Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: fluxcd/kustomize-controller
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: v0.23.0
Choose a base ref
...
head repository: fluxcd/kustomize-controller
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: v0.24.0
Choose a head ref
  • 13 commits
  • 12 files changed
  • 4 contributors

Commits on Apr 1, 2022

  1. update toolkit.fluxcd.io docs link 

    Signed-off-by: Daniel Holbach <daniel@weave.works>
    Daniel Holbach committed Apr 1, 2022
    Copy the full SHA
    033efe9 View commit details

Commits on Apr 5, 2022

  1. Merge pull request #610 from dholbach/update-link 

    update toolkit.fluxcd.io docs link
    @stefanprodan
    stefanprodan authored Apr 5, 2022

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    4da17e1 View commit details

Commits on Apr 14, 2022

  1. controllers: improve decryptor and add tests 

    - Refactored recursion while iterating over Kustomization files.
  References of files that have been visited are cached, and not
  visited again. In addition, symlinks are confirmed to not traverse
  outside the working directory.
- Optimized various bits around (un)marshalling (encrypted) data, and
  YAML -> JSON -> YAML roundtrips are prevented where not required.
- Added support for decrypting INI Kustomize EnvSource references using
  the dedicated SOPS store for the format.
- Introduced support for decrypting Kustomize FileSources:
  https://pkg.go.dev/sigs.k8s.io/kustomize@v1.0.2/pkg/types#DataSources

Signed-off-by: Hidde Beydals <hello@hidde.co>
    @hiddeco
    hiddeco committed Apr 14, 2022

    Unverified

    This commit is not signed, but one or more authors requires that any commit attributed to them is signed.
    Learn about vigilant mode
    Copy the full SHA
    105ebd9 View commit details

  2. Merge pull request #619 from fluxcd/kustomize-decryptor-impr

    @hiddeco
    hiddeco authored Apr 14, 2022

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    ad91006 View commit details

Commits on Apr 15, 2022

  1. controllers: use own Kustomize FS implementation 

    For details, see: fluxcd/pkg#262

Signed-off-by: Hidde Beydals <hello@hidde.co>
    @hiddeco
    hiddeco committed Apr 15, 2022

    Unverified

    This commit is not signed, but one or more authors requires that any commit attributed to them is signed.
    Learn about vigilant mode
    Copy the full SHA
    f4528fb View commit details

  2. Merge pull request #620 from fluxcd/fssecure

    @hiddeco
    hiddeco authored Apr 15, 2022

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    39872cd View commit details

  3. api: update dependencies 

    - github.com/fluxcd/pkg/apis/kustomize to v0.3.3
- github.com/fluxcd/pkg/apis/meta to v0.12.2
- k8s.io/apiextensions-apiserver to v0.23.5
- k8s.io/apimachinery to v0.23.5
- sigs.k8s.io/controller-runtime to v0.11.2

Signed-off-by: Hidde Beydals <hello@hidde.co>
    @hiddeco
    hiddeco committed Apr 15, 2022

    Unverified

    This commit is not signed, but one or more authors requires that any commit attributed to them is signed.
    Learn about vigilant mode
    Copy the full SHA
    1499631 View commit details

  4. Update dependencies 

    Azure SDK dependencies cannot be updated, as this requires us to move to
Go 1.18.

- github.com/fluxcd/pkg/apis/kustomize to version 0.3.3
- github.com/fluxcd/pkg/apis/meta to version 0.12.2
- github.com/fluxcd/pkg/runtime to version 0.14.1
- github.com/fluxcd/pkg/ssa to version 0.15.2
- github.com/hashicorp/go-retryablehttp to version 0.7.1
- github.com/hashicorp/vault/api to version 1.5.0
- github.com/onsi/gomega to version 1.19.0
- golang.org/x/net to version 0.0.0-20220412020605-290c469a71a5
- sigs.k8s.io/cli-utils to version 0.29.4

Signed-off-by: Hidde Beydals <hello@hidde.co>
    @hiddeco
    hiddeco committed Apr 15, 2022

    Unverified

    This commit is not signed, but one or more authors requires that any commit attributed to them is signed.
    Learn about vigilant mode
    Copy the full SHA
    f0bcd0c View commit details

  5. Merge pull request #621 from fluxcd/update-deps

    @hiddeco
    hiddeco authored Apr 15, 2022

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    2f41b20 View commit details

Commits on Apr 19, 2022

  1. Update dependencies 

    - github.com/fluxcd/source-controller/api to v0.24.0
- golang.org/x/net to v0.0.0-20220418201149-a630d4f3e7a2

