xianyun_deploy/deployer/helm/

chartdeps.rs

//! Ported from `internal/deployer/helm/chartdeps.go`.

use std::path::{Path, PathBuf};
use std::sync::LazyLock;

use serde::Deserialize;
use sha2::{Digest, Sha256};

use super::HelmError;

/// Ported from `chartMetadataFile`: the file that marks a directory as a
/// chart.
pub(super) const CHART_METADATA_FILE: &str = "Chart.yaml";

/// Ported from `lockFile`: where a chart pins its resolved dependencies.
pub(super) const LOCK_FILE: &str = "Chart.lock";

/// Ported from `satisfiedStatuses`: the `helm dependency list` `STATUS`
/// values that need no fetching.
const SATISFIED_STATUSES: &[&str] = &["ok", "unpacked"];

static REPO_NAME_UNSAFE: LazyLock<regex::Regex> =
    LazyLock::new(|| regex::Regex::new(r"[^a-z0-9]+").unwrap());

/// Ported from `chartLock`: the part of `Chart.lock` this needs.
#[derive(Debug, Default, Deserialize)]
struct ChartLockDependency {
    #[serde(default)]
    repository: String,
}

#[derive(Debug, Default, Deserialize)]
struct ChartLock {
    #[serde(default)]
    dependencies: Vec<ChartLockDependency>,
}

/// Ported from `dependenciesSatisfied`.
#[must_use]
pub(super) fn dependencies_satisfied(list_output: &str) -> bool {
    for line in list_output.lines() {
        let row = line.trim();

        if row.is_empty() {
            continue;
        }

        if row.to_uppercase().starts_with("WARNING:") {
            continue;
        }

        if row.starts_with("NAME") {
            continue;
        }

        let satisfied = SATISFIED_STATUSES
            .iter()
            .any(|status| row.ends_with(status));

        if !satisfied {
            return false;
        }
    }

    true
}

/// Ported from `lockedRepositories`.
pub(super) fn locked_repositories(chart_dir: &Path) -> Result<Vec<String>, HelmError> {
    let path = chart_dir.join(LOCK_FILE);

    let data = match std::fs::read(&path) {
        Ok(data) => data,
        Err(e) if e.kind() == std::io::ErrorKind::NotFound => return Ok(Vec::new()),
        Err(e) => return Err(HelmError::Io(format!("reading {LOCK_FILE}: {e}"))),
    };

    let lock: ChartLock = serde_yaml::from_slice(&data).map_err(|e| {
        HelmError::Io(format!(
            "parsing chart lock in {}: {e}",
            chart_dir.display()
        ))
    })?;

    let mut seen = std::collections::HashSet::new();
    let mut repos = Vec::new();

    for dep in lock.dependencies {
        let repo = dep.repository.trim();

        if repo.is_empty() || repo.starts_with("file://") || repo.starts_with("oci://") {
            continue;
        }

        if !seen.insert(repo.to_string()) {
            continue;
        }

        repos.push(repo.to_string());
    }

    Ok(repos)
}

/// Ported from `isChartDirectory`. A relative reference is resolved against
/// caproni's current working directory, as helm resolves it too.
#[must_use]
pub(super) fn is_chart_directory(chart: &str) -> bool {
    if chart.is_empty() {
        return false;
    }

    std::fs::metadata(chart).is_ok_and(|info| info.is_dir())
}

/// Ported from `locateUnpackedChart`.
pub(super) fn locate_unpacked_chart(dir: &Path) -> Result<PathBuf, HelmError> {
    let mut matches = Vec::new();

    if let Ok(entries) = std::fs::read_dir(dir) {
        for entry in entries.flatten() {
            let candidate = entry.path();
            if candidate.is_dir() && candidate.join(CHART_METADATA_FILE).is_file() {
                matches.push(candidate);
            }
        }
    }

    match matches.len() {
        0 => Err(HelmError::ChartNotUnpacked(dir.display().to_string())),
        1 => Ok(matches.remove(0)),
        _ => Err(HelmError::AmbiguousUnpackedChart(dir.display().to_string())),
    }
}

