This repository has been archived by the owner on Nov 1, 2022. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 262
/
git.go
414 lines (352 loc) · 12.4 KB
/
git.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
package chartsync
import (
"context"
"errors"
"fmt"
"net/url"
"strings"
"sync"
"time"
"github.com/fluxcd/flux/pkg/git"
"github.com/go-kit/kit/log"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/labels"
corev1client "k8s.io/client-go/kubernetes/typed/core/v1"
"k8s.io/client-go/tools/cache"
v1 "github.com/fluxcd/helm-operator/pkg/apis/helm.fluxcd.io/v1"
lister "github.com/fluxcd/helm-operator/pkg/client/listers/helm.fluxcd.io/v1"
)
// Various (final) errors.
var (
ErrReleasesForMirror = errors.New("failed to get HelmRelease resources for mirror")
ErrNoMirror = errors.New("no existing git mirror found")
ErrMirrorSync = errors.New("failed syncing git mirror")
)
// ReleaseQueue is an add-only `workqueue.RateLimitingInterface`
type ReleaseQueue interface {
AddRateLimited(item interface{})
}
// GitConfig holds the configuration for git operations.
type GitConfig struct {
GitTimeout time.Duration
GitPollInterval time.Duration
GitDefaultRef string
}
// GitChartSync syncs `sourceRef`s with their mirrors, and queues
// updates for `v1.HelmRelease`s the sync changes are relevant for.
type GitChartSync struct {
logger log.Logger
config GitConfig
coreV1Client corev1client.CoreV1Interface
lister lister.HelmReleaseLister
mirrors *git.Mirrors
releaseSourcesMu sync.RWMutex
releaseSourcesByID map[string]sourceRef
releaseQueue ReleaseQueue
}
// sourceRef is used for book keeping, so that we know when a
// signal we receive from a mirror is an actual update for a
// release, and if the source we hold is still the one referred
// to in the `v1.HelmRelease`.
type sourceRef struct {
mirror string
remote string
ref string
head string
}
// forHelmRelease returns true if the given `v1.HelmRelease`s
// `v1.GitChartSource` matches the sourceRef.
func (c sourceRef) forHelmRelease(hr *v1.HelmRelease, defaultGitRef string) bool {
if hr == nil || hr.Spec.GitChartSource == nil {
return false
}
// reject git source if URL and path are missing
if hr.Spec.GitURL == "" || hr.Spec.Path == "" {
return false
}
return c.mirror == mirrorName(hr) && c.remote == hr.Spec.GitURL && c.ref == hr.Spec.GitChartSource.RefOrDefault(defaultGitRef)
}
func NewGitChartSync(logger log.Logger,
coreV1Client corev1client.CoreV1Interface, lister lister.HelmReleaseLister, cfg GitConfig, queue ReleaseQueue) *GitChartSync {
return &GitChartSync{
logger: logger,
config: cfg,
coreV1Client: coreV1Client,
lister: lister,
mirrors: git.NewMirrors(),
releaseSourcesByID: make(map[string]sourceRef),
releaseQueue: queue,
}
}
// Run starts the mirroring of git repositories, and processes mirror
// changes on signal, scheduling a release for a `HelmRelease` resource
// when the update is relevant to the release.
func (c *GitChartSync) Run(stopCh <-chan struct{}, errCh chan error, wg *sync.WaitGroup) {
c.logger.Log("info", "starting sync of git chart sources")
wg.Add(1)
go func() {
for {
select {
case changed := <-c.mirrors.Changes():
for mirrorName := range changed {
repo, ok := c.mirrors.Get(mirrorName)
hrs, err := c.helmReleasesForMirror(mirrorName)
if err != nil {
c.logger.Log("error", ErrReleasesForMirror.Error(), "mirror", mirrorName, "err", err)
continue
}
// We received a signal from a no longer existing
// mirror.
if !ok {
if len(hrs) == 0 {
// If there are no references to it either,
// just continue with the next mirror...
continue
}
c.logger.Log("warning", ErrNoMirror.Error(), "mirror", mirrorName)
for _, hr := range hrs {
c.maybeMirror(mirrorName, hr.Spec.GitChartSource, hr.Namespace)
}
// Wait for the signal from the newly requested mirror...
continue
}
// We received a signal from a mirror, but no
// resource refers to it anymore.
if ok && len(hrs) == 0 {
// Garbage collect the mirror.
c.mirrors.StopOne(mirrorName)
continue
}
c.processChangedMirror(mirrorName, repo, hrs)
}
case <-stopCh:
c.logger.Log("info", "stopping sync of git chart sources")
c.mirrors.StopAllAndWait()
wg.Done()
return
}
}
}()
}
// GetMirrorCopy returns a newly exported copy of the git mirror at the
// recorded HEAD and a string with the HEAD commit hash, or an error.