Signed-off-by: Hidde Beydals <hello@hidde.co>
    @hiddeco
    hiddeco committed Apr 19, 2022

    Unverified

    This commit is not signed, but one or more authors requires that any commit attributed to them is signed.
    Learn about vigilant mode
    Copy the full SHA
    87ea78c View commit details

  2. Merge pull request #623 from fluxcd/update-deps

    @hiddeco
    hiddeco authored Apr 19, 2022

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    31a8fb4 View commit details

  3. Release v0.24.0 

    Signed-off-by: Hidde Beydals <hello@hidde.co>
    @hiddeco
    hiddeco committed Apr 19, 2022

    Unverified

    This commit is not signed, but one or more authors requires that any commit attributed to them is signed.
    Learn about vigilant mode
    Copy the full SHA
    4340d2f View commit details

  4. Merge pull request #624 from fluxcd/release-v0.24.0

    @hiddeco
    hiddeco authored Apr 19, 2022

    Verified

    This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
    GPG key ID: 4AEE18F83AFDEB23
    Expired
    Verified
    Learn about vigilant mode
    Copy the full SHA
    69a9e9d View commit details
Showing with 2,123 additions and 269 deletions.
  1. +22 −1 CHANGELOG.md
  2. +1 −1 Makefile
  3. +5 −5 api/go.mod
  4. +17 −17 api/go.sum
  5. +2 −2 config/default/kustomization.yaml
  6. +1 −1 config/manager/kustomization.yaml
  7. +13 −16 controllers/kustomization_controller.go
  8. +567 −151 controllers/kustomization_decryptor.go
  9. +1,415 −2 controllers/kustomization_decryptor_test.go
  10. +23 −9 controllers/kustomization_generator.go
  11. +19 −18 go.mod
  12. +38 −46 go.sum
23 changes: 22 additions & 1 deletion CHANGELOG.md
View file
Original file line number Diff line number Diff line change
@@ -2,6 +2,27 @@

All notable changes to this project are documented in this file.

## 0.24.0

**Release date:** 2022-04-19

This prerelease matures the Kustomize decryptor service, which handles the
actual decryption of SOPS' encrypted Secrets, and now allows decrypting
[file sources](https://pkg.go.dev/sigs.k8s.io/kustomize@v1.0.2/pkg/types#DataSources)
referenced in Kustomization files.

In addition, Kustomize now operates using our own file system implementation,
and dependencies have been updated to their latest versions.

Improvements:
- controllers: improve decryptor and add tests
[#619](https://github.com/fluxcd/kustomize-controller/pull/619)
- controllers: use own Kustomize FS implementation
[#620](https://github.com/fluxcd/kustomize-controller/pull/620)
- Update dependencies
[#621](https://github.com/fluxcd/kustomize-controller/pull/621)
[#622](https://github.com/fluxcd/kustomize-controller/pull/622)

## 0.23.0

**Release date:** 2022-04-05
@@ -1244,7 +1265,7 @@ using the [notification.fluxcd.io API](https://github.com/fluxcd/notification-co
**Release date:** 2020-06-24

This is the first prerelease ready for public testing. To get started
testing, see the [GitOps Toolkit guide](https://toolkit.fluxcd.io/get-started/).
testing, see the [GitOps Toolkit guide](https://fluxcd.io/docs/get-started/).

## 0.0.1-beta.2

2 changes: 1 addition & 1 deletion Makefile
View file
Original file line number Diff line number Diff line change
@@ -2,7 +2,7 @@
IMG ?= fluxcd/kustomize-controller:latest
# Produce CRDs that work back to Kubernetes 1.16
CRD_OPTIONS ?= crd:crdVersions=v1
SOURCE_VER ?= v0.22.3
SOURCE_VER ?= $(shell go list -m all | grep github.com/fluxcd/source-controller/api | awk '{print $$2}')