/// Ported from `chartRepoName`.
#[must_use]
pub(super) fn chart_repo_name(repo_url: &str) -> String {
    let trimmed = repo_url.trim().trim_end_matches('/');

    let mut hasher = Sha256::new();
    hasher.update(trimmed.as_bytes());
    let digest = hex::encode(hasher.finalize())[..8].to_string();

    let host = url::Url::parse(trimmed)
        .ok()
        .and_then(|u| u.host_str().map(str::to_string))
        .filter(|h| !h.is_empty())
        .unwrap_or_else(|| trimmed.to_string());

    let slug = REPO_NAME_UNSAFE
        .replace_all(&host.to_lowercase(), "-")
        .trim_matches('-')
        .to_string();

    format!("caproni-{slug}-{digest}")
}

#[cfg(test)]
mod tests {
    use super::*;

    // Ported from internal/deployer/helm/chartdeps_test.go
    #[test]
    // Ported from internal/deployer/helm/chartdeps_test.go:14 (TestDependenciesSatisfied)
    fn test_dependencies_satisfied() {
        struct Case {
            name: &'static str,
            output: &'static str,
            want: bool,
        }

        let cases = [
            Case {
                name: "every dependency is ok",
                output: "NAME         \tVERSION\tREPOSITORY                    \tSTATUS\ncert-manager \t1.16.2 \thttps://charts.jetstack.io    \tok\nprometheus   \t25.8.0 \thttps://prometheus-community.github.io/helm-charts\tok\n",
                want: true,
            },
            Case {
                name: "every dependency is unpacked",
                output: "NAME     \tVERSION\tREPOSITORY               \tSTATUS\nregistry \t1.0.0  \t                         \tunpacked\ngitlab   \t10.3.1 \t                         \tunpacked\n",
                want: true,
            },
            Case {
                name: "one dependency is missing",
                output: "NAME         \tVERSION\tREPOSITORY                \tSTATUS\nregistry     \t1.0.0  \t                          \tunpacked\ncert-manager \t1.16.2 \thttps://charts.jetstack.io\tmissing\n",
                want: false,
            },
            Case {
                name: "a dependency is at the wrong version",
                output: "NAME         \tVERSION\tREPOSITORY                \tSTATUS\ncert-manager \t1.16.2 \thttps://charts.jetstack.io\twrong version\n",
                want: false,
            },
            Case {
                name: "a status containing a space is not mistaken for ok",
                output: "NAME         \tVERSION\tREPOSITORY                \tSTATUS\ncert-manager \t1.16.2 \thttps://charts.jetstack.io\ttoo many matches\n",
                want: false,
            },
            Case {
                name: "a truncated repository column does not hide the status",
                output: "NAME         \tVERSION\tREPOSITORY          \tSTATUS\ncert-manager \t1.16.2 \thttps://charts.jets...\tok\n",
                want: true,
            },
            Case {
                name: "a chart with no dependencies is satisfied",
                output: "WARNING: no dependencies at /tmp/chart/charts\n",
                want: true,
            },
            Case {
                name: "warnings about unexpected charts are ignored",
                output: "NAME         \tVERSION\tREPOSITORY                \tSTATUS\ncert-manager \t1.16.2 \thttps://charts.jetstack.io\tok\n\nWARNING: \"/tmp/chart/charts/stray\" is not in Chart.yaml.\nWarning: stat /tmp/chart/charts/x: no such file or directory\n",
                want: true,
            },
            Case {
                name: "a header with no rows is satisfied",
                output: "NAME\tVERSION\tREPOSITORY\tSTATUS\n",
                want: true,
            },
            Case {
                name: "an unreadable row is treated as unsatisfied",
                output: "NAME\tVERSION\tREPOSITORY\tSTATUS\nsomething unexpected\n",
                want: false,
            },
        ];

        for case in cases {
            assert_eq!(
                dependencies_satisfied(case.output),
                case.want,
                "{}",
                case.name
            );
        }
    }

