feat: support kustomize-load-restrictor flag

.gitignore

@@ -30,3 +30,6 @@ testbin/*
 # Misc
 dist/
 .vscode/
+
+# Release artifacts
+git-kustomize-diff

README.md

@@ -41,14 +41,16 @@ Usage:
   git-kustomize-diff run target_dir [flags]
 
 Flags:
-      --allow-dirty             allow dirty tree
-      --base string             base commitish (default to origin/main)
-      --debug                   debug mode
-      --exclude string          exclude regexp (default to none)
-  -h, --help                    help for run
-      --include string          include regexp (default to all)
-      --kustomize-path string   path of a kustomize binary (default to embeded)
-      --target string           target commitish (default to the current branch)
+      --allow-dirty                        allow dirty tree
+      --base string                        base commitish (default to origin/main)
+      --debug                              debug mode
+      --exclude string                     exclude regexp (default to none)
+      --git-path string                    path of a git binary (default to git)
+  -h, --help                               help for run
+      --include string                     include regexp (default to all)
+      --kustomize-load-restrictor string   kustomize load restrictor type (default to kustomizaton provider defaults)
+      --kustomize-path string              path of a kustomize binary (default to embedded)
+      --target string                      target commitish (default to the current branch)
 ```
 
 ## Contributing

cmd/run.go

@@ -27,14 +27,15 @@ import (
 )
 
 type runFlags struct {
-	base                string
-	target              string
-	includeRegexpString string
-	excludeRegexpString string
-	kustomizePath       string
-	gitPath             string
-	debug               bool
-	allowDirty          bool
+	base                    string
+	target                  string
+	includeRegexpString     string
+	excludeRegexpString     string
+	kustomizePath           string
+	kustomizeLoadRestrictor string
+	gitPath                 string
+	debug                   bool
+	allowDirty              bool
 }
 
 var runCmd = &cobra.Command{
@@ -44,12 +45,13 @@ var runCmd = &cobra.Command{
 	Args:  cobra.RangeArgs(0, 1),
 	RunE: func(cmd *cobra.Command, args []string) error {
 		opts := gitkustomizediff.RunOpts{
-			Base:          runOpts.base,
-			Target:        runOpts.target,
-			Debug:         runOpts.debug,
-			AllowDirty:    runOpts.allowDirty,
-			KustomizePath: runOpts.kustomizePath,
-			GitPath:       runOpts.gitPath,
+			Base:                    runOpts.base,
+			Target:                  runOpts.target,
+			Debug:                   runOpts.debug,
+			AllowDirty:              runOpts.allowDirty,
+			KustomizePath:           runOpts.kustomizePath,
+			KustomizeLoadRestrictor: runOpts.kustomizeLoadRestrictor,
+			GitPath:                 runOpts.gitPath,
 		}
 		if runOpts.includeRegexpString != "" {
 			includeRegexp, err := regexp.Compile(runOpts.includeRegexpString)
@@ -89,7 +91,8 @@ func init() {
 	runCmd.PersistentFlags().StringVar(&runOpts.target, "target", "", "target commitish (default to the current branch)")
 	runCmd.PersistentFlags().StringVar(&runOpts.includeRegexpString, "include", "", "include regexp (default to all)")
 	runCmd.PersistentFlags().StringVar(&runOpts.excludeRegexpString, "exclude", "", "exclude regexp (default to none)")
-	runCmd.PersistentFlags().StringVar(&runOpts.kustomizePath, "kustomize-path", "", "path of a kustomize binary (default to embeded)")
+	runCmd.PersistentFlags().StringVar(&runOpts.kustomizePath, "kustomize-path", "", "path of a kustomize binary (default to embedded)")
+	runCmd.PersistentFlags().StringVar(&runOpts.kustomizeLoadRestrictor, "kustomize-load-restrictor", "", "kustomize load restrictor type (default to kustomizaton provider defaults)")
 	runCmd.PersistentFlags().StringVar(&runOpts.gitPath, "git-path", "", "path of a git binary (default to git)")
 	runCmd.PersistentFlags().BoolVar(&runOpts.debug, "debug", false, "debug mode")
 	runCmd.PersistentFlags().BoolVar(&runOpts.allowDirty, "allow-dirty", false, "allow dirty tree")

pkg/gitkustomizediff/diff.go

