-
Notifications
You must be signed in to change notification settings - Fork 50
/
setup.go
371 lines (325 loc) · 13 KB
/
setup.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
package setup
import (
"bytes"
"fmt"
"os"
"path/filepath"
jxcore "github.com/jenkins-x/jx-api/v4/pkg/apis/core/v4beta1"
"github.com/jenkins-x/jx-helpers/v3/pkg/boot"
"github.com/jenkins-x/jx-helpers/v3/pkg/files"
"github.com/jenkins-x/jx-helpers/v3/pkg/gitclient"
"github.com/jenkins-x/jx-helpers/v3/pkg/gitclient/cli"
"github.com/jenkins-x/jx-helpers/v3/pkg/gitclient/credentialhelper"
"github.com/jenkins-x/jx-helpers/v3/pkg/gitclient/giturl"
"github.com/jenkins-x/jx-helpers/v3/pkg/homedir"
"github.com/jenkins-x/jx-helpers/v3/pkg/kube"
"github.com/jenkins-x/jx-helpers/v3/pkg/options"
"github.com/jenkins-x/jx-helpers/v3/pkg/termcolor"
"github.com/jenkins-x/jx-logging/v3/pkg/log"
"k8s.io/client-go/kubernetes"
"k8s.io/client-go/rest"
"github.com/jenkins-x-plugins/jx-gitops/pkg/rootcmd"
"github.com/jenkins-x/jx-helpers/v3/pkg/cmdrunner"
"github.com/jenkins-x/jx-helpers/v3/pkg/cobras/helper"
"github.com/jenkins-x/jx-helpers/v3/pkg/cobras/templates"
"github.com/pkg/errors"
"github.com/spf13/cobra"
)
var (
info = termcolor.ColorInfo
cmdLong = templates.LongDesc(`
Sets up git to ensure the git user name and email is setup. This is typically used in a pipeline to ensure git can do commits.
The jx gitops git setup command ensures that we can authenticate with configured Git server by configuring the local
credentials file in the home directory. This command tries to ensure the following things:
- The user can be authenticated with Git provider (for example Github)
- An email is associated with each automated commit message
These credentials are written to ${HOME}/git/credentials file, where the ${HOME} directory is determined as:
- value stored in XGD_CONFIG_HOME environment variable or
- value stored in HOME environment variable or
- value stored in USERPROFILE environment variable or
- as current directory ./
The credentials are determined by reading out the jx-requirements.yaml from the cluster repository and jx-boot
Secret resource provisioned together with jx-git-operator in your Kubernetes namespace.
The Git username and email are preferentially determined from PipelineUser field from jx-requirements.yaml, but if
they are not available there then default email address jenkins-x@googlegroups.com is used . If the username could not be determined
from jx-requirements.yaml, then it is determined from:
- GIT_USERNAME environment variable or
- GITHUB_ACTOR environment variable
- In case that we are running in Kubernetes cluster from "username" field of the "jx-boot" Secret provisioned with
"jx-git-operator"
The password for Github user (or a token for the robot account, depending on which you configued) is determined in
similar fashion. Namely the token is first determined from environment variable GITHUB_TOKEN, but if that fails, then
further determination is dependent on execution environment of the command. Namely if it is running within Github
actions, then the GITHUB_TOKEN environment variable is our last stop. Otherwise if the command is executed within
Kubernetes cluster, then the secret is determined by reading the password field of the "jx-boot" Secret provisioned
with the "jx-git-operator".