    #[test]
    // Ported from internal/deployer/helm/chartdeps_test.go:103 (TestLockedRepositories)
    fn test_locked_repositories() {
        struct Case {
            name: &'static str,
            file: bool,
            lock: &'static str,
            want: Vec<&'static str>,
            want_err: bool,
        }

        let cases = [
            Case {
                name: "the http repositories a Chart.lock names",
                file: true,
                lock: "dependencies:\n- name: cert-manager\n  repository: https://charts.jetstack.io\n  version: 1.16.2\n- name: prometheus\n  repository: https://prometheus-community.github.io/helm-charts\n  version: 25.8.0\ndigest: sha256:abc\n",
                want: vec![
                    "https://charts.jetstack.io",
                    "https://prometheus-community.github.io/helm-charts",
                ],
                want_err: false,
            },
            Case {
                name: "only the repositories helm needs registered, once each",
                file: true,
                lock: "dependencies:\n- name: in-tree\n  repository: \"\"\n  version: 1.0.0\n- name: vendored\n  repository: file://./charts/vendored\n  version: 1.0.0\n- name: from-registry\n  repository: oci://registry.example.com/charts\n  version: 1.0.0\n- name: cert-manager\n  repository: https://charts.jetstack.io\n  version: 1.16.2\n- name: cert-manager-again\n  repository: https://charts.jetstack.io\n  version: 1.16.2\n",
                want: vec!["https://charts.jetstack.io"],
                want_err: false,
            },
            Case {
                name: "a chart without a lock has nothing to register",
                file: false,
                lock: "",
                want: vec![],
                want_err: false,
            },
            Case {
                name: "a lock that cannot be read",
                file: true,
                lock: "dependencies: [oh dear\n",
                want: vec![],
                want_err: true,
            },
        ];

        for case in cases {
            let dir = tempfile::tempdir().unwrap();
            if case.file {
                std::fs::write(dir.path().join("Chart.lock"), case.lock).unwrap();
            }

            let result = locked_repositories(dir.path());

            if case.want_err {
                assert!(result.is_err(), "{}", case.name);
                continue;
            }

            let repos = result.unwrap_or_else(|e| panic!("{}: {e}", case.name));
            assert_eq!(repos, case.want, "{}", case.name);
        }
    }

    #[test]
    // Ported from internal/deployer/helm/chartdeps_test.go:186 (TestIsChartDirectory)
    fn test_is_chart_directory() {
        let dir = tempfile::tempdir().unwrap();
        let file = dir.path().join("my-app-1.0.0.tgz");
        std::fs::write(&file, "x").unwrap();

        assert!(is_chart_directory(dir.path().to_str().unwrap()));
        assert!(
            !is_chart_directory(file.to_str().unwrap()),
            "a packaged chart is not a directory"
        );
        assert!(
            !is_chart_directory(dir.path().join("missing").to_str().unwrap()),
            "a path that does not resolve"
        );
        assert!(
            !is_chart_directory("gitlab/gitlab"),
            "a repository reference"
        );
        assert!(!is_chart_directory(""), "an empty reference");
    }

    #[test]
    // Ported from internal/deployer/helm/chartdeps_test.go:200 (TestLocateUnpackedChart)
    fn test_locate_unpacked_chart() {
        // finds the chart helm unpacked beside its stray directory
        {
            let dir = tempfile::tempdir().unwrap();
            std::fs::create_dir_all(dir.path().join("gitlab-abc123.tar.gz")).unwrap();
            std::fs::create_dir_all(dir.path().join("gitlab")).unwrap();
            std::fs::write(
                dir.path().join("gitlab").join("Chart.yaml"),
                "name: gitlab\n",
            )
            .unwrap();

            let root = locate_unpacked_chart(dir.path()).unwrap();

            assert_eq!(root, dir.path().join("gitlab"));
        }

        // reports a directory holding no chart
        {
            let dir = tempfile::tempdir().unwrap();
            let err = locate_unpacked_chart(dir.path()).unwrap_err();
            assert!(matches!(err, HelmError::ChartNotUnpacked(_)));
        }

