Documentation
¶
Overview ¶
Package source turns a checked-out working tree into what the chart engine's PlanApply takes: a release file, a chart source, and the reader it uses for values files.
There are two source types and they converge here. A releaseFile application points at a swarmcli-release.yaml the repository already contains. A chart application names one chart, and this package synthesises the release file it would have written — by rendering it and handing it to the engine's own parser, so a synthesised file obeys exactly the rules a committed one does rather than a second implementation of them.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Contained ¶
Contained resolves rel against root and refuses anything that ends up outside it, returning the resolved path.
The config loader already rejects an escaping path, but this is the check that matters: it resolves symlinks. Repository content is not trusted the way the operator's own configuration is — anyone who can land a commit can add a symlink — and a values file pointing at /run/secrets would otherwise be read, merged and rendered into a manifest that is then stored in a Docker config readable by anyone with Docker access.
It is exported because the same rule applies to any file read out of a tree the controller did not write: the app-set source (package appset) reads its applications file through it rather than through a second copy of a check whose failure mode is reading whatever the controller can.
Types ¶
type Builder ¶
type Builder struct {
// contains filtered or unexported fields
}
Builder turns working trees into plans' inputs.
func NewBuilder ¶
NewBuilder returns a Builder keeping its per-application state under root.
Root must not be the directory the git sourcer clones into. Everything under a clone is inside a working tree that gets force-checked-out and cleaned on every fetch, so a repository cache living there would be deleted underneath this package — or, worse, show up as repository content.
Warnf receives the chart repository store's warnings. Without it they are dropped: a repository index that could not be refreshed is best-effort in the engine and silent by default.
type Built ¶
type Built struct {
ReleaseFile *charts.ReleaseFile
Charts charts.ChartSource
// ReadFile is charts.PlanOptions.ReadFile: it reads one values file the
// release file names, checks it really is repository content, and runs it
// through the SecretProvider seam on the way past.
ReadFile func(path string) ([]byte, error)
}
Built is what PlanApply needs.
Source Files