@@ -24,13 +24,15 @@ import (
 	"github.com/pkg/errors"
 	log "github.com/sirupsen/logrus"
 	"sigs.k8s.io/kustomize/api/krusty"
+	"sigs.k8s.io/kustomize/api/types"
 	"sigs.k8s.io/kustomize/kyaml/filesys"
 )
 
 type DiffOpts struct {
-	IncludeRegexp *regexp.Regexp
-	ExcludeRegexp *regexp.Regexp
-	KustomizePath string
+	IncludeRegexp           *regexp.Regexp
+	ExcludeRegexp           *regexp.Regexp
+	KustomizePath           string
+	KustomizeLoadRestrictor string
 }
 
 func Diff(baseDirPath, targetDirPath string, opts DiffOpts) (*DiffMap, error) {
@@ -71,12 +73,12 @@ func Diff(baseDirPath, targetDirPath string, opts DiffOpts) (*DiffMap, error) {
 				continue
 			}
 		}
-		baseYaml, err := Build(baseKDirPath, BuildOpts{opts.KustomizePath})
+		baseYaml, err := Build(baseKDirPath, BuildOpts{opts.KustomizePath, opts.KustomizeLoadRestrictor})
 		if err != nil {
 			diffMap.Results[kDir] = &DiffError{err}
 			continue
 		}
-		targetYaml, err := Build(targetKDirPath, BuildOpts{opts.KustomizePath})
+		targetYaml, err := Build(targetKDirPath, BuildOpts{opts.KustomizePath, opts.KustomizeLoadRestrictor})
 		if err != nil {
 			diffMap.Results[kDir] = &DiffError{err}
 			continue
@@ -92,22 +94,61 @@ func Diff(baseDirPath, targetDirPath string, opts DiffOpts) (*DiffMap, error) {
 	return diffMap, nil
 }
 
+func MakeBuildOptions(kustomizeLoadRestrictor string) (*krusty.Options, error) {
+	var err error
+	options := krusty.MakeDefaultOptions()
+	if kustomizeLoadRestrictor == "" {
+		return options, err
+	}
+	switch kustomizeLoadRestrictor {
+	case "LoadRestrictionsUnknown":
+		{
+			options.LoadRestrictions = types.LoadRestrictionsUnknown
+		}
+	case "LoadRestrictionsRootOnly":
+		{
+			options.LoadRestrictions = types.LoadRestrictionsRootOnly
+		}
+	case "LoadRestrictionsNone":
+		{
+			options.LoadRestrictions = types.LoadRestrictionsNone
+		}
+	default:
+		{
+			err := errors.Errorf("unknown LoadRestrictions type given by kustomizeLoadRestrictor: %q", kustomizeLoadRestrictor)
+			return nil, err
+		}
+	}
+	return options, err
+}
+
 type BuildOpts struct {
-	KustomizePath string
+	KustomizePath           string
+	KustomizeLoadRestrictor string
 }
 
 func Build(dirPath string, opts BuildOpts) (string, error) {
 	if opts.KustomizePath != "" {
-		stdout, _, err := (&utils.WorkDir{}).RunCommand(opts.KustomizePath, "build", dirPath)
+		buildArgs := []string {"build"}
+		if (opts.KustomizeLoadRestrictor != "") {
+			buildArgs = append(buildArgs, "--load-restrictor")
+			buildArgs = append(buildArgs, opts.KustomizeLoadRestrictor)
+		}
+		buildArgs = append(buildArgs, dirPath)
+		stdout, _, err := (&utils.WorkDir{}).RunCommand(opts.KustomizePath, buildArgs...)
 		if err != nil {
 			return "", err
 		}
 		return stdout, nil
 	}
-	fSys := filesys.MakeFsOnDisk()
+	options, err := MakeBuildOptions(opts.KustomizeLoadRestrictor)
+	if err != nil {
+		return "", errors.WithStack(err)
+	}
 	k := krusty.MakeKustomizer(
-		krusty.MakeDefaultOptions(),
+		options,
 	)
+	fSys := filesys.MakeFsOnDisk()
 	resMap, err := k.Run(fSys, dirPath)
 	if err != nil {
 		return "", errors.WithStack(err)

pkg/gitkustomizediff/diff_test.go

@@ -24,8 +24,44 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"sigs.k8s.io/kustomize/api/krusty"
+	"sigs.k8s.io/kustomize/api/types"
 )
 
+func TestMakeBuildOptions(t *testing.T) {
+	var err error
+	var kustomizeLoadRestrictor string
+	var options *krusty.Options
+	defaultOptions := krusty.MakeDefaultOptions()
+
+	kustomizeLoadRestrictor = ""
+	options, err = MakeBuildOptions(kustomizeLoadRestrictor)
+	assert.Equal(t, err, nil)
+	assert.Equal(t, options, defaultOptions)
+
+	kustomizeLoadRestrictor = "LoadRestrictionsUnknown"
+	options, err = MakeBuildOptions(kustomizeLoadRestrictor)
+	assert.Equal(t, err, nil)
+	assert.Equal(t, options.LoadRestrictions, types.LoadRestrictionsUnknown)
+
+	kustomizeLoadRestrictor = "LoadRestrictionsRootOnly"
+	options, err = MakeBuildOptions(kustomizeLoadRestrictor)
+	assert.Equal(t, err, nil)
+	assert.Equal(t, options.LoadRestrictions, types.LoadRestrictionsRootOnly)
+
+	kustomizeLoadRestrictor = "LoadRestrictionsNone"
+	options, err = MakeBuildOptions(kustomizeLoadRestrictor)
