string]any)["clusterRole"].(map[string]any)["enabled"]) +} + +func TestBuildValues_OptionalAgentSettings(t *testing.T) { + opts := completedTargetOptions(t) + agentValues := mustBuild(t, opts)["agent"].(map[string]any) + assert.NotContains(t, agentValues, "machinePolicyName") + assert.NotContains(t, agentValues, "serverCertificate") + + opts.MachinePolicy.Value = "Kubernetes Machine Policy" + opts.ServerCertificate.Value = "LS0tLS1CRUdJTg==" + agentValues = mustBuild(t, opts)["agent"].(map[string]any) + assert.Equal(t, "Kubernetes Machine Policy", agentValues["machinePolicyName"]) + assert.Equal(t, "LS0tLS1CRUdJTg==", agentValues["serverCertificate"]) +} + +func TestBuildValues_NeedsAPollingAddress(t *testing.T) { + opts := completedTargetOptions(t) + opts.ServerCommsAddress.Value = "" + + _, err := opts.BuildValues() + assert.ErrorContains(t, err, install.FlagServerCommsAddress) +} + +func mustBuild(t *testing.T, opts *install.InstallOptions) map[string]any { + t.Helper() + + values, err := opts.BuildValues() + require.NoError(t, err) + return values +} + +func TestValidateForAutomation_DeploymentTarget(t *testing.T) { + tests := []struct { + name string + prepare func(*install.InstallFlags) + missing []string + }{ + {"nothing supplied", func(*install.InstallFlags) {}, []string{"--name", "--environment", "--role or --tag", "--accept-eula"}}, + {"no environment", func(f *install.InstallFlags) { + f.Name.Value = "Production" + f.Roles.Value = []string{"k8s"} + f.AcceptEula.Value = true + }, []string{"--environment"}}, + {"no role or tag", func(f *install.InstallFlags) { + f.Name.Value = "Production" + f.Environments.Value = []string{"Production"} + f.AcceptEula.Value = true + }, []string{"--role or --tag"}}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + flags := install.NewInstallFlags() + tt.prepare(flags) + + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.NoPrompt = true + + err := opts.ValidateForAutomation() + require.Error(t, err) + for _, expected := range tt.missing { + assert.Contains(t, err.Error(), expected) + } + }) + } +} + +func TestValidateForAutomation_WorkerNeedsAPool(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.Name.Value = "Cluster Worker" + flags.AcceptEula.Value = true + + opts := newOptions(t, flags, agentK8s.ModeWorker, asker) + opts.NoPrompt = true + + err := opts.ValidateForAutomation() + require.Error(t, err) + assert.Contains(t, err.Error(), "--worker-pool") + assert.NotContains(t, err.Error(), "--environment", "a worker has no environments") +} + +// A dry run registers nothing, so there is no agreement being entered into. +func TestValidateForAutomation_DryRunNeedsNoAgreement(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.AcceptEula.Value = false + flags.DryRun.Value = true + + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.NoPrompt = true + + require.NoError(t, opts.ValidateForAutomation()) +} + +func TestPromptMissing_RejectsAnUnknownMachinePolicy(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.MachinePolicy.Value = "Does Not Exist" + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + assert.ErrorContains(t, install.PromptMissing(context.Background(), opts), "Does Not Exist") +} + +func TestResolveWithoutPrompting_RejectsAnUnknownMachinePolicy(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.MachinePolicy.Value = "Does Not Exist" + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + assert.ErrorContains(t, opts.ResolveWithoutPrompting(), "Does Not Exist") +} + +func TestResolveWithoutPrompting_DerivesThePollingAddress(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.ServerCommsAddress.Value = "" + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + require.NoError(t, opts.ResolveWithoutPrompting()) + assert.Equal(t, pollingAddress, flags.ServerCommsAddress.Value) +} + +// A space can easily have only dynamic pools, which Octopus runs on its own +// machines, so an empty list is a likely dead end rather than a rare one. +func TestPromptMissing_NoPoolCanHoldAWorker(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewConfirmPromptWithDefault("Do you accept it?", "", true, true), + testutil.NewInputPrompt("Name", "A short, memorable, unique name for this worker.", "Cluster Worker"), + }) + + opts := newOptions(t, install.NewInstallFlags(), agentK8s.ModeWorker, asker) + opts.GetAllWorkerPoolsCallback = func() ([]*workerpools.WorkerPoolListResult, error) { return nil, nil } + + err := install.PromptMissing(context.Background(), opts) + require.Error(t, err) + assert.Contains(t, err.Error(), "no worker pool in space Default can hold a worker") + assert.Contains(t, err.Error(), "worker-pool static create") + checkRemainingPrompts() +} + +func TestValidateWorkerPools_RejectsAPoolThatCannotHoldAWorker(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedWorkerFlags() + flags.WorkerPools.Value = []string{"Kubernetes Pool", "Hosted Pool"} + opts := newOptions(t, flags, agentK8s.ModeWorker, asker) + + err := opts.ResolveWithoutPrompting() + require.Error(t, err) + assert.Contains(t, err.Error(), "Hosted Pool") + assert.NotContains(t, err.Error(), "Kubernetes Pool", "only the pools that could not be found are named") +} + +// A deployment target has no worker pools, so nothing supplied there should be +// checked against them. +func TestValidateWorkerPools_IgnoredForADeploymentTarget(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.WorkerPools.Value = []string{"Hosted Pool"} + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + require.NoError(t, opts.ResolveWithoutPrompting()) +} + +// Octopus creates a target tag as soon as a target registers with it, so a tag +// that is not in the list is a normal answer rather than a mistake. +func TestPromptMissing_ATargetTagCanBeNew(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewMultiSelectWithAddPrompt("Which target tags should this deployment target have?\n", "", + []string{"k8s", "web"}, []string{"k8s", "k8s-agent"}, "tag"), + }) + + flags := allSuppliedTargetFlags() + flags.Roles.Value = nil + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Equal(t, []string{"k8s", "k8s-agent"}, flags.Roles.Value) + assert.Equal(t, []string{"k8s-agent"}, opts.NewTargetTagsForTest(), "only the tag Octopus has never seen is new") +} + +// The tags come from every target tag set at once. Which set a tag belongs to +// is not something to make somebody answer while installing an agent. +func TestPromptMissing_TargetTagsAreAskedForOnce(t *testing.T) { + asked := 0 + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewMultiSelectWithAddPrompt("Which target tags should this deployment target have?\n", "", + []string{"cloud-aws", "cloud-gcp", "k8s"}, []string{"k8s", "cloud-gcp"}, "tag"), + }) + + flags := allSuppliedTargetFlags() + flags.Roles.Value = nil + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.TargetTagsCallback = func() ([]string, error) { + asked++ + return []string{"cloud-aws", "cloud-gcp", "k8s"}, nil + } + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Equal(t, []string{"k8s", "cloud-gcp"}, flags.Roles.Value) + assert.Equal(t, 1, asked, "the space's tags are read once and kept for the review") + assert.Empty(t, opts.NewTargetTagsForTest()) +} + +// A worker has no target tags at all. +func TestPromptMissing_WorkerIsNotAskedForTargetTags(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedWorkerFlags() + flags.StorageClass.Value = "standard" + flags.ReadWriteMany.Value = true + + opts := newOptions(t, flags, agentK8s.ModeWorker, asker) + opts.TargetTagsCallback = func() ([]string, error) { + t.Fatal("a worker has no target tags") + return nil, nil + } + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() +} + +func TestBuildValues_ScriptPodPermissions(t *testing.T) { + opts := completedTargetOptions(t) + assert.NotContains(t, mustBuild(t, opts), "scriptPods", "the chart's own default is left alone") + + opts.RestrictScriptPods.Value = true + clusterRole := mustBuild(t, opts)["scriptPods"].(map[string]any)["serviceAccount"].(map[string]any)["clusterRole"].(map[string]any) + assert.Equal(t, false, clusterRole["enabled"]) + assert.NotContains(t, clusterRole, "rules") + + opts.RestrictScriptPods.Value = false + opts.ScriptPodRules = []any{map[string]any{"apiGroups": []string{"apps"}, "resources": []string{"deployments"}, "verbs": []string{"get"}}} + clusterRole = mustBuild(t, opts)["scriptPods"].(map[string]any)["serviceAccount"].(map[string]any)["clusterRole"].(map[string]any) + assert.Equal(t, opts.ScriptPodRules, clusterRole["rules"]) + assert.NotContains(t, clusterRole, "enabled", "the role still has to exist for the rules to go in") +} + +// A role named by flag has to be read whichever way the install was started, +// or the review would promise permissions the chart never receives. +func TestPromptMissing_ResolvesAScriptPodRoleGivenByFlag(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.ScriptPodRoles.Value = []string{"deployer"} + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.PermissionsController = true + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Len(t, opts.ScriptPodRules, 1, "the rules are read even though nothing was asked") +} diff --git a/pkg/cmd/kubernetes/agent/install/prompt.go b/pkg/cmd/kubernetes/agent/install/prompt.go new file mode 100644 index 00000000..0ceb4db2 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/prompt.go @@ -0,0 +1,321 @@ +package install + +import ( + "context" + "fmt" + "strings" + + "github.com/AlecAivazis/survey/v2" + sharedTarget "github.com/OctopusDeploy/cli/pkg/cmd/target/shared" + sharedWorker "github.com/OctopusDeploy/cli/pkg/cmd/worker/shared" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/question" + "github.com/OctopusDeploy/cli/pkg/question/selectors" +) + +// PromptMissing guards every prompt on its flag, so supplying a flag suppresses +// the matching question and the generated automation command reproduces the run. +func PromptMissing(ctx context.Context, opts *InstallOptions) error { + // Recorded before the defaults fill the rest in, so a supplied flag + // suppresses its prompt rather than merely seeding it. + suppliedPollingAddress := opts.ServerCommsAddress.Value != "" + + if err := promptForEula(opts); err != nil { + return err + } + + if err := question.AskName(opts.Ask, "", string(opts.Mode), &opts.Name.Value); err != nil { + return err + } + + if err := opts.resolveNames(); err != nil { + return err + } + opts.applyDefaults() + if err := opts.validateMachinePolicy(); err != nil { + return err + } + // A role named by flag still has to be read, so the review can say what the + // script pods are getting. + if err := opts.resolveScriptPodRoles(ctx); err != nil { + return err + } + opts.reportFindings() + + if err := promptForRegistration(opts); err != nil { + return err + } + + if !suppliedPollingAddress { + if err := promptForPollingAddress(opts); err != nil { + return err + } + } + + if err := promptForStorage(opts); err != nil { + return err + } + opts.warnAboutAccessMode() + + return promptForScriptPodPermissions(opts) +} + +// promptForRegistration asks only what the agent registers itself with, which +// is the one part that differs between a deployment target and a worker. +func promptForRegistration(opts *InstallOptions) error { + if opts.isWorker() { + return promptForWorkerPools(opts) + } + + if err := sharedTarget.PromptForEnvironments(opts.CreateTargetEnvironmentOptions, opts.CreateTargetEnvironmentFlags); err != nil { + return err + } + if err := promptForTargetTags(opts); err != nil { + return err + } + // Tenanted deployments are deliberately not asked about. Octopus's own agent + // wizard does not either: the docs point people at the target's settings + // afterwards, and --tenanted-mode covers the scripted case. + return promptForDefaultNamespace(opts) +} + +// promptForWorkerPools stops with something to act on rather than an empty +// list. A space can easily have only dynamic pools, which Octopus runs on its +// own machines and a worker cannot join. +func promptForWorkerPools(opts *InstallOptions) error { + if len(opts.WorkerPools.Value) > 0 { + return opts.validateWorkerPools() + } + + pools, err := opts.GetAllWorkerPoolsCallback() + if err != nil { + return err + } + if len(pools) == 0 { + return fmt.Errorf("no worker pool in space %s can hold a worker. %s", + opts.spaceName(), staticPoolAdvice()) + } + + return sharedWorker.PromptForWorkerPools(opts.WorkerPoolOptions, opts.WorkerPoolFlags) +} + +// promptForTargetTags asks once for target tags, rather than once per tag set +// as the deployment target commands do. Which set a tag belongs to is Octopus's +// business; somebody installing an agent is choosing what the agent is for. +// +// A tag that is not in the list can be typed in, because Octopus creates a +// target tag as soon as a target registers with it. +func promptForTargetTags(opts *InstallOptions) error { + if len(opts.Roles.Value) > 0 || len(opts.Tags.Value) > 0 { + return nil + } + + available, err := opts.knownTargetTags() + if err != nil { + return err + } + + chosen, err := question.MultiSelectWithAddMap(opts.Ask, + "Which target tags should this deployment target have?\n", available, true, "tag") + if err != nil { + return err + } + + opts.Roles.Value = chosen + return nil +} + +// promptForEula comes first so that declining costs one question rather than a +// page of them. The chart will not install without it. +func promptForEula(opts *InstallOptions) error { + if opts.AcceptEula.Value { + return nil + } + + fmt.Fprintf(opts.Out, "\nThe Octopus %s is covered by the Octopus Customer Agreement.\n %s\n", + opts.installedThing(), output.Blue(eulaURL)) + + if err := opts.Ask(&survey.Confirm{ + Message: "Do you accept it?", + Default: true, + }, &opts.AcceptEula.Value); err != nil { + return err + } + if !opts.AcceptEula.Value { + return errEulaDeclined + } + return nil +} + +func promptForDefaultNamespace(opts *InstallOptions) error { + if opts.DefaultNamespace.Value != "" { + return nil + } + + return opts.Ask(&survey.Input{ + Message: "Default namespace for deployments (optional)", + Help: "Used only when neither the step nor the manifest names a namespace. " + + "Leave it blank to make every step say where it deploys to.", + }, &opts.DefaultNamespace.Value) +} + +func promptForPollingAddress(opts *InstallOptions) error { + // Derived from the URL the CLI is logged in to, which is nearly always + // right - but the port is configurable, and a proxy that terminates TLS + // breaks the agent, so confirm it. + return opts.Ask(&survey.Input{ + Message: "Octopus Server polling address", + Default: opts.ServerCommsAddress.Value, + Help: fmt.Sprintf("The agent polls Octopus over TCP, on port %d by default, separately from the REST API on 443. "+ + "Octopus Cloud serves this on its own hostname over 443. The connection has to reach Octopus intact - SSL offloading does not work.", + octoK8s.DefaultPollingPort), + }, &opts.ServerCommsAddress.Value, survey.WithValidator(survey.Required)) +} + +// promptForStorage asks only where the volume comes from. The access mode +// follows from the class, so it is worked out rather than asked about. +func promptForStorage(opts *InstallOptions) error { + if opts.StorageClass.Value == "" && len(opts.StorageClasses) > 0 { + if err := promptForStorageClass(opts); err != nil { + return err + } + } + + opts.deriveAccessMode() + return nil +} + +func promptForStorageClass(opts *InstallOptions) error { + const clusterDefault = "Use the cluster's default storage class" + + options := []*selectors.SelectOption[string]{{Display: clusterDefault, Value: ""}} + for _, class := range opts.StorageClasses { + options = append(options, &selectors.SelectOption[string]{Display: class.Display(), Value: class.Name}) + } + + selected, err := selectors.SelectOptions(opts.Ask, "Which storage class should the agent use?", + func() []*selectors.SelectOption[string] { return options }) + if err != nil { + return err + } + opts.StorageClass.Value = selected.Value + return nil +} + +// promptForScriptPodPermissions is only worth asking where the permissions +// controller can act on the answer. Without it, this is the only thing standing +// between a deployment and the cluster, and taking it away stops deployments. +func promptForScriptPodPermissions(opts *InstallOptions) error { + if !opts.PermissionsController || opts.RestrictScriptPods.Value || len(opts.ScriptPodRoles.Value) > 0 { + return nil + } + + const ( + nothing = "Nothing" + anything = "Anything" + copyRole = "Copy an existing role" + ) + + answer := "" + if err := opts.Ask(&survey.Select{ + Message: "What permissions should be used by workloads out of any WSA scope?", + Options: []string{nothing, anything, copyRole}, + Default: nothing, + Help: "A workload that no WorkloadServiceAccount matches falls back to these. Granting nothing means such a " + + "workload fails rather than running with more access than it should have; anything is the chart's own " + + "default of the whole cluster.", + }, &answer); err != nil { + return err + } + + switch answer { + case nothing: + opts.RestrictScriptPods.Value = true + return nil + case copyRole: + return promptForScriptPodRoles(opts) + default: + return nil + } +} + +// promptForScriptPodRoles copies rules out of existing roles rather than +// binding to them, because that is what the chart takes. Saying so matters: the +// copy does not follow the roles afterwards. +func promptForScriptPodRoles(opts *InstallOptions) error { + roles, err := opts.Cluster.Roles(context.Background()) + if err != nil { + return err + } + if len(roles) == 0 { + fmt.Fprintf(opts.Out, " %s This cluster has no roles of its own to copy, so script pods keep the chart's default.\n", + output.Yellow("!")) + return nil + } + + selected, err := question.MultiSelectMap(opts.Ask, "Which roles should they be given the rules of?", roles, + func(role octoK8s.Role) string { return role.Display() }, true) + if err != nil { + return err + } + + rules := octoK8s.MergePolicyRules(selected) + if len(rules) == 0 { + fmt.Fprintf(opts.Out, " %s Those roles grant nothing, so script pods keep the chart's default.\n", + output.Yellow("!")) + return nil + } + + references := make([]string, 0, len(selected)) + for _, role := range selected { + references = append(references, role.Reference()) + } + + opts.ScriptPodRoles.Value = references + opts.ScriptPodRules = rules + fmt.Fprintf(opts.Out, " %s\n", output.Dimf( + "The %d %s are copied in now. Later changes to %s are not picked up.", + len(rules), octoK8s.Pluralise("rule", "rules", len(rules)), strings.Join(references, ", "))) + return nil +} + +// reportFindings says what was already in the cluster and in Octopus, because +// both change what this install does: a name that is already in use upgrades an +// agent rather than adding one. +func (opts *InstallOptions) reportFindings() { + opts.reportUnsupportedNodes() + + if existing, found := opts.existingRelease(); found { + if existing.Mode != agentK8s.ModeUnknown && existing.Mode != opts.Mode { + fmt.Fprintf(opts.Out, "%s Release %s in namespace %s is already a %s. Installing here would replace it; "+ + "give this one a different name.\n", + output.Yellow("!"), output.Cyan(existing.Release.Name), output.Cyan(existing.Release.Namespace), existing.Mode) + } else { + fmt.Fprintf(opts.Out, "%s Upgrading the existing release %s in namespace %s (%s %s).\n", + output.Dim("-"), output.Cyan(existing.Release.Name), output.Cyan(existing.Release.Namespace), + existing.Release.Chart, existing.Release.Version) + } + } + + if opts.RegisteredCallback != nil { + switch taken, err := opts.alreadyRegistered(); { + case err != nil: + fmt.Fprintf(opts.Out, "%s Could not check whether Octopus already has a %s named %s: %v\n", + output.Yellow("!"), opts.Mode, output.Cyan(opts.Name.Value), err) + case taken: + fmt.Fprintf(opts.Out, "%s Octopus already has a %s named %s. The agent registers by name, so it will take that one over.\n", + output.Yellow("!"), opts.Mode, output.Cyan(opts.Name.Value)) + } + } + + if opts.PermissionsController { + fmt.Fprintf(opts.Out, "%s The Octopus permissions controller is running in this cluster, so each deployment can be\n"+ + " granted its own permissions by a WorkloadServiceAccount rather than sharing the agent's.\n", output.Dim("-")) + } +} + +func ReportFindingsForTest(opts *InstallOptions) { + opts.reportFindings() +} diff --git a/pkg/cmd/kubernetes/agent/install/review.go b/pkg/cmd/kubernetes/agent/install/review.go new file mode 100644 index 00000000..0372ddb2 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/review.go @@ -0,0 +1,352 @@ +package install + +import ( + "context" + "fmt" + "strings" + + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" + sharedTarget "github.com/OctopusDeploy/cli/pkg/cmd/target/shared" + sharedWorker "github.com/OctopusDeploy/cli/pkg/cmd/worker/shared" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/question" + "github.com/OctopusDeploy/cli/pkg/question/selectors" +) + +// Confirm shows every setting, detected or chosen. Most are worked out rather +// than asked for, which is the point of the wizard, but it also means nobody +// sees them unless they are shown. +func Confirm(ctx context.Context, opts *InstallOptions) error { + review := &shared.Review{ + Dependencies: opts.Dependencies, + Groups: func() []shared.Group { return reviewGroups(opts) }, + Refresh: func() error { + // The namespace and release name follow the agent's name, and the + // access mode follows the storage class, so an edit to either has to + // carry through. + opts.deriveAccessMode() + return opts.resolveNames() + }, + } + return review.Confirm(ctx) +} + +func reviewGroups(opts *InstallOptions) []shared.Group { + groups := []shared.Group{ + {Title: "Cluster", Items: clusterItems(opts)}, + {Title: "Octopus", Items: octopusItems(opts)}, + } + + if opts.isWorker() { + groups = append(groups, shared.Group{Title: "Worker", Items: workerItems(opts)}) + } else { + groups = append(groups, shared.Group{Title: "Deployment target", Items: deploymentTargetItems(opts)}) + } + + return append(groups, + shared.Group{Title: "Script pods", Items: scriptPodItems(opts)}, + shared.Group{Title: "Helm", Items: helmItems(opts)}, + ) +} + +func clusterItems(opts *InstallOptions) []shared.Item { + source := "current context" + if opts.KubeContext.Value != "" && !opts.KubeContextInfo.IsCurrent { + source = "chosen" + } + + return []shared.Item{ + { + Label: "Kubernetes context", + Value: opts.KubeContext.Value, + Source: source, + // Changing cluster invalidates everything discovered from it. + Edit: nil, + }, + {Label: "Cluster address", Value: opts.KubeContextInfo.Server, Source: "from the kubeconfig"}, + {Label: "Node architectures", Value: shared.OrNone(opts.NodeArchitectures), Source: "from the cluster"}, + { + Label: "Namespace", + Value: opts.TargetNamespace, + Source: shared.DerivedOrSet(opts.Namespace.Value, "derived from the name"), + Edit: shared.EditText(opts.Ask, &opts.Namespace.Value, "Namespace to install into", + func() string { return opts.TargetNamespace }), + }, + { + Label: "Helm release", + Value: opts.TargetRelease, + Source: shared.DerivedOrSet(opts.ReleaseName.Value, "derived from the name"), + Edit: shared.EditText(opts.Ask, &opts.ReleaseName.Value, "Helm release name", + func() string { return opts.TargetRelease }), + }, + } +} + +func octopusItems(opts *InstallOptions) []shared.Item { + return []shared.Item{ + { + Label: "Name", Value: opts.Name.Value, Source: "chosen", + Edit: func(context.Context) error { + opts.Name.Value = "" + return question.AskName(opts.Ask, "", string(opts.Mode), &opts.Name.Value) + }, + }, + {Label: "Server", Value: opts.Host, Source: "from your login"}, + {Label: "Space", Value: opts.spaceName(), Source: "from your login"}, + { + Label: "Polling address", Value: opts.ServerCommsAddress.Value, Source: "derived from the server address", + Edit: shared.EditText(opts.Ask, &opts.ServerCommsAddress.Value, "Octopus Server polling address", + func() string { return opts.ServerCommsAddress.Value }), + }, + {Label: "Registration", Value: registrationSummary(opts), Source: opts.Token.Describe()}, + { + Label: "Machine policy", Value: shared.OrDefault(opts.MachinePolicy.Value, "(default)"), Source: "", + Edit: shared.EditText(opts.Ask, &opts.MachinePolicy.Value, "Machine policy name (blank for the default)", + func() string { return opts.MachinePolicy.Value }), + }, + { + Label: "Server certificate", Value: certificateSummary(opts), Source: "", + Edit: shared.EditText(opts.Ask, &opts.ServerCertificate.Value, "Base64-encoded PEM certificate to trust (blank for none)", + func() string { return opts.ServerCertificate.Value }), + }, + } +} + +func deploymentTargetItems(opts *InstallOptions) []shared.Item { + items := []shared.Item{ + { + Label: "Environments", Value: shared.OrNone(opts.Environments.Value), Source: "chosen", + Edit: func(context.Context) error { + opts.Environments.Value = nil + return sharedTarget.PromptForEnvironments(opts.CreateTargetEnvironmentOptions, opts.CreateTargetEnvironmentFlags) + }, + }, + { + Label: "Target tags", + Value: shared.OrNone(append(append([]string{}, opts.Roles.Value...), opts.Tags.Value...)), + Source: targetTagSource(opts), + Edit: func(context.Context) error { + opts.Roles.Value = nil + opts.Tags.Value = nil + return promptForTargetTags(opts) + }, + }, + { + Label: "Default namespace", Value: shared.OrNotSet(opts.DefaultNamespace.Value), Source: "", + Edit: shared.EditText(opts.Ask, &opts.DefaultNamespace.Value, "Default namespace for deployments (optional)", + func() string { return opts.DefaultNamespace.Value }), + }, + { + Label: "Tenanted deployments", Value: tenantedSummary(opts), Source: "", + Edit: editTenantedParticipation(opts), + }, + } + + if len(opts.Tenants.Value) > 0 || len(opts.TenantTags.Value) > 0 { + items = append(items, shared.Item{ + Label: "Tenants", + Value: shared.OrNone(append(append([]string{}, opts.Tenants.Value...), opts.TenantTags.Value...)), + Source: "chosen", + }) + } + return items +} + +func workerItems(opts *InstallOptions) []shared.Item { + return []shared.Item{ + { + Label: "Worker pools", Value: shared.OrNone(opts.WorkerPools.Value), Source: "chosen", + Edit: func(context.Context) error { + opts.WorkerPools.Value = nil + return sharedWorker.PromptForWorkerPools(opts.WorkerPoolOptions, opts.WorkerPoolFlags) + }, + }, + } +} + +func scriptPodItems(opts *InstallOptions) []shared.Item { + items := []shared.Item{ + { + Label: "Storage class", Value: shared.OrDefault(opts.StorageClass.Value, "(cluster default)"), + Source: storageSource(opts), + Edit: func(context.Context) error { + opts.StorageClass.Value = "" + if len(opts.StorageClasses) == 0 { + return nil + } + return promptForStorageClass(opts) + }, + }, + { + Label: "Access mode", Value: accessModeSummary(opts), Source: accessModeSource(opts), + Edit: func(ctx context.Context) error { + // Answering makes it a choice, so a later change of storage class + // does not quietly take it back. + opts.AccessModeChosen = true + return shared.EditConfirm(opts.Ask, &opts.ReadWriteMany.Value, + "Let script pods run on any node?", + "This asks for a ReadWriteMany volume, which only works with a storage class that serves a shared filesystem.")(ctx) + }, + }, + } + + if opts.PermissionsController || opts.RestrictScriptPods.Value || len(opts.ScriptPodRoles.Value) > 0 { + items = append(items, shared.Item{ + Label: "Permissions", Value: permissionsSummary(opts), Source: permissionsSource(opts), + Edit: func(context.Context) error { + opts.RestrictScriptPods.Value = false + opts.ScriptPodRoles.Value = nil + opts.ScriptPodRules = nil + return promptForScriptPodPermissions(opts) + }, + }) + } + return items +} + +func helmItems(opts *InstallOptions) []shared.Item { + return []shared.Item{ + {Label: "Chart", Value: ChartRef.Ref}, + { + Label: "Chart version", Value: shared.OrDefault(opts.ChartVersion.Value, "latest"), + Edit: shared.EditText(opts.Ask, &opts.ChartVersion.Value, "Chart version (blank for the latest)", + func() string { return opts.ChartVersion.Value }), + }, + { + Label: "Credentials", Value: credentialPlacement(opts), + Edit: shared.EditConfirm(opts.Ask, &opts.InlineSecrets.Value, + "Put the registration credential directly in the Helm values instead of a Kubernetes Secret?", + "A Secret keeps it out of the Helm release and out of any file written with --output-values."), + }, + { + Label: "Timeout", Value: shared.OrDefault(opts.Timeout.Value, octoK8s.DefaultTimeout.String()), + Edit: shared.EditText(opts.Ask, &opts.Timeout.Value, "How long to wait for the release to become ready", + func() string { return opts.Timeout.Value }), + }, + } +} + +func registrationSummary(opts *InstallOptions) string { + return fmt.Sprintf("the agent registers itself as a %s", opts.Mode) +} + +func certificateSummary(opts *InstallOptions) string { + if opts.ServerCertificate.Value == "" { + return "(publicly trusted)" + } + return "supplied" +} + +// targetTagSource calls out a tag Octopus has never seen, because choosing one +// creates it rather than matching anything that exists. +func targetTagSource(opts *InstallOptions) string { + created := opts.newTargetTags() + if len(created) == 0 { + return "chosen" + } + return fmt.Sprintf("%s created when the agent registers", strings.Join(created, ", ")) +} + +// editTenantedParticipation asks only which kinds of deployment the target +// takes part in. Which tenants it serves is left to the target's settings in +// Octopus, which is where the agent's own documentation sends people, and to +// --tenant and --tenant-tag. +func editTenantedParticipation(opts *InstallOptions) func(context.Context) error { + return func(context.Context) error { + selected, err := selectors.SelectOptions(opts.Ask, + "Choose the kind of deployments where this deployment target should be included", + sharedTarget.TenantDeploymentOptions) + if err != nil { + return err + } + opts.TenantedDeploymentMode.Value = selected.Value + return nil + } +} + +func tenantedSummary(opts *InstallOptions) string { + switch opts.TenantedDeploymentMode.Value { + case sharedTarget.Tenanted: + return "tenanted deployments only" + case sharedTarget.TenantedOrUntenanted: + return "tenanted and untenanted deployments" + default: + return "untenanted deployments only" + } +} + +func storageSource(opts *InstallOptions) string { + if opts.StorageClass.Value != "" { + return "chosen" + } + if len(opts.StorageClasses) == 0 { + return "no storage classes are readable in this cluster" + } + return "" +} + +func accessModeSummary(opts *InstallOptions) string { + if opts.ReadWriteMany.Value { + return "ReadWriteMany - script pods run on any node" + } + return "ReadWriteOnce - script pods run on the agent's node" +} + +// accessModeSource names the provisioner the mode was read from, because it is +// worked out rather than asked about. +func accessModeSource(opts *InstallOptions) string { + if opts.AccessModeChosen { + return "chosen" + } + + class, found := opts.resolvedStorageClass() + switch { + case !found: + return "no storage class to read it from" + case class.SupportsReadWriteMany(): + return fmt.Sprintf("%s serves a shared filesystem", class.Provisioner) + default: + return fmt.Sprintf("%s serves one node at a time", class.Provisioner) + } +} + +// permissionsSummary describes the fallback, which is what these values decide. +// What a deployment actually gets can be more than this, whenever a +// WorkloadServiceAccount matches it. +func permissionsSummary(opts *InstallOptions) string { + switch { + case opts.RestrictScriptPods.Value: + return "nothing by default" + case len(opts.ScriptPodRoles.Value) > 0: + return "the rules of " + strings.Join(opts.ScriptPodRoles.Value, ", ") + default: + return "anything in the cluster" + } +} + +func permissionsSource(opts *InstallOptions) string { + switch { + case opts.RestrictScriptPods.Value: + return "the permissions controller grants each deployment what it needs" + case len(opts.ScriptPodRoles.Value) > 0: + return fmt.Sprintf("%d %s copied in now, and not followed afterwards", + len(opts.ScriptPodRules), octoK8s.Pluralise("rule", "rules", len(opts.ScriptPodRules))) + case opts.PermissionsController: + return "the permissions controller can grant less than this per deployment" + default: + return "the chart's own default" + } +} + +func credentialPlacement(opts *InstallOptions) string { + if opts.InlineSecrets.Value { + return "access token in the Helm values" + } + return "access token in a Kubernetes Secret" +} + +// RenderReviewForTest prints the review screen without asking anything. +func RenderReviewForTest(opts *InstallOptions) { + _ = opts.resolveNames() + shared.PrintReview(opts.Out, reviewGroups(opts)) +} diff --git a/pkg/cmd/kubernetes/agent/install/review_test.go b/pkg/cmd/kubernetes/agent/install/review_test.go new file mode 100644 index 00000000..5dc4f9c1 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/review_test.go @@ -0,0 +1,249 @@ +package install_test + +import ( + "bytes" + "context" + "strings" + "testing" + + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/agent/install" + agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/test/testutil" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func reviewOf(t *testing.T, opts *install.InstallOptions) string { + t.Helper() + + out := &bytes.Buffer{} + opts.Out = out + install.RenderReviewForTest(opts) + return out.String() +} + +// Everything the installer worked out has to appear here, because this screen is +// the only place anybody sees it. +func TestReview_ShowsWhatWasDetectedAsWellAsWhatWasChosen(t *testing.T) { + review := reviewOf(t, completedTargetOptions(t)) + + for _, expected := range []string{ + "Kubernetes context", "Cluster address", "Node architectures", + "octopus-agent-production", "production", + "Polling address", pollingAddress, + "Environments", "Target tags", "Default namespace", "Tenanted deployments", + "Storage class", "Access mode", + "Chart", "Chart version", "Credentials", "Timeout", + } { + assert.Contains(t, review, expected) + } +} + +func TestReview_WorkerShowsPoolsRatherThanEnvironments(t *testing.T) { + review := reviewOf(t, completedWorkerOptions(t)) + + assert.Contains(t, review, "Worker pools") + assert.Contains(t, review, "Kubernetes Pool") + assert.NotContains(t, review, "Environments") + assert.NotContains(t, review, "Target tags") +} + +// The token is minted at install time, so the review can only promise what will +// be used - and must never show a credential. +func TestReview_NeverShowsACredential(t *testing.T) { + opts := completedTargetOptions(t) + review := reviewOf(t, opts) + + assert.Contains(t, review, "access token in a Kubernetes Secret") + assert.NotContains(t, review, "eyJhbGciOiJIUzI1NiJ9") +} + +func TestReview_ScriptPodPermissionsOnlyAppearWhenTheyAreAChoice(t *testing.T) { + opts := completedTargetOptions(t) + assert.NotContains(t, reviewOf(t, opts), "Permissions") + + opts.PermissionsController = true + assert.Contains(t, reviewOf(t, opts), "the permissions controller can grant less than this per deployment") +} + +// The review describes the fallback, which is all these values decide: a +// deployment that a WorkloadServiceAccount matches gets that instead. +func TestReview_DescribesEachKindOfScriptPodPermission(t *testing.T) { + opts := completedTargetOptions(t) + opts.PermissionsController = true + + assert.Contains(t, reviewOf(t, opts), "anything in the cluster") + + opts.RestrictScriptPods.Value = true + review := reviewOf(t, opts) + assert.Contains(t, review, "nothing by default") + assert.Contains(t, review, "the permissions controller grants each deployment what it needs") + + opts.RestrictScriptPods.Value = false + opts.ScriptPodRoles.Value = []string{"deployer", "monitoring/reader"} + opts.ScriptPodRules = []any{map[string]any{"verbs": []string{"get"}}} + review = reviewOf(t, opts) + assert.Contains(t, review, "the rules of deployer, monitoring/reader") + assert.Contains(t, review, "1 rule copied in now, and not followed afterwards") +} + +// The access mode is worked out rather than asked about, so the review has to +// say where it came from. +func TestReview_ReportsTheAccessModeAndWhereItCameFrom(t *testing.T) { + opts := completedTargetOptions(t) + review := reviewOf(t, opts) + assert.Contains(t, review, "ReadWriteOnce - script pods run on the agent's node") + assert.Contains(t, review, "kubernetes.io/gce-pd serves one node at a time") + + opts.StorageClass.Value = "filestore" + opts.DeriveAccessModeForTest() + review = reviewOf(t, opts) + assert.Contains(t, review, "ReadWriteMany - script pods run on any node") + assert.Contains(t, review, "filestore.csi.storage.gke.io serves a shared filesystem") + + opts.AccessModeChosen = true + assert.Contains(t, reviewOf(t, opts), "(chosen)") +} + +func TestConfirm_Cancelling(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPrompt("Ready to install?", "", []string{"Install", "Change a setting", "Cancel"}, "Cancel"), + }) + + opts := completedTargetOptions(t) + opts.Ask = asker + + assert.ErrorContains(t, install.Confirm(context.Background(), opts), "cancelled") + checkRemainingPrompts() +} + +// Editing the name has to bring the namespace and release name with it, because +// both are derived from it. +func TestConfirm_EditingTheNameRederivesTheNamespace(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPrompt("Ready to install?", "", []string{"Install", "Change a setting", "Cancel"}, "Change a setting"), + testutil.NewSelectPrompt("Which setting?", "", editableSettings(t), "Octopus: Name"), + testutil.NewInputPrompt("Name", "A short, memorable, unique name for this deployment target.", "Staging"), + testutil.NewSelectPrompt("Ready to install?", "", []string{"Install", "Change a setting", "Cancel"}, "Install"), + }) + + opts := completedTargetOptions(t) + opts.Ask = asker + + require.NoError(t, install.Confirm(context.Background(), opts)) + checkRemainingPrompts() + + assert.Equal(t, "Staging", opts.Name.Value) + assert.Equal(t, "octopus-agent-staging", opts.TargetNamespace) + assert.Equal(t, "staging", opts.TargetRelease) +} + +// editableSettings is the "Which setting?" option list, which follows the review +// groups rather than being written out twice. +func editableSettings(t *testing.T) []string { + t.Helper() + + return []string{ + "Cluster: Namespace", + "Cluster: Helm release", + "Octopus: Name", + "Octopus: Polling address", + "Octopus: Machine policy", + "Octopus: Server certificate", + "Deployment target: Environments", + "Deployment target: Target tags", + "Deployment target: Default namespace", + "Deployment target: Tenanted deployments", + "Script pods: Storage class", + "Script pods: Access mode", + "Helm: Chart version", + "Helm: Credentials", + "Helm: Timeout", + } +} + +// A name that is already a Helm release in this cluster upgrades that release +// rather than adding an agent, and one that is already the other kind of agent +// is the documented way to break both. +func TestReportFindings_ExistingReleaseOfTheOtherKind(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) + require.NoError(t, opts.ResolveWithoutPrompting()) + opts.Installations = []agentK8s.Installation{{ + Release: helm.Release{Name: "production", Namespace: "octopus-agent-production", Chart: "kubernetes-agent", Version: "3.13.3"}, + Name: "Production", + Mode: agentK8s.ModeWorker, + }} + + out := &bytes.Buffer{} + opts.Out = out + install.ReportFindingsForTest(opts) + + assert.Contains(t, out.String(), "is already a worker") + assert.Contains(t, out.String(), "different name") +} + +func TestReportFindings_UpgradingAnExistingAgent(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) + require.NoError(t, opts.ResolveWithoutPrompting()) + opts.Installations = []agentK8s.Installation{{ + Release: helm.Release{Name: "production", Namespace: "octopus-agent-production", Chart: "kubernetes-agent", Version: "3.13.3"}, + Name: "Production", + Mode: agentK8s.ModeDeploymentTarget, + }} + + out := &bytes.Buffer{} + opts.Out = out + install.ReportFindingsForTest(opts) + + assert.Contains(t, out.String(), "Upgrading the existing release") +} + +func TestReportFindings_NameAlreadyRegisteredInOctopus(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) + require.NoError(t, opts.ResolveWithoutPrompting()) + opts.RegisteredCallback = func(string) (bool, error) { return true, nil } + + out := &bytes.Buffer{} + opts.Out = out + install.ReportFindingsForTest(opts) + + assert.Contains(t, out.String(), "already has a deployment target named") + assert.Contains(t, out.String(), "take that one over") +} + +func TestReportFindings_UnsupportedNodeArchitecture(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) + require.NoError(t, opts.ResolveWithoutPrompting()) + opts.NodeArchitectures = []string{"amd64", "ppc64le"} + + out := &bytes.Buffer{} + opts.Out = out + install.ReportFindingsForTest(opts) + + assert.Contains(t, out.String(), "ppc64le") + assert.True(t, strings.Contains(out.String(), "cannot run on")) +} + +// Choosing a tag Octopus has never seen creates it, which the review has to say +// rather than let it look like a match. +func TestReview_NamesTheTargetTagsThatWillBeCreated(t *testing.T) { + opts := completedTargetOptions(t) + opts.KnownTargetTags = []string{"k8s", "web"} + + opts.Roles.Value = []string{"k8s"} + assert.Contains(t, reviewOf(t, opts), "(chosen)") + + opts.Roles.Value = []string{"k8s", "k8s-agent"} + review := reviewOf(t, opts) + assert.Contains(t, review, "k8s, k8s-agent") + assert.Contains(t, review, "k8s-agent created when the agent registers") +} diff --git a/pkg/cmd/kubernetes/gateway/install/commit.go b/pkg/cmd/kubernetes/gateway/install/commit.go index d214213e..2c793317 100644 --- a/pkg/cmd/kubernetes/gateway/install/commit.go +++ b/pkg/cmd/kubernetes/gateway/install/commit.go @@ -8,8 +8,8 @@ import ( "strings" "time" - "github.com/AlecAivazis/survey/v2" "github.com/OctopusDeploy/cli/pkg/argocdgateways" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" "github.com/OctopusDeploy/cli/pkg/output" @@ -32,7 +32,7 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { return err } - if err := opts.checkPermissions(ctx); err != nil { + if err := shared.CheckPermissions(ctx, opts.Dependencies, opts.Cluster, opts.TargetNamespace, opts.DryRun.Value); err != nil { return err } @@ -40,11 +40,11 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { return opts.renderOnly(ctx, values, timeout) } - if err := opts.ensureNamespace(ctx); err != nil { + if err := shared.EnsureNamespace(ctx, opts.Dependencies, opts.Cluster, opts.TargetNamespace); err != nil { return err } - if err := opts.runPreflight(ctx); err != nil { + if err := opts.preflight().Run(ctx); err != nil { return err } @@ -223,131 +223,28 @@ func (opts *InstallOptions) writeValuesFile(values map[string]any) error { return nil } -// checkPermissions runs before anything is created, so a missing permission -// surfaces here rather than halfway through. -func (opts *InstallOptions) checkPermissions(ctx context.Context) error { - denied, err := opts.Cluster.CheckPermissions(ctx, octoK8s.InstallPermissions(opts.TargetNamespace)) - if err != nil { - return err - } - if len(denied) == 0 { - return nil - } - - var b strings.Builder - fmt.Fprintf(&b, "your Kubernetes credentials cannot perform this install in context %q:", opts.Cluster.ContextName) - for _, d := range denied { - fmt.Fprintf(&b, "\n cannot %s - needed to %s", d, d.Description) - } - - // A dry run creates nothing, so this is worth knowing but not worth - // withholding the preview for. - if opts.DryRun.Value { - fmt.Fprintf(opts.Out, "%s %s\n", output.Yellow("!"), b.String()) - return nil - } - return errors.New(b.String()) -} - -func (opts *InstallOptions) ensureNamespace(ctx context.Context) error { - exists, err := opts.Cluster.NamespaceExists(ctx, opts.TargetNamespace) - if err != nil { - return err - } - if exists { - fmt.Fprintf(opts.Out, "Using existing namespace %s\n", output.Cyan(opts.TargetNamespace)) - return nil - } - return opts.Cluster.CreateNamespace(ctx, opts.TargetNamespace) -} - -// runPreflight catches the case where an install succeeds and then never -// connects: the gateway registers over the REST API but runs over gRPC on a -// different port. -func (opts *InstallOptions) runPreflight(ctx context.Context) error { - if opts.SkipPreflight.Value { - return nil - } - - targets := []octoK8s.Target{ - { - Name: "Octopus REST API", - Address: opts.Host, - Remediation: "The gateway registers itself with Octopus over the REST API. " + - "Confirm this address is reachable from inside the cluster.", +func (opts *InstallOptions) preflight() *shared.Preflight { + return &shared.Preflight{ + Dependencies: opts.Dependencies, + CommonFlags: opts.CommonFlags, + Cluster: opts.Cluster, + Namespace: opts.TargetNamespace, + Targets: []octoK8s.Target{ + { + Name: "Octopus REST API", + Address: opts.Host, + Remediation: "The gateway registers itself with Octopus over the REST API. " + + "Confirm this address is reachable from inside the cluster.", + }, + { + Name: "Octopus gRPC endpoint", + Address: opts.OctopusGRPCURL.Value, + Remediation: "The running gateway connects to Octopus over gRPC on a different port to the REST API. " + + "A load balancer, proxy, or firewall that forwards only HTTPS is the usual cause; make sure the gRPC port is forwarded too.", + }, }, - { - Name: "Octopus gRPC endpoint", - Address: opts.OctopusGRPCURL.Value, - Remediation: "The running gateway connects to Octopus over gRPC on a different port to the REST API. " + - "A load balancer, proxy, or firewall that forwards only HTTPS is the usual cause; make sure the gRPC port is forwarded too.", - }, - } - - checks := octoK8s.StaticChecks(targets) - podChecks, err := opts.Cluster.RunPreflight(ctx, octoK8s.PreflightRequest{ - Namespace: opts.TargetNamespace, - Image: opts.PreflightImage.Value, - Targets: targets, - }) - if err != nil { - return err + ProceedHelp: "The gateway is likely to install and then fail to connect.", } - checks = append(checks, podChecks...) - - return opts.confirmPreflight(checks) -} - -func (opts *InstallOptions) printPreflight(checks []octoK8s.Check) int { - if len(checks) == 0 { - return 0 - } - - fmt.Fprintln(opts.Out, "\nConnectivity checks:") - failed := 0 - for _, c := range checks { - switch c.Result { - case octoK8s.CheckPassed: - fmt.Fprintf(opts.Out, " %s %s %s\n", output.Green("✔"), c.Name, output.Dim(c.Detail)) - case octoK8s.CheckSkipped: - fmt.Fprintf(opts.Out, " %s %s %s\n", output.Dim("-"), c.Name, output.Dim(c.Detail)) - default: - failed++ - fmt.Fprintf(opts.Out, " %s %s %s\n", output.Red("✘"), c.Name, c.Detail) - if c.Remediation != "" { - fmt.Fprintf(opts.Out, " %s\n", output.Dim(c.Remediation)) - } - } - } - - return failed -} - -func (opts *InstallOptions) confirmPreflight(checks []octoK8s.Check) error { - failed := opts.printPreflight(checks) - if failed == 0 { - return nil - } - - if opts.NoPrompt { - return fmt.Errorf("%d connectivity %s failed; fix the problems above or pass --%s", - failed, octoK8s.Pluralise("check", "checks", failed), octoK8s.FlagSkipPreflight) - } - - // A check can be wrong: egress policy may allow the real workload's service - // account but not a bare pod. - proceed := false - if err := opts.Ask(&survey.Confirm{ - Message: "Continue with the install anyway?", - Default: false, - Help: "The gateway is likely to install and then fail to connect.", - }, &proceed); err != nil { - return err - } - if !proceed { - return errors.New("install cancelled") - } - return nil } // storeCredentials keeps credentials out of the Helm release values. @@ -410,13 +307,7 @@ func (opts *InstallOptions) renderOnly(ctx context.Context, values map[string]an fmt.Fprintf(opts.Out, "\n%s Rendering only. Nothing will be installed, and the connectivity checks that need a pod in the cluster are skipped.\n", output.Dim("--"+octoK8s.FlagDryRun)) - if !opts.SkipPreflight.Value { - // Report only: there is no install to abandon. - opts.printPreflight(octoK8s.StaticChecks([]octoK8s.Target{ - {Name: "Octopus REST API", Address: opts.Host}, - {Name: "Octopus gRPC endpoint", Address: opts.OctopusGRPCURL.Value}, - })) - } + opts.preflight().ReportStatic() manifest, err := opts.Runner.Render(ctx, helm.InstallSpec{ Chart: opts.chartRef(), diff --git a/pkg/cmd/kubernetes/gateway/install/install.go b/pkg/cmd/kubernetes/gateway/install/install.go index 657c42a8..c0684194 100644 --- a/pkg/cmd/kubernetes/gateway/install/install.go +++ b/pkg/cmd/kubernetes/gateway/install/install.go @@ -6,10 +6,10 @@ import ( "fmt" "strings" - "github.com/AlecAivazis/survey/v2" "github.com/MakeNowJust/heredoc/v2" "github.com/OctopusDeploy/cli/pkg/argocdgateways" "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" "github.com/OctopusDeploy/cli/pkg/constants" "github.com/OctopusDeploy/cli/pkg/factory" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" @@ -216,109 +216,32 @@ func installRun(ctx context.Context, opts *InstallOptions) error { } func (opts *InstallOptions) Discover(ctx context.Context) error { - kubeConfig, err := octoK8s.LoadKubeConfig(opts.KubeConfig.Value) - if err != nil { - return err - } - - for { - err := opts.connectAndDiscover(ctx, kubeConfig) - if err == nil { - return nil - } - - retry, retryErr := opts.ConfirmRetry(kubeConfig, err) - if retryErr != nil { - return retryErr - } - if !retry { - return err - } - } + _, err := opts.connector().Connect(ctx) + return err } -// connectAndDiscover holds everything that talks to the cluster, so a -// credential problem can be fixed and retried as a unit. -func (opts *InstallOptions) connectAndDiscover(ctx context.Context, kubeConfig *octoK8s.KubeConfig) error { - if err := opts.resolveKubeContext(kubeConfig); err != nil { - return err - } - - kubeContext, err := kubeConfig.FindContext(opts.KubeContext.Value) - if err != nil { - return err - } - opts.KubeContextInfo = kubeContext - - cluster, err := octoK8s.Connect(kubeConfig, opts.KubeContext.Value) - if err != nil { - return err - } - opts.Cluster = cluster - - // Building a client is offline, so this is the first call that proves the - // credentials work. Cloud clusters authenticate through a helper such as - // gcloud or aws, which fails here when its session has expired. - version, err := cluster.ServerVersion() - if err != nil { - return err - } - fmt.Fprintf(opts.Out, "Connected to %s %s\n", output.Cyan(opts.KubeContext.Value), output.Dimf("(Kubernetes %s)", version)) - - runner, err := helm.NewRunner(opts.KubeConfig.Value, opts.KubeContext.Value, opts.Out) - if err != nil { - return err +// connector holds the options' own CommonFlags, so a different cluster chosen +// while retrying is seen by the rest of the install. +func (opts *InstallOptions) connector() *shared.Connector { + return &shared.Connector{ + Dependencies: opts.Dependencies, + CommonFlags: opts.CommonFlags, + SelectMessage: "Which cluster should the gateway be installed into?", + Discover: func(ctx context.Context, session *shared.Session) error { + opts.Cluster = session.Cluster + opts.Runner = session.Runner + opts.KubeContextInfo = session.Context + return opts.discoverArgoCD(ctx) + }, + Unrecoverable: func(cause error, kubeConfig *octoK8s.KubeConfig) bool { + // Nothing to retry, and no other cluster to move to. + return errors.As(cause, &argocd.ErrNoInstances{}) && len(kubeConfig.Contexts()) == 1 + }, } - opts.Runner = runner - - return opts.discoverArgoCD(ctx) } -// ConfirmRetry avoids ending the command and discarding everything already -// answered. Expired cloud credentials are the common case, and are usually -// fixed in another terminal in seconds. func (opts *InstallOptions) ConfirmRetry(kubeConfig *octoK8s.KubeConfig, cause error) (bool, error) { - if opts.NoPrompt { - return false, nil - } - // Nothing to retry, and no other cluster to move to. - if errors.As(cause, &argocd.ErrNoInstances{}) && len(kubeConfig.Contexts()) == 1 { - return false, nil - } - - fmt.Fprintf(opts.Out, "\n%s %v\n", output.Red("✘"), cause) - - const ( - tryAgain = "Try again" - pickOther = "Choose a different cluster" - cancel = "Cancel" - ) - - choices := []string{tryAgain} - if len(kubeConfig.Contexts()) > 1 { - choices = append(choices, pickOther) - } - choices = append(choices, cancel) - - answer := "" - if err := opts.Ask(&survey.Select{ - Message: "What would you like to do?", - Options: choices, - Help: "If a cloud credential helper failed, sign in again in another terminal and choose Try again.", - }, &answer); err != nil { - return false, err - } - - switch answer { - case tryAgain: - return true, nil - case pickOther: - // Sends resolveKubeContext back to the prompt. - opts.KubeContext.Value = "" - return true, nil - default: - return false, nil - } + return opts.connector().ConfirmRetry(kubeConfig, cause) } // discoverArgoCD covers both hosting models: Argo CD usually runs in the @@ -369,46 +292,6 @@ func (opts *InstallOptions) discoverArgoCD(ctx context.Context) error { return argocd.ErrNoInstances{} } -// resolveKubeContext always reports the chosen context rather than silently -// assuming one: installing into the wrong cluster is the most expensive mistake -// available here. -func (opts *InstallOptions) resolveKubeContext(kubeConfig *octoK8s.KubeConfig) error { - contexts := kubeConfig.Contexts() - if len(contexts) == 0 { - return errors.New("your kubeconfig does not contain any contexts") - } - - if opts.KubeContext.Value != "" { - if _, err := kubeConfig.FindContext(opts.KubeContext.Value); err != nil { - return err - } - return nil - } - - current, hasCurrent := kubeConfig.CurrentContext() - if opts.NoPrompt { - if !hasCurrent { - return fmt.Errorf("your kubeconfig has no current context, so --%s must be specified", octoK8s.FlagKubeContext) - } - opts.KubeContext.Value = current.Name - return nil - } - - if len(contexts) == 1 { - opts.KubeContext.Value = contexts[0].Name - return nil - } - - selected, err := selectors.Select(opts.Ask, "Which cluster should the gateway be installed into?", - func() ([]octoK8s.Context, error) { return contexts, nil }, - func(c octoK8s.Context) string { return c.Display() }) - if err != nil { - return err - } - opts.KubeContext.Value = selected.Name - return nil -} - func (opts *InstallOptions) validateForAutomation() error { var missing []string if opts.Name.Value == "" { diff --git a/pkg/cmd/kubernetes/gateway/install/review.go b/pkg/cmd/kubernetes/gateway/install/review.go index 90c6a2be..6810ac95 100644 --- a/pkg/cmd/kubernetes/gateway/install/review.go +++ b/pkg/cmd/kubernetes/gateway/install/review.go @@ -2,123 +2,26 @@ package install import ( "context" - "errors" - "fmt" "strings" "github.com/AlecAivazis/survey/v2" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" - "github.com/OctopusDeploy/cli/pkg/output" "github.com/OctopusDeploy/cli/pkg/question" ) -type reviewItem struct { - Label string - Value string - // Source distinguishes a detected value from one that was typed. - Source string - // A nil Edit means the value can only be changed by starting again. - Edit func(context.Context, *InstallOptions) error -} - -type reviewGroup struct { - Title string - Items []reviewItem -} - -// Confirm shows every setting, detected or chosen. Most are worked out rather -// than asked for, which is the point of the wizard, but it also means nobody -// sees them unless they are shown. func Confirm(ctx context.Context, opts *InstallOptions) error { - for { - groups := reviewGroups(opts) - printReview(opts, groups) - - const ( - install = "Install" - change = "Change a setting" - cancel = "Cancel" - ) - - answer := "" - if err := opts.Ask(&survey.Select{ - Message: "Ready to install?", - Options: []string{install, change, cancel}, - }, &answer); err != nil { - return err - } - - switch answer { - case install: - return nil - case cancel: - return errors.New("install cancelled") - } - - if err := editSetting(ctx, opts, groups); err != nil { - return err - } - } -} - -func editSetting(ctx context.Context, opts *InstallOptions, groups []reviewGroup) error { - type editable struct { - label string - edit func(context.Context, *InstallOptions) error + review := &shared.Review{ + Dependencies: opts.Dependencies, + Groups: func() []shared.Group { return reviewGroups(opts) }, + Refresh: opts.resolveNames, } - - var choices []editable - for _, group := range groups { - for _, item := range group.Items { - if item.Edit != nil { - choices = append(choices, editable{label: group.Title + ": " + item.Label, edit: item.Edit}) - } - } - } - - selected, err := question.SelectMap(opts.Ask, "Which setting?", choices, - func(e editable) string { return e.label }) - if err != nil { - return err - } - - if err := selected.edit(ctx, opts); err != nil { - return err - } - - // The namespace and release name follow the instance name unless set - // explicitly, so they need working out again. - return opts.resolveNames() + return review.Confirm(ctx) } -func printReview(opts *InstallOptions, groups []reviewGroup) { - width := 0 - for _, group := range groups { - for _, item := range group.Items { - if len(item.Label) > width { - width = len(item.Label) - } - } - } - - fmt.Fprintf(opts.Out, "\n%s\n", output.Bold("Review the installation")) - for _, group := range groups { - fmt.Fprintf(opts.Out, "\n %s\n", output.Bold(group.Title)) - for _, item := range group.Items { - fmt.Fprintf(opts.Out, " %-*s %s", width, item.Label, output.Cyan(item.Value)) - // An unset value has no source worth claiming. - if item.Source != "" && !strings.HasPrefix(item.Value, "(") { - fmt.Fprintf(opts.Out, " %s", output.Dimf("(%s)", item.Source)) - } - fmt.Fprintln(opts.Out) - } - } - fmt.Fprintln(opts.Out) -} - -func reviewGroups(opts *InstallOptions) []reviewGroup { - return []reviewGroup{ +func reviewGroups(opts *InstallOptions) []shared.Group { + return []shared.Group{ {Title: "Cluster", Items: clusterItems(opts)}, {Title: "Octopus", Items: octopusItems(opts)}, {Title: "Argo CD", Items: argoItems(opts)}, @@ -126,14 +29,14 @@ func reviewGroups(opts *InstallOptions) []reviewGroup { } } -func clusterItems(opts *InstallOptions) []reviewItem { +func clusterItems(opts *InstallOptions) []shared.Item { context := opts.KubeContextInfo source := "current context" if opts.KubeContext.Value != "" && !context.IsCurrent { source = "chosen" } - return []reviewItem{ + return []shared.Item{ { Label: "Kubernetes context", Value: opts.KubeContext.Value, @@ -145,32 +48,34 @@ func clusterItems(opts *InstallOptions) []reviewItem { { Label: "Namespace", Value: opts.TargetNamespace, - Source: derivedOrSet(opts.Namespace.Value, "derived from the name"), - Edit: editText(&opts.Namespace.Value, "Namespace to install into", func(o *InstallOptions) string { return o.TargetNamespace }), + Source: shared.DerivedOrSet(opts.Namespace.Value, "derived from the name"), + Edit: shared.EditText(opts.Ask, &opts.Namespace.Value, "Namespace to install into", + func() string { return opts.TargetNamespace }), }, { Label: "Helm release", Value: opts.TargetRelease, - Source: derivedOrSet(opts.ReleaseName.Value, "derived from the name"), - Edit: editText(&opts.ReleaseName.Value, "Helm release name", func(o *InstallOptions) string { return o.TargetRelease }), + Source: shared.DerivedOrSet(opts.ReleaseName.Value, "derived