Chart linting git-crypt issue

[Mykolaichenko]

Hi!

We currently use git-crypt for storing creds.
How can we prevent ecnrypted files from validating?

Olegs-MacBook-Pro:k8s mukolaich$ docker run --rm -v "$(pwd):/workdir" --workdir /workdir gcr.io/kubernetes-charts-ci/chart-testing:v1.0.2 chart_test.sh --no-install --config .conf

--------------------------------------------------------------------------------
 Environment:
 REMOTE=origin
 TARGET_BRANCH=SRE100-500k8s_for_sat
 CHART_DIRS=sat/
 EXCLUDED_CHARTS=sat/s3sync/
 CHART_REPOS=
 TIMEOUT=300
 LINT_CONF=/testing/etc/lintconf.yaml
 CHART_YAML_SCHEMA=/testing/etc/chart_schema.yaml
 VALIDATE_MAINTAINERS=true
--------------------------------------------------------------------------------

"git-crypt" clean: line 1: git-crypt: not found
error: external filter '"git-crypt" clean' failed 127
error: external filter '"git-crypt" clean' failed
fatal: sat/blah/blah/blah/blah.yaml: clean filter 'git-crypt' failed

.conf

CHART_DIRS=sat/charts/blah-nginx
EXCLUDED_CHARTS=sat/s3sync/
TARGET_BRANCH=SRE100-500k8s_for_sat

[mattfarina]

I'm not a user of git-crypt so this is a bit of a guess... I think you'll need to create a derivative image from the chart-testing one that knows how to deal with your git-crypt setup.

[unguiculus]

Can't you git crypt unlock before you do the linting and git crypt lock afterwards?

[Mykolaichenko]

@unguiculus of course I'm using chart-testing in the same way. Error appears to unlocked files.

[unguiculus]

OK, I see what the problem is. git-crypt is called by Git because it is added as a filter in .gitattributes. You need to create your own Docker image that exends from the chart-testing image and install git-crypt in it.

[Mykolaichenko]

@unguiculus yep, I see this solution but it a little bit dirty, because I will care about creating/deploying/storing and updating new docker image which is simply extended by git-crypt.
Could we have flag like --ignore-gitattributes and logic inside chart-testing for preventing this issue?

[unguiculus]

Closing this for now. I'm not aware of any way to tell Git to ignore .gitattributes. Anyways, I think this is a custom use case. You should really extend the Docker image.