func (c *GitChartSync) GetMirrorCopy(hr *v1.HelmRelease) (*git.Export, string, error) {
mirror := mirrorName(hr)
repo, ok := c.mirrors.Get(mirror)
if !ok {
// We did not find a mirror; request one, return, and wait for
// signal.
c.maybeMirror(mirror, hr.Spec.GitChartSource, hr.Namespace)
return nil, "", ChartNotReadyError{ErrNoMirror}
}
s, ok, err := c.sync(hr, mirror, repo)
if err != nil {
return nil, "", err
}
ctx, cancel := context.WithTimeout(context.Background(), c.config.GitTimeout)
defer cancel()
export, err := repo.Export(ctx, s.head)
if err != nil {
return nil, "", ChartUnavailableError{err}
}
return export, s.head, nil
}
// Delete cleans up the source reference for the given `v1.HelmRelease`,
// this includes the mirror if there is no reference to it from sources.
// It returns a boolean indicating a successful removal (`true` if so,
// `false` otherwise).
func (c *GitChartSync) Delete(hr *v1.HelmRelease) bool {
c.releaseSourcesMu.Lock()
defer c.releaseSourcesMu.Unlock()
// Attempt to get the source from store, and delete it if found.
source, ok := c.releaseSourcesByID[hr.ResourceID().String()]
if ok {
delete(c.releaseSourcesByID, hr.ResourceID().String())
if hrs, err := c.helmReleasesForMirror(source.mirror); err == nil && len(hrs) == 0 {
// The mirror is no longer in use by any source;
// stop and delete the mirror.
c.mirrors.StopOne(source.mirror)
}
}
return ok
}
// SyncMirror instructs the helmrelease's git mirror to sync from its upstream
func (c *GitChartSync) SyncMirror(hr *v1.HelmRelease) error {
mirror := mirrorName(hr)
c.logger.Log("info", "starting sync of git mirror", "mirror", mirror)
repo, ok := c.mirrors.Get(mirror)
if !ok {
return ChartNotReadyError{ErrNoMirror}
}
ctx, cancel := context.WithTimeout(context.Background(), c.config.GitTimeout)
repo.Refresh(ctx)
cancel()
c.logger.Log("info", "finished syncing git mirror", "mirror", mirror)
return nil
}
// SyncMirrors instructs all git mirrors to sync from their respective
// upstreams.
func (c *GitChartSync) SyncMirrors() {
c.logger.Log("info", "starting sync of git mirrors")
for _, err := range c.mirrors.RefreshAll(c.config.GitTimeout) {
c.logger.Log("error", ErrMirrorSync.Error(), "err", err)
}
c.logger.Log("info", "finished syncing git mirror")
}
// processChangedMirror syncs all given `v1.HelmRelease`s with the
// mirror we received a change signal for and schedules a release,
// but only if the sync indicated the change was relevant.
func (c *GitChartSync) processChangedMirror(mirror string, repo *git.Repo, hrs []*v1.HelmRelease) {
for _, hr := range hrs {
if _, ok, _ := c.sync(hr, mirror, repo); ok {
cacheKey, err := cache.MetaNamespaceKeyFunc(hr.GetObjectMeta())
if err != nil {
continue // this should never happen
}
// Schedule release sync by adding it to the queue.
c.releaseQueue.AddRateLimited(cacheKey)
}
}
}
// sync synchronizes the record we have for the given `v1.HelmRelease`
// with the given mirror. It always updates the HEAD record in the
// `sourceRef`, but only returns `true` if the update was relevant for
// the release (e.g. a change in git the chart source path, or a new
// record). In case of failure it returns an error.
func (c *GitChartSync) sync(hr *v1.HelmRelease, mirrorName string, repo *git.Repo) (sourceRef, bool, error) {
source := hr.Spec.GitChartSource
if source == nil {
return sourceRef{}, false, nil
}
if status, err := repo.Status(); status != git.RepoReady {
return sourceRef{}, false, ChartNotReadyError{err}
}
c.releaseSourcesMu.RLock()
s, ok := c.releaseSourcesByID[hr.ResourceID().String()]
c.releaseSourcesMu.RUnlock()
var changed bool
if !ok || !s.forHelmRelease(hr, c.config.GitDefaultRef) {
s = sourceRef{mirror: mirrorName, remote: source.GitURL, ref: source.RefOrDefault(c.config.GitDefaultRef)}
changed = true
}
ctx, cancel := context.WithTimeout(context.Background(), c.config.GitTimeout)
head, err := repo.Revision(ctx, s.ref)
cancel()
if err != nil {
return sourceRef{}, false, ChartUnavailableError{err}
}
if !changed {
// If the head still equals to what is in our books, there are no changes.