        // reports a directory holding more than one chart
        {
            let dir = tempfile::tempdir().unwrap();
            for name in ["one", "two"] {
                std::fs::create_dir_all(dir.path().join(name)).unwrap();
                std::fs::write(
                    dir.path().join(name).join("Chart.yaml"),
                    format!("name: {name}\n"),
                )
                .unwrap();
            }

            let err = locate_unpacked_chart(dir.path()).unwrap_err();
            assert!(matches!(err, HelmError::AmbiguousUnpackedChart(_)));
        }
    }

    #[test]
    // Ported from internal/deployer/helm/chartdeps_test.go:242 (TestChartRepoName)
    fn test_chart_repo_name() {
        let name = chart_repo_name("https://charts.jetstack.io");

        assert!(
            name.starts_with("caproni-"),
            "should say what created it: {name}"
        );
        assert!(
            name.contains("charts-jetstack-io"),
            "should say which repository it is"
        );

        let odd = chart_repo_name("https://user:pw@example.com:8443/a/b?x=1");
        assert!(
            odd.chars()
                .all(|c| c.is_ascii_lowercase() || c.is_ascii_digit() || c == '-'),
            "should hold only characters a helm repository name can: {odd}"
        );

        // Stable, so helm reuses the index it cached last time, and unaffected
        // by a trailing slash, as helm's own matching is.
        assert_eq!(name, chart_repo_name("https://charts.jetstack.io/"));

        // A collision would make RepoAdd clobber the entry the other URL needs.
        assert_ne!(
            chart_repo_name("https://gitlab.com/api/v4/projects/1/packages/helm/stable"),
            chart_repo_name("https://gitlab.com/api/v4/projects/2/packages/helm/stable"),
        );
    }

    // --- Ported from internal/deployer/helm/chartdeps_integration_test.go ---
    //
    // A real `helm` binary is available in this environment, so these run
    // against it for real rather than staying `unimplemented!()` stubs.
    // There is no live network access, so "a repository" here means a
    // `StaticFileServer` (`httpfixture.rs`) serving a `helm repo index`'d
    // directory on `127.0.0.1` -- exactly what `helm repo add`/`helm
    // dependency build` need, without reaching the internet. Go
    // build-tags this whole file `_integration_test.go` and marks every
    // test `//nolint:paralleltest // sets HELM_* in the environment`;
    // `HelmEnvGuard` is this port's equivalent serialization.

    use std::sync::Arc;

    use super::super::httpfixture::{
        HelmEnvGuard, StaticFileServer, index_repo, package_chart, tar_chart,
    };
    use super::super::manager::Manager;
    use xianyun_backends::helm::Client as HelmClient;
    use xianyun_core::config::latest::{DeployerConfig, HelmConfig, HelmReleaseConfig};

    fn real_manager() -> Manager<HelmClient> {
        Manager::new(HelmClient::new(
            "",
            Arc::new(xianyun_executor::exec::Client::new()),
        ))
    }

    /// Packages, serves, and indexes a one-chart repository holding
    /// `dep-chart` 0.1.0. Returns the server (keep it alive for the
    /// duration of the test) and its base URL.
    fn serve_dep_chart_repo(workdir: &Path) -> (StaticFileServer, String) {
        let dep_chart_dir = workdir.join("dep-chart");
        std::fs::create_dir_all(dep_chart_dir.join("templates")).unwrap();
        std::fs::write(
            dep_chart_dir.join("Chart.yaml"),
            "apiVersion: v2\nname: dep-chart\nversion: 0.1.0\n",
        )
        .unwrap();
        std::fs::write(
            dep_chart_dir.join("templates").join("configmap.yaml"),
            "apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: dep-chart-cm\n",
        )
        .unwrap();

        let repo_dir = workdir.join("repo");
        std::fs::create_dir_all(&repo_dir).unwrap();
        package_chart(&dep_chart_dir, &repo_dir);

