Skip to content

Commit ab77bd4

Browse files
matttrachmatttrach
authored
fix: name space imports should not change project (#1515)
Signed-off-by: matttrach <matt.trachier@suse.com>
1 parent 56a7b45 commit ab77bd4

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

64 files changed

+4375
-454
lines changed

‎.github/workflows/pull_request.yaml

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,11 @@ name: Pull Request
33
on:
44
pull_request:
55

6+
env:
7+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
8+
GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
9+
GITHUB_OWNER: ${{ github.repository_owner }}
10+
611
jobs:
712
build:
813
runs-on: ubuntu-latest
@@ -14,3 +19,162 @@ jobs:
1419
VERSION: ${{ github.ref_name }}
1520
run: |
1621
make build-rancher
22+
23+
terraform:
24+
name: 'Terraform'
25+
runs-on: ubuntu-latest
26+
steps:
27+
- uses: actions/checkout@v4
28+
with:
29+
fetch-depth: 0
30+
- name: install-nix
31+
run: |
32+
curl -L https://nixos.org/nix/install | sh
33+
source /home/runner/.nix-profile/etc/profile.d/nix.sh
34+
nix --version
35+
which nix
36+
- name: lint terraform
37+
shell: /home/runner/.nix-profile/bin/nix develop --ignore-environment --extra-experimental-features nix-command --extra-experimental-features flakes --keep HOME --keep SSH_AUTH_SOCK --keep GITHUB_TOKEN --keep AWS_ROLE --keep AWS_REGION --keep AWS_DEFAULT_REGION --keep AWS_ACCESS_KEY_ID --keep AWS_SECRET_ACCESS_KEY --keep AWS_SESSION_TOKEN --keep UPDATECLI_GPGTOKEN --keep UPDATECLI_GITHUB_TOKEN --keep UPDATECLI_GITHUB_ACTOR --keep GPG_SIGNING_KEY --keep NIX_SSL_CERT_FILE --keep NIX_ENV_LOADED --keep TERM --command bash -e {0}
38+
run: |
39+
terraform fmt -check -recursive
40+
tflint --recursive
41+
42+
actionlint:
43+
name: 'Lint Workflows'
44+
runs-on: ubuntu-latest
45+
steps:
46+
- uses: actions/checkout@v4
47+
with:
48+
fetch-depth: 0
49+
- name: install-nix
50+
run: |
51+
curl -L https://nixos.org/nix/install | sh
52+
source /home/runner/.nix-profile/etc/profile.d/nix.sh
53+
nix --version
54+
which nix
55+
- name: action lint
56+
shell: /home/runner/.nix-profile/bin/nix develop --ignore-environment --extra-experimental-features nix-command --extra-experimental-features flakes --keep HOME --keep SSH_AUTH_SOCK --keep GITHUB_TOKEN --keep AWS_ROLE --keep AWS_REGION --keep AWS_DEFAULT_REGION --keep AWS_ACCESS_KEY_ID --keep AWS_SECRET_ACCESS_KEY --keep AWS_SESSION_TOKEN --keep UPDATECLI_GPGTOKEN --keep UPDATECLI_GITHUB_TOKEN --keep UPDATECLI_GITHUB_ACTOR --keep GPG_SIGNING_KEY --keep NIX_SSL_CERT_FILE --keep NIX_ENV_LOADED --keep TERM --command bash -e {0}
57+
run: actionlint
58+
59+
shellcheck:
60+
runs-on: ubuntu-latest