from the name"), + Edit: shared.EditText(opts.Ask, &opts.ReleaseName.Value, "Helm release name", + func() string { return opts.TargetRelease }), }, } } -func octopusItems(opts *InstallOptions) []reviewItem { - return []reviewItem{ +func octopusItems(opts *InstallOptions) []shared.Item { + return []shared.Item{ { Label: "Name", Value: opts.Name.Value, Source: "chosen", - Edit: func(_ context.Context, o *InstallOptions) error { - o.Name.Value = "" - return question.AskName(o.Ask, "", "Argo CD instance", &o.Name.Value) + Edit: func(context.Context) error { + opts.Name.Value = "" + return question.AskName(opts.Ask, "", "Argo CD instance", &opts.Name.Value) }, }, { Label: "Environments", Value: strings.Join(opts.Environments.Value, ", "), Source: "chosen", - Edit: func(_ context.Context, o *InstallOptions) error { - o.Environments.Value = nil - return promptForEnvironments(o) + Edit: func(context.Context) error { + opts.Environments.Value = nil + return promptForEnvironments(opts) }, }, {Label: "Server", Value: opts.Host, Source: "from your login"}, @@ -178,143 +83,130 @@ func octopusItems(opts *InstallOptions) []reviewItem { {Label: "Space", Value: opts.Space.Name, Source: "from your login"}, { Label: "gRPC address", Value: opts.OctopusGRPCURL.Value, Source: "derived from the server address", - Edit: editText(&opts.OctopusGRPCURL.Value, "Octopus Server gRPC address", - func(o *InstallOptions) string { return o.OctopusGRPCURL.Value }), + Edit: shared.EditText(opts.Ask, &opts.OctopusGRPCURL.Value, "Octopus Server gRPC address", + func() string { return opts.OctopusGRPCURL.Value }), }, } } -func argoItems(opts *InstallOptions) []reviewItem { +func argoItems(opts *InstallOptions) []shared.Item { instance := opts.Instance - items := []reviewItem{ + items := []shared.Item{ {Label: "Instance", Value: instance.Display(), Source: instanceSource(instance)}, { Label: "Address", Value: opts.ArgoCDServerGRPCURL.Value, Source: "found in the cluster", - Edit: editText(&opts.ArgoCDServerGRPCURL.Value, "Argo CD address", - func(o *InstallOptions) string { return o.ArgoCDServerGRPCURL.Value }), + Edit: shared.EditText(opts.Ask, &opts.ArgoCDServerGRPCURL.Value, "Argo CD address", + func() string { return opts.ArgoCDServerGRPCURL.Value }), }, { Label: "Connection", Value: connectionSummary(opts), Source: "matched to the instance", - Edit: editConnection, + Edit: editConnection(opts), }, { - Label: "Web UI", Value: orNotSet(opts.ArgoCDWebUIURL.Value), Source: "found in the cluster", - Edit: editText(&opts.ArgoCDWebUIURL.Value, "Argo CD web UI address (optional)", - func(o *InstallOptions) string { return o.ArgoCDWebUIURL.Value }), + Label: "Web UI", Value: shared.OrNotSet(opts.ArgoCDWebUIURL.Value), Source: "found in the cluster", + Edit: shared.EditText(opts.Ask, &opts.ArgoCDWebUIURL.Value, "Argo CD web UI address (optional)", + func() string { return opts.ArgoCDWebUIURL.Value }), }, } if instance.IsManaged() { - items = append(items, reviewItem{ + items = append(items, shared.Item{ Label: "Project tokens", Value: projectTokenSummary(opts), Source: "AWS caps account tokens at 12 hours", - Edit: func(_ context.Context, o *InstallOptions) error { - o.ArgoCDProjectTokens.Value = nil - return promptForProjectTokens(o) + Edit: func(context.Context) error { + opts.ArgoCDProjectTokens.Value = nil + return promptForProjectTokens(opts) }, }) return items } return append(items, - reviewItem{ + shared.Item{ Label: "Account", Value: opts.ArgoCDAccountName.Value, Source: accountSource(opts), }, - reviewItem{ + shared.Item{ Label: "Token", - Value: maskedToken(opts.ArgoCDToken.Value), + Value: shared.Masked(opts.ArgoCDToken.Value), Source: tokenSource(opts), - Edit: func(_ context.Context, o *InstallOptions) error { - o.ArgoCDToken.Value = "" - return askForTokenValue(o) + Edit: func(context.Context) error { + opts.ArgoCDToken.Value = "" + return askForTokenValue(opts) }, }, ) } -func helmItems(opts *InstallOptions) []reviewItem { - return []reviewItem{ +func helmItems(opts *InstallOptions) []shared.Item { + return []shared.Item{ { Label: "Chart", Value: ChartRef.Ref, Source: "", }, { - Label: "Chart version", Value: orDefault(opts.ChartVersion.Value, "latest"), Source: "", - Edit: editText(&opts.ChartVersion.Value, "Chart version (blank for the latest)", - func(o *InstallOptions) string { return o.ChartVersion.Value }), + Label: "Chart version", Value: shared.OrDefault(opts.ChartVersion.Value, "latest"), Source: "", + Edit: shared.EditText(opts.Ask, &opts.ChartVersion.Value, "Chart version (blank for the latest)", + func() string { return opts.ChartVersion.Value }), }, { Label: "Credentials", Value: credentialPlacement(opts), Source: "", - Edit: func(_ context.Context, o *InstallOptions) error { - return o.Ask(&survey.Confirm{ - Message: "Put credentials directly in the Helm values instead of Kubernetes Secrets?", - Default: o.InlineSecrets.Value, - Help: "Secrets keep credentials out of the Helm release and out of any file written with --output-values.", - }, &o.InlineSecrets.Value) - }, + Edit: shared.EditConfirm(opts.Ask, &opts.InlineSecrets.Value, + "Put credentials directly in the Helm values instead of Kubernetes Secrets?", + "Secrets keep credentials out of the Helm release and out of any file written with --output-values."), }, { - Label: "Timeout", Value: orDefault(opts.Timeout.Value, octoK8s.DefaultTimeout.String()), Source: "", - Edit: editText(&opts.Timeout.Value, "How long to wait for the release to become ready", - func(o *InstallOptions) string { return o.Timeout.Value }), + Label: "Timeout", Value: shared.OrDefault(opts.Timeout.Value, octoK8s.DefaultTimeout.String()), Source: "", + Edit: shared.EditText(opts.Ask, &opts.Timeout.Value, "How long to wait for the release to become ready", + func() string { return opts.Timeout.Value }), }, } } -func editText(target *string, message string, current func(*InstallOptions) string) func(context.Context, *InstallOptions) error { - return func(_ context.Context, o *InstallOptions) error { - value := current(o) - if err := o.Ask(&survey.Input{Message: message, Default: value}, &value); err != nil { - return err - } - *target = strings.TrimSpace(value) - return nil - } -} - // editConnection covers the three settings that are the documented cause of a // gateway that installs and then never connects. -func editConnection(_ context.Context, o *InstallOptions) error { - const ( - plaintext = "Argo CD is served without TLS" - selfSign = "Argo CD uses a certificate that is not publicly trusted" - grpcWeb = "Tunnel gRPC over HTTP/1.1 (needed when a load balancer has no HTTP/2)" - ) +func editConnection(opts *InstallOptions) func(context.Context) error { + return func(context.Context) error { + const ( + plaintext = "Argo CD is served without TLS" + selfSign = "Argo CD uses a certificate that is not publicly trusted" + grpcWeb = "Tunnel gRPC over HTTP/1.1 (needed when a load balancer has no HTTP/2)" + ) - var current []string - if o.Instance.Plaintext { - current = append(current, plaintext) - } - if o.Instance.SelfSignedTLS { - current = append(current, selfSign) - } - if o.useGRPCWeb() { - current = append(current, grpcWeb) - } + var current []string + if opts.Instance.Plaintext { + current = append(current, plaintext) + } + if opts.Instance.SelfSignedTLS { + current = append(current, selfSign) + } + if opts.useGRPCWeb() { + current = append(current, grpcWeb) + } - var chosen []string - prompt := &survey.MultiSelect{ - Message: "How does the gateway reach Argo CD?", - Options: []string{plaintext, selfSign, grpcWeb}, - Default: current, - } - if err := o.Ask(prompt, &chosen); err != nil { - return err - } + var chosen []string + prompt := &survey.MultiSelect{ + Message: "How does the gateway reach Argo CD?", + Options: []string{plaintext, selfSign, grpcWeb}, + Default: current, + } + if err := opts.Ask(prompt, &chosen); err != nil { + return err + } - selected := map[string]bool{} - for _, c := range chosen { - selected[c] = true - } + selected := map[string]bool{} + for _, c := range chosen { + selected[c] = true + } - o.Instance.Plaintext = selected[plaintext] - o.Instance.SelfSignedTLS = selected[selfSign] - o.Instance.GRPCWeb = selected[grpcWeb] - o.ArgoCDGRPCWeb.Value = selected[grpcWeb] - return nil + opts.Instance.Plaintext = selected[plaintext] + opts.Instance.SelfSignedTLS = selected[selfSign] + opts.Instance.GRPCWeb = selected[grpcWeb] + opts.ArgoCDGRPCWeb.Value = selected[grpcWeb] + return nil + } } func connectionSummary(opts *InstallOptions) string { @@ -355,7 +247,7 @@ func tokenSource(opts *InstallOptions) string { func projectTokenSummary(opts *InstallOptions) string { tokens, err := opts.ProjectTokens() - if err != nil || len(tokens) == 0 { + if err != nil { return "(none)" } @@ -363,7 +255,7 @@ func projectTokenSummary(opts *InstallOptions) string { for _, t := range tokens { projects = append(projects, t.Project) } - return strings.Join(projects, ", ") + return shared.OrNone(projects) } func credentialPlacement(opts *InstallOptions) string { @@ -373,32 +265,7 @@ func credentialPlacement(opts *InstallOptions) string { return "Argo CD token in a Kubernetes Secret" } -func maskedToken(token string) string { - if token == "" { - return "(not set)" - } - return "***" -} - -func derivedOrSet(explicit, derivedDescription string) string { - if explicit != "" { - return "set" - } - return derivedDescription -} - -func orNotSet(value string) string { - return orDefault(value, "(not set)") -} - -func orDefault(value, fallback string) string { - if strings.TrimSpace(value) == "" { - return fallback - } - return value -} - func RenderReviewForDemo(opts *InstallOptions) { _ = opts.resolveNames() - printReview(opts, reviewGroups(opts)) + shared.PrintReview(opts.Out, reviewGroups(opts)) } diff --git a/pkg/cmd/kubernetes/install/install.go b/pkg/cmd/kubernetes/install/install.go index 2f1c82c1..2d52c785 100644 --- a/pkg/cmd/kubernetes/install/install.go +++ b/pkg/cmd/kubernetes/install/install.go @@ -6,7 +6,9 @@ import ( "github.com/MakeNowJust/heredoc/v2" "github.com/OctopusDeploy/cli/pkg/cmd" + agentInstall "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/agent/install" gatewayInstall "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway/install" + permissionsControllerInstall "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/permissionscontroller/install" "github.com/OctopusDeploy/cli/pkg/constants" "github.com/OctopusDeploy/cli/pkg/factory" "github.com/OctopusDeploy/cli/pkg/question" @@ -23,6 +25,20 @@ type component struct { func components() []component { return []component{ + { + display: "Kubernetes agent - run Kubernetes deployments from inside the cluster", + cmdPath: constants.ExecutableName + " kubernetes agent install", + install: func(f factory.Factory, dependencies *cmd.Dependencies, cmdPath string) error { + return agentInstall.Run(f, cmd.NewDependenciesFromExisting(dependencies, cmdPath)) + }, + }, + { + display: "Kubernetes worker - run Octopus steps in the cluster, one pod per task", + cmdPath: constants.ExecutableName + " kubernetes worker install", + install: func(f factory.Factory, dependencies *cmd.Dependencies, cmdPath string) error { + return agentInstall.RunWorker(f, cmd.NewDependenciesFromExisting(dependencies, cmdPath)) + }, + }, { display: "Argo CD gateway - connect an Argo CD instance to Octopus", cmdPath: constants.ExecutableName + " kubernetes gateway install", @@ -30,6 +46,13 @@ func components() []component { return gatewayInstall.Run(f, cmd.NewDependenciesFromExisting(dependencies, cmdPath)) }, }, + { + display: "Permissions controller - scope what an agent's script pods are allowed to do", + cmdPath: constants.ExecutableName + " kubernetes permissions-controller install", + install: func(f factory.Factory, dependencies *cmd.Dependencies, cmdPath string) error { + return permissionsControllerInstall.Run(f, cmd.NewDependenciesFromExisting(dependencies, cmdPath)) + }, + }, } } diff --git a/pkg/cmd/kubernetes/kubernetes.go b/pkg/cmd/kubernetes/kubernetes.go index 5af3d087..08e06a16 100644 --- a/pkg/cmd/kubernetes/kubernetes.go +++ b/pkg/cmd/kubernetes/kubernetes.go @@ -2,8 +2,11 @@ package kubernetes import ( "github.com/MakeNowJust/heredoc/v2" + cmdAgent "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/agent" cmdGateway "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway" cmdInstall "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/install" + cmdPermissionsController "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/permissionscontroller" + cmdWorker "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/worker" "github.com/OctopusDeploy/cli/pkg/constants" "github.com/OctopusDeploy/cli/pkg/constants/annotations" "github.com/OctopusDeploy/cli/pkg/factory" @@ -25,7 +28,10 @@ func NewCmdKubernetes(f factory.Factory) *cobra.Command { } cmd.AddCommand(cmdInstall.NewCmdInstall(f)) + cmd.AddCommand(cmdAgent.NewCmdAgent(f)) + cmd.AddCommand(cmdWorker.NewCmdWorker(f)) cmd.AddCommand(cmdGateway.NewCmdGateway(f)) + cmd.AddCommand(cmdPermissionsController.NewCmdPermissionsController(f)) return cmd } diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/commit.go b/pkg/cmd/kubernetes/permissionscontroller/install/commit.go new file mode 100644 index 00000000..f6ca073b --- /dev/null +++ b/pkg/cmd/kubernetes/permissionscontroller/install/commit.go @@ -0,0 +1,290 @@ +package install + +import ( + "context" + "errors" + "fmt" + "os" + "strings" + "time" + + "github.com/AlecAivazis/survey/v2" + "github.com/MakeNowJust/heredoc/v2" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/util/flag" + "sigs.k8s.io/yaml" +) + +func (opts *InstallOptions) Commit(ctx context.Context) error { + timeout, err := opts.ResolveTimeout() + if err != nil { + return err + } + + values := opts.BuildValues() + + if err := opts.writeValuesFile(values); err != nil { + return err + } + + if err := shared.CheckPermissions(ctx, opts.Dependencies, opts.Cluster, opts.TargetNamespace, opts.DryRun.Value); err != nil { + return err + } + + if err := opts.confirmPrerequisites(); err != nil { + return err + } + + if opts.DryRun.Value { + return opts.renderOnly(ctx, values, timeout) + } + + if err := shared.EnsureNamespace(ctx, opts.Dependencies, opts.Cluster, opts.TargetNamespace); err != nil { + return err + } + + fmt.Fprintf(opts.Out, "\nInstalling the permissions controller into %s...\n", output.Cyan(opts.TargetNamespace)) + + release, err := opts.Runner.Install(ctx, helm.InstallSpec{ + Chart: opts.chartRef(), + ReleaseName: opts.TargetRelease, + Namespace: opts.TargetNamespace, + Values: values, + Atomic: opts.Atomic.Value, + Wait: opts.Wait.Value, + Timeout: timeout, + }) + if err != nil { + return err + } + + opts.reportSuccess(release) + return nil +} + +// BuildValues sets only what was chosen, leaving everything else at the chart's +// own defaults so a later chart version is free to change them. +func (opts *InstallOptions) BuildValues() map[string]any { + values := map[string]any{ + "certManager": map[string]any{"enable": opts.CertManager.Value}, + "rbac": map[string]any{"namespaced": opts.NamespacedRBAC.Value}, + } + + // envOverrides is the chart's own hook for replacing a single variable, which + // setting manager.env would not do - it is a list, so it replaces the lot. + overrides := map[string]any{} + if len(opts.TargetNamespaces.Value) > 0 { + overrides["TARGET_NAMESPACES"] = strings.Join(opts.TargetNamespaces.Value, ",") + } + if opts.TargetNamespaceRegex.Value != "" { + overrides["TARGET_NAMESPACE_REGEX"] = opts.TargetNamespaceRegex.Value + } + if len(overrides) > 0 { + values["manager"] = map[string]any{"envOverrides": overrides} + } + + return values +} + +func (opts *InstallOptions) writeValuesFile(values map[string]any) error { + if opts.OutputValues.Value == "" { + return nil + } + + encoded, err := yaml.Marshal(values) + if err != nil { + return fmt.Errorf("could not encode the Helm values: %w", err) + } + if err := os.WriteFile(opts.OutputValues.Value, encoded, 0o600); err != nil { + return fmt.Errorf("could not write %s: %w", opts.OutputValues.Value, err) + } + + fmt.Fprintf(opts.Out, "Wrote Helm values to %s\n", output.Cyan(opts.OutputValues.Value)) + return nil +} + +// PrerequisiteChecks cover what the controller needs from the cluster rather +// than from the network. It makes no outbound connection, so unlike the other +// installers there is nothing to dial and no check pod to start. +func (opts *InstallOptions) PrerequisiteChecks() []octoK8s.Check { + certManager := octoK8s.Check{Name: "cert-manager", Result: octoK8s.CheckPassed, Detail: "installed"} + switch { + case opts.CertManagerPresent: + case !opts.CertManager.Value: + certManager.Result = octoK8s.CheckSkipped + certManager.Detail = "not installed, and the chart has been told not to use it" + default: + certManager.Result = octoK8s.CheckFailed + certManager.Detail = "not installed" + certManager.Remediation = fmt.Sprintf( + "The controller's mutating admission webhook needs a certificate. Install cert-manager, or pass --%s=false "+ + "if you are supplying the certificate another way.", FlagCertManager) + } + + agentCheck := octoK8s.Check{Name: "Kubernetes agents", Result: octoK8s.CheckPassed} + if len(opts.Agents) == 0 { + // Not a failure: the docs sanction installing the controller first, and + // it simply does nothing until an agent turns up. + agentCheck.Result = octoK8s.CheckSkipped + agentCheck.Detail = fmt.Sprintf("none installed; the controller does nothing until an agent %s or newer arrives", MinimumAgentVersion) + } else { + agentCheck.Detail = fmt.Sprintf("%d found", len(opts.Agents)) + } + + return []octoK8s.Check{certManager, agentCheck} +} + +func (opts *InstallOptions) confirmPrerequisites() error { + if opts.SkipPreflight.Value { + return nil + } + + failed := shared.PrintChecks(opts.Out, "Prerequisites", opts.PrerequisiteChecks()) + if failed == 0 { + return nil + } + + // A dry run creates nothing, so an unmet prerequisite is worth reporting but + // not worth withholding the preview for. + if opts.DryRun.Value { + return nil + } + + if opts.NoPrompt { + return fmt.Errorf("%d %s not met; fix the problems above or pass --%s", + failed, octoK8s.Pluralise("prerequisite was", "prerequisites were", failed), octoK8s.FlagSkipPreflight) + } + + proceed := false + if err := opts.Ask(&survey.Confirm{ + Message: "Continue with the install anyway?", + Default: false, + Help: "The controller is likely to install and then be unable to do its job.", + }, &proceed); err != nil { + return err + } + if !proceed { + return errors.New("install cancelled") + } + return nil +} + +func (opts *InstallOptions) renderOnly(ctx context.Context, values map[string]any, timeout time.Duration) error { + fmt.Fprintf(opts.Out, "\n%s Rendering only. Nothing will be installed.\n", output.Dim("--"+octoK8s.FlagDryRun)) + + manifest, err := opts.Runner.Render(ctx, helm.InstallSpec{ + Chart: opts.chartRef(), + ReleaseName: opts.TargetRelease, + Namespace: opts.TargetNamespace, + Values: values, + Timeout: timeout, + }) + if err != nil { + return err + } + + fmt.Fprintln(opts.Out, manifest) + return nil +} + +func (opts *InstallOptions) reportSuccess(release helm.Release) { + fmt.Fprintf(opts.Out, "\n%s Installed %s %s as release %s in namespace %s.\n", + output.Green("✔"), release.Chart, release.Version, + output.Cyan(release.Name), output.Cyan(release.Namespace)) + + opts.PrintNextSteps() + + if opts.NoPrompt { + return + } + + generatable := []flag.Generatable{ + opts.TargetNamespaces, opts.TargetNamespaceRegex, opts.NamespacedRBAC, + negated{name: FlagCertManager, off: !opts.CertManager.Value}, + } + generatable = append(generatable, opts.CommonFlags.Generatable()...) + + autoCmd := flag.GenerateAutomationCmd(opts.CmdPath, opts.GetSpaceNameOrEmpty(), generatable...) + fmt.Fprintf(opts.Out, "\nAutomation Command: %s\n", autoCmd) +} + +// PrintNextSteps exists because the controller changes nothing on its own: +// deployments carry on using the agent's default script pod permissions until a +// WorkloadServiceAccount matches them, and until each agent stops granting +// those defaults cluster-wide. +func (opts *InstallOptions) PrintNextSteps() { + fmt.Fprintf(opts.Out, "\n%s\n", output.Bold("Next steps")) + + fmt.Fprintf(opts.Out, "\n Create a %s in each namespace you deploy to, scoped to the deployments it applies\n"+ + " to and naming the permissions they get:\n\n", output.Cyan("WorkloadServiceAccount")) + fmt.Fprint(opts.Out, output.Dim(heredoc.Doc(` + apiVersion: agent.octopus.com/v1beta1 + kind: WorkloadServiceAccount + metadata: + name: sample-wsa + namespace: your-application-namespace + spec: + scope: + spaces: [default] + projects: [guestbook] + environments: [dev-a, dev-b] + permissions: + permissions: + - verbs: ["*"] + apiGroups: ["*"] + resources: ["*"] + `))) + + opts.printAgentRestrictions() +} + +func (opts *InstallOptions) printAgentRestrictions() { + unrestricted := make([]agent.Installation, 0, len(opts.Agents)) + for _, installation := range opts.Agents { + if installation.ScriptPodClusterRole { + unrestricted = append(unrestricted, installation) + } + } + if len(unrestricted) == 0 { + return + } + + fmt.Fprintf(opts.Out, "\n A deployment with no matching WorkloadServiceAccount falls back to the agent's default\n"+ + " script pod permissions, which %s still grant across the cluster. Run this to take those\n"+ + " defaults away, so an unmatched deployment fails instead:\n\n", + octoK8s.Pluralise("this agent", "these agents", len(unrestricted))) + + for _, installation := range unrestricted { + fmt.Fprintf(opts.Out, " %s\n", output.Dimf("# %s", installation.Name)) + fmt.Fprintf(opts.Out, " %s\n\n", output.Cyan(agentRestrictCommand(installation))) + } +} + +func agentRestrictCommand(installation agent.Installation) string { + return fmt.Sprintf("helm upgrade --install --atomic --create-namespace --namespace %s --reset-then-reuse-values "+ + "--set scriptPods.serviceAccount.clusterRole.enabled=\"false\" %s %s", + installation.Release.Namespace, installation.Release.Name, AgentChartRef) +} + +// negated renders a flag that defaults to on. GenerateAutomationCmd emits a bool +// flag only when it is true, so turning one off has to be spelled out. +type negated struct { + name string + off bool +} + +func (n negated) GetName() string { return n.name + "=false" } +func (n negated) GetValue() any { return n.off } +func (n negated) IsSecure() bool { return false } + +func (opts *InstallOptions) ReportSuccessForTest(release helm.Release) { + opts.reportSuccess(release) +} + +func (opts *InstallOptions) ConfirmPrerequisitesForTest() error { + return opts.confirmPrerequisites() +} diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/install.go b/pkg/cmd/kubernetes/permissionscontroller/install/install.go new file mode 100644 index 00000000..0069093d --- /dev/null +++ b/pkg/cmd/kubernetes/permissionscontroller/install/install.go @@ -0,0 +1,313 @@ +package install + +import ( + "context" + "fmt" + "sort" + "strings" + + "github.com/MakeNowJust/heredoc/v2" + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" + "github.com/OctopusDeploy/cli/pkg/constants" + "github.com/OctopusDeploy/cli/pkg/factory" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/util/flag" + "github.com/spf13/cobra" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/octopus-permissions-controller-chart"} + +// ChartName is the chart's own name, which is how an existing release is +// recognised whatever it was named. +const ChartName = "octopus-permissions-controller-chart" + +// Only one controller runs per cluster, so there is nothing to derive a release +// name from. +const DefaultReleaseName = "octopus-permissions-controller" + +// MinimumAgentVersion is the first agent release whose script pods ask the +// controller which service account to run as. An older agent ignores it. +const MinimumAgentVersion = "v2.28.1" + +// AgentChartRef is printed rather than installed: restricting an agent's script +// pods changes a release this command does not own. +const AgentChartRef = "oci://registry-1.docker.io/octopusdeploy/kubernetes-agent" + +const ( + FlagTargetNamespace = "target-namespace" + FlagTargetNamespaceRegex = "target-namespace-regex" + FlagCertManager = "cert-manager" + FlagNamespacedRBAC = "namespaced-rbac" +) + +type InstallFlags struct { + TargetNamespaces *flag.Flag[[]string] + TargetNamespaceRegex *flag.Flag[string] + CertManager *flag.Flag[bool] + NamespacedRBAC *flag.Flag[bool] + + *octoK8s.CommonFlags +} + +func NewInstallFlags() *InstallFlags { + flags := &InstallFlags{ + TargetNamespaces: flag.New[[]string](FlagTargetNamespace, false), + TargetNamespaceRegex: flag.New[string](FlagTargetNamespaceRegex, false), + CertManager: flag.New[bool](FlagCertManager, false), + NamespacedRBAC: flag.New[bool](FlagNamespacedRBAC, false), + CommonFlags: octoK8s.NewCommonFlags(), + } + // Set here as well as on the cobra flag, because the `kubernetes install` + // wizard builds these without cobra ever parsing a command line. + flags.CertManager.Value = true + return flags +} + +type InstallOptions struct { + *InstallFlags + *cmd.Dependencies + + // These read the cluster during Discover. Injected so the prompt, review and + // commit flows can be tested without one. + CertManagerPresentCallback func() (bool, error) + ControllerPresentCallback func() (bool, error) + ExistingReleasesCallback func() ([]helm.Release, error) + AgentsCallback func() ([]agent.Installation, error) + NamespacesCallback func(ctx context.Context) ([]string, error) + + // Populated by Discover before prompting. Exported so tests can drive the + // prompt flow against a fake cluster. + Cluster *octoK8s.Cluster + Runner *helm.Runner + KubeContextInfo octoK8s.Context + + CertManagerPresent bool + // ControllerPresent is read from the custom resources, which the chart keeps + // when it is uninstalled, so it can be true with no release behind it. + ControllerPresent bool + ExistingRelease *helm.Release + Agents []agent.Installation + + TargetNamespace string + TargetRelease string +} + +func NewInstallOptions(installFlags *InstallFlags, dependencies *cmd.Dependencies) *InstallOptions { + opts := &InstallOptions{ + InstallFlags: installFlags, + Dependencies: dependencies, + } + + opts.CertManagerPresentCallback = func() (bool, error) { return agent.CertManagerPresent(opts.Cluster) } + opts.ControllerPresentCallback = func() (bool, error) { return agent.PermissionsControllerPresent(opts.Cluster) } + opts.ExistingReleasesCallback = func() ([]helm.Release, error) { return opts.Runner.FindByChart(ChartName) } + opts.AgentsCallback = func() ([]agent.Installation, error) { return agent.Installations(opts.Runner) } + opts.NamespacesCallback = func(ctx context.Context) ([]string, error) { return listNamespaces(ctx, opts.Cluster) } + + return opts +} + +func NewCmdInstall(f factory.Factory) *cobra.Command { + installFlags := NewInstallFlags() + + command := &cobra.Command{ + Use: "install", + Short: "Install the Octopus permissions controller", + Long: heredoc.Docf(` + Install the Octopus permissions controller into a Kubernetes cluster. + + The controller decides which service account a Kubernetes agent's script pods run as, + matching each deployment against the WorkloadServiceAccount resources in the namespace + it is deploying to. It runs entirely inside the cluster and never contacts Octopus. + + One controller serves the whole cluster. It needs cert-manager for its admission + webhook's certificate, and Kubernetes agent %s or newer to have any effect. + `, MinimumAgentVersion), + Example: heredoc.Docf(` + $ %[1]s kubernetes permissions-controller install + $ %[1]s kubernetes permissions-controller install --target-namespace my-app --no-prompt + $ %[1]s kubernetes permissions-controller install --target-namespace-regex '^team-.*$' --dry-run + `, constants.ExecutableName), + RunE: func(c *cobra.Command, _ []string) error { + // The permissions controller never talks to Octopus, so this command + // works without a login. + dependencies := &cmd.Dependencies{ + Ask: f.Ask, + CmdPath: c.CommandPath(), + Out: c.OutOrStdout(), + NoPrompt: !f.IsPromptEnabled(), + } + return installRun(c.Context(), NewInstallOptions(installFlags, dependencies)) + }, + } + + flags := command.Flags() + flags.SortFlags = false + flags.StringArrayVar(&installFlags.TargetNamespaces.Value, FlagTargetNamespace, nil, + "Namespace the controller manages permissions in. Repeat for more than one. Defaults to every namespace.") + flags.StringVar(&installFlags.TargetNamespaceRegex.Value, FlagTargetNamespaceRegex, "", + "Regular expression matched against namespace names, for managing namespaces that do not exist yet.") + flags.BoolVar(&installFlags.CertManager.Value, FlagCertManager, true, + "Let cert-manager issue the certificate the controller's mutating admission webhook needs. Turn off only if you are supplying it yourself.") + flags.BoolVar(&installFlags.NamespacedRBAC.Value, FlagNamespacedRBAC, false, + "Give the controller permissions in its own namespace only, instead of across the cluster.") + octoK8s.RegisterCommonFlags(command, installFlags.CommonFlags) + describeCommonFlags(command) + + return command +} + +// describeCommonFlags corrects the shared help for a component that has no name +// to derive anything from, and makes no outbound connection to check. +func describeCommonFlags(command *cobra.Command) { + flags := command.Flags() + flags.Lookup(octoK8s.FlagNamespace).Usage = fmt.Sprintf("The namespace to install into. Defaults to %s.", octoK8s.PermissionsControllerNamespace) + flags.Lookup(octoK8s.FlagReleaseName).Usage = fmt.Sprintf("The Helm release name. Defaults to %s.", DefaultReleaseName) + flags.Lookup(octoK8s.FlagSkipPreflight).Usage = "Skip the prerequisite checks that run before installing." + _ = flags.MarkHidden(octoK8s.FlagPreflightImage) +} + +// Run installs the controller using an existing set of dependencies. The +// `kubernetes install` wizard uses this to hand off after the user picks a +// component, so the two entry points share one implementation. +func Run(_ factory.Factory, dependencies *cmd.Dependencies) error { + return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies)) +} + +func installRun(ctx context.Context, opts *InstallOptions) error { + if ctx == nil { + ctx = context.Background() + } + + if err := opts.Discover(ctx); err != nil { + return err + } + + if opts.NoPrompt { + // Nothing is mandatory here: the controller has no name, no credential, + // and nothing to register with. + if err := opts.ResolveWithoutPrompting(); err != nil { + return err + } + } else { + if err := PromptMissing(ctx, opts); err != nil { + return err + } + // Most of this was worked out rather than asked for, so show all of it + // before anything is created. + if err := Confirm(ctx, opts); err != nil { + return err + } + } + + return opts.Commit(ctx) +} + +func (opts *InstallOptions) Discover(ctx context.Context) error { + connector := &shared.Connector{ + Dependencies: opts.Dependencies, + CommonFlags: opts.CommonFlags, + SelectMessage: "Which cluster should the permissions controller be installed into?", + Discover: opts.discover, + } + + session, err := connector.Connect(ctx) + if err != nil { + return err + } + + opts.Cluster = session.Cluster + opts.Runner = session.Runner + opts.KubeContextInfo = session.Context + return nil +} + +// discover runs inside the connector's retry loop, so it sets what the +// callbacks read from before using them. +func (opts *InstallOptions) discover(_ context.Context, session *shared.Session) error { + opts.Cluster = session.Cluster + opts.Runner = session.Runner + opts.KubeContextInfo = session.Context + + certManager, err := opts.CertManagerPresentCallback() + if err != nil { + return err + } + opts.CertManagerPresent = certManager + + controller, err := opts.ControllerPresentCallback() + if err != nil { + return err + } + opts.ControllerPresent = controller + + releases, err := opts.ExistingReleasesCallback() + if err != nil { + return err + } + if len(releases) > 0 { + opts.ExistingRelease = &releases[0] + } + + agents, err := opts.AgentsCallback() + if err != nil { + return err + } + opts.Agents = agents + + return nil +} + +// ResolveWithoutPrompting has only names to work out. Nothing else is +// mandatory: the controller has no name of its own, no credential, and nothing +// to register with. The prerequisite checks in Commit are what stop an install +// that cannot work. +func (opts *InstallOptions) ResolveWithoutPrompting() error { + opts.resolveNames() + return nil +} + +// resolveNames adopts an existing controller's release, so this install upgrades +// it rather than standing a second one up beside it. +func (opts *InstallOptions) resolveNames() { + namespace, release := octoK8s.PermissionsControllerNamespace, DefaultReleaseName + if opts.ExistingRelease != nil { + namespace, release = opts.ExistingRelease.Namespace, opts.ExistingRelease.Name + } + + opts.TargetNamespace = shared.OrDefault(opts.Namespace.Value, namespace) + opts.TargetRelease = shared.OrDefault(opts.ReleaseName.Value, release) +} + +func (opts *InstallOptions) chartRef() helm.ChartRef { + ref := ChartRef + ref.Version = opts.ChartVersion.Value + return ref +} + +// listNamespaces leaves out the kube-* namespaces, which hold the control plane +// and never run a script pod. +func listNamespaces(ctx context.Context, cluster *octoK8s.Cluster) ([]string, error) { + list, err := cluster.Clientset.CoreV1().Namespaces().List(ctx, metav1.ListOptions{}) + if err != nil { + return nil, fmt.Errorf("could not list the cluster's namespaces: %w", err) + } + + names := make([]string, 0, len(list.Items)) + for _, item := range list.Items { + if strings.HasPrefix(item.Name, "kube-") { + continue + } + names = append(names, item.Name) + } + sort.Strings(names) + return names, nil +} + +func (opts *InstallOptions) ResolveNamesForTest() { + opts.resolveNames() +} diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/install_test.go b/pkg/cmd/kubernetes/permissionscontroller/install/install_test.go new file mode 100644 index 00000000..cb31d524 --- /dev/null +++ b/pkg/cmd/kubernetes/permissionscontroller/install/install_test.go @@ -0,0 +1,486 @@ +package install_test + +import ( + "bytes" + "context" + "testing" + + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/permissionscontroller/install" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/question" + "github.com/OctopusDeploy/cli/test/testutil" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +const namespaceQuestion = "Which namespaces should the controller manage permissions in?" + +const namespaceHelp = "Outside these namespaces the agent's own default script pod permissions apply, " + + "and the controller does nothing." + +var namespaceOptions = []string{"Every namespace", "Only namespaces I choose", "Namespaces matching a pattern"} + +// clusterNamespaces is what the cluster reports, minus the kube-* namespaces the +// installer filters out. +var clusterNamespaces = []string{"default", "my-app", "octopus-agent-production"} + +func agentInstallation(name, namespace string, mode agent.Mode, clusterRole bool) agent.Installation { + return agent.Installation{ + Release: helm.Release{Name: name, Namespace: namespace, Chart: agent.ChartName, Version: "2.30.0"}, + Name: name, + Mode: mode, + ScriptPodClusterRole: clusterRole, + } +} + +// newOptions starts from a cluster that already has cert-manager and one agent, +// which is what the prerequisites ask for and so asks the fewest questions. +func newOptions(t *testing.T, flags *install.InstallFlags, asker question.Asker) (*install.InstallOptions, *bytes.Buffer) { + t.Helper() + + out := &bytes.Buffer{} + opts := &install.InstallOptions{ + InstallFlags: flags, + Dependencies: &cmd.Dependencies{Ask: asker, Out: out, CmdPath: "octopus kubernetes permissions-controller install"}, + CertManagerPresent: true, + Agents: []agent.Installation{agentInstallation("production", "octopus-agent-production", agent.ModeDeploymentTarget, true)}, + KubeContextInfo: octoK8s.Context{Name: "colima-k8s", Server: "https://192.168.64.4:52409", IsCurrent: true}, + } + opts.NamespacesCallback = func(context.Context) ([]string, error) { return clusterNamespaces, nil } + return opts, out +} + +func TestPromptMissing_NothingSupplied(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPromptWithDefault(namespaceQuestion, namespaceHelp, namespaceOptions, + "Every namespace", "Every namespace"), + }) + + flags := install.NewInstallFlags() + opts, _ := newOptions(t, flags, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Empty(t, flags.TargetNamespaces.Value, "every namespace is the chart's own default, so nothing is set") + assert.Empty(t, flags.TargetNamespaceRegex.Value) + assert.True(t, flags.CertManager.Value) + assert.False(t, flags.NamespacedRBAC.Value) + + assert.Equal(t, octoK8s.PermissionsControllerNamespace, opts.TargetNamespace) + assert.Equal(t, "octopus-permissions-controller", opts.TargetRelease) +} + +func TestPromptMissing_ChoosingNamespacesOffersTheOnesInTheCluster(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPromptWithDefault(namespaceQuestion, namespaceHelp, namespaceOptions, + "Every namespace", "Only namespaces I choose"), + testutil.NewMultiSelectPrompt("Which namespaces?", "", clusterNamespaces, []string{"my-app", "default"}), + }) + + flags := install.NewInstallFlags() + opts, _ := newOptions(t, flags, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Equal(t, []string{"my-app", "default"}, flags.TargetNamespaces.Value) +} + +func TestPromptMissing_PatternIsAskedForAsAnExpression(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPromptWithDefault(namespaceQuestion, namespaceHelp, namespaceOptions, + "Every namespace", "Namespaces matching a pattern"), + testutil.NewInputPrompt("Namespace pattern", + "A regular expression matched against namespace names, which also covers namespaces that do not exist yet.", + "^team-.*$"), + }) + + flags := install.NewInstallFlags() + opts, _ := newOptions(t, flags, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Equal(t, "^team-.*$", flags.TargetNamespaceRegex.Value) + assert.Empty(t, flags.TargetNamespaces.Value) +} + +func TestPromptMissing_AllOptionsSupplied(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.TargetNamespaces.Value = []string{"my-app"} + flags.NamespacedRBAC.Value = true + + opts, _ := newOptions(t, flags, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() +} + +// A namespace pattern is an answer to the same question, so being given one must +// not lead to being asked it again. +func TestPromptMissing_PatternFlagSuppressesTheNamespaceQuestion(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.TargetNamespaceRegex.Value = "^team-.*$" + + opts, _ := newOptions(t, flags, asker) + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() +} + +func TestPromptMissing_WithoutCertManagerOffersToCarryOn(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewConfirmPromptWithDefault("Install anyway, and supply the webhook certificate yourself?", + "Answering no cancels the install, so you can install cert-manager first and start again.", true, false), + testutil.NewSelectPromptWithDefault(namespaceQuestion, namespaceHelp, namespaceOptions, + "Every namespace", "Every namespace"), + }) + + flags := install.NewInstallFlags() + opts, out := newOptions(t, flags, asker) + opts.CertManagerPresent = false + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.False(t, flags.CertManager.Value, "carrying on means the chart must not be told to use cert-manager") + assert.Contains(t, out.String(), "cert-manager is not installed in this cluster") +} + +func TestPromptMissing_WithoutCertManagerCanBeCancelled(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewConfirmPromptWithDefault("Install anyway, and supply the webhook certificate yourself?", + "Answering no cancels the install, so you can install cert-manager first and start again.", false, false), + }) + + flags := install.NewInstallFlags() + opts, _ := newOptions(t, flags, asker) + opts.CertManagerPresent = false + + assert.EqualError(t, install.PromptMissing(context.Background(), opts), "install cancelled") +} + +func TestPromptMissing_ReportsWhatIsAlreadyInTheCluster(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPromptWithDefault(namespaceQuestion, namespaceHelp, namespaceOptions, + "Every namespace", "Every namespace"), + }) + + flags := install.NewInstallFlags() + opts, out := newOptions(t, flags, asker) + opts.ExistingRelease = &helm.Release{ + Name: "octopus-permissions-controller", Namespace: "octopus-permissions-controller-system", Version: "1.2.0", + } + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + + assert.Contains(t, out.String(), "already installed") + assert.Contains(t, out.String(), "This install upgrades it") + assert.Contains(t, out.String(), "production", "the agent it will act on is worth knowing about") + assert.Contains(t, out.String(), "octopus-agent-production") +} + +func TestPromptMissing_SaysWhenThereIsNoAgentToActOn(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewSelectPromptWithDefault(namespaceQuestion, namespaceHelp, namespaceOptions, + "Every namespace", "Every namespace"), + }) + + flags := install.NewInstallFlags() + opts, out := newOptions(t, flags, asker) + opts.Agents = nil + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + + assert.Contains(t, out.String(), "No Kubernetes agent is installed in this cluster") + assert.Contains(t, out.String(), "Installing it first is fine") +} + +func TestBuildValues_Defaults(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + opts, _ := newOptions(t, install.NewInstallFlags(), asker) + + values := opts.BuildValues() + + assert.Equal(t, map[string]any{ + "certManager": map[string]any{"enable": true}, + "rbac": map[string]any{"namespaced": false}, + }, values) + assert.NotContains(t, values, "manager", "neither namespace flag was set, so the chart's own env stays as it is") +} + +func TestBuildValues_TargetNamespacesAreJoinedWithCommas(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.TargetNamespaces.Value = []string{"my-app", "other-app"} + opts, _ := newOptions(t, flags, asker) + + values := opts.BuildValues() + + assert.Equal(t, map[string]any{ + "envOverrides": map[string]any{"TARGET_NAMESPACES": "my-app,other-app"}, + }, values["manager"]) +} + +func TestBuildValues_NamespaceRegex(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.TargetNamespaceRegex.Value = "^team-.*$" + opts, _ := newOptions(t, flags, asker) + + values := opts.BuildValues() + + assert.Equal(t, map[string]any{ + "envOverrides": map[string]any{"TARGET_NAMESPACE_REGEX": "^team-.*$"}, + }, values["manager"]) +} + +func TestBuildValues_NamespacesAndRegexTogether(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.TargetNamespaces.Value = []string{"my-app"} + flags.TargetNamespaceRegex.Value = "^team-.*$" + opts, _ := newOptions(t, flags, asker) + + assert.Equal(t, map[string]any{ + "envOverrides": map[string]any{ + "TARGET_NAMESPACES": "my-app", + "TARGET_NAMESPACE_REGEX": "^team-.*$", + }, + }, opts.BuildValues()["manager"]) +} + +func TestBuildValues_CertManagerOff(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.CertManager.Value = false + opts, _ := newOptions(t, flags, asker) + + assert.Equal(t, map[string]any{"enable": false}, opts.BuildValues()["certManager"]) +} + +func TestBuildValues_NamespacedRBAC(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.NamespacedRBAC.Value = true + opts, _ := newOptions(t, flags, asker) + + assert.Equal(t, map[string]any{"namespaced": true}, opts.BuildValues()["rbac"]) +} + +func TestResolveNames_FixedByDefault(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + opts, _ := newOptions(t, install.NewInstallFlags(), asker) + + opts.ResolveNamesForTest() + + assert.Equal(t, "octopus-permissions-controller-system", opts.TargetNamespace) + assert.Equal(t, "octopus-permissions-controller", opts.TargetRelease) +} + +func TestResolveNames_FlagsOverride(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.Namespace.Value = "octopus" + flags.ReleaseName.Value = "opc" + opts, _ := newOptions(t, flags, asker) + + opts.ResolveNamesForTest() + + assert.Equal(t, "octopus", opts.TargetNamespace) + assert.Equal(t, "opc", opts.TargetRelease) +} + +// Only one controller runs per cluster, so an existing release has to be +// upgraded rather than joined by a second one. +func TestResolveNames_AdoptsAnExistingRelease(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + opts, _ := newOptions(t, install.NewInstallFlags(), asker) + opts.ExistingRelease = &helm.Release{Name: "opc", Namespace: "octopus", Version: "1.2.0"} + + opts.ResolveNamesForTest() + + assert.Equal(t, "octopus", opts.TargetNamespace) + assert.Equal(t, "opc", opts.TargetRelease) +} + +func TestConfirmPrerequisites_WithoutCertManagerAndNothingToAsk(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + opts, out := newOptions(t, install.NewInstallFlags(), asker) + opts.CertManagerPresent = false + opts.NoPrompt = true + + err := opts.ConfirmPrerequisitesForTest() + + require.Error(t, err) + assert.Contains(t, err.Error(), octoK8s.FlagSkipPreflight) + assert.Contains(t, out.String(), "cert-manager") + assert.Contains(t, out.String(), "--cert-manager=false", "the remediation has to name the way out of it") +} + +// A dry run creates nothing, so an unmet prerequisite is worth reporting but not +// worth withholding the preview for. +func TestConfirmPrerequisites_WithoutCertManagerIsOnlyAWarningForADryRun(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.DryRun.Value = true + opts, out := newOptions(t, flags, asker) + opts.CertManagerPresent = false + opts.NoPrompt = true + + require.NoError(t, opts.ConfirmPrerequisitesForTest()) + assert.Contains(t, out.String(), "cert-manager") +} + +func TestConfirmPrerequisites_CertManagerOffNeedsNothingInstalled(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.CertManager.Value = false + opts, _ := newOptions(t, flags, asker) + opts.CertManagerPresent = false + opts.NoPrompt = true + + require.NoError(t, opts.ConfirmPrerequisitesForTest()) +} + +func TestConfirmPrerequisites_CancellingAtTheWarning(t *testing.T) { + asker, checkRemainingPrompts := testutil.NewMockAsker(t, []*testutil.PA{ + testutil.NewConfirmPromptWithDefault("Continue with the install anyway?", + "The controller is likely to install and then be unable to do its job.", false, false), + }) + + opts, _ := newOptions(t, install.NewInstallFlags(), asker) + opts.CertManagerPresent = false + + assert.ErrorContains(t, opts.ConfirmPrerequisitesForTest(), "cancelled") + checkRemainingPrompts() +} + +func TestPrerequisiteChecks(t *testing.T) { + tests := []struct { + name string + certManagerPresent bool + certManagerFlag bool + agents []agent.Installation + wantCertManager octoK8s.CheckResult + wantAgent octoK8s.CheckResult + }{ + { + name: "everything in place", + certManagerPresent: true, + certManagerFlag: true, + agents: []agent.Installation{agentInstallation("production", "octopus-agent-production", agent.ModeWorker, true)}, + wantCertManager: octoK8s.CheckPassed, + wantAgent: octoK8s.CheckPassed, + }, + { + name: "cert-manager missing and wanted", + certManagerFlag: true, + wantCertManager: octoK8s.CheckFailed, + wantAgent: octoK8s.CheckSkipped, + }, + { + // Supplying the certificate another way is a supported choice, not a + // failed prerequisite. + name: "cert-manager missing and not wanted", + wantCertManager: octoK8s.CheckSkipped, + wantAgent: octoK8s.CheckSkipped, + }, + } + + for _, test := range tests { + t.Run(test.name, func(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.CertManager.Value = test.certManagerFlag + opts, _ := newOptions(t, flags, asker) + opts.CertManagerPresent = test.certManagerPresent + opts.Agents = test.agents + + checks := opts.PrerequisiteChecks() + require.Len(t, checks, 2) + + assert.Equal(t, "cert-manager", checks[0].Name) + assert.Equal(t, test.wantCertManager, checks[0].Result) + assert.Equal(t, "Kubernetes agents", checks[1].Name) + assert.Equal(t, test.wantAgent, checks[1].Result) + }) + } +} + +// The controller takes nothing away on its own: until an agent stops granting +// its script pods cluster-wide permissions, an unmatched deployment carries on. +func TestPrintNextSteps_ShowsHowToRestrictEachAgentStillGrantingClusterWidePermissions(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + opts, out := newOptions(t, install.NewInstallFlags(), asker) + opts.Agents = []agent.Installation{ + agentInstallation("production", "octopus-agent-production", agent.ModeDeploymentTarget, true), + agentInstallation("already-done", "octopus-agent-already-done", agent.ModeWorker, false), + } + + opts.PrintNextSteps() + printed := out.String() + + assert.Contains(t, printed, "apiVersion: agent.octopus.com/v1beta1") + assert.Contains(t, printed, "kind: WorkloadServiceAccount") + assert.Contains(t, printed, + `--set scriptPods.serviceAccount.clusterRole.enabled="false" production `+ + "oci://registry-1.docker.io/octopusdeploy/kubernetes-agent") + assert.Contains(t, printed, "--namespace octopus-agent-production") + assert.NotContains(t, printed, "already-done", "an agent whose script pods are already restricted has nothing to do") +} + +func TestPrintNextSteps_NoAgentsMeansNoHelmCommands(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + opts, out := newOptions(t, install.NewInstallFlags(), asker) + opts.Agents = nil + + opts.PrintNextSteps() + + assert.Contains(t, out.String(), "kind: WorkloadServiceAccount") + assert.NotContains(t, out.String(), "helm upgrade") +} + +// The wizard builds these flags without cobra ever parsing a command line, so +// the two entry points have to agree that cert-manager is on by default. +func TestNewCmdInstall_CertManagerDefaultsOnInBothEntryPoints(t *testing.T) { + assert.Equal(t, "true", install.NewCmdInstall(nil).Flags().Lookup(install.FlagCertManager).DefValue) + assert.True(t, install.NewInstallFlags().CertManager.Value) +} + +// GenerateAutomationCmd emits a bool flag only when it is true, so a +// --cert-manager that was turned off has to be spelled out to be reproducible. +func TestAutomationCmd_SpellsOutCertManagerWhenItIsTurnedOff(t *testing.T) { + run := func(certManager bool) string { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.CertManager.Value = certManager + flags.TargetNamespaces.Value = []string{"my-app"} + opts, out := newOptions(t, flags, asker) + opts.ResolveNamesForTest() + opts.ReportSuccessForTest(helm.Release{Name: "octopus-permissions-controller", Namespace: "ns", Version: "1.3.0"}) + return out.String() + } + + assert.Contains(t, run(false), "--cert-manager=false") + assert.NotContains(t, run(true), "--cert-manager") + assert.Contains(t, run(true), "--target-namespace 'my-app'") +} diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/prompt.go b/pkg/cmd/kubernetes/permissionscontroller/install/prompt.go new file mode 100644 index 00000000..a68b096e --- /dev/null +++ b/pkg/cmd/kubernetes/permissionscontroller/install/prompt.go @@ -0,0 +1,141 @@ +package install + +import ( + "context" + "errors" + "fmt" + + "github.com/AlecAivazis/survey/v2" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/question" +) + +// PromptMissing guards every prompt on its flag, so supplying a flag suppresses +// the matching question and the generated automation command reproduces the run. +func PromptMissing(ctx context.Context, opts *InstallOptions) error { + opts.resolveNames() + + reportExistingController(opts) + reportAgents(opts) + + if err := confirmWithoutCertManager(opts); err != nil { + return err + } + + return promptForManagedNamespaces(ctx, opts) +} + +func reportExistingController(opts *InstallOptions) { + if opts.ExistingRelease != nil { + fmt.Fprintf(opts.Out, "\nThe permissions controller is already installed here: release %s in namespace %s.\n", + output.Cyan(opts.ExistingRelease.Name), output.Cyan(opts.ExistingRelease.Namespace)) + fmt.Fprintf(opts.Out, " %s\n", output.Dimf( + "Chart %s. This install upgrades it - one controller serves the whole cluster.", opts.ExistingRelease.Version)) + return + } + + // The chart keeps its custom resources when it is uninstalled, so they + // outlive the release that created them. + if opts.ControllerPresent { + fmt.Fprintf(opts.Out, "\n%s This cluster already serves the controller's custom resources, but no Helm release was found for them.\n", + output.Yellow("!")) + fmt.Fprintf(opts.Out, " %s\n", output.Dim( + "They are left behind by an uninstalled controller, or by one installed some other way. Installing over them is safe.")) + } +} + +// reportAgents says what the controller will have to work with: it only ever +// acts on the script pods an agent creates. +func reportAgents(opts *InstallOptions) { + if len(opts.Agents) == 0 { + fmt.Fprintf(opts.Out, "\nNo Kubernetes agent is installed in this cluster, so the controller has nothing to act on yet.\n") + fmt.Fprintf(opts.Out, " %s\n", output.Dimf( + "Installing it first is fine - it starts working as soon as an agent %s or newer arrives.", MinimumAgentVersion)) + return + } + + fmt.Fprintf(opts.Out, "\nKubernetes agents in this cluster:\n") + for _, installation := range opts.Agents { + fmt.Fprintf(opts.Out, " %s %s\n", output.Cyan(installation.Name), + output.Dimf("(%s in %s)", installation.Mode, installation.Release.Namespace)) + } +} + +// confirmWithoutCertManager makes carrying on a deliberate choice: without a +// certificate the webhook installs and then rejects every pod it is asked to +// mutate, which stops deployments rather than merely failing to help them. +func confirmWithoutCertManager(opts *InstallOptions) error { + if opts.CertManagerPresent || !opts.CertManager.Value { + return nil + } + + fmt.Fprintf(opts.Out, "\n%s cert-manager is not installed in this cluster.