        // The server needs to be listening before `helm repo index` writes
        // its URL into index.yaml, since the URL is baked in up front.
        let server = StaticFileServer::start(repo_dir.clone());
        let url = server.url();
        index_repo(&repo_dir, &url);

        (server, url)
    }

    /// Writes `parent-chart`, declaring `dep-chart` as a dependency served
    /// at `dep_repo_url`, and runs a real `helm dependency update` so a
    /// genuine `Chart.lock` (and, unless `strip_charts` is set, a populated
    /// `charts/` directory) exists before the test's own call to
    /// `resolve_chart_dependencies`/`prepare_chart_source`.
    fn write_parent_chart(workdir: &Path, dep_repo_url: &str, strip_charts: bool) -> PathBuf {
        let chart_dir = workdir.join("parent-chart");
        std::fs::create_dir_all(chart_dir.join("templates")).unwrap();
        std::fs::write(
            chart_dir.join("Chart.yaml"),
            format!(
                "apiVersion: v2\nname: parent-chart\nversion: 0.1.0\ndependencies:\n- name: dep-chart\n  version: 0.1.0\n  repository: {dep_repo_url}\n"
            ),
        )
        .unwrap();

        let output = std::process::Command::new("helm")
            .arg("dependency")
            .arg("update")
            .arg(&chart_dir)
            .output()
            .expect("helm binary must be on PATH");
        assert!(
            output.status.success(),
            "helm dependency update failed: {}",
            String::from_utf8_lossy(&output.stderr)
        );

        if strip_charts {
            std::fs::remove_dir_all(chart_dir.join("charts")).unwrap();
        }

        chart_dir
    }

    // Ported from internal/deployer/helm/chartdeps_integration_test.go:293
    // (TestChartDependencies_SatisfiedChartIsNotResolved)
    #[test]
    fn test_chart_dependencies_satisfied_chart_is_not_resolved() {
        let workdir = tempfile::tempdir().unwrap();
        let home = tempfile::tempdir().unwrap();
        let _env = HelmEnvGuard::install(home.path());

        let (server, dep_repo_url) = serve_dep_chart_repo(workdir.path());
        // `strip_charts: false` so the dependency is already vendored --
        // `helm dependency list` reports "ok" without touching the
        // repository at all.
        let chart_dir = write_parent_chart(workdir.path(), &dep_repo_url, false);

        // The repository is gone by the time resolution runs: a satisfied
        // chart must not be resolved (i.e. must not need the repository),
        // not merely "happens to succeed because the repository was still
        // reachable".
        drop(server);

        real_manager()
            .resolve_chart_dependencies(&chart_dir)
            .expect("a satisfied chart's dependencies resolve without reaching the repository");

        assert!(
            chart_dir
                .join("charts")
                .join("dep-chart-0.1.0.tgz")
                .is_file(),
            "the vendored dependency must be left untouched"
        );
    }

    // Ported from internal/deployer/helm/chartdeps_integration_test.go:239
    // (TestChartDependencies_ChartDirectoryIsResolvedInPlace)
    #[test]
    fn test_chart_dependencies_chart_directory_is_resolved_in_place() {
        let workdir = tempfile::tempdir().unwrap();
        let home = tempfile::tempdir().unwrap();
        let _env = HelmEnvGuard::install(home.path());

        let (_server, dep_repo_url) = serve_dep_chart_repo(workdir.path());
        let chart_dir = write_parent_chart(workdir.path(), &dep_repo_url, true);

        let deployer_config = DeployerConfig {
            deployer_type: "helm".to_string(),
            helm: Some(HelmConfig {
                release: Some(HelmReleaseConfig {
                    name: "parent".to_string(),
                    chart: chart_dir.display().to_string(),
                    ..Default::default()
                }),
                ..Default::default()
            }),
            ..Default::default()
        };
        let caproni_config = xianyun_core::config::latest::CaproniConfig::default();

        let (resolved_chart, cleanup) = real_manager()
            .prepare_chart_source(&deployer_config, &caproni_config)
            .expect("resolving a local chart directory's dependencies");
        cleanup();

