amont-runtime 1.47.3

//! The three Kubernetes hooks: argo-lint, kube-linter, kubeconform.
//!
//! All are SOFT gates — a missing toolchain warns and skips rather than
//! blocking a commit, because CI is the hard gate and not every developer has
//! kustomize/kubeconform/argo installed.

use super::common::{fail, hl, ok, program, repo_root, staged_files, warn, which};
use crate::check::Outcome;
use std::path::Path;
use std::process::{Command, Stdio};

/// The extensions all three Kubernetes checks consume. Exported so
/// `registry.rs` declares their scopes from the same constant — see
/// `lint_json_yaml::EXTS` for the drift this prevents.
pub const EXTS: &[&str] = &[".yaml", ".yml"];

/// Staged YAML under a kubernetes-ish prefix. Deliberately conservative and
/// shared by all three hooks, so they trigger on exactly the same change sets.
fn k8s_staged() -> Vec<String> {
    const PREFIXES: [&str; 7] = [
        "kubernetes/",
        "manifests/",
        "chart/",
        "charts/",
        "k8s/",
        "helm/",
        "deploy/",
    ];
    staged_files(EXTS)
        .into_iter()
        .filter(|f| PREFIXES.iter().any(|p| f.starts_with(p)))
        .collect()
}

const ARGO_KINDS: [&str; 4] = [
    "Workflow",
    "CronWorkflow",
    "WorkflowTemplate",
    "ClusterWorkflowTemplate",
];

/// `^kind: <one of the Argo kinds>$` — anchored per line, so a `kind:` nested
/// in a template body or a longer word does not qualify.
pub fn declares_argo_kind(content: &str) -> bool {
    content.lines().any(|line| {
        line.strip_prefix("kind: ")
            .map(|k| ARGO_KINDS.contains(&k.trim_end()))
            .unwrap_or(false)
    })
}

pub fn argo_lint(settings: &crate::config::Settings, _args: &[std::ffi::OsString]) -> Outcome {
    let staged = k8s_staged();
    if staged.is_empty() {
        return Outcome::Passed;
    }
    let root = repo_root();
    let workflows: Vec<String> = staged
        .into_iter()
        .filter(|file| {
            std::fs::read_to_string(Path::new(&root).join(file))
                .map(|c| declares_argo_kind(&c))
                .unwrap_or(false)
        })
        .collect();
    if workflows.is_empty() {
        return Outcome::Passed;
    }
    if which("argo").is_none() {
        warn(&format!(
            "Argo workflow manifests staged. Skipping argo lint; install: {}",
            hl("argo")
        ));
        return Outcome::Unavailable;
    }
    // --offline: no cluster needed, inline templates only. Flux ${VAR}
    // postBuild placeholders are inert strings to the linter; Argo {{…}}
    // templating is what it actually checks.
    // `--` before the paths: a workflow file named e.g. `-canary.yaml` would
    // otherwise be read as a flag by argo's own parser.
    let mut argv = vec![
        "lint".to_string(),
        "--offline".to_string(),
        "--".to_string(),
    ];
    argv.extend(workflows.iter().cloned());
    let mut cmd = Command::new(program("argo"));
    cmd.args(&argv).current_dir(&root).stdin(Stdio::null());
    let okd = super::common::bounded_success(settings, &mut cmd, "argo");
    if !okd {
        fail("argo lint failed (output above)");
        return Outcome::Failed;
    }
    let n = workflows.len();
    ok(
        settings,
        &format!(
            "argo lint passed ({n} workflow manifest{})",
            if n > 1 { "s" } else { "" }
        ),
    );
    Outcome::Passed
}

