exit code on failure

main.go

@@ -1,7 +1,6 @@
 package main
 
 import (
-	"fmt"
 	"os"
 
 	"sigs.k8s.io/kubectl-validate/pkg/cmd"
@@ -10,6 +9,17 @@ import (
 func main() {
 	rootCmd := cmd.NewRootCommand()
 	if err := rootCmd.Execute(); err != nil {
-		fmt.Fprintln(os.Stderr, err.Error())
+		switch err.(type) {
+		case cmd.ValidationError:
+			os.Exit(1)
+		case cmd.ArgumentError:
+			os.Exit(2)
+		case cmd.InternalError:
+			os.Exit(3)
+		default:
+			// This case should not get hit, but in case it does,
+			// Treat unknown error as internal error
+			os.Exit(3)
+		}
 	}
 }

pkg/cmd/errors.go

@@ -0,0 +1,13 @@
+package cmd
+
+type ArgumentError struct {
+	error
+}
+
+type ValidationError struct {
+	error
+}
+
+type InternalError struct {
+	error
+}

pkg/cmd/validate.go

@@ -76,11 +76,12 @@ func NewRootCommand() *cobra.Command {
 		version:      "1.27",
 	}
 	res := &cobra.Command{
-		Use:   "kubectl-validate [manifests to validate]",
-		Short: "kubectl-validate",
-		Long:  "kubectl-validate is a CLI tool to validate Kubernetes manifests against their schemas",
-		Args:  cobra.MinimumNArgs(1),
-		RunE:  invoked.Run,
+		Use:          "kubectl-validate [manifests to validate]",
+		Short:        "kubectl-validate",
+		Long:         "kubectl-validate is a CLI tool to validate Kubernetes manifests against their schemas",
+		Args:         cobra.MinimumNArgs(1),
+		RunE:         invoked.Run,
+		SilenceUsage: true,
 	}
 	res.Flags().StringVarP(&invoked.version, "version", "", invoked.version, "Kubernetes version to validate native resources against. Required if not connected directly to cluster")
 	res.Flags().StringVarP(&invoked.localSchemasDir, "local-schemas", "", "", "--local-schemas=./path/to/schemas/dir. Path to a directory with format: /apis/<group>/<version>.json for each group-version's schema.")
@@ -213,14 +214,15 @@ func (c *commandFlags) Run(cmd *cobra.Command, args []string) error {
 		),
 	)
 	if err != nil {
-		return err
+		return ArgumentError{err}
 	}
 
 	files, err := utils.FindFiles(args...)
 	if err != nil {
-		return err
+		return ArgumentError{err}
 	}
 
+	hasError := false
 	if c.outputFormat == OutputHuman {
 		for _, path := range files {
 			fmt.Fprintf(cmd.OutOrStdout(), "\n\033[1m%v\033[0m...", path)
@@ -235,6 +237,7 @@ func (c *commandFlags) Run(cmd *cobra.Command, args []string) error {
 				for _, err := range errs {
 					fmt.Fprintln(cmd.ErrOrStderr(), err.Error())
 				}
+				hasError = true
 			} else {
 				fmt.Fprintln(cmd.OutOrStdout(), "\033[32mOK\033[0m")
 			}
@@ -244,15 +247,19 @@ func (c *commandFlags) Run(cmd *cobra.Command, args []string) error {
 		for _, path := range files {
 			for _, err := range ValidateFile(path, factory) {
 				res[path] = append(res[path], errorToStatus(err))
+				hasError = hasError || err != nil
 			}
 		}
 		data, e := json.MarshalIndent(res, "", "    ")
 		if e != nil {
-			return fmt.Errorf("failed to render results into JSON: %w", e)
+			return InternalError{fmt.Errorf("failed to render results into JSON: %w", e)}
 		}
 		fmt.Fprintln(cmd.OutOrStdout(), string(data))
 	}
 
+	if hasError {
+		return ValidationError{errors.New("validation failed")}
+	}
 	return nil
 }
 

pkg/cmd/validate_test.go

@@ -14,12 +14,14 @@ import (
 	"sigs.k8s.io/kubectl-validate/pkg/utils"
 )
 
+var (
+	testcasesDir string = "../../testcases"
+	manifestDir         = filepath.Join(testcasesDir, "manifests")
+	crdsDir             = filepath.Join(testcasesDir, "crds")
+)
+
 // Shows that each testcase has its expected output when run by itself
 func TestValidationErrorsIndividually(t *testing.T) {
-	testcasesDir := "../../testcases"
-	manifestDir := filepath.Join(testcasesDir, "manifests")
-	crdsDir := filepath.Join(testcasesDir, "crds")
-
 	// TODO: using 1.23 since as of writing we only have patches for that schema
 	// version should change to more recent version/test a matrix a versions in
 	// the future.
@@ -46,6 +48,7 @@ func TestValidationErrorsIndividually(t *testing.T) {
 			require.NoError(t, err)
 
 			var expected []metav1.Status
+			expectedError := false
 			for _, document := range documents {
 				if utils.IsEmptyYamlDocument(document) {
 					expected = append(expected, metav1.Status{Status: metav1.StatusSuccess})
@@ -72,6 +75,9 @@ func TestValidationErrorsIndividually(t *testing.T) {
 					}
 
 					expected = append(expected, expectation)
+					if expectation.Status != "Success" {
+						expectedError = true
+					}
 				}
 			}
 