\n", output.Yellow("!")) + fmt.Fprintf(opts.Out, " %s\n", output.Dim( + "The controller runs a mutating admission webhook, and cert-manager normally issues the certificate it serves with.")) + + proceed := false + if err := opts.Ask(&survey.Confirm{ + Message: "Install anyway, and supply the webhook certificate yourself?", + Default: false, + Help: "Answering no cancels the install, so you can install cert-manager first and start again.", + }, &proceed); err != nil { + return err + } + if !proceed { + return errors.New("install cancelled") + } + + opts.CertManager.Value = false + return nil +} + +func promptForManagedNamespaces(ctx context.Context, opts *InstallOptions) error { + // Either flag already answers this, so asking would override what was asked + // for. + if len(opts.TargetNamespaces.Value) > 0 || opts.TargetNamespaceRegex.Value != "" { + return nil + } + + const ( + everyNamespace = "Every namespace" + chosen = "Only namespaces I choose" + matching = "Namespaces matching a pattern" + ) + + answer := "" + if err := opts.Ask(&survey.Select{ + Message: "Which namespaces should the controller manage permissions in?", + Options: []string{everyNamespace, chosen, matching}, + Default: everyNamespace, + Help: "Outside these namespaces the agent's own default script pod permissions apply, and the controller does nothing.", + }, &answer); err != nil { + return err + } + + switch answer { + case chosen: + return promptForNamespaceList(ctx, opts) + case matching: + return opts.Ask(&survey.Input{ + Message: "Namespace pattern", + Help: "A regular expression matched against namespace names, which also covers namespaces that do not exist yet.", + }, &opts.TargetNamespaceRegex.Value, survey.WithValidator(survey.Required)) + } + return nil +} + +func promptForNamespaceList(ctx context.Context, opts *InstallOptions) error { + namespaces, err := opts.NamespacesCallback(ctx) + if err != nil { + return err + } + + selected, err := question.MultiSelectMap(opts.Ask, "Which namespaces?", namespaces, + func(namespace string) string { return namespace }, true) + if err != nil { + return err + } + + opts.TargetNamespaces.Value = selected + return nil +} diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/review.go b/pkg/cmd/kubernetes/permissionscontroller/install/review.go new file mode 100644 index 00000000..bcb717c7 --- /dev/null +++ b/pkg/cmd/kubernetes/permissionscontroller/install/review.go @@ -0,0 +1,186 @@ +package install + +import ( + "context" + "fmt" + + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" +) + +func Confirm(ctx context.Context, opts *InstallOptions) error { + review := &shared.Review{ + Dependencies: opts.Dependencies, + Groups: func() []shared.Group { return reviewGroups(opts) }, + Refresh: func() error { opts.resolveNames(); return nil }, + } + return review.Confirm(ctx) +} + +func reviewGroups(opts *InstallOptions) []shared.Group { + return []shared.Group{ + {Title: "Cluster", Items: clusterItems(opts)}, + {Title: "Controller", Items: controllerItems(opts)}, + {Title: "Agents", Items: agentItems(opts)}, + {Title: "Helm", Items: helmItems(opts)}, + } +} + +func clusterItems(opts *InstallOptions) []shared.Item { + kubeContext := opts.KubeContextInfo + source := "current context" + if opts.KubeContext.Value != "" && !kubeContext.IsCurrent { + source = "chosen" + } + + return []shared.Item{ + { + Label: "Kubernetes context", + Value: opts.KubeContext.Value, + Source: source, + // Changing cluster invalidates everything discovered from it. + Edit: nil, + }, + {Label: "Cluster address", Value: kubeContext.Server, Source: "from the kubeconfig"}, + { + Label: "Namespace", + Value: opts.TargetNamespace, + Source: shared.DerivedOrSet(opts.Namespace.Value, nameSource(opts)), + Edit: shared.EditText(opts.Ask, &opts.Namespace.Value, "Namespace to install into", + func() string { return opts.TargetNamespace }), + }, + { + Label: "Helm release", + Value: opts.TargetRelease, + Source: shared.DerivedOrSet(opts.ReleaseName.Value, nameSource(opts)), + Edit: shared.EditText(opts.Ask, &opts.ReleaseName.Value, "Helm release name", + func() string { return opts.TargetRelease }), + }, + } +} + +func nameSource(opts *InstallOptions) string { + if opts.ExistingRelease != nil { + return "from the controller already installed" + } + return "one controller per cluster" +} + +func controllerItems(opts *InstallOptions) []shared.Item { + items := []shared.Item{ + { + Label: "Managed namespaces", Value: managedNamespaces(opts), Source: "chosen", + Edit: func(ctx context.Context) error { + opts.TargetNamespaces.Value = nil + opts.TargetNamespaceRegex.Value = "" + return promptForManagedNamespaces(ctx, opts) + }, + }, + { + Label: "Namespace pattern", Value: shared.OrNotSet(opts.TargetNamespaceRegex.Value), Source: "chosen", + Edit: shared.EditText(opts.Ask, &opts.TargetNamespaceRegex.Value, "Namespace pattern (blank for none)", + func() string { return opts.TargetNamespaceRegex.Value }), + }, + { + Label: "RBAC scope", Value: rbacScope(opts), + Edit: shared.EditConfirm(opts.Ask, &opts.NamespacedRBAC.Value, + "Give the controller permissions in its own namespace only?", + "The controller creates Roles and RoleBindings in the namespaces being deployed to, so restricting it to one namespace only works if that is where everything is deployed."), + }, + { + Label: "Webhook certificate", Value: webhookCertificate(opts), Source: certificateSource(opts), + Edit: shared.EditConfirm(opts.Ask, &opts.CertManager.Value, + "Let cert-manager issue the webhook's certificate?", + "Answer no only if you are supplying the certificate yourself. Without one the webhook rejects every pod it is asked to mutate."), + }, + } + + if opts.ExistingRelease != nil { + items = append(items, shared.Item{ + Label: "Already installed", + Value: opts.ExistingRelease.Version, + Source: "this install upgrades it", + }) + } + + return items +} + +// managedNamespaces reports what the controller will act on. An empty list is +// not "none": the chart takes it to mean every namespace. +func managedNamespaces(opts *InstallOptions) string { + if len(opts.TargetNamespaces.Value) == 0 && opts.TargetNamespaceRegex.Value == "" { + return "every namespace" + } + return shared.OrNone(opts.TargetNamespaces.Value) +} + +func rbacScope(opts *InstallOptions) string { + if opts.NamespacedRBAC.Value { + return "this namespace only" + } + return "cluster-wide" +} + +func webhookCertificate(opts *InstallOptions) string { + if opts.CertManager.Value { + return "cert-manager" + } + return "supplied by you" +} + +func certificateSource(opts *InstallOptions) string { + if opts.CertManagerPresent { + return "cert-manager found in the cluster" + } + return "cert-manager is not installed" +} + +func agentItems(opts *InstallOptions) []shared.Item { + if len(opts.Agents) == 0 { + return []shared.Item{{ + Label: "Agents", + Value: "none installed in this cluster", + Source: fmt.Sprintf("the controller does nothing until an agent %s or newer arrives", MinimumAgentVersion), + }} + } + + items := make([]shared.Item, 0, len(opts.Agents)) + for _, installation := range opts.Agents { + items = append(items, shared.Item{ + Label: installation.Name, + Value: fmt.Sprintf("%s in %s", installation.Mode, installation.Release.Namespace), + Source: scriptPodPermissions(installation), + }) + } + return items +} + +func scriptPodPermissions(installation agent.Installation) string { + if installation.ScriptPodClusterRole { + return "script pods still hold cluster-wide permissions" + } + return "script pod permissions already restricted" +} + +func helmItems(opts *InstallOptions) []shared.Item { + return []shared.Item{ + {Label: "Chart", Value: ChartRef.Ref}, + { + Label: "Chart version", Value: shared.OrDefault(opts.ChartVersion.Value, "latest"), + Edit: shared.EditText(opts.Ask, &opts.ChartVersion.Value, "Chart version (blank for the latest)", + func() string { return opts.ChartVersion.Value }), + }, + { + Label: "Timeout", Value: shared.OrDefault(opts.Timeout.Value, octoK8s.DefaultTimeout.String()), + Edit: shared.EditText(opts.Ask, &opts.Timeout.Value, "How long to wait for the release to become ready", + func() string { return opts.Timeout.Value }), + }, + } +} + +func RenderReviewForTest(opts *InstallOptions) { + opts.resolveNames() + shared.PrintReview(opts.Out, reviewGroups(opts)) +} diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/review_test.go b/pkg/cmd/kubernetes/permissionscontroller/install/review_test.go new file mode 100644 index 00000000..84d5e723 --- /dev/null +++ b/pkg/cmd/kubernetes/permissionscontroller/install/review_test.go @@ -0,0 +1,162 @@ +package install_test + +import ( + "bytes" + "strings" + "testing" + + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/permissionscontroller/install" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/test/testutil" + "github.com/stretchr/testify/assert" +) + +func reviewOptions(t *testing.T) *install.InstallOptions { + t.Helper() + + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := install.NewInstallFlags() + flags.KubeContext.Value = "colima-k8s" + + return &install.InstallOptions{ + InstallFlags: flags, + Dependencies: &cmd.Dependencies{Ask: asker, Out: &bytes.Buffer{}}, + CertManagerPresent: true, + Agents: []agent.Installation{ + agentInstallation("production", "octopus-agent-production", agent.ModeDeploymentTarget, true), + }, + KubeContextInfo: octoK8s.Context{Name: "colima-k8s", Server: "https://192.168.64.4:52409", IsCurrent: true}, + } +} + +func reviewOf(t *testing.T, opts *install.InstallOptions) string { + t.Helper() + + out := &bytes.Buffer{} + opts.Out = out + install.RenderReviewForTest(opts) + return out.String() +} + +// Almost everything here is worked out rather than asked for, so the review is +// the only place a person sees it before anything is created. +func TestReview_ShowsEverySetting(t *testing.T) { + review := reviewOf(t, reviewOptions(t)) + + for _, expected := range []string{ + "colima-k8s", // chosen cluster + "https://192.168.64.4:52409", // detected cluster address + "octopus-permissions-controller-system", // fixed namespace + "octopus-permissions-controller", // fixed release name + "every namespace", // the chart's own default + "cluster-wide", // RBAC scope + "cert-manager", // who issues the webhook certificate + install.ChartRef.Ref, + octoK8s.DefaultTimeout.String(), + "(one controller per cluster)", // why the names are what they are + } { + assert.Contains(t, review, expected) + } +} + +// The controller only ever acts on the script pods an agent creates, so what is +// already installed decides whether this install changes anything. +func TestReview_ListsTheAgentsFound(t *testing.T) { + opts := reviewOptions(t) + opts.Agents = []agent.Installation{ + agentInstallation("production", "octopus-agent-production", agent.ModeDeploymentTarget, true), + agentInstallation("build-workers", "octopus-agent-build-workers", agent.ModeWorker, false), + } + + review := reviewOf(t, opts) + + assert.Contains(t, review, "production") + assert.Contains(t, review, "deployment target in octopus-agent-production") + assert.Contains(t, review, "script pods still hold cluster-wide permissions") + assert.Contains(t, review, "build-workers") + assert.Contains(t, review, "worker in octopus-agent-build-workers") + assert.Contains(t, review, "script pod permissions already restricted") +} + +func TestReview_SaysWhenNoAgentIsInstalled(t *testing.T) { + opts := reviewOptions(t) + opts.Agents = nil + + review := reviewOf(t, opts) + + assert.Contains(t, review, "none installed in this cluster") +} + +func TestReview_ShowsTheChosenNamespaces(t *testing.T) { + opts := reviewOptions(t) + opts.TargetNamespaces.Value = []string{"my-app", "other-app"} + opts.TargetNamespaceRegex.Value = "^team-.*$" + + review := reviewOf(t, opts) + + assert.Contains(t, review, "my-app, other-app") + assert.Contains(t, review, "^team-.*$") + assert.NotContains(t, review, "every namespace") +} + +func TestReview_ShowsWhenTheCertificateIsNotComingFromCertManager(t *testing.T) { + opts := reviewOptions(t) + opts.CertManagerPresent = false + opts.CertManager.Value = false + + review := reviewOf(t, opts) + + assert.Contains(t, review, "supplied by you") + assert.Contains(t, review, "cert-manager is not installed") +} + +func TestReview_ShowsThatAnExistingControllerWillBeUpgraded(t *testing.T) { + opts := reviewOptions(t) + opts.ExistingRelease = &helm.Release{Name: "opc", Namespace: "octopus", Version: "1.2.0"} + + review := reviewOf(t, opts) + + assert.Contains(t, review, "Already installed") + assert.Contains(t, review, "1.2.0") + assert.Contains(t, review, "this install upgrades it") + assert.Contains(t, review, "opc", "the existing release is what gets upgraded") +} + +// Claiming a source for something that was never found reads as a detection that +// succeeded. +func TestReview_ClaimsNoSourceForAnUnsetValue(t *testing.T) { + review := reviewOf(t, reviewOptions(t)) + + for _, line := range strings.Split(review, "\n") { + if strings.Contains(line, "Namespace pattern") { + assert.Contains(t, line, "(not set)") + assert.NotContains(t, line, "chosen") + } + } +} + +// --namespaced-rbac is not asked about, so the review is the only place its +// effect is described rather than named. +func TestReview_NamespacedRBACIsDescribedRatherThanNamed(t *testing.T) { + opts := reviewOptions(t) + opts.NamespacedRBAC.Value = true + + assert.Contains(t, rbacScopeLine(t, reviewOf(t, opts)), "this namespace only") + assert.Contains(t, rbacScopeLine(t, reviewOf(t, reviewOptions(t))), "cluster-wide") +} + +func rbacScopeLine(t *testing.T, review string) string { + t.Helper() + + for _, line := range strings.Split(review, "\n") { + if strings.Contains(line, "RBAC scope") { + return line + } + } + t.Fatal("the review did not show the RBAC scope") + return "" +} diff --git a/pkg/cmd/kubernetes/permissionscontroller/permissionscontroller.go b/pkg/cmd/kubernetes/permissionscontroller/permissionscontroller.go new file mode 100644 index 00000000..9bed6012 --- /dev/null +++ b/pkg/cmd/kubernetes/permissionscontroller/permissionscontroller.go @@ -0,0 +1,26 @@ +package permissionscontroller + +import ( + "github.com/MakeNowJust/heredoc/v2" + cmdInstall "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/permissionscontroller/install" + "github.com/OctopusDeploy/cli/pkg/constants" + "github.com/OctopusDeploy/cli/pkg/factory" + "github.com/spf13/cobra" +) + +func NewCmdPermissionsController(f factory.Factory) *cobra.Command { + cmd := &cobra.Command{ + Use: "permissions-controller ", + Aliases: []string{"opc"}, + Short: "Manage the Octopus permissions controller", + Long: heredoc.Doc(` + Manage the Octopus permissions controller, which decides which service account a + Kubernetes agent's script pods run as. + `), + Example: heredoc.Docf("$ %s kubernetes permissions-controller install", constants.ExecutableName), + } + + cmd.AddCommand(cmdInstall.NewCmdInstall(f)) + + return cmd +} diff --git a/pkg/cmd/kubernetes/shared/cluster.go b/pkg/cmd/kubernetes/shared/cluster.go new file mode 100644 index 00000000..ff532453 --- /dev/null +++ b/pkg/cmd/kubernetes/shared/cluster.go @@ -0,0 +1,198 @@ +// Package shared holds the parts of the Kubernetes installers every component +// needs: reaching a cluster, proving it can reach Octopus from the inside, and +// showing what is about to be installed before anything is created. +package shared + +import ( + "context" + "errors" + "fmt" + + "github.com/AlecAivazis/survey/v2" + "github.com/OctopusDeploy/cli/pkg/cmd" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/question/selectors" +) + +// Session is a live connection to a cluster, and what was learned while +// opening it. +type Session struct { + Cluster *octoK8s.Cluster + Runner *helm.Runner + Context octoK8s.Context +} + +// Connector chooses a cluster, connects to it, and runs the component's own +// discovery against it. +type Connector struct { + *cmd.Dependencies + *octoK8s.CommonFlags + + // SelectMessage is asked when the kubeconfig holds more than one context. + SelectMessage string + // Discover is everything else the component reads from the cluster. It runs + // inside the retry loop, so a credential problem anywhere in it can be fixed + // and retried as one unit. + Discover func(ctx context.Context, session *Session) error + // Unrecoverable reports an error that neither retrying nor moving to another + // cluster can fix, so neither is offered. + Unrecoverable func(err error, kubeConfig *octoK8s.KubeConfig) bool +} + +func (c *Connector) Connect(ctx context.Context) (*Session, error) { + kubeConfig, err := octoK8s.LoadKubeConfig(c.KubeConfig.Value) + if err != nil { + return nil, err + } + + for { + session, err := c.connectAndDiscover(ctx, kubeConfig) + if err == nil { + return session, nil + } + + retry, retryErr := c.ConfirmRetry(kubeConfig, err) + if retryErr != nil { + return nil, retryErr + } + if !retry { + return nil, err + } + } +} + +// connectAndDiscover holds everything that talks to the cluster, so a +// credential problem can be fixed and retried as a unit. +func (c *Connector) connectAndDiscover(ctx context.Context, kubeConfig *octoK8s.KubeConfig) (*Session, error) { + if err := c.ResolveKubeContext(kubeConfig); err != nil { + return nil, err + } + + kubeContext, err := kubeConfig.FindContext(c.KubeContext.Value) + if err != nil { + return nil, err + } + + cluster, err := octoK8s.Connect(kubeConfig, c.KubeContext.Value) + if err != nil { + return nil, err + } + + // Building a client is offline, so this is the first call that proves the + // credentials work. Cloud clusters authenticate through a helper such as + // gcloud or aws, which fails here when its session has expired. + version, err := cluster.ServerVersion() + if err != nil { + return nil, err + } + fmt.Fprintf(c.Out, "Connected to %s %s\n", output.Cyan(c.KubeContext.Value), output.Dimf("(Kubernetes %s)", version)) + + runner, err := helm.NewRunner(c.KubeConfig.Value, c.KubeContext.Value, c.Out) + if err != nil { + return nil, err + } + + session := &Session{Cluster: cluster, Runner: runner, Context: kubeContext} + if c.Discover == nil { + return session, nil + } + if err := c.Discover(ctx, session); err != nil { + return nil, err + } + return session, nil +} + +// ResolveKubeContext always reports the chosen context rather than silently +// assuming one: installing into the wrong cluster is the most expensive mistake +// available here. +func (c *Connector) ResolveKubeContext(kubeConfig *octoK8s.KubeConfig) error { + contexts := kubeConfig.Contexts() + if len(contexts) == 0 { + return errors.New("your kubeconfig does not contain any contexts") + } + + if c.KubeContext.Value != "" { + if _, err := kubeConfig.FindContext(c.KubeContext.Value); err != nil { + return err + } + return nil + } + + current, hasCurrent := kubeConfig.CurrentContext() + if c.NoPrompt { + if !hasCurrent { + return fmt.Errorf("your kubeconfig has no current context, so --%s must be specified", octoK8s.FlagKubeContext) + } + c.KubeContext.Value = current.Name + return nil + } + + if len(contexts) == 1 { + c.KubeContext.Value = contexts[0].Name + return nil + } + + selected, err := selectors.Select(c.Ask, c.selectMessage(), + func() ([]octoK8s.Context, error) { return contexts, nil }, + func(ctx octoK8s.Context) string { return ctx.Display() }) + if err != nil { + return err + } + c.KubeContext.Value = selected.Name + return nil +} + +func (c *Connector) selectMessage() string { + if c.SelectMessage == "" { + return "Which cluster should this be installed into?" + } + return c.SelectMessage +} + +// ConfirmRetry avoids ending the command and discarding everything already +// answered. Expired cloud credentials are the common case, and are usually +// fixed in another terminal in seconds. +func (c *Connector) ConfirmRetry(kubeConfig *octoK8s.KubeConfig, cause error) (bool, error) { + if c.NoPrompt { + return false, nil + } + if c.Unrecoverable != nil && c.Unrecoverable(cause, kubeConfig) { + return false, nil + } + + fmt.Fprintf(c.Out, "\n%s %v\n", output.Red("✘"), cause) + + const ( + tryAgain = "Try again" + pickOther = "Choose a different cluster" + cancel = "Cancel" + ) + + choices := []string{tryAgain} + if len(kubeConfig.Contexts()) > 1 { + choices = append(choices, pickOther) + } + choices = append(choices, cancel) + + answer := "" + if err := c.Ask(&survey.Select{ + Message: "What would you like to do?", + Options: choices, + Help: "If a cloud credential helper failed, sign in again in another terminal and choose Try again.", + }, &answer); err != nil { + return false, err + } + + switch answer { + case tryAgain: + return true, nil + case pickOther: + // Sends ResolveKubeContext back to the prompt. + c.KubeContext.Value = "" + return true, nil + default: + return false, nil + } +} diff --git a/pkg/cmd/kubernetes/shared/preflight.go b/pkg/cmd/kubernetes/shared/preflight.go new file mode 100644 index 00000000..34198d5a --- /dev/null +++ b/pkg/cmd/kubernetes/shared/preflight.go @@ -0,0 +1,150 @@ +package shared + +import ( + "context" + "errors" + "fmt" + "io" + + "github.com/AlecAivazis/survey/v2" + "github.com/OctopusDeploy/cli/pkg/cmd" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/output" +) + +// Preflight proves the endpoints a component needs are reachable from inside +// the cluster, which is what separates an install that works from one that +// succeeds and then never connects. +type Preflight struct { + *cmd.Dependencies + *octoK8s.CommonFlags + + Cluster *octoK8s.Cluster + Namespace string + Targets []octoK8s.Target + // ProceedHelp says what is likely to go wrong if the install continues past + // a failed check. + ProceedHelp string +} + +// Run reports the checks and decides whether the install goes ahead. +func (p *Preflight) Run(ctx context.Context) error { + if p.SkipPreflight.Value || len(p.Targets) == 0 { + return nil + } + + checks := octoK8s.StaticChecks(p.Targets) + podChecks, err := p.Cluster.RunPreflight(ctx, octoK8s.PreflightRequest{ + Namespace: p.Namespace, + Image: p.PreflightImage.Value, + Targets: p.Targets, + }) + if err != nil { + return err + } + checks = append(checks, podChecks...) + + return p.confirm(checks) +} + +// ReportStatic covers a dry run, where there is no install to abandon and no +// namespace to put a check pod in. +func (p *Preflight) ReportStatic() { + if p.SkipPreflight.Value || len(p.Targets) == 0 { + return + } + PrintChecks(p.Out, connectivityHeading, octoK8s.StaticChecks(p.Targets)) +} + +func (p *Preflight) confirm(checks []octoK8s.Check) error { + failed := PrintChecks(p.Out, connectivityHeading, checks) + if failed == 0 { + return nil + } + + if p.NoPrompt { + return fmt.Errorf("%d connectivity %s failed; fix the problems above or pass --%s", + failed, octoK8s.Pluralise("check", "checks", failed), octoK8s.FlagSkipPreflight) + } + + // A check can be wrong: egress policy may allow the real workload's service + // account but not a bare pod. + proceed := false + if err := p.Ask(&survey.Confirm{ + Message: "Continue with the install anyway?", + Default: false, + Help: p.ProceedHelp, + }, &proceed); err != nil { + return err + } + if !proceed { + return errors.New("install cancelled") + } + return nil +} + +const connectivityHeading = "Connectivity checks" + +// PrintChecks writes the results and returns how many failed. +func PrintChecks(out io.Writer, heading string, checks []octoK8s.Check) int { + if len(checks) == 0 { + return 0 + } + + fmt.Fprintf(out, "\n%s:\n", heading) + failed := 0 + for _, c := range checks { + switch c.Result { + case octoK8s.CheckPassed: + fmt.Fprintf(out, " %s %s %s\n", output.Green("✔"), c.Name, output.Dim(c.Detail)) + case octoK8s.CheckSkipped: + fmt.Fprintf(out, " %s %s %s\n", output.Dim("-"), c.Name, output.Dim(c.Detail)) + default: + failed++ + fmt.Fprintf(out, " %s %s %s\n", output.Red("✘"), c.Name, c.Detail) + if c.Remediation != "" { + fmt.Fprintf(out, " %s\n", output.Dim(c.Remediation)) + } + } + } + + return failed +} + +// CheckPermissions runs before anything is created, so a missing permission +// surfaces here rather than halfway through. A dry run creates nothing, so it +// reports the problem and carries on. +func CheckPermissions(ctx context.Context, d *cmd.Dependencies, cluster *octoK8s.Cluster, namespace string, dryRun bool) error { + denied, err := cluster.CheckPermissions(ctx, octoK8s.InstallPermissions(namespace)) + if err != nil { + return err + } + if len(denied) == 0 { + return nil + } + + message := fmt.Sprintf("your Kubernetes credentials cannot perform this install in context %q:", cluster.ContextName) + for _, permission := range denied { + message += fmt.Sprintf("\n cannot %s - needed to %s", permission, permission.Description) + } + + if dryRun { + fmt.Fprintf(d.Out, "%s %s\n", output.Yellow("!"), message) + return nil + } + return errors.New(message) +} + +// EnsureNamespace creates the install namespace, so the credentials the chart +// needs can be written before Helm runs. +func EnsureNamespace(ctx context.Context, d *cmd.Dependencies, cluster *octoK8s.Cluster, namespace string) error { + exists, err := cluster.NamespaceExists(ctx, namespace) + if err != nil { + return err + } + if exists { + fmt.Fprintf(d.Out, "Using existing namespace %s\n", output.Cyan(namespace)) + return nil + } + return cluster.CreateNamespace(ctx, namespace) +} diff --git a/pkg/cmd/kubernetes/shared/review.go b/pkg/cmd/kubernetes/shared/review.go new file mode 100644 index 00000000..9295cdbe --- /dev/null +++ b/pkg/cmd/kubernetes/shared/review.go @@ -0,0 +1,185 @@ +package shared + +import ( + "context" + "errors" + "fmt" + "io" + "strings" + + "github.com/AlecAivazis/survey/v2" + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/question" +) + +type Item struct { + Label string + Value string + // Source distinguishes a detected value from one that was typed. + Source string + // A nil Edit means the value can only be changed by starting again. + Edit func(context.Context) error +} + +type Group struct { + Title string + Items []Item +} + +// Review shows every setting, detected or chosen. Most are worked out rather +// than asked for, which is the point of the wizard, but it also means nobody +// sees them unless they are shown. +type Review struct { + *cmd.Dependencies + + // Groups is rebuilt after every edit, so the screen reflects what changed. + Groups func() []Group + // Refresh recomputes anything derived from an edited value, such as a + // namespace that follows the component's name. + Refresh func() error +} + +func (r *Review) Confirm(ctx context.Context) error { + for { + groups := r.Groups() + PrintReview(r.Out, groups) + + const ( + install = "Install" + change = "Change a setting" + cancel = "Cancel" + ) + + answer := "" + if err := r.Ask(&survey.Select{ + Message: "Ready to install?", + Options: []string{install, change, cancel}, + }, &answer); err != nil { + return err + } + + switch answer { + case install: + return nil + case cancel: + return errors.New("install cancelled") + } + + if err := r.editSetting(ctx, groups); err != nil { + return err + } + } +} + +func (r *Review) editSetting(ctx context.Context, groups []Group) error { + type editable struct { + label string + edit func(context.Context) error + } + + var choices []editable + for _, group := range groups { + for _, item := range group.Items { + if item.Edit != nil { + choices = append(choices, editable{label: group.Title + ": " + item.Label, edit: item.Edit}) + } + } + } + + selected, err := question.SelectMap(r.Ask, "Which setting?", choices, + func(e editable) string { return e.label }) + if err != nil { + return err + } + + if err := selected.edit(ctx); err != nil { + return err + } + + if r.Refresh == nil { + return nil + } + return r.Refresh() +} + +func PrintReview(out io.Writer, groups []Group) { + width := 0 + for _, group := range groups { + for _, item := range group.Items { + if len(item.Label) > width { + width = len(item.Label) + } + } + } + + fmt.Fprintf(out, "\n%s\n", output.Bold("Review the installation")) + for _, group := range groups { + fmt.Fprintf(out, "\n %s\n", output.Bold(group.Title)) + for _, item := range group.Items { + fmt.Fprintf(out, " %-*s %s", width, item.Label, output.Cyan(item.Value)) + // An unset value has no source worth claiming. + if item.Source != "" && !strings.HasPrefix(item.Value, "(") { + fmt.Fprintf(out, " %s", output.Dimf("(%s)", item.Source)) + } + fmt.Fprintln(out) + } + } + fmt.Fprintln(out) +} + +// EditText edits a value in place, offering what is currently in effect as the +// default so pressing enter changes nothing. +func EditText(ask question.Asker, target *string, message string, current func() string) func(context.Context) error { + return func(context.Context) error { + value := current() + if err := ask(&survey.Input{Message: message, Default: value}, &value); err != nil { + return err + } + *target = strings.TrimSpace(value) + return nil + } +} + +// EditConfirm edits a yes/no setting, starting from what is in effect. +func EditConfirm(ask question.Asker, target *bool, message, help string) func(context.Context) error { + return func(context.Context) error { + return ask(&survey.Confirm{Message: message, Default: *target, Help: help}, target) + } +} + +// DerivedOrSet describes where a value came from, for values the installer +// works out unless they were given explicitly. +func DerivedOrSet(explicit, derivedDescription string) string { + if explicit != "" { + return "set" + } + return derivedDescription +} + +func OrNotSet(value string) string { + return OrDefault(value, "(not set)") +} + +func OrDefault(value, fallback string) string { + if strings.TrimSpace(value) == "" { + return fallback + } + return value +} + +func OrNone(values []string) string { + if len(values) == 0 { + return "(none)" + } + return strings.Join(values, ", ") +} + +// Masked keeps a credential out of the review screen and out of anything that +// scrapes the terminal. +func Masked(secret string) string { + if secret == "" { + return "(not set)" + } + return "***" +} diff --git a/pkg/cmd/kubernetes/worker/worker.go b/pkg/cmd/kubernetes/worker/worker.go new file mode 100644 index 00000000..a15c91ed --- /dev/null +++ b/pkg/cmd/kubernetes/worker/worker.go @@ -0,0 +1,28 @@ +package worker + +import ( + "github.com/MakeNowJust/heredoc/v2" + agentInstall "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/agent/install" + "github.com/OctopusDeploy/cli/pkg/constants" + "github.com/OctopusDeploy/cli/pkg/factory" + "github.com/spf13/cobra" +) + +// NewCmdWorker is the same agent as `kubernetes agent`, registered as a worker +// instead of a deployment target. They are separate commands because that is +// the choice being made, and one agent can only be one of the two. +func NewCmdWorker(f factory.Factory) *cobra.Command { + cmd := &cobra.Command{ + Use: "worker ", + Short: "Manage the Octopus Kubernetes agent running as a worker", + Long: heredoc.Doc(` + Manage the Octopus Kubernetes agent running as a worker, which executes steps in a + Kubernetes cluster and releases the compute again when each task finishes. + `), + Example: heredoc.Docf("$ %s kubernetes worker install", constants.ExecutableName), + } + + cmd.AddCommand(agentInstall.NewCmdWorkerInstall(f)) + + return cmd +} diff --git a/pkg/cmd/target/shared/role.go b/pkg/cmd/target/shared/role.go index c9ce7249..27cddfa9 100644 --- a/pkg/cmd/target/shared/role.go +++ b/pkg/cmd/target/shared/role.go @@ -1,6 +1,7 @@ package shared import ( + "sort" "strings" "github.com/OctopusDeploy/cli/pkg/cmd" @@ -70,7 +71,7 @@ func PromptForRoles(opts *CreateTargetRoleOptions, flags *CreateTargetRoleFlags) if err != nil { return err } - roles, err := question.MultiSelectWithAddMap(opts.Ask, "Choose at least one role for the deployment target.\n", availableRoles, true) + roles, err := question.MultiSelectWithAddMap(opts.Ask, "Choose at least one role for the deployment target.\n", availableRoles, true, "") if err != nil { return err } @@ -145,3 +146,44 @@ func CombineRolesAndTags(client *client.Client, roles []string, tags []string) ( return combined, nil } + +// TargetTagNames is every target tag in the space, as the plain names a +// deployment target actually carries. Octopus organises target tags into tag +// sets, but the machine itself holds a flat list, and a tag that only exists on +// a machine is still a tag worth offering. +func TargetTagNames(client *client.Client) ([]string, error) { + if client == nil { + return nil, nil + } + + tagSets, err := getTargetTagSets(client) + if err != nil { + return nil, err + } + + seen := map[string]bool{} + names := make([]string, 0) + add := func(name string) { + if name = strings.TrimSpace(name); name != "" && !seen[name] { + seen[name] = true + names = append(names, name) + } + } + + for _, tagSet := range tagSets { + for _, tag := range tagSet.Tags { + add(tag.Name) + } + } + + roles, err := getAllMachineRoles(*client) + if err != nil { + return nil, err + } + for _, role := range roles { + add(role) + } + + sort.Strings(names) + return names, nil +} diff --git a/pkg/cmd/target/shared/tenant.go b/pkg/cmd/target/shared/tenant.go index 640bed27..e3ab5e14 100644 --- a/pkg/cmd/target/shared/tenant.go +++ b/pkg/cmd/target/shared/tenant.go @@ -144,6 +144,11 @@ func isTenantedTarget(flags *CreateTargetTenantFlags) bool { return flags.TenantedDeploymentMode.Value == Tenanted || flags.TenantedDeploymentMode.Value == TenantedOrUntenanted } +// TenantDeploymentOptions are the kinds of deployment a target can take part in. +func TenantDeploymentOptions() []*selectors.SelectOption[string] { + return getTenantDeploymentOptions() +} + func getTenantDeploymentOptions() []*selectors.SelectOption[string] { return []*selectors.SelectOption[string]{ {Display: "Exclude from tenanted deployments (default)", Value: Untenanted}, diff --git a/pkg/kubernetes/agent/agent.go b/pkg/kubernetes/agent/agent.go new file mode 100644 index 00000000..0ffcda81 --- /dev/null +++ b/pkg/kubernetes/agent/agent.go @@ -0,0 +1,183 @@ +// Package agent holds what the installers need to know about the Octopus +// Kubernetes agent as it exists in a cluster: which agents are already +// installed, and which of the components they cooperate with are present. +package agent + +import ( + "fmt" + "strings" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" +) + +// ChartName is the chart's own name, which is how an installed release is +// recognised whatever it was named. +const ChartName = "kubernetes-agent" + +// Mode is what an agent was registered as. One agent is either a deployment +// target or a worker, never both: the chart's registration takes one path or +// the other. +type Mode string + +const ( + ModeDeploymentTarget Mode = "deployment target" + ModeWorker Mode = "worker" + // ModeUnknown covers a release whose values could not be read, which a + // namespace-scoped credential is entitled to be unable to do. + ModeUnknown Mode = "unknown" +) + +// Installation is an agent already installed in this cluster. +type Installation struct { + Release helm.Release + // Name is the name the agent registered with, which is not necessarily the + // Helm release name. + Name string + Mode Mode + // ScriptPodClusterRole reports whether the agent's script pods still hold + // the chart's default cluster-wide permissions. + ScriptPodClusterRole bool +} + +// Installations lists the agents in the cluster, so an installer can say when a +// name is already taken and what an existing agent would need to change. +func Installations(runner *helm.Runner) ([]Installation, error) { + releases, err := runner.FindByChart(ChartName) + if err != nil { + return nil, err + } + + installations := make([]Installation, 0, len(releases)) + for _, release := range releases { + installation := Installation{Release: release, Mode: ModeUnknown, ScriptPodClusterRole: true} + + values, err := runner.GetValues(release.Name, release.Namespace) + if err == nil { + installation.Name = stringAt(values, "agent", "name") + installation.Mode = modeFrom(values) + installation.ScriptPodClusterRole = clusterRoleEnabled(values) + } + if installation.Name == "" { + installation.Name = release.Name + } + + installations = append(installations, installation) + } + return installations, nil +} + +func modeFrom(values map[string]any) Mode { + switch { + case boolAt(values, false, "agent", "worker", "enabled"): + return ModeWorker + case boolAt(values, false, "agent", "deploymentTarget", "enabled"): + return ModeDeploymentTarget + default: + return ModeUnknown + } +} + +// clusterRoleEnabled defaults to true because that is the chart's own default, +// so a release that never set it has the cluster-wide permissions. +func clusterRoleEnabled(values map[string]any) bool { + return boolAt(values, true, "scriptPods", "serviceAccount", "clusterRole", "enabled") +} + +// PermissionsControllerPresent reports whether the Octopus permissions +// controller is running in this cluster. It is found by its own custom +// resource rather than by a Helm release, which can be named anything. +func PermissionsControllerPresent(cluster *octoK8s.Cluster) (bool, error) { + return cluster.HasAPIResource(PermissionsControllerAPIGroup, workloadServiceAccountResource) +} + +// CertManagerPresent reports whether cert-manager is installed, which the +// permissions controller needs for its admission webhook's certificate. +func CertManagerPresent(cluster *octoK8s.Cluster) (bool, error) { + return cluster.HasAPIResource(certManagerAPIGroup, certificateResource) +} + +const ( + // PermissionsControllerAPIGroup is shared with the agent's own script pod + // templates, so presence is checked by resource rather than by group. + PermissionsControllerAPIGroup = "agent.octopus.com" + workloadServiceAccountResource = "workloadserviceaccounts" + + certManagerAPIGroup = "cert-manager.io" + certificateResource = "certificates" +) + +// SupportedArchitectures are the node architectures the agent's images are +// built for. Anything else schedules and then crash-loops. +var SupportedArchitectures = []string{"amd64", "arm64"} + +// ErrUnsupportedNodes means no node in this cluster can run the agent, which is +// a property of the cluster rather than of anything the caller did. +type ErrUnsupportedNodes struct { + Architectures []string +} + +func (e ErrUnsupportedNodes) Error() string { + return fmt.Sprintf("the Octopus agent only runs on linux/amd64 and linux/arm64 nodes, and this cluster has none (its nodes are %s)", + strings.Join(e.Architectures, ", ")) +} + +// UnsupportedArchitectures returns the architectures in a cluster the agent +// cannot run on. An empty result covers both a supported cluster and one whose +// nodes could not be listed. +func UnsupportedArchitectures(present []string) []string { + supported := map[string]bool{} + for _, arch := range SupportedArchitectures { + supported[arch] = true + } + + var unsupported []string + for _, arch := range present { + if !supported[arch] { + unsupported = append(unsupported, arch) + } + } + return unsupported +} + +// RunnableArchitecture reports whether any node in the cluster can run the +// agent. A cluster whose nodes could not be listed is assumed to be fine. +func RunnableArchitecture(present []string) bool { + if len(present) == 0 { + return true + } + return len(UnsupportedArchitectures(present)) < len(present) +} + +func stringAt(values map[string]any, keys ...string) string { + value, ok := at(values, keys...).(string) + if !ok { + return "" + } + return value +} + +func boolAt(values map[string]any, fallback bool, keys ...string) bool { + value, ok := at(values, keys...).(bool) + if !ok { + return fallback + } + return value +} + +// at walks a Helm values tree, which only holds what was set explicitly, so any +// step of the path may be missing. +func at(values map[string]any, keys ...string) any { + var current any = values + for _, key := range keys { + node, ok := current.(map[string]any) + if !ok { + return nil + } + current, ok = node[key] + if !ok { + return nil + } + } + return current +} diff --git a/pkg/kubernetes/agent/agent_internal_test.go b/pkg/kubernetes/agent/agent_internal_test.go new file mode 100644 index 00000000..7b6b1e2e --- /dev/null +++ b/pkg/kubernetes/agent/agent_internal_test.go @@ -0,0 +1,58 @@ +package agent + +import ( + "testing" + + "github.com/stretchr/testify/assert" +) + +// Helm reports only the values a release actually set, so every step of a path +// may be missing. +func TestValuesTree_TolerantOfMissingBranches(t *testing.T) { + values := map[string]any{ + "agent": map[string]any{ + "name": "Production", + "worker": map[string]any{"enabled": true}, + }, + } + + assert.Equal(t, "Production", stringAt(values, "agent", "name")) + assert.Equal(t, "", stringAt(values, "agent", "missing")) + assert.Equal(t, "", stringAt(values, "nothing", "here", "at", "all")) + assert.True(t, boolAt(values, false, "agent", "worker", "enabled")) + assert.False(t, boolAt(values, false, "agent", "deploymentTarget", "enabled")) + assert.True(t, boolAt(values, true, "agent", "deploymentTarget", "enabled"), "the fallback stands in for the chart's own default") + + // A value of the wrong type is no more useful than a missing one. + assert.Equal(t, "", stringAt(values, "agent", "worker")) +} + +func TestModeFrom(t *testing.T) { + tests := []struct { + name string + values map[string]any + expected Mode + }{ + {"a worker", map[string]any{"agent": map[string]any{"worker": map[string]any{"enabled": true}}}, ModeWorker}, + {"a deployment target", map[string]any{"agent": map[string]any{"deploymentTarget": map[string]any{"enabled": true}}}, ModeDeploymentTarget}, + {"neither switched on", map[string]any{"agent": map[string]any{"name": "x"}}, ModeUnknown}, + {"values that could not be read", nil, ModeUnknown}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert.Equal(t, tt.expected, modeFrom(tt.values)) + }) + } +} + +// The chart's default is a cluster-wide role for script pods, so a release that +// never mentioned it still has one. +func TestClusterRoleEnabled_DefaultsToTheChartsDefault(t *testing.T) { + assert.True(t, clusterRoleEnabled(nil)) + assert.False(t, clusterRoleEnabled(map[string]any{ + "scriptPods": map[string]any{ + "serviceAccount": map[string]any{"clusterRole": map[string]any{"enabled": false}}, + }, + })) +} diff --git a/pkg/kubernetes/agent/agent_test.go b/pkg/kubernetes/agent/agent_test.go new file mode 100644 index 00000000..c56d68d4 --- /dev/null +++ b/pkg/kubernetes/agent/agent_test.go @@ -0,0 +1,219 @@ +package agent_test + +import ( + "context" + "errors" + "fmt" + "testing" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + rbacv1 "k8s.io/api/rbac/v1" + storagev1 "k8s.io/api/storage/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/runtime" + "k8s.io/client-go/kubernetes/fake" +) + +func clusterWith(resources []*metav1.APIResourceList, objects ...runtime.Object) *octoK8s.Cluster { + clientset := fake.NewSimpleClientset(objects...) + clientset.Resources = resources + return octoK8s.NewClusterForTesting(clientset, "test", "https://cluster") +} + +func TestPermissionsControllerPresent(t *testing.T) { + // The agent's own script pod templates share this API group, so the + // controller has to be recognised by its resource rather than its group. + agentOnly := clusterWith([]*metav1.APIResourceList{{ + GroupVersion: "agent.octopus.com/v1beta1", + APIResources: []metav1.APIResource{{Name: "scriptpodtemplates", Kind: "ScriptPodTemplate"}}, + }}) + + present, err := agent.PermissionsControllerPresent(agentOnly) + require.NoError(t, err) + assert.False(t, present) + + withController := clusterWith([]*metav1.APIResourceList{{ + GroupVersion: "agent.octopus.com/v1beta1", + APIResources: []metav1.APIResource{ + {Name: "scriptpodtemplates", Kind: "ScriptPodTemplate"}, + {Name: "workloadserviceaccounts", Kind: "WorkloadServiceAccount"}, + }, + }}) + + present, err = agent.PermissionsControllerPresent(withController) + require.NoError(t, err) + assert.True(t, present) +} + +func TestCertManagerPresent(t *testing.T) { + none := clusterWith(nil) + present, err := agent.CertManagerPresent(none) + require.NoError(t, err) + assert.False(t, present) + + installed := clusterWith([]*metav1.APIResourceList{{ + GroupVersion: "cert-manager.io/v1", + APIResources: []metav1.APIResource{{Name: "certificates", Kind: "Certificate"}}, + }}) + present, err = agent.CertManagerPresent(installed) + require.NoError(t, err) + assert.True(t, present) +} + +func TestStorageClasses_DefaultFirst(t *testing.T) { + cluster := clusterWith(nil, + &storagev1.StorageClass{ + ObjectMeta: metav1.ObjectMeta{Name: "filestore"}, + Provisioner: "filestore.csi.storage.gke.io", + }, + &storagev1.StorageClass{ + ObjectMeta: metav1.ObjectMeta{ + Name: "standard", + Annotations: map[string]string{"storageclass.kubernetes.io/is-default-class": "true"}, + }, + Provisioner: "kubernetes.io/gce-pd", + }) + + classes, err := cluster.StorageClasses(context.Background()) + require.NoError(t, err) + require.Len(t, classes, 2) + + assert.Equal(t, "standard", classes[0].Name) + assert.True(t, classes[0].IsDefault) + assert.Equal(t, "standard (cluster default, kubernetes.io/gce-pd)", classes[0].Display()) + assert.Equal(t, "filestore (filestore.csi.storage.gke.io)", classes[1].Display()) +} + +func TestArchitectureSupport(t *testing.T) { + tests := []struct { + name string + present []string + unsupported []string + runnable bool + }{ + {"a cluster of arm64 nodes", []string{"arm64"}, nil, true}, + {"a mixed cluster still has somewhere to run", []string{"amd64", "s390x"}, []string{"s390x"}, true}, + {"nowhere to run", []string{"s390x"}, []string{"s390x"}, false}, + {"nodes that could not be listed are assumed to be fine", nil, nil, true}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert.Equal(t, tt.unsupported, agent.UnsupportedArchitectures(tt.present)) + assert.Equal(t, tt.runnable, agent.RunnableArchitecture(tt.present)) + }) + } +} + +// Retrying cannot change a cluster's node architectures, so the error is typed +// for the installer to recognise. +func TestErrUnsupportedNodes(t *testing.T) { + err := error(agent.ErrUnsupportedNodes{Architectures: []string{"s390x", "ppc64le"}}) + + assert.Contains(t, err.Error(), "s390x, ppc64le") + assert.Contains(t, err.Error(), "linux/amd64 and linux/arm64") + + var typed agent.ErrUnsupportedNodes + assert.True(t, errors.As(fmt.Errorf("wrapped: %w", err), &typed)) + assert.Equal(t, []string{"s390x", "ppc64le"}, typed.Architectures) +} + +// The Kubernetes API does not report which access modes a storage class +// supports, so the provisioner is the only signal there is. +func TestStorageClass_SupportsReadWriteMany(t *testing.T) { + tests := map[string]bool{ + "filestore.csi.storage.gke.io": true, + "efs.csi.aws.com": true, + "file.csi.azure.com": true, + "nfs.csi.k8s.io": true, + "cephfs.csi.ceph.com": true, + "kubernetes.io/gce-pd": false, + "ebs.csi.aws.com": false, + "disk.csi.azure.com": false, + "rancher.io/local-path": false, + "": false, + // An unrecognised provisioner costs node affinity; assuming the other + // way leaves a volume that never binds. + "example.com/something-new": false, + } + + for provisioner, expected := range tests { + t.Run(provisioner, func(t *testing.T) { + assert.Equal(t, expected, octoK8s.StorageClass{Provisioner: provisioner}.SupportsReadWriteMany()) + }) + } +} + +// The chart checks the value is a list and renders it with toYaml, neither of +// which a typed struct survives. +func TestPolicyRuleValues_ArePlainMapsWithoutEmptyFields(t *testing.T) { + values := octoK8s.PolicyRuleValues([]rbacv1.PolicyRule{ + {APIGroups: []string{"apps"}, Resources: []string{"deployments"}, Verbs: []string{"get", "list"}}, + {NonResourceURLs: []string{"/healthz"}, Verbs: []string{"get"}}, + {}, + }) + + assert.Equal(t, []any{ + map[string]any{"apiGroups": []string{"apps"}, "resources": []string{"deployments"}, "verbs": []string{"get", "list"}}, + map[string]any{"nonResourceURLs": []string{"/healthz"}, "verbs": []string{"get"}}, + }, values, "a rule that grants nothing is dropped, and so is every empty field") +} + +func TestRole_Display(t *testing.T) { + unrestricted := octoK8s.Role{Name: "cluster-admin", Rules: []rbacv1.PolicyRule{ + {APIGroups: []string{"*"}, Resources: []string{"*"}, Verbs: []string{"*"}}, + }} + assert.True(t, unrestricted.GrantsEverything()) + assert.Equal(t, "cluster-admin (cluster role, full access to the cluster)", unrestricted.Display(), + "copying this restricts nothing, which is worth saying before somebody picks it") + + scoped := octoK8s.Role{Name: "deployer", Rules: []rbacv1.PolicyRule{ + {APIGroups: []string{"apps"}, Resources: []string{"deployments"}, Verbs: []string{"get"}}, + }} + assert.False(t, scoped.GrantsEverything()) + assert.Equal(t, "deployer (cluster role, 1 rule)", scoped.Display()) + + namespaced := octoK8s.Role{Name: "reader", Namespace: "monitoring"} + assert.Equal(t, "monitoring/reader", namespaced.Reference(), "a namespaced role is named the way a flag names it") + assert.Equal(t, "monitoring/reader (role, 0 rules)", namespaced.Display()) +} + +// Kubernetes ships around seventy roles of its own, and the kube- namespaces +// hold the control plane's. None of them is what anybody is looking for here. +func TestRoles_LeavesOutTheOnesKubernetesShips(t *testing.T) { + cluster := clusterWith(nil, + &rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: "system:discovery"}}, + &rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: "deployer"}}, + &rbacv1.ClusterRole{ObjectMeta: metav1.ObjectMeta{Name: "admin"}}, + &rbacv1.Role{ObjectMeta: metav1.ObjectMeta{Name: "reader", Namespace: "monitoring"}}, + &rbacv1.Role{ObjectMeta: metav1.ObjectMeta{Name: "signer", Namespace: "kube-system"}}) + + roles, err := cluster.Roles(context.Background()) + require.NoError(t, err) + + references := make([]string, 0, len(roles)) + for _, role := range roles { + references = append(references, role.Reference()) + } + assert.Equal(t, []string{"admin", "deployer", "monitoring/reader"}, references, + "cluster roles come first, because they are the more likely answer") +} + +// RBAC is additive, so a workload given several roles ends up with the union. +func TestMergePolicyRules_UnionWithoutDuplicates(t *testing.T) { + pods := rbacv1.PolicyRule{APIGroups: []string{""}, Resources: []string{"pods"}, Verbs: []string{"get"}} + deployments := rbacv1.PolicyRule{APIGroups: []string{"apps"}, Resources: []string{"deployments"}, Verbs: []string{"get"}} + + merged := octoK8s.MergePolicyRules([]octoK8s.Role{ + {Name: "a", Rules: []rbacv1.PolicyRule{pods, deployments}}, + {Name: "b", Rules: []rbacv1.PolicyRule{pods}}, + }) + + assert.Equal(t, []any{ + map[string]any{"apiGroups": []string{""}, "resources": []string{"pods"}, "verbs": []string{"get"}}, + map[string]any{"apiGroups": []string{"apps"}, "resources": []string{"deployments"}, "verbs": []string{"get"}}, + }, merged) +} diff --git a/pkg/kubernetes/cluster.go b/pkg/kubernetes/cluster.go index 89dcfca0..fff613eb 100644 --- a/pkg/kubernetes/cluster.go +++ b/pkg/kubernetes/cluster.go @@ -4,11 +4,13 @@ import ( "context" "fmt" "sort" + "strings" "time" appsv1 "k8s.io/api/apps/v1" authzv1 "k8s.io/api/authorization/v1" corev1 "k8s.io/api/core/v1" + rbacv1 "k8s.io/api/rbac/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/types" @@ -308,3 +310,271 @@ func (c *Cluster) RestartDeployment(ctx context.Context, namespace, name string) } return nil } + +// HasAPIResource reports whether a CRD-backed resource is served by this +// cluster. Components detect each other this way rather than by looking for a +// Helm release, because a release can be named anything. +func (c *Cluster) HasAPIResource(group, resource string) (bool, error) { + discovery := c.Clientset.Discovery() + + groups, err := discovery.ServerGroups() + if err != nil { + return false, fmt.Errorf("could not list the API groups this cluster serves: %w", err) + } + + for _, g := range groups.Groups { + if g.Name != group { + continue + } + for _, version := range g.Versions { + list, err := discovery.ServerResourcesForGroupVersion(version.GroupVersion) + if err != nil { + // A group can advertise a version whose resources cannot be + // listed, usually an aggregated API server that is down. Other + // versions may still answer. + continue + } + for _, r := range list.APIResources { + if r.Name == resource { + return true, nil + } + } + } + } + return false, nil +} + +// StorageClass is what an installer needs to know to choose where a component's +// volume comes from. +type StorageClass struct { + Name string + Provisioner string + IsDefault bool +} + +// readWriteManyProvisioners serve a shared filesystem, so many pods on many +// nodes can mount the same volume. Everything else provisions a block device +// that only one node can mount at a time. +// +// The Kubernetes API does not report which access modes a storage class +// supports, and this is the only signal it does give. An unrecognised +// provisioner is treated as one node at a time, because that costs nothing but +// node affinity, where guessing the other way leaves a volume that never binds. +var readWriteManyProvisioners = map[string]bool{ + "efs.csi.aws.com": true, // AWS EFS + "filestore.csi.storage.gke.io": true, // Google Filestore + "file.csi.azure.com": true, // Azure Files + "kubernetes.io/azure-file": true, + "nfs.csi.k8s.io": true, + "smb.csi.k8s.io": true, + "cephfs.csi.ceph.com": true, + "rook-ceph.cephfs.csi.ceph.com": true, + "openebs.io/nfsrwx": true, + "nfs.openebs.io": true, + "k8s-sigs.io/nfs-subdir-external-provisioner": true, +} + +// SupportsReadWriteMany reports whether a volume from this class can be mounted +// by pods on more than one node. +func (s StorageClass) SupportsReadWriteMany() bool { + return readWriteManyProvisioners[s.Provisioner] +} + +func (s StorageClass) Display() string { + if s.IsDefault { + return fmt.Sprintf("%s (cluster default, %s)", s.Name, s.Provisioner) + } + return fmt.Sprintf("%s (%s)", s.Name, s.Provisioner) +} + +// StorageClasses is advisory, so a cluster that will not let the caller list +// them reports none rather than failing. +func (c *Cluster) StorageClasses(ctx context.Context) ([]StorageClass, error) { + list, err := c.Clientset.StorageV1().StorageClasses().List(ctx, metav1.ListOptions{}) + if err != nil { + if apierrors.IsForbidden(err) { + return nil, nil + } + return nil, fmt.Errorf("could not list the cluster's storage classes: %w", err) + } + + classes := make([]StorageClass, 0, len(list.Items)) + for _, item := range list.Items { + classes = append(classes, StorageClass{ + Name: item.Name, + Provisioner: item.Provisioner, + IsDefault: item.Annotations["storageclass.kubernetes.io/is-default-class"] == "true", + }) + } + + sort.Slice(classes, func(i, j int) bool { + if classes[i].IsDefault != classes[j].IsDefault { + return classes[i].IsDefault + } + return classes[i].Name < classes[j].Name + }) + return classes, nil +} + +// Role is an existing role whose rules can be copied into a component's own +// role. Namespace is empty for a cluster role. +type Role struct { + Name string + Namespace string + Rules []rbacv1.PolicyRule +} + +func (r Role) IsClusterScoped() bool { return r.Namespace == "" } + +// Reference is how a role is named on a command line: a bare name for a cluster +// role, and namespace/name for one that lives in a namespace. +func (r Role) Reference() string { + if r.IsClusterScoped() { + return r.Name + } + return r.Namespace + "/" + r.Name +} + +// GrantsEverything reports an unrestricted role, which is worth saying out loud +// before somebody copies it expecting to have restricted something. +func (r Role) GrantsEverything() bool { + for _, rule := range r.Rules { + if contains(rule.Verbs, "*") && contains(rule.APIGroups, "*") && contains(rule.Resources, "*") { + return true + } + } + return false +} + +func (r Role) Display() string { + kind := "role" + if r.IsClusterScoped() { + kind = "cluster role" + } + + if r.GrantsEverything() { + return fmt.Sprintf("%s (%s, full access to the cluster)", r.Reference(), kind) + } + return fmt.Sprintf("%s (%s, %d %s)", r.Reference(), kind, len(r.Rules), Pluralise("rule", "rules", len(r.Rules))) +} + +// Roles lists the roles worth offering to copy, cluster-scoped ones first. +// Kubernetes ships around seventy of its own, all prefixed system:, and the +// kube- namespaces hold the control plane's, none of which is what anybody is +// looking for here. +func (c *Cluster) Roles(ctx context.Context) ([]Role, error) { + clusterRoles, err := c.Clientset.RbacV1().ClusterRoles().List(ctx, metav1.ListOptions{}) + if err != nil { + return nil, fmt.Errorf("could not list the cluster's roles: %w", err) + } + + roles := make([]Role, 0, len(clusterRoles.Items)) + for _, item := range clusterRoles.Items { + if strings.HasPrefix(item.Name, "system:") { + continue + } + roles = append(roles, Role{Name: item.Name, Rules: item.Rules}) + } + + namespaced, err := c.Clientset.RbacV1().Roles(metav1.NamespaceAll).List(ctx, metav1.ListOptions{}) + if err != nil { + // A credential that can read cluster roles but not namespaced ones still + // has something to offer. + if !apierrors.IsForbidden(err) { + return nil, fmt.Errorf("could not list the cluster's roles: %w", err) + } + } else { + for _, item := range namespaced.Items { + if strings.HasPrefix(item.Namespace, "kube-") || strings.HasPrefix(item.Name, "system:") { + continue + } + roles = append(roles, Role{Name: item.Name, Namespace: item.Namespace, Rules: item.Rules}) + } + } + + sort.Slice(roles, func(i, j int) bool { + if roles[i].IsClusterScoped() != roles[j].IsClusterScoped() { + return roles[i].IsClusterScoped() + } + return roles[i].Reference() < roles[j].Reference() + }) + return roles, nil +} + +// FindRole reads one role by the reference a command line gives it. +func (c *Cluster) FindRole(ctx context.Context, reference string) (Role, error) { + namespace, name, namespaced := strings.Cut(strings.TrimSpace(reference), "/") + if !namespaced { + role, err := c.Clientset.RbacV1().ClusterRoles().Get(ctx, namespace, metav1.GetOptions{}) + if err != nil { + if apierrors.IsNotFound(err) { + return Role{}, fmt.Errorf("this cluster has no cluster role named %q. Name a role in a namespace as namespace/name", reference) + } + return Role{}, fmt.Errorf("could not read cluster role %q: %w", reference, err) + } + return Role{Name: role.Name, Rules: role.Rules}, nil + } + + role, err := c.Clientset.RbacV1().Roles(namespace).Get(ctx, name, metav1.GetOptions{}) + if err != nil { + if apierrors.IsNotFound(err) { + return Role{}, fmt.Errorf("namespace %s has no role named %q", namespace, name) + } + return Role{}, fmt.Errorf("could not read role %q: %w", reference, err) + } + return Role{Name: role.Name, Namespace: role.Namespace, Rules: role.Rules}, nil +} + +// MergePolicyRules gathers the rules of several roles into one list. RBAC is +// additive, so a workload given all of them ends up with the union; exact +// duplicates only make the result harder to read. +func MergePolicyRules(roles []Role) []any { + merged := make([]any, 0) + seen := map[string]bool{} + + for _, role := range roles { + for _, value := range PolicyRuleValues(role.Rules) { + key := fmt.Sprint(value) + if seen[key] { + continue + } + seen[key] = true + merged = append(merged, value) + } + } + return merged +} + +// PolicyRuleValues converts RBAC rules into the plain maps a Helm value has to +// be. The chart checks the value is a list and renders it with toYaml, neither +// of which a typed struct survives. +func PolicyRuleValues(rules []rbacv1.PolicyRule) []any { + values := make([]any, 0, len(rules)) + for _, rule := range rules { + value := map[string]any{} + addStrings(value, "apiGroups", rule.APIGroups) + addStrings(value, "resources", rule.Resources) + addStrings(value, "resourceNames", rule.ResourceNames) + addStrings(value, "nonResourceURLs", rule.NonResourceURLs) + addStrings(value, "verbs", rule.Verbs) + if len(value) > 0 { + values = append(values, value) + } + } + return values +} + +func addStrings(value map[string]any, key string, values []string) { + if len(values) > 0 { + value[key] = values + } +} + +func contains(values []string, wanted string) bool { + for _, value := range values { + if value == wanted { + return true + } + } + return false +} diff --git a/pkg/kubernetes/octopus.go b/pkg/kubernetes/octopus.go index e8e2173c..223dcd5a 100644 --- a/pkg/kubernetes/octopus.go +++ b/pkg/kubernetes/octopus.go @@ -23,3 +23,37 @@ func DeriveGRPCURL(serverURL string) string { return fmt.Sprintf("grpc://%s:%d", parsed.Hostname(), DefaultOctopusGRPCPort) } + +// DefaultPollingPort is the TCP port Octopus Server listens on for polling +// Tentacles, which is how the Kubernetes agent connects. +const DefaultPollingPort = 10943 + +// cloudDomains are the Octopus Cloud domains. Cloud instances serve polling +// Tentacles on a separate hostname over 443, because the cluster's egress often +// only allows that port. +var cloudDomains = []string{".octopus.app", ".testoctopus.app"} + +// DerivePollingURL is a starting point to confirm rather than a guarantee. The +// port is configurable on a self-hosted server, and a load balancer in front of +// Octopus has to pass the connection through untouched - the protocol needs an +// intact end-to-end TLS connection, so SSL offloading does not work. The +// connectivity preflight is what proves it. +func DerivePollingURL(serverURL string) string { + if serverURL == "" { + return "" + } + + parsed, err := url.Parse(strings.TrimSpace(serverURL)) + if err != nil || parsed.Hostname() == "" { + return "" + } + + host := parsed.Hostname() + for _, domain := range cloudDomains { + if strings.HasSuffix(strings.ToLower(host), domain) { + return fmt.Sprintf("https://polling.