61+
steps:
62+
- uses: actions/checkout@v4
63+
with:
64+
fetch-depth: 0
65+
- name: install-nix
66+
run: |
67+
curl -L https://nixos.org/nix/install | sh
68+
source /home/runner/.nix-profile/etc/profile.d/nix.sh
69+
nix --version
70+
which nix
71+
- name: shell check
72+
shell: /home/runner/.nix-profile/bin/nix develop --ignore-environment --extra-experimental-features nix-command --extra-experimental-features flakes --keep HOME --keep SSH_AUTH_SOCK --keep GITHUB_TOKEN --keep AWS_ROLE --keep AWS_REGION --keep AWS_DEFAULT_REGION --keep AWS_ACCESS_KEY_ID --keep AWS_SECRET_ACCESS_KEY --keep AWS_SESSION_TOKEN --keep UPDATECLI_GPGTOKEN --keep UPDATECLI_GITHUB_TOKEN --keep UPDATECLI_GITHUB_ACTOR --keep GPG_SIGNING_KEY --keep NIX_SSL_CERT_FILE --keep NIX_ENV_LOADED --keep TERM --command bash -e {0}
73+
run: |
74+
# while read -r file; do
75+
# echo "checking $file..."
76+
# shellcheck -x "$file"
77+
# done <<<"$(grep -Rl -e '^#!' | grep -v '.terraform'| grep -v '.git')"
78+
# in the future run this on every script, but first we need to eliminate unused scripts
79+
shellcheck -x "./scripts/run_tests.sh"
80+
81+
validate-commit-message:
82+
runs-on: ubuntu-latest
83+
steps:
84+
- uses: actions/checkout@v4
85+
with:
86+
fetch-depth: 0 # fetch all history so that we can validate the commit messages
87+
- name: install-nix
88+
run: |
89+
curl -L https://nixos.org/nix/install | sh
90+
source /home/runner/.nix-profile/etc/profile.d/nix.sh
91+
nix --version
92+
which nix
93+
- name: Check commit message
94+
shell: /home/runner/.nix-profile/bin/nix develop --ignore-environment --extra-experimental-features nix-command --extra-experimental-features flakes --keep HOME --keep SSH_AUTH_SOCK --keep GITHUB_TOKEN --keep AWS_ROLE --keep AWS_REGION --keep AWS_DEFAULT_REGION --keep AWS_ACCESS_KEY_ID --keep AWS_SECRET_ACCESS_KEY --keep AWS_SESSION_TOKEN --keep UPDATECLI_GPGTOKEN --keep UPDATECLI_GITHUB_TOKEN --keep UPDATECLI_GITHUB_ACTOR --keep GPG_SIGNING_KEY --keep NIX_SSL_CERT_FILE --keep NIX_ENV_LOADED --keep TERM --command bash -e {0}
95+
run: |
96+
set -e
97+
# Check commit messages
98+
# This steps enforces https://www.conventionalcommits.org/en/v1.0.0/
99+
# This format enables automatic generation of changelogs and versioning
100+
filter() {
101+
COMMIT="$1"
102+
ouput="$(echo "$COMMIT" | grep -e '^fix: ' -e '^feature: ' -e '^feat: ' -e 'refactor!: ' -e 'feature!: ' -e 'feat!: ' -e '^chore(main): ')"
103+
echo "$output"
104+
}
105+
prefix_check() {
106+
message="$1"
107+
if [ "" != "$(filter "$message")" ]; then
108+
echo "...Commit message does not start with the required prefix.
109+