        // "In place": the directory handed to helm is exactly the one
        // named by the config, not a copy.
        assert_eq!(resolved_chart, chart_dir.display().to_string());
        assert!(
            chart_dir
                .join("charts")
                .join("dep-chart-0.1.0.tgz")
                .is_file(),
            "dependency build must have populated the chart's own charts/ directory"
        );
    }

    // Ported from internal/deployer/helm/chartdeps_integration_test.go:199
    // (TestChartDependencies_URLArchiveIsResolvedFromItsLock)
    #[test]
    fn test_chart_dependencies_url_archive_is_resolved_from_its_lock() {
        let workdir = tempfile::tempdir().unwrap();
        let home = tempfile::tempdir().unwrap();
        let _env = HelmEnvGuard::install(home.path());

        let (_dep_server, dep_repo_url) = serve_dep_chart_repo(workdir.path());
        // The chart that gets downloaded carries a Chart.lock pointing at
        // `dep_repo_url` but no vendored `charts/` of its own -- resolving
        // it from that lock, after unpacking, is exactly what this test
        // name describes.
        let chart_dir = write_parent_chart(workdir.path(), &dep_repo_url, true);

        let archive_dir = workdir.path().join("archive");
        std::fs::create_dir_all(&archive_dir).unwrap();
        let archive_path = tar_chart(&chart_dir, &archive_dir);

        let archive_server = StaticFileServer::start(archive_dir.clone());
        let archive_url = format!(
            "{}/{}",
            archive_server.url(),
            archive_path.file_name().unwrap().to_str().unwrap()
        );

        let (resolved_chart, cleanup) = real_manager()
            .materialize_url_chart(&archive_url)
            .expect("fetching and resolving a URL-referenced chart archive");

        assert!(
            resolved_chart
                .join("charts")
                .join("dep-chart-0.1.0.tgz")
                .is_file(),
            "the unpacked archive's own dependency must be resolved from its Chart.lock"
        );

        cleanup();
    }

    // Ported from internal/deployer/helm/chartdeps_integration_test.go:268
    // (TestChartDependencies_UsesARepositoryTheUserAlreadyRegistered)
    #[test]
    fn test_chart_dependencies_uses_a_repository_the_user_already_registered() {
        let workdir = tempfile::tempdir().unwrap();
        let home = tempfile::tempdir().unwrap();
        let _env = HelmEnvGuard::install(home.path());

        let (_server, dep_repo_url) = serve_dep_chart_repo(workdir.path());
        let chart_dir = write_parent_chart(workdir.path(), &dep_repo_url, true);

        let manager = real_manager();

        // The user already has this exact URL registered, under a name of
        // their own choosing.
        let output = std::process::Command::new("helm")
            .args(["repo", "add", "my-own-jetstack", &dep_repo_url])
            .output()
            .expect("helm binary must be on PATH");
        assert!(
            output.status.success(),
            "helm repo add failed: {}",
            String::from_utf8_lossy(&output.stderr)
        );

        manager
            .resolve_chart_dependencies(&chart_dir)
            .expect("resolving dependencies against an already-registered repository");

        let repos = manager.get_existing_helm_repos().unwrap();
        assert_eq!(
            repos.len(),
            1,
            "no second (auto-named) repository should have been registered: {repos:?}"
        );
        assert_eq!(repos[0].name, "my-own-jetstack");

        assert!(
            chart_dir
                .join("charts")
                .join("dep-chart-0.1.0.tgz")
                .is_file()
        );
    }
}