%s", host) + } + } + + return fmt.Sprintf("https://%s:%d", host, DefaultPollingPort) +} diff --git a/pkg/kubernetes/octopus_test.go b/pkg/kubernetes/octopus_test.go index b384ccb0..f4f40ecf 100644 --- a/pkg/kubernetes/octopus_test.go +++ b/pkg/kubernetes/octopus_test.go @@ -28,3 +28,24 @@ func TestDeriveGRPCURL(t *testing.T) { }) } } + +func TestDerivePollingURL(t *testing.T) { + tests := []struct { + name string + server string + expected string + }{ + {"self-hosted gets the polling port", "https://octopus.example.com", "https://octopus.example.com:10943"}, + {"a port on the REST address is not the polling port", "https://octopus.example.com:8080", "https://octopus.example.com:10943"}, + {"Octopus Cloud serves polling on its own hostname", "https://myinstance.octopus.app", "https://polling.myinstance.octopus.app"}, + {"Octopus Cloud test instances too", "https://myinstance.testoctopus.app", "https://polling.myinstance.testoctopus.app"}, + {"nothing to derive from", "", ""}, + {"not an address", "not a url", ""}, + } + + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + assert.Equal(t, tt.expected, kubernetes.DerivePollingURL(tt.server)) + }) + } +} diff --git a/pkg/question/helpers_test.go b/pkg/question/helpers_test.go index 3994e3af..bd1db981 100644 --- a/pkg/question/helpers_test.go +++ b/pkg/question/helpers_test.go @@ -1,2 +1 @@ package question_test - diff --git a/pkg/question/select.go b/pkg/question/select.go index 2da0de78..84690a12 100644 --- a/pkg/question/select.go +++ b/pkg/question/select.go @@ -32,14 +32,17 @@ func MultiSelectMap[T any](ask Asker, message string, items []T, getKey func(ite return selected, nil } -func MultiSelectWithAddMap(ask Asker, message string, items []string, required bool) ([]string, error) { +// MultiSelectWithAddMap offers a list that can also be typed into. An empty +// newItemName leaves the prompt calling what enter creates an entry. +func MultiSelectWithAddMap(ask Asker, message string, items []string, required bool, newItemName string) ([]string, error) { askOpts := func(options *survey.AskOptions) error { return nil } if required { askOpts = survey.WithValidator(survey.Required) } var selectedKeys []string - if err := ask(&surveyext.MultiSelectWithAdd{Message: message, Options: items}, &selectedKeys, askOpts); err != nil { + prompt := &surveyext.MultiSelectWithAdd{Message: message, Options: items, NewItemName: newItemName} + if err := ask(prompt, &selectedKeys, askOpts); err != nil { return nil, err } return selectedKeys, nil diff --git a/pkg/surveyext/multiselectwithadd.go b/pkg/surveyext/multiselectwithadd.go index 972cf8e7..f8a23b77 100644 --- a/pkg/surveyext/multiselectwithadd.go +++ b/pkg/surveyext/multiselectwithadd.go @@ -20,9 +20,16 @@ for them to select using the arrow keys and enter, typing allows the user to add } survey.AskOne(prompt, &days) */ +// DefaultNewItemName is what this prompt calls the thing enter creates when the +// caller has not said. +const DefaultNewItemName = "entry" + type MultiSelectWithAdd struct { survey.Renderer - Message string + Message string + // NewItemName names what pressing enter creates, for prompts where "entry" + // is vaguer than it needs to be. Defaults to DefaultNewItemName. + NewItemName string Options []string Default interface{} Help string @@ -72,13 +79,35 @@ var MultiSelectQuestionTemplate = ` {{- color "default+hb"}}{{ .Message }}{{ .FilterMessage }}{{color "reset"}} {{- if .ShowAnswer}}{{color "cyan"}} {{.Answer}}{{color "reset"}}{{"\n"}} {{- else }} - {{- " "}}{{- color "cyan"}}[Type to filter, enter to add a new entry, use arrows to move, to select, to deselect{{- if and .Help (not .ShowHelp)}}, {{ .Config.HelpInput }} for more help{{end}}]{{color "reset"}} + {{- " "}}{{- color "cyan"}} + {{- if .Filtering}}{{ .EnterHint }} + {{- else}}[Type to filter or create a new {{ .NewItemName }}, use arrows to move, to select, to deselect{{- if and .Help (not .ShowHelp)}}, {{ .Config.HelpInput }} for more help{{end}}]{{end}} + {{- color "reset"}} {{- "\n"}} {{- range $ix, $option := .PageEntries}} {{- template "option" $.IterateOption $ix $option}} {{- end}} {{- end}}` +// Filtering reports whether anything has been typed, which changes what the +// prompt has to offer to do next. +func (m MultiSelectWithAdd) Filtering() bool { + return strings.TrimSpace(m.filter) != "" +} + +// EnterHint says what pressing enter would do with what has been typed. Enter +// picks an option that already matches rather than creating a second one, so +// the hint has to tell those apart. +func (m MultiSelectWithAdd) EnterHint() string { + typed := strings.TrimSpace(m.filter) + for _, option := range m.Options { + if strings.EqualFold(option, typed) { + return fmt.Sprintf("Press enter to select %s", option) + } + } + return fmt.Sprintf("Press enter to create %s", typed) +} + // OnChange is called on every keypress. func (m *MultiSelectWithAdd) OnChange(key rune, config *survey.PromptConfig) { options := m.filterOptions(config) @@ -237,6 +266,10 @@ func (m *MultiSelectWithAdd) filterOptions(config *survey.PromptConfig) []core.O } func (m *MultiSelectWithAdd) Prompt(config *survey.PromptConfig) (interface{}, error) { + if m.NewItemName == "" { + m.NewItemName = DefaultNewItemName + } + // compute the default state m.checked = make(map[int]bool) // if there is a default diff --git a/pkg/surveyext/select.go b/pkg/surveyext/select.go index cc915268..597b40f9 100644 --- a/pkg/surveyext/select.go +++ b/pkg/surveyext/select.go @@ -13,6 +13,7 @@ import ( /* Select is a prompt that presents a list of various options to the user for them to select using the arrow keys and enter. Response type is a string. + color := "" prompt := &survey.Select{ Message: "Choose a color:", diff --git a/test/testutil/fakesurvey.go b/test/testutil/fakesurvey.go index 0c3f9644..9a0cfd92 100644 --- a/test/testutil/fakesurvey.go +++ b/test/testutil/fakesurvey.go @@ -86,15 +86,16 @@ func NewMultiSelectPrompt(prompt string, help string, options []string, response } } -func NewMultiSelectWithAddPrompt(prompt string, help string, options []string, responses []string) *PA { - return &PA{ - Prompt: &surveyext.MultiSelectWithAdd{ - Message: prompt, - Options: options, - Help: help, - }, - Answer: responses, +func NewMultiSelectWithAddPrompt(prompt string, help string, options []string, responses []string, newItemName ...string) *PA { + p := &surveyext.MultiSelectWithAdd{ + Message: prompt, + Options: options, + Help: help, + } + if len(newItemName) > 0 { + p.NewItemName = newItemName[0] } + return &PA{Prompt: p, Answer: responses} } func NewConfirmPrompt(prompt string, help string, response any) *PA { From 5416f14c098e23fd1772ca9d39565e8d3447bf63 Mon Sep 17 00:00:00 2001 From: Liam Mackie Date: Wed, 2 Sep 2026 10:04:13 +1000 Subject: [PATCH 5/7] things --- pkg/argocdgateways/argocdgateways.go | 80 ++++----- pkg/cmd/kubernetes/agent/install/commit.go | 125 +++++++++----- pkg/cmd/kubernetes/agent/install/ha_test.go | 131 ++++++++++++++ pkg/cmd/kubernetes/agent/install/install.go | 160 ++++++++++++++---- .../kubernetes/agent/install/install_test.go | 17 +- .../kubernetes/agent/install/monitor_test.go | 77 +++++++++ pkg/cmd/kubernetes/agent/install/prompt.go | 53 ++++-- pkg/cmd/kubernetes/agent/install/review.go | 36 +++- pkg/cmd/kubernetes/gateway/install/commit.go | 22 +-- .../gateway/install/environments_test.go | 43 +++++ pkg/cmd/kubernetes/gateway/install/install.go | 45 ++++- pkg/cmd/kubernetes/gateway/install/prompt.go | 4 +- .../gateway/install/registration_test.go | 12 -- pkg/cmd/kubernetes/gateway/install/review.go | 3 +- .../kubernetes/gateway/install/review_test.go | 2 +- pkg/cmd/kubernetes/install/install.go | 22 +-- .../permissionscontroller/install/commit.go | 21 +-- .../permissionscontroller/install/install.go | 2 +- pkg/cmd/kubernetes/shared/values.go | 33 ++++ pkg/kubernetes/argocd/eks.go | 4 - pkg/kubernetes/argocd/token.go | 4 - pkg/kubernetes/cluster.go | 12 +- pkg/kubernetes/kubeconfig.go | 7 +- pkg/kubernetes/naming.go | 1 + pkg/kubernetes/octopus.go | 27 ++- pkg/octopusservernodes/octopusservernodes.go | 57 +++++++ pkg/question/helpers_test.go | 1 + pkg/surveyext/select.go | 1 - 28 files changed, 752 insertions(+), 250 deletions(-) create mode 100644 pkg/cmd/kubernetes/agent/install/ha_test.go create mode 100644 pkg/cmd/kubernetes/agent/install/monitor_test.go create mode 100644 pkg/cmd/kubernetes/gateway/install/environments_test.go create mode 100644 pkg/cmd/kubernetes/shared/values.go create mode 100644 pkg/octopusservernodes/octopusservernodes.go diff --git a/pkg/argocdgateways/argocdgateways.go b/pkg/argocdgateways/argocdgateways.go index 435089ba..c6914cea 100644 --- a/pkg/argocdgateways/argocdgateways.go +++ b/pkg/argocdgateways/argocdgateways.go @@ -11,6 +11,7 @@ import ( "strings" "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/newclient" + "github.com/google/uuid" ) const template = "/api/{spaceId}/argocdgateways" @@ -19,53 +20,65 @@ type RegisterCommand struct { SpaceID string `json:"SpaceId"` Name string `json:"Name"` Environments []string `json:"Environments"` - // ClientID re-registers an existing gateway, which is how one gateway is - // shared across spaces. + // ClientID is how the gateway identifies itself to Octopus over gRPC. + // Octopus requires the caller to choose it; a gateway registering itself + // generates one the same way. Left empty, Register generates one. ClientID string `json:"ClientId,omitempty"` - // PreserveAuthenticationToken keeps the gateway's existing credential when - // re-registering. The response then carries no token. - PreserveAuthenticationToken bool `json:"PreserveAuthenticationToken,omitempty"` } // Registration is what Octopus hands back, and is everything the gateway needs // to connect. The credential is shown once. type Registration struct { - ID string `json:"Id"` - Name string `json:"Name"` - SpaceID string `json:"SpaceId"` - ClientID string `json:"ClientId"` - // AuthenticationToken is empty when re-registering with - // PreserveAuthenticationToken. - AuthenticationToken string `json:"AuthenticationToken"` + ID string + Name string + ClientID string + // AuthenticationToken is the gateway's own credential. + AuthenticationToken string // CertificateThumbprint identifies the Octopus Server the gateway should - // expect. Octopus has spelled this field both ways. - CertificateThumbprint string `json:"CertificateThumbprint"` - Thumbprint string `json:"Thumbprint"` + // expect. + CertificateThumbprint string } -// Thumb returns whichever spelling of the thumbprint the server used. -func (r Registration) Thumb() string { - if r.CertificateThumbprint != "" { - return r.CertificateThumbprint - } - return r.Thumbprint +// registerResponse is the wire shape: the gateway resource itself is nested +// beside the credential, which is only ever returned from this call. +type registerResponse struct { + Resource struct { + ID string `json:"Id"` + Name string `json:"Name"` + ClientID string `json:"ClientId"` + } `json:"Resource"` + AuthenticationToken string `json:"AuthenticationToken"` + CertificateThumbprint string `json:"CertificateThumbprint"` } func Register(client newclient.Client, command RegisterCommand) (*Registration, error) { if strings.TrimSpace(command.Name) == "" { return nil, fmt.Errorf("a gateway name is required") } + if command.ClientID == "" { + command.ClientID = uuid.New().String() + } path, err := expand(client, command.SpaceID) if err != nil { return nil, err } - registration, err := newclient.Post[Registration](client.HttpSession(), path, command) + response, err := newclient.Post[registerResponse](client.HttpSession(), path, command) if err != nil { return nil, fmt.Errorf("could not register the Argo CD gateway with Octopus: %w", err) } - return registration, nil + if response.Resource.ID == "" { + return nil, fmt.Errorf("Octopus did not return the registered gateway") + } + + return &Registration{ + ID: response.Resource.ID, + Name: response.Resource.Name, + ClientID: response.Resource.ClientID, + AuthenticationToken: response.AuthenticationToken, + CertificateThumbprint: response.CertificateThumbprint, + }, nil } // DeleteByID removes a registration. Used to undo one when the install that @@ -79,27 +92,6 @@ func DeleteByID(client newclient.Client, spaceID, id string) error { return newclient.Delete(client.HttpSession(), path+"/"+id) } -// List returns the gateways already registered in a space, so a name collision -// can be reported before it silently takes over an existing gateway. -func List(client newclient.Client, spaceID string) ([]Registration, error) { - path, err := expand(client, spaceID) - if err != nil { - return nil, err - } - - var response struct { - Items []Registration `json:"Items"` - } - page, err := newclient.Get[struct { - Items []Registration `json:"Items"` - }](client.HttpSession(), path) - if err != nil { - return nil, fmt.Errorf("could not list the Argo CD gateways in this space: %w", err) - } - response = *page - return response.Items, nil -} - func expand(client newclient.Client, spaceID string) (string, error) { if spaceID == "" { spaceID = client.GetSpaceID() diff --git a/pkg/cmd/kubernetes/agent/install/commit.go b/pkg/cmd/kubernetes/agent/install/commit.go index 222b6915..c4c41dcf 100644 --- a/pkg/cmd/kubernetes/agent/install/commit.go +++ b/pkg/cmd/kubernetes/agent/install/commit.go @@ -4,7 +4,7 @@ import ( "context" "errors" "fmt" - "os" + "maps" "time" "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" @@ -14,7 +14,6 @@ import ( "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" "github.com/OctopusDeploy/cli/pkg/output" "github.com/OctopusDeploy/cli/pkg/util/flag" - "sigs.k8s.io/yaml" ) func (opts *InstallOptions) Commit(ctx context.Context) error { @@ -106,16 +105,18 @@ func (opts *InstallOptions) authenticate(ctx context.Context) error { // --inline-secrets was given, so it stays out of the release values and out of // any file written by --output-values. func (opts *InstallOptions) BuildValues() (map[string]any, error) { - if opts.ServerCommsAddress.Value == "" { + if len(opts.ServerCommsAddresses.Value) == 0 { return nil, errors.New("the Octopus polling address could not be determined; specify --" + FlagServerCommsAddress) } agentValues := map[string]any{ - "name": opts.Name.Value, - "acceptEula": eulaValue(opts.AcceptEula.Value), - "serverUrl": opts.Host, - "serverCommsAddress": opts.ServerCommsAddress.Value, - "space": opts.spaceName(), + "name": opts.Name.Value, + "acceptEula": eulaValue(opts.AcceptEula.Value), + "serverUrl": opts.Host, + // The list form of the polling address, as the portal's generated + // command uses; a High Availability cluster has one entry per node. + "serverCommsAddresses": opts.ServerCommsAddresses.Value, + "space": opts.spaceName(), } if opts.MachinePolicy.Value != "" { @@ -137,9 +138,7 @@ func (opts *InstallOptions) BuildValues() (map[string]any, error) { if err != nil { return nil, err } - for key, value := range registration { - agentValues[key] = value - } + maps.Copy(agentValues, registration) values := map[string]any{"agent": agentValues} @@ -149,10 +148,45 @@ func (opts *InstallOptions) BuildValues() (map[string]any, error) { if scriptPods := opts.scriptPodValues(); len(scriptPods) > 0 { values["scriptPods"] = scriptPods } + if opts.monitorEnabled() { + values["kubernetesMonitor"] = opts.monitorValues() + } return values, nil } +// monitorEnabled guards on the mode as well as the flag: the monitor watches +// the objects deployments create, which only a deployment target has. +func (opts *InstallOptions) monitorEnabled() bool { + return opts.KubernetesMonitor.Value && !opts.isWorker() +} + +// monitorValues fills in the monitor subchart the same way the Octopus portal +// does. It registers with the same short-lived token as the agent, so the two +// share one Secret. +func (opts *InstallOptions) monitorValues() map[string]any { + registration := map[string]any{ + "serverApiUrl": opts.Host, + "spaceId": opts.spaceID(), + "machineName": opts.Name.Value, + } + if opts.InlineSecrets.Value && opts.Token.Value != "" { + registration["serverAccessToken"] = opts.Token.Value + } else { + registration["serverAccessTokenSecretName"] = tokenSecretName + registration["serverAccessTokenSecretKey"] = tokenSecretKey + } + if opts.ServerCertificate.Value != "" { + registration["serverCertificate"] = opts.ServerCertificate.Value + } + + return map[string]any{ + "enabled": true, + "monitor": map[string]any{"serverGrpcUrl": octoK8s.DeriveGRPCURL(opts.Host)}, + "registration": registration, + } +} + // TargetTags is the one list of tags the agent registers with. Octopus builds it // from plain role names and from tag set entries, which are given in canonical // TagSetName/TagName form and sent as the tag name alone. @@ -245,48 +279,50 @@ func eulaValue(accepted bool) string { } func (opts *InstallOptions) preflight() *shared.Preflight { + targets := []octoK8s.Target{ + { + Name: "Octopus REST API", + Address: opts.Host, + Remediation: "The chart registers the agent with Octopus over the REST API, from a pod in the cluster. " + + "Confirm this address is reachable from inside the cluster.", + }, + } + + for _, address := range opts.ServerCommsAddresses.Value { + targets = append(targets, octoK8s.Target{ + Name: "Octopus polling endpoint", + Address: address, + Remediation: fmt.Sprintf("The running agent polls Octopus over TCP on this address, on port %d by default and separately from the REST API. "+ + "A firewall or proxy that only allows HTTPS is the usual cause. The connection also has to reach Octopus intact, so SSL offloading will not work.", + octoK8s.DefaultPollingPort), + }) + } + + if opts.monitorEnabled() { + targets = append(targets, octoK8s.Target{ + Name: "Octopus gRPC endpoint", + Address: octoK8s.DeriveGRPCURL(opts.Host), + Remediation: "The Kubernetes monitor streams live object status to Octopus over gRPC on a different port to the REST API. " + + "A load balancer, proxy, or firewall that forwards only HTTPS is the usual cause; make sure the gRPC port is forwarded too.", + }) + } + return &shared.Preflight{ Dependencies: opts.Dependencies, CommonFlags: opts.CommonFlags, Cluster: opts.Cluster, Namespace: opts.TargetNamespace, - Targets: []octoK8s.Target{ - { - Name: "Octopus REST API", - Address: opts.Host, - Remediation: "The chart registers the agent with Octopus over the REST API, from a pod in the cluster. " + - "Confirm this address is reachable from inside the cluster.", - }, - { - Name: "Octopus polling endpoint", - Address: opts.ServerCommsAddress.Value, - Remediation: fmt.Sprintf("The running agent polls Octopus over TCP on this address, on port %d by default and separately from the REST API. "+ - "A firewall or proxy that only allows HTTPS is the usual cause. The connection also has to reach Octopus intact, so SSL offloading will not work.", - octoK8s.DefaultPollingPort), - }, - }, - ProceedHelp: "The agent is likely to install and then fail to register.", + Targets: targets, + ProceedHelp: "The agent is likely to install and then fail to register.", } } func (opts *InstallOptions) writeValuesFile(values map[string]any) error { - if opts.OutputValues.Value == "" { - return nil - } - - encoded, err := yaml.Marshal(values) - if err != nil { - return fmt.Errorf("could not encode the Helm values: %w", err) - } - if err := os.WriteFile(opts.OutputValues.Value, encoded, 0o600); err != nil { - return fmt.Errorf("could not write %s: %w", opts.OutputValues.Value, err) - } - - fmt.Fprintf(opts.Out, "Wrote Helm values to %s\n", output.Cyan(opts.OutputValues.Value)) + warning := "" if opts.InlineSecrets.Value && opts.Token.Value != "" { - fmt.Fprintf(opts.Out, "%s This file contains an Octopus access token in plain text.\n", output.Yellow("!")) + warning = "This file contains an Octopus access token in plain text." } - return nil + return shared.WriteValuesFile(opts.Out, opts.OutputValues.Value, values, warning) } func (opts *InstallOptions) renderOnly(ctx context.Context, timeout time.Duration) error { @@ -382,10 +418,11 @@ func (opts *InstallOptions) generatable() []flag.Generatable { generatable = append(generatable, opts.WorkerPools) } else { generatable = append(generatable, opts.Environments, opts.Roles, opts.Tags, - opts.TenantedDeploymentMode, opts.Tenants, opts.TenantTags, opts.DefaultNamespace) + opts.TenantedDeploymentMode, opts.Tenants, opts.TenantTags, opts.DefaultNamespace, + opts.KubernetesMonitor) } - generatable = append(generatable, opts.MachinePolicy, opts.ServerCommsAddress, opts.ServerCertificate, + generatable = append(generatable, opts.MachinePolicy, opts.ServerCommsAddresses, opts.ServerCertificate, opts.StorageClass, opts.ReadWriteMany, opts.AcceptEula, opts.InlineSecrets, opts.RestrictScriptPods, opts.ScriptPodRoles) return append(generatable, opts.CommonFlags.Generatable()...) diff --git a/pkg/cmd/kubernetes/agent/install/ha_test.go b/pkg/cmd/kubernetes/agent/install/ha_test.go new file mode 100644 index 00000000..50ad1dd4 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/ha_test.go @@ -0,0 +1,131 @@ +package install_test + +import ( + "bytes" + "context" + "testing" + + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/agent/install" + agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/octopusservernodes" + "github.com/OctopusDeploy/cli/test/testutil" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +const selfHostedHost = "https://octopus.internal" + +func haNodes() []octopusservernodes.Node { + return []octopusservernodes.Node{ + {Name: "OCTOPUS-01", MaxConcurrentTasks: 5}, + {Name: "OCTOPUS-02", MaxConcurrentTasks: 5}, + } +} + +// A High Availability node has no derivable polling address: the agent polls +// every node, each on its own address, and only the person who set the cluster +// up knows what those are. +func TestResolveWithoutPrompting_HANeedsAnAddressPerNode(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.ServerCommsAddresses.Value = nil + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.Host = selfHostedHost + opts.ServerNodesCallback = func() ([]octopusservernodes.Node, error) { return haNodes(), nil } + + err := opts.ResolveWithoutPrompting() + assert.ErrorContains(t, err, "High Availability") + assert.ErrorContains(t, err, "OCTOPUS-01, OCTOPUS-02") + assert.ErrorContains(t, err, install.FlagServerCommsAddress) +} + +// Addresses given explicitly are taken at face value, however many nodes there +// are: the person installing may deliberately point an agent at a subset. +func TestResolveWithoutPrompting_HAAcceptsTheAddressesGiven(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.ServerCommsAddresses.Value = []string{"https://node-1.internal:10943", "https://node-2.internal:10943"} + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.Host = selfHostedHost + opts.ServerNodesCallback = func() ([]octopusservernodes.Node, error) { return haNodes(), nil } + + require.NoError(t, opts.ResolveWithoutPrompting()) + + values, err := opts.BuildValues() + require.NoError(t, err) + assert.Equal(t, []string{"https://node-1.internal:10943", "https://node-2.internal:10943"}, + values["agent"].(map[string]any)["serverCommsAddresses"]) +} + +func TestPromptMissing_HAAsksForEveryNodesAddress(t *testing.T) { + nodeHelp := "The agent polls each node over TCP, on port 10943 by default, separately from the REST API on 443. " + + "The connection has to reach that node intact - SSL offloading does not work." + + pa := []*testutil.PA{ + testutil.NewConfirmPromptWithDefault("Do you accept it?", "", true, true), + testutil.NewInputPrompt("Name", "A short, memorable, unique name for this deployment target.", "Production"), + testutil.NewMultiSelectPrompt("Choose at least one environment for the deployment target.\n", "", + []string{"Development", "Production"}, []string{"Production"}), + testutil.NewMultiSelectWithAddPrompt("Which target tags should this deployment target have?\n", "", + []string{"k8s", "web"}, []string{"k8s"}, "tag"), + testutil.NewInputPrompt("Default namespace for deployments (optional)", + "Used only when neither the step nor the manifest names a namespace. "+ + "Leave it blank to make every step say where it deploys to.", ""), + testutil.NewInputPrompt("Polling address for node OCTOPUS-01", nodeHelp, "https://node-1.internal:10943"), + testutil.NewInputPrompt("Polling address for node OCTOPUS-02", nodeHelp, "https://node-2.internal:10943"), + testutil.NewSelectPrompt("Which storage class should the agent use?", "", + []string{ + "Use the cluster's default storage class", + "standard (cluster default, kubernetes.io/gce-pd)", + "filestore (filestore.csi.storage.gke.io)", + }, "Use the cluster's default storage class"), + } + asker, checkRemainingPrompts := testutil.NewMockAsker(t, pa) + + flags := install.NewInstallFlags() + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.Host = selfHostedHost + opts.ServerNodesCallback = func() ([]octopusservernodes.Node, error) { return haNodes(), nil } + + require.NoError(t, install.PromptMissing(context.Background(), opts)) + checkRemainingPrompts() + + assert.Equal(t, []string{"https://node-1.internal:10943", "https://node-2.internal:10943"}, + flags.ServerCommsAddresses.Value) +} + +// Octopus Cloud serves every polling connection on one shared address, so its +// nodes are its own business and never worth a question. +func TestResolveWithoutPrompting_CloudNeverReadsTheTopology(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.ServerCommsAddresses.Value = nil + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.ServerNodesCallback = func() ([]octopusservernodes.Node, error) { + t.Fatal("Octopus Cloud topology should not be read") + return nil, nil + } + + require.NoError(t, opts.ResolveWithoutPrompting()) + assert.Equal(t, []string{pollingAddress}, flags.ServerCommsAddresses.Value) +} + +// The topology read is a convenience: a credential that cannot read it can +// still name the polling addresses itself, so the install carries on with the +// derived one. +func TestResolveWithoutPrompting_UnreadableTopologyFallsBackToOneAddress(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := allSuppliedTargetFlags() + flags.ServerCommsAddresses.Value = nil + opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) + opts.Host = selfHostedHost + opts.ServerNodesCallback = func() ([]octopusservernodes.Node, error) { return nil, assert.AnError } + + require.NoError(t, opts.ResolveWithoutPrompting()) + assert.Equal(t, []string{"https://octopus.internal:10943"}, flags.ServerCommsAddresses.Value) + assert.Contains(t, opts.Out.(*bytes.Buffer).String(), "Could not read the Octopus Server's nodes") +} diff --git a/pkg/cmd/kubernetes/agent/install/install.go b/pkg/cmd/kubernetes/agent/install/install.go index 41ee227f..113716b7 100644 --- a/pkg/cmd/kubernetes/agent/install/install.go +++ b/pkg/cmd/kubernetes/agent/install/install.go @@ -18,6 +18,7 @@ import ( agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" "github.com/OctopusDeploy/cli/pkg/machinescommon" + "github.com/OctopusDeploy/cli/pkg/octopusservernodes" "github.com/OctopusDeploy/cli/pkg/output" "github.com/OctopusDeploy/cli/pkg/util/flag" "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/machines" @@ -25,7 +26,11 @@ import ( "github.com/spf13/cobra" ) -var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/kubernetes-agent"} +// ChartRef floats within the newest chart major version this tooling is known +// to work with, as the Octopus portal's generated command does. Bump the major +// together with KubernetesAgentUpgradeManager.LatestSupportedMajorVersion in +// Octopus Server. +var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/kubernetes-agent", Version: "3.*.*"} const ( FlagName = "name" @@ -38,6 +43,7 @@ const ( FlagInlineSecrets = "inline-secrets" FlagRestrictScriptPods = "restrict-script-pod-permissions" FlagScriptPodRole = "script-pod-role" + FlagKubernetesMonitor = "kubernetes-monitor" ) // The agent registers itself, so an Octopus credential has to reach the @@ -54,16 +60,17 @@ const ( const eulaURL = "https://octopus.com/company/legal" type InstallFlags struct { - Name *flag.Flag[string] - ServerCommsAddress *flag.Flag[string] - ServerCertificate *flag.Flag[string] - DefaultNamespace *flag.Flag[string] - StorageClass *flag.Flag[string] - ReadWriteMany *flag.Flag[bool] - AcceptEula *flag.Flag[bool] - InlineSecrets *flag.Flag[bool] - RestrictScriptPods *flag.Flag[bool] - ScriptPodRoles *flag.Flag[[]string] + Name *flag.Flag[string] + ServerCommsAddresses *flag.Flag[[]string] + ServerCertificate *flag.Flag[string] + DefaultNamespace *flag.Flag[string] + StorageClass *flag.Flag[string] + ReadWriteMany *flag.Flag[bool] + AcceptEula *flag.Flag[bool] + InlineSecrets *flag.Flag[bool] + RestrictScriptPods *flag.Flag[bool] + ScriptPodRoles *flag.Flag[[]string] + KubernetesMonitor *flag.Flag[bool] *sharedTarget.CreateTargetEnvironmentFlags *sharedTarget.CreateTargetRoleFlags @@ -75,16 +82,17 @@ type InstallFlags struct { func NewInstallFlags() *InstallFlags { return &InstallFlags{ - Name: flag.New[string](FlagName, false), - ServerCommsAddress: flag.New[string](FlagServerCommsAddress, false), - ServerCertificate: flag.New[string](FlagServerCertificate, false), - DefaultNamespace: flag.New[string](FlagDefaultNamespace, false), - StorageClass: flag.New[string](FlagStorageClass, false), - ReadWriteMany: flag.New[bool](FlagReadWriteMany, false), - AcceptEula: flag.New[bool](FlagAcceptEula, false), - InlineSecrets: flag.New[bool](FlagInlineSecrets, false), - RestrictScriptPods: flag.New[bool](FlagRestrictScriptPods, false), - ScriptPodRoles: flag.New[[]string](FlagScriptPodRole, false), + Name: flag.New[string](FlagName, false), + ServerCommsAddresses: flag.New[[]string](FlagServerCommsAddress, false), + ServerCertificate: flag.New[string](FlagServerCertificate, false), + DefaultNamespace: flag.New[string](FlagDefaultNamespace, false), + StorageClass: flag.New[string](FlagStorageClass, false), + ReadWriteMany: flag.New[bool](FlagReadWriteMany, false), + AcceptEula: flag.New[bool](FlagAcceptEula, false), + InlineSecrets: flag.New[bool](FlagInlineSecrets, false), + RestrictScriptPods: flag.New[bool](FlagRestrictScriptPods, false), + ScriptPodRoles: flag.New[[]string](FlagScriptPodRole, false), + KubernetesMonitor: flag.New[bool](FlagKubernetesMonitor, false), CreateTargetEnvironmentFlags: sharedTarget.NewCreateTargetEnvironmentFlags(), CreateTargetRoleFlags: sharedTarget.NewCreateTargetRoleFlags(), @@ -117,6 +125,10 @@ type InstallOptions struct { RegisteredCallback func(name string) (bool, error) // TargetTagsCallback lists the target tags the space already knows about. TargetTagsCallback func() ([]string, error) + // ServerNodesCallback lists the Octopus Server's own task-running nodes, + // which is how a High Availability cluster is recognised: the agent polls + // every node, and each needs its own address. + ServerNodesCallback func() ([]octopusservernodes.Node, error) // Populated by Discover before prompting. Exported so tests can drive the // prompt flow against a fake cluster. @@ -147,6 +159,10 @@ type InstallOptions struct { // three times in one run. registeredBefore bool registrationCheckedFor string + + // serverNodes is the answer from ServerNodesCallback, read once and kept. + serverNodes []octopusservernodes.Node + serverNodesRead bool } // alreadyRegistered answers whether Octopus already has an agent of this name. @@ -188,6 +204,9 @@ func NewInstallOptions(installFlags *InstallFlags, dependencies *cmd.Dependencie TargetTagsCallback: func() ([]string, error) { return sharedTarget.TargetTagNames(dependencies.Client) }, + ServerNodesCallback: func() ([]octopusservernodes.Node, error) { + return octopusservernodes.TaskNodes(dependencies.Client) + }, } } @@ -221,7 +240,8 @@ func newCmdInstall(f factory.Factory, mode agentK8s.Mode) *cobra.Command { registerModeFlags(command, installFlags, mode) flags.StringVar(&installFlags.MachinePolicy.Value, machinescommon.FlagMachinePolicy, "", fmt.Sprintf( "Machine policy the %s is registered with. Uses the default machine policy if not set.", mode)) - flags.StringVar(&installFlags.ServerCommsAddress.Value, FlagServerCommsAddress, "", "Polling address of your Octopus Server. Derived from the configured server URL if not set.") + flags.StringArrayVar(&installFlags.ServerCommsAddresses.Value, FlagServerCommsAddress, nil, + "Polling address of your Octopus Server. Derived from the configured server URL if not set. For a High Availability cluster, repeat for each node - the agent polls every node, and each needs its own address.") flags.StringVar(&installFlags.ServerCertificate.Value, FlagServerCertificate, "", "Base64-encoded PEM certificate to trust when Octopus is not served by a publicly trusted certificate.") flags.StringVar(&installFlags.StorageClass.Value, FlagStorageClass, "", "Storage class for the agent's volume. Uses the cluster's default storage class if not set.") flags.BoolVar(&installFlags.ReadWriteMany.Value, FlagReadWriteMany, false, "Request a ReadWriteMany volume, so script pods can run on any node. Read from the storage class if not set.") @@ -248,6 +268,9 @@ func registerModeFlags(command *cobra.Command, installFlags *InstallFlags, mode sharedTarget.RegisterCreateTargetTenantFlags(command, installFlags.CreateTargetTenantFlags) command.Flags().StringVar(&installFlags.DefaultNamespace.Value, FlagDefaultNamespace, "", "Namespace deployments go to when the step or the manifest does not name one.") + // The monitor watches deployed objects, which only a deployment target has. + command.Flags().BoolVar(&installFlags.KubernetesMonitor.Value, FlagKubernetesMonitor, false, + "Also install the Kubernetes monitor, which streams live status of the deployed objects back to Octopus. Needs an Octopus Server that supports it.") } // registerTargetTagFlags describes these as target tags rather than roles. @@ -294,11 +317,11 @@ func installRun(ctx context.Context, opts *InstallOptions) error { // Run installs using an existing set of dependencies. The `kubernetes install` // wizard uses this to hand off after the user picks a component, so the two // entry points share one implementation. -func Run(_ factory.Factory, dependencies *cmd.Dependencies) error { +func Run(dependencies *cmd.Dependencies) error { return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies, agentK8s.ModeDeploymentTarget)) } -func RunWorker(_ factory.Factory, dependencies *cmd.Dependencies) error { +func RunWorker(dependencies *cmd.Dependencies) error { return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies, agentK8s.ModeWorker)) } @@ -363,12 +386,6 @@ func (opts *InstallOptions) discoverCluster(ctx context.Context, session *shared return nil } -// ConfirmRetry is the recovery prompt for a cluster that could not be read, -// which is nearly always an expired cloud credential. -func (opts *InstallOptions) ConfirmRetry(kubeConfig *octoK8s.KubeConfig, cause error) (bool, error) { - return opts.connector().ConfirmRetry(kubeConfig, cause) -} - func (opts *InstallOptions) ValidateForAutomation() error { var missing []string if opts.Name.Value == "" { @@ -401,7 +418,9 @@ func (opts *InstallOptions) ValidateForAutomation() error { } func (opts *InstallOptions) ResolveWithoutPrompting() error { - opts.applyDefaults() + if err := opts.resolvePollingAddresses(); err != nil { + return err + } if err := opts.resolveNames(); err != nil { return err @@ -561,17 +580,68 @@ func storageClassDescription(class octoK8s.StorageClass, found bool, requested s } } -func (opts *InstallOptions) applyDefaults() { - if opts.ServerCommsAddress.Value == "" { - opts.ServerCommsAddress.Value = octoK8s.DerivePollingURL(opts.Host) +// resolvePollingAddresses fills in the polling address when none was given. +// Octopus Cloud and a single-node server have one derivable address; a High +// Availability cluster does not - each node needs its own address, which only +// the person who set the cluster up knows. +func (opts *InstallOptions) resolvePollingAddresses() error { + if len(opts.ServerCommsAddresses.Value) > 0 { + return nil + } + + if nodes := opts.haNodes(); len(nodes) > 0 { + names := make([]string, 0, len(nodes)) + for _, node := range nodes { + names = append(names, node.Name) + } + return fmt.Errorf("this Octopus Server is a High Availability cluster (nodes %s), and the agent polls every node on its own address; give --%s once per node", + strings.Join(names, ", "), FlagServerCommsAddress) + } + + if derived := octoK8s.DerivePollingURL(opts.Host); derived != "" { + opts.ServerCommsAddresses.Value = []string{derived} + } + return nil +} + +// haNodes is empty unless Octopus is a self-hosted High Availability cluster. +// Octopus Cloud serves every polling connection on one shared address, so its +// nodes are its own business. +func (opts *InstallOptions) haNodes() []octopusservernodes.Node { + if octoK8s.IsOctopusCloud(opts.Host) { + return nil + } + nodes := opts.taskNodes() + if len(nodes) <= 1 { + return nil + } + return nodes +} + +// taskNodes degrades to none rather than failing: the topology read is a +// convenience, and a credential that cannot read it can still name the polling +// addresses itself. +func (opts *InstallOptions) taskNodes() []octopusservernodes.Node { + if opts.serverNodesRead || opts.ServerNodesCallback == nil { + return opts.serverNodes + } + opts.serverNodesRead = true + + nodes, err := opts.ServerNodesCallback() + if err != nil { + fmt.Fprintf(opts.Out, "%s Could not read the Octopus Server's nodes to check for High Availability: %v\n", + output.Yellow("!"), err) + return nil } + opts.serverNodes = nodes + return nodes } func (opts *InstallOptions) resolveNames() error { if opts.Namespace.Value != "" { opts.TargetNamespace = opts.Namespace.Value } else { - derived, err := octoK8s.DerivedNamespace(octoK8s.AgentNamespacePrefix, opts.Name.Value) + derived, err := octoK8s.DerivedNamespace(opts.namespacePrefix(), opts.Name.Value) if err != nil { return err } @@ -590,6 +660,15 @@ func (opts *InstallOptions) resolveNames() error { return nil } +// namespacePrefix matches what the Octopus portal generates for each mode, so +// a CLI install and a portal install of the same name land in the same place. +func (opts *InstallOptions) namespacePrefix() string { + if opts.isWorker() { + return octoK8s.WorkerNamespacePrefix + } + return octoK8s.AgentNamespacePrefix +} + func (opts *InstallOptions) spaceName() string { if name := opts.GetSpaceNameOrEmpty(); name != "" { return name @@ -597,6 +676,13 @@ func (opts *InstallOptions) spaceName() string { return "Default" } +func (opts *InstallOptions) spaceID() string { + if opts.Space == nil { + return "" + } + return opts.Space.ID +} + func (opts *InstallOptions) isWorker() bool { return opts.Mode == agentK8s.ModeWorker } @@ -753,7 +839,9 @@ func examples(mode agentK8s.Mode) string { func (opts *InstallOptions) chartRef() helm.ChartRef { ref := ChartRef - ref.Version = opts.ChartVersion.Value + if opts.ChartVersion.Value != "" { + ref.Version = opts.ChartVersion.Value + } return ref } diff --git a/pkg/cmd/kubernetes/agent/install/install_test.go b/pkg/cmd/kubernetes/agent/install/install_test.go index 223bc56c..4822e43b 100644 --- a/pkg/cmd/kubernetes/agent/install/install_test.go +++ b/pkg/cmd/kubernetes/agent/install/install_test.go @@ -154,7 +154,7 @@ func TestPromptMissing_DeploymentTargetWithNothingSupplied(t *testing.T) { assert.Equal(t, []string{"Production"}, flags.Environments.Value) assert.Equal(t, []string{"k8s"}, flags.Roles.Value) assert.Empty(t, flags.TenantedDeploymentMode.Value, "tenanted deployments are not asked about, and default to untenanted") - assert.Equal(t, pollingAddress, flags.ServerCommsAddress.Value) + assert.Equal(t, []string{pollingAddress}, flags.ServerCommsAddresses.Value) assert.True(t, flags.AcceptEula.Value) // Derived rather than asked for. @@ -285,7 +285,8 @@ func TestPromptMissing_WorkerAsksAboutPoolsInsteadOfEnvironments(t *testing.T) { assert.Equal(t, []string{"Kubernetes Pool"}, flags.WorkerPools.Value) assert.Empty(t, flags.Environments.Value, "a worker has no environments") - assert.Equal(t, "octopus-agent-cluster-worker", opts.TargetNamespace) + assert.Equal(t, "octopus-worker-cluster-worker", opts.TargetNamespace, + "a worker lands in the same namespace a portal install of the same name would") } const permissionsQuestion = "What permissions should be used by workloads out of any WSA scope?" @@ -440,7 +441,7 @@ func allSuppliedTargetFlags() *install.InstallFlags { flags.Roles.Value = []string{"k8s"} flags.TenantedDeploymentMode.Value = sharedTarget.Untenanted flags.DefaultNamespace.Value = "production" - flags.ServerCommsAddress.Value = pollingAddress + flags.ServerCommsAddresses.Value = []string{pollingAddress} flags.StorageClass.Value = "standard" flags.AcceptEula.Value = true return flags @@ -450,7 +451,7 @@ func allSuppliedWorkerFlags() *install.InstallFlags { flags := install.NewInstallFlags() flags.Name.Value = "Cluster Worker" flags.WorkerPools.Value = []string{"Kubernetes Pool"} - flags.ServerCommsAddress.Value = pollingAddress + flags.ServerCommsAddresses.Value = []string{pollingAddress} flags.AcceptEula.Value = true return flags } @@ -483,7 +484,7 @@ func TestBuildValues_DeploymentTargetRegistration(t *testing.T) { assert.Equal(t, "Production", agentValues["name"]) assert.Equal(t, "Y", agentValues["acceptEula"]) assert.Equal(t, octopusHost, agentValues["serverUrl"]) - assert.Equal(t, pollingAddress, agentValues["serverCommsAddress"]) + assert.Equal(t, []string{pollingAddress}, agentValues["serverCommsAddresses"]) assert.Equal(t, "Default", agentValues["space"]) assert.NotContains(t, agentValues, "worker", "a deployment target does not register as a worker") @@ -628,7 +629,7 @@ func TestBuildValues_OptionalAgentSettings(t *testing.T) { func TestBuildValues_NeedsAPollingAddress(t *testing.T) { opts := completedTargetOptions(t) - opts.ServerCommsAddress.Value = "" + opts.ServerCommsAddresses.Value = nil _, err := opts.BuildValues() assert.ErrorContains(t, err, install.FlagServerCommsAddress) @@ -733,11 +734,11 @@ func TestResolveWithoutPrompting_DerivesThePollingAddress(t *testing.T) { asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) flags := allSuppliedTargetFlags() - flags.ServerCommsAddress.Value = "" + flags.ServerCommsAddresses.Value = nil opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) require.NoError(t, opts.ResolveWithoutPrompting()) - assert.Equal(t, pollingAddress, flags.ServerCommsAddress.Value) + assert.Equal(t, []string{pollingAddress}, flags.ServerCommsAddresses.Value) } // A space can easily have only dynamic pools, which Octopus runs on its own diff --git a/pkg/cmd/kubernetes/agent/install/monitor_test.go b/pkg/cmd/kubernetes/agent/install/monitor_test.go new file mode 100644 index 00000000..585ba755 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/monitor_test.go @@ -0,0 +1,77 @@ +package install_test + +import ( + "testing" + + "github.com/OctopusDeploy/cli/pkg/accesstokens" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// The monitor registers with the same short-lived token as the agent, so the +// two share one Secret and nothing extra reaches the Helm values. +func TestBuildValues_KubernetesMonitor(t *testing.T) { + opts := completedTargetOptions(t) + opts.KubernetesMonitor.Value = true + + values, err := opts.BuildValues() + require.NoError(t, err) + + monitor := values["kubernetesMonitor"].(map[string]any) + assert.Equal(t, true, monitor["enabled"]) + assert.Equal(t, map[string]any{"serverGrpcUrl": "grpc://my.octopus.app:8443"}, monitor["monitor"]) + + registration := monitor["registration"].(map[string]any) + assert.Equal(t, octopusHost, registration["serverApiUrl"]) + assert.Equal(t, "Spaces-1", registration["spaceId"]) + assert.Equal(t, "Production", registration["machineName"]) + assert.Equal(t, "octopus-agent-registration-token", registration["serverAccessTokenSecretName"]) + assert.Equal(t, "bearer-token", registration["serverAccessTokenSecretKey"]) + assert.NotContains(t, registration, "serverAccessToken", "the access token must not reach the Helm values") +} + +func TestBuildValues_KubernetesMonitorSharesTheInlineToken(t *testing.T) { + opts := completedTargetOptions(t) + opts.KubernetesMonitor.Value = true + opts.InlineSecrets.Value = true + opts.Token = accesstokens.Token{Value: "eyJhbGciOiJIUzI1NiJ9.token"} + + values, err := opts.BuildValues() + require.NoError(t, err) + + registration := values["kubernetesMonitor"].(map[string]any)["registration"].(map[string]any) + assert.Equal(t, "eyJhbGciOiJIUzI1NiJ9.token", registration["serverAccessToken"]) + assert.NotContains(t, registration, "serverAccessTokenSecretName") +} + +func TestBuildValues_KubernetesMonitorTrustsTheSuppliedCertificate(t *testing.T) { + opts := completedTargetOptions(t) + opts.KubernetesMonitor.Value = true + opts.ServerCertificate.Value = "LS0tLS1CRUdJTg==" + + values, err := opts.BuildValues() + require.NoError(t, err) + + registration := values["kubernetesMonitor"].(map[string]any)["registration"].(map[string]any) + assert.Equal(t, "LS0tLS1CRUdJTg==", registration["serverCertificate"]) +} + +// The monitor watches the objects deployments create, which only a deployment +// target has, so a worker never installs one. +func TestBuildValues_WorkerNeverGetsTheMonitor(t *testing.T) { + opts := completedWorkerOptions(t) + opts.KubernetesMonitor.Value = true + + values, err := opts.BuildValues() + require.NoError(t, err) + + assert.NotContains(t, values, "kubernetesMonitor") +} + +func TestBuildValues_MonitorIsLeftOutUnlessAskedFor(t *testing.T) { + values, err := completedTargetOptions(t).BuildValues() + require.NoError(t, err) + + assert.NotContains(t, values, "kubernetesMonitor", + "the subchart's own default keeps the monitor off, and setting anything would pin that") +} diff --git a/pkg/cmd/kubernetes/agent/install/prompt.go b/pkg/cmd/kubernetes/agent/install/prompt.go index 0ceb4db2..42760e1b 100644 --- a/pkg/cmd/kubernetes/agent/install/prompt.go +++ b/pkg/cmd/kubernetes/agent/install/prompt.go @@ -18,10 +18,6 @@ import ( // PromptMissing guards every prompt on its flag, so supplying a flag suppresses // the matching question and the generated automation command reproduces the run. func PromptMissing(ctx context.Context, opts *InstallOptions) error { - // Recorded before the defaults fill the rest in, so a supplied flag - // suppresses its prompt rather than merely seeding it. - suppliedPollingAddress := opts.ServerCommsAddress.Value != "" - if err := promptForEula(opts); err != nil { return err } @@ -33,7 +29,6 @@ func PromptMissing(ctx context.Context, opts *InstallOptions) error { if err := opts.resolveNames(); err != nil { return err } - opts.applyDefaults() if err := opts.validateMachinePolicy(); err != nil { return err } @@ -48,10 +43,8 @@ func PromptMissing(ctx context.Context, opts *InstallOptions) error { return err } - if !suppliedPollingAddress { - if err := promptForPollingAddress(opts); err != nil { - return err - } + if err := promptForPollingAddresses(opts); err != nil { + return err } if err := promptForStorage(opts); err != nil { @@ -161,17 +154,53 @@ func promptForDefaultNamespace(opts *InstallOptions) error { }, &opts.DefaultNamespace.Value) } +// promptForPollingAddresses asks per node when Octopus is a High Availability +// cluster: the agent polls every node, each on its own address, and only the +// person who set the cluster up knows what those are. +func promptForPollingAddresses(opts *InstallOptions) error { + if len(opts.ServerCommsAddresses.Value) > 0 { + return nil + } + + nodes := opts.haNodes() + if len(nodes) == 0 { + return promptForPollingAddress(opts) + } + + fmt.Fprintf(opts.Out, "\nThis Octopus Server is a High Availability cluster of %d nodes. The agent polls every\n"+ + "node, and each needs its own address - a load balancer cannot sit in between.\n", len(nodes)) + + for _, node := range nodes { + address := "" + if err := opts.Ask(&survey.Input{ + Message: fmt.Sprintf("Polling address for node %s", node.Name), + Help: fmt.Sprintf("The agent polls each node over TCP, on port %d by default, separately from the REST API on 443. "+ + "The connection has to reach that node intact - SSL offloading does not work.", octoK8s.DefaultPollingPort), + }, &address, survey.WithValidator(survey.Required)); err != nil { + return err + } + opts.ServerCommsAddresses.Value = append(opts.ServerCommsAddresses.Value, strings.TrimSpace(address)) + } + return nil +} + func promptForPollingAddress(opts *InstallOptions) error { // Derived from the URL the CLI is logged in to, which is nearly always // right - but the port is configurable, and a proxy that terminates TLS // breaks the agent, so confirm it. - return opts.Ask(&survey.Input{ + address := octoK8s.DerivePollingURL(opts.Host) + if err := opts.Ask(&survey.Input{ Message: "Octopus Server polling address", - Default: opts.ServerCommsAddress.Value, + Default: address, Help: fmt.Sprintf("The agent polls Octopus over TCP, on port %d by default, separately from the REST API on 443. "+ "Octopus Cloud serves this on its own hostname over 443. The connection has to reach Octopus intact - SSL offloading does not work.", octoK8s.DefaultPollingPort), - }, &opts.ServerCommsAddress.Value, survey.WithValidator(survey.Required)) + }, &address, survey.WithValidator(survey.Required)); err != nil { + return err + } + + opts.ServerCommsAddresses.Value = []string{strings.TrimSpace(address)} + return nil } // promptForStorage asks only where the volume comes from. The access mode diff --git a/pkg/cmd/kubernetes/agent/install/review.go b/pkg/cmd/kubernetes/agent/install/review.go index 0372ddb2..a9e27cac 100644 --- a/pkg/cmd/kubernetes/agent/install/review.go +++ b/pkg/cmd/kubernetes/agent/install/review.go @@ -94,9 +94,13 @@ func octopusItems(opts *InstallOptions) []shared.Item { {Label: "Server", Value: opts.Host, Source: "from your login"}, {Label: "Space", Value: opts.spaceName(), Source: "from your login"}, { - Label: "Polling address", Value: opts.ServerCommsAddress.Value, Source: "derived from the server address", - Edit: shared.EditText(opts.Ask, &opts.ServerCommsAddress.Value, "Octopus Server polling address", - func() string { return opts.ServerCommsAddress.Value }), + Label: pollingLabel(opts), + Value: strings.Join(opts.ServerCommsAddresses.Value, ", "), + Source: pollingSource(opts), + Edit: func(context.Context) error { + opts.ServerCommsAddresses.Value = nil + return promptForPollingAddresses(opts) + }, }, {Label: "Registration", Value: registrationSummary(opts), Source: opts.Token.Describe()}, { @@ -149,6 +153,14 @@ func deploymentTargetItems(opts *InstallOptions) []shared.Item { Source: "chosen", }) } + + if opts.monitorEnabled() { + items = append(items, shared.Item{ + Label: "Kubernetes monitor", + Value: "installed alongside the agent", + Source: "streams live status of deployed objects to Octopus over gRPC", + }) + } return items } @@ -208,8 +220,8 @@ func helmItems(opts *InstallOptions) []shared.Item { return []shared.Item{ {Label: "Chart", Value: ChartRef.Ref}, { - Label: "Chart version", Value: shared.OrDefault(opts.ChartVersion.Value, "latest"), - Edit: shared.EditText(opts.Ask, &opts.ChartVersion.Value, "Chart version (blank for the latest)", + Label: "Chart version", Value: shared.OrDefault(opts.ChartVersion.Value, ChartRef.Version), + Edit: shared.EditText(opts.Ask, &opts.ChartVersion.Value, fmt.Sprintf("Chart version (blank for %s)", ChartRef.Version), func() string { return opts.ChartVersion.Value }), }, { @@ -230,6 +242,20 @@ func registrationSummary(opts *InstallOptions) string { return fmt.Sprintf("the agent registers itself as a %s", opts.Mode) } +func pollingLabel(opts *InstallOptions) string { + if len(opts.ServerCommsAddresses.Value) > 1 { + return "Polling addresses" + } + return "Polling address" +} + +func pollingSource(opts *InstallOptions) string { + if len(opts.ServerCommsAddresses.Value) > 1 { + return "one per Octopus Server node" + } + return "derived from the server address" +} + func certificateSummary(opts *InstallOptions) string { if opts.ServerCertificate.Value == "" { return "(publicly trusted)" diff --git a/pkg/cmd/kubernetes/gateway/install/commit.go b/pkg/cmd/kubernetes/gateway/install/commit.go index 2c793317..289a3432 100644 --- a/pkg/cmd/kubernetes/gateway/install/commit.go +++ b/pkg/cmd/kubernetes/gateway/install/commit.go @@ -4,7 +4,6 @@ import ( "context" "errors" "fmt" - "os" "strings" "time" @@ -14,7 +13,6 @@ import ( "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" "github.com/OctopusDeploy/cli/pkg/output" "github.com/OctopusDeploy/cli/pkg/util/flag" - "sigs.k8s.io/yaml" ) func (opts *InstallOptions) Commit(ctx context.Context) error { @@ -204,23 +202,11 @@ func (opts *InstallOptions) BuildValues() (map[string]any, error) { } func (opts *InstallOptions) writeValuesFile(values map[string]any) error { - if opts.OutputValues.Value == "" { - return nil - } - - encoded, err := yaml.Marshal(values) - if err != nil { - return fmt.Errorf("could not encode the Helm values: %w", err) - } - if err := os.WriteFile(opts.OutputValues.Value, encoded, 0o600); err != nil { - return fmt.Errorf("could not write %s: %w", opts.OutputValues.Value, err) - } - - fmt.Fprintf(opts.Out, "Wrote Helm values to %s\n", output.Cyan(opts.OutputValues.Value)) + warning := "" if opts.InlineSecrets.Value { - fmt.Fprintf(opts.Out, "%s This file contains credentials in plain text.