# Use the same version of SOPS already referenced on go.mod
SOPS_VER := $(shell go list -m all | grep go.mozilla.org/sops | awk '{print $$2}')
10 changes: 5 additions & 5 deletions api/go.mod
View file
Original file line number Diff line number Diff line change
@@ -3,11 +3,11 @@ module github.com/fluxcd/kustomize-controller/api
go 1.17

require (
github.com/fluxcd/pkg/apis/kustomize v0.3.2
github.com/fluxcd/pkg/apis/meta v0.12.1
k8s.io/apiextensions-apiserver v0.23.4
k8s.io/apimachinery v0.23.4
sigs.k8s.io/controller-runtime v0.11.1
github.com/fluxcd/pkg/apis/kustomize v0.3.3
github.com/fluxcd/pkg/apis/meta v0.12.2
k8s.io/apiextensions-apiserver v0.23.5
k8s.io/apimachinery v0.23.5
sigs.k8s.io/controller-runtime v0.11.2
)

require (
34 changes: 17 additions & 17 deletions api/go.sum
View file
Original file line number Diff line number Diff line change
@@ -120,10 +120,10 @@ github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7
github.com/evanphx/json-patch v4.12.0+incompatible/go.mod h1:50XU6AFN0ol/bzJsmQLiYLvXMP4fmwYFNcr97nuDLSk=
github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
github.com/fluxcd/pkg/apis/kustomize v0.3.2 h1:ULoAwOOekHf5cy6mYIwL+K6v8/cfcNVVbwfIPgWjdjg=
github.com/fluxcd/pkg/apis/kustomize v0.3.2/go.mod h1:p8iAH5TeqMBnnxkkpCNNDvWYfKlNRx89a6WKOo+hJHA=
github.com/fluxcd/pkg/apis/meta v0.12.1 h1:m5PfKAqbqWBvGp9+JRj1sv+xNkGsHwUVf+3rJ8wm6SE=
github.com/fluxcd/pkg/apis/meta v0.12.1/go.mod h1:f8YVt70/KAhqzZ7xxhjvqyzKubOYx2pAbakb/FfCEg8=
github.com/fluxcd/pkg/apis/kustomize v0.3.3 h1:bPN29SdVzWl0yhgivuf/83IAe2R6vUuDVcB3LzyVU8E=
github.com/fluxcd/pkg/apis/kustomize v0.3.3/go.mod h1:5HTOFZfQFVMMqR2rvuxpbZhpb+sQpcTT6RCQZOhjFzA=
github.com/fluxcd/pkg/apis/meta v0.12.2 h1:AiKAZxLyPtV150y63WC+mL1Qm4x5qWQmW6r4mLy1i8c=
github.com/fluxcd/pkg/apis/meta v0.12.2/go.mod h1:Z26X5uTU5LxAyWETGueRQY7TvdPaGfKU7Wye9bdUlho=
github.com/form3tech-oss/jwt-go v3.2.2+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
github.com/form3tech-oss/jwt-go v3.2.3+incompatible/go.mod h1:pbq4aXjuKjdthFRnoDwaVPLA+WlJuPGy+QneDUgJi2k=
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
@@ -890,16 +890,16 @@ honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWh
honnef.co/go/tools v0.0.1-2019.2.3/go.mod h1:a3bituU0lyd329TUQxRnasdCoJDkEUEAqEt0JzvZhAg=
honnef.co/go/tools v0.0.1-2020.1.3/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
honnef.co/go/tools v0.0.1-2020.1.4/go.mod h1:X/FiERA/W4tHapMX5mGpAtMSVEeEUOyHaw9vFzvIQ3k=
k8s.io/api v0.23.4 h1:85gnfXQOWbJa1SiWGpE9EEtHs0UVvDyIsSMpEtl2D4E=
k8s.io/api v0.23.4/go.mod h1:i77F4JfyNNrhOjZF7OwwNJS5Y1S9dpwvb9iYRYRczfI=
k8s.io/apiextensions-apiserver v0.23.4 h1:AFDUEu/yEf0YnuZhqhIFhPLPhhcQQVuR1u3WCh0rveU=
k8s.io/apiextensions-apiserver v0.23.4/go.mod h1:TWYAKymJx7nLMxWCgWm2RYGXHrGlVZnxIlGnvtfYu+g=
k8s.io/apimachinery v0.23.4 h1:fhnuMd/xUL3Cjfl64j5ULKZ1/J9n8NuQEgNL+WXWfdM=
k8s.io/apimachinery v0.23.4/go.mod h1:BEuFMMBaIbcOqVIJqNZJXGFTP4W6AycEpb5+m/97hrM=
k8s.io/apiserver v0.23.4/go.mod h1:A6l/ZcNtxGfPSqbFDoxxOjEjSKBaQmE+UTveOmMkpNc=
k8s.io/client-go v0.23.4/go.mod h1:PKnIL4pqLuvYUK1WU7RLTMYKPiIh7MYShLshtRY9cj0=
k8s.io/code-generator v0.23.4/go.mod h1:S0Q1JVA+kSzTI1oUvbKAxZY/DYbA/ZUb4Uknog12ETk=
k8s.io/component-base v0.23.4/go.mod h1:8o3Gg8i2vnUXGPOwciiYlkSaZT+p+7gA9Scoz8y4W4E=
k8s.io/api v0.23.5 h1:zno3LUiMubxD/V1Zw3ijyKO3wxrhbUF1Ck+VjBvfaoA=
k8s.io/api v0.23.5/go.mod h1:Na4XuKng8PXJ2JsploYYrivXrINeTaycCGcYgF91Xm8=