Please use one of the following prefixes: "fix:", "feature:", "feat:", "refactor!:", "feature!:", or "feat!:".
110+
This enables release-please to automatically determine the type of release (major, minor, patch) based on the commit message.
111+
$message"
112+
exit 1
113+
else
114+
echo "...Commit message starts with the required prefix."
115+
fi
116+
}
117+
empty_check() {
118+
message="$1"
119+
if [ "" == "$message" ]; then
120+
echo "...Empty commit message."
121+
exit 1
122+
else
123+
echo "...Commit message isnt empty."
124+
fi
125+
}
126+
length_check() {
127+
message="$1"
128+
if [ "$(wc -m <<<"$message")" -gt 50 ]; then
129+
echo "...Commit message subject line should be less than 50 characters, found $(wc -m "$message")."
130+
exit 1
131+
else
132+
echo "...Commit message subject line is less than 50 characters."
133+
fi
134+
}
135+
spell_check() {
136+
message="$1"
137+
WORDS="$(aspell list <<<"$message")"
138+
if [ "" != "$WORDS" ]; then
139+
echo "...Commit message contains spelling errors on: ^$WORDS\$"
140+
echo "...Also try updating the PR title."
141+
exit 1
142+
else
143+
echo "...Commit message doesnt contain spelling errors."
144+
fi
145+
}
146+
147+
# Fetch the commit messages
148+
149+
COMMIT_MESSAGES="$(gh pr view ${{github.event.number}} --json commits | jq -r '.commits[].messageHeadline')"
150+
echo "Commit messages found: "
151+
echo "$COMMIT_MESSAGES"
152+
153+
while read -r message; do
154+
echo "checking message ^$message\$"
155+
empty_check "$message"
156+
prefix_check "$message"
157+
length_check "$message"
158+
spell_check "$message"
159+
echo "message ^$message\$ passed all checks"
160+
done <<<"$COMMIT_MESSAGES"
161+
162+
gitleaks:
163+
name: 'Scan for Secrets'
164+
runs-on: ubuntu-latest
165+
steps:
166+
- uses: actions/checkout@v4
167+
with:
168+
fetch-depth: 0
169+
- name: install-nix
170+
run: |
171+
curl -L https://nixos.org/nix/install | sh
172+
source /home/runner/.nix-profile/etc/profile.d/nix.sh
173+
nix --version
174+
which nix
175+
- name: Check for secrets
176+
shell: /home/runner/.nix-profile/bin/nix develop --ignore-environment --extra-experimental-features nix-command --extra-experimental-features flakes --keep HOME --keep SSH_AUTH_SOCK --keep GITHUB_TOKEN --keep AWS_ROLE --keep AWS_REGION --keep AWS_DEFAULT_REGION --keep AWS_ACCESS_KEY_ID --keep AWS_SECRET_ACCESS_KEY --keep AWS_SESSION_TOKEN --keep UPDATECLI_GPGTOKEN --keep UPDATECLI_GITHUB_TOKEN --keep UPDATECLI_GITHUB_ACTOR --keep GPG_SIGNING_KEY --keep NIX_SSL_CERT_FILE --keep NIX_ENV_LOADED --keep TERM --command bash -e {0}
177+
run: |
178+
gitleaks detect --no-banner -v --no-git
179+
gitleaks detect --no-banner -v
180+
continue-on-error: true