\n", output.Yellow("!")) + warning = "This file contains credentials in plain text." } - return nil + return shared.WriteValuesFile(opts.Out, opts.OutputValues.Value, values, warning) } func (opts *InstallOptions) preflight() *shared.Preflight { @@ -297,7 +283,7 @@ func (opts *InstallOptions) registrationSecretContents() (string, error) { var b strings.Builder fmt.Fprintf(&b, "octopus-grpc-authentication-token: %q\n", opts.Registration.AuthenticationToken) fmt.Fprintf(&b, "octopus-grpc-client-id: %q\n", opts.Registration.ClientID) - if thumbprint := opts.Registration.Thumb(); thumbprint != "" { + if thumbprint := opts.Registration.CertificateThumbprint; thumbprint != "" { fmt.Fprintf(&b, "octopus-grpc-thumbprint: %q\n", thumbprint) } return b.String(), nil diff --git a/pkg/cmd/kubernetes/gateway/install/environments_test.go b/pkg/cmd/kubernetes/gateway/install/environments_test.go new file mode 100644 index 00000000..dc0f524f --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/environments_test.go @@ -0,0 +1,43 @@ +package install_test + +import ( + "context" + "testing" + + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/gateway/install" + "github.com/OctopusDeploy/cli/test/testutil" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +// Octopus's registration API takes an environment slug or ID, not the display +// name someone naturally types, so whatever --environment was given is +// resolved before it is sent. +func TestResolveWithoutPrompting_EnvironmentNamesBecomeSlugs(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := completedFlags() + flags.Environments.Value = []string{"Production", "development"} + opts := newOptions(t, flags, asker) + + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) + assert.Equal(t, []string{"production", "development"}, flags.Environments.Value) +} + +func TestResolveWithoutPrompting_RejectsAnUnknownEnvironment(t *testing.T) { + asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) + + flags := completedFlags() + flags.Environments.Value = []string{"Staging"} + opts := newOptions(t, flags, asker) + + assert.ErrorContains(t, opts.ResolveWithoutPrompting(context.Background()), `"Staging"`) +} + +func completedFlags() *install.InstallFlags { + flags := install.NewInstallFlags() + flags.Name.Value = "Production" + flags.Environments.Value = []string{"production"} + flags.ArgoCDToken.Value = "eyJhbGciOiJIUzI1NiJ9.token" + return flags +} diff --git a/pkg/cmd/kubernetes/gateway/install/install.go b/pkg/cmd/kubernetes/gateway/install/install.go index c0684194..8394b206 100644 --- a/pkg/cmd/kubernetes/gateway/install/install.go +++ b/pkg/cmd/kubernetes/gateway/install/install.go @@ -315,6 +315,10 @@ func (opts *InstallOptions) validateForAutomation() error { } func (opts *InstallOptions) ResolveWithoutPrompting(ctx context.Context) error { + if err := opts.resolveEnvironments(); err != nil { + return err + } + instance, err := opts.selectInstanceByFlag() if err != nil { return err @@ -413,10 +417,49 @@ func (opts *InstallOptions) resolveNames() error { // Run installs the gateway using an existing set of dependencies. The // `kubernetes install` wizard uses this to hand off after the user picks a // component, so the two entry points share one implementation. -func Run(_ factory.Factory, dependencies *cmd.Dependencies) error { +func Run(dependencies *cmd.Dependencies) error { return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies)) } +// resolveEnvironments turns whatever --environment was given into the slug +// Octopus's registration API accepts, matching by name, slug, or ID. The +// prompt already collects slugs, so this only has work to do when the flag was +// used. +func (opts *InstallOptions) resolveEnvironments() error { + if len(opts.Environments.Value) == 0 || opts.GetAllEnvironmentsCallback == nil { + return nil + } + + all, err := opts.GetAllEnvironmentsCallback() + if err != nil { + return err + } + + resolved := make([]string, 0, len(opts.Environments.Value)) + for _, given := range opts.Environments.Value { + environment, found := matchEnvironment(all, given) + if !found { + return fmt.Errorf("no environment named %q exists in this space", given) + } + resolved = append(resolved, environmentReference(environment)) + } + + opts.Environments.Value = resolved + return nil +} + +func matchEnvironment(all []*environments.Environment, given string) (*environments.Environment, bool) { + given = strings.TrimSpace(given) + for _, environment := range all { + if strings.EqualFold(environment.Name, given) || + strings.EqualFold(environment.Slug, given) || + strings.EqualFold(environment.GetID(), given) { + return environment, true + } + } + return nil, false +} + // accountName is the Argo CD account, or role, Octopus authenticates as. // Defaulted here as well as during discovery so a caller that reaches a prompt // by another route cannot end up with a blank one. diff --git a/pkg/cmd/kubernetes/gateway/install/prompt.go b/pkg/cmd/kubernetes/gateway/install/prompt.go index 76649594..b7a07689 100644 --- a/pkg/cmd/kubernetes/gateway/install/prompt.go +++ b/pkg/cmd/kubernetes/gateway/install/prompt.go @@ -47,8 +47,10 @@ func PromptMissing(ctx context.Context, opts *InstallOptions) error { } func promptForEnvironments(opts *InstallOptions) error { + // Given by flag: still resolved, because the registration API takes a slug + // or an ID, not the display name someone naturally types. if len(opts.Environments.Value) > 0 { - return nil + return opts.resolveEnvironments() } selected, err := selectors.EnvironmentsMultiSelect(opts.Ask, opts.GetAllEnvironmentsCallback, diff --git a/pkg/cmd/kubernetes/gateway/install/registration_test.go b/pkg/cmd/kubernetes/gateway/install/registration_test.go index 7d0cb956..bac87f41 100644 --- a/pkg/cmd/kubernetes/gateway/install/registration_test.go +++ b/pkg/cmd/kubernetes/gateway/install/registration_test.go @@ -34,22 +34,10 @@ func TestRegistrationSecret_HoldsOnlyTheGatewaysOwnCredential(t *testing.T) { assert.Contains(t, contents, `octopus-grpc-thumbprint: "AABBCCDDEEFF00112233445566778899AABBCCDD"`) } -// Octopus has spelled the thumbprint both ways. -func TestRegistrationSecret_AcceptsEitherThumbprintSpelling(t *testing.T) { - opts := registeredOptions(t) - opts.Registration.CertificateThumbprint = "" - opts.Registration.Thumbprint = "1122334455" - - contents, err := opts.RegistrationSecretForTest() - require.NoError(t, err) - assert.Contains(t, contents, `octopus-grpc-thumbprint: "1122334455"`) -} - // A server that returns no thumbprint should not produce an empty setting. func TestRegistrationSecret_OmitsAnAbsentThumbprint(t *testing.T) { opts := registeredOptions(t) opts.Registration.CertificateThumbprint = "" - opts.Registration.Thumbprint = "" contents, err := opts.RegistrationSecretForTest() require.NoError(t, err) diff --git a/pkg/cmd/kubernetes/gateway/install/review.go b/pkg/cmd/kubernetes/gateway/install/review.go index 6810ac95..15a545ea 100644 --- a/pkg/cmd/kubernetes/gateway/install/review.go +++ b/pkg/cmd/kubernetes/gateway/install/review.go @@ -265,7 +265,8 @@ func credentialPlacement(opts *InstallOptions) string { return "Argo CD token in a Kubernetes Secret" } -func RenderReviewForDemo(opts *InstallOptions) { +// RenderReviewForTest prints the review screen without asking anything. +func RenderReviewForTest(opts *InstallOptions) { _ = opts.resolveNames() shared.PrintReview(opts.Out, reviewGroups(opts)) } diff --git a/pkg/cmd/kubernetes/gateway/install/review_test.go b/pkg/cmd/kubernetes/gateway/install/review_test.go index 816b497e..87bbf6aa 100644 --- a/pkg/cmd/kubernetes/gateway/install/review_test.go +++ b/pkg/cmd/kubernetes/gateway/install/review_test.go @@ -22,7 +22,7 @@ func reviewOf(t *testing.T, opts *install.InstallOptions) string { out := &bytes.Buffer{} opts.Out = out - install.RenderReviewForDemo(opts) + install.RenderReviewForTest(opts) return out.String() } diff --git a/pkg/cmd/kubernetes/install/install.go b/pkg/cmd/kubernetes/install/install.go index 2d52c785..7a867a7c 100644 --- a/pkg/cmd/kubernetes/install/install.go +++ b/pkg/cmd/kubernetes/install/install.go @@ -20,7 +20,7 @@ import ( type component struct { display string cmdPath string - install func(f factory.Factory, dependencies *cmd.Dependencies, cmdPath string) error + install func(dependencies *cmd.Dependencies) error } func components() []component { @@ -28,30 +28,22 @@ func components() []component { { display: "Kubernetes agent - run Kubernetes deployments from inside the cluster", cmdPath: constants.ExecutableName + " kubernetes agent install", - install: func(f factory.Factory, dependencies *cmd.Dependencies, cmdPath string) error { - return agentInstall.Run(f, cmd.NewDependenciesFromExisting(dependencies, cmdPath)) - }, + install: agentInstall.Run, }, { display: "Kubernetes worker - run Octopus steps in the cluster, one pod per task", cmdPath: constants.ExecutableName + " kubernetes worker install", - install: func(f factory.Factory, dependencies *cmd.Dependencies, cmdPath string) error { - return agentInstall.RunWorker(f, cmd.NewDependenciesFromExisting(dependencies, cmdPath)) - }, + install: agentInstall.RunWorker, }, { display: "Argo CD gateway - connect an Argo CD instance to Octopus", cmdPath: constants.ExecutableName + " kubernetes gateway install", - install: func(f factory.Factory, dependencies *cmd.Dependencies, cmdPath string) error { - return gatewayInstall.Run(f, cmd.NewDependenciesFromExisting(dependencies, cmdPath)) - }, + install: gatewayInstall.Run, }, { display: "Permissions controller - scope what an agent's script pods are allowed to do", cmdPath: constants.ExecutableName + " kubernetes permissions-controller install", - install: func(f factory.Factory, dependencies *cmd.Dependencies, cmdPath string) error { - return permissionsControllerInstall.Run(f, cmd.NewDependenciesFromExisting(dependencies, cmdPath)) - }, + install: permissionsControllerInstall.Run, }, } } @@ -81,7 +73,9 @@ func NewCmdInstall(f factory.Factory) *cobra.Command { return err } - return selected.install(f, dependencies, selected.cmdPath) + // The chosen component's own command path, so the automation command + // it prints at the end reproduces the run without the wizard. + return selected.install(cmd.NewDependenciesFromExisting(dependencies, selected.cmdPath)) }, } } diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/commit.go b/pkg/cmd/kubernetes/permissionscontroller/install/commit.go index f6ca073b..8fe21896 100644 --- a/pkg/cmd/kubernetes/permissionscontroller/install/commit.go +++ b/pkg/cmd/kubernetes/permissionscontroller/install/commit.go @@ -4,7 +4,6 @@ import ( "context" "errors" "fmt" - "os" "strings" "time" @@ -16,7 +15,6 @@ import ( "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" "github.com/OctopusDeploy/cli/pkg/output" "github.com/OctopusDeploy/cli/pkg/util/flag" - "sigs.k8s.io/yaml" ) func (opts *InstallOptions) Commit(ctx context.Context) error { @@ -27,7 +25,7 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { values := opts.BuildValues() - if err := opts.writeValuesFile(values); err != nil { + if err := shared.WriteValuesFile(opts.Out, opts.OutputValues.Value, values, ""); err != nil { return err } @@ -90,23 +88,6 @@ func (opts *InstallOptions) BuildValues() map[string]any { return values } -func (opts *InstallOptions) writeValuesFile(values map[string]any) error { - if opts.OutputValues.Value == "" { - return nil - } - - encoded, err := yaml.Marshal(values) - if err != nil { - return fmt.Errorf("could not encode the Helm values: %w", err) - } - if err := os.WriteFile(opts.OutputValues.Value, encoded, 0o600); err != nil { - return fmt.Errorf("could not write %s: %w", opts.OutputValues.Value, err) - } - - fmt.Fprintf(opts.Out, "Wrote Helm values to %s\n", output.Cyan(opts.OutputValues.Value)) - return nil -} - // PrerequisiteChecks cover what the controller needs from the cluster rather // than from the network. It makes no outbound connection, so unlike the other // installers there is nothing to dial and no check pod to start. diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/install.go b/pkg/cmd/kubernetes/permissionscontroller/install/install.go index 0069093d..a5bb2047 100644 --- a/pkg/cmd/kubernetes/permissionscontroller/install/install.go +++ b/pkg/cmd/kubernetes/permissionscontroller/install/install.go @@ -174,7 +174,7 @@ func describeCommonFlags(command *cobra.Command) { // Run installs the controller using an existing set of dependencies. The // `kubernetes install` wizard uses this to hand off after the user picks a // component, so the two entry points share one implementation. -func Run(_ factory.Factory, dependencies *cmd.Dependencies) error { +func Run(dependencies *cmd.Dependencies) error { return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies)) } diff --git a/pkg/cmd/kubernetes/shared/values.go b/pkg/cmd/kubernetes/shared/values.go new file mode 100644 index 00000000..3297f3f5 --- /dev/null +++ b/pkg/cmd/kubernetes/shared/values.go @@ -0,0 +1,33 @@ +package shared + +import ( + "fmt" + "io" + "os" + + "github.com/OctopusDeploy/cli/pkg/output" + "sigs.k8s.io/yaml" +) + +// WriteValuesFile writes the resolved Helm values where --output-values asked +// for them. secretsWarning, when set, is printed after the file is written, +// because writing credentials to disk should never happen silently. +func WriteValuesFile(out io.Writer, path string, values map[string]any, secretsWarning string) error { + if path == "" { + return nil + } + + encoded, err := yaml.Marshal(values) + if err != nil { + return fmt.Errorf("could not encode the Helm values: %w", err) + } + if err := os.WriteFile(path, encoded, 0o600); err != nil { + return fmt.Errorf("could not write %s: %w", path, err) + } + + fmt.Fprintf(out, "Wrote Helm values to %s\n", output.Cyan(path)) + if secretsWarning != "" { + fmt.Fprintf(out, "%s %s\n", output.Yellow("!"), secretsWarning) + } + return nil +} diff --git a/pkg/kubernetes/argocd/eks.go b/pkg/kubernetes/argocd/eks.go index d247e6d5..8bbc1881 100644 --- a/pkg/kubernetes/argocd/eks.go +++ b/pkg/kubernetes/argocd/eks.go @@ -19,10 +19,6 @@ const awsTimeout = 30 * time.Second const argoCapabilityType = "ARGOCD" -// UnscopedProject names the token the gateway falls back on for Argo CD calls -// that are not project-scoped. -const UnscopedProject = "octo-gateway-unscoped" - // ProjectToken is a project role token. AWS caps account token lifetimes at 12 // hours, so managed instances authenticate per project instead. type ProjectToken struct { diff --git a/pkg/kubernetes/argocd/token.go b/pkg/kubernetes/argocd/token.go index 5a199534..b5eb9709 100644 --- a/pkg/kubernetes/argocd/token.go +++ b/pkg/kubernetes/argocd/token.go @@ -329,10 +329,6 @@ func (c *Client) VerifyAccess(ctx context.Context) AccessCheck { return check } -func (c *Client) ListApplicationNames(ctx context.Context) ([]string, error) { - return c.listNames(ctx, "/api/v1/applications") -} - func (c *Client) listNames(ctx context.Context, path string) ([]string, error) { var response struct { Items []struct { diff --git a/pkg/kubernetes/cluster.go b/pkg/kubernetes/cluster.go index fff613eb..c0b0902e 100644 --- a/pkg/kubernetes/cluster.go +++ b/pkg/kubernetes/cluster.go @@ -3,6 +3,7 @@ package kubernetes import ( "context" "fmt" + "slices" "sort" "strings" "time" @@ -439,7 +440,7 @@ func (r Role) Reference() string { // before somebody copies it expecting to have restricted something. func (r Role) GrantsEverything() bool { for _, rule := range r.Rules { - if contains(rule.Verbs, "*") && contains(rule.APIGroups, "*") && contains(rule.Resources, "*") { + if slices.Contains(rule.Verbs, "*") && slices.Contains(rule.APIGroups, "*") && slices.Contains(rule.Resources, "*") { return true } } @@ -569,12 +570,3 @@ func addStrings(value map[string]any, key string, values []string) { value[key] = values } } - -func contains(values []string, wanted string) bool { - for _, value := range values { - if value == wanted { - return true - } - } - return false -} diff --git a/pkg/kubernetes/kubeconfig.go b/pkg/kubernetes/kubeconfig.go index 6c30cd92..a6f7c669 100644 --- a/pkg/kubernetes/kubeconfig.go +++ b/pkg/kubernetes/kubeconfig.go @@ -39,7 +39,6 @@ func (c Context) Display() string { } type KubeConfig struct { - path string loader clientcmd.ClientConfigLoader raw clientcmdapi.Config } @@ -57,7 +56,7 @@ func LoadKubeConfig(explicitPath string) (*KubeConfig, error) { return nil, fmt.Errorf("could not load kubeconfig: %w", err) } - return &KubeConfig{path: explicitPath, loader: rules, raw: *raw}, nil + return &KubeConfig{loader: rules, raw: *raw}, nil } func (k *KubeConfig) Contexts() []Context { @@ -103,10 +102,6 @@ func (k *KubeConfig) FindContext(name string) (Context, error) { return Context{}, fmt.Errorf("no context named %q exists in the kubeconfig", name) } -func (k *KubeConfig) Path() string { - return k.path -} - // RestConfig builds a client-go configuration. An empty contextName uses the // kubeconfig's current context. func (k *KubeConfig) RestConfig(contextName string) (*rest.Config, error) { diff --git a/pkg/kubernetes/naming.go b/pkg/kubernetes/naming.go index da5f647e..85551b51 100644 --- a/pkg/kubernetes/naming.go +++ b/pkg/kubernetes/naming.go @@ -11,6 +11,7 @@ import ( const ( ArgoCDGatewayNamespacePrefix = "octo-argo-gateway-" AgentNamespacePrefix = "octopus-agent-" + WorkerNamespacePrefix = "octopus-worker-" // Only one permissions controller can run per cluster, so this is fixed. PermissionsControllerNamespace = "octopus-permissions-controller-system" diff --git a/pkg/kubernetes/octopus.go b/pkg/kubernetes/octopus.go index 223dcd5a..9ae8f3a6 100644 --- a/pkg/kubernetes/octopus.go +++ b/pkg/kubernetes/octopus.go @@ -33,6 +33,23 @@ const DefaultPollingPort = 10943 // only allows that port. var cloudDomains = []string{".octopus.app", ".testoctopus.app"} +// IsOctopusCloud reports whether this server is hosted by Octopus, which serves +// every polling connection on one shared address however many nodes it runs. +func IsOctopusCloud(serverURL string) bool { + parsed, err := url.Parse(strings.TrimSpace(serverURL)) + if err != nil || parsed.Hostname() == "" { + return false + } + + host := strings.ToLower(parsed.Hostname()) + for _, domain := range cloudDomains { + if strings.HasSuffix(host, domain) { + return true + } + } + return false +} + // DerivePollingURL is a starting point to confirm rather than a guarantee. The // port is configurable on a self-hosted server, and a load balancer in front of // Octopus has to pass the connection through untouched - the protocol needs an @@ -48,12 +65,8 @@ func DerivePollingURL(serverURL string) string { return "" } - host := parsed.Hostname() - for _, domain := range cloudDomains { - if strings.HasSuffix(strings.ToLower(host), domain) { - return fmt.Sprintf("https://polling.%s", host) - } + if IsOctopusCloud(serverURL) { + return fmt.Sprintf("https://polling.%s", parsed.Hostname()) } - - return fmt.Sprintf("https://%s:%d", host, DefaultPollingPort) + return fmt.Sprintf("https://%s:%d", parsed.Hostname(), DefaultPollingPort) } diff --git a/pkg/octopusservernodes/octopusservernodes.go b/pkg/octopusservernodes/octopusservernodes.go new file mode 100644 index 00000000..0ba417dc --- /dev/null +++ b/pkg/octopusservernodes/octopusservernodes.go @@ -0,0 +1,57 @@ +// Package octopusservernodes reads the Octopus Server cluster topology, which +// is how an installer learns it is talking to a High Availability cluster: a +// polling agent connects to every node, and each node needs its own address. +package octopusservernodes + +import ( + "fmt" + "time" + + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/newclient" +) + +const path = "/api/octopusservernodes/summary" + +type Node struct { + Name string `json:"Name"` + // MaxConcurrentTasks is zero for a node that only serves the web UI, which + // a polling agent never needs to reach. + MaxConcurrentTasks int `json:"MaxConcurrentTasks"` + IsOffline bool `json:"IsOffline"` + // LastSeen is nil when the node has never reported in. + LastSeen *time.Time `json:"LastSeen"` +} + +// decommissionedAfter matches the Octopus portal: an offline node not seen for +// this long is treated as removed rather than merely restarting. +const decommissionedAfter = 5 * 24 * time.Hour + +// TaskNodes returns the nodes an agent would poll: the ones that run tasks and +// have not been gone long enough to call decommissioned. +func TaskNodes(client newclient.Client) ([]Node, error) { + response, err := newclient.Get[struct { + Nodes []Node `json:"Nodes"` + }](client.HttpSession(), path) + if err != nil { + return nil, fmt.Errorf("could not read the Octopus Server's nodes: %w", err) + } + + nodes := make([]Node, 0, len(response.Nodes)) + for _, node := range response.Nodes { + if node.runsTasks() && !node.decommissioned() { + nodes = append(nodes, node) + } + } + return nodes, nil +} + +func (n Node) runsTasks() bool { + return n.MaxConcurrentTasks != 0 +} + +func (n Node) decommissioned() bool { + if !n.IsOffline { + return false + } + return n.LastSeen == nil || time.Since(*n.LastSeen) > decommissionedAfter +} diff --git a/pkg/question/helpers_test.go b/pkg/question/helpers_test.go index bd1db981..3994e3af 100644 --- a/pkg/question/helpers_test.go +++ b/pkg/question/helpers_test.go @@ -1 +1,2 @@ package question_test + diff --git a/pkg/surveyext/select.go b/pkg/surveyext/select.go index 597b40f9..cc915268 100644 --- a/pkg/surveyext/select.go +++ b/pkg/surveyext/select.go @@ -13,7 +13,6 @@ import ( /* Select is a prompt that presents a list of various options to the user for them to select using the arrow keys and enter. Response type is a string. - color := "" prompt := &survey.Select{ Message: "Choose a color:", From 8052aa128678d61c44f3f2c2b553fc6756b54b7c Mon Sep 17 00:00:00 2001 From: Liam Mackie Date: Wed, 2 Sep 2026 10:59:13 +1000 Subject: [PATCH 6/7] cleanup --- cmd/octopus/main.go | 4 +- pkg/accesstokens/accesstokens.go | 16 +-- pkg/apiclient/client_factory.go | 47 ++++---- pkg/apiclient/remember_space_test.go | 3 +- pkg/cmd/kubernetes/agent/install/commit.go | 58 +++------- .../kubernetes/agent/install/export_test.go | 25 +++++ pkg/cmd/kubernetes/agent/install/install.go | 51 ++------- pkg/cmd/kubernetes/agent/install/prompt.go | 7 +- pkg/cmd/kubernetes/agent/install/review.go | 69 ++---------- .../kubernetes/gateway/install/argosetup.go | 5 +- pkg/cmd/kubernetes/gateway/install/commit.go | 91 +++++---------- .../kubernetes/gateway/install/export_test.go | 30 +++++ pkg/cmd/kubernetes/gateway/install/install.go | 54 ++------- pkg/cmd/kubernetes/gateway/install/prompt.go | 6 +- .../gateway/install/registration_test.go | 3 +- pkg/cmd/kubernetes/gateway/install/review.go | 69 ++---------- .../kubernetes/gateway/rotatetoken/rotate.go | 106 +++++++----------- .../permissionscontroller/install/commit.go | 75 +++---------- .../install/export_test.go | 25 +++++ .../permissionscontroller/install/install.go | 93 +++++---------- .../permissionscontroller/install/review.go | 53 +-------- .../install/review_test.go | 3 +- pkg/cmd/kubernetes/shared/cluster.go | 2 +- pkg/cmd/kubernetes/shared/flags.go | 106 ++++++++++++++++++ pkg/cmd/kubernetes/shared/preflight.go | 35 ++++-- pkg/cmd/kubernetes/shared/report.go | 46 ++++++++ pkg/cmd/kubernetes/shared/review.go | 64 +++++++++++ pkg/cmd/target/shared/tenant.go | 6 +- pkg/kubernetes/agent/agent.go | 90 ++++----------- pkg/kubernetes/agent/agent_internal_test.go | 21 ---- pkg/kubernetes/agent/agent_test.go | 40 ------- pkg/kubernetes/argocd/account.go | 3 +- pkg/kubernetes/argocd/bootstrap.go | 16 +-- pkg/kubernetes/argocd/discover.go | 15 ++- pkg/kubernetes/argocd/eks.go | 14 +-- pkg/kubernetes/argocd/token.go | 27 +---- pkg/kubernetes/cluster.go | 18 ++- pkg/kubernetes/flags.go | 87 +------------- pkg/kubernetes/gateway/gateway.go | 48 ++++++++ pkg/kubernetes/helm/runner.go | 38 ++++--- pkg/kubernetes/helm/values.go | 35 ++++++ pkg/kubernetes/helm/values_test.go | 29 +++++ pkg/kubernetes/naming.go | 19 ++++ .../permissionscontroller.go | 37 ++++++ .../permissionscontroller_test.go | 58 ++++++++++ pkg/kubernetes/preflight.go | 31 ++++- pkg/question/ask.go | 6 + pkg/surveyext/asker.go | 26 +++-- pkg/util/jwt.go | 33 ++++++ pkg/util/util.go | 9 ++ 50 files changed, 940 insertions(+), 912 deletions(-) create mode 100644 pkg/cmd/kubernetes/agent/install/export_test.go create mode 100644 pkg/cmd/kubernetes/gateway/install/export_test.go create mode 100644 pkg/cmd/kubernetes/permissionscontroller/install/export_test.go create mode 100644 pkg/cmd/kubernetes/shared/flags.go create mode 100644 pkg/cmd/kubernetes/shared/report.go create mode 100644 pkg/kubernetes/gateway/gateway.go create mode 100644 pkg/kubernetes/helm/values.go create mode 100644 pkg/kubernetes/helm/values_test.go create mode 100644 pkg/kubernetes/permissionscontroller/permissionscontroller.go create mode 100644 pkg/kubernetes/permissionscontroller/permissionscontroller_test.go create mode 100644 pkg/util/jwt.go diff --git a/cmd/octopus/main.go b/cmd/octopus/main.go index 189f82d4..24c133d3 100644 --- a/cmd/octopus/main.go +++ b/cmd/octopus/main.go @@ -15,10 +15,10 @@ import ( "github.com/briandowns/spinner" "github.com/spf13/viper" + "github.com/AlecAivazis/survey/v2" "github.com/OctopusDeploy/cli/pkg/config" "github.com/OctopusDeploy/cli/pkg/factory" "github.com/OctopusDeploy/cli/pkg/question" - "github.com/OctopusDeploy/cli/pkg/surveyext" "github.com/OctopusDeploy/cli/pkg/usage" "github.com/joho/godotenv" @@ -41,7 +41,7 @@ func main() { // initialize our wrapper around survey, which is also used as a flag for whether // we are in interactive mode or automation mode - askProvider := question.NewAskProvider(surveyext.AskOne) + askProvider := question.NewAskProvider(survey.AskOne) _, ci := os.LookupEnv("CI") // TODO move this to some other function and have it look for GITHUB_ACTIONS etc as we learn more about it if ci { diff --git a/pkg/accesstokens/accesstokens.go b/pkg/accesstokens/accesstokens.go index c82cce9e..59f66a3d 100644 --- a/pkg/accesstokens/accesstokens.go +++ b/pkg/accesstokens/accesstokens.go @@ -8,13 +8,11 @@ package accesstokens import ( - "encoding/base64" - "encoding/json" "errors" "fmt" - "strings" "time" + "github.com/OctopusDeploy/cli/pkg/util" "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/newclient" ) @@ -55,20 +53,10 @@ func Generate(client newclient.Client) (Token, error) { // can do. A token that cannot be read is still usable, so this reports no // expiry rather than an error. func expiry(token string) time.Time { - parts := strings.Split(strings.TrimSpace(token), ".") - if len(parts) != 3 { - return time.Time{} - } - - payload, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(parts[1], "=")) - if err != nil { - return time.Time{} - } - var claims struct { Expires int64 `json:"exp"` } - if err := json.Unmarshal(payload, &claims); err != nil || claims.Expires <= 0 { + if err := util.DecodeJWTClaims(token, &claims); err != nil || claims.Expires <= 0 { return time.Time{} } return time.Unix(claims.Expires, 0) diff --git a/pkg/apiclient/client_factory.go b/pkg/apiclient/client_factory.go index 8a89083a..f7d87669 100644 --- a/pkg/apiclient/client_factory.go +++ b/pkg/apiclient/client_factory.go @@ -77,11 +77,20 @@ type Client struct { Ask question.AskProvider // RememberSpace saves an interactively chosen space as the default, so a - // person is asked once rather than on every command. Nil in tests. - RememberSpace func(spaceNameOrID string) error + // person is asked once rather than on every command. It owns its own + // reporting, so this layer does no terminal IO. Nil in tests. + RememberSpace func(spaceNameOrID string) } func NewClientFactory(httpClient *http.Client, host string, credentials octopusApiClient.ICredential, spaceNameOrID string, ask question.AskProvider) (ClientFactory, error) { + client, err := newClient(httpClient, host, credentials, spaceNameOrID, ask) + if err != nil { + return nil, err + } + return client, nil +} + +func newClient(httpClient *http.Client, host string, credentials octopusApiClient.ICredential, spaceNameOrID string, ask question.AskProvider) (*Client, error) { // httpClient is allowed to be nil; it is passed through to the go-octopusdeploy library which falls back to a default httpClient if host == "" { return nil, cliErrors.NewArgumentNullOrEmptyError("host") @@ -101,7 +110,7 @@ func NewClientFactory(httpClient *http.Client, host string, credentials octopusA return nil, err } - clientImpl := &Client{ + return &Client{ HttpClient: httpClient, SystemClient: nil, SpaceScopedClient: nil, @@ -110,26 +119,15 @@ func NewClientFactory(httpClient *http.Client, host string, credentials octopusA SpaceNameOrID: spaceNameOrID, ActiveSpace: nil, Ask: ask, - } - return clientImpl, nil + }, nil } // rememberSpace saves only a choice the person actually made: a space from // --space, the environment, or a server with just one was never asked about. func (c *Client) rememberSpace(space *spaces.Space) { - if c.RememberSpace == nil { - return - } - - if err := c.RememberSpace(space.Name); err != nil { - // A convenience, so failing at it is not worth stopping for. - fmt.Fprintf(os.Stderr, "Could not save %s as your default space: %v\n", space.Name, err) - return + if c.RememberSpace != nil { + c.RememberSpace(space.Name) } - - // Say so rather than quietly editing the config file. - fmt.Fprintf(os.Stderr, "Saved %s as your default space. Change it with '%s config set Space '.\n", - space.Name, constants.ExecutableName) } // NewClientFactoryFromConfig Creates a new Client wrapper structure by reading the viper config. @@ -174,17 +172,22 @@ func NewClientFactoryFromConfig(ask question.AskProvider) (ClientFactory, error) credentials = accessTokenCredential } - factory, err := NewClientFactory(httpClient, host, credentials, spaceNameOrID, ask) + client, err := newClient(httpClient, host, credentials, spaceNameOrID, ask) if err != nil { return nil, err } - if client, ok := factory.(*Client); ok { - client.RememberSpace = func(space string) error { - return config.New(viper.GetViper()).Set(constants.ConfigSpace, space) + client.RememberSpace = func(space string) { + if err := config.New(viper.GetViper()).Set(constants.ConfigSpace, space); err != nil { + // A convenience, so failing at it is not worth stopping for. + fmt.Fprintf(os.Stderr, "Could not save %s as your default space: %v\n", space, err) + return } + // Say so rather than quietly editing the config file. + fmt.Fprintf(os.Stderr, "Saved %s as your default space. Change it with '%s config set Space '.\n", + space, constants.ExecutableName) } - return factory, nil + return client, nil } func ValidateMandatoryEnvironment(host string, apiKey string, accessToken string, isInteractive bool) error { diff --git a/pkg/apiclient/remember_space_test.go b/pkg/apiclient/remember_space_test.go index 6f700be9..deb82851 100644 --- a/pkg/apiclient/remember_space_test.go +++ b/pkg/apiclient/remember_space_test.go @@ -30,9 +30,8 @@ func rememberingFactory(t *testing.T, api *testutil.MockHttpServer, asker *testu question.NewAskProvider(asker.AsAsker())) require.NoError(t, err) - factory.(*apiclient.Client).RememberSpace = func(space string) error { + factory.(*apiclient.Client).RememberSpace = func(space string) { *saved = space - return nil } return factory } diff --git a/pkg/cmd/kubernetes/agent/install/commit.go b/pkg/cmd/kubernetes/agent/install/commit.go index c4c41dcf..02590885 100644 --- a/pkg/cmd/kubernetes/agent/install/commit.go +++ b/pkg/cmd/kubernetes/agent/install/commit.go @@ -22,7 +22,7 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { return err } - if err := shared.CheckPermissions(ctx, opts.Dependencies, opts.Cluster, opts.TargetNamespace, opts.DryRun.Value); err != nil { + if err := shared.CheckPermissions(ctx, opts.Dependencies, opts.Cluster, octoK8s.InstallPermissions(opts.TargetNamespace), opts.DryRun.Value); err != nil { return err } @@ -63,15 +63,7 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { "Waiting for it to register with Octopus and become ready. This can take a few minutes, and gives up after %s.", timeout)) } - release, err := opts.Runner.Install(ctx, helm.InstallSpec{ - Chart: opts.chartRef(), - ReleaseName: opts.TargetRelease, - Namespace: opts.TargetNamespace, - Values: values, - Atomic: opts.Atomic.Value, - Wait: opts.Wait.Value, - Timeout: timeout, - }) + release, err := opts.Runner.Install(ctx, opts.installSpec(values, timeout)) if err != nil { return opts.reportFailure(err) } @@ -280,12 +272,7 @@ func eulaValue(accepted bool) string { func (opts *InstallOptions) preflight() *shared.Preflight { targets := []octoK8s.Target{ - { - Name: "Octopus REST API", - Address: opts.Host, - Remediation: "The chart registers the agent with Octopus over the REST API, from a pod in the cluster. " + - "Confirm this address is reachable from inside the cluster.", - }, + octoK8s.RESTAPITarget(opts.Host, "The chart registers the agent with Octopus over the REST API, from a pod in the cluster."), } for _, address := range opts.ServerCommsAddresses.Value { @@ -299,12 +286,8 @@ func (opts *InstallOptions) preflight() *shared.Preflight { } if opts.monitorEnabled() { - targets = append(targets, octoK8s.Target{ - Name: "Octopus gRPC endpoint", - Address: octoK8s.DeriveGRPCURL(opts.Host), - Remediation: "The Kubernetes monitor streams live object status to Octopus over gRPC on a different port to the REST API. " + - "A load balancer, proxy, or firewall that forwards only HTTPS is the usual cause; make sure the gRPC port is forwarded too.", - }) + targets = append(targets, octoK8s.GRPCTarget(octoK8s.DeriveGRPCURL(opts.Host), + "The Kubernetes monitor streams live object status to Octopus over gRPC on a different port to the REST API.")) } return &shared.Preflight{ @@ -326,9 +309,6 @@ func (opts *InstallOptions) writeValuesFile(values map[string]any) error { } func (opts *InstallOptions) renderOnly(ctx context.Context, timeout time.Duration) error { - fmt.Fprintf(opts.Out, "\n%s Rendering only. Nothing will be installed, no Octopus access token is created, and the connectivity checks that need a pod in the cluster are skipped.\n", - output.Dim("--"+octoK8s.FlagDryRun)) - // The rendered manifests carry acceptEula, and an agent given "N" starts and // then refuses to run, so values taken from here would not work as they are. if !opts.AcceptEula.Value { @@ -344,22 +324,21 @@ func (opts *InstallOptions) renderOnly(ctx context.Context, timeout time.Duratio return err } - // Report only: there is no install to abandon. - opts.preflight().ReportStatic() + return shared.RenderOnly(ctx, opts.Dependencies, opts.Runner, opts.installSpec(values, timeout), + "Nothing will be installed, no Octopus access token is created, and the connectivity checks that need a pod in the cluster are skipped.", + opts.preflight()) +} - manifest, err := opts.Runner.Render(ctx, helm.InstallSpec{ +func (opts *InstallOptions) installSpec(values map[string]any, timeout time.Duration) helm.InstallSpec { + return helm.InstallSpec{ Chart: opts.chartRef(), ReleaseName: opts.TargetRelease, Namespace: opts.TargetNamespace, Values: values, + Atomic: opts.Atomic.Value, + Wait: opts.Wait.Value, Timeout: timeout, - }) - if err != nil { - return err } - - fmt.Fprintln(opts.Out, manifest) - return nil } // reportFailure covers the case Helm cannot undo. The chart registers the agent @@ -390,18 +369,11 @@ func (opts *InstallOptions) removeCommand() string { } func (opts *InstallOptions) reportSuccess(release helm.Release) { - fmt.Fprintf(opts.Out, "\n%s Installed %s %s as release %s in namespace %s.\n", - output.Green("✔"), release.Chart, release.Version, - output.Cyan(release.Name), output.Cyan(release.Namespace)) + shared.ReportInstalled(opts.Out, release) fmt.Fprintf(opts.Out, " The agent polls Octopus for work. It appears under %s once its first health check passes.\n", opts.portalLocation()) - if opts.NoPrompt { - return - } - - autoCmd := flag.GenerateAutomationCmd(opts.CmdPath, opts.GetSpaceNameOrEmpty(), opts.generatable()...) - fmt.Fprintf(opts.Out, "\nAutomation Command: %s\n", autoCmd) + shared.PrintAutomationCommand(opts.Dependencies, opts.generatable()) } func (opts *InstallOptions) portalLocation() string { diff --git a/pkg/cmd/kubernetes/agent/install/export_test.go b/pkg/cmd/kubernetes/agent/install/export_test.go new file mode 100644 index 00000000..d8f6abb5 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/export_test.go @@ -0,0 +1,25 @@ +package install + +import ( + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" +) + +// Test-only exports: compiled into the test binary, never into the package. + +func ReportFindingsForTest(opts *InstallOptions) { + opts.reportFindings() +} + +// RenderReviewForTest prints the review screen without asking anything. +func RenderReviewForTest(opts *InstallOptions) { + _ = opts.resolveNames() + shared.PrintReview(opts.Out, reviewGroups(opts)) +} + +func (opts *InstallOptions) NewTargetTagsForTest() []string { + return opts.newTargetTags() +} + +func (opts *InstallOptions) DeriveAccessModeForTest() { + opts.deriveAccessMode() +} diff --git a/pkg/cmd/kubernetes/agent/install/install.go b/pkg/cmd/kubernetes/agent/install/install.go index 113716b7..745f0c51 100644 --- a/pkg/cmd/kubernetes/agent/install/install.go +++ b/pkg/cmd/kubernetes/agent/install/install.go @@ -17,6 +17,7 @@ import ( octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/kubernetes/permissionscontroller" "github.com/OctopusDeploy/cli/pkg/machinescommon" "github.com/OctopusDeploy/cli/pkg/octopusservernodes" "github.com/OctopusDeploy/cli/pkg/output" @@ -26,12 +27,6 @@ import ( "github.com/spf13/cobra" ) -// ChartRef floats within the newest chart major version this tooling is known -// to work with, as the Octopus portal's generated command does. Bump the major -// together with KubernetesAgentUpgradeManager.LatestSupportedMajorVersion in -// Octopus Server. -var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/kubernetes-agent", Version: "3.*.*"} - const ( FlagName = "name" FlagServerCommsAddress = "server-comms-address" @@ -77,7 +72,7 @@ type InstallFlags struct { *sharedTarget.CreateTargetTenantFlags *machinescommon.CreateTargetMachinePolicyFlags *sharedWorker.WorkerPoolFlags - *octoK8s.CommonFlags + *shared.CommonFlags } func NewInstallFlags() *InstallFlags { @@ -99,7 +94,7 @@ func NewInstallFlags() *InstallFlags { CreateTargetTenantFlags: sharedTarget.NewCreateTargetTenantFlags(), CreateTargetMachinePolicyFlags: machinescommon.NewCreateTargetMachinePolicyFlags(), WorkerPoolFlags: sharedWorker.NewWorkerPoolFlags(), - CommonFlags: octoK8s.NewCommonFlags(), + CommonFlags: shared.NewCommonFlags(), } } @@ -250,7 +245,7 @@ func newCmdInstall(f factory.Factory, mode agentK8s.Mode) *cobra.Command { flags.BoolVar(&installFlags.RestrictScriptPods.Value, FlagRestrictScriptPods, false, "Give script pods no permissions of their own, leaving every deployment to the Octopus permissions controller.") flags.StringArrayVar(&installFlags.ScriptPodRoles.Value, FlagScriptPodRole, nil, "Give script pods the rules of this role, copied in at install time. Name a cluster role, or a role in a namespace as namespace/name. Repeat for more than one.") - octoK8s.RegisterCommonFlags(command, installFlags.CommonFlags) + shared.RegisterCommonFlags(command, installFlags.CommonFlags, shared.DerivedFromNameDetails()) return command } @@ -377,7 +372,7 @@ func (opts *InstallOptions) discoverCluster(ctx context.Context, session *shared } opts.Installations = installations - present, err := agentK8s.PermissionsControllerPresent(session.Cluster) + present, err := permissionscontroller.Present(session.Cluster) if err != nil { return err } @@ -638,25 +633,11 @@ func (opts *InstallOptions) taskNodes() []octopusservernodes.Node { } func (opts *InstallOptions) resolveNames() error { - if opts.Namespace.Value != "" { - opts.TargetNamespace = opts.Namespace.Value - } else { - derived, err := octoK8s.DerivedNamespace(opts.namespacePrefix(), opts.Name.Value) - if err != nil { - return err - } - opts.TargetNamespace = derived - } - - if opts.ReleaseName.Value != "" { - opts.TargetRelease = opts.ReleaseName.Value - } else { - derived, err := octoK8s.ReleaseName(opts.Name.Value) - if err != nil { - return err - } - opts.TargetRelease = derived + namespace, release, err := octoK8s.ResolveNames(opts.Namespace.Value, opts.ReleaseName.Value, opts.namespacePrefix(), opts.Name.Value) + if err != nil { + return err } + opts.TargetNamespace, opts.TargetRelease = namespace, release return nil } @@ -838,11 +819,7 @@ func examples(mode agentK8s.Mode) string { } func (opts *InstallOptions) chartRef() helm.ChartRef { - ref := ChartRef - if opts.ChartVersion.Value != "" { - ref.Version = opts.ChartVersion.Value - } - return ref + return agentK8s.ChartRef.WithVersion(opts.ChartVersion.Value) } var errEulaDeclined = errors.New("the Octopus Customer Agreement has to be accepted to install the agent") @@ -855,11 +832,3 @@ func (opts *InstallOptions) reportUnsupportedNodes() { fmt.Fprintf(opts.Out, "%s This cluster has %s nodes, which the agent cannot run on. It will only schedule on the linux/amd64 and linux/arm64 nodes.\n", output.Yellow("!"), strings.Join(unsupported, " and ")) } - -func (opts *InstallOptions) NewTargetTagsForTest() []string { - return opts.newTargetTags() -} - -func (opts *InstallOptions) DeriveAccessModeForTest() { - opts.deriveAccessMode() -} diff --git a/pkg/cmd/kubernetes/agent/install/prompt.go b/pkg/cmd/kubernetes/agent/install/prompt.go index 42760e1b..12d5dbce 100644 --- a/pkg/cmd/kubernetes/agent/install/prompt.go +++ b/pkg/cmd/kubernetes/agent/install/prompt.go @@ -13,6 +13,7 @@ import ( "github.com/OctopusDeploy/cli/pkg/output" "github.com/OctopusDeploy/cli/pkg/question" "github.com/OctopusDeploy/cli/pkg/question/selectors" + "github.com/OctopusDeploy/cli/pkg/util" ) // PromptMissing guards every prompt on its flag, so supplying a flag suppresses @@ -306,7 +307,7 @@ func promptForScriptPodRoles(opts *InstallOptions) error { opts.ScriptPodRules = rules fmt.Fprintf(opts.Out, " %s\n", output.Dimf( "The %d %s are copied in now. Later changes to %s are not picked up.", - len(rules), octoK8s.Pluralise("rule", "rules", len(rules)), strings.Join(references, ", "))) + len(rules), util.Pluralise("rule", "rules", len(rules)), strings.Join(references, ", "))) return nil } @@ -344,7 +345,3 @@ func (opts *InstallOptions) reportFindings() { " granted its own permissions by a WorkloadServiceAccount rather than sharing the agent's.\n", output.Dim("-")) } } - -func ReportFindingsForTest(opts *InstallOptions) { - opts.reportFindings() -} diff --git a/pkg/cmd/kubernetes/agent/install/review.go b/pkg/cmd/kubernetes/agent/install/review.go index a9e27cac..348441a7 100644 --- a/pkg/cmd/kubernetes/agent/install/review.go +++ b/pkg/cmd/kubernetes/agent/install/review.go @@ -8,9 +8,10 @@ import ( "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" sharedTarget "github.com/OctopusDeploy/cli/pkg/cmd/target/shared" sharedWorker "github.com/OctopusDeploy/cli/pkg/cmd/worker/shared" - octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" "github.com/OctopusDeploy/cli/pkg/question" "github.com/OctopusDeploy/cli/pkg/question/selectors" + "github.com/OctopusDeploy/cli/pkg/util" ) // Confirm shows every setting, detected or chosen. Most are worked out rather @@ -50,36 +51,9 @@ func reviewGroups(opts *InstallOptions) []shared.Group { } func clusterItems(opts *InstallOptions) []shared.Item { - source := "current context" - if opts.KubeContext.Value != "" && !opts.KubeContextInfo.IsCurrent { - source = "chosen" - } - - return []shared.Item{ - { - Label: "Kubernetes context", - Value: opts.KubeContext.Value, - Source: source, - // Changing cluster invalidates everything discovered from it. - Edit: nil, - }, - {Label: "Cluster address", Value: opts.KubeContextInfo.Server, Source: "from the kubeconfig"}, - {Label: "Node architectures", Value: shared.OrNone(opts.NodeArchitectures), Source: "from the cluster"}, - { - Label: "Namespace", - Value: opts.TargetNamespace, - Source: shared.DerivedOrSet(opts.Namespace.Value, "derived from the name"), - Edit: shared.EditText(opts.Ask, &opts.Namespace.Value, "Namespace to install into", - func() string { return opts.TargetNamespace }), - }, - { - Label: "Helm release", - Value: opts.TargetRelease, - Source: shared.DerivedOrSet(opts.ReleaseName.Value, "derived from the name"), - Edit: shared.EditText(opts.Ask, &opts.ReleaseName.Value, "Helm release name", - func() string { return opts.TargetRelease }), - }, - } + return shared.ClusterItems(opts.Dependencies, opts.CommonFlags, opts.KubeContextInfo, + &opts.TargetNamespace, &opts.TargetRelease, "derived from the name", + shared.Item{Label: "Node architectures", Value: shared.OrNone(opts.NodeArchitectures), Source: "from the cluster"}) } func octopusItems(opts *InstallOptions) []shared.Item { @@ -217,25 +191,12 @@ func scriptPodItems(opts *InstallOptions) []shared.Item { } func helmItems(opts *InstallOptions) []shared.Item { - return []shared.Item{ - {Label: "Chart", Value: ChartRef.Ref}, - { - Label: "Chart version", Value: shared.OrDefault(opts.ChartVersion.Value, ChartRef.Version), - Edit: shared.EditText(opts.Ask, &opts.ChartVersion.Value, fmt.Sprintf("Chart version (blank for %s)", ChartRef.Version), - func() string { return opts.ChartVersion.Value }), - }, - { - Label: "Credentials", Value: credentialPlacement(opts), - Edit: shared.EditConfirm(opts.Ask, &opts.InlineSecrets.Value, - "Put the registration credential directly in the Helm values instead of a Kubernetes Secret?", - "A Secret keeps it out of the Helm release and out of any file written with --output-values."), - }, - { - Label: "Timeout", Value: shared.OrDefault(opts.Timeout.Value, octoK8s.DefaultTimeout.String()), - Edit: shared.EditText(opts.Ask, &opts.Timeout.Value, "How long to wait for the release to become ready", - func() string { return opts.Timeout.Value }), - }, - } + return shared.HelmItems(opts.Dependencies, opts.CommonFlags, agentK8s.ChartRef, shared.Item{ + Label: "Credentials", Value: credentialPlacement(opts), + Edit: shared.EditConfirm(opts.Ask, &opts.InlineSecrets.Value, + "Put the registration credential directly in the Helm values instead of a Kubernetes Secret?", + "A Secret keeps it out of the Helm release and out of any file written with --output-values."), + }) } func registrationSummary(opts *InstallOptions) string { @@ -356,7 +317,7 @@ func permissionsSource(opts *InstallOptions) string { return "the permissions controller grants each deployment what it needs" case len(opts.ScriptPodRoles.Value) > 0: return fmt.Sprintf("%d %s copied in now, and not followed afterwards", - len(opts.ScriptPodRules), octoK8s.Pluralise("rule", "rules", len(opts.ScriptPodRules))) + len(opts.ScriptPodRules), util.Pluralise("rule", "rules", len(opts.ScriptPodRules))) case opts.PermissionsController: return "the permissions controller can grant less than this per deployment" default: @@ -370,9 +331,3 @@ func credentialPlacement(opts *InstallOptions) string { } return "access token in a Kubernetes Secret" } - -// RenderReviewForTest prints the review screen without asking anything. -func RenderReviewForTest(opts *InstallOptions) { - _ = opts.resolveNames() - shared.PrintReview(opts.Out, reviewGroups(opts)) -} diff --git a/pkg/cmd/kubernetes/gateway/install/argosetup.go b/pkg/cmd/kubernetes/gateway/install/argosetup.go index de67b092..12debdda 100644 --- a/pkg/cmd/kubernetes/gateway/install/argosetup.go +++ b/pkg/cmd/kubernetes/gateway/install/argosetup.go @@ -12,6 +12,7 @@ import ( octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/util" "k8s.io/client-go/rest" ) @@ -231,8 +232,8 @@ func reportAccess(opts *InstallOptions, access argocd.AccessCheck) { } fmt.Fprintf(opts.Out, " %s\n", output.Dimf("It can read %d %s and %d %s.", - access.Applications, octoK8s.Pluralise("application", "applications", access.Applications), - access.Clusters, octoK8s.Pluralise("cluster", "clusters", access.Clusters))) + access.Applications, util.Pluralise("application", "applications", access.Applications), + access.Clusters, util.Pluralise("cluster", "clusters", access.Clusters))) } func unreadable(access argocd.AccessCheck) string { diff --git a/pkg/cmd/kubernetes/gateway/install/commit.go b/pkg/cmd/kubernetes/gateway/install/commit.go index 289a3432..d840a9d3 100644 --- a/pkg/cmd/kubernetes/gateway/install/commit.go +++ b/pkg/cmd/kubernetes/gateway/install/commit.go @@ -10,6 +10,7 @@ import ( "github.com/OctopusDeploy/cli/pkg/argocdgateways" "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + gatewayK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/gateway" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" "github.com/OctopusDeploy/cli/pkg/output" "github.com/OctopusDeploy/cli/pkg/util/flag" @@ -30,7 +31,7 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { return err } - if err := shared.CheckPermissions(ctx, opts.Dependencies, opts.Cluster, opts.TargetNamespace, opts.DryRun.Value); err != nil { + if err := shared.CheckPermissions(ctx, opts.Dependencies, opts.Cluster, octoK8s.InstallPermissions(opts.TargetNamespace), opts.DryRun.Value); err != nil { return err } @@ -62,15 +63,7 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { "Waiting for it to register with Octopus and become ready. This can take a few minutes, and gives up after %s.", timeout)) } - release, err := opts.Runner.Install(ctx, helm.InstallSpec{ - Chart: opts.chartRef(), - ReleaseName: opts.TargetRelease, - Namespace: opts.TargetNamespace, - Values: values, - Atomic: opts.Atomic.Value, - Wait: opts.Wait.Value, - Timeout: timeout, - }) + release, err := opts.Runner.Install(ctx, opts.installSpec(values, timeout)) if err != nil { return opts.deregister(err) } @@ -128,9 +121,7 @@ func (opts *InstallOptions) deregister(cause error) error { } func (opts *InstallOptions) chartRef() helm.ChartRef { - ref := ChartRef - ref.Version = opts.ChartVersion.Value - return ref + return gatewayK8s.ChartRef.WithVersion(opts.ChartVersion.Value) } // BuildValues passes credentials by Secret reference unless --inline-secrets @@ -178,13 +169,13 @@ func (opts *InstallOptions) BuildValues() (map[string]any, error) { if opts.InlineSecrets.Value { gatewayArgoCD["projectAuthentication"] = projectTokens } else { - gatewayArgoCD["projectAuthenticationSecretName"] = projectTokenSecretName + gatewayArgoCD["projectAuthenticationSecretName"] = gatewayK8s.ProjectTokenSecretName } case opts.InlineSecrets.Value: gatewayArgoCD["authenticationToken"] = opts.ArgoCDToken.Value default: - gatewayArgoCD["authenticationTokenSecretName"] = argoTokenSecretName - gatewayArgoCD["authenticationTokenSecretKey"] = argoTokenSecretKey + gatewayArgoCD["authenticationTokenSecretName"] = gatewayK8s.ArgoTokenSecretName + gatewayArgoCD["authenticationTokenSecretKey"] = gatewayK8s.ArgoTokenSecretKey } registration := map[string]any{"register": false, "octopus": registrationOctopus} @@ -216,18 +207,9 @@ func (opts *InstallOptions) preflight() *shared.Preflight { Cluster: opts.Cluster, Namespace: opts.TargetNamespace, Targets: []octoK8s.Target{ - { - Name: "Octopus REST API", - Address: opts.Host, - Remediation: "The gateway registers itself with Octopus over the REST API. " + - "Confirm this address is reachable from inside the cluster.", - }, - { - Name: "Octopus gRPC endpoint", - Address: opts.OctopusGRPCURL.Value, - Remediation: "The running gateway connects to Octopus over gRPC on a different port to the REST API. " + - "A load balancer, proxy, or firewall that forwards only HTTPS is the usual cause; make sure the gRPC port is forwarded too.", - }, + octoK8s.RESTAPITarget(opts.Host, "The gateway registers itself with Octopus over the REST API."), + octoK8s.GRPCTarget(opts.OctopusGRPCURL.Value, + "The running gateway connects to Octopus over gRPC on a different port to the REST API."), }, ProceedHelp: "The gateway is likely to install and then fail to connect.", } @@ -249,13 +231,13 @@ func (opts *InstallOptions) storeCredentials(ctx context.Context) error { // OCTOPUS_ARGOCD_, so the key names are part of its contract. data := make(map[string]string, len(projectTokens)) for _, t := range projectTokens { - data["PROJECT_AUTH_TOKEN_"+t.Project] = t.Token + data[gatewayK8s.ProjectTokenKeyPrefix+t.Project] = t.Token } - if err := opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, projectTokenSecretName, data); err != nil { + if err := opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, gatewayK8s.ProjectTokenSecretName, data); err != nil { return err } - } else if err := opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, argoTokenSecretName, map[string]string{ - argoTokenSecretKey: opts.ArgoCDToken.Value, + } else if err := opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, gatewayK8s.ArgoTokenSecretName, map[string]string{ + gatewayK8s.ArgoTokenSecretKey: opts.ArgoCDToken.Value, }); err != nil { return err } @@ -271,8 +253,8 @@ func (opts *InstallOptions) storeRegistration(ctx context.Context) error { return err } - return opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, registrationSecretName, - map[string]string{registrationSecretKey: contents}) + return opts.Cluster.UpsertSecret(ctx, opts.TargetNamespace, gatewayK8s.RegistrationSecretName, + map[string]string{gatewayK8s.RegistrationSecretKey: contents}) } func (opts *InstallOptions) registrationSecretContents() (string, error) { @@ -290,37 +272,28 @@ func (opts *InstallOptions) registrationSecretContents() (string, error) { } func (opts *InstallOptions) renderOnly(ctx context.Context, values map[string]any, timeout time.Duration) error { - fmt.Fprintf(opts.Out, "\n%s Rendering only. Nothing will be installed, and the connectivity checks that need a pod in the cluster are skipped.\n", - output.Dim("--"+octoK8s.FlagDryRun)) - - opts.preflight().ReportStatic() + return shared.RenderOnly(ctx, opts.Dependencies, opts.Runner, opts.installSpec(values, timeout), + "Nothing will be installed, and the connectivity checks that need a pod in the cluster are skipped.", + opts.preflight()) +} - manifest, err := opts.Runner.Render(ctx, helm.InstallSpec{ +func (opts *InstallOptions) installSpec(values map[string]any, timeout time.Duration) helm.InstallSpec { + return helm.InstallSpec{ Chart: opts.chartRef(), ReleaseName: opts.TargetRelease, Namespace: opts.TargetNamespace, Values: values, + Atomic: opts.Atomic.Value, + Wait: opts.Wait.Value, Timeout: timeout, - }) - if err != nil { - return err } - - fmt.Fprintln(opts.Out, manifest) - return nil } func (opts *InstallOptions) reportSuccess(release helm.Release) { - fmt.Fprintf(opts.Out, "\n%s Installed %s %s as release %s in namespace %s.\n", - output.Green("✔"), release.Chart, release.Version, - output.Cyan(release.Name), output.Cyan(release.Namespace)) + shared.ReportInstalled(opts.Out, release) fmt.Fprintf(opts.Out, " The gateway registers itself with Octopus, then connects. "+ "It appears under Infrastructure > Argo CD Instances once it is healthy.\n") - if opts.NoPrompt { - return - } - generatable := []flag.Generatable{ opts.Name, opts.Environments, opts.ArgoCDNamespace, opts.ArgoCDServerGRPCURL, opts.ArgoCDToken, opts.ArgoCDProjectTokens, opts.ArgoCDWebUIURL, opts.OctopusGRPCURL, @@ -328,17 +301,5 @@ func (opts *InstallOptions) reportSuccess(release helm.Release) { opts.ArgoCDAccountName, opts.AllowSync, opts.InlineSecrets, } generatable = append(generatable, opts.CommonFlags.Generatable()...) - - autoCmd := flag.GenerateAutomationCmd(opts.CmdPath, opts.GetSpaceNameOrEmpty(), generatable...) - fmt.Fprintf(opts.Out, "\nAutomation Command: %s\n", autoCmd) -} - -var ErrForTest = errors.New("install failed") - -func (opts *InstallOptions) RegistrationSecretForTest() (string, error) { - return opts.registrationSecretContents() + shared.PrintAutomationCommand(opts.Dependencies, generatable) } - -func (opts *InstallOptions) RegisterForTest() error { return opts.register() } - -func (opts *InstallOptions) DeregisterForTest(cause error) error { return opts.deregister(cause) } diff --git a/pkg/cmd/kubernetes/gateway/install/export_test.go b/pkg/cmd/kubernetes/gateway/install/export_test.go new file mode 100644 index 00000000..83940862 --- /dev/null +++ b/pkg/cmd/kubernetes/gateway/install/export_test.go @@ -0,0 +1,30 @@ +package install + +import ( + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" +) + +// Test-only exports: compiled into the test binary, never into the package. + +func (opts *InstallOptions) RegistrationSecretForTest() (string, error) { + return opts.registrationSecretContents() +} + +func (opts *InstallOptions) RegisterForTest() error { return opts.register() } + +func (opts *InstallOptions) DeregisterForTest(cause error) error { return opts.deregister(cause) } + +func (opts *InstallOptions) ConfirmRetry(kubeConfig *octoK8s.KubeConfig, cause error) (bool, error) { + return opts.connector().ConfirmRetry(kubeConfig, cause) +} + +func PromptForProjectTokenForTest(opts *InstallOptions, project string) error { + return promptForProjectToken(opts, project) +} + +// RenderReviewForTest prints the review screen without asking anything. +func RenderReviewForTest(opts *InstallOptions) { + _ = opts.resolveNames() + shared.PrintReview(opts.Out, reviewGroups(opts)) +} diff --git a/pkg/cmd/kubernetes/gateway/install/install.go b/pkg/cmd/kubernetes/gateway/install/install.go index 8394b206..f7dff329 100644 --- a/pkg/cmd/kubernetes/gateway/install/install.go +++ b/pkg/cmd/kubernetes/gateway/install/install.go @@ -22,8 +22,6 @@ import ( "github.com/spf13/cobra" ) -var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/octopus-argocd-gateway-chart"} - const ( FlagName = "name" FlagEnvironment = "environment" @@ -41,21 +39,6 @@ const ( FlagArgoCDProjectToken = "argocd-project-token" ) -// Passing credentials by Secret reference keeps them out of the Helm release -// values, out of any file written by --output-values, and out of the process -// table. -const ( - argoTokenSecretName = "octopus-argocd-gateway-argocd-token" - argoTokenSecretKey = "ARGOCD_AUTH_TOKEN" - projectTokenSecretName = "octopus-argocd-gateway-project-tokens" - - // The chart's own registration job would write these, and the gateway - // reads them from its projected configuration volume. Octopus writes them - // instead, so no Octopus credential of the user's ever enters the cluster. - registrationSecretName = "octopus-argocd-gateway-octopus-auth-secret" - registrationSecretKey = "octopus-argocd-gateway-octopus-authentication-secret.yaml" -) - type InstallFlags struct { Name *flag.Flag[string] Environments *flag.Flag[[]string] @@ -72,7 +55,7 @@ type InstallFlags struct { ArgoCDGRPCWebRootPath *flag.Flag[string] ArgoCDProjectTokens *flag.Flag[[]string] - *octoK8s.CommonFlags + *shared.CommonFlags } func NewInstallFlags() *InstallFlags { @@ -91,7 +74,7 @@ func NewInstallFlags() *InstallFlags { ArgoCDGRPCWeb: flag.New[bool](FlagArgoCDGRPCWeb, false), ArgoCDGRPCWebRootPath: flag.New[string](FlagArgoCDGRPCWebRootPath, false), ArgoCDProjectTokens: flag.New[[]string](FlagArgoCDProjectToken, true), - CommonFlags: octoK8s.NewCommonFlags(), + CommonFlags: shared.NewCommonFlags(), } } @@ -180,7 +163,7 @@ func NewCmdInstall(f factory.Factory) *cobra.Command { flags.BoolVar(&installFlags.ArgoCDGRPCWeb.Value, FlagArgoCDGRPCWeb, false, "Tunnel gRPC over HTTP/1.1. Set automatically for AWS managed Argo CD, whose load balancer does not support HTTP/2.") flags.StringVar(&installFlags.ArgoCDGRPCWebRootPath.Value, FlagArgoCDGRPCWebRootPath, "", "Root path of the Argo CD API when it is not served at the root, e.g. /argo/api.") flags.StringArrayVar(&installFlags.ArgoCDProjectTokens.Value, FlagArgoCDProjectToken, nil, "Argo CD project role token. Repeat per project; the project is read from the token. Required for AWS managed Argo CD, which caps account token lifetimes at 12 hours.") - octoK8s.RegisterCommonFlags(command, installFlags.CommonFlags) + shared.RegisterCommonFlags(command, installFlags.CommonFlags, shared.DerivedFromNameDetails()) return command } @@ -240,10 +223,6 @@ func (opts *InstallOptions) connector() *shared.Connector { } } -func (opts *InstallOptions) ConfirmRetry(kubeConfig *octoK8s.KubeConfig, cause error) (bool, error) { - return opts.connector().ConfirmRetry(kubeConfig, cause) -} - // discoverArgoCD covers both hosting models: Argo CD usually runs in the // cluster, but the EKS capability runs it in the AWS control plane instead, // where there is nothing in the cluster to find. @@ -339,7 +318,7 @@ func (opts *InstallOptions) ResolveWithoutPrompting(ctx context.Context) error { if opts.ArgoCDToken.Value == "" && opts.ConfigureArgoCDAccount.Value { status, err := argocd.InspectAccount(ctx, opts.Cluster, opts.Instance, - argocd.AccountSpec{Name: opts.ArgoCDAccountName.Value, AllowSync: opts.AllowSync.Value}) + argocd.AccountSpec{Name: opts.accountName(), AllowSync: opts.AllowSync.Value}) if err != nil { return err } @@ -386,31 +365,14 @@ func (opts *InstallOptions) applyInstanceDefaults() { if opts.OctopusGRPCURL.Value == "" { opts.OctopusGRPCURL.Value = octoK8s.DeriveGRPCURL(opts.Host) } - if opts.ArgoCDAccountName.Value == "" { - opts.ArgoCDAccountName.Value = argocd.DefaultAccountName - } } func (opts *InstallOptions) resolveNames() error { - if opts.Namespace.Value != "" { - opts.TargetNamespace = opts.Namespace.Value - } else { - derived, err := octoK8s.DerivedNamespace(octoK8s.ArgoCDGatewayNamespacePrefix, opts.Name.Value) - if err != nil { - return err - } - opts.TargetNamespace = derived - } - - if opts.ReleaseName.Value != "" { - opts.TargetRelease = opts.ReleaseName.Value - } else { - derived, err := octoK8s.ReleaseName(opts.Name.Value) - if err != nil { - return err - } - opts.TargetRelease = derived + namespace, release, err := octoK8s.ResolveNames(opts.Namespace.Value, opts.ReleaseName.Value, octoK8s.ArgoCDGatewayNamespacePrefix, opts.Name.Value) + if err != nil { + return err } + opts.TargetNamespace, opts.TargetRelease = namespace, release return nil } diff --git a/pkg/cmd/kubernetes/gateway/install/prompt.go b/pkg/cmd/kubernetes/gateway/install/prompt.go index b7a07689..36941340 100644 --- a/pkg/cmd/kubernetes/gateway/install/prompt.go +++ b/pkg/cmd/kubernetes/gateway/install/prompt.go @@ -320,7 +320,7 @@ func promptForProjectToken(opts *InstallOptions, project string) error { // could not be read, where the project can only come from the token itself. func promptForUnknownProjectTokens(opts *InstallOptions) error { fmt.Fprintf(opts.Out, " %s\n\n", output.Dimf( - "argocd proj role create-token %s", opts.ArgoCDAccountName.Value)) + "argocd proj role create-token %s", opts.accountName())) for { token := "" @@ -420,7 +420,3 @@ func printProjectTokenPreamble(opts *InstallOptions) { "these for you. Each one is a project role token, because AWS caps account\n"+ "tokens at 12 hours.\n") } - -func PromptForProjectTokenForTest(opts *InstallOptions, project string) error { - return promptForProjectToken(opts, project) -} diff --git a/pkg/cmd/kubernetes/gateway/install/registration_test.go b/pkg/cmd/kubernetes/gateway/install/registration_test.go index bac87f41..ffc303ff 100644 --- a/pkg/cmd/kubernetes/gateway/install/registration_test.go +++ b/pkg/cmd/kubernetes/gateway/install/registration_test.go @@ -1,6 +1,7 @@ package install_test import ( + "errors" "strings" "testing" @@ -93,7 +94,7 @@ func TestDeregister_KeepsTheOriginalFailureWhenCleanupFails(t *testing.T) { opts := registeredOptions(t) opts.DeregisterCallback = func(string) error { return assert.AnError } - cause := install.ErrForTest + cause := errors.New("install failed") assert.Equal(t, cause, opts.DeregisterForTest(cause)) assert.Contains(t, opts.Out.