Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: maintain agent mutate even when already mutated #3166

Open
wants to merge 5 commits into
base: main
Choose a base branch
from
+239 −78
Open

fix: maintain agent mutate even when already mutated #3166

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d75c6b1
fix: maintain agent mutate even when already mutated
a1994sc Oct 31, 2024
edd3b56
Merge branch 'main' into main
a1994sc Nov 7, 2024
b8e9f77
Updated logic for when to mutate
a1994sc Nov 8, 2024
a93f280
Merge remote-tracking branch 'origin-zarf/main'
a1994sc Nov 9, 2024
db8c955
Merge branch 'main' into main
a1994sc Nov 15, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 43 additions & 0 deletions src/internal/agent/hooks/argocd-application_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@ import (
"github.com/zarf-dev/zarf/src/internal/agent/operations"
"github.com/zarf-dev/zarf/src/types"
v1 "k8s.io/api/admission/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
"k8s.io/apimachinery/pkg/runtime"
)

Expand Down Expand Up @@ -78,6 +79,48 @@ func TestArgoAppWebhook(t *testing.T) {
},
code: http.StatusOK,
},
{
name: "should mutate even if agent patched",
admissionReq: createArgoAppAdmissionRequest(t, v1.Create, &Application{
ObjectMeta: metav1.ObjectMeta{
Labels: map[string]string{
"zarf-agent": "patched",
},
},
Spec: ApplicationSpec{
Source: &ApplicationSource{RepoURL: "https://diff-git-server.com/peanuts"},
Sources: []ApplicationSource{
{
RepoURL: "https://diff-git-server.com/cashews",
},
{
RepoURL: "https://diff-git-server.com/almonds",
},
},
},
}),
patch: []operations.PatchOperation{
operations.ReplacePatchOperation(
"/spec/source/repoURL",
"https://git-server.com/a-push-user/peanuts-3883081014",
),
operations.ReplacePatchOperation(
"/spec/sources/0/repoURL",
"https://git-server.com/a-push-user/cashews-580170494",
),
operations.ReplacePatchOperation(
"/spec/sources/1/repoURL",
"https://git-server.com/a-push-user/almonds-640159520",
),
operations.ReplacePatchOperation(
"/metadata/labels",
map[string]string{
"zarf-agent": "patched",
},
),
},
code: http.StatusOK,
},
{
name: "should return internal server error on bad git URL",
admissionReq: createArgoAppAdmissionRequest(t, v1.Create, &Application{
Expand Down
38 changes: 38 additions & 0 deletions src/internal/agent/hooks/argocd-repository_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,44 @@ func TestArgoRepoWebhook(t *testing.T) {
},
code: http.StatusOK,
},
{
name: "should mutate even if agent patched",
admissionReq: createArgoRepoAdmissionRequest(t, v1.Create, &corev1.Secret{
ObjectMeta: metav1.ObjectMeta{
Labels: map[string]string{
"argocd.argoproj.io/secret-type": "repository",
"zarf-agent": "patched",
},
Name: "argo-repo-secret",
Namespace: "argo",
},
Data: map[string][]byte{
"url": []byte("https://diff-git-server.com/podinfo"),
},
}),
patch: []operations.PatchOperation{
operations.ReplacePatchOperation(
"/data/url",
b64.StdEncoding.EncodeToString([]byte("https://git-server.com/a-push-user/podinfo-1868163476")),
),
operations.ReplacePatchOperation(
"/data/username",
b64.StdEncoding.EncodeToString([]byte(state.GitServer.PullUsername)),
),
operations.ReplacePatchOperation(
"/data/password",
b64.StdEncoding.EncodeToString([]byte(state.GitServer.PullPassword)),
),
operations.ReplacePatchOperation(
"/metadata/labels",
map[string]string{
"argocd.argoproj.io/secret-type": "repository",
"zarf-agent": "patched",
},
),
},
code: http.StatusOK,
},
{
name: "matching hostname on update should stay the same, but secret should be added",
admissionReq: createArgoRepoAdmissionRequest(t, v1.Update, &corev1.Secret{
Expand Down
31 changes: 31 additions & 0 deletions src/internal/agent/hooks/flux-gitrepo_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,6 +73,37 @@ func TestFluxMutationWebhook(t *testing.T) {
},
code: http.StatusOK,
},
{
name: "should mutate even if agent patched",
admissionReq: createFluxGitRepoAdmissionRequest(t, v1.Create, &flux.GitRepository{
ObjectMeta: metav1.ObjectMeta{
Name: "mutate-this",
Labels: map[string]string{
"zarf-agent": "patched",
},
},
Spec: flux.GitRepositorySpec{
URL: "https://github.com/stefanprodan/podinfo.git",
},
}),
patch: []operations.PatchOperation{
operations.ReplacePatchOperation(
"/spec/url",
"https://git-server.com/a-push-user/podinfo-1646971829.git",
),
operations.AddPatchOperation(
"/spec/secretRef",
fluxmeta.LocalObjectReference{Name: config.ZarfGitServerSecretName},
),
operations.ReplacePatchOperation(
"/metadata/labels",
map[string]string{
"zarf-agent": "patched",
},
),
},
code: http.StatusOK,
},
{
name: "should not mutate invalid git url",
admissionReq: createFluxGitRepoAdmissionRequest(t, v1.Update, &flux.GitRepository{
Expand Down
7 changes: 0 additions & 7 deletions src/internal/agent/hooks/flux-helmrepo.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,13 +47,6 @@ func mutateHelmRepo(ctx context.Context, r *v1.AdmissionRequest, cluster *cluste
return &operations.Result{Allowed: true}, nil
}