‎.github/workflows/release.yaml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,8 @@ jobs:
4444
echo '${{ env.GPG_PASSPHRASE }}' | gpg --detach-sig --pinentry-mode loopback --passphrase-fd 0 --output "${SHASUM_FILE}.sig" --sign "${SHASUM_FILE}"
4545
4646
echo "Validating signature..."
47-
gpg --verify "${SHASUM_FILE}.sig" "${SHASUM_FILE}"
48-
if [ $? -eq 0 ]; then
47+
48+
if ! gpg --verify "${SHASUM_FILE}.sig" "${SHASUM_FILE}"; then
4949
echo "Signature is valid..."
5050
else
5151
echo "Signature verification failed!"

‎.gitignore

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,9 @@ test/data
88
.terraform.lock.hcl
99
*/.terraform.lock.hcl
1010
.terraform
11+
*/*.test
12+
examples/**/rke2
13+
terraform.tfstate
14+
*.tfstate.*
15+
tf-*
16+
*.env

‎docs/resources/namespace.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -134,8 +134,8 @@ Namespaces can be imported using the namespace ID in the format `<project_id>.<n
134134
$ terraform import rancher2_namespace.foo &lt;project_id&gt;.&lt;namespaces_id&gt;
135135
```
136136

137-
`<project_id>` is in the format `<cluster_id>:<id>`, but <id> part is optional:
137+
`<project_id>` is in the format `<cluster_id>:<id>`, this is the output from `data.rancher2_cluster.downstream_cluster.default_project_id`
138138

139-
- If full project_id is provided, `<project_id>=<cluster_id>:<id>`, the namespace'll be assigned to corresponding cluster project once it's imported.
140-
- If `<id>` part is omitted `<project_id>=<cluster_id>`, the namespace'll not be assigned to any project. To move it into a project, `<project_id>=<cluster_id>:<id>` needs to be updated in tf file. Namespace movement is only supported inside same `cluster_id`.
139+
The `<project_id>` must match the actual resource, importing will error on project mismatch.
141140

141+
In past versions you could modify the namespace while importing it, this functionality is no longer available.

‎examples/deploy_rke2/README.md

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
# Deploy RKE2
2+
3+
This example module configures Rancher to deploy a downstream RKE2 cluster.
4+
5+
## Deploy Rancher
6+
7+
This module starts by using the rancher-aws module to deploy Rancher on AWS.
8+
9+
## Downstream
10+
11+
This module has a local module that provides a logical separation for deploying a downstream cluster using the rancher2_cluster_v2 resource.
12+
13+
## Machine Config Patch
14+
15+
There is a local exec that runs kubectl to patch the Amazonec2Config objects.
16+
The AWS access key id and secret access key attributes are obfuscated and unable to be set directly in favor of the Amazonec2Credential object.
17+
The Amazonec2Credential object doesn't support a session token making it impossible to use temporary credentials.
18+
Our CI must use temporary AWS credentials supplied via OIDC, so this may be something that you eliminate from the example in your implementation.
19+
We bypass the Amazonec2Credential object by manually patching the Amazonec2Config objects with the aws_access_key_id and aws_secret_access_key.
20+
The AWS session token isn't obfuscated and is available as an argument when creating a rancher2_machine_config_v2 resource.
21+
22+
## Dependencies
23+
24+
The Flake.nix in the root of the module explains all of the dependencies for the development of the module, it also includes the dependencies to run it.
25+
You can see the list on lines 50-80, but a more specific list is below (with explanations).
26+
- bash -> born again shell with linux core utils
27+
- git -> required by Terraform
28+
- curl -> required by Terraform as well as dependent modules (when downloading RKE2 for install)
29+
- openssh -> required by Terraform and used in dependent modules to connect to servers for initial configuration
30+
- ssh-agent -> used for connecting to remote server for initial configuration, you need to have the key you send into the module loaded in your agent
31+
- gh -> the github cli tool, used to find releases when downloading RKE2 for install
32+
- jq -> json parsing tool, used in dependent modules to parse submodule outputs
33+
- openssl -> required by Terraform and used in dependent modules to verify TLS certificates
34+
- kubectl -> used in local exec to patch kubernetes objects
35+
- awscli2 -> the aws cli tool, used in some dependent modules in some use cases (dualstack)
36+
- tfswitch -> handy for installing Terraform
37+
- yq -> yaml parsing tool, used in dependent modules to parse kubectl outputs
38+
- go -> necessary to run tests
39+
40+
## Environment Variables
41+
42+
I like to set my AWS credentials in environment variables:
43+
- AWS_ROLE -> role to assume when using OIDC
44+
- AWS_REGION -> AWS region to deploy to, make sure there are multiple availability zones when needing HA
45+
- AWS_DEFAULT_REGION -> same as region
46+
- AWS_ACCESS_KEY_ID -> access key, this will make it into the state, please secure it properly
47+
- AWS_SECRET_ACCESS_KEY -> secret key, this will make it into the state, please secure it properly
48+
- AWS_SESSION_TOKEN -> used with temporary AWS credentials, this will make it into the state, please secure it properly
49+
- TF_VAR_aws_access_key_id -> access key, this will make it into the state, please secure it properly
50+
- TF_VAR_aws_secret_access_key -> secret key, this will make it into the state, please secure it properly
51+
- TF_VAR_aws_session_token -> used with temporary AWS credentials, this will make it into the state, please secure it properly
52+
- TF_VAR_aws_region -> AWS region to deploy to, make sure there are multiple availability zones when needing HA
53+

0 commit comments

Comments
 (0)