/// Repo-root `.kube-linter*.yaml` / `.yml`, sorted for a stable run order.
pub fn kube_linter_configs(root: &str) -> Vec<String> {
    let Ok(rd) = std::fs::read_dir(root) else {
        return Vec::new();
    };
    let mut out: Vec<String> = rd
        .flatten()
        .filter_map(|e| e.file_name().into_string().ok())
        .filter(|n| n.starts_with(".kube-linter") && (n.ends_with(".yaml") || n.ends_with(".yml")))
        .collect();
    out.sort();
    out
}

pub fn kube_linter(settings: &crate::config::Settings, _args: &[std::ffi::OsString]) -> Outcome {
    if k8s_staged().is_empty() {
        return Outcome::Passed;
    }
    let root = repo_root();
    // Stock kube-linter rules are too noisy to enforce generically, so a
    // repo-local config is the opt-in signal — and it is tested before the
    // binary, so a repo that never opted in is not told to install a linter it
    // does not use, and does not report a gap it does not have.
    let configs = kube_linter_configs(&root);
    if configs.is_empty() {
        // SILENT, like `yamllint::run` in exactly this situation. It used to
        // print a skip notice, which fires on EVERY commit that touches
        // `kubernetes/**.yaml` in a repository that has no `.kube-linter*.yaml`
        // and never will — the same "a repo that never wanted yamllint was told
        // to install it" noise `docs/hook-architecture.md` records these three
        // checks being fixed for.
        return Outcome::Passed;
    }
    if which("kube-linter").is_none() {
        warn(&format!(
            "This repo configures kube-linter but it is not installed. Install {}",
            hl("kube-linter")
        ));
        return Outcome::Unavailable;
    }
    // One run per config: each config's own `excludes:` and scope (set inside
    // the YAML, not on the CLI) decide which manifests it applies to, so
    // apps-vs-infra splits work without per-hook wiring.
    let mut overall = 0;
    for cfg in &configs {
        let mut cmd = Command::new(program("kube-linter"));
        cmd.args(["lint", ".", "--config", cfg])
            .current_dir(&root)
            .stdin(Stdio::null());
        let okd = super::common::bounded_success(settings, &mut cmd, "kube-linter");
        if !okd {
            fail(&format!("kube-linter ({cfg}) found issues"));
            overall = 1;
        }
    }
    if overall != 0 {
        return Outcome::Failed;
    }
    let n = configs.len();
    ok(
        settings,
        &format!(
            "kube-linter passed ({n} config{})",
            if n > 1 { "s" } else { "" }
        ),
    );
    Outcome::Passed
}

/// Walk up from each staged file until a directory holding one of `markers` is
/// found, or the repo root is reached. Deduped, stable order.
///
/// Generalised from `kustomization_roots` when `helm` needed the identical walk
/// for `Chart.yaml`. One walk with two callers rather than two walks: the
/// subtle parts — stopping at the repo root, deduping so ten files under one
/// directory yield one root, keeping the order stable so a golden render can
/// pin it — are the same for every marker, and a second copy is a second place
/// for them to drift.
pub fn marker_roots(root: &str, staged: &[String], markers: &[&str]) -> Vec<String> {
    let mut roots: Vec<String> = Vec::new();
    for f in staged {
        let mut dir = Path::new(f).parent();
        while let Some(d) = dir {
            let s = d.to_string_lossy().to_string();
            if s.is_empty() || s == "." {
                break;
            }
            let base = Path::new(root).join(&s);
            if markers.iter().any(|m| base.join(m).is_file()) {
                if !roots.contains(&s) {
                    roots.push(s);
                }
                break;
            }
            dir = d.parent();
        }
    }
    roots
}

/// The kustomize marker set. Kept as its own function so `k8s`'s callers and
/// their tests are untouched by the generalisation above.
pub fn kustomization_roots(root: &str, staged: &[String]) -> Vec<String> {
    marker_roots(root, staged, &["kustomization.yaml", "kustomization.yml"])
}