(interface{ String() string }).String(), "could not be removed") } diff --git a/pkg/cmd/kubernetes/gateway/install/review.go b/pkg/cmd/kubernetes/gateway/install/review.go index 15a545ea..744e81b6 100644 --- a/pkg/cmd/kubernetes/gateway/install/review.go +++ b/pkg/cmd/kubernetes/gateway/install/review.go @@ -6,8 +6,8 @@ import ( "github.com/AlecAivazis/survey/v2" "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" - octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + gatewayK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/gateway" "github.com/OctopusDeploy/cli/pkg/question" ) @@ -30,36 +30,8 @@ func reviewGroups(opts *InstallOptions) []shared.Group { } func clusterItems(opts *InstallOptions) []shared.Item { - context := opts.KubeContextInfo - source := "current context" - if opts.KubeContext.Value != "" && !context.IsCurrent { - source = "chosen" - } - - return []shared.Item{ - { - Label: "Kubernetes context", - Value: opts.KubeContext.Value, - Source: source, - // Changing cluster invalidates everything discovered from it. - Edit: nil, - }, - {Label: "Cluster address", Value: context.Server, Source: "from the kubeconfig"}, - { - Label: "Namespace", - Value: opts.TargetNamespace, - Source: shared.DerivedOrSet(opts.Namespace.Value, "derived from the name"), - Edit: shared.EditText(opts.Ask, &opts.Namespace.Value, "Namespace to install into", - func() string { return opts.TargetNamespace }), - }, - { - Label: "Helm release", - Value: opts.TargetRelease, - Source: shared.DerivedOrSet(opts.ReleaseName.Value, "derived from the name"), - Edit: shared.EditText(opts.Ask, &opts.ReleaseName.Value, "Helm release name", - func() string { return opts.TargetRelease }), - }, - } + return shared.ClusterItems(opts.Dependencies, opts.CommonFlags, opts.KubeContextInfo, + &opts.TargetNamespace, &opts.TargetRelease, "derived from the name") } func octopusItems(opts *InstallOptions) []shared.Item { @@ -126,7 +98,7 @@ func argoItems(opts *InstallOptions) []shared.Item { return append(items, shared.Item{ Label: "Account", - Value: opts.ArgoCDAccountName.Value, + Value: opts.accountName(), Source: accountSource(opts), }, shared.Item{ @@ -142,27 +114,12 @@ func argoItems(opts *InstallOptions) []shared.Item { } func helmItems(opts *InstallOptions) []shared.Item { - return []shared.Item{ - { - Label: "Chart", Value: ChartRef.Ref, Source: "", - }, - { - Label: "Chart version", Value: shared.OrDefault(opts.ChartVersion.Value, "latest"), Source: "", - Edit: shared.EditText(opts.Ask, &opts.ChartVersion.Value, "Chart version (blank for the latest)", - func() string { return opts.ChartVersion.Value }), - }, - { - Label: "Credentials", Value: credentialPlacement(opts), Source: "", - Edit: shared.EditConfirm(opts.Ask, &opts.InlineSecrets.Value, - "Put credentials directly in the Helm values instead of Kubernetes Secrets?", - "Secrets keep credentials out of the Helm release and out of any file written with --output-values."), - }, - { - Label: "Timeout", Value: shared.OrDefault(opts.Timeout.Value, octoK8s.DefaultTimeout.String()), Source: "", - Edit: shared.EditText(opts.Ask, &opts.Timeout.Value, "How long to wait for the release to become ready", - func() string { return opts.Timeout.Value }), - }, - } + return shared.HelmItems(opts.Dependencies, opts.CommonFlags, gatewayK8s.ChartRef, shared.Item{ + Label: "Credentials", Value: credentialPlacement(opts), + Edit: shared.EditConfirm(opts.Ask, &opts.InlineSecrets.Value, + "Put credentials directly in the Helm values instead of Kubernetes Secrets?", + "Secrets keep credentials out of the Helm release and out of any file written with --output-values."), + }) } // editConnection covers the three settings that are the documented cause of a @@ -264,9 +221,3 @@ func credentialPlacement(opts *InstallOptions) string { } return "Argo CD token in a Kubernetes Secret" } - -// RenderReviewForTest prints the review screen without asking anything. -func RenderReviewForTest(opts *InstallOptions) { - _ = opts.resolveNames() - shared.PrintReview(opts.Out, reviewGroups(opts)) -} diff --git a/pkg/cmd/kubernetes/gateway/rotatetoken/rotate.go b/pkg/cmd/kubernetes/gateway/rotatetoken/rotate.go index ea036284..a22ece86 100644 --- a/pkg/cmd/kubernetes/gateway/rotatetoken/rotate.go +++ b/pkg/cmd/kubernetes/gateway/rotatetoken/rotate.go @@ -9,42 +9,38 @@ import ( "github.com/AlecAivazis/survey/v2" "github.com/MakeNowJust/heredoc/v2" "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" "github.com/OctopusDeploy/cli/pkg/constants" "github.com/OctopusDeploy/cli/pkg/factory" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + gatewayK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/gateway" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" "github.com/OctopusDeploy/cli/pkg/output" "github.com/OctopusDeploy/cli/pkg/question" + "github.com/OctopusDeploy/cli/pkg/util" "github.com/OctopusDeploy/cli/pkg/util/flag" "github.com/spf13/cobra" + appsv1 "k8s.io/api/apps/v1" ) const ( - FlagRelease = "release" - FlagRestart = "restart" - gatewayChart = "octopus-argocd-gateway-chart" - // gatewaySelector matches the gateway deployment the chart installs. - gatewaySelector = "app.kubernetes.io/name=octopus-argocd-gateway" - - // The chart reads project tokens from Secret keys of this shape, with the - // OCTOPUS_ARGOCD_ prefix added by envFrom. - projectTokenEnvPrefix = "PROJECT_AUTH_TOKEN_" - accountTokenEnvName = "OCTOPUS_ARGOCD_AUTH_TOKEN" + FlagRelease = "release" + FlagRestart = "restart" ) type RotateFlags struct { Release *flag.Flag[string] Restart *flag.Flag[bool] - *octoK8s.CommonFlags + *shared.CommonFlags } func NewRotateFlags() *RotateFlags { return &RotateFlags{ Release: flag.New[string](FlagRelease, false), Restart: flag.New[bool](FlagRestart, false), - CommonFlags: octoK8s.NewCommonFlags(), + CommonFlags: shared.NewCommonFlags(), } } @@ -56,7 +52,7 @@ type RotateOptions struct { Runner *helm.Runner release helm.Release - deployment string + deployment *appsv1.Deployment instance argocd.Instance } @@ -87,7 +83,7 @@ func NewCmdRotateToken(f factory.Factory) *cobra.Command { flags.SortFlags = false flags.StringVar(&rotateFlags.Release.Value, FlagRelease, "", "The gateway's Helm release name. Only needed when a cluster has more than one.") flags.BoolVar(&rotateFlags.Restart.Value, FlagRestart, true, "Restart the gateway so it picks up the new token.") - octoK8s.RegisterCommonFlags(command, rotateFlags.CommonFlags) + shared.RegisterCommonFlags(command, rotateFlags.CommonFlags, shared.DerivedFromNameDetails()) return command } @@ -133,35 +129,23 @@ func rotateRun(ctx context.Context, opts *RotateOptions) error { } func (opts *RotateOptions) connect(ctx context.Context) error { - kubeConfig, err := octoK8s.LoadKubeConfig(opts.KubeConfig.Value) - if err != nil { - return err - } - - if opts.KubeContext.Value == "" { - current, ok := kubeConfig.CurrentContext() - if !ok { - return fmt.Errorf("your kubeconfig has no current context, so --%s must be specified", octoK8s.FlagKubeContext) - } - opts.KubeContext.Value = current.Name - } - - cluster, err := octoK8s.Connect(kubeConfig, opts.KubeContext.Value) - if err != nil { - return err + connector := &shared.Connector{ + Dependencies: opts.Dependencies, + CommonFlags: opts.CommonFlags, + SelectMessage: "Which cluster is the gateway installed in?", } - opts.Cluster = cluster - runner, err := helm.NewRunner(opts.KubeConfig.Value, opts.KubeContext.Value, opts.Out) + session, err := connector.Connect(ctx) if err != nil { return err } - opts.Runner = runner + opts.Cluster = session.Cluster + opts.Runner = session.Runner return nil } func (opts *RotateOptions) selectRelease() error { - releases, err := opts.Runner.FindByChart(gatewayChart) + releases, err := opts.Runner.FindByChart(gatewayK8s.ChartName) if err != nil { return err } @@ -194,20 +178,20 @@ func (opts *RotateOptions) selectRelease() error { // describeGateway reads the gateway's own configuration back out of the // cluster, so a token can be replaced without knowing how it was installed. func (opts *RotateOptions) describeGateway(ctx context.Context) error { - deployment, found, err := opts.Cluster.FindDeployment(ctx, opts.release.Namespace, gatewaySelector) + deployment, found, err := opts.Cluster.FindDeployment(ctx, opts.release.Namespace, gatewayK8s.DeploymentSelector) if err != nil { return err } if !found { return fmt.Errorf("the %s release has no gateway deployment in namespace %s", opts.release.Name, opts.release.Namespace) } - opts.deployment = deployment.Name + opts.deployment = deployment values, err := opts.Runner.GetValues(opts.release.Name, opts.release.Namespace) if err != nil { return err } - opts.instance = instanceFromValues(values) + opts.instance = gatewayK8s.InstanceFromValues(values) fmt.Fprintf(opts.Out, "Gateway %s in namespace %s, connected to %s\n", output.Cyan(opts.release.Name), output.Cyan(opts.release.Namespace), @@ -250,16 +234,11 @@ func (h tokenHolding) Display() string { // tokens. Taking it from the running workload rather than the Helm values means // this works however the gateway was installed. func (opts *RotateOptions) currentTokens(ctx context.Context) ([]tokenHolding, error) { - deployment, found, err := opts.Cluster.FindDeployment(ctx, opts.release.Namespace, gatewaySelector) - if err != nil || !found { - return nil, err - } - var holdings []tokenHolding - for _, container := range deployment.Spec.Template.Spec.Containers { + for _, container := range opts.deployment.Spec.Template.Spec.Containers { for _, env := range container.Env { ref := env.ValueFrom - if env.Name != accountTokenEnvName || ref == nil || ref.SecretKeyRef == nil { + if env.Name != gatewayK8s.AccountTokenEnvName || ref == nil || ref.SecretKeyRef == nil { continue } holdings = append(holdings, opts.readHolding(ctx, "", ref.SecretKeyRef.Name, ref.SecretKeyRef.Key)) @@ -282,22 +261,27 @@ func (opts *RotateOptions) readProjectHoldings(ctx context.Context, secretName s } var holdings []tokenHolding - for key := range secret.Data { - project, isProjectToken := strings.CutPrefix(key, projectTokenEnvPrefix) + for key, value := range secret.Data { + project, isProjectToken := strings.CutPrefix(key, gatewayK8s.ProjectTokenKeyPrefix) if !isProjectToken { continue } - holding := opts.readHolding(ctx, project, secretName, key) - holdings = append(holdings, holding) + holdings = append(holdings, holdingFromValue(project, secretName, key, string(value))) } return holdings } func (opts *RotateOptions) readHolding(ctx context.Context, project, secretName, secretKey string) tokenHolding { - holding := tokenHolding{Project: project, SecretName: secretName, SecretKey: secretKey} - value, found, err := opts.Cluster.SecretKey(ctx, opts.release.Namespace, secretName, secretKey) - if err != nil || !found || value == "" { + if err != nil || !found { + value = "" + } + return holdingFromValue(project, secretName, secretKey, value) +} + +func holdingFromValue(project, secretName, secretKey, value string) tokenHolding { + holding := tokenHolding{Project: project, SecretName: secretName, SecretKey: secretKey} + if value == "" { return holding } @@ -413,22 +397,22 @@ func (opts *RotateOptions) verifyAgainstArgoCD(ctx context.Context, token string } fmt.Fprintf(opts.Out, " %s\n", output.Dimf("Checked against Argo CD: reads %d %s.", - access.Applications, octoK8s.Pluralise("application", "applications", access.Applications))) + access.Applications, util.Pluralise("application", "applications", access.Applications))) return nil } func (opts *RotateOptions) restart(ctx context.Context) error { if !opts.Restart.Value { fmt.Fprintf(opts.Out, "\nRestart the gateway for the new tokens to take effect:\n %s\n", - output.Cyan(fmt.Sprintf("kubectl rollout restart deploy/%s -n %s", opts.deployment, opts.release.Namespace))) + output.Cyan(fmt.Sprintf("kubectl rollout restart deploy/%s -n %s", opts.deployment.Name, opts.release.Namespace))) return nil } - if err := opts.Cluster.RestartDeployment(ctx, opts.release.Namespace, opts.deployment); err != nil { + if err := opts.Cluster.RestartDeployment(ctx, opts.release.Namespace, opts.deployment.Name); err != nil { return err } fmt.Fprintf(opts.Out, "\n%s Restarted %s so it picks up the new tokens.\n", - output.Green("✔"), output.Cyan(opts.deployment)) + output.Green("✔"), output.Cyan(opts.deployment.Name)) return nil } @@ -439,18 +423,6 @@ func holdingName(holding tokenHolding) string { return "project " + holding.Project } -func instanceFromValues(values map[string]any) argocd.Instance { - gateway, _ := values["gateway"].(map[string]any) - argo, _ := gateway["argocd"].(map[string]any) - registration, _ := values["registration"].(map[string]any) - registrationArgo, _ := registration["argocd"].(map[string]any) - - instance := argocd.Instance{} - instance.ServerGRPCURL, _ = argo["serverGrpcUrl"].(string) - instance.WebUIURL, _ = registrationArgo["webUiUrl"].(string) - return instance -} - func orUnknown(value string) string { if value == "" { return "an unknown Argo CD" diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/commit.go b/pkg/cmd/kubernetes/permissionscontroller/install/commit.go index 8fe21896..62531db7 100644 --- a/pkg/cmd/kubernetes/permissionscontroller/install/commit.go +++ b/pkg/cmd/kubernetes/permissionscontroller/install/commit.go @@ -2,18 +2,17 @@ package install import ( "context" - "errors" "fmt" "strings" "time" - "github.com/AlecAivazis/survey/v2" "github.com/MakeNowJust/heredoc/v2" "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/util" "github.com/OctopusDeploy/cli/pkg/util/flag" ) @@ -29,7 +28,7 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { return err } - if err := shared.CheckPermissions(ctx, opts.Dependencies, opts.Cluster, opts.TargetNamespace, opts.DryRun.Value); err != nil { + if err := shared.CheckPermissions(ctx, opts.Dependencies, opts.Cluster, octoK8s.InstallPermissions(opts.TargetNamespace), opts.DryRun.Value); err != nil { return err } @@ -47,15 +46,7 @@ func (opts *InstallOptions) Commit(ctx context.Context) error { fmt.Fprintf(opts.Out, "\nInstalling the permissions controller into %s...\n", output.Cyan(opts.TargetNamespace)) - release, err := opts.Runner.Install(ctx, helm.InstallSpec{ - Chart: opts.chartRef(), - ReleaseName: opts.TargetRelease, - Namespace: opts.TargetNamespace, - Values: values, - Atomic: opts.Atomic.Value, - Wait: opts.Wait.Value, - Timeout: timeout, - }) + release, err := opts.Runner.Install(ctx, opts.installSpec(values, timeout)) if err != nil { return err } @@ -135,62 +126,40 @@ func (opts *InstallOptions) confirmPrerequisites() error { return nil } - if opts.NoPrompt { - return fmt.Errorf("%d %s not met; fix the problems above or pass --%s", - failed, octoK8s.Pluralise("prerequisite was", "prerequisites were", failed), octoK8s.FlagSkipPreflight) - } - - proceed := false - if err := opts.Ask(&survey.Confirm{ - Message: "Continue with the install anyway?", - Default: false, - Help: "The controller is likely to install and then be unable to do its job.", - }, &proceed); err != nil { - return err - } - if !proceed { - return errors.New("install cancelled") - } - return nil + return shared.ConfirmProceed(opts.Dependencies, + fmt.Sprintf("%d %s not met; fix the problems above or pass --%s", + failed, util.Pluralise("prerequisite was", "prerequisites were", failed), octoK8s.FlagSkipPreflight), + "The controller is likely to install and then be unable to do its job.") } func (opts *InstallOptions) renderOnly(ctx context.Context, values map[string]any, timeout time.Duration) error { - fmt.Fprintf(opts.Out, "\n%s Rendering only. Nothing will be installed.\n", output.Dim("--"+octoK8s.FlagDryRun)) + return shared.RenderOnly(ctx, opts.Dependencies, opts.Runner, opts.installSpec(values, timeout), + "Nothing will be installed.", nil) +} - manifest, err := opts.Runner.Render(ctx, helm.InstallSpec{ +func (opts *InstallOptions) installSpec(values map[string]any, timeout time.Duration) helm.InstallSpec { + return helm.InstallSpec{ Chart: opts.chartRef(), ReleaseName: opts.TargetRelease, Namespace: opts.TargetNamespace, Values: values, + Atomic: opts.Atomic.Value, + Wait: opts.Wait.Value, Timeout: timeout, - }) - if err != nil { - return err } - - fmt.Fprintln(opts.Out, manifest) - return nil } func (opts *InstallOptions) reportSuccess(release helm.Release) { - fmt.Fprintf(opts.Out, "\n%s Installed %s %s as release %s in namespace %s.\n", - output.Green("✔"), release.Chart, release.Version, - output.Cyan(release.Name), output.Cyan(release.Namespace)) + shared.ReportInstalled(opts.Out, release) opts.PrintNextSteps() - if opts.NoPrompt { - return - } - generatable := []flag.Generatable{ opts.TargetNamespaces, opts.TargetNamespaceRegex, opts.NamespacedRBAC, negated{name: FlagCertManager, off: !opts.CertManager.Value}, } generatable = append(generatable, opts.CommonFlags.Generatable()...) - - autoCmd := flag.GenerateAutomationCmd(opts.CmdPath, opts.GetSpaceNameOrEmpty(), generatable...) - fmt.Fprintf(opts.Out, "\nAutomation Command: %s\n", autoCmd) + shared.PrintAutomationCommand(opts.Dependencies, generatable) } // PrintNextSteps exists because the controller changes nothing on its own: @@ -237,7 +206,7 @@ func (opts *InstallOptions) printAgentRestrictions() { fmt.Fprintf(opts.Out, "\n A deployment with no matching WorkloadServiceAccount falls back to the agent's default\n"+ " script pod permissions, which %s still grant across the cluster. Run this to take those\n"+ " defaults away, so an unmatched deployment fails instead:\n\n", - octoK8s.Pluralise("this agent", "these agents", len(unrestricted))) + util.Pluralise("this agent", "these agents", len(unrestricted))) for _, installation := range unrestricted { fmt.Fprintf(opts.Out, " %s\n", output.Dimf("# %s", installation.Name)) @@ -248,7 +217,7 @@ func (opts *InstallOptions) printAgentRestrictions() { func agentRestrictCommand(installation agent.Installation) string { return fmt.Sprintf("helm upgrade --install --atomic --create-namespace --namespace %s --reset-then-reuse-values "+ "--set scriptPods.serviceAccount.clusterRole.enabled=\"false\" %s %s", - installation.Release.Namespace, installation.Release.Name, AgentChartRef) + installation.Release.Namespace, installation.Release.Name, agent.ChartRef.Ref) } // negated renders a flag that defaults to on. GenerateAutomationCmd emits a bool @@ -261,11 +230,3 @@ type negated struct { func (n negated) GetName() string { return n.name + "=false" } func (n negated) GetValue() any { return n.off } func (n negated) IsSecure() bool { return false } - -func (opts *InstallOptions) ReportSuccessForTest(release helm.Release) { - opts.reportSuccess(release) -} - -func (opts *InstallOptions) ConfirmPrerequisitesForTest() error { - return opts.confirmPrerequisites() -} diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/export_test.go b/pkg/cmd/kubernetes/permissionscontroller/install/export_test.go new file mode 100644 index 00000000..723e29da --- /dev/null +++ b/pkg/cmd/kubernetes/permissionscontroller/install/export_test.go @@ -0,0 +1,25 @@ +package install + +import ( + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" +) + +// Test-only exports: compiled into the test binary, never into the package. + +func (opts *InstallOptions) ReportSuccessForTest(release helm.Release) { + opts.reportSuccess(release) +} + +func (opts *InstallOptions) ConfirmPrerequisitesForTest() error { + return opts.confirmPrerequisites() +} + +func (opts *InstallOptions) ResolveNamesForTest() { + opts.resolveNames() +} + +func RenderReviewForTest(opts *InstallOptions) { + opts.resolveNames() + shared.PrintReview(opts.Out, reviewGroups(opts)) +} diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/install.go b/pkg/cmd/kubernetes/permissionscontroller/install/install.go index a5bb2047..71b20589 100644 --- a/pkg/cmd/kubernetes/permissionscontroller/install/install.go +++ b/pkg/cmd/kubernetes/permissionscontroller/install/install.go @@ -14,17 +14,12 @@ import ( octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + controllerK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/permissionscontroller" "github.com/OctopusDeploy/cli/pkg/util/flag" "github.com/spf13/cobra" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" ) -var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/octopus-permissions-controller-chart"} - -// ChartName is the chart's own name, which is how an existing release is -// recognised whatever it was named. -const ChartName = "octopus-permissions-controller-chart" - // Only one controller runs per cluster, so there is nothing to derive a release // name from. const DefaultReleaseName = "octopus-permissions-controller" @@ -33,10 +28,6 @@ const DefaultReleaseName = "octopus-permissions-controller" // controller which service account to run as. An older agent ignores it. const MinimumAgentVersion = "v2.28.1" -// AgentChartRef is printed rather than installed: restricting an agent's script -// pods changes a release this command does not own. -const AgentChartRef = "oci://registry-1.docker.io/octopusdeploy/kubernetes-agent" - const ( FlagTargetNamespace = "target-namespace" FlagTargetNamespaceRegex = "target-namespace-regex" @@ -50,7 +41,7 @@ type InstallFlags struct { CertManager *flag.Flag[bool] NamespacedRBAC *flag.Flag[bool] - *octoK8s.CommonFlags + *shared.CommonFlags } func NewInstallFlags() *InstallFlags { @@ -59,7 +50,7 @@ func NewInstallFlags() *InstallFlags { TargetNamespaceRegex: flag.New[string](FlagTargetNamespaceRegex, false), CertManager: flag.New[bool](FlagCertManager, false), NamespacedRBAC: flag.New[bool](FlagNamespacedRBAC, false), - CommonFlags: octoK8s.NewCommonFlags(), + CommonFlags: shared.NewCommonFlags(), } // Set here as well as on the cobra flag, because the `kubernetes install` // wizard builds these without cobra ever parsing a command line. @@ -71,13 +62,9 @@ type InstallOptions struct { *InstallFlags *cmd.Dependencies - // These read the cluster during Discover. Injected so the prompt, review and - // commit flows can be tested without one. - CertManagerPresentCallback func() (bool, error) - ControllerPresentCallback func() (bool, error) - ExistingReleasesCallback func() ([]helm.Release, error) - AgentsCallback func() ([]agent.Installation, error) - NamespacesCallback func(ctx context.Context) ([]string, error) + // NamespacesCallback reads the cluster while prompting. Injected so the + // prompt flow can be tested without one. + NamespacesCallback func(ctx context.Context) ([]string, error) // Populated by Discover before prompting. Exported so tests can drive the // prompt flow against a fake cluster. @@ -102,10 +89,6 @@ func NewInstallOptions(installFlags *InstallFlags, dependencies *cmd.Dependencie Dependencies: dependencies, } - opts.CertManagerPresentCallback = func() (bool, error) { return agent.CertManagerPresent(opts.Cluster) } - opts.ControllerPresentCallback = func() (bool, error) { return agent.PermissionsControllerPresent(opts.Cluster) } - opts.ExistingReleasesCallback = func() ([]helm.Release, error) { return opts.Runner.FindByChart(ChartName) } - opts.AgentsCallback = func() ([]agent.Installation, error) { return agent.Installations(opts.Runner) } opts.NamespacesCallback = func(ctx context.Context) ([]string, error) { return listNamespaces(ctx, opts.Cluster) } return opts @@ -155,22 +138,16 @@ func NewCmdInstall(f factory.Factory) *cobra.Command { "Let cert-manager issue the certificate the controller's mutating admission webhook needs. Turn off only if you are supplying it yourself.") flags.BoolVar(&installFlags.NamespacedRBAC.Value, FlagNamespacedRBAC, false, "Give the controller permissions in its own namespace only, instead of across the cluster.") - octoK8s.RegisterCommonFlags(command, installFlags.CommonFlags) - describeCommonFlags(command) + shared.RegisterCommonFlags(command, installFlags.CommonFlags, shared.CommonFlagDetails{ + NamespaceDefault: fmt.Sprintf("Defaults to %s.", octoK8s.PermissionsControllerNamespace), + ReleaseDefault: fmt.Sprintf("Defaults to %s.", DefaultReleaseName), + Checks: "prerequisite", + NoCheckPod: true, + }) return command } -// describeCommonFlags corrects the shared help for a component that has no name -// to derive anything from, and makes no outbound connection to check. -func describeCommonFlags(command *cobra.Command) { - flags := command.Flags() - flags.Lookup(octoK8s.FlagNamespace).Usage = fmt.Sprintf("The namespace to install into. Defaults to %s.", octoK8s.PermissionsControllerNamespace) - flags.Lookup(octoK8s.FlagReleaseName).Usage = fmt.Sprintf("The Helm release name. Defaults to %s.", DefaultReleaseName) - flags.Lookup(octoK8s.FlagSkipPreflight).Usage = "Skip the prerequisite checks that run before installing." - _ = flags.MarkHidden(octoK8s.FlagPreflightImage) -} - // Run installs the controller using an existing set of dependencies. The // `kubernetes install` wizard uses this to hand off after the user picks a // component, so the two entry points share one implementation. @@ -215,49 +192,43 @@ func (opts *InstallOptions) Discover(ctx context.Context) error { Discover: opts.discover, } - session, err := connector.Connect(ctx) - if err != nil { - return err - } - - opts.Cluster = session.Cluster - opts.Runner = session.Runner - opts.KubeContextInfo = session.Context - return nil + _, err := connector.Connect(ctx) + return err } -// discover runs inside the connector's retry loop, so it sets what the -// callbacks read from before using them. +// discover runs inside the connector's retry loop, so it sets what the later +// flows read from before using anything. func (opts *InstallOptions) discover(_ context.Context, session *shared.Session) error { opts.Cluster = session.Cluster opts.Runner = session.Runner opts.KubeContextInfo = session.Context - certManager, err := opts.CertManagerPresentCallback() + certManager, err := controllerK8s.CertManagerPresent(opts.Cluster) if err != nil { return err } opts.CertManagerPresent = certManager - controller, err := opts.ControllerPresentCallback() + controller, err := controllerK8s.Present(opts.Cluster) if err != nil { return err } opts.ControllerPresent = controller - releases, err := opts.ExistingReleasesCallback() + // One cross-namespace release list answers both the existing-controller and + // installed-agents questions: Helm reads every release Secret in the + // cluster to build it, so it is the slowest call in this discovery. + releases, err := opts.Runner.List() if err != nil { return err } - if len(releases) > 0 { - opts.ExistingRelease = &releases[0] - } - - agents, err := opts.AgentsCallback() - if err != nil { - return err + for _, release := range releases { + if release.Chart == controllerK8s.ChartName { + opts.ExistingRelease = &release + break + } } - opts.Agents = agents + opts.Agents = agent.InstallationsFromReleases(opts.Runner, releases) return nil } @@ -284,9 +255,7 @@ func (opts *InstallOptions) resolveNames() { } func (opts *InstallOptions) chartRef() helm.ChartRef { - ref := ChartRef - ref.Version = opts.ChartVersion.Value - return ref + return controllerK8s.ChartRef.WithVersion(opts.ChartVersion.Value) } // listNamespaces leaves out the kube-* namespaces, which hold the control plane @@ -307,7 +276,3 @@ func listNamespaces(ctx context.Context, cluster *octoK8s.Cluster) ([]string, er sort.Strings(names) return names, nil } - -func (opts *InstallOptions) ResolveNamesForTest() { - opts.resolveNames() -} diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/review.go b/pkg/cmd/kubernetes/permissionscontroller/install/review.go index bcb717c7..c8306fed 100644 --- a/pkg/cmd/kubernetes/permissionscontroller/install/review.go +++ b/pkg/cmd/kubernetes/permissionscontroller/install/review.go @@ -5,8 +5,8 @@ import ( "fmt" "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" - octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + controllerK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/permissionscontroller" ) func Confirm(ctx context.Context, opts *InstallOptions) error { @@ -28,36 +28,8 @@ func reviewGroups(opts *InstallOptions) []shared.Group { } func clusterItems(opts *InstallOptions) []shared.Item { - kubeContext := opts.KubeContextInfo - source := "current context" - if opts.KubeContext.Value != "" && !kubeContext.IsCurrent { - source = "chosen" - } - - return []shared.Item{ - { - Label: "Kubernetes context", - Value: opts.KubeContext.Value, - Source: source, - // Changing cluster invalidates everything discovered from it. - Edit: nil, - }, - {Label: "Cluster address", Value: kubeContext.Server, Source: "from the kubeconfig"}, - { - Label: "Namespace", - Value: opts.TargetNamespace, - Source: shared.DerivedOrSet(opts.Namespace.Value, nameSource(opts)), - Edit: shared.EditText(opts.Ask, &opts.Namespace.Value, "Namespace to install into", - func() string { return opts.TargetNamespace }), - }, - { - Label: "Helm release", - Value: opts.TargetRelease, - Source: shared.DerivedOrSet(opts.ReleaseName.Value, nameSource(opts)), - Edit: shared.EditText(opts.Ask, &opts.ReleaseName.Value, "Helm release name", - func() string { return opts.TargetRelease }), - }, - } + return shared.ClusterItems(opts.Dependencies, opts.CommonFlags, opts.KubeContextInfo, + &opts.TargetNamespace, &opts.TargetRelease, nameSource(opts)) } func nameSource(opts *InstallOptions) string { @@ -165,22 +137,5 @@ func scriptPodPermissions(installation agent.Installation) string { } func helmItems(opts *InstallOptions) []shared.Item { - return []shared.Item{ - {Label: "Chart", Value: ChartRef.Ref}, - { - Label: "Chart version", Value: shared.OrDefault(opts.ChartVersion.Value, "latest"), - Edit: shared.EditText(opts.Ask, &opts.ChartVersion.Value, "Chart version (blank for the latest)", - func() string { return opts.ChartVersion.Value }), - }, - { - Label: "Timeout", Value: shared.OrDefault(opts.Timeout.Value, octoK8s.DefaultTimeout.String()), - Edit: shared.EditText(opts.Ask, &opts.Timeout.Value, "How long to wait for the release to become ready", - func() string { return opts.Timeout.Value }), - }, - } -} - -func RenderReviewForTest(opts *InstallOptions) { - opts.resolveNames() - shared.PrintReview(opts.Out, reviewGroups(opts)) + return shared.HelmItems(opts.Dependencies, opts.CommonFlags, controllerK8s.ChartRef) } diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/review_test.go b/pkg/cmd/kubernetes/permissionscontroller/install/review_test.go index 84d5e723..73c0a169 100644 --- a/pkg/cmd/kubernetes/permissionscontroller/install/review_test.go +++ b/pkg/cmd/kubernetes/permissionscontroller/install/review_test.go @@ -10,6 +10,7 @@ import ( octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/kubernetes/permissionscontroller" "github.com/OctopusDeploy/cli/test/testutil" "github.com/stretchr/testify/assert" ) @@ -55,7 +56,7 @@ func TestReview_ShowsEverySetting(t *testing.T) { "every namespace", // the chart's own default "cluster-wide", // RBAC scope "cert-manager", // who issues the webhook certificate - install.ChartRef.Ref, + permissionscontroller.ChartRef.Ref, octoK8s.DefaultTimeout.String(), "(one controller per cluster)", // why the names are what they are } { diff --git a/pkg/cmd/kubernetes/shared/cluster.go b/pkg/cmd/kubernetes/shared/cluster.go index ff532453..81d1baaf 100644 --- a/pkg/cmd/kubernetes/shared/cluster.go +++ b/pkg/cmd/kubernetes/shared/cluster.go @@ -28,7 +28,7 @@ type Session struct { // discovery against it. type Connector struct { *cmd.Dependencies - *octoK8s.CommonFlags + *CommonFlags // SelectMessage is asked when the kubeconfig holds more than one context. SelectMessage string diff --git a/pkg/cmd/kubernetes/shared/flags.go b/pkg/cmd/kubernetes/shared/flags.go new file mode 100644 index 00000000..07fdaeac --- /dev/null +++ b/pkg/cmd/kubernetes/shared/flags.go @@ -0,0 +1,106 @@ +package shared + +import ( + "fmt" + "time" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/util/flag" + "github.com/spf13/cobra" +) + +// CommonFlags are embedded by each component's own flags struct. +type CommonFlags struct { + KubeConfig *flag.Flag[string] + KubeContext *flag.Flag[string] + Namespace *flag.Flag[string] + ReleaseName *flag.Flag[string] + ChartVersion *flag.Flag[string] + DryRun *flag.Flag[bool] + OutputValues *flag.Flag[string] + Timeout *flag.Flag[string] + Atomic *flag.Flag[bool] + Wait *flag.Flag[bool] + SkipPreflight *flag.Flag[bool] + PreflightImage *flag.Flag[string] +} + +func NewCommonFlags() *CommonFlags { + return &CommonFlags{ + KubeConfig: flag.New[string](octoK8s.FlagKubeConfig, false), + KubeContext: flag.New[string](octoK8s.FlagKubeContext, false), + Namespace: flag.New[string](octoK8s.FlagNamespace, false), + ReleaseName: flag.New[string](octoK8s.FlagReleaseName, false), + ChartVersion: flag.New[string](octoK8s.FlagChartVersion, false), + DryRun: flag.New[bool](octoK8s.FlagDryRun, false), + OutputValues: flag.New[string](octoK8s.FlagOutputValues, false), + Timeout: flag.New[string](octoK8s.FlagTimeout, false), + Atomic: flag.New[bool](octoK8s.FlagAtomic, false), + Wait: flag.New[bool](octoK8s.FlagWait, false), + SkipPreflight: flag.New[bool](octoK8s.FlagSkipPreflight, false), + PreflightImage: flag.New[string](octoK8s.FlagPreflightImage, false), + } +} + +func (f *CommonFlags) Generatable() []flag.Generatable { + return []flag.Generatable{ + f.KubeConfig, f.KubeContext, f.Namespace, f.ReleaseName, f.ChartVersion, + f.Timeout, f.Atomic, f.Wait, f.SkipPreflight, f.PreflightImage, + } +} + +func (f *CommonFlags) ResolveTimeout() (time.Duration, error) { + if f.Timeout.Value == "" { + return octoK8s.DefaultTimeout, nil + } + d, err := time.ParseDuration(f.Timeout.Value) + if err != nil { + return 0, fmt.Errorf("--%s must be a duration such as 5m or 90s: %w", octoK8s.FlagTimeout, err) + } + if d <= 0 { + return 0, fmt.Errorf("--%s must be greater than zero", octoK8s.FlagTimeout) + } + return d, nil +} + +// CommonFlagDetails adapts the shared flag help to the component, so no +// command has to patch usage strings after registration. +type CommonFlagDetails struct { + // NamespaceDefault and ReleaseDefault say what happens when the flag is + // not given. + NamespaceDefault string + ReleaseDefault string + // Checks names what --skip-preflight skips. + Checks string + // NoCheckPod hides --preflight-image for a component whose checks start no pod. + NoCheckPod bool +} + +// DerivedFromNameDetails fits the components whose namespace and release +// follow the name they register with. +func DerivedFromNameDetails() CommonFlagDetails { + return CommonFlagDetails{ + NamespaceDefault: "Derived from the name if not set.", + ReleaseDefault: "Derived from the name if not set.", + Checks: "connectivity", + } +} + +func RegisterCommonFlags(cmd *cobra.Command, f *CommonFlags, details CommonFlagDetails) { + flags := cmd.Flags() + flags.StringVar(&f.KubeConfig.Value, octoK8s.FlagKubeConfig, "", "Path to the kubeconfig file. Defaults to $KUBECONFIG, then ~/.kube/config.") + flags.StringVar(&f.KubeContext.Value, octoK8s.FlagKubeContext, "", "The kubeconfig context to install into. Defaults to the current context.") + flags.StringVar(&f.Namespace.Value, octoK8s.FlagNamespace, "", "The namespace to install into. "+details.NamespaceDefault) + flags.StringVar(&f.ReleaseName.Value, octoK8s.FlagReleaseName, "", "The Helm release name. "+details.ReleaseDefault) + flags.StringVar(&f.ChartVersion.Value, octoK8s.FlagChartVersion, "", "The chart version to install. Defaults to the latest compatible version.") + flags.BoolVar(&f.DryRun.Value, octoK8s.FlagDryRun, false, "Render the manifests that would be applied, without installing anything.") + flags.StringVarP(&f.OutputValues.Value, octoK8s.FlagOutputValues, "o", "", "Write the resolved Helm values to this file.") + flags.StringVar(&f.Timeout.Value, octoK8s.FlagTimeout, "", fmt.Sprintf("How long to wait for the release to become ready, e.g. 5m. Defaults to %s.", octoK8s.DefaultTimeout)) + flags.BoolVar(&f.Atomic.Value, octoK8s.FlagAtomic, true, "Roll the release back if it fails to become ready.") + flags.BoolVar(&f.Wait.Value, octoK8s.FlagWait, true, "Wait for the release's resources to become ready.") + flags.BoolVar(&f.SkipPreflight.Value, octoK8s.FlagSkipPreflight, false, fmt.Sprintf("Skip the %s checks that run before installing.", details.Checks)) + flags.StringVar(&f.PreflightImage.Value, octoK8s.FlagPreflightImage, octoK8s.DefaultPreflightImage, "The image used by the connectivity check pod.") + if details.NoCheckPod { + _ = flags.MarkHidden(octoK8s.FlagPreflightImage) + } +} diff --git a/pkg/cmd/kubernetes/shared/preflight.go b/pkg/cmd/kubernetes/shared/preflight.go index 34198d5a..4c0dce21 100644 --- a/pkg/cmd/kubernetes/shared/preflight.go +++ b/pkg/cmd/kubernetes/shared/preflight.go @@ -10,6 +10,7 @@ import ( "github.com/OctopusDeploy/cli/pkg/cmd" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/util" ) // Preflight proves the endpoints a component needs are reachable from inside @@ -17,7 +18,7 @@ import ( // succeeds and then never connects. type Preflight struct { *cmd.Dependencies - *octoK8s.CommonFlags + *CommonFlags Cluster *octoK8s.Cluster Namespace string @@ -38,6 +39,7 @@ func (p *Preflight) Run(ctx context.Context) error { Namespace: p.Namespace, Image: p.PreflightImage.Value, Targets: p.Targets, + Warnings: p.Out, }) if err != nil { return err @@ -62,18 +64,26 @@ func (p *Preflight) confirm(checks []octoK8s.Check) error { return nil } - if p.NoPrompt { - return fmt.Errorf("%d connectivity %s failed; fix the problems above or pass --%s", - failed, octoK8s.Pluralise("check", "checks", failed), octoK8s.FlagSkipPreflight) + return ConfirmProceed(p.Dependencies, + fmt.Sprintf("%d connectivity %s failed; fix the problems above or pass --%s", + failed, util.Pluralise("check", "checks", failed), octoK8s.FlagSkipPreflight), + p.ProceedHelp) +} + +// ConfirmProceed asks whether to install past failed checks, because a check +// can be wrong: egress policy may allow the real workload's service account +// but not a bare check pod. noPromptMessage is the error when nobody can be +// asked. +func ConfirmProceed(d *cmd.Dependencies, noPromptMessage, proceedHelp string) error { + if d.NoPrompt { + return errors.New(noPromptMessage) } - // A check can be wrong: egress policy may allow the real workload's service - // account but not a bare pod. proceed := false - if err := p.Ask(&survey.Confirm{ + if err := d.Ask(&survey.Confirm{ Message: "Continue with the install anyway?", Default: false, - Help: p.ProceedHelp, + Help: proceedHelp, }, &proceed); err != nil { return err } @@ -112,10 +122,11 @@ func PrintChecks(out io.Writer, heading string, checks []octoK8s.Check) int { } // CheckPermissions runs before anything is created, so a missing permission -// surfaces here rather than halfway through. A dry run creates nothing, so it -// reports the problem and carries on. -func CheckPermissions(ctx context.Context, d *cmd.Dependencies, cluster *octoK8s.Cluster, namespace string, dryRun bool) error { - denied, err := cluster.CheckPermissions(ctx, octoK8s.InstallPermissions(namespace)) +// surfaces here rather than halfway through. Each component says what its +// install needs; octoK8s.InstallPermissions is the base every chart shares. A +// dry run creates nothing, so it reports the problem and carries on. +func CheckPermissions(ctx context.Context, d *cmd.Dependencies, cluster *octoK8s.Cluster, permissions []octoK8s.Permission, dryRun bool) error { + denied, err := cluster.CheckPermissions(ctx, permissions) if err != nil { return err } diff --git a/pkg/cmd/kubernetes/shared/report.go b/pkg/cmd/kubernetes/shared/report.go new file mode 100644 index 00000000..98f8afd5 --- /dev/null +++ b/pkg/cmd/kubernetes/shared/report.go @@ -0,0 +1,46 @@ +package shared + +import ( + "context" + "fmt" + "io" + + "github.com/OctopusDeploy/cli/pkg/cmd" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/cli/pkg/util/flag" +) + +func ReportInstalled(out io.Writer, release helm.Release) { + fmt.Fprintf(out, "\n%s Installed %s %s as release %s in namespace %s.\n", + output.Green("✔"), release.Chart, release.Version, + output.Cyan(release.Name), output.Cyan(release.Namespace)) +} + +// PrintAutomationCommand shows how to reproduce the run without the wizard, so +// there is nothing to print when there was no wizard. +func PrintAutomationCommand(d *cmd.Dependencies, generatable []flag.Generatable) { + if d.NoPrompt { + return + } + autoCmd := flag.GenerateAutomationCmd(d.CmdPath, d.GetSpaceNameOrEmpty(), generatable...) + fmt.Fprintf(d.Out, "\nAutomation Command: %s\n", autoCmd) +} + +// RenderOnly backs --dry-run. detail spells out what this component skips when +// nothing is installed; a nil preflight means it has no connectivity targets. +func RenderOnly(ctx context.Context, d *cmd.Dependencies, runner *helm.Runner, spec helm.InstallSpec, detail string, preflight *Preflight) error { + fmt.Fprintf(d.Out, "\n%s Rendering only. %s\n", output.Dim("--"+octoK8s.FlagDryRun), detail) + + if preflight != nil { + preflight.ReportStatic() + } + + manifest, err := runner.Render(ctx, spec) + if err != nil { + return err + } + fmt.Fprintln(d.Out, manifest) + return nil +} diff --git a/pkg/cmd/kubernetes/shared/review.go b/pkg/cmd/kubernetes/shared/review.go index 9295cdbe..e3b21070 100644 --- a/pkg/cmd/kubernetes/shared/review.go +++ b/pkg/cmd/kubernetes/shared/review.go @@ -9,6 +9,8 @@ import ( "github.com/AlecAivazis/survey/v2" "github.com/OctopusDeploy/cli/pkg/cmd" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" "github.com/OctopusDeploy/cli/pkg/output" "github.com/OctopusDeploy/cli/pkg/question" ) @@ -128,6 +130,68 @@ func PrintReview(out io.Writer, groups []Group) { fmt.Fprintln(out) } +// ClusterItems is the review group every installer starts with. derivedSource +// says where the namespace and release names come from when they were not +// given; extra rows appear after the cluster address. +func ClusterItems(d *cmd.Dependencies, flags *CommonFlags, kubeContext octoK8s.Context, + targetNamespace, targetRelease *string, derivedSource string, extra ...Item) []Item { + source := "current context" + if flags.KubeContext.Value != "" && !kubeContext.IsCurrent { + source = "chosen" + } + + items := []Item{ + { + Label: "Kubernetes context", + Value: flags.KubeContext.Value, + Source: source, + // Changing cluster invalidates everything discovered from it. + Edit: nil, + }, + {Label: "Cluster address", Value: kubeContext.Server, Source: "from the kubeconfig"}, + } + items = append(items, extra...) + + return append(items, + Item{ + Label: "Namespace", + Value: *targetNamespace, + Source: DerivedOrSet(flags.Namespace.Value, derivedSource), + Edit: EditText(d.Ask, &flags.Namespace.Value, "Namespace to install into", + func() string { return *targetNamespace }), + }, + Item{ + Label: "Helm release", + Value: *targetRelease, + Source: DerivedOrSet(flags.ReleaseName.Value, derivedSource), + Edit: EditText(d.Ask, &flags.ReleaseName.Value, "Helm release name", + func() string { return *targetRelease }), + }, + ) +} + +// HelmItems is the review group every installer ends with; extra rows appear +// between the chart version and the timeout. +func HelmItems(d *cmd.Dependencies, flags *CommonFlags, chart helm.ChartRef, extra ...Item) []Item { + versionDefault := OrDefault(chart.Version, "latest") + + items := []Item{ + {Label: "Chart", Value: chart.Ref}, + { + Label: "Chart version", Value: OrDefault(flags.ChartVersion.Value, versionDefault), + Edit: EditText(d.Ask, &flags.ChartVersion.Value, fmt.Sprintf("Chart version (blank for %s)", versionDefault), + func() string { return flags.ChartVersion.Value }), + }, + } + items = append(items, extra...) + + return append(items, Item{ + Label: "Timeout", Value: OrDefault(flags.Timeout.Value, octoK8s.DefaultTimeout.String()), + Edit: EditText(d.Ask, &flags.Timeout.Value, "How long to wait for the release to become ready", + func() string { return flags.Timeout.Value }), + }) +} + // EditText edits a value in place, offering what is currently in effect as the // default so pressing enter changes nothing. func EditText(ask question.Asker, target *string, message string, current func() string) func(context.Context) error { diff --git a/pkg/cmd/target/shared/tenant.go b/pkg/cmd/target/shared/tenant.go index e3ab5e14..fad20b37 100644 --- a/pkg/cmd/target/shared/tenant.go +++ b/pkg/cmd/target/shared/tenant.go @@ -72,7 +72,7 @@ func RegisterCreateTargetTenantFlags(cmd *cobra.Command, flags *CreateTargetTena func PromptForTenant(opts *CreateTargetTenantOptions, flags *CreateTargetTenantFlags) error { if flags.TenantedDeploymentMode.Value == "" { - selectedOption, err := selectors.SelectOptions(opts.Ask, "Choose the kind of deployments where this deployment target should be included", getTenantDeploymentOptions) + selectedOption, err := selectors.SelectOptions(opts.Ask, "Choose the kind of deployments where this deployment target should be included", TenantDeploymentOptions) if err != nil { return err } @@ -146,10 +146,6 @@ func isTenantedTarget(flags *CreateTargetTenantFlags) bool { // TenantDeploymentOptions are the kinds of deployment a target can take part in. func TenantDeploymentOptions() []*selectors.SelectOption[string] { - return getTenantDeploymentOptions() -} - -func getTenantDeploymentOptions() []*selectors.SelectOption[string] { return []*selectors.SelectOption[string]{ {Display: "Exclude from tenanted deployments (default)", Value: Untenanted}, {Display: "Include only in tenanted deployments", Value: Tenanted}, diff --git a/pkg/kubernetes/agent/agent.go b/pkg/kubernetes/agent/agent.go index 0ffcda81..8618bcd9 100644 --- a/pkg/kubernetes/agent/agent.go +++ b/pkg/kubernetes/agent/agent.go @@ -7,7 +7,6 @@ import ( "fmt" "strings" - octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" ) @@ -15,6 +14,12 @@ import ( // recognised whatever it was named. const ChartName = "kubernetes-agent" +// ChartRef floats within the newest chart major version this tooling is known +// to work with, as the Octopus portal's generated command does. Bump the major +// together with KubernetesAgentUpgradeManager.LatestSupportedMajorVersion in +// Octopus Server. +var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/kubernetes-agent", Version: "3.*.*"} + // Mode is what an agent was registered as. One agent is either a deployment // target or a worker, never both: the chart's registration takes one path or // the other. @@ -47,14 +52,23 @@ func Installations(runner *helm.Runner) ([]Installation, error) { if err != nil { return nil, err } + return InstallationsFromReleases(runner, releases), nil +} - installations := make([]Installation, 0, len(releases)) +// InstallationsFromReleases picks the agents out of an already-fetched release +// list, for a caller that lists every release anyway: Helm reads a Secret per +// release to build the list, so it is worth listing once. +func InstallationsFromReleases(runner *helm.Runner, releases []helm.Release) []Installation { + var installations []Installation for _, release := range releases { + if release.Chart != ChartName { + continue + } installation := Installation{Release: release, Mode: ModeUnknown, ScriptPodClusterRole: true} values, err := runner.GetValues(release.Name, release.Namespace) if err == nil { - installation.Name = stringAt(values, "agent", "name") + installation.Name = helm.StringAt(values, "agent", "name") installation.Mode = modeFrom(values) installation.ScriptPodClusterRole = clusterRoleEnabled(values) } @@ -64,14 +78,14 @@ func Installations(runner *helm.Runner) ([]Installation, error) { installations = append(installations, installation) } - return installations, nil + return installations } func modeFrom(values map[string]any) Mode { switch { - case boolAt(values, false, "agent", "worker", "enabled"): + case helm.BoolAt(values, false, "agent", "worker", "enabled"): return ModeWorker - case boolAt(values, false, "agent", "deploymentTarget", "enabled"): + case helm.BoolAt(values, false, "agent", "deploymentTarget", "enabled"): return ModeDeploymentTarget default: return ModeUnknown @@ -81,35 +95,12 @@ func modeFrom(values map[string]any) Mode { // clusterRoleEnabled defaults to true because that is the chart's own default, // so a release that never set it has the cluster-wide permissions. func clusterRoleEnabled(values map[string]any) bool { - return boolAt(values, true, "scriptPods", "serviceAccount", "clusterRole", "enabled") + return helm.BoolAt(values, true, "scriptPods", "serviceAccount", "clusterRole", "enabled") } -// PermissionsControllerPresent reports whether the Octopus permissions -// controller is running in this cluster. It is found by its own custom -// resource rather than by a Helm release, which can be named anything. -func PermissionsControllerPresent(cluster *octoK8s.Cluster) (bool, error) { - return cluster.HasAPIResource(PermissionsControllerAPIGroup, workloadServiceAccountResource) -} - -// CertManagerPresent reports whether cert-manager is installed, which the -// permissions controller needs for its admission webhook's certificate. -func CertManagerPresent(cluster *octoK8s.Cluster) (bool, error) { - return cluster.HasAPIResource(certManagerAPIGroup, certificateResource) -} - -const ( - // PermissionsControllerAPIGroup is shared with the agent's own script pod - // templates, so presence is checked by resource rather than by group. - PermissionsControllerAPIGroup = "agent.octopus.com" - workloadServiceAccountResource = "workloadserviceaccounts" - - certManagerAPIGroup = "cert-manager.io" - certificateResource = "certificates" -) - -// SupportedArchitectures are the node architectures the agent's images are +// supportedArchitectures are the node architectures the agent's images are // built for. Anything else schedules and then crash-loops. -var SupportedArchitectures = []string{"amd64", "arm64"} +var supportedArchitectures = []string{"amd64", "arm64"} // ErrUnsupportedNodes means no node in this cluster can run the agent, which is // a property of the cluster rather than of anything the caller did. @@ -127,7 +118,7 @@ func (e ErrUnsupportedNodes) Error() string { // nodes could not be listed. func UnsupportedArchitectures(present []string) []string { supported := map[string]bool{} - for _, arch := range SupportedArchitectures { + for _, arch := range supportedArchitectures { supported[arch] = true } @@ -148,36 +139,3 @@ func RunnableArchitecture(present []string) bool { } return len(UnsupportedArchitectures(present)) < len(present) } - -func stringAt(values map[string]any, keys ...string) string { - value, ok := at(values, keys...).(string) - if !ok { - return "" - } - return value -} - -func boolAt(values map[string]any, fallback bool, keys ...string) bool { - value, ok := at(values, keys...).(bool) - if !ok { - return fallback - } - return value -} - -// at walks a Helm values tree, which only holds what was set explicitly, so any -// step of the path may be missing. -func at(values map[string]any, keys ...string) any { - var current any = values - for _, key := range keys { - node, ok := current.(map[string]any) - if !ok { - return nil - } - current, ok = node[key] - if !ok { - return nil - } - } - return current -} diff --git a/pkg/kubernetes/agent/agent_internal_test.go b/pkg/kubernetes/agent/agent_internal_test.go index 7b6b1e2e..ec51194c 100644 --- a/pkg/kubernetes/agent/agent_internal_test.go +++ b/pkg/kubernetes/agent/agent_internal_test.go @@ -6,27 +6,6 @@ import ( "github.com/stretchr/testify/assert" ) -// Helm reports only the values a release actually set, so every step of a path -// may be missing. -func TestValuesTree_TolerantOfMissingBranches(t *testing.T) { - values := map[string]any{ - "agent": map[string]any{ - "name": "Production", - "worker": map[string]any{"enabled": true}, - }, - } - - assert.Equal(t, "Production", stringAt(values, "agent", "name")) - assert.Equal(t, "", stringAt(values, "agent", "missing")) - assert.Equal(t, "", stringAt(values, "nothing", "here", "at", "all")) - assert.True(t, boolAt(values, false, "agent", "worker", "enabled")) - assert.False(t, boolAt(values, false, "agent", "deploymentTarget", "enabled")) - assert.True(t, boolAt(values, true, "agent", "deploymentTarget", "enabled"), "the fallback stands in for the chart's own default") - - // A value of the wrong type is no more useful than a missing one. - assert.Equal(t, "", stringAt(values, "agent", "worker")) -} - func TestModeFrom(t *testing.T) { tests := []struct { name string diff --git a/pkg/kubernetes/agent/agent_test.go b/pkg/kubernetes/agent/agent_test.go index c56d68d4..416e309c 100644 --- a/pkg/kubernetes/agent/agent_test.go +++ b/pkg/kubernetes/agent/agent_test.go @@ -23,46 +23,6 @@ func clusterWith(resources []*metav1.APIResourceList, objects ...runtime.Object) return octoK8s.NewClusterForTesting(clientset, "test", "https://cluster") } -func TestPermissionsControllerPresent(t *testing.T) { - // The agent's own script pod templates share this API group, so the - // controller has to be recognised by its resource rather than its group. - agentOnly := clusterWith([]*metav1.APIResourceList{{ - GroupVersion: "agent.octopus.com/v1beta1", - APIResources: []metav1.APIResource{{Name: "scriptpodtemplates", Kind: "ScriptPodTemplate"}}, - }}) - - present, err := agent.PermissionsControllerPresent(agentOnly) - require.NoError(t, err) - assert.False(t, present) - - withController := clusterWith([]*metav1.APIResourceList{{ - GroupVersion: "agent.octopus.com/v1beta1", - APIResources: []metav1.APIResource{ - {Name: "scriptpodtemplates", Kind: "ScriptPodTemplate"}, - {Name: "workloadserviceaccounts", Kind: "WorkloadServiceAccount"}, - }, - }}) - - present, err = agent.PermissionsControllerPresent(withController) - require.NoError(t, err) - assert.True(t, present) -} - -func TestCertManagerPresent(t *testing.T) { - none := clusterWith(nil) - present, err := agent.CertManagerPresent(none) - require.NoError(t, err) - assert.False(t, present) - - installed := clusterWith([]*metav1.APIResourceList{{ - GroupVersion: "cert-manager.io/v1", - APIResources: []metav1.APIResource{{Name: "certificates", Kind: "Certificate"}}, - }}) - present, err = agent.CertManagerPresent(installed) - require.NoError(t, err) - assert.True(t, present) -} - func TestStorageClasses_DefaultFirst(t *testing.T) { cluster := clusterWith(nil, &storagev1.StorageClass{ diff --git a/pkg/kubernetes/argocd/account.go b/pkg/kubernetes/argocd/account.go index 2e0374d5..82bbf3d6 100644 --- a/pkg/kubernetes/argocd/account.go +++ b/pkg/kubernetes/argocd/account.go @@ -12,6 +12,7 @@ import ( "k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/util" ) // DefaultAccountName is a local account: Argo CD has no service-account @@ -65,7 +66,7 @@ func (s AccountStatus) Summary() string { missing = append(missing, fmt.Sprintf("the %q account is disabled", s.Spec.Name)) } if len(s.MissingPolicies) > 0 { - missing = append(missing, fmt.Sprintf("%d RBAC %s", len(s.MissingPolicies), octoK8s.Pluralise("policy", "policies", len(s.MissingPolicies)))) + missing = append(missing, fmt.Sprintf("%d RBAC %s", len(s.MissingPolicies), util.Pluralise("policy", "policies", len(s.MissingPolicies)))) } return "Argo CD is missing " + strings.Join(missing, " and ") } diff --git a/pkg/kubernetes/argocd/bootstrap.go b/pkg/kubernetes/argocd/bootstrap.go index 1e4debe7..f50d9eca 100644 --- a/pkg/kubernetes/argocd/bootstrap.go +++ b/pkg/kubernetes/argocd/bootstrap.go @@ -125,15 +125,17 @@ func BeginBootstrapLogin(ctx context.Context, c *octoK8s.Cluster, instance Insta passwordKey := accountsKeyPrefix + spec.Name + accountPasswordKeySuffix mtimeKey := accountsKeyPrefix + spec.Name + accountPasswordMtimeKeySuffix - if value, found, err := c.SecretKey(ctx, namespace, SecretName, passwordKey); err != nil { + if secret, found, err := c.GetSecret(ctx, namespace, SecretName); err != nil { return nil, err } else if found { - bootstrap.previousPassword = &value - } - if value, found, err := c.SecretKey(ctx, namespace, SecretName, mtimeKey); err != nil { - return nil, err - } else if found { - bootstrap.previousMtime = &value + if value, ok := secret.Data[passwordKey]; ok { + previous := string(value) + bootstrap.previousPassword = &previous + } + if value, ok := secret.Data[mtimeKey]; ok { + previous := string(value) + bootstrap.previousMtime = &previous + } } err = c.MergeSecretKeys(ctx, namespace, SecretName, map[string]string{ diff --git a/pkg/kubernetes/argocd/discover.go b/pkg/kubernetes/argocd/discover.go index 28be921f..db0cd93d 100644 --- a/pkg/kubernetes/argocd/discover.go +++ b/pkg/kubernetes/argocd/discover.go @@ -267,17 +267,22 @@ func runsArgoCD(d *appsv1.Deployment) bool { // namespacesWithArgoConfig finds installations whose labels name nothing // recognisable. Argo CD reads its configuration from a ConfigMap of a fixed -// name, so the namespaces holding one are where to look. +// name, so the namespaces holding one are where to look. One cluster-wide list +// rather than a read per namespace: this fallback tends to run against exactly +// the clusters with too many namespaces to walk. func namespacesWithArgoConfig(ctx context.Context, c *octoK8s.Cluster) []string { - namespaces, err := c.Clientset.CoreV1().Namespaces().List(ctx, metav1.ListOptions{}) + configMaps, err := c.Clientset.CoreV1().ConfigMaps(metav1.NamespaceAll).List(ctx, metav1.ListOptions{ + FieldSelector: "metadata.name=" + ConfigMapName, + }) if err != nil { return nil } var found []string - for _, namespace := range namespaces.Items { - if _, ok, err := c.GetConfigMap(ctx, namespace.Name, ConfigMapName); err == nil && ok { - found = append(found, namespace.Name) + for _, configMap := range configMaps.Items { + // Checked again because a fake clientset in tests ignores field selectors. + if configMap.Name == ConfigMapName { + found = append(found, configMap.Namespace) } } return found diff --git a/pkg/kubernetes/argocd/eks.go b/pkg/kubernetes/argocd/eks.go index 8bbc1881..2c1240ef 100644 --- a/pkg/kubernetes/argocd/eks.go +++ b/pkg/kubernetes/argocd/eks.go @@ -2,7 +2,6 @@ package argocd import ( "context" - "encoding/base64" "encoding/json" "fmt" "os" @@ -11,6 +10,7 @@ import ( "time" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/util" ) // awsTimeout keeps a stale SSO session showing up as a prompt for the endpoint @@ -233,21 +233,11 @@ func (c ProjectTokenClaims) Expired() bool { // which Argo CD sets to proj:: - so a person pasting a token // does not also have to say which project it belongs to. func ParseProjectToken(token string) (ProjectTokenClaims, error) { - parts := strings.Split(strings.TrimSpace(token), ".") - if len(parts) != 3 { - return ProjectTokenClaims{}, fmt.Errorf("this does not look like an Argo CD token") - } - - payload, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(parts[1], "=")) - if err != nil { - return ProjectTokenClaims{}, fmt.Errorf("this does not look like an Argo CD token") - } - var claims struct { Subject string `json:"sub"` Expires int64 `json:"exp"` } - if err := json.Unmarshal(payload, &claims); err != nil { + if err := util.DecodeJWTClaims(token, &claims); err != nil { return ProjectTokenClaims{}, fmt.Errorf("this does not look like an Argo CD token") } diff --git a/pkg/kubernetes/argocd/token.go b/pkg/kubernetes/argocd/token.go index b5eb9709..2cfff0e4 100644 --- a/pkg/kubernetes/argocd/token.go +++ b/pkg/kubernetes/argocd/token.go @@ -319,34 +319,19 @@ func (a AccessCheck) Readable() bool { // show nothing at all. func (c *Client) VerifyAccess(ctx context.Context) AccessCheck { var check AccessCheck - - applications, err := c.listNames(ctx, "/api/v1/applications") - check.Applications, check.ApplicationsErr = len(applications), err - - clusters, err := c.listNames(ctx, "/api/v1/clusters") - check.Clusters, check.ClustersErr = len(clusters), err - + check.Applications, check.ApplicationsErr = c.countItems(ctx, "/api/v1/applications") + check.Clusters, check.ClustersErr = c.countItems(ctx, "/api/v1/clusters") return check } -func (c *Client) listNames(ctx context.Context, path string) ([]string, error) { +func (c *Client) countItems(ctx context.Context, path string) (int, error) { var response struct { - Items []struct { - Name string `json:"name"` - Metadata struct { - Name string `json:"name"` - } `json:"metadata"` - } `json:"items"` + Items []json.RawMessage `json:"items"` } if err := c.do(ctx, http.MethodGet, path, nil, &response); err != nil { - return nil, err - } - - names := make([]string, 0, len(response.Items)) - for _, item := range response.Items { - names = append(names, firstNonEmpty(item.Metadata.Name, item.Name)) + return 0, err } - return names, nil + return len(response.Items), nil } // NewClientForURL talks to an Argo CD that is already reachable, which is the diff --git a/pkg/kubernetes/cluster.go b/pkg/kubernetes/cluster.go index c0b0902e..eee80672 100644 --- a/pkg/kubernetes/cluster.go +++ b/pkg/kubernetes/cluster.go @@ -8,6 +8,7 @@ import ( "strings" "time" + "github.com/OctopusDeploy/cli/pkg/util" appsv1 "k8s.io/api/apps/v1" authzv1 "k8s.io/api/authorization/v1" corev1 "k8s.io/api/core/v1" @@ -26,6 +27,10 @@ type Cluster struct { Dynamic dynamic.Interface ContextName string Server string + + // apiGroups caches the discovery listing: it is a full API-group round + // trip, and one wizard run asks HasAPIResource for several components. + apiGroups *metav1.APIGroupList } func Connect(kubeConfig *KubeConfig, contextName string) (*Cluster, error) { @@ -318,9 +323,14 @@ func (c *Cluster) RestartDeployment(ctx context.Context, namespace, name string) func (c *Cluster) HasAPIResource(group, resource string) (bool, error) { discovery := c.Clientset.Discovery() - groups, err := discovery.ServerGroups() - if err != nil { - return false, fmt.Errorf("could not list the API groups this cluster serves: %w", err) + groups := c.apiGroups + if groups == nil { + listed, err := discovery.ServerGroups() + if err != nil { + return false, fmt.Errorf("could not list the API groups this cluster serves: %w", err) + } + c.apiGroups = listed + groups = listed } for _, g := range groups.Groups { @@ -456,7 +466,7 @@ func (r Role) Display() string { if r.GrantsEverything() { return fmt.Sprintf("%s (%s, full access to the cluster)", r.Reference(), kind) } - return fmt.Sprintf("%s (%s, %d %s)", r.Reference(), kind, len(r.Rules), Pluralise("rule", "rules", len(r.Rules))) + return fmt.Sprintf("%s (%s, %d %s)", r.Reference(), kind, len(r.Rules), util.Pluralise("rule", "rules", len(r.Rules))) } // Roles lists the roles worth offering to copy, cluster-scoped ones first. diff --git a/pkg/kubernetes/flags.go b/pkg/kubernetes/flags.go index a3480bcd..9f69af2f 100644 --- a/pkg/kubernetes/flags.go +++ b/pkg/kubernetes/flags.go @@ -1,13 +1,9 @@ package kubernetes -import ( - "fmt" - "time" - - "github.com/OctopusDeploy/cli/pkg/util/flag" - "github.com/spf13/cobra" -) +import "time" +// Flag names live beside the cluster code rather than the commands, because +// error messages raised here tell the user which flag fixes the problem. const ( FlagKubeConfig = "kubeconfig" FlagKubeContext = "kube-context" @@ -24,80 +20,3 @@ const ( ) const DefaultTimeout = 10 * time.Minute - -// CommonFlags are embedded by each component's own flags struct. -type CommonFlags struct { - KubeConfig *flag.Flag[string] - KubeContext *flag.Flag[string] - Namespace *flag.Flag[string] - ReleaseName *flag.Flag[string] - ChartVersion *flag.Flag[string] - DryRun *flag.Flag[bool] - OutputValues *flag.Flag[string] - Timeout *flag.Flag[string] - Atomic *flag.Flag[bool] - Wait *flag.Flag[bool] - SkipPreflight *flag.Flag[bool] - PreflightImage *flag.Flag[string] -} - -func NewCommonFlags() *CommonFlags { - return &CommonFlags{ - KubeConfig: flag.New[string](FlagKubeConfig, false), - KubeContext: flag.New[string](FlagKubeContext, false), - Namespace: flag.New[string](FlagNamespace, false), - ReleaseName: flag.New[string](FlagReleaseName, false), - ChartVersion: flag.New[string](FlagChartVersion, false), - DryRun: flag.New[bool](FlagDryRun, false), - OutputValues: flag.New[string](FlagOutputValues, false), - Timeout: flag.New[string](FlagTimeout, false), - Atomic: flag.New[bool](FlagAtomic, false), - Wait: flag.New[bool](FlagWait, false), - SkipPreflight: flag.New[bool](FlagSkipPreflight, false), - PreflightImage: flag.New[string](FlagPreflightImage, false), - } -} - -func (f *CommonFlags) Generatable() []flag.Generatable { - return []flag.Generatable{ - f.KubeConfig, f.KubeContext, f.Namespace, f.ReleaseName, f.ChartVersion, - f.Timeout, f.Atomic, f.Wait, f.SkipPreflight, f.PreflightImage, - } -} - -func (f *CommonFlags) ResolveTimeout() (time.Duration, error) { - if f.Timeout.Value == "" { - return DefaultTimeout, nil - } - d, err := time.ParseDuration(f.Timeout.Value) - if err != nil { - return 0, fmt.Errorf("--%s must be a duration such as 5m or 90s: %w", FlagTimeout, err) - } - if d <= 0 { - return 0, fmt.Errorf("--%s must be greater than zero", FlagTimeout) - } - return d, nil -} - -func RegisterCommonFlags(cmd *cobra.Command, f *CommonFlags) { - flags := cmd.Flags() - flags.StringVar(&f.KubeConfig.Value, FlagKubeConfig, "", "Path to the kubeconfig file. Defaults to $KUBECONFIG, then ~/.kube/config.") - flags.StringVar(&f.KubeContext.Value, FlagKubeContext, "", "The kubeconfig context to install into. Defaults to the current context.") - flags.StringVar(&f.Namespace.Value, FlagNamespace, "", "The namespace to install into. Derived from the name if not set.") - flags.StringVar(&f.ReleaseName.Value, FlagReleaseName, "", "The Helm release name. Derived from the name if not set.") - flags.StringVar(&f.ChartVersion.Value, FlagChartVersion, "", "The chart version to install. Defaults to the latest compatible version.") - flags.BoolVar(&f.DryRun.Value, FlagDryRun, false, "Render the manifests that would be applied, without installing anything.") - flags.StringVarP(&f.OutputValues.Value, FlagOutputValues, "o", "", "Write the resolved Helm values to this file.") - flags.StringVar(&f.Timeout.Value, FlagTimeout, "", fmt.Sprintf("How long to wait for the release to become ready, e.g. 5m. Defaults to %s.", DefaultTimeout)) - flags.BoolVar(&f.Atomic.Value, FlagAtomic, true, "Roll the release back if it fails to become ready.") - flags.BoolVar(&f.Wait.Value, FlagWait, true, "Wait for the release's resources to become ready.") - flags.BoolVar(&f.SkipPreflight.Value, FlagSkipPreflight, false, "Skip the connectivity checks that run before installing.") - flags.StringVar(&f.PreflightImage.Value, FlagPreflightImage, DefaultPreflightImage, "The image used by the connectivity check pod.") -} - -func Pluralise(singular, plural string, n int) string { - if n == 1 { - return singular - } - return plural -} diff --git a/pkg/kubernetes/gateway/gateway.go b/pkg/kubernetes/gateway/gateway.go new file mode 100644 index 00000000..091782ff --- /dev/null +++ b/pkg/kubernetes/gateway/gateway.go @@ -0,0 +1,48 @@ +// Package gateway holds what the installers and operational commands need to +// know about the Octopus Argo CD gateway as it exists in a cluster: its chart, +// its workload, and the Secret contract its chart reads credentials from. +package gateway + +import ( + "github.com/OctopusDeploy/cli/pkg/kubernetes/argocd" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" +) + +// ChartName is the chart's own name, which is how an installed release is +// recognised whatever it was named. +const ChartName = "octopus-argocd-gateway-chart" + +var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/octopus-argocd-gateway-chart"} + +// DeploymentSelector matches the gateway deployment the chart installs. +const DeploymentSelector = "app.kubernetes.io/name=octopus-argocd-gateway" + +// Passing credentials by Secret reference keeps them out of the Helm release +// values, out of any file written by --output-values, and out of the process +// table. These names and keys are the chart's contract. +const ( + ArgoTokenSecretName = "octopus-argocd-gateway-argocd-token" + ArgoTokenSecretKey = "ARGOCD_AUTH_TOKEN" + ProjectTokenSecretName = "octopus-argocd-gateway-project-tokens" + + // The chart reads project tokens from Secret keys of this shape, exposed as + // environment variables with an OCTOPUS_ARGOCD_ prefix added by envFrom. + ProjectTokenKeyPrefix = "PROJECT_AUTH_TOKEN_" + AccountTokenEnvName = "OCTOPUS_ARGOCD_AUTH_TOKEN" + + // The chart's own registration job would write these, and the gateway + // reads them from its projected configuration volume. Octopus writes them + // instead, so no Octopus credential of the user's ever enters the cluster. + RegistrationSecretName = "octopus-argocd-gateway-octopus-auth-secret" + RegistrationSecretKey = "octopus-argocd-gateway-octopus-authentication-secret.yaml" +) + +// InstanceFromValues reads the gateway's Argo CD connection back out of a +// release's values, so a gateway can be operated on without knowing how it was +// installed. +func InstanceFromValues(values map[string]any) argocd.Instance { + return argocd.Instance{ + ServerGRPCURL: helm.StringAt(values, "gateway", "argocd", "serverGrpcUrl"), + WebUIURL: helm.StringAt(values, "registration", "argocd", "webUiUrl"), + } +} diff --git a/pkg/kubernetes/helm/runner.go b/pkg/kubernetes/helm/runner.go index 5944b3de..d60615be 100644 --- a/pkg/kubernetes/helm/runner.go +++ b/pkg/kubernetes/helm/runner.go @@ -26,27 +26,31 @@ type ChartRef struct { Version string } +// WithVersion keeps the ref's own version pin when nothing was asked for. +func (r ChartRef) WithVersion(version string) ChartRef { + if version != "" { + r.Version = version + } + return r +} + type Release struct { Name string Namespace string Chart string Version string - Revision int - Status string Manifest string - Notes string } type InstallSpec struct { - Chart ChartRef - ReleaseName string - Namespace string - Values map[string]any - CreateNamespace bool - Atomic bool - Wait bool - Timeout time.Duration - DryRun bool + Chart ChartRef + ReleaseName string + Namespace string + Values map[string]any + Atomic bool + Wait bool + Timeout time.Duration + DryRun bool } type Runner struct { @@ -155,9 +159,12 @@ func (r *Runner) Install(ctx context.Context, spec InstallSpec) (Release, error) return r.install(ctx, cfg, spec) } -// Render backs --dry-run. +// Render backs --dry-run. Rendering never waits or rolls back - there is +// nothing applied to watch or undo. func (r *Runner) Render(ctx context.Context, spec InstallSpec) (string, error) { spec.DryRun = true + spec.Atomic = false + spec.Wait = false rel, err := r.Install(ctx, spec) if err != nil { return "", err @@ -169,7 +176,6 @@ func (r *Runner) install(ctx context.Context, cfg *action.Configuration, spec In client := action.NewInstall(cfg) client.ReleaseName = spec.ReleaseName client.Namespace = spec.Namespace - client.CreateNamespace = spec.CreateNamespace client.Version = spec.Chart.Version client.Timeout = spec.Timeout client.RollbackOnFailure = spec.Atomic @@ -179,7 +185,6 @@ func (r *Runner) install(ctx context.Context, cfg *action.Configuration, spec In // Client-side only: a server-side dry run needs permissions the user // may not have, and fails for a namespace that does not exist yet. client.DryRunStrategy = action.DryRunClient - client.CreateNamespace = false } chrt, err := r.loadChart(&client.ChartPathOptions, spec.Chart) @@ -265,10 +270,7 @@ func toRelease(result release.Releaser) (Release, error) { rel := Release{ Name: accessor.Name(), Namespace: accessor.Namespace(), - Revision: accessor.Version(), - Status: accessor.Status(), Manifest: accessor.Manifest(), - Notes: accessor.Notes(), } if chartAccessor, err := chart.NewDefaultAccessor(accessor.Chart()); err == nil { diff --git a/pkg/kubernetes/helm/values.go b/pkg/kubernetes/helm/values.go new file mode 100644 index 00000000..113c9303 --- /dev/null +++ b/pkg/kubernetes/helm/values.go @@ -0,0 +1,35 @@ +package helm + +// StringAt and BoolAt read one value out of a release's values tree, which +// only holds what was set explicitly, so any step of the path may be missing. + +func StringAt(values map[string]any, keys ...string) string { + value, ok := at(values, keys...).