if src.Labels != nil && src.Labels["zarf-agent"] == "patched" {
return &operations.Result{
Allowed: true,
PatchOps: nil,
}, nil
}

zarfState, err := cluster.LoadZarfState(ctx)
if err != nil {
return nil, err
Expand Down
19 changes: 18 additions & 1 deletion src/internal/agent/hooks/flux-helmrepo_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ func TestFluxHelmMutationWebhook(t *testing.T) {
code: http.StatusInternalServerError,
},
{
name: "should not mutate when agent patched",
name: "should mutate even if agent patched",
admissionReq: createFluxHelmRepoAdmissionRequest(t, v1.Update, &flux.HelmRepository{
ObjectMeta: metav1.ObjectMeta{
Name: "already-patched",
Expand All @@ -77,9 +77,26 @@ func TestFluxHelmMutationWebhook(t *testing.T) {
},
},
Spec: flux.HelmRepositorySpec{
URL: "oci://ghcr.io/stefanprodan/charts",
Type: "oci",
},
}),
patch: []operations.PatchOperation{
operations.ReplacePatchOperation(
"/spec/url",
"oci://127.0.0.1:31999/stefanprodan/charts",
),
operations.AddPatchOperation(
"/spec/secretRef",
fluxmeta.LocalObjectReference{Name: config.ZarfImagePullSecretName},
),
operations.ReplacePatchOperation(
"/metadata/labels",
map[string]string{
"zarf-agent": "patched",
},
),
},
code: http.StatusOK,
},
{
Expand Down
7 changes: 0 additions & 7 deletions src/internal/agent/hooks/flux-ocirepo.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,13 +50,6 @@ func mutateOCIRepo(ctx context.Context, r *v1.AdmissionRequest, cluster *cluster
message.Warnf(lang.AgentWarnSemVerRef, src.Spec.Reference.SemVer)
}

if src.Labels != nil && src.Labels["zarf-agent"] == "patched" {
return &operations.Result{
Allowed: true,
PatchOps: []operations.PatchOperation{},
}, nil
}

zarfState, err := cluster.LoadZarfState(ctx)
if err != nil {
return nil, err
Expand Down
23 changes: 21 additions & 2 deletions src/internal/agent/hooks/flux-ocirepo_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,7 @@ func TestFluxOCIMutationWebhook(t *testing.T) {

tests := []admissionTest{
{
name: "should not mutate when agent patched",
name: "should mutate even if agent patched",
admissionReq: createFluxOCIRepoAdmissionRequest(t, v1.Update, &flux.OCIRepository{
ObjectMeta: metav1.ObjectMeta{
Name: "already-patched",
Expand All @@ -54,7 +54,26 @@ func TestFluxOCIMutationWebhook(t *testing.T) {
},
},
}),
patch: nil,
patch: []operations.PatchOperation{
operations.ReplacePatchOperation(
"/spec/url",
"oci://127.0.0.1:31999/stefanprodan/manifests/podinfo",
),
operations.AddPatchOperation(
"/spec/secretRef",
fluxmeta.LocalObjectReference{Name: config.ZarfImagePullSecretName},
),
operations.ReplacePatchOperation(
"/spec/ref/tag",
"6.4.0-zarf-2823281104",
),
operations.ReplacePatchOperation(
"/metadata/labels",
map[string]string{
"zarf-agent": "patched",
},
),
},
code: http.StatusOK,
},
{
Expand Down
Loading