@@ -87,7 +93,11 @@ func TestValidationErrorsIndividually(t *testing.T) {
 			require.NoError(t, rootCmd.Flags().Set("output", "json"))
 
 			// There should be no error executing the case, just validation errors
-			require.NoError(t, rootCmd.Execute())
+			if err := rootCmd.Execute(); expectedError {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
 
 			output := map[string][]metav1.Status{}
 			if err := json.Unmarshal(buf.Bytes(), &output); err != nil {
@@ -98,3 +108,18 @@ func TestValidationErrorsIndividually(t *testing.T) {
 		})
 	}
 }
+
+// Test that the command returns an error if validation fails, and not when it
+// succeeds
+func TestReturnsError(t *testing.T) {
+	path := filepath.Join(manifestDir, "error_invalid_name.yaml")
+	successPath := filepath.Join(manifestDir, "configmap.yaml")
+
+	rootCmd := cmd.NewRootCommand()
+	rootCmd.SetArgs([]string{path})
+	require.Error(t, rootCmd.Execute(), "expected error")
+
+	rootCmd = cmd.NewRootCommand()
+	rootCmd.SetArgs([]string{successPath})
+	require.NoError(t, rootCmd.Execute(), "expected no error")
+}

pkg/openapiclient/composite.go

@@ -1,6 +1,8 @@
 package openapiclient
 
 import (
+	"errors"
+
 	"k8s.io/client-go/openapi"
 	"sigs.k8s.io/kubectl-validate/pkg/openapiclient/groupversion"
 )
@@ -16,9 +18,11 @@ func NewComposite(clients ...openapi.Client) openapi.Client {
 
 func (c compositeClient) Paths() (map[string]openapi.GroupVersion, error) {
 	merged := map[string][]openapi.GroupVersion{}
+	var allErrors []error
 	for _, client := range c.clients {
 		paths, err := client.Paths()
 		if err != nil {
+			allErrors = append(allErrors, err)
 			continue
 		}
 		for k, v := range paths {
@@ -29,5 +33,13 @@ func (c compositeClient) Paths() (map[string]openapi.GroupVersion, error) {
 	for k, v := range merged {
 		composite[k] = groupversion.NewForComposite(v...)
 	}
-	return composite, nil
+
+	var er error
+	if len(allErrors) == 1 {
+		er = allErrors[0]
+	} else if len(allErrors) > 0 {
+		er = errors.Join(allErrors...)
+	}
+
+	return composite, er
 }

pkg/openapiclient/fallback.go

@@ -2,7 +2,6 @@ package openapiclient
 
 import (
 	"errors"
-	"fmt"
 	"sync/atomic"
 
 	"k8s.io/client-go/openapi"
@@ -29,7 +28,7 @@ func (f *fallbackClient) Paths() (map[string]openapi.GroupVersion, error) {
 		}
 	}
 
-	return nil, fmt.Errorf("all openapi sources returned errors: %w", errors.Join(errs...))
+	return nil, errors.Join(errs...)
 }
 
 // Creates an OpenAPI client which forwards calls to the first

pkg/openapiclient/github_builtins.go

@@ -38,14 +38,18 @@ func (g githubBuiltins) Paths() (map[string]openapi.GroupVersion, error) {
 	//TODO: responses use and respect ETAG. use a disk cache
 	ghResponse, err := http.Get(fmt.Sprintf("https://api.github.com/repos/kubernetes/kubernetes/contents/api/openapi-spec/v3?ref=release-%v", g.version))
 	if err != nil {
-		return nil, fmt.Errorf("error retreiving s mpecs from GitHub: %w", err)
+		return nil, fmt.Errorf("error retreiving specs from GitHub: %w", err)
 	}
 	defer ghResponse.Body.Close()
 	ghBody, err := io.ReadAll(ghResponse.Body)
 	if err != nil {
 		return nil, fmt.Errorf("error downloading specs from GitHub: %w", err)
 	}
 
+	if ghResponse.StatusCode != http.StatusOK {
+		return nil, fmt.Errorf("failed to download GitHub spec for version '%v': %v", g.version, string(ghBody))
+	}
+
 	var decodedResponse []ghResponseObject
 	if err := json.Unmarshal(ghBody, &decodedResponse); err != nil {
 		return nil, fmt.Errorf("failed to parse github response: %w", err)

pkg/openapiclient/kubeconfig.go

@@ -1,6 +1,8 @@
 package openapiclient
 
 import (
+	"fmt"
+
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/openapi"
 	"k8s.io/client-go/tools/clientcmd"
@@ -23,16 +25,21 @@ func (k *kubeConfig) Paths() (map[string]openapi.GroupVersion, error) {
 
 		config, err := kubeConfig.ClientConfig()
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to load kubeconfig: %w", err)
 		}
 
 		clientset, err := kubernetes.NewForConfig(config)
 		if err != nil {
-			return nil, err
+			return nil, fmt.Errorf("failed to create clientset for kubeconfig")
 		}
 
 		k.client = clientset.Discovery().OpenAPIV3()
 	}
 
-	return k.client.Paths()
+	res, err := k.client.Paths()
+	if err != nil {
+		return nil, fmt.Errorf("failed to download schemas from kubeconfig cluster: %w", err)
+	}
+
+	return res, nil
 }

testcases/manifests/configmap.yaml

@@ -0,0 +1,12 @@
+# {
+#     "status": "Success",
+#     "message": ""
+# }
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: myapp
+  finalizers:
+  - finalizers.compute.linkedin.com
+data:
+  key: value