/// Kinds from a repo-local `.kubeconform-skip` (one per line, `#` comments) —
/// the escape hatch for the day someone vendors local CRD schemas.
pub fn skip_kinds(content: &str) -> Vec<String> {
    content
        .lines()
        .map(str::trim)
        .filter(|l| !l.is_empty() && !l.starts_with('#'))
        .map(|l| l.replace(' ', ""))
        .collect()
}

pub fn kubeconform(settings: &crate::config::Settings, _args: &[std::ffi::OsString]) -> Outcome {
    let staged = k8s_staged();
    if staged.is_empty() {
        return Outcome::Passed;
    }
    let root = repo_root();
    let roots = kustomization_roots(&root, &staged);
    // Raw-YAML validation is out of scope: a project either uses kustomize or
    // it does not — and that, not the toolbox, is what decides whether this
    // check had anything to do.
    if roots.is_empty() {
        return Outcome::Passed;
    }
    let missing: Vec<&str> = ["kustomize", "kubeconform"]
        .into_iter()
        .filter(|t| which(t).is_none())
        .collect();
    if !missing.is_empty() {
        warn(&format!(
            "Kustomizations staged. Skipping kubeconform; install: {}",
            hl(&missing.join(", "))
        ));
        return Outcome::Unavailable;
    }

    let skip = std::fs::read_to_string(Path::new(&root).join(".kubeconform-skip"))
        .ok()
        .map(|c| skip_kinds(&c))
        .filter(|k| !k.is_empty())
        .map(|k| k.join(","));

    let mut overall = 0;
    for r in &roots {
        if !validate_root(settings, &root, r, skip.as_deref()) {
            fail(&format!("kubeconform failed for {r}"));
            overall = 1;
        }
    }
    if overall != 0 {
        return Outcome::Failed;
    }
    let n = roots.len();
    ok(
        settings,
        &format!(
            "kubeconform passed ({n} kustomization root{})",
            if n > 1 { "s" } else { "" }
        ),
    );
    Outcome::Passed
}

/// `kustomize build <root> | kubeconform …`, with the shell's `pipefail`
/// semantics: a kustomize failure fails the check even when kubeconform would
/// happily consume the empty input.
fn validate_root(
    settings: &crate::config::Settings,
    root: &str,
    sub: &str,
    skip: Option<&str>,
) -> bool {
    // `--` before `sub`: it is a directory name walked up from staged paths,
    // so a kustomization root named e.g. `-overlay` would otherwise be read
    // as a flag by kustomize's own (cobra) parser.
    // `--load-restrictor LoadRestrictionsNone`, because the question this check
    // answers is "will the cluster accept what Flux applies", and
    // kustomize-controller loads relative to the SOURCE root rather than the
    // kustomization directory. kustomize's CLI default refuses a `../` reference
    // that leaves the root, so a root the controller renders happily fails here
    // with `security; file ... is not in or below ...` — and since a build
    // failure fails the check, the effect is that such a directory cannot be
    // committed to at all.
    //
    // Real example: a repository where `apps/stalwart-secrets/` is built almost
    // entirely from `../stalwart/*.yaml`. Flux applies it every ten minutes; the
    // CLI cannot build it; and the repository's CI had grown a whitelist for
    // that exact error string, so the directory was silently validated by
    // nothing while every commit touching it was blocked locally.
    //
    // The relaxation is what the controller already does with the same files, so
    // it widens nothing the cluster does not already permit.
    let Ok(mut build) = Command::new(program("kustomize"))
        .args([
            "build",
            "--load-restrictor",
            "LoadRestrictionsNone",
            "--",
            sub,
        ])
        .current_dir(root)
        .stdin(Stdio::null())
        .stdout(Stdio::piped())
        .spawn()
    else {
        return false;
    };
    let Some(out) = build.stdout.take() else {
        return false;
    };

    // CRDs are deliberately NOT validated against an external catalog: the
    // datree CRDs-catalog is unmaintained (Datree is EOL) and its cilium schema
    // typed CIDR fields IPv4-only, false-failing IPv6 policies. Kyverno CLI,
    // Trivy and each operator's admission webhook cover them instead.
    let mut argv = vec![
        "--strict",
        "--ignore-missing-schemas",
        "--schema-location",
        "default",
    ];
    if let Some(s) = skip {
        argv.push("--skip");
        argv.push(s);
    }
    argv.push("--summary");
    argv.push("-");

    let mut cmd = Command::new(program("kubeconform"));
    cmd.args(&argv).current_dir(root).stdin(Stdio::from(out));
    let conform = super::common::bounded_success(settings, &mut cmd, "kubeconform");
    // kubeconform's deadline closes the pipe, which normally ends kustomize
    // too — but a kustomize hung BEFORE writing (a remote base fetching over
    // the network, say) never feels the pipe close, and an unbounded wait
    // here would inherit its hang. Same clock, and a kill on expiry.
    let built = matches!(
        super::common::wait_within(&mut build, super::common::check_timeout(settings), 0, None),
        Ok(super::common::Ran::Status(s)) if s.success()
    );
    built && conform
}