(string) + if !ok { + return "" + } + return value +} + +func BoolAt(values map[string]any, fallback bool, keys ...string) bool { + value, ok := at(values, keys...).(bool) + if !ok { + return fallback + } + return value +} + +func at(values map[string]any, keys ...string) any { + var current any = values + for _, key := range keys { + node, ok := current.(map[string]any) + if !ok { + return nil + } + current, ok = node[key] + if !ok { + return nil + } + } + return current +} diff --git a/pkg/kubernetes/helm/values_test.go b/pkg/kubernetes/helm/values_test.go new file mode 100644 index 00000000..456cc342 --- /dev/null +++ b/pkg/kubernetes/helm/values_test.go @@ -0,0 +1,29 @@ +package helm_test + +import ( + "testing" + + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" + "github.com/stretchr/testify/assert" +) + +// Helm reports only the values a release actually set, so every step of a path +// may be missing. +func TestValuesTree_TolerantOfMissingBranches(t *testing.T) { + values := map[string]any{ + "agent": map[string]any{ + "name": "Production", + "worker": map[string]any{"enabled": true}, + }, + } + + assert.Equal(t, "Production", helm.StringAt(values, "agent", "name")) + assert.Equal(t, "", helm.StringAt(values, "agent", "missing")) + assert.Equal(t, "", helm.StringAt(values, "nothing", "here", "at", "all")) + assert.True(t, helm.BoolAt(values, false, "agent", "worker", "enabled")) + assert.False(t, helm.BoolAt(values, false, "agent", "deploymentTarget", "enabled")) + assert.True(t, helm.BoolAt(values, true, "agent", "deploymentTarget", "enabled"), "the fallback stands in for the chart's own default") + + // A value of the wrong type is no more useful than a missing one. + assert.Equal(t, "", helm.StringAt(values, "agent", "worker")) +} diff --git a/pkg/kubernetes/naming.go b/pkg/kubernetes/naming.go index 85551b51..d208401f 100644 --- a/pkg/kubernetes/naming.go +++ b/pkg/kubernetes/naming.go @@ -54,6 +54,25 @@ func DerivedNamespace(prefix, name string) (string, error) { return prefix + truncateSlug(s, dnsLabelMaxLen-len(prefix)), nil } +// ResolveNames keeps an explicit --namespace or --release-name and derives +// whatever was not given from the component's name. +func ResolveNames(explicitNamespace, explicitRelease, prefix, name string) (namespace, release string, err error) { + namespace = explicitNamespace + if namespace == "" { + if namespace, err = DerivedNamespace(prefix, name); err != nil { + return "", "", err + } + } + + release = explicitRelease + if release == "" { + if release, err = ReleaseName(name); err != nil { + return "", "", err + } + } + return namespace, release, nil +} + // truncateSlug cuts on a hyphen boundary where it can, to stay readable. func truncateSlug(s string, max int) string { if len(s) <= max { diff --git a/pkg/kubernetes/permissionscontroller/permissionscontroller.go b/pkg/kubernetes/permissionscontroller/permissionscontroller.go new file mode 100644 index 00000000..ea442ffc --- /dev/null +++ b/pkg/kubernetes/permissionscontroller/permissionscontroller.go @@ -0,0 +1,37 @@ +// Package permissionscontroller holds what the installers need to know about +// the Octopus permissions controller as it exists in a cluster. +package permissionscontroller + +import ( + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" +) + +// ChartName is the chart's own name, which is how an installed release is +// recognised whatever it was named. +const ChartName = "octopus-permissions-controller-chart" + +var ChartRef = helm.ChartRef{Ref: "oci://registry-1.docker.io/octopusdeploy/octopus-permissions-controller-chart"} + +const ( + // APIGroup is shared with the agent's own script pod templates, so presence + // is checked by resource rather than by group. + APIGroup = "agent.octopus.com" + workloadServiceAccountResource = "workloadserviceaccounts" + + certManagerAPIGroup = "cert-manager.io" + certificateResource = "certificates" +) + +// Present reports whether the controller is running in this cluster. It is +// found by its own custom resource rather than by a Helm release, which can be +// named anything. +func Present(cluster *octoK8s.Cluster) (bool, error) { + return cluster.HasAPIResource(APIGroup, workloadServiceAccountResource) +} + +// CertManagerPresent reports whether cert-manager is installed, which the +// controller needs for its admission webhook's certificate. +func CertManagerPresent(cluster *octoK8s.Cluster) (bool, error) { + return cluster.HasAPIResource(certManagerAPIGroup, certificateResource) +} diff --git a/pkg/kubernetes/permissionscontroller/permissionscontroller_test.go b/pkg/kubernetes/permissionscontroller/permissionscontroller_test.go new file mode 100644 index 00000000..bbd56a17 --- /dev/null +++ b/pkg/kubernetes/permissionscontroller/permissionscontroller_test.go @@ -0,0 +1,58 @@ +package permissionscontroller_test + +import ( + "testing" + + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + "github.com/OctopusDeploy/cli/pkg/kubernetes/permissionscontroller" + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/client-go/kubernetes/fake" +) + +func clusterWith(resources []*metav1.APIResourceList) *octoK8s.Cluster { + clientset := fake.NewSimpleClientset() + clientset.Resources = resources + return octoK8s.NewClusterForTesting(clientset, "test", "https://cluster") +} + +func TestPresent(t *testing.T) { + // The agent's own script pod templates share this API group, so the + // controller has to be recognised by its resource rather than its group. + agentOnly := clusterWith([]*metav1.APIResourceList{{ + GroupVersion: "agent.octopus.com/v1beta1", + APIResources: []metav1.APIResource{{Name: "scriptpodtemplates", Kind: "ScriptPodTemplate"}}, + }}) + + present, err := permissionscontroller.Present(agentOnly) + require.NoError(t, err) + assert.False(t, present) + + withController := clusterWith([]*metav1.APIResourceList{{ + GroupVersion: "agent.octopus.com/v1beta1", + APIResources: []metav1.APIResource{ + {Name: "scriptpodtemplates", Kind: "ScriptPodTemplate"}, + {Name: "workloadserviceaccounts", Kind: "WorkloadServiceAccount"}, + }, + }}) + + present, err = permissionscontroller.Present(withController) + require.NoError(t, err) + assert.True(t, present) +} + +func TestCertManagerPresent(t *testing.T) { + none := clusterWith(nil) + present, err := permissionscontroller.CertManagerPresent(none) + require.NoError(t, err) + assert.False(t, present) + + installed := clusterWith([]*metav1.APIResourceList{{ + GroupVersion: "cert-manager.io/v1", + APIResources: []metav1.APIResource{{Name: "certificates", Kind: "Certificate"}}, + }}) + present, err = permissionscontroller.CertManagerPresent(installed) + require.NoError(t, err) + assert.True(t, present) +} diff --git a/pkg/kubernetes/preflight.go b/pkg/kubernetes/preflight.go index f61637a4..2bd4d417 100644 --- a/pkg/kubernetes/preflight.go +++ b/pkg/kubernetes/preflight.go @@ -59,10 +59,33 @@ type Target struct { Remediation string } +// RESTAPITarget and GRPCTarget carry the remediation prose every component +// shares; purpose says what this component does over the endpoint. + +func RESTAPITarget(host, purpose string) Target { + return Target{ + Name: "Octopus REST API", + Address: host, + Remediation: purpose + " Confirm this address is reachable from inside the cluster.", + } +} + +func GRPCTarget(address, purpose string) Target { + return Target{ + Name: "Octopus gRPC endpoint", + Address: address, + Remediation: purpose + " A load balancer, proxy, or firewall that forwards only HTTPS is the usual cause; " + + "make sure the gRPC port is forwarded too.", + } +} + type PreflightRequest struct { Namespace string Image string Targets []Target + // Warnings is where a failure to clean up the check pod is reported; the + // checks themselves come back as values. Nil discards it. + Warnings io.Writer } // StaticChecks need no cluster access, and catch the most common local-cluster @@ -114,7 +137,7 @@ func (c *Cluster) RunPreflight(ctx context.Context, req PreflightRequest) ([]Che return nil, err } // Also on cancellation: a stray check pod left behind is our mess. - defer c.deletePreflightPod(pod.Namespace, pod.Name) + defer c.deletePreflightPod(req.Warnings, pod.Namespace, pod.Name) if err := c.waitForPreflightPod(ctx, pod.Namespace, pod.Name); err != nil { return skippedChecks(req.Targets, err), nil @@ -222,7 +245,7 @@ func (c *Cluster) preflightLogs(ctx context.Context, namespace, name string) (st return string(body), nil } -func (c *Cluster) deletePreflightPod(namespace, name string) { +func (c *Cluster) deletePreflightPod(warnings io.Writer, namespace, name string) { // A fresh context: the caller's may already be cancelled, and the pod still // has to go. ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second) @@ -231,8 +254,8 @@ func (c *Cluster) deletePreflightPod(namespace, name string) { grace := int64(0) err := c.Clientset.CoreV1().Pods(namespace). Delete(ctx, name, metav1.DeleteOptions{GracePeriodSeconds: &grace}) - if err != nil && !apierrors.IsNotFound(err) { - fmt.Printf("warning: could not delete the connectivity check pod %s/%s: %v\n", namespace, name, err) + if err != nil && !apierrors.IsNotFound(err) && warnings != nil { + fmt.Fprintf(warnings, "warning: could not delete the connectivity check pod %s/%s: %v\n", namespace, name, err) } } diff --git a/pkg/question/ask.go b/pkg/question/ask.go index c1e38c0d..091d5b29 100644 --- a/pkg/question/ask.go +++ b/pkg/question/ask.go @@ -3,6 +3,7 @@ package question import ( "github.com/AlecAivazis/survey/v2" cliErrors "github.com/OctopusDeploy/cli/pkg/errors" + "github.com/OctopusDeploy/cli/pkg/surveyext" ) type Asker func(p survey.Prompt, response interface{}, opts ...survey.AskOpt) error @@ -22,6 +23,11 @@ type askWrapper struct { } func NewAskProvider(asker Asker) AskProvider { + if asker != nil { + // Applied here rather than at each composition root, so a provider + // without the escape-sequence recovery cannot be built by accident. + asker = surveyext.Resilient(asker) + } return &askWrapper{ asker: asker, } diff --git a/pkg/surveyext/asker.go b/pkg/surveyext/asker.go index 13236583..4037c1ea 100644 --- a/pkg/surveyext/asker.go +++ b/pkg/surveyext/asker.go @@ -14,18 +14,26 @@ const maxTerminalRetries = 3 // prompt for any escape sequence outside the handful it understands, which on // its own ends the whole command and discards every answer given so far. func AskOne(p survey.Prompt, response any, opts ...survey.AskOpt) error { - opts = append([]survey.AskOpt{withTranslatedStdio()}, opts...) + return Resilient(survey.AskOne)(p, response, opts...) +} - var err error - for attempt := 0; attempt <= maxTerminalRetries; attempt++ { - err = survey.AskOne(p, response, opts...) - if !isUnparsedKeyError(err) { - return err - } +// Resilient gives any asker the same recovery, so a provider built from a +// different asker cannot end up without it. +func Resilient(ask func(survey.Prompt, any, ...survey.AskOpt) error) func(survey.Prompt, any, ...survey.AskOpt) error { + return func(p survey.Prompt, response any, opts ...survey.AskOpt) error { + opts = append([]survey.AskOpt{withTranslatedStdio()}, opts...) - fmt.Fprintf(os.Stderr, "\nThat key isn't supported here. Please try again.\n") + var err error + for attempt := 0; attempt <= maxTerminalRetries; attempt++ { + err = ask(p, response, opts...) + if !isUnparsedKeyError(err) { + return err + } + + fmt.Fprintf(os.Stderr, "\nThat key isn't supported here. Please try again.\n") + } + return err } - return err } func withTranslatedStdio() survey.AskOpt { diff --git a/pkg/util/jwt.go b/pkg/util/jwt.go new file mode 100644 index 00000000..34ecf1bb --- /dev/null +++ b/pkg/util/jwt.go @@ -0,0 +1,33 @@ +package util + +import ( + "encoding/base64" + "encoding/json" + "errors" + "fmt" + "strings" +) + +// ErrNotAJWT reports a token that does not have a JWT's shape at all, as +// opposed to one whose payload did not unmarshal into the caller's claims. +var ErrNotAJWT = errors.New("this does not look like a JWT") + +// DecodeJWTClaims reads a JWT's payload without verifying its signature, for +// callers that only need to inspect a claim; verifying stays with the token's +// issuer. +func DecodeJWTClaims(token string, into any) error { + parts := strings.Split(strings.TrimSpace(token), ".") + if len(parts) != 3 { + return ErrNotAJWT + } + + payload, err := base64.RawURLEncoding.DecodeString(strings.TrimRight(parts[1], "=")) + if err != nil { + return ErrNotAJWT + } + + if err := json.Unmarshal(payload, into); err != nil { + return fmt.Errorf("could not read the token's claims: %w", err) + } + return nil +} diff --git a/pkg/util/util.go b/pkg/util/util.go index 5a6c76c1..2c14b787 100644 --- a/pkg/util/util.go +++ b/pkg/util/util.go @@ -306,3 +306,12 @@ func GenerateWebURL(host, spaceID, path string) string { path = strings.TrimPrefix(path, "/") return fmt.Sprintf("%s/app#/%s/%s", host, spaceID, path) } + +// Pluralise returns the form matching n. The caller supplies both words, which +// covers the irregular plurals a suffix rule would get wrong. +func Pluralise(singular, plural string, n int) string { + if n == 1 { + return singular + } + return plural +} From 430360cf83260ecafa428fc66081dc89fd340e8d Mon Sep 17 00:00:00 2001 From: Liam Mackie Date: Thu, 3 Sep 2026 16:09:41 +1000 Subject: [PATCH 7/7] unify --- pkg/cmd/kubernetes/agent/install/command.go | 150 ++++ .../kubernetes/agent/install/descriptions.go | 58 ++ pkg/cmd/kubernetes/agent/install/discover.go | 73 ++ pkg/cmd/kubernetes/agent/install/ha_test.go | 8 +- pkg/cmd/kubernetes/agent/install/install.go | 653 +----------------- .../kubernetes/agent/install/install_test.go | 22 +- pkg/cmd/kubernetes/agent/install/prompt.go | 10 +- pkg/cmd/kubernetes/agent/install/resolve.go | 405 +++++++++++ pkg/cmd/kubernetes/agent/install/review.go | 4 +- .../kubernetes/agent/install/review_test.go | 8 +- pkg/cmd/kubernetes/gateway/install/install.go | 4 +- pkg/cmd/kubernetes/gateway/install/prompt.go | 9 +- pkg/cmd/kubernetes/gateway/install/review.go | 4 +- pkg/cmd/kubernetes/install/install.go | 5 +- .../permissionscontroller/install/install.go | 4 +- pkg/kubernetes/cluster.go | 382 ---------- pkg/kubernetes/rbac.go | 225 ++++++ pkg/kubernetes/secrets.go | 105 +++ pkg/kubernetes/storage.go | 82 +++ 19 files changed, 1142 insertions(+), 1069 deletions(-) create mode 100644 pkg/cmd/kubernetes/agent/install/command.go create mode 100644 pkg/cmd/kubernetes/agent/install/descriptions.go create mode 100644 pkg/cmd/kubernetes/agent/install/discover.go create mode 100644 pkg/cmd/kubernetes/agent/install/resolve.go create mode 100644 pkg/kubernetes/rbac.go create mode 100644 pkg/kubernetes/secrets.go create mode 100644 pkg/kubernetes/storage.go diff --git a/pkg/cmd/kubernetes/agent/install/command.go b/pkg/cmd/kubernetes/agent/install/command.go new file mode 100644 index 00000000..15d695a7 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/command.go @@ -0,0 +1,150 @@ +package install + +import ( + "fmt" + + "github.com/OctopusDeploy/cli/pkg/cmd" + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" + sharedTarget "github.com/OctopusDeploy/cli/pkg/cmd/target/shared" + sharedWorker "github.com/OctopusDeploy/cli/pkg/cmd/worker/shared" + "github.com/OctopusDeploy/cli/pkg/factory" + agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/machinescommon" + "github.com/OctopusDeploy/cli/pkg/util/flag" + "github.com/spf13/cobra" +) + +const ( + FlagName = "name" + FlagServerCommsAddress = "server-comms-address" + FlagServerCertificate = "server-certificate" + FlagDefaultNamespace = "default-namespace" + FlagStorageClass = "storage-class" + FlagReadWriteMany = "read-write-many" + FlagAcceptEula = "accept-eula" + FlagInlineSecrets = "inline-secrets" + FlagRestrictScriptPods = "restrict-script-pod-permissions" + FlagScriptPodRole = "script-pod-role" + FlagKubernetesMonitor = "kubernetes-monitor" +) + +// eulaURL is shown rather than assumed: the chart will not install without +// acceptEula, and nobody should be accepting an agreement they were not offered. +const eulaURL = "https://octopus.com/company/legal" + +type InstallFlags struct { + Name *flag.Flag[string] + ServerCommsAddresses *flag.Flag[[]string] + ServerCertificate *flag.Flag[string] + DefaultNamespace *flag.Flag[string] + StorageClass *flag.Flag[string] + ReadWriteMany *flag.Flag[bool] + AcceptEula *flag.Flag[bool] + InlineSecrets *flag.Flag[bool] + RestrictScriptPods *flag.Flag[bool] + ScriptPodRoles *flag.Flag[[]string] + KubernetesMonitor *flag.Flag[bool] + + *sharedTarget.CreateTargetEnvironmentFlags + *sharedTarget.CreateTargetRoleFlags + *sharedTarget.CreateTargetTenantFlags + *machinescommon.CreateTargetMachinePolicyFlags + *sharedWorker.WorkerPoolFlags + *shared.CommonFlags +} + +func NewInstallFlags() *InstallFlags { + return &InstallFlags{ + Name: flag.New[string](FlagName, false), + ServerCommsAddresses: flag.New[[]string](FlagServerCommsAddress, false), + ServerCertificate: flag.New[string](FlagServerCertificate, false), + DefaultNamespace: flag.New[string](FlagDefaultNamespace, false), + StorageClass: flag.New[string](FlagStorageClass, false), + ReadWriteMany: flag.New[bool](FlagReadWriteMany, false), + AcceptEula: flag.New[bool](FlagAcceptEula, false), + InlineSecrets: flag.New[bool](FlagInlineSecrets, false), + RestrictScriptPods: flag.New[bool](FlagRestrictScriptPods, false), + ScriptPodRoles: flag.New[[]string](FlagScriptPodRole, false), + KubernetesMonitor: flag.New[bool](FlagKubernetesMonitor, false), + + CreateTargetEnvironmentFlags: sharedTarget.NewCreateTargetEnvironmentFlags(), + CreateTargetRoleFlags: sharedTarget.NewCreateTargetRoleFlags(), + CreateTargetTenantFlags: sharedTarget.NewCreateTargetTenantFlags(), + CreateTargetMachinePolicyFlags: machinescommon.NewCreateTargetMachinePolicyFlags(), + WorkerPoolFlags: sharedWorker.NewWorkerPoolFlags(), + CommonFlags: shared.NewCommonFlags(), + } +} +func NewCmdInstall(f factory.Factory) *cobra.Command { + return newCmdInstall(f, agentK8s.ModeDeploymentTarget) +} + +func NewCmdWorkerInstall(f factory.Factory) *cobra.Command { + return newCmdInstall(f, agentK8s.ModeWorker) +} + +func newCmdInstall(f factory.Factory, mode agentK8s.Mode) *cobra.Command { + installFlags := NewInstallFlags() + + command := &cobra.Command{ + Use: "install", + Short: shortDescription(mode), + Long: longDescription(mode), + Example: examples(mode), + RunE: func(c *cobra.Command, _ []string) error { + opts := NewInstallOptions(installFlags, cmd.NewDependencies(f, c), mode) + opts.AccessModeChosen = c.Flags().Changed(FlagReadWriteMany) + return installRun(c.Context(), opts) + }, + } + + flags := command.Flags() + flags.SortFlags = false + flags.StringVarP(&installFlags.Name.Value, FlagName, "n", "", fmt.Sprintf( + "Name for the %s in Octopus. The namespace and Helm release name are derived from it.", mode)) + registerModeFlags(command, installFlags, mode) + flags.StringVar(&installFlags.MachinePolicy.Value, machinescommon.FlagMachinePolicy, "", fmt.Sprintf( + "Machine policy the %s is registered with. Uses the default machine policy if not set.", mode)) + flags.StringArrayVar(&installFlags.ServerCommsAddresses.Value, FlagServerCommsAddress, nil, + "Polling address of your Octopus Server. Derived from the configured server URL if not set. For a High Availability cluster, repeat for each node - the agent polls every node, and each needs its own address.") + flags.StringVar(&installFlags.ServerCertificate.Value, FlagServerCertificate, "", "Base64-encoded PEM certificate to trust when Octopus is not served by a publicly trusted certificate.") + flags.StringVar(&installFlags.StorageClass.Value, FlagStorageClass, "", "Storage class for the agent's volume. Uses the cluster's default storage class if not set.") + flags.BoolVar(&installFlags.ReadWriteMany.Value, FlagReadWriteMany, false, "Request a ReadWriteMany volume, so script pods can run on any node. Read from the storage class if not set.") + flags.BoolVar(&installFlags.AcceptEula.Value, FlagAcceptEula, false, "Accept the Octopus Customer Agreement ("+eulaURL+"). Required to install.") + flags.BoolVar(&installFlags.InlineSecrets.Value, FlagInlineSecrets, false, "Put the registration credential directly in the Helm values instead of in a Kubernetes Secret.") + flags.BoolVar(&installFlags.RestrictScriptPods.Value, FlagRestrictScriptPods, false, "Give script pods no permissions of their own, leaving every deployment to the Octopus permissions controller.") + flags.StringArrayVar(&installFlags.ScriptPodRoles.Value, FlagScriptPodRole, nil, + "Give script pods the rules of this role, copied in at install time. Name a cluster role, or a role in a namespace as namespace/name. Repeat for more than one.") + shared.RegisterCommonFlags(command, installFlags.CommonFlags, shared.DerivedFromNameDetails()) + + return command +} + +// registerModeFlags keeps a worker from advertising deployment target settings +// it cannot use, and the other way round. +func registerModeFlags(command *cobra.Command, installFlags *InstallFlags, mode agentK8s.Mode) { + if mode == agentK8s.ModeWorker { + sharedWorker.RegisterCreateWorkerWorkerPoolFlags(command, installFlags.WorkerPoolFlags) + return + } + + sharedTarget.RegisterCreateTargetEnvironmentFlags(command, installFlags.CreateTargetEnvironmentFlags) + registerTargetTagFlags(command, installFlags) + sharedTarget.RegisterCreateTargetTenantFlags(command, installFlags.CreateTargetTenantFlags) + command.Flags().StringVar(&installFlags.DefaultNamespace.Value, FlagDefaultNamespace, "", + "Namespace deployments go to when the step or the manifest does not name one.") + // The monitor watches deployed objects, which only a deployment target has. + command.Flags().BoolVar(&installFlags.KubernetesMonitor.Value, FlagKubernetesMonitor, false, + "Also install the Kubernetes monitor, which streams live status of the deployed objects back to Octopus. Needs an Octopus Server that supports it.") +} + +// registerTargetTagFlags describes these as target tags rather than roles. +// Octopus renamed them, and a tag that does not exist yet is a normal thing to +// give an agent: Octopus creates it when the agent registers. +func registerTargetTagFlags(command *cobra.Command, installFlags *InstallFlags) { + flags := command.Flags() + flags.StringSliceVar(&installFlags.Roles.Value, sharedTarget.FlagRole, nil, + "Target tag for the deployment target. Repeat for more than one. A tag that does not exist yet is created when the agent registers.") + flags.StringSliceVar(&installFlags.Tags.Value, sharedTarget.FlagTag, nil, + "Target tag in canonical TagSetName/TagName form, checked against the tag sets. Repeat for more than one.") +} diff --git a/pkg/cmd/kubernetes/agent/install/descriptions.go b/pkg/cmd/kubernetes/agent/install/descriptions.go new file mode 100644 index 00000000..6cbc55b9 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/descriptions.go @@ -0,0 +1,58 @@ +package install + +import ( + "github.com/MakeNowJust/heredoc/v2" + "github.com/OctopusDeploy/cli/pkg/constants" + agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" +) + +func shortDescription(mode agentK8s.Mode) string { + if mode == agentK8s.ModeWorker { + return "Install the Octopus Kubernetes agent as a worker" + } + return "Install the Octopus Kubernetes agent as a deployment target" +} + +func longDescription(mode agentK8s.Mode) string { + if mode == agentK8s.ModeWorker { + return heredoc.Doc(` + Install the Octopus Kubernetes agent into a Kubernetes cluster as a worker. + + The worker runs Octopus steps in the cluster, one pod per task, and releases the + compute again when the task finishes. It polls Octopus for work, so the cluster does + not need to be reachable from outside. + + Run without arguments to be prompted. Anything that can be read from the cluster or + from Octopus is filled in for you: the Octopus server, space and polling address, the + cluster's storage classes, and the install namespace. + `) + } + + return heredoc.Doc(` + Install the Octopus Kubernetes agent into a Kubernetes cluster as a deployment target. + + The agent runs Kubernetes steps from inside the cluster, so Octopus does not need + cluster credentials and the cluster does not need to be reachable from outside - the + agent polls Octopus for work. + + Run without arguments to be prompted. Anything that can be read from the cluster or + from Octopus is filled in for you: the Octopus server, space and polling address, the + cluster's storage classes, and the install namespace. + `) +} + +func examples(mode agentK8s.Mode) string { + if mode == agentK8s.ModeWorker { + return heredoc.Docf(` + $ %[1]s kubernetes worker install + $ %[1]s kubernetes worker install --name cluster-worker --worker-pool "Kubernetes Pool" --dry-run + $ %[1]s kubernetes worker install --name cluster-worker --worker-pool "Kubernetes Pool" --accept-eula --no-prompt + `, constants.ExecutableName) + } + + return heredoc.Docf(` + $ %[1]s kubernetes agent install + $ %[1]s kubernetes agent install --name production --environment Production --role k8s --dry-run + $ %[1]s kubernetes agent install --name production --environment Production --role k8s --accept-eula --no-prompt + `, constants.ExecutableName) +} diff --git a/pkg/cmd/kubernetes/agent/install/discover.go b/pkg/cmd/kubernetes/agent/install/discover.go new file mode 100644 index 00000000..facefe33 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/discover.go @@ -0,0 +1,73 @@ +package install + +import ( + "context" + "errors" + "fmt" + + "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/kubernetes/permissionscontroller" +) + +func (opts *InstallOptions) Discover(ctx context.Context) error { + connector := opts.connector() + session, err := connector.Connect(ctx) + if err != nil { + return err + } + + opts.Cluster = session.Cluster + opts.Runner = session.Runner + opts.KubeContextInfo = session.Context + return nil +} + +func (opts *InstallOptions) connector() *shared.Connector { + return &shared.Connector{ + Dependencies: opts.Dependencies, + CommonFlags: opts.CommonFlags, + SelectMessage: fmt.Sprintf("Which cluster should the %s be installed into?", opts.installedThing()), + Discover: opts.discoverCluster, + Unrecoverable: func(cause error, kubeConfig *octoK8s.KubeConfig) bool { + // Nothing to retry, and no other cluster to move to. + return errors.As(cause, &agentK8s.ErrUnsupportedNodes{}) && len(kubeConfig.Contexts()) == 1 + }, + } +} + +// discoverCluster reads everything the questions and the review screen are +// filled in from, so a credential problem anywhere in it can be fixed and +// retried as one unit. +func (opts *InstallOptions) discoverCluster(ctx context.Context, session *shared.Session) error { + architectures, err := session.Cluster.NodeArchitectures(ctx) + if err != nil { + return err + } + opts.NodeArchitectures = architectures + + if !agentK8s.RunnableArchitecture(architectures) { + return agentK8s.ErrUnsupportedNodes{Architectures: architectures} + } + + classes, err := session.Cluster.StorageClasses(ctx) + if err != nil { + return err + } + opts.StorageClasses = classes + + installations, err := agentK8s.Installations(session.Runner) + if err != nil { + return err + } + opts.Installations = installations + + present, err := permissionscontroller.Present(session.Cluster) + if err != nil { + return err + } + opts.PermissionsController = present + + return nil +} diff --git a/pkg/cmd/kubernetes/agent/install/ha_test.go b/pkg/cmd/kubernetes/agent/install/ha_test.go index 50ad1dd4..a66b135f 100644 --- a/pkg/cmd/kubernetes/agent/install/ha_test.go +++ b/pkg/cmd/kubernetes/agent/install/ha_test.go @@ -34,7 +34,7 @@ func TestResolveWithoutPrompting_HANeedsAnAddressPerNode(t *testing.T) { opts.Host = selfHostedHost opts.ServerNodesCallback = func() ([]octopusservernodes.Node, error) { return haNodes(), nil } - err := opts.ResolveWithoutPrompting() + err := opts.ResolveWithoutPrompting(context.Background()) assert.ErrorContains(t, err, "High Availability") assert.ErrorContains(t, err, "OCTOPUS-01, OCTOPUS-02") assert.ErrorContains(t, err, install.FlagServerCommsAddress) @@ -51,7 +51,7 @@ func TestResolveWithoutPrompting_HAAcceptsTheAddressesGiven(t *testing.T) { opts.Host = selfHostedHost opts.ServerNodesCallback = func() ([]octopusservernodes.Node, error) { return haNodes(), nil } - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) values, err := opts.BuildValues() require.NoError(t, err) @@ -109,7 +109,7 @@ func TestResolveWithoutPrompting_CloudNeverReadsTheTopology(t *testing.T) { return nil, nil } - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) assert.Equal(t, []string{pollingAddress}, flags.ServerCommsAddresses.Value) } @@ -125,7 +125,7 @@ func TestResolveWithoutPrompting_UnreadableTopologyFallsBackToOneAddress(t *test opts.Host = selfHostedHost opts.ServerNodesCallback = func() ([]octopusservernodes.Node, error) { return nil, assert.AnError } - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) assert.Equal(t, []string{"https://octopus.internal:10943"}, flags.ServerCommsAddresses.Value) assert.Contains(t, opts.Out.(*bytes.Buffer).String(), "Could not read the Octopus Server's nodes") } diff --git a/pkg/cmd/kubernetes/agent/install/install.go b/pkg/cmd/kubernetes/agent/install/install.go index 745f0c51..63dd1cb8 100644 --- a/pkg/cmd/kubernetes/agent/install/install.go +++ b/pkg/cmd/kubernetes/agent/install/install.go @@ -6,39 +6,16 @@ import ( "fmt" "strings" - "github.com/MakeNowJust/heredoc/v2" "github.com/OctopusDeploy/cli/pkg/accesstokens" "github.com/OctopusDeploy/cli/pkg/cmd" - "github.com/OctopusDeploy/cli/pkg/cmd/kubernetes/shared" sharedTarget "github.com/OctopusDeploy/cli/pkg/cmd/target/shared" sharedWorker "github.com/OctopusDeploy/cli/pkg/cmd/worker/shared" - "github.com/OctopusDeploy/cli/pkg/constants" - "github.com/OctopusDeploy/cli/pkg/factory" octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" "github.com/OctopusDeploy/cli/pkg/kubernetes/helm" - "github.com/OctopusDeploy/cli/pkg/kubernetes/permissionscontroller" "github.com/OctopusDeploy/cli/pkg/machinescommon" "github.com/OctopusDeploy/cli/pkg/octopusservernodes" "github.com/OctopusDeploy/cli/pkg/output" - "github.com/OctopusDeploy/cli/pkg/util/flag" - "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/machines" - "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/workers" - "github.com/spf13/cobra" -) - -const ( - FlagName = "name" - FlagServerCommsAddress = "server-comms-address" - FlagServerCertificate = "server-certificate" - FlagDefaultNamespace = "default-namespace" - FlagStorageClass = "storage-class" - FlagReadWriteMany = "read-write-many" - FlagAcceptEula = "accept-eula" - FlagInlineSecrets = "inline-secrets" - FlagRestrictScriptPods = "restrict-script-pod-permissions" - FlagScriptPodRole = "script-pod-role" - FlagKubernetesMonitor = "kubernetes-monitor" ) // The agent registers itself, so an Octopus credential has to reach the @@ -50,54 +27,6 @@ const ( tokenSecretKey = "bearer-token" ) -// eulaURL is shown rather than assumed: the chart will not install without -// acceptEula, and nobody should be accepting an agreement they were not offered. -const eulaURL = "https://octopus.com/company/legal" - -type InstallFlags struct { - Name *flag.Flag[string] - ServerCommsAddresses *flag.Flag[[]string] - ServerCertificate *flag.Flag[string] - DefaultNamespace *flag.Flag[string] - StorageClass *flag.Flag[string] - ReadWriteMany *flag.Flag[bool] - AcceptEula *flag.Flag[bool] - InlineSecrets *flag.Flag[bool] - RestrictScriptPods *flag.Flag[bool] - ScriptPodRoles *flag.Flag[[]string] - KubernetesMonitor *flag.Flag[bool] - - *sharedTarget.CreateTargetEnvironmentFlags - *sharedTarget.CreateTargetRoleFlags - *sharedTarget.CreateTargetTenantFlags - *machinescommon.CreateTargetMachinePolicyFlags - *sharedWorker.WorkerPoolFlags - *shared.CommonFlags -} - -func NewInstallFlags() *InstallFlags { - return &InstallFlags{ - Name: flag.New[string](FlagName, false), - ServerCommsAddresses: flag.New[[]string](FlagServerCommsAddress, false), - ServerCertificate: flag.New[string](FlagServerCertificate, false), - DefaultNamespace: flag.New[string](FlagDefaultNamespace, false), - StorageClass: flag.New[string](FlagStorageClass, false), - ReadWriteMany: flag.New[bool](FlagReadWriteMany, false), - AcceptEula: flag.New[bool](FlagAcceptEula, false), - InlineSecrets: flag.New[bool](FlagInlineSecrets, false), - RestrictScriptPods: flag.New[bool](FlagRestrictScriptPods, false), - ScriptPodRoles: flag.New[[]string](FlagScriptPodRole, false), - KubernetesMonitor: flag.New[bool](FlagKubernetesMonitor, false), - - CreateTargetEnvironmentFlags: sharedTarget.NewCreateTargetEnvironmentFlags(), - CreateTargetRoleFlags: sharedTarget.NewCreateTargetRoleFlags(), - CreateTargetTenantFlags: sharedTarget.NewCreateTargetTenantFlags(), - CreateTargetMachinePolicyFlags: machinescommon.NewCreateTargetMachinePolicyFlags(), - WorkerPoolFlags: sharedWorker.NewWorkerPoolFlags(), - CommonFlags: shared.NewCommonFlags(), - } -} - type InstallOptions struct { *InstallFlags *cmd.Dependencies @@ -205,80 +134,6 @@ func NewInstallOptions(installFlags *InstallFlags, dependencies *cmd.Dependencie } } -func NewCmdInstall(f factory.Factory) *cobra.Command { - return newCmdInstall(f, agentK8s.ModeDeploymentTarget) -} - -func NewCmdWorkerInstall(f factory.Factory) *cobra.Command { - return newCmdInstall(f, agentK8s.ModeWorker) -} - -func newCmdInstall(f factory.Factory, mode agentK8s.Mode) *cobra.Command { - installFlags := NewInstallFlags() - - command := &cobra.Command{ - Use: "install", - Short: shortDescription(mode), - Long: longDescription(mode), - Example: examples(mode), - RunE: func(c *cobra.Command, _ []string) error { - opts := NewInstallOptions(installFlags, cmd.NewDependencies(f, c), mode) - opts.AccessModeChosen = c.Flags().Changed(FlagReadWriteMany) - return installRun(c.Context(), opts) - }, - } - - flags := command.Flags() - flags.SortFlags = false - flags.StringVarP(&installFlags.Name.Value, FlagName, "n", "", fmt.Sprintf( - "Name for the %s in Octopus. The namespace and Helm release name are derived from it.", mode)) - registerModeFlags(command, installFlags, mode) - flags.StringVar(&installFlags.MachinePolicy.Value, machinescommon.FlagMachinePolicy, "", fmt.Sprintf( - "Machine policy the %s is registered with. Uses the default machine policy if not set.", mode)) - flags.StringArrayVar(&installFlags.ServerCommsAddresses.Value, FlagServerCommsAddress, nil, - "Polling address of your Octopus Server. Derived from the configured server URL if not set. For a High Availability cluster, repeat for each node - the agent polls every node, and each needs its own address.") - flags.StringVar(&installFlags.ServerCertificate.Value, FlagServerCertificate, "", "Base64-encoded PEM certificate to trust when Octopus is not served by a publicly trusted certificate.") - flags.StringVar(&installFlags.StorageClass.Value, FlagStorageClass, "", "Storage class for the agent's volume. Uses the cluster's default storage class if not set.") - flags.BoolVar(&installFlags.ReadWriteMany.Value, FlagReadWriteMany, false, "Request a ReadWriteMany volume, so script pods can run on any node. Read from the storage class if not set.") - flags.BoolVar(&installFlags.AcceptEula.Value, FlagAcceptEula, false, "Accept the Octopus Customer Agreement ("+eulaURL+"). Required to install.") - flags.BoolVar(&installFlags.InlineSecrets.Value, FlagInlineSecrets, false, "Put the registration credential directly in the Helm values instead of in a Kubernetes Secret.") - flags.BoolVar(&installFlags.RestrictScriptPods.Value, FlagRestrictScriptPods, false, "Give script pods no permissions of their own, leaving every deployment to the Octopus permissions controller.") - flags.StringArrayVar(&installFlags.ScriptPodRoles.Value, FlagScriptPodRole, nil, - "Give script pods the rules of this role, copied in at install time. Name a cluster role, or a role in a namespace as namespace/name. Repeat for more than one.") - shared.RegisterCommonFlags(command, installFlags.CommonFlags, shared.DerivedFromNameDetails()) - - return command -} - -// registerModeFlags keeps a worker from advertising deployment target settings -// it cannot use, and the other way round. -func registerModeFlags(command *cobra.Command, installFlags *InstallFlags, mode agentK8s.Mode) { - if mode == agentK8s.ModeWorker { - sharedWorker.RegisterCreateWorkerWorkerPoolFlags(command, installFlags.WorkerPoolFlags) - return - } - - sharedTarget.RegisterCreateTargetEnvironmentFlags(command, installFlags.CreateTargetEnvironmentFlags) - registerTargetTagFlags(command, installFlags) - sharedTarget.RegisterCreateTargetTenantFlags(command, installFlags.CreateTargetTenantFlags) - command.Flags().StringVar(&installFlags.DefaultNamespace.Value, FlagDefaultNamespace, "", - "Namespace deployments go to when the step or the manifest does not name one.") - // The monitor watches deployed objects, which only a deployment target has. - command.Flags().BoolVar(&installFlags.KubernetesMonitor.Value, FlagKubernetesMonitor, false, - "Also install the Kubernetes monitor, which streams live status of the deployed objects back to Octopus. Needs an Octopus Server that supports it.") -} - -// registerTargetTagFlags describes these as target tags rather than roles. -// Octopus renamed them, and a tag that does not exist yet is a normal thing to -// give an agent: Octopus creates it when the agent registers. -func registerTargetTagFlags(command *cobra.Command, installFlags *InstallFlags) { - flags := command.Flags() - flags.StringSliceVar(&installFlags.Roles.Value, sharedTarget.FlagRole, nil, - "Target tag for the deployment target. Repeat for more than one. A tag that does not exist yet is created when the agent registers.") - flags.StringSliceVar(&installFlags.Tags.Value, sharedTarget.FlagTag, nil, - "Target tag in canonical TagSetName/TagName form, checked against the tag sets. Repeat for more than one.") -} - func installRun(ctx context.Context, opts *InstallOptions) error { if ctx == nil { ctx = context.Background() @@ -292,7 +147,7 @@ func installRun(ctx context.Context, opts *InstallOptions) error { if err := opts.ValidateForAutomation(); err != nil { return err } - if err := opts.ResolveWithoutPrompting(); err != nil { + if err := opts.ResolveWithoutPrompting(ctx); err != nil { return err } } else { @@ -312,510 +167,12 @@ func installRun(ctx context.Context, opts *InstallOptions) error { // Run installs using an existing set of dependencies. The `kubernetes install` // wizard uses this to hand off after the user picks a component, so the two // entry points share one implementation. -func Run(dependencies *cmd.Dependencies) error { - return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies, agentK8s.ModeDeploymentTarget)) +func Run(ctx context.Context, dependencies *cmd.Dependencies) error { + return installRun(ctx, NewInstallOptions(NewInstallFlags(), dependencies, agentK8s.ModeDeploymentTarget)) } -func RunWorker(dependencies *cmd.Dependencies) error { - return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies, agentK8s.ModeWorker)) -} - -func (opts *InstallOptions) Discover(ctx context.Context) error { - connector := opts.connector() - session, err := connector.Connect(ctx) - if err != nil { - return err - } - - opts.Cluster = session.Cluster - opts.Runner = session.Runner - opts.KubeContextInfo = session.Context - return nil -} - -func (opts *InstallOptions) connector() *shared.Connector { - return &shared.Connector{ - Dependencies: opts.Dependencies, - CommonFlags: opts.CommonFlags, - SelectMessage: fmt.Sprintf("Which cluster should the %s be installed into?", opts.installedThing()), - Discover: opts.discoverCluster, - Unrecoverable: func(cause error, kubeConfig *octoK8s.KubeConfig) bool { - // Nothing to retry, and no other cluster to move to. - return errors.As(cause, &agentK8s.ErrUnsupportedNodes{}) && len(kubeConfig.Contexts()) == 1 - }, - } -} - -// discoverCluster reads everything the questions and the review screen are -// filled in from, so a credential problem anywhere in it can be fixed and -// retried as one unit. -func (opts *InstallOptions) discoverCluster(ctx context.Context, session *shared.Session) error { - architectures, err := session.Cluster.NodeArchitectures(ctx) - if err != nil { - return err - } - opts.NodeArchitectures = architectures - - if !agentK8s.RunnableArchitecture(architectures) { - return agentK8s.ErrUnsupportedNodes{Architectures: architectures} - } - - classes, err := session.Cluster.StorageClasses(ctx) - if err != nil { - return err - } - opts.StorageClasses = classes - - installations, err := agentK8s.Installations(session.Runner) - if err != nil { - return err - } - opts.Installations = installations - - present, err := permissionscontroller.Present(session.Cluster) - if err != nil { - return err - } - opts.PermissionsController = present - - return nil -} - -func (opts *InstallOptions) ValidateForAutomation() error { - var missing []string - if opts.Name.Value == "" { - missing = append(missing, "--"+FlagName) - } - - if opts.Mode == agentK8s.ModeWorker { - if len(opts.WorkerPools.Value) == 0 { - missing = append(missing, "--"+sharedWorker.FlagWorkerPool) - } - } else { - if len(opts.Environments.Value) == 0 { - missing = append(missing, "--"+sharedTarget.FlagEnvironment) - } - if len(opts.Roles.Value) == 0 && len(opts.Tags.Value) == 0 { - missing = append(missing, fmt.Sprintf("--%s or --%s", sharedTarget.FlagRole, sharedTarget.FlagTag)) - } - } - - // A dry run renders manifests without registering anything, so there is no - // agreement being entered into. - if !opts.AcceptEula.Value && !opts.DryRun.Value { - missing = append(missing, "--"+FlagAcceptEula) - } - - if len(missing) > 0 { - return fmt.Errorf("%s must be specified when prompting is disabled", strings.Join(missing, ", ")) - } - return nil -} - -func (opts *InstallOptions) ResolveWithoutPrompting() error { - if err := opts.resolvePollingAddresses(); err != nil { - return err - } - - if err := opts.resolveNames(); err != nil { - return err - } - - if err := opts.validateMachinePolicy(); err != nil { - return err - } - - if err := opts.validateWorkerPools(); err != nil { - return err - } - - if err := opts.resolveScriptPodRoles(context.Background()); err != nil { - return err - } - - opts.deriveAccessMode() - opts.warnAboutAccessMode() - return nil -} - -// validateWorkerPools catches a pool that cannot hold a worker before the agent -// tries to register with it. A dynamic pool is the likely mistake: Octopus runs -// those on its own machines, so a worker cannot join one. -func (opts *InstallOptions) validateWorkerPools() error { - if !opts.isWorker() || len(opts.WorkerPools.Value) == 0 { - return nil - } - - pools, err := opts.GetAllWorkerPoolsCallback() - if err != nil { - return err - } - - known := map[string]bool{} - for _, pool := range pools { - known[strings.ToLower(pool.Name)] = true - known[strings.ToLower(pool.ID)] = true - } - - var unknown []string - for _, given := range opts.WorkerPools.Value { - if !known[strings.ToLower(strings.TrimSpace(given))] { - unknown = append(unknown, given) - } - } - if len(unknown) == 0 { - return nil - } - - return fmt.Errorf("no worker pool named %s in space %s can hold a worker. %s", - strings.Join(unknown, ", "), opts.spaceName(), staticPoolAdvice()) -} - -// staticPoolAdvice is worth spelling out because a space can easily have only -// dynamic pools, which is the default on Octopus Cloud. -func staticPoolAdvice() string { - return fmt.Sprintf("A Kubernetes worker joins a static worker pool; create one with `%s worker-pool static create`", - constants.ExecutableName) -} - -// validateMachinePolicy checks the name before anything is created, so a typo -// surfaces here rather than in a registration that fails inside the cluster. -func (opts *InstallOptions) validateMachinePolicy() error { - if opts.MachinePolicy.Value == "" { - return nil - } - _, err := machinescommon.FindMachinePolicy(opts.GetAllMachinePoliciesCallback, opts.MachinePolicy.Value) - return err -} - -// resolveScriptPodRoles copies the rules out of the named roles. They are -// copied rather than referenced because the chart takes rules, so this is a -// snapshot: the agent does not follow the roles afterwards. -func (opts *InstallOptions) resolveScriptPodRoles(ctx context.Context) error { - if len(opts.ScriptPodRoles.Value) == 0 { - return nil - } - if opts.RestrictScriptPods.Value { - return fmt.Errorf("--%s and --%s ask for opposite things; script pods either have no permissions of their own or the ones copied from %s", - FlagRestrictScriptPods, FlagScriptPodRole, strings.Join(opts.ScriptPodRoles.Value, ", ")) - } - - roles := make([]octoK8s.Role, 0, len(opts.ScriptPodRoles.Value)) - for _, reference := range opts.ScriptPodRoles.Value { - role, err := opts.Cluster.FindRole(ctx, reference) - if err != nil { - return err - } - roles = append(roles, role) - } - - opts.ScriptPodRules = octoK8s.MergePolicyRules(roles) - if len(opts.ScriptPodRules) == 0 { - return fmt.Errorf("%s grants nothing, so copying it would leave script pods unable to deploy. "+ - "Use --%s if that is what you want", strings.Join(opts.ScriptPodRoles.Value, ", "), FlagRestrictScriptPods) - } - return nil -} - -// resolvedStorageClass is where the volume actually comes from: the class that -// was chosen, or the cluster's default when none was. -func (opts *InstallOptions) resolvedStorageClass() (octoK8s.StorageClass, bool) { - for _, class := range opts.StorageClasses { - if opts.StorageClass.Value == "" { - if class.IsDefault { - return class, true - } - continue - } - if class.Name == opts.StorageClass.Value { - return class, true - } - } - return octoK8s.StorageClass{}, false -} - -// deriveAccessMode reads the access mode off the storage class rather than -// asking for it. Whether script pods can spread across nodes follows from -// whether the class serves a shared filesystem, which is not a separate -// decision anybody should have to make. -func (opts *InstallOptions) deriveAccessMode() { - if opts.AccessModeChosen { - return - } - class, found := opts.resolvedStorageClass() - opts.ReadWriteMany.Value = found && class.SupportsReadWriteMany() -} - -// warnAboutAccessMode is a warning rather than a refusal: the provisioner is -// only a signal, and a class this does not recognise may well serve a shared -// filesystem. -func (opts *InstallOptions) warnAboutAccessMode() { - if !opts.ReadWriteMany.Value || !opts.AccessModeChosen { - return - } - - class, found := opts.resolvedStorageClass() - if found && class.SupportsReadWriteMany() { - return - } - - fmt.Fprintf(opts.Out, "%s --%s asks for a ReadWriteMany volume from %s, which is not known to serve one. "+ - "If it cannot, the volume never binds and the agent stays pending.