`)
cmdExample = templates.Examples(`
%s git setup
`)
)
// Options the options for the command
type Options struct {
Dir string
UserName string
UserEmail string
Password string
OutputFile string
Namespace string
OperatorNamespace string
SecretName string
GitURL string
GitProviderURL string
GitInitCommands string
DisableInClusterTest bool
KubeClient kubernetes.Interface
CommandRunner cmdrunner.CommandRunner
gitClient gitclient.Interface
Requirements *jxcore.Requirements
}
// NewCmdGitSetup creates a command object for the command
func NewCmdGitSetup() (*cobra.Command, *Options) {
o := &Options{}
cmd := &cobra.Command{
Use: "setup",
Short: "Sets up git to ensure the git user name and email is setup",
Long: cmdLong,
Example: fmt.Sprintf(cmdExample, rootcmd.BinaryName),
Run: func(_ *cobra.Command, _ []string) {
err := o.Run()
helper.CheckErr(err)
},
}
o.AddFlags(cmd)
return cmd, o
}
// AddFlags adds the command line flags
func (o *Options) AddFlags(cmd *cobra.Command) {
cmd.Flags().StringVarP(&o.Dir, "dir", "d", "", "the directory to run the git setup command from")
cmd.Flags().StringVarP(&o.UserName, "name", "n", "", "the git user name to use if one is not setup")
cmd.Flags().StringVarP(&o.Password, "password", "", "", "the git password/token to use. if not specified it is detected from the git operator Secret")
cmd.Flags().StringVarP(&o.UserEmail, "email", "e", "", "the git user email to use if one is not setup. Default value is jenkins-x@googlegroups.com, if none other is provided")
cmd.Flags().StringVarP(&o.GitProviderURL, "git-provider", "", "", "the git provider URL. If not specified its detected from the git operator jx-boot Secret or defaults to https://github.com")
cmd.Flags().StringVarP(&o.OutputFile, "credentials-file", "", "", "The destination of the git credentials file to generate. If not specified uses $XDG_CONFIG_HOME/git/credentials or $HOME/git/credentials")
cmd.Flags().StringVarP(&o.OperatorNamespace, "operator-namespace", "", "jx-git-operator", "the namespace used by the git operator to find the secret for the git repository if running in cluster")
cmd.Flags().StringVarP(&o.Namespace, "namespace", "", "", "the namespace used to find the git operator secret for the git repository if running in cluster. Defaults to the current namespace")
cmd.Flags().StringVarP(&o.SecretName, "secret", "", "jx-boot", "the name of the Secret to find the git URL, username and password for creating a git credential if running inside the cluster")
cmd.Flags().BoolVarP(&o.DisableInClusterTest, "fake-in-cluster", "", false, "for testing: lets you fake running this command inside a kubernetes cluster so that it can create the file: $XDG_CONFIG_HOME/git/credentials or $HOME/git/credentials")
}
// Run implements the command
func (o *Options) Run() error {
gitClient := o.GitClient()
// lets make sure there's a git config home dir
homeDir := GetConfigHome()
err := os.MkdirAll(homeDir, files.DefaultDirWritePermissions)
if err != nil {
return errors.Wrapf(err, "failed to ensure git config home directory exists %s", homeDir)
}
err = o.findCredentialsFromRequirements()
if err != nil {
return errors.Wrapf(err, "failed to find credentials from requirements")
}
// lets fetch the credentials so we can default the UserName if its not specified
credentials, err := o.findCredentials()
if err != nil {
return errors.Wrap(err, "creating git credentials")
}
_, _, err = gitclient.SetUserAndEmail(gitClient, o.Dir, o.UserName, o.UserEmail, o.DisableInClusterTest)
if err != nil {
return errors.Wrapf(err, "failed to setup git user and email")
}
err = gitclient.SetCredentialHelper(gitClient, "")
if err != nil {
return errors.Wrapf(err, "failed to setup credential store")
}
if o.DisableInClusterTest || InGitHubActions() || IsInCluster() {
outFile, err := o.determineOutputFile()
if err != nil {
return errors.Wrap(err, "unable to determine for git credentials")
}
err = o.createGitCredentialsFile(outFile, credentials)
if err != nil {
return errors.Wrapf(err, "failed to generate credentials file %s", outFile)
}
log.Logger().Infof("generated Git credentials file: %s with username: %s email: %s", info(outFile), info(o.UserName), info(o.UserEmail))
}
return nil
}
// InGitHubActions returns true if we are running inside a github action
func InGitHubActions() bool {
return os.Getenv("GITHUB_ACTIONS") == "true"
}
func (o *Options) GitClient() gitclient.Interface {
if o.gitClient == nil {
if o.CommandRunner == nil {
o.CommandRunner = cmdrunner.QuietCommandRunner
}
o.gitClient = cli.NewCLIClient("", o.CommandRunner)
}
return o.gitClient
}
// findCredentials detects the git operator secret so we have default credentials
func (o *Options) findCredentials() ([]credentialhelper.GitCredential, error) {
var credentialList []credentialhelper.GitCredential