k8s.io/apiextensions-apiserver v0.23.5 h1:5SKzdXyvIJKu+zbfPc3kCbWpbxi+O+zdmAJBm26UJqI=
k8s.io/apiextensions-apiserver v0.23.5/go.mod h1:ntcPWNXS8ZPKN+zTXuzYMeg731CP0heCTl6gYBxLcuQ=
k8s.io/apimachinery v0.23.5 h1:Va7dwhp8wgkUPWsEXk6XglXWU4IKYLKNlv8VkX7SDM0=
k8s.io/apimachinery v0.23.5/go.mod h1:BEuFMMBaIbcOqVIJqNZJXGFTP4W6AycEpb5+m/97hrM=
k8s.io/apiserver v0.23.5/go.mod h1:7wvMtGJ42VRxzgVI7jkbKvMbuCbVbgsWFT7RyXiRNTw=
k8s.io/client-go v0.23.5/go.mod h1:flkeinTO1CirYgzMPRWxUCnV0G4Fbu2vLhYCObnt/r4=
k8s.io/code-generator v0.23.5/go.mod h1:S0Q1JVA+kSzTI1oUvbKAxZY/DYbA/ZUb4Uknog12ETk=
k8s.io/component-base v0.23.5/go.mod h1:c5Nq44KZyt1aLl0IpHX82fhsn84Sb0jjzwjpcA42bY0=
k8s.io/gengo v0.0.0-20210813121822-485abfe95c7c/go.mod h1:FiNAH4ZV3gBg2Kwh89tzAEV2be7d5xI0vBa/VySYy3E=
k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
k8s.io/klog/v2 v2.2.0/go.mod h1:Od+F08eJP+W3HUb4pSrPpgp9DGU4GzlpG/TmITuYh/Y=
@@ -914,9 +914,9 @@ k8s.io/utils v0.0.0-20220210201930-3a6ce19ff2f9/go.mod h1:jPW/WVKK9YHAvNhRxK0md/
rsc.io/binaryregexp v0.2.0/go.mod h1:qTv7/COck+e2FymRvadv62gMdZztPaShugOCi3I+8D8=
rsc.io/quote/v3 v3.1.0/go.mod h1:yEA65RcK8LyAZtP9Kv3t0HmxON59tX3rD+tICJqUlj0=
rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA=
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.27/go.mod h1:tq2nT0Kx7W+/f2JVE+zxYtUhdjuELJkVpNz+x/QN5R4=
sigs.k8s.io/controller-runtime v0.11.1 h1:7YIHT2QnHJArj/dk9aUkYhfqfK5cIxPOX5gPECfdZLU=
sigs.k8s.io/controller-runtime v0.11.1/go.mod h1:KKwLiTooNGu+JmLZGn9Sl3Gjmfj66eMbCQznLP5zcqA=
sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.0.30/go.mod h1:fEO7lRTdivWO2qYVCVG7dEADOMo/MLDCVr8So2g88Uw=
sigs.k8s.io/controller-runtime v0.11.2 h1:H5GTxQl0Mc9UjRJhORusqfJCIjBO8UtUxGggCwL1rLA=
sigs.k8s.io/controller-runtime v0.11.2/go.mod h1:P6QCzrEjLaZGqHsfd+os7JQ+WFZhvB8MRFsn4dWF7O4=
sigs.k8s.io/json v0.0.0-20211020170558-c049b76a60c6/go.mod h1:p4QtZmO4uMYipTQNzagwnNoseA6OxSUutVw05NhYDRs=
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2 h1:kDi4JBNAsJWfz1aEXhO8Jg87JJaPNLh5tIzYHgStQ9Y=
sigs.k8s.io/json v0.0.0-20211208200746-9f7c6b3444d2/go.mod h1:B+TnT182UBxE84DiCz4CVE26eOSDAeYCpfDnC2kdKMY=
4 changes: 2 additions & 2 deletions config/default/kustomization.yaml
View file
Original file line number Diff line number Diff line change
@@ -2,8 +2,8 @@ apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: kustomize-system
resources:
- https://github.com/fluxcd/source-controller/releases/download/v0.22.3/source-controller.crds.yaml
- https://github.com/fluxcd/source-controller/releases/download/v0.22.3/source-controller.deployment.yaml
- https://github.com/fluxcd/source-controller/releases/download/v0.24.0/source-controller.crds.yaml
- https://github.com/fluxcd/source-controller/releases/download/v0.24.0/source-controller.deployment.yaml
- ../crd
- ../rbac
- ../manager
2 changes: 1 addition & 1 deletion config/manager/kustomization.yaml
View file
Original file line number Diff line number Diff line change
@@ -5,4 +5,4 @@ resources:
images:
- name: fluxcd/kustomize-controller
newName: fluxcd/kustomize-controller
newTag: v0.23.0
newTag: v0.24.0
29 changes: 13 additions & 16 deletions controllers/kustomization_controller.go
View file
Original file line number Diff line number Diff line change
@@ -52,7 +52,6 @@ import (
"sigs.k8s.io/controller-runtime/pkg/predicate"
"sigs.k8s.io/controller-runtime/pkg/reconcile"
"sigs.k8s.io/controller-runtime/pkg/source"
"sigs.k8s.io/kustomize/kyaml/filesys"