\n", - output.Yellow("!"), FlagReadWriteMany, storageClassDescription(class, found, opts.StorageClass.Value)) -} - -func storageClassDescription(class octoK8s.StorageClass, found bool, requested string) string { - switch { - case found && class.Provisioner != "": - return fmt.Sprintf("%s (%s)", class.Name, class.Provisioner) - case requested != "": - return requested - default: - return "the cluster's default storage class" - } -} - -// resolvePollingAddresses fills in the polling address when none was given. -// Octopus Cloud and a single-node server have one derivable address; a High -// Availability cluster does not - each node needs its own address, which only -// the person who set the cluster up knows. -func (opts *InstallOptions) resolvePollingAddresses() error { - if len(opts.ServerCommsAddresses.Value) > 0 { - return nil - } - - if nodes := opts.haNodes(); len(nodes) > 0 { - names := make([]string, 0, len(nodes)) - for _, node := range nodes { - names = append(names, node.Name) - } - return fmt.Errorf("this Octopus Server is a High Availability cluster (nodes %s), and the agent polls every node on its own address; give --%s once per node", - strings.Join(names, ", "), FlagServerCommsAddress) - } - - if derived := octoK8s.DerivePollingURL(opts.Host); derived != "" { - opts.ServerCommsAddresses.Value = []string{derived} - } - return nil -} - -// haNodes is empty unless Octopus is a self-hosted High Availability cluster. -// Octopus Cloud serves every polling connection on one shared address, so its -// nodes are its own business. -func (opts *InstallOptions) haNodes() []octopusservernodes.Node { - if octoK8s.IsOctopusCloud(opts.Host) { - return nil - } - nodes := opts.taskNodes() - if len(nodes) <= 1 { - return nil - } - return nodes -} - -// taskNodes degrades to none rather than failing: the topology read is a -// convenience, and a credential that cannot read it can still name the polling -// addresses itself. -func (opts *InstallOptions) taskNodes() []octopusservernodes.Node { - if opts.serverNodesRead || opts.ServerNodesCallback == nil { - return opts.serverNodes - } - opts.serverNodesRead = true - - nodes, err := opts.ServerNodesCallback() - if err != nil { - fmt.Fprintf(opts.Out, "%s Could not read the Octopus Server's nodes to check for High Availability: %v\n", - output.Yellow("!"), err) - return nil - } - opts.serverNodes = nodes - return nodes -} - -func (opts *InstallOptions) resolveNames() error { - namespace, release, err := octoK8s.ResolveNames(opts.Namespace.Value, opts.ReleaseName.Value, opts.namespacePrefix(), opts.Name.Value) - if err != nil { - return err - } - opts.TargetNamespace, opts.TargetRelease = namespace, release - return nil -} - -// namespacePrefix matches what the Octopus portal generates for each mode, so -// a CLI install and a portal install of the same name land in the same place. -func (opts *InstallOptions) namespacePrefix() string { - if opts.isWorker() { - return octoK8s.WorkerNamespacePrefix - } - return octoK8s.AgentNamespacePrefix -} - -func (opts *InstallOptions) spaceName() string { - if name := opts.GetSpaceNameOrEmpty(); name != "" { - return name - } - return "Default" -} - -func (opts *InstallOptions) spaceID() string { - if opts.Space == nil { - return "" - } - return opts.Space.ID -} - -func (opts *InstallOptions) isWorker() bool { - return opts.Mode == agentK8s.ModeWorker -} - -// installedThing names what goes into the cluster, which is one chart either -// way. Mode names what Octopus ends up with, which is what a name or a -// registration belongs to. -func (opts *InstallOptions) installedThing() string { - if opts.isWorker() { - return "Kubernetes worker" - } - return "Kubernetes agent" -} - -// existingRelease is the agent this install would replace, which is worth -// saying: a Helm release name is derived from the agent name, so reusing a name -// upgrades an agent rather than adding one. -func (opts *InstallOptions) existingRelease() (agentK8s.Installation, bool) { - for _, installation := range opts.Installations { - if installation.Release.Name == opts.TargetRelease && installation.Release.Namespace == opts.TargetNamespace { - return installation, true - } - } - return agentK8s.Installation{}, false -} - -// registered answers whether Octopus already has an agent of this name. -// Registration matches on name, so an existing one is taken over rather than -// added to. -func registered(dependencies *cmd.Dependencies, mode agentK8s.Mode, name string) (bool, error) { - if dependencies.Client == nil || strings.TrimSpace(name) == "" { - return false, nil - } - spaceID := "" - if dependencies.Space != nil { - spaceID = dependencies.Space.ID - } - - if mode == agentK8s.ModeWorker { - page, err := workers.Get(dependencies.Client, spaceID, machines.WorkersQuery{PartialName: name}) - if err != nil { - return false, err - } - for _, worker := range page.Items { - if strings.EqualFold(worker.Name, name) { - return true, nil - } - } - return false, nil - } - - page, err := machines.Get(dependencies.Client, spaceID, machines.MachinesQuery{PartialName: name}) - if err != nil { - return false, err - } - for _, target := range page.Items { - if strings.EqualFold(target.Name, name) { - return true, nil - } - } - return false, nil -} - -// knownTargetTags is read once and kept, so the review can tell a tag the space -// already had from one that will be created. -func (opts *InstallOptions) knownTargetTags() ([]string, error) { - if opts.KnownTargetTags != nil || opts.TargetTagsCallback == nil { - return opts.KnownTargetTags, nil - } - - tags, err := opts.TargetTagsCallback() - if err != nil { - return nil, err - } - if tags == nil { - tags = []string{} - } - opts.KnownTargetTags = tags - return tags, nil -} - -// newTargetTags are the chosen tags Octopus has never seen, which it creates -// when the agent registers. Tags that came from a flag are taken at face value: -// nothing was read, so nothing can be called new. -func (opts *InstallOptions) newTargetTags() []string { - if opts.KnownTargetTags == nil { - return nil - } - - known := map[string]bool{} - for _, tag := range opts.KnownTargetTags { - known[tag] = true - } - - var created []string - for _, tag := range opts.Roles.Value { - if !known[tag] { - created = append(created, tag) - } - } - return created -} - -func shortDescription(mode agentK8s.Mode) string { - if mode == agentK8s.ModeWorker { - return "Install the Octopus Kubernetes agent as a worker" - } - return "Install the Octopus Kubernetes agent as a deployment target" -} - -func longDescription(mode agentK8s.Mode) string { - if mode == agentK8s.ModeWorker { - return heredoc.Doc(` - Install the Octopus Kubernetes agent into a Kubernetes cluster as a worker. - - The worker runs Octopus steps in the cluster, one pod per task, and releases the - compute again when the task finishes. It polls Octopus for work, so the cluster does - not need to be reachable from outside. - - Run without arguments to be prompted. Anything that can be read from the cluster or - from Octopus is filled in for you: the Octopus server, space and polling address, the - cluster's storage classes, and the install namespace. - `) - } - - return heredoc.Doc(` - Install the Octopus Kubernetes agent into a Kubernetes cluster as a deployment target. - - The agent runs Kubernetes steps from inside the cluster, so Octopus does not need - cluster credentials and the cluster does not need to be reachable from outside - the - agent polls Octopus for work. - - Run without arguments to be prompted. Anything that can be read from the cluster or - from Octopus is filled in for you: the Octopus server, space and polling address, the - cluster's storage classes, and the install namespace. - `) -} - -func examples(mode agentK8s.Mode) string { - if mode == agentK8s.ModeWorker { - return heredoc.Docf(` - $ %[1]s kubernetes worker install - $ %[1]s kubernetes worker install --name cluster-worker --worker-pool "Kubernetes Pool" --dry-run - $ %[1]s kubernetes worker install --name cluster-worker --worker-pool "Kubernetes Pool" --accept-eula --no-prompt - `, constants.ExecutableName) - } - - return heredoc.Docf(` - $ %[1]s kubernetes agent install - $ %[1]s kubernetes agent install --name production --environment Production --role k8s --dry-run - $ %[1]s kubernetes agent install --name production --environment Production --role k8s --accept-eula --no-prompt - `, constants.ExecutableName) +func RunWorker(ctx context.Context, dependencies *cmd.Dependencies) error { + return installRun(ctx, NewInstallOptions(NewInstallFlags(), dependencies, agentK8s.ModeWorker)) } func (opts *InstallOptions) chartRef() helm.ChartRef { diff --git a/pkg/cmd/kubernetes/agent/install/install_test.go b/pkg/cmd/kubernetes/agent/install/install_test.go index 4822e43b..a40c0435 100644 --- a/pkg/cmd/kubernetes/agent/install/install_test.go +++ b/pkg/cmd/kubernetes/agent/install/install_test.go @@ -215,7 +215,7 @@ func TestResolveWithoutPrompting_ReadWriteManyOverridesTheStorageClass(t *testin out := &bytes.Buffer{} opts.Out = out - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) assert.True(t, flags.ReadWriteMany.Value) assert.Contains(t, out.String(), "not known to serve one", "a class that cannot do it is worth a warning") } @@ -232,7 +232,7 @@ func TestResolveWithoutPrompting_ReadWriteManyOnASharedFilesystemIsNotWarnedAbou out := &bytes.Buffer{} opts.Out = out - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) assert.NotContains(t, out.String(), "not known to serve one") } @@ -381,7 +381,7 @@ func TestResolveScriptPodRole_CopiesTheRulesByName(t *testing.T) { flags.ScriptPodRoles.Value = []string{"deployer"} opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) assert.Len(t, opts.ScriptPodRules, 1) } @@ -392,7 +392,7 @@ func TestResolveScriptPodRole_RejectsAnUnknownRole(t *testing.T) { flags.ScriptPodRoles.Value = []string{"does-not-exist"} opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) - assert.ErrorContains(t, opts.ResolveWithoutPrompting(), "does-not-exist") + assert.ErrorContains(t, opts.ResolveWithoutPrompting(context.Background()), "does-not-exist") } // Granting nothing and granting a role's rules are opposite answers to the same @@ -405,7 +405,7 @@ func TestResolveScriptPodRole_RejectsBothWaysAtOnce(t *testing.T) { flags.RestrictScriptPods.Value = true opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) - err := opts.ResolveWithoutPrompting() + err := opts.ResolveWithoutPrompting(context.Background()) require.Error(t, err) assert.Contains(t, err.Error(), install.FlagRestrictScriptPods) assert.Contains(t, err.Error(), install.FlagScriptPodRole) @@ -461,7 +461,7 @@ func completedTargetOptions(t *testing.T) *install.InstallOptions { asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) return opts } @@ -470,7 +470,7 @@ func completedWorkerOptions(t *testing.T) *install.InstallOptions { asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) opts := newOptions(t, allSuppliedWorkerFlags(), agentK8s.ModeWorker, asker) - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) return opts } @@ -727,7 +727,7 @@ func TestResolveWithoutPrompting_RejectsAnUnknownMachinePolicy(t *testing.T) { flags.MachinePolicy.Value = "Does Not Exist" opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) - assert.ErrorContains(t, opts.ResolveWithoutPrompting(), "Does Not Exist") + assert.ErrorContains(t, opts.ResolveWithoutPrompting(context.Background()), "Does Not Exist") } func TestResolveWithoutPrompting_DerivesThePollingAddress(t *testing.T) { @@ -737,7 +737,7 @@ func TestResolveWithoutPrompting_DerivesThePollingAddress(t *testing.T) { flags.ServerCommsAddresses.Value = nil opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) assert.Equal(t, []string{pollingAddress}, flags.ServerCommsAddresses.Value) } @@ -766,7 +766,7 @@ func TestValidateWorkerPools_RejectsAPoolThatCannotHoldAWorker(t *testing.T) { flags.WorkerPools.Value = []string{"Kubernetes Pool", "Hosted Pool"} opts := newOptions(t, flags, agentK8s.ModeWorker, asker) - err := opts.ResolveWithoutPrompting() + err := opts.ResolveWithoutPrompting(context.Background()) require.Error(t, err) assert.Contains(t, err.Error(), "Hosted Pool") assert.NotContains(t, err.Error(), "Kubernetes Pool", "only the pools that could not be found are named") @@ -781,7 +781,7 @@ func TestValidateWorkerPools_IgnoredForADeploymentTarget(t *testing.T) { flags.WorkerPools.Value = []string{"Hosted Pool"} opts := newOptions(t, flags, agentK8s.ModeDeploymentTarget, asker) - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) } // Octopus creates a target tag as soon as a target registers with it, so a tag diff --git a/pkg/cmd/kubernetes/agent/install/prompt.go b/pkg/cmd/kubernetes/agent/install/prompt.go index 12d5dbce..f942df5f 100644 --- a/pkg/cmd/kubernetes/agent/install/prompt.go +++ b/pkg/cmd/kubernetes/agent/install/prompt.go @@ -53,7 +53,7 @@ func PromptMissing(ctx context.Context, opts *InstallOptions) error { } opts.warnAboutAccessMode() - return promptForScriptPodPermissions(opts) + return promptForScriptPodPermissions(ctx, opts) } // promptForRegistration asks only what the agent registers itself with, which @@ -237,7 +237,7 @@ func promptForStorageClass(opts *InstallOptions) error { // promptForScriptPodPermissions is only worth asking where the permissions // controller can act on the answer. Without it, this is the only thing standing // between a deployment and the cluster, and taking it away stops deployments. -func promptForScriptPodPermissions(opts *InstallOptions) error { +func promptForScriptPodPermissions(ctx context.Context, opts *InstallOptions) error { if !opts.PermissionsController || opts.RestrictScriptPods.Value || len(opts.ScriptPodRoles.Value) > 0 { return nil } @@ -265,7 +265,7 @@ func promptForScriptPodPermissions(opts *InstallOptions) error { opts.RestrictScriptPods.Value = true return nil case copyRole: - return promptForScriptPodRoles(opts) + return promptForScriptPodRoles(ctx, opts) default: return nil } @@ -274,8 +274,8 @@ func promptForScriptPodPermissions(opts *InstallOptions) error { // promptForScriptPodRoles copies rules out of existing roles rather than // binding to them, because that is what the chart takes. Saying so matters: the // copy does not follow the roles afterwards. -func promptForScriptPodRoles(opts *InstallOptions) error { - roles, err := opts.Cluster.Roles(context.Background()) +func promptForScriptPodRoles(ctx context.Context, opts *InstallOptions) error { + roles, err := opts.Cluster.Roles(ctx) if err != nil { return err } diff --git a/pkg/cmd/kubernetes/agent/install/resolve.go b/pkg/cmd/kubernetes/agent/install/resolve.go new file mode 100644 index 00000000..804734a0 --- /dev/null +++ b/pkg/cmd/kubernetes/agent/install/resolve.go @@ -0,0 +1,405 @@ +package install + +import ( + "context" + "fmt" + "strings" + + "github.com/OctopusDeploy/cli/pkg/cmd" + sharedTarget "github.com/OctopusDeploy/cli/pkg/cmd/target/shared" + sharedWorker "github.com/OctopusDeploy/cli/pkg/cmd/worker/shared" + "github.com/OctopusDeploy/cli/pkg/constants" + octoK8s "github.com/OctopusDeploy/cli/pkg/kubernetes" + agentK8s "github.com/OctopusDeploy/cli/pkg/kubernetes/agent" + "github.com/OctopusDeploy/cli/pkg/machinescommon" + "github.com/OctopusDeploy/cli/pkg/octopusservernodes" + "github.com/OctopusDeploy/cli/pkg/output" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/machines" + "github.com/OctopusDeploy/go-octopusdeploy/v2/pkg/workers" +) + +func (opts *InstallOptions) ValidateForAutomation() error { + var missing []string + if opts.Name.Value == "" { + missing = append(missing, "--"+FlagName) + } + + if opts.Mode == agentK8s.ModeWorker { + if len(opts.WorkerPools.Value) == 0 { + missing = append(missing, "--"+sharedWorker.FlagWorkerPool) + } + } else { + if len(opts.Environments.Value) == 0 { + missing = append(missing, "--"+sharedTarget.FlagEnvironment) + } + if len(opts.Roles.Value) == 0 && len(opts.Tags.Value) == 0 { + missing = append(missing, fmt.Sprintf("--%s or --%s", sharedTarget.FlagRole, sharedTarget.FlagTag)) + } + } + + // A dry run renders manifests without registering anything, so there is no + // agreement being entered into. + if !opts.AcceptEula.Value && !opts.DryRun.Value { + missing = append(missing, "--"+FlagAcceptEula) + } + + if len(missing) > 0 { + return fmt.Errorf("%s must be specified when prompting is disabled", strings.Join(missing, ", ")) + } + return nil +} + +func (opts *InstallOptions) ResolveWithoutPrompting(ctx context.Context) error { + if err := opts.resolvePollingAddresses(); err != nil { + return err + } + + if err := opts.resolveNames(); err != nil { + return err + } + + if err := opts.validateMachinePolicy(); err != nil { + return err + } + + if err := opts.validateWorkerPools(); err != nil { + return err + } + + if err := opts.resolveScriptPodRoles(ctx); err != nil { + return err + } + + opts.deriveAccessMode() + opts.warnAboutAccessMode() + return nil +} + +// validateWorkerPools catches a pool that cannot hold a worker before the agent +// tries to register with it. A dynamic pool is the likely mistake: Octopus runs +// those on its own machines, so a worker cannot join one. +func (opts *InstallOptions) validateWorkerPools() error { + if !opts.isWorker() || len(opts.WorkerPools.Value) == 0 { + return nil + } + + pools, err := opts.GetAllWorkerPoolsCallback() + if err != nil { + return err + } + + known := map[string]bool{} + for _, pool := range pools { + known[strings.ToLower(pool.Name)] = true + known[strings.ToLower(pool.ID)] = true + } + + var unknown []string + for _, given := range opts.WorkerPools.Value { + if !known[strings.ToLower(strings.TrimSpace(given))] { + unknown = append(unknown, given) + } + } + if len(unknown) == 0 { + return nil + } + + return fmt.Errorf("no worker pool named %s in space %s can hold a worker. %s", + strings.Join(unknown, ", "), opts.spaceName(), staticPoolAdvice()) +} + +// staticPoolAdvice is worth spelling out because a space can easily have only +// dynamic pools, which is the default on Octopus Cloud. +func staticPoolAdvice() string { + return fmt.Sprintf("A Kubernetes worker joins a static worker pool; create one with `%s worker-pool static create`", + constants.ExecutableName) +} + +// validateMachinePolicy checks the name before anything is created, so a typo +// surfaces here rather than in a registration that fails inside the cluster. +func (opts *InstallOptions) validateMachinePolicy() error { + if opts.MachinePolicy.Value == "" { + return nil + } + _, err := machinescommon.FindMachinePolicy(opts.GetAllMachinePoliciesCallback, opts.MachinePolicy.Value) + return err +} + +// resolveScriptPodRoles copies the rules out of the named roles. They are +// copied rather than referenced because the chart takes rules, so this is a +// snapshot: the agent does not follow the roles afterwards. +func (opts *InstallOptions) resolveScriptPodRoles(ctx context.Context) error { + if len(opts.ScriptPodRoles.Value) == 0 { + return nil + } + if opts.RestrictScriptPods.Value { + return fmt.Errorf("--%s and --%s ask for opposite things; script pods either have no permissions of their own or the ones copied from %s", + FlagRestrictScriptPods, FlagScriptPodRole, strings.Join(opts.ScriptPodRoles.Value, ", ")) + } + + roles := make([]octoK8s.Role, 0, len(opts.ScriptPodRoles.Value)) + for _, reference := range opts.ScriptPodRoles.Value { + role, err := opts.Cluster.FindRole(ctx, reference) + if err != nil { + return err + } + roles = append(roles, role) + } + + opts.ScriptPodRules = octoK8s.MergePolicyRules(roles) + if len(opts.ScriptPodRules) == 0 { + return fmt.Errorf("%s grants nothing, so copying it would leave script pods unable to deploy. "+ + "Use --%s if that is what you want", strings.Join(opts.ScriptPodRoles.Value, ", "), FlagRestrictScriptPods) + } + return nil +} + +// resolvedStorageClass is where the volume actually comes from: the class that +// was chosen, or the cluster's default when none was. +func (opts *InstallOptions) resolvedStorageClass() (octoK8s.StorageClass, bool) { + for _, class := range opts.StorageClasses { + if opts.StorageClass.Value == "" { + if class.IsDefault { + return class, true + } + continue + } + if class.Name == opts.StorageClass.Value { + return class, true + } + } + return octoK8s.StorageClass{}, false +} + +// deriveAccessMode reads the access mode off the storage class rather than +// asking for it. Whether script pods can spread across nodes follows from +// whether the class serves a shared filesystem, which is not a separate +// decision anybody should have to make. +func (opts *InstallOptions) deriveAccessMode() { + if opts.AccessModeChosen { + return + } + class, found := opts.resolvedStorageClass() + opts.ReadWriteMany.Value = found && class.SupportsReadWriteMany() +} + +// warnAboutAccessMode is a warning rather than a refusal: the provisioner is +// only a signal, and a class this does not recognise may well serve a shared +// filesystem. +func (opts *InstallOptions) warnAboutAccessMode() { + if !opts.ReadWriteMany.Value || !opts.AccessModeChosen { + return + } + + class, found := opts.resolvedStorageClass() + if found && class.SupportsReadWriteMany() { + return + } + + fmt.Fprintf(opts.Out, "%s --%s asks for a ReadWriteMany volume from %s, which is not known to serve one. "+ + "If it cannot, the volume never binds and the agent stays pending.\n", + output.Yellow("!"), FlagReadWriteMany, storageClassDescription(class, found, opts.StorageClass.Value)) +} + +func storageClassDescription(class octoK8s.StorageClass, found bool, requested string) string { + switch { + case found && class.Provisioner != "": + return fmt.Sprintf("%s (%s)", class.Name, class.Provisioner) + case requested != "": + return requested + default: + return "the cluster's default storage class" + } +} + +// resolvePollingAddresses fills in the polling address when none was given. +// Octopus Cloud and a single-node server have one derivable address; a High +// Availability cluster does not - each node needs its own address, which only +// the person who set the cluster up knows. +func (opts *InstallOptions) resolvePollingAddresses() error { + if len(opts.ServerCommsAddresses.Value) > 0 { + return nil + } + + if nodes := opts.haNodes(); len(nodes) > 0 { + names := make([]string, 0, len(nodes)) + for _, node := range nodes { + names = append(names, node.Name) + } + return fmt.Errorf("this Octopus Server is a High Availability cluster (nodes %s), and the agent polls every node on its own address; give --%s once per node", + strings.Join(names, ", "), FlagServerCommsAddress) + } + + if derived := octoK8s.DerivePollingURL(opts.Host); derived != "" { + opts.ServerCommsAddresses.Value = []string{derived} + } + return nil +} + +// haNodes is empty unless Octopus is a self-hosted High Availability cluster. +// Octopus Cloud serves every polling connection on one shared address, so its +// nodes are its own business. +func (opts *InstallOptions) haNodes() []octopusservernodes.Node { + if octoK8s.IsOctopusCloud(opts.Host) { + return nil + } + nodes := opts.taskNodes() + if len(nodes) <= 1 { + return nil + } + return nodes +} + +// taskNodes degrades to none rather than failing: the topology read is a +// convenience, and a credential that cannot read it can still name the polling +// addresses itself. +func (opts *InstallOptions) taskNodes() []octopusservernodes.Node { + if opts.serverNodesRead || opts.ServerNodesCallback == nil { + return opts.serverNodes + } + opts.serverNodesRead = true + + nodes, err := opts.ServerNodesCallback() + if err != nil { + fmt.Fprintf(opts.Out, "%s Could not read the Octopus Server's nodes to check for High Availability: %v\n", + output.Yellow("!"), err) + return nil + } + opts.serverNodes = nodes + return nodes +} + +func (opts *InstallOptions) resolveNames() error { + namespace, release, err := octoK8s.ResolveNames(opts.Namespace.Value, opts.ReleaseName.Value, opts.namespacePrefix(), opts.Name.Value) + if err != nil { + return err + } + opts.TargetNamespace, opts.TargetRelease = namespace, release + return nil +} + +// namespacePrefix matches what the Octopus portal generates for each mode, so +// a CLI install and a portal install of the same name land in the same place. +func (opts *InstallOptions) namespacePrefix() string { + if opts.isWorker() { + return octoK8s.WorkerNamespacePrefix + } + return octoK8s.AgentNamespacePrefix +} + +func (opts *InstallOptions) spaceName() string { + if name := opts.GetSpaceNameOrEmpty(); name != "" { + return name + } + return "Default" +} + +func (opts *InstallOptions) spaceID() string { + if opts.Space == nil { + return "" + } + return opts.Space.ID +} + +func (opts *InstallOptions) isWorker() bool { + return opts.Mode == agentK8s.ModeWorker +} + +// installedThing names what goes into the cluster, which is one chart either +// way. Mode names what Octopus ends up with, which is what a name or a +// registration belongs to. +func (opts *InstallOptions) installedThing() string { + if opts.isWorker() { + return "Kubernetes worker" + } + return "Kubernetes agent" +} + +// existingRelease is the agent this install would replace, which is worth +// saying: a Helm release name is derived from the agent name, so reusing a name +// upgrades an agent rather than adding one. +func (opts *InstallOptions) existingRelease() (agentK8s.Installation, bool) { + for _, installation := range opts.Installations { + if installation.Release.Name == opts.TargetRelease && installation.Release.Namespace == opts.TargetNamespace { + return installation, true + } + } + return agentK8s.Installation{}, false +} + +// registered answers whether Octopus already has an agent of this name. +// Registration matches on name, so an existing one is taken over rather than +// added to. +func registered(dependencies *cmd.Dependencies, mode agentK8s.Mode, name string) (bool, error) { + if dependencies.Client == nil || strings.TrimSpace(name) == "" { + return false, nil + } + spaceID := "" + if dependencies.Space != nil { + spaceID = dependencies.Space.ID + } + + if mode == agentK8s.ModeWorker { + page, err := workers.Get(dependencies.Client, spaceID, machines.WorkersQuery{PartialName: name}) + if err != nil { + return false, err + } + for _, worker := range page.Items { + if strings.EqualFold(worker.Name, name) { + return true, nil + } + } + return false, nil + } + + page, err := machines.Get(dependencies.Client, spaceID, machines.MachinesQuery{PartialName: name}) + if err != nil { + return false, err + } + for _, target := range page.Items { + if strings.EqualFold(target.Name, name) { + return true, nil + } + } + return false, nil +} + +// knownTargetTags is read once and kept, so the review can tell a tag the space +// already had from one that will be created. +func (opts *InstallOptions) knownTargetTags() ([]string, error) { + if opts.KnownTargetTags != nil || opts.TargetTagsCallback == nil { + return opts.KnownTargetTags, nil + } + + tags, err := opts.TargetTagsCallback() + if err != nil { + return nil, err + } + if tags == nil { + tags = []string{} + } + opts.KnownTargetTags = tags + return tags, nil +} + +// newTargetTags are the chosen tags Octopus has never seen, which it creates +// when the agent registers. Tags that came from a flag are taken at face value: +// nothing was read, so nothing can be called new. +func (opts *InstallOptions) newTargetTags() []string { + if opts.KnownTargetTags == nil { + return nil + } + + known := map[string]bool{} + for _, tag := range opts.KnownTargetTags { + known[tag] = true + } + + var created []string + for _, tag := range opts.Roles.Value { + if !known[tag] { + created = append(created, tag) + } + } + return created +} diff --git a/pkg/cmd/kubernetes/agent/install/review.go b/pkg/cmd/kubernetes/agent/install/review.go index 348441a7..8475c2f0 100644 --- a/pkg/cmd/kubernetes/agent/install/review.go +++ b/pkg/cmd/kubernetes/agent/install/review.go @@ -179,11 +179,11 @@ func scriptPodItems(opts *InstallOptions) []shared.Item { if opts.PermissionsController || opts.RestrictScriptPods.Value || len(opts.ScriptPodRoles.Value) > 0 { items = append(items, shared.Item{ Label: "Permissions", Value: permissionsSummary(opts), Source: permissionsSource(opts), - Edit: func(context.Context) error { + Edit: func(ctx context.Context) error { opts.RestrictScriptPods.Value = false opts.ScriptPodRoles.Value = nil opts.ScriptPodRules = nil - return promptForScriptPodPermissions(opts) + return promptForScriptPodPermissions(ctx, opts) }, }) } diff --git a/pkg/cmd/kubernetes/agent/install/review_test.go b/pkg/cmd/kubernetes/agent/install/review_test.go index 5dc4f9c1..e4409ba9 100644 --- a/pkg/cmd/kubernetes/agent/install/review_test.go +++ b/pkg/cmd/kubernetes/agent/install/review_test.go @@ -170,7 +170,7 @@ func TestReportFindings_ExistingReleaseOfTheOtherKind(t *testing.T) { asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) opts.Installations = []agentK8s.Installation{{ Release: helm.Release{Name: "production", Namespace: "octopus-agent-production", Chart: "kubernetes-agent", Version: "3.13.3"}, Name: "Production", @@ -189,7 +189,7 @@ func TestReportFindings_UpgradingAnExistingAgent(t *testing.T) { asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) opts.Installations = []agentK8s.Installation{{ Release: helm.Release{Name: "production", Namespace: "octopus-agent-production", Chart: "kubernetes-agent", Version: "3.13.3"}, Name: "Production", @@ -207,7 +207,7 @@ func TestReportFindings_NameAlreadyRegisteredInOctopus(t *testing.T) { asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) opts.RegisteredCallback = func(string) (bool, error) { return true, nil } out := &bytes.Buffer{} @@ -222,7 +222,7 @@ func TestReportFindings_UnsupportedNodeArchitecture(t *testing.T) { asker, _ := testutil.NewMockAsker(t, []*testutil.PA{}) opts := newOptions(t, allSuppliedTargetFlags(), agentK8s.ModeDeploymentTarget, asker) - require.NoError(t, opts.ResolveWithoutPrompting()) + require.NoError(t, opts.ResolveWithoutPrompting(context.Background())) opts.NodeArchitectures = []string{"amd64", "ppc64le"} out := &bytes.Buffer{} diff --git a/pkg/cmd/kubernetes/gateway/install/install.go b/pkg/cmd/kubernetes/gateway/install/install.go index f7dff329..c633b1be 100644 --- a/pkg/cmd/kubernetes/gateway/install/install.go +++ b/pkg/cmd/kubernetes/gateway/install/install.go @@ -379,8 +379,8 @@ func (opts *InstallOptions) resolveNames() error { // Run installs the gateway using an existing set of dependencies. The // `kubernetes install` wizard uses this to hand off after the user picks a // component, so the two entry points share one implementation. -func Run(dependencies *cmd.Dependencies) error { - return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies)) +func Run(ctx context.Context, dependencies *cmd.Dependencies) error { + return installRun(ctx, NewInstallOptions(NewInstallFlags(), dependencies)) } // resolveEnvironments turns whatever --environment was given into the slug diff --git a/pkg/cmd/kubernetes/gateway/install/prompt.go b/pkg/cmd/kubernetes/gateway/install/prompt.go index 36941340..59e9386b 100644 --- a/pkg/cmd/kubernetes/gateway/install/prompt.go +++ b/pkg/cmd/kubernetes/gateway/install/prompt.go @@ -173,7 +173,7 @@ func promptForArgoCDToken(ctx context.Context, opts *InstallOptions) error { // Managed Argo CD has no argocd-cm to edit, and authenticates with project // role tokens because AWS caps account tokens at 12 hours. if opts.Instance.IsManaged() { - return promptForProjectTokens(opts) + return promptForProjectTokens(ctx, opts) } spec := argocd.AccountSpec{Name: opts.accountName(), AllowSync: opts.AllowSync.Value} @@ -254,12 +254,12 @@ func printManualTokenInstructions(opts *InstallOptions, status argocd.AccountSta fmt.Fprintf(opts.Out, " %s\n\n", output.Cyan(fmt.Sprintf("argocd account generate-token --account %s", status.Spec.Name))) } -func promptForProjectTokens(opts *InstallOptions) error { +func promptForProjectTokens(ctx context.Context, opts *InstallOptions) error { if len(opts.ArgoCDProjectTokens.Value) > 0 { return nil } - projects, err := prepareProjectRoles(opts) + projects, err := prepareProjectRoles(ctx, opts) if err != nil { return err } @@ -352,8 +352,7 @@ func promptForUnknownProjectTokens(opts *InstallOptions) error { // prepareProjectRoles creates the role Octopus authenticates as on the chosen // projects, and reports which they are. AWS signs the tokens themselves, but // the role and its policies live in the AppProject in the cluster. -func prepareProjectRoles(opts *InstallOptions) ([]string, error) { - ctx := context.Background() +func prepareProjectRoles(ctx context.Context, opts *InstallOptions) ([]string, error) { projects, err := argocd.ListProjects(ctx, opts.Cluster, opts.Instance.Namespace) if err != nil || len(projects) == 0 { diff --git a/pkg/cmd/kubernetes/gateway/install/review.go b/pkg/cmd/kubernetes/gateway/install/review.go index 744e81b6..bb9ef757 100644 --- a/pkg/cmd/kubernetes/gateway/install/review.go +++ b/pkg/cmd/kubernetes/gateway/install/review.go @@ -87,9 +87,9 @@ func argoItems(opts *InstallOptions) []shared.Item { Label: "Project tokens", Value: projectTokenSummary(opts), Source: "AWS caps account tokens at 12 hours", - Edit: func(context.Context) error { + Edit: func(ctx context.Context) error { opts.ArgoCDProjectTokens.Value = nil - return promptForProjectTokens(opts) + return promptForProjectTokens(ctx, opts) }, }) return items diff --git a/pkg/cmd/kubernetes/install/install.go b/pkg/cmd/kubernetes/install/install.go index 7a867a7c..b9c5c8ce 100644 --- a/pkg/cmd/kubernetes/install/install.go +++ b/pkg/cmd/kubernetes/install/install.go @@ -1,6 +1,7 @@ package install import ( + "context" "fmt" "strings" @@ -20,7 +21,7 @@ import ( type component struct { display string cmdPath string - install func(dependencies *cmd.Dependencies) error + install func(context.Context, *cmd.Dependencies) error } func components() []component { @@ -75,7 +76,7 @@ func NewCmdInstall(f factory.Factory) *cobra.Command { // The chosen component's own command path, so the automation command // it prints at the end reproduces the run without the wizard. - return selected.install(cmd.NewDependenciesFromExisting(dependencies, selected.cmdPath)) + return selected.install(c.Context(), cmd.NewDependenciesFromExisting(dependencies, selected.cmdPath)) }, } } diff --git a/pkg/cmd/kubernetes/permissionscontroller/install/install.go b/pkg/cmd/kubernetes/permissionscontroller/install/install.go index 71b20589..17ea6e97 100644 --- a/pkg/cmd/kubernetes/permissionscontroller/install/install.go +++ b/pkg/cmd/kubernetes/permissionscontroller/install/install.go @@ -151,8 +151,8 @@ func NewCmdInstall(f factory.Factory) *cobra.Command { // Run installs the controller using an existing set of dependencies. The // `kubernetes install` wizard uses this to hand off after the user picks a // component, so the two entry points share one implementation. -func Run(dependencies *cmd.Dependencies) error { - return installRun(context.Background(), NewInstallOptions(NewInstallFlags(), dependencies)) +func Run(ctx context.Context, dependencies *cmd.Dependencies) error { + return installRun(ctx, NewInstallOptions(NewInstallFlags(), dependencies)) } func installRun(ctx context.Context, opts *InstallOptions) error { diff --git a/pkg/kubernetes/cluster.go b/pkg/kubernetes/cluster.go index eee80672..a1ced1eb 100644 --- a/pkg/kubernetes/cluster.go +++ b/pkg/kubernetes/cluster.go @@ -3,16 +3,11 @@ package kubernetes import ( "context" "fmt" - "slices" "sort" - "strings" "time" - "github.com/OctopusDeploy/cli/pkg/util" appsv1 "k8s.io/api/apps/v1" - authzv1 "k8s.io/api/authorization/v1" corev1 "k8s.io/api/core/v1" - rbacv1 "k8s.io/api/rbac/v1" apierrors "k8s.io/apimachinery/pkg/api/errors" metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/types" @@ -129,74 +124,6 @@ func (c *Cluster) GetConfigMap(ctx context.Context, namespace, name string) (*co } } -func (c *Cluster) GetSecret(ctx context.Context, namespace, name string) (*corev1.Secret, bool, error) { - s, err := c.Clientset.CoreV1().Secrets(namespace).Get(ctx, name, metav1.GetOptions{}) - switch { - case err == nil: - return s, true, nil - case apierrors.IsNotFound(err): - return nil, false, nil - default: - return nil, false, fmt.Errorf("could not read Secret %s/%s: %w", namespace, name, err) - } -} - -type Permission struct { - Verb string - Group string - Resource string - Namespace string - Description string -} - -func (p Permission) String() string { - if p.Namespace != "" { - return fmt.Sprintf("%s %s in namespace %s", p.Verb, p.Resource, p.Namespace) - } - return fmt.Sprintf("%s %s", p.Verb, p.Resource) -} - -func InstallPermissions(namespace string) []Permission { - return []Permission{ - {Verb: "create", Resource: "namespaces", Description: "create the install namespace"}, - {Verb: "create", Resource: "secrets", Namespace: namespace, Description: "store credentials for the chart"}, - {Verb: "create", Resource: "serviceaccounts", Namespace: namespace, Description: "create the chart's service account"}, - {Verb: "create", Group: "apps", Resource: "deployments", Namespace: namespace, Description: "deploy the chart's workloads"}, - {Verb: "create", Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Description: "grant the chart its cluster permissions"}, - {Verb: "create", Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Description: "bind the chart's cluster permissions"}, - } -} - -// CheckPermissions returns the permissions that were denied. Checking up front -// means a missing one surfaces before the user answers a page of questions, -// rather than halfway through a partly applied install. -func (c *Cluster) CheckPermissions(ctx context.Context, permissions []Permission) ([]Permission, error) { - var denied []Permission - - for _, p := range permissions { - review := &authzv1.SelfSubjectAccessReview{ - Spec: authzv1.SelfSubjectAccessReviewSpec{ - ResourceAttributes: &authzv1.ResourceAttributes{ - Namespace: p.Namespace, - Verb: p.Verb, - Group: p.Group, - Resource: p.Resource, - }, - }, - } - - result, err := c.Clientset.AuthorizationV1().SelfSubjectAccessReviews().Create(ctx, review, metav1.CreateOptions{}) - if err != nil { - return nil, fmt.Errorf("could not check whether you can %s: %w", p, err) - } - if !result.Status.Allowed { - denied = append(denied, p) - } - } - - return denied, nil -} - func (c *Cluster) CreateNamespace(ctx context.Context, name string) error { ns := &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: name}} @@ -207,89 +134,6 @@ func (c *Cluster) CreateNamespace(ctx context.Context, name string) error { return nil } -// UpsertSecret replaces a Secret's contents wholesale, dropping any key it was -// not given. Only use it for Secrets Octopus owns; for anything else use -// MergeSecretKeys. -func (c *Cluster) UpsertSecret(ctx context.Context, namespace, name string, data map[string]string) error { - secrets := c.Clientset.CoreV1().Secrets(namespace) - - desired := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: name, - Namespace: namespace, - Labels: map[string]string{"app.kubernetes.io/managed-by": "octopus-cli"}, - }, - Type: corev1.SecretTypeOpaque, - StringData: data, - } - - existing, found, err := c.GetSecret(ctx, namespace, name) - if err != nil { - return err - } - - if !found { - if _, err := secrets.Create(ctx, desired, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) { - return fmt.Errorf("could not create Secret %s/%s: %w", namespace, name, err) - } - return nil - } - - desired.ResourceVersion = existing.ResourceVersion - if _, err := secrets.Update(ctx, desired, metav1.UpdateOptions{}); err != nil { - return fmt.Errorf("could not update Secret %s/%s: %w", namespace, name, err) - } - return nil -} - -// MergeSecretKeys is the only safe way to edit a Secret Octopus does not own. -// argocd-secret holds Argo CD's TLS and signing keys alongside anything Octopus -// puts there, and replacing it wholesale would destroy the installation. -func (c *Cluster) MergeSecretKeys(ctx context.Context, namespace, name string, set map[string]string, remove []string) error { - secrets := c.Clientset.CoreV1().Secrets(namespace) - - existing, found, err := c.GetSecret(ctx, namespace, name) - if err != nil { - return err - } - if !found { - return fmt.Errorf("Secret %s/%s does not exist", namespace, name) - } - - updated := existing.DeepCopy() - if updated.Data == nil { - updated.Data = map[string][]byte{} - } - for key, value := range set { - updated.Data[key] = []byte(value) - } - for _, key := range remove { - delete(updated.Data, key) - } - - // The resourceVersion that was read makes a concurrent change conflict - // rather than be silently overwritten. - if _, err := secrets.Update(ctx, updated, metav1.UpdateOptions{}); err != nil { - if apierrors.IsConflict(err) { - return fmt.Errorf("%s/%s changed while it was being updated; try again", namespace, name) - } - return fmt.Errorf("could not update Secret %s/%s: %w", namespace, name, err) - } - return nil -} - -func (c *Cluster) SecretKey(ctx context.Context, namespace, name, key string) (string, bool, error) { - secret, found, err := c.GetSecret(ctx, namespace, name) - if err != nil || !found { - return "", false, err - } - value, ok := secret.Data[key] - if !ok { - return "", false, nil - } - return string(value), true, nil -} - func (c *Cluster) FindDeployment(ctx context.Context, namespace, selector string) (*appsv1.Deployment, bool, error) { list, err := c.Clientset.AppsV1().Deployments(namespace). List(ctx, metav1.ListOptions{LabelSelector: selector}) @@ -354,229 +198,3 @@ func (c *Cluster) HasAPIResource(group, resource string) (bool, error) { } return false, nil } - -// StorageClass is what an installer needs to know to choose where a component's -// volume comes from. -type StorageClass struct { - Name string - Provisioner string - IsDefault bool -} - -// readWriteManyProvisioners serve a shared filesystem, so many pods on many -// nodes can mount the same volume. Everything else provisions a block device -// that only one node can mount at a time. -// -// The Kubernetes API does not report which access modes a storage class -// supports, and this is the only signal it does give. An unrecognised -// provisioner is treated as one node at a time, because that costs nothing but -// node affinity, where guessing the other way leaves a volume that never binds. -var readWriteManyProvisioners = map[string]bool{ - "efs.csi.aws.com": true, // AWS EFS - "filestore.csi.storage.gke.io": true, // Google Filestore - "file.csi.azure.com": true, // Azure Files - "kubernetes.io/azure-file": true, - "nfs.csi.k8s.io": true, - "smb.csi.k8s.io": true, - "cephfs.csi.ceph.com": true, - "rook-ceph.cephfs.csi.ceph.com": true, - "openebs.io/nfsrwx": true, - "nfs.openebs.io": true, - "k8s-sigs.io/nfs-subdir-external-provisioner": true, -} - -// SupportsReadWriteMany reports whether a volume from this class can be mounted -// by pods on more than one node. -func (s StorageClass) SupportsReadWriteMany() bool { - return readWriteManyProvisioners[s.Provisioner] -} - -func (s StorageClass) Display() string { - if s.IsDefault { - return fmt.Sprintf("%s (cluster default, %s)", s.Name, s.Provisioner) - } - return fmt.Sprintf("%s (%s)", s.Name, s.Provisioner) -} - -// StorageClasses is advisory, so a cluster that will not let the caller list -// them reports none rather than failing. -func (c *Cluster) StorageClasses(ctx context.Context) ([]StorageClass, error) { - list, err := c.Clientset.StorageV1().StorageClasses().List(ctx, metav1.ListOptions{}) - if err != nil { - if apierrors.IsForbidden(err) { - return nil, nil - } - return nil, fmt.Errorf("could not list the cluster's storage classes: %w", err) - } - - classes := make([]StorageClass, 0, len(list.Items)) - for _, item := range list.Items { - classes = append(classes, StorageClass{ - Name: item.Name, - Provisioner: item.Provisioner, - IsDefault: item.Annotations["storageclass.kubernetes.io/is-default-class"] == "true", - }) - } - - sort.Slice(classes, func(i, j int) bool { - if classes[i].IsDefault != classes[j].IsDefault { - return classes[i].IsDefault - } - return classes[i].Name < classes[j].Name - }) - return classes, nil -} - -// Role is an existing role whose rules can be copied into a component's own -// role. Namespace is empty for a cluster role. -type Role struct { - Name string - Namespace string - Rules []rbacv1.PolicyRule -} - -func (r Role) IsClusterScoped() bool { return r.Namespace == "" } - -// Reference is how a role is named on a command line: a bare name for a cluster -// role, and namespace/name for one that lives in a namespace. -func (r Role) Reference() string { - if r.IsClusterScoped() { - return r.Name - } - return r.Namespace + "/" + r.Name -} - -// GrantsEverything reports an unrestricted role, which is worth saying out loud -// before somebody copies it expecting to have restricted something. -func (r Role) GrantsEverything() bool { - for _, rule := range r.Rules { - if slices.Contains(rule.Verbs, "*") && slices.Contains(rule.APIGroups, "*") && slices.Contains(rule.Resources, "*") { - return true - } - } - return false -} - -func (r Role) Display() string { - kind := "role" - if r.IsClusterScoped() { - kind = "cluster role" - } - - if r.GrantsEverything() { - return fmt.Sprintf("%s (%s, full access to the cluster)", r.Reference(), kind) - } - return fmt.Sprintf("%s (%s, %d %s)", r.Reference(), kind, len(r.Rules), util.Pluralise("rule", "rules", len(r.Rules))) -} - -// Roles lists the roles worth offering to copy, cluster-scoped ones first. -// Kubernetes ships around seventy of its own, all prefixed system:, and the -// kube- namespaces hold the control plane's, none of which is what anybody is -// looking for here. -func (c *Cluster) Roles(ctx context.Context) ([]Role, error) { - clusterRoles, err := c.Clientset.RbacV1().ClusterRoles().List(ctx, metav1.ListOptions{}) - if err != nil { - return nil, fmt.Errorf("could not list the cluster's roles: %w", err) - } - - roles := make([]Role, 0, len(clusterRoles.Items)) - for _, item := range clusterRoles.Items { - if strings.HasPrefix(item.Name, "system:") { - continue - } - roles = append(roles, Role{Name: item.Name, Rules: item.Rules}) - } - - namespaced, err := c.Clientset.RbacV1().Roles(metav1.NamespaceAll).List(ctx, metav1.ListOptions{}) - if err != nil { - // A credential that can read cluster roles but not namespaced ones still - // has something to offer. - if !apierrors.IsForbidden(err) { - return nil, fmt.Errorf("could not list the cluster's roles: %w", err) - } - } else { - for _, item := range namespaced.Items { - if strings.HasPrefix(item.Namespace, "kube-") || strings.HasPrefix(item.Name, "system:") { - continue - } - roles = append(roles, Role{Name: item.Name, Namespace: item.Namespace, Rules: item.Rules}) - } - } - - sort.Slice(roles, func(i, j int) bool { - if roles[i].IsClusterScoped() != roles[j].IsClusterScoped() { - return roles[i].IsClusterScoped() - } - return roles[i].Reference() < roles[j].Reference() - }) - return roles, nil -} - -// FindRole reads one role by the reference a command line gives it. -func (c *Cluster) FindRole(ctx context.Context, reference string) (Role, error) { - namespace, name, namespaced := strings.Cut(strings.TrimSpace(reference), "/") - if !namespaced { - role, err := c.Clientset.RbacV1().ClusterRoles().Get(ctx, namespace, metav1.GetOptions{}) - if err != nil { - if apierrors.IsNotFound(err) { - return Role{}, fmt.Errorf("this cluster has no cluster role named %q. Name a role in a namespace as namespace/name", reference) - } - return Role{}, fmt.Errorf("could not read cluster role %q: %w", reference, err) - } - return Role{Name: role.Name, Rules: role.Rules}, nil - } - - role, err := c.Clientset.RbacV1().Roles(namespace).Get(ctx, name, metav1.GetOptions{}) - if err != nil { - if apierrors.IsNotFound(err) { - return Role{}, fmt.Errorf("namespace %s has no role named %q", namespace, name) - } - return Role{}, fmt.Errorf("could not read role %q: %w", reference, err) - } - return Role{Name: role.Name, Namespace: role.Namespace, Rules: role.Rules}, nil -} - -// MergePolicyRules gathers the rules of several roles into one list. RBAC is -// additive, so a workload given all of them ends up with the union; exact -// duplicates only make the result harder to read. -func MergePolicyRules(roles []Role) []any { - merged := make([]any, 0) - seen := map[string]bool{} - - for _, role := range roles { - for _, value := range PolicyRuleValues(role.Rules) { - key := fmt.Sprint(value) - if seen[key] { - continue - } - seen[key] = true - merged = append(merged, value) - } - } - return merged -} - -// PolicyRuleValues converts RBAC rules into the plain maps a Helm value has to -// be. The chart checks the value is a list and renders it with toYaml, neither -// of which a typed struct survives. -func PolicyRuleValues(rules []rbacv1.PolicyRule) []any { - values := make([]any, 0, len(rules)) - for _, rule := range rules { - value := map[string]any{} - addStrings(value, "apiGroups", rule.APIGroups) - addStrings(value, "resources", rule.Resources) - addStrings(value, "resourceNames", rule.ResourceNames) - addStrings(value, "nonResourceURLs", rule.NonResourceURLs) - addStrings(value, "verbs", rule.Verbs) - if len(value) > 0 { - values = append(values, value) - } - } - return values -} - -func addStrings(value map[string]any, key string, values []string) { - if len(values) > 0 { - value[key] = values - } -} diff --git a/pkg/kubernetes/rbac.go b/pkg/kubernetes/rbac.go new file mode 100644 index 00000000..a62b3cea --- /dev/null +++ b/pkg/kubernetes/rbac.go @@ -0,0 +1,225 @@ +package kubernetes + +import ( + "context" + "fmt" + "slices" + "sort" + "strings" + + "github.com/OctopusDeploy/cli/pkg/util" + authzv1 "k8s.io/api/authorization/v1" + rbacv1 "k8s.io/api/rbac/v1" + apierrors "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +type Permission struct { + Verb string + Group string + Resource string + Namespace string + Description string +} + +func (p Permission) String() string { + if p.Namespace != "" { + return fmt.Sprintf("%s %s in namespace %s", p.Verb, p.Resource, p.Namespace) + } + return fmt.Sprintf("%s %s", p.Verb, p.Resource) +} + +func InstallPermissions(namespace string) []Permission { + return []Permission{ + {Verb: "create", Resource: "namespaces", Description: "create the install namespace"}, + {Verb: "create", Resource: "secrets", Namespace: namespace, Description: "store credentials for the chart"}, + {Verb: "create", Resource: "serviceaccounts", Namespace: namespace, Description: "create the chart's service account"}, + {Verb: "create", Group: "apps", Resource: "deployments", Namespace: namespace, Description: "deploy the chart's workloads"}, + {Verb: "create", Group: "rbac.authorization.k8s.io", Resource: "clusterroles", Description: "grant the chart its cluster permissions"}, + {Verb: "create", Group: "rbac.authorization.k8s.io", Resource: "clusterrolebindings", Description: "bind the chart's cluster permissions"}, + } +} + +// CheckPermissions returns the permissions that were denied. Checking up front +// means a missing one surfaces before the user answers a page of questions, +// rather than halfway through a partly applied install. +func (c *Cluster) CheckPermissions(ctx context.Context, permissions []Permission) ([]Permission, error) { + var denied []Permission + + for _, p := range permissions { + review := &authzv1.SelfSubjectAccessReview{ + Spec: authzv1.SelfSubjectAccessReviewSpec{ + ResourceAttributes: &authzv1.ResourceAttributes{ + Namespace: p.Namespace, + Verb: p.Verb, + Group: p.Group, + Resource: p.Resource, + }, + }, + } + + result, err := c.Clientset.AuthorizationV1().SelfSubjectAccessReviews().Create(ctx, review, metav1.CreateOptions{}) + if err != nil { + return nil, fmt.Errorf("could not check whether you can %s: %w", p, err) + } + if !result.Status.Allowed { + denied = append(denied, p) + } + } + + return denied, nil +} + +// Role is an existing role whose rules can be copied into a component's own +// role. Namespace is empty for a cluster role. +type Role struct { + Name string + Namespace string + Rules []rbacv1.PolicyRule +} + +func (r Role) IsClusterScoped() bool { return r.Namespace == "" } + +// Reference is how a role is named on a command line: a bare name for a cluster +// role, and namespace/name for one that lives in a namespace. +func (r Role) Reference() string { + if r.IsClusterScoped() { + return r.Name + } + return r.Namespace + "/" + r.Name +} + +// GrantsEverything reports an unrestricted role, which is worth saying out loud +// before somebody copies it expecting to have restricted something. +func (r Role) GrantsEverything() bool { + for _, rule := range r.Rules { + if slices.Contains(rule.Verbs, "*") && slices.Contains(rule.APIGroups, "*") && slices.Contains(rule.Resources, "*") { + return true + } + } + return false +} + +func (r Role) Display() string { + kind := "role" + if r.IsClusterScoped() { + kind = "cluster role" + } + + if r.GrantsEverything() { + return fmt.Sprintf("%s (%s, full access to the cluster)", r.Reference(), kind) + } + return fmt.Sprintf("%s (%s, %d %s)", r.Reference(), kind, len(r.Rules), util.Pluralise("rule", "rules", len(r.Rules))) +} + +// Roles lists the roles worth offering to copy, cluster-scoped ones first. +// Kubernetes ships around seventy of its own, all prefixed system:, and the +// kube- namespaces hold the control plane's, none of which is what anybody is +// looking for here. +func (c *Cluster) Roles(ctx context.Context) ([]Role, error) { + clusterRoles, err := c.Clientset.RbacV1().ClusterRoles().List(ctx, metav1.ListOptions{}) + if err != nil { + return nil, fmt.Errorf("could not list the cluster's roles: %w", err) + } + + roles := make([]Role, 0, len(clusterRoles.Items)) + for _, item := range clusterRoles.Items { + if strings.HasPrefix(item.Name, "system:") { + continue + } + roles = append(roles, Role{Name: item.Name, Rules: item.Rules}) + } + + namespaced, err := c.Clientset.RbacV1().Roles(metav1.NamespaceAll).List(ctx, metav1.ListOptions{}) + if err != nil { + // A credential that can read cluster roles but not namespaced ones still + // has something to offer. + if !apierrors.IsForbidden(err) { + return nil, fmt.Errorf("could not list the cluster's roles: %w", err) + } + } else { + for _, item := range namespaced.Items { + if strings.HasPrefix(item.Namespace, "kube-") || strings.HasPrefix(item.Name, "system:") { + continue + } + roles = append(roles, Role{Name: item.Name, Namespace: item.Namespace, Rules: item.Rules}) + } + } + + sort.Slice(roles, func(i, j int) bool { + if roles[i].IsClusterScoped() != roles[j].IsClusterScoped() { + return roles[i].IsClusterScoped() + } + return roles[i].Reference() < roles[j].Reference() + }) + return roles, nil +} + +// FindRole reads one role by the reference a command line gives it. +func (c *Cluster) FindRole(ctx context.Context, reference string) (Role, error) { + namespace, name, namespaced := strings.Cut(strings.TrimSpace(reference), "/") + if !namespaced { + role, err := c.Clientset.RbacV1().ClusterRoles().Get(ctx, namespace, metav1.GetOptions{}) + if err != nil { + if apierrors.IsNotFound(err) { + return Role{}, fmt.Errorf("this cluster has no cluster role named %q. Name a role in a namespace as namespace/name", reference) + } + return Role{}, fmt.Errorf("could not read cluster role %q: %w", reference, err) + } + return Role{Name: role.Name, Rules: role.Rules}, nil + } + + role, err := c.Clientset.RbacV1().Roles(namespace).Get(ctx, name, metav1.GetOptions{}) + if err != nil { + if apierrors.IsNotFound(err) { + return Role{}, fmt.Errorf("namespace %s has no role named %q", namespace, name) + } + return Role{}, fmt.Errorf("could not read role %q: %w", reference, err) + } + return Role{Name: role.Name, Namespace: role.Namespace, Rules: role.Rules}, nil +} + +// MergePolicyRules gathers the rules of several roles into one list. RBAC is +// additive, so a workload given all of them ends up with the union; exact +// duplicates only make the result harder to read. +func MergePolicyRules(roles []Role) []any { + merged := make([]any, 0) + seen := map[string]bool{} + + for _, role := range roles { + for _, value := range PolicyRuleValues(role.Rules) { + key := fmt.Sprint(value) + if seen[key] { + continue + } + seen[key] = true + merged = append(merged, value) + } + } + return merged +} + +// PolicyRuleValues converts RBAC rules into the plain maps a Helm value has to +// be. The chart checks the value is a list and renders it with toYaml, neither +// of which a typed struct survives. +func PolicyRuleValues(rules []rbacv1.PolicyRule) []any { + values := make([]any, 0, len(rules)) + for _, rule := range rules { + value := map[string]any{} + addStrings(value, "apiGroups", rule.APIGroups) + addStrings(value, "resources", rule.Resources) + addStrings(value, "resourceNames", rule.ResourceNames) + addStrings(value, "nonResourceURLs", rule.NonResourceURLs) + addStrings(value, "verbs", rule.Verbs) + if len(value) > 0 { + values = append(values, value) + } + } + return values +} + +func addStrings(value map[string]any, key string, values []string) { + if len(values) > 0 { + value[key] = values + } +} diff --git a/pkg/kubernetes/secrets.go b/pkg/kubernetes/secrets.go new file mode 100644 index 00000000..c4598d8e --- /dev/null +++ b/pkg/kubernetes/secrets.go @@ -0,0 +1,105 @@ +package kubernetes + +import ( + "context" + "fmt" + + corev1 "k8s.io/api/core/v1" + apierrors "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func (c *Cluster) GetSecret(ctx context.Context, namespace, name string) (*corev1.Secret, bool, error) { + s, err := c.Clientset.CoreV1().Secrets(namespace).Get(ctx, name, metav1.GetOptions{}) + switch { + case err == nil: + return s, true, nil + case apierrors.IsNotFound(err): + return nil, false, nil + default: + return nil, false, fmt.Errorf("could not read Secret %s/%s: %w", namespace, name, err) + } +} + +// UpsertSecret replaces a Secret's contents wholesale, dropping any key it was +// not given. Only use it for Secrets Octopus owns; for anything else use +// MergeSecretKeys. +func (c *Cluster) UpsertSecret(ctx context.Context, namespace, name string, data map[string]string) error { + secrets := c.Clientset.CoreV1().Secrets(namespace) + + desired := &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{ + Name: name, + Namespace: namespace, + Labels: map[string]string{"app.kubernetes.io/managed-by": "octopus-cli"}, + }, + Type: corev1.SecretTypeOpaque, + StringData: data, + } + + existing, found, err := c.GetSecret(ctx, namespace, name) + if err != nil { + return err + } + + if !found { + if _, err := secrets.Create(ctx, desired, metav1.CreateOptions{}); err != nil && !apierrors.IsAlreadyExists(err) { + return fmt.Errorf("could not create Secret %s/%s: %w", namespace, name, err) + } + return nil + } + + desired.ResourceVersion = existing.ResourceVersion + if _, err := secrets.Update(ctx, desired, metav1.UpdateOptions{}); err != nil { + return fmt.Errorf("could not update Secret %s/%s: %w", namespace, name, err) + } + return nil +} + +// MergeSecretKeys is the only safe way to edit a Secret Octopus does not own. +// argocd-secret holds Argo CD's TLS and signing keys alongside anything Octopus +// puts there, and replacing it wholesale would destroy the installation. +func (c *Cluster) MergeSecretKeys(ctx context.Context, namespace, name string, set map[string]string, remove []string) error { + secrets := c.Clientset.CoreV1().Secrets(namespace) + + existing, found, err := c.GetSecret(ctx, namespace, name) + if err != nil { + return err + } + if !found { + return fmt.Errorf("Secret %s/%s does not exist", namespace, name) + } + + updated := existing.DeepCopy() + if updated.Data == nil { + updated.Data = map[string][]byte{} + } + for key, value := range set { + updated.Data[key] = []byte(value) + } + for _, key := range remove { + delete(updated.Data, key) + } + + // The resourceVersion that was read makes a concurrent change conflict + // rather than be silently overwritten. + if _, err := secrets.Update(ctx, updated, metav1.UpdateOptions{}); err != nil { + if apierrors.IsConflict(err) { + return fmt.Errorf("%s/%s changed while it was being updated; try again", namespace, name) + } + return fmt.Errorf("could not update Secret %s/%s: %w", namespace, name, err) + } + return nil +} + +func (c *Cluster) SecretKey(ctx context.Context, namespace, name, key string) (string, bool, error) { + secret, found, err := c.GetSecret(ctx, namespace, name) + if err != nil || !found { + return "", false, err + } + value, ok := secret.Data[key] + if !ok { + return "", false, nil + } + return string(value), true, nil +} diff --git a/pkg/kubernetes/storage.go b/pkg/kubernetes/storage.go new file mode 100644 index 00000000..181db1ff --- /dev/null +++ b/pkg/kubernetes/storage.go @@ -0,0 +1,82 @@ +package kubernetes + +import ( + "context" + "fmt" + "sort" + + apierrors "k8s.io/apimachinery/pkg/api/errors" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +// StorageClass is what an installer needs to know to choose where a component's +// volume comes from. +type StorageClass struct { + Name string + Provisioner string + IsDefault bool +} + +// readWriteManyProvisioners serve a shared filesystem, so many pods on many +// nodes can mount the same volume. Everything else provisions a block device +// that only one node can mount at a time. +// +// The Kubernetes API does not report which access modes a storage class +// supports, and this is the only signal it does give. An unrecognised +// provisioner is treated as one node at a time, because that costs nothing but +// node affinity, where guessing the other way leaves a volume that never binds. +var readWriteManyProvisioners = map[string]bool{ + "efs.csi.aws.com": true, // AWS EFS + "filestore.csi.storage.gke.io": true, // Google Filestore + "file.csi.azure.com": true, // Azure Files + "kubernetes.io/azure-file": true, + "nfs.csi.k8s.io": true, + "smb.csi.k8s.io": true, + "cephfs.csi.ceph.com": true, + "rook-ceph.cephfs.csi.ceph.com": true, + "openebs.io/nfsrwx": true, + "nfs.openebs.io": true, + "k8s-sigs.io/nfs-subdir-external-provisioner": true, +} + +// SupportsReadWriteMany reports whether a volume from this class can be mounted +// by pods on more than one node. +func (s StorageClass) SupportsReadWriteMany() bool { + return readWriteManyProvisioners[s.Provisioner] +} + +func (s StorageClass) Display() string { + if s.IsDefault { + return fmt.Sprintf("%s (cluster default, %s)", s.Name, s.Provisioner) + } + return fmt.Sprintf("%s (%s)", s.Name, s.Provisioner) +} + +// StorageClasses is advisory, so a cluster that will not let the caller list +// them reports none rather than failing. +func (c *Cluster) StorageClasses(ctx context.Context) ([]StorageClass, error) { + list, err := c.Clientset.StorageV1().StorageClasses().List(ctx, metav1.ListOptions{}) + if err != nil { + if apierrors.IsForbidden(err) { + return nil, nil + } + return nil, fmt.Errorf("could not list the cluster's storage classes: %w", err) + } + + classes := make([]StorageClass, 0, len(list.Items)) + for _, item := range list.Items { + classes = append(classes, StorageClass{ + Name: item.Name, + Provisioner: item.Provisioner, + IsDefault: item.Annotations["storageclass.kubernetes.io/is-default-class"] == "true", + }) + } + + sort.Slice(classes, func(i, j int) bool { + if classes[i].IsDefault != classes[j].IsDefault { + return classes[i].IsDefault + } + return classes[i].Name < classes[j].Name + }) + return classes, nil +}