if o.UserName == "" {
o.UserName = os.Getenv("GIT_USERNAME")
}
if o.UserName == "" {
o.UserName = os.Getenv("GITHUB_ACTOR")
}
if o.Password == "" {
o.Password = os.Getenv("GIT_TOKEN")
}
if o.Password == "" {
o.Password = os.Getenv("GITHUB_TOKEN")
}
if (o.Password == "" || o.UserName == "") && !InGitHubActions() {
var err error
o.KubeClient, o.Namespace, err = kube.LazyCreateKubeClientAndNamespace(o.KubeClient, o.Namespace)
if err != nil {
return nil, errors.Wrapf(err, "failed to create kube client")
}
bootSecret, err := boot.LoadBootSecret(o.KubeClient, o.Namespace, o.OperatorNamespace, o.SecretName, o.UserName)
if err != nil {
return nil, errors.Wrapf(err, "failed to load the boot secret")
}
if bootSecret == nil {
return nil, errors.Errorf("failed to find the boot secret")
}
gitURL := bootSecret.URL
if o.GitProviderURL == "" {
o.GitProviderURL = bootSecret.GitProviderURL
}
if gitURL != "" && o.GitProviderURL == "" {
// lets convert the git URL into a provider URL
gitInfo, err := giturl.ParseGitURL(gitURL)
if err != nil {
return nil, errors.Wrapf(err, "failed to parse git URL %s", gitURL)
}
o.GitProviderURL = gitInfo.HostURL()
}
o.GitURL = gitURL
o.GitInitCommands = bootSecret.GitInitCommands
if o.UserName == "" {
o.UserName = bootSecret.Username
}
if o.Password == "" {
o.Password = bootSecret.Password
}
}
if o.GitProviderURL == "" {
o.GitProviderURL = "https://github.com"
}
if o.UserName == "" {
return nil, options.MissingOption("name")
}
if o.Password == "" {
return nil, options.MissingOption("password")
}
credential, err := credentialhelper.CreateGitCredentialFromURL(o.GitProviderURL, o.UserName, o.Password)
if err != nil {
return nil, errors.Wrapf(err, "invalid git auth information")
}
credentialList = append(credentialList, credential)
return credentialList, nil
}
func (o *Options) determineOutputFile() (string, error) {
outFile := o.OutputFile
if outFile == "" {
outFile = GitCredentialsFile()
}
dir, _ := filepath.Split(outFile)
if dir != "" {
err := os.MkdirAll(dir, files.DefaultDirWritePermissions)
if err != nil {
return "", err
}
}
return outFile, nil
}
// CreateGitCredentialsFileFromUsernameAndToken creates the git credentials into file using the provided username, token & url
func (o *Options) createGitCredentialsFile(fileName string, credentials []credentialhelper.GitCredential) error {
data, err := o.GitCredentialsFileData(credentials)
if err != nil {
return errors.Wrap(err, "creating git credentials")
}
if err := os.WriteFile(fileName, data, files.DefaultDirWritePermissions); err != nil {
return fmt.Errorf("failed to write to %s: %s", fileName, err)
}
return nil
}
// GitCredentialsFileData takes the given git credentials and writes them into a byte array.
func (o *Options) GitCredentialsFileData(credentials []credentialhelper.GitCredential) ([]byte, error) {
var buffer bytes.Buffer
for _, gitCredential := range credentials {
u, err := gitCredential.URL()
if err != nil {
log.Logger().Warnf("Ignoring incomplete git credentials %q", gitCredential)
continue
}
buffer.WriteString(u.String() + "\n")
// Write the https protocol in case only https is set for completeness
if u.Scheme == "http" {
u.Scheme = "https"
buffer.WriteString(u.String() + "\n")
}
}
return buffer.Bytes(), nil
}
func (o *Options) findCredentialsFromRequirements() error {
if o.Requirements == nil {
if o.Dir == "" {
o.Dir = "."
}
path := filepath.Join(o.Dir, jxcore.RequirementsConfigFileName)
exists, err := files.FileExists(path)
if err != nil {
return errors.Wrapf(err, "failed to check for file %s", path)
}
if !exists {
log.Logger().Warnf("could not default pipeline user/email from requirements as file does not exist: %s", path)
return nil
}
o.Requirements, _, err = jxcore.LoadRequirementsConfig(o.Dir, false)
if err != nil {
return errors.Wrapf(err, "failed to load jx-requirements.yml file")
}
}
if o.Requirements == nil {
return nil
}
pu := o.Requirements.Spec.PipelineUser
if pu == nil {
return nil
}
if o.UserName == "" {
o.UserName = pu.Username
log.Logger().Infof("found git user.name %s from requirements", info(o.UserName))
}
if o.UserEmail == "" {
o.UserEmail = pu.Email
log.Logger().Infof("found git user.email %s from requirements", info(o.UserEmail))
}
return nil
}
// IsInCluster tells if we are running incluster
func IsInCluster() bool {
_, err := rest.InClusterConfig()
return err == nil
}
// GitCredentialsFile returns the location of the git credentials file
func GitCredentialsFile() string {
cfgHome := GetConfigHome()
return filepath.Join(cfgHome, "git", "credentials")
}
// GetConfigHome returns the home dir
func GetConfigHome() string {
cfgHome := os.Getenv("XDG_CONFIG_HOME")
if cfgHome == "" {
cfgHome = homedir.HomeDir()
}
if cfgHome == "" {
cfgHome = "."
}
return cfgHome
}