#[cfg(test)]
mod tests {
    use super::*;

    fn test_settings() -> crate::config::Settings {
        crate::config::Settings::default()
    }

    #[test]
    fn recognises_every_argo_kind_and_nothing_else() {
        for k in ARGO_KINDS {
            assert!(
                declares_argo_kind(&format!("apiVersion: x\nkind: {k}\n")),
                "{k}"
            );
        }
        assert!(!declares_argo_kind("kind: Deployment\n"));
        assert!(!declares_argo_kind("kind: WorkflowSomethingElse\n"));
        assert!(!declares_argo_kind("  kind: Workflow\n")); // must be anchored
    }

    #[test]
    fn parses_the_skip_list() {
        let c = "# comment\nCiliumNetworkPolicy\n\n  Foo Bar \n";
        assert_eq!(skip_kinds(c), vec!["CiliumNetworkPolicy", "FooBar"]);
        assert!(skip_kinds("# only a comment\n").is_empty());
    }

    /// A root built from files ABOVE it must validate.
    ///
    /// kustomize's CLI default refuses `../` out of the root; kustomize-controller
    /// does not, so a directory Flux applies every ten minutes failed here — and
    /// because a build failure fails the check, no commit touching that directory
    /// could be made at all. Needs the real binaries; skipped without them, the
    /// same soft-tool rule the check itself follows.
    #[test]
    fn a_root_that_reaches_above_itself_still_validates() {
        if which("kustomize").is_none() || which("kubeconform").is_none() {
            return;
        }
        let tmp = std::env::temp_dir().join(format!("amont-loadrestrictor-{}", std::process::id()));
        let _ = std::fs::remove_dir_all(&tmp);
        let shared = tmp.join("shared");
        let overlay = tmp.join("overlay");
        std::fs::create_dir_all(&shared).unwrap();
        std::fs::create_dir_all(&overlay).unwrap();
        std::fs::write(
            shared.join("namespace.yaml"),
            "apiVersion: v1\nkind: Namespace\nmetadata:\n  name: demo\n",
        )
        .unwrap();
        // The shape that fails without the relaxation: every resource lives in a
        // sibling directory.
        std::fs::write(
            overlay.join("kustomization.yaml"),
            "apiVersion: kustomize.config.k8s.io/v1beta1\nkind: Kustomization\nresources:\n  - ../shared/namespace.yaml\n",
        )
        .unwrap();

        let root = tmp.to_string_lossy().to_string();
        assert!(
            validate_root(&test_settings(), &root, "overlay", None),
            "a kustomization built from ../shared must validate — kustomize-controller renders it"
        );
        let _ = std::fs::remove_dir_all(&tmp);
    }

    #[test]
    fn walks_up_to_the_nearest_kustomization_root() {
        let tmp = std::env::temp_dir().join("amont-kustomize-test");
        let _ = std::fs::remove_dir_all(&tmp);
        let base = tmp.join("kubernetes/app/base");
        std::fs::create_dir_all(&base).unwrap();
        std::fs::write(base.join("kustomization.yaml"), "resources: []").unwrap();
        let root = tmp.to_string_lossy().to_string();

        let found = kustomization_roots(&root, &["kubernetes/app/base/deploy.yaml".into()]);
        assert_eq!(found, vec!["kubernetes/app/base".to_string()]);

        // nothing above it → no root, and therefore nothing to validate
        let none = kustomization_roots(&root, &["kubernetes/loose/deploy.yaml".into()]);
        assert!(none.is_empty());
        let _ = std::fs::remove_dir_all(&tmp);
    }
}