+	assert.Equal(t, err, nil)
+	assert.Equal(t, options.LoadRestrictions, types.LoadRestrictionsNone)
+
+	invalidType := "invalid-load-restrictions-type--"
+	kustomizeLoadRestrictor = invalidType
+	options, err = MakeBuildOptions(kustomizeLoadRestrictor)
+	assert.Equal(t, options, (*krusty.Options)(nil))
+	assert.NotEqual(t, err, nil)
+	assert.Error(t, err, "unknown LoadRestrictions type given by kustomizeLoadRestrictor: %q", invalidType)
+}
+
 func TestBuild(t *testing.T) {
 	wd, _ := os.Getwd()
 
@@ -48,6 +84,33 @@ spec:
 	assert.Equal(t, expectedYaml, actualYaml)
 }
 
+func TestBuildLoadRestrictionsNone(t *testing.T) {
+	wd, _ := os.Getwd()
+
+	expectedYaml := strings.TrimLeft(`
+apiVersion: v1
+kind: Pod
+metadata:
+  name: sub1
+spec:
+  containers:
+  - image: nginx:latest
+    name: sub1
+`, "\n")
+
+	fixturesDirPath := filepath.Join(wd, "fixtures", "diff-load-restrictions-none", "base", "sub1/nested")
+	_, err := Build(fixturesDirPath, BuildOpts{})
+	assert.NotEqual(t, err, nil)
+
+	buildOpts := BuildOpts{"", "LoadRestrictionsNone"}
+	actualYaml, err := Build(fixturesDirPath, buildOpts)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	assert.Equal(t, expectedYaml, actualYaml)
+}
+
 func TestDiff(t *testing.T) {
 	wd, _ := os.Getwd()
 
@@ -73,3 +136,31 @@ func TestDiff(t *testing.T) {
 	assert.Equal(t, expectedSub2Diff, diffMap.Results["sub2"].(*DiffContent).ToString())
 	assert.Regexp(t, expectedInvalidErrorRegexp, diffMap.Results["invalid"].(*DiffError).Error().Error())
 }
+
+func TestDiffLoadRestrictionsNone(t *testing.T) {
+	wd, _ := os.Getwd()
+
+	expectedSub1Diff := strings.TrimLeft(`
+@@ -5,4 +5,4 @@
+ spec:
+   containers:
+   - image: nginx:latest
+-    name: sub1
++    name: sub1-modified
+`, "\n")
+
+	baseDirPath := filepath.Join(wd, "fixtures", "diff-load-restrictions-none", "base")
+	targetDirPath := filepath.Join(wd, "fixtures", "diff-load-restrictions-none", "target")
+	_, err := Diff(baseDirPath, targetDirPath, DiffOpts{})
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+
+	diffOpts := DiffOpts{nil, nil, "", "LoadRestrictionsNone"}
+	diffMap, err := Diff(baseDirPath, targetDirPath, diffOpts)
+	if !assert.NoError(t, err) {
+		t.FailNow()
+	}
+	assert.Equal(t, 1, len(diffMap.Results))
+	assert.Equal(t, expectedSub1Diff, diffMap.Results["sub1/nested"].(*DiffContent).ToString())
+}

pkg/gitkustomizediff/fixtures/diff-load-restrictions-none/base/sub1/nested/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+- ../pod.yaml

pkg/gitkustomizediff/fixtures/diff-load-restrictions-none/base/sub1/pod.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: sub1
+spec:
+  containers:
+  - name: sub1
+    image: nginx:latest

pkg/gitkustomizediff/fixtures/diff-load-restrictions-none/target/sub1/nested/kustomization.yaml

@@ -0,0 +1,2 @@
+resources:
+- ../pod.yaml

pkg/gitkustomizediff/fixtures/diff-load-restrictions-none/target/sub1/pod.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Pod
+metadata:
+  name: sub1
+spec:
+  containers:
+  - name: sub1-modified
+    image: nginx:latest

pkg/gitkustomizediff/run.go

@@ -27,14 +27,15 @@ import (
 )
 
 type RunOpts struct {
-	Base          string
-	Target        string
-	IncludeRegexp *regexp.Regexp
-	ExcludeRegexp *regexp.Regexp
-	KustomizePath string
-	GitPath       string
-	Debug         bool
-	AllowDirty    bool
+	Base                    string
+	Target                  string
+	IncludeRegexp           *regexp.Regexp
+	ExcludeRegexp           *regexp.Regexp
+	KustomizePath           string
+	KustomizeLoadRestrictor string
+	GitPath                 string
+	Debug                   bool
+	AllowDirty              bool
 }
 
 type RunResult struct {
@@ -119,9 +120,10 @@ func Run(dirPath string, opts RunOpts) (*RunResult, error) {
 	}
 
 	diffMap, err := Diff(baseGitDir.WorkDir.Dir, targetGitDir.WorkDir.Dir, DiffOpts{
-		IncludeRegexp: opts.IncludeRegexp,
-		ExcludeRegexp: opts.ExcludeRegexp,
-		KustomizePath: opts.KustomizePath,
+		IncludeRegexp:           opts.IncludeRegexp,
+		ExcludeRegexp:           opts.ExcludeRegexp,
+		KustomizePath:           opts.KustomizePath,
+		KustomizeLoadRestrictor: opts.KustomizeLoadRestrictor,
 	})
 	if err != nil {
 		return nil, err