if s.head == head {
return s, false, nil
}
// Check if the mirror has seen commits in paths we are interested in for
// this release.
ctx, cancel = context.WithTimeout(context.Background(), c.config.GitTimeout)
commits, err := repo.CommitsBetween(ctx, s.head, head, false, source.Path)
cancel()
if err != nil {
return sourceRef{}, false, ChartUnavailableError{err}
}
changed = len(commits) > 0
}
// Update the HEAD reference
s.head = head
c.releaseSourcesMu.Lock()
c.releaseSourcesByID[hr.ResourceID().String()] = s
c.releaseSourcesMu.Unlock()
return s, changed, nil
}
// maybeMirror requests a new mirror for the given remote. The return value
// indicates whether the repo was already present (`true` if so,
// `false` otherwise).
func (c *GitChartSync) maybeMirror(mirrorName string, source *v1.GitChartSource, namespace string) bool {
gitURL := source.GitURL
var err error
if source.SecretRef != nil && source.SecretRef.Namespace == "" {
source.SecretRef.Namespace = namespace
}
if gitURL, err = c.addAuthForHTTPS(gitURL, source.SecretRef); err != nil {
c.logger.Log("error", GitAuthError{err}.Error())
return false
}
ok := c.mirrors.Mirror(
mirrorName, git.Remote{URL: gitURL}, git.Timeout(c.config.GitTimeout),
git.PollInterval(c.config.GitPollInterval), git.ReadOnly)
if !ok {
c.logger.Log("info", "started mirroring new remote", "remote", source.GitURL, "mirror", mirrorName)
}
return ok
}
// helmReleasesForMirror returns a slice of `HelmRelease`s that make
// use of the given mirror.
func (c *GitChartSync) helmReleasesForMirror(mirror string) ([]*v1.HelmRelease, error) {
hrs, err := c.lister.List(labels.Everything())
if err != nil {
return nil, err
}
mHrs := make([]*v1.HelmRelease, 0)
for _, hr := range hrs {
if m := mirrorName(hr); m == "" || m != mirror {
continue
}
mHrs = append(mHrs, hr.DeepCopy()) // to prevent modifying the (shared) lister store
}
return mHrs, nil
}
// mirrorName returns the name of the mirror for the given
// `v1.HelmRelease`.
func mirrorName(hr *v1.HelmRelease) string {
if hr != nil && hr.Spec.GitChartSource != nil {
if hr.Spec.GitChartSource.SecretRef == nil {
return hr.Spec.GitURL
}
return fmt.Sprintf("%s/%s/%s", hr.GetNamespace(), hr.Spec.GitChartSource.SecretRef.Name, hr.Spec.GitURL)
}
return ""
}
// addAuthForHTTPS will attempt to add basic auth credentials from the
// given secretRef to the given gitURL and return the result, but only
// if the scheme of the URL is HTTPS. In case of a failure it returns
// an error.
func (c *GitChartSync) addAuthForHTTPS(gitURL string, secretRef *v1.ObjectReference) (string, error) {
if secretRef == nil {
return gitURL, nil
}
modifiedURL, err := url.Parse(strings.ToLower(gitURL))
if err != nil {
return "", err
}
if modifiedURL.Scheme != "https" {
return gitURL, nil
}
username, password, err := c.getAuthFromSecret(secretRef)
if err != nil {
return "", err
}
modifiedURL.User = url.UserPassword(username, password)
return modifiedURL.String(), nil
}
// getAuthFromSecret resolve the given `secretRef` from the given namespace
// using the core v1 secrets client, and return the username and password.
// If this errors, or the secret does not contain the expected keys, an
// error is returned.
func (c *GitChartSync) getAuthFromSecret(secretRef *v1.ObjectReference) (string, string, error) {
secretName := secretRef.Name
ns := secretRef.Namespace
secret, err := c.coreV1Client.Secrets(ns).Get(context.Background(), secretName, metav1.GetOptions{})
if err != nil {
return "", "", err
}
d, ok := secret.Data["username"]
if !ok {
return "", "", fmt.Errorf("could not find username key in secret %s/%s", ns, secretName)
}
username := string(d)
d, ok = secret.Data["password"]
if !ok {
return "", "", fmt.Errorf("could not find password key in secret %s/%s", ns, secretName)
}
password := string(d)
return username, password, nil
}