apiacl "github.com/fluxcd/pkg/apis/acl"
"github.com/fluxcd/pkg/apis/meta"
@@ -357,7 +356,7 @@ func (r *KustomizationReconciler) reconcile(
}

// generate kustomization.yaml if needed
err = r.generate(kustomization, dirPath)
err = r.generate(kustomization, tmpDir, dirPath)
if err != nil {
return kustomizev1.KustomizationNotReady(
kustomization,
@@ -368,7 +367,7 @@ func (r *KustomizationReconciler) reconcile(
}

// build the kustomization
resources, err := r.build(ctx, kustomization, dirPath)
resources, err := r.build(ctx, tmpDir, kustomization, dirPath)
if err != nil {
return kustomizev1.KustomizationNotReady(
kustomization,
@@ -629,31 +628,29 @@ func (r *KustomizationReconciler) getSource(ctx context.Context, kustomization k
return source, nil
}

func (r *KustomizationReconciler) generate(kustomization kustomizev1.Kustomization, dirPath string) error {
gen := NewGenerator(kustomization)
func (r *KustomizationReconciler) generate(kustomization kustomizev1.Kustomization, workDir string, dirPath string) error {
gen := NewGenerator(workDir, kustomization)
return gen.WriteFile(dirPath)
}

func (r *KustomizationReconciler) build(ctx context.Context, kustomization kustomizev1.Kustomization, dirPath string) ([]byte, error) {
dec, cleanup, err := NewTempDecryptor(r.Client, kustomization)
func (r *KustomizationReconciler) build(ctx context.Context, workDir string, kustomization kustomizev1.Kustomization, dirPath string) ([]byte, error) {
dec, cleanup, err := NewTempDecryptor(workDir, r.Client, kustomization)
if err != nil {
return nil, err
}
defer cleanup()

// import OpenPGP keys if any
// Import decryption keys
if err := dec.ImportKeys(ctx); err != nil {
return nil, err
}

fs := filesys.MakeFsOnDisk()
// decrypt .env files before building kustomization
if kustomization.Spec.Decryption != nil {
if err = dec.decryptDotEnvFiles(dirPath); err != nil {
return nil, fmt.Errorf("error decrypting .env file: %w", err)
}
// Decrypt Kustomize EnvSources files before build
if err = dec.DecryptEnvSources(dirPath); err != nil {
return nil, fmt.Errorf("error decrypting env sources: %w", err)
}
m, err := buildKustomization(fs, dirPath)

m, err := secureBuildKustomization(workDir, dirPath)
if err != nil {
return nil, fmt.Errorf("kustomize build failed: %w", err)
}
@@ -666,7 +663,7 @@ func (r *KustomizationReconciler) build(ctx context.Context, kustomization kusto

// check if resources are encrypted and decrypt them before generating the final YAML
if kustomization.Spec.Decryption != nil {
outRes, err := dec.Decrypt(res)
outRes, err := dec.DecryptResource(res)
if err != nil {
return nil, fmt.Errorf("decryption failed for '%s': %w", res.GetName(), err)
}
Loading