mirror of
https://github.com/kubeshark/kubeshark.git
synced 2026-08-18 11:56:31 +00:00
* deps: bump indirect deps to clear critical/high Dependabot alerts Bumps the vulnerable indirect dependencies flagged as critical or high severity in Dependabot: - golang.org/x/crypto v0.39.0 -> v0.54.0 (7 critical + 2 high: SSH agent constraint/key-constraint bypass, @revoked auth bypass, FIDO/U2F presence check bypass, VerifiedPublicKeyCallback permission skip, infinite loop on large channel writes, client-induced server deadlock, RSA/DSA DoS, byte arithmetic underflow panic) - google.golang.org/grpc v1.68.1 -> v1.83.0 (critical: authz bypass via missing leading slash in :path; high: xDS RBAC and HTTP/2 issues) - github.com/containerd/containerd v1.7.27 -> v1.7.34 (high: LABEL -> restart-monitor binary:// host-root RCE, runAsNonRoot evasion, local privesc via wide CRI directory permissions) - oras.land/oras-go/v2 v2.6.0 -> v2.6.2 (high: CVE-2026-50163 hardlink extract-dir escape, credential forwarding via unvalidated Location header) - github.com/moby/spdystream v0.5.0 -> v0.5.1 (high: DoS on CRI) Transitively pulls up x/net, x/sync, x/sys, x/term, x/text, x/time, x/oauth2, protobuf, filepath-securejoin, selinux and go-logr via go mod tidy. The go directive moves 1.24.0 -> 1.25.0 (required by the upgraded modules); the explicit toolchain pin is dropped. CI resolves Go from go.mod, so no workflow changes are needed. go build ./... and go test ./... pass. * ci: move golangci-lint to v2, fix resulting lint issues golangci-lint-action@v3 pins `latest` to v1.64.8, which is built with go1.24 and refuses to run now that go.mod targets 1.25.0: can't load config: the Go language version (go1.24) used to build golangci-lint is lower than the targeted Go version (1.25.0) Move the job to golangci-lint-action@v7 + v2.8.0 and add a .golangci.yml mirroring the hub repo's v2 config: govet, staticcheck, ineffassign and unused, plus gofmt/goimports as formatters. Fixes for the issues that surfaced: - ST1005: lowercase error strings, drop trailing '!' in connect/hub.go - SA4011: kubernetes/watch.go had a `break` inside a `select` default that broke the select rather than the loop, i.e. a no-op; removed - QF1008: drop the embedded ChartPathOptions selector in helm.go - QF1003: tagged switch on r.URL.Path in mcp_test.go - QF1004: strings.Replace(..., -1) -> strings.ReplaceAll - gofmt -s and goimports with a local prefix across the tree errcheck is not in the enabled set, matching hub. * cmd: clarify --time parse error in pcap dump The error neither named the offending flag/value nor separated the wrapped error from the message. Reported by Copilot on #1952. --------- Co-authored-by: Alon Girmonsky <1990761+alongir@users.noreply.github.com>
191 lines
4.6 KiB
Go
191 lines
4.6 KiB
Go
package helm
|
|
|
|
import (
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
"path/filepath"
|
|
"regexp"
|
|
"strings"
|
|
|
|
"github.com/pkg/errors"
|
|
"github.com/rs/zerolog/log"
|
|
"helm.sh/helm/v3/pkg/action"
|
|
"helm.sh/helm/v3/pkg/chart"
|
|
"helm.sh/helm/v3/pkg/chart/loader"
|
|
"helm.sh/helm/v3/pkg/cli"
|
|
"helm.sh/helm/v3/pkg/downloader"
|
|
"helm.sh/helm/v3/pkg/getter"
|
|
"helm.sh/helm/v3/pkg/kube"
|
|
"helm.sh/helm/v3/pkg/registry"
|
|
"helm.sh/helm/v3/pkg/release"
|
|
"helm.sh/helm/v3/pkg/repo"
|
|
|
|
"github.com/kubeshark/kubeshark/config"
|
|
"github.com/kubeshark/kubeshark/misc"
|
|
)
|
|
|
|
const ENV_HELM_DRIVER = "HELM_DRIVER"
|
|
|
|
var settings = cli.New()
|
|
|
|
type Helm struct {
|
|
repo string
|
|
releaseName string
|
|
releaseNamespace string
|
|
}
|
|
|
|
func NewHelm(repo string, releaseName string, releaseNamespace string) *Helm {
|
|
return &Helm{
|
|
repo: repo,
|
|
releaseName: releaseName,
|
|
releaseNamespace: releaseNamespace,
|
|
}
|
|
}
|
|
|
|
func parseOCIRef(chartRef string) (string, string, error) {
|
|
refTagRegexp := regexp.MustCompile(`^(oci://[^:]+(:[0-9]{1,5})?[^:]+):(.*)$`)
|
|
caps := refTagRegexp.FindStringSubmatch(chartRef)
|
|
if len(caps) != 4 {
|
|
return "", "", errors.Errorf("improperly formatted oci chart reference: %s", chartRef)
|
|
}
|
|
chartRef = caps[1]
|
|
tag := caps[3]
|
|
|
|
return chartRef, tag, nil
|
|
}
|
|
|
|
func (h *Helm) Install() (rel *release.Release, err error) {
|
|
kubeConfigPath := config.Config.KubeConfigPath()
|
|
actionConfig := new(action.Configuration)
|
|
if err = actionConfig.Init(kube.GetConfig(kubeConfigPath, "", h.releaseNamespace), h.releaseNamespace, os.Getenv(ENV_HELM_DRIVER), func(format string, v ...interface{}) {
|
|
log.Info().Msgf(format, v...)
|
|
}); err != nil {
|
|
return
|
|
}
|
|
|
|
client := action.NewInstall(actionConfig)
|
|
client.Namespace = h.releaseNamespace
|
|
client.ReleaseName = h.releaseName
|
|
|
|
chartPath := config.Config.Tap.Release.HelmChartPath
|
|
if chartPath == "" {
|
|
chartPath = os.Getenv(fmt.Sprintf("%s_HELM_CHART_PATH", strings.ToUpper(misc.Program)))
|
|
}
|
|
if chartPath == "" {
|
|
var chartURL string
|
|
chartURL, err = repo.FindChartInRepoURL(h.repo, h.releaseName, "", "", "", "", getter.All(&cli.EnvSettings{}))
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
var cp string
|
|
cp, err = client.LocateChart(chartURL, settings)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
m := &downloader.Manager{
|
|
Out: os.Stdout,
|
|
ChartPath: cp,
|
|
Keyring: client.Keyring,
|
|
SkipUpdate: false,
|
|
Getters: getter.All(settings),
|
|
RepositoryConfig: settings.RepositoryConfig,
|
|
RepositoryCache: settings.RepositoryCache,
|
|
Debug: settings.Debug,
|
|
}
|
|
|
|
dl := downloader.ChartDownloader{
|
|
Out: m.Out,
|
|
Verify: m.Verify,
|
|
Keyring: m.Keyring,
|
|
RepositoryConfig: m.RepositoryConfig,
|
|
RepositoryCache: m.RepositoryCache,
|
|
RegistryClient: m.RegistryClient,
|
|
Getters: m.Getters,
|
|
Options: []getter.Option{
|
|
getter.WithInsecureSkipVerifyTLS(false),
|
|
},
|
|
}
|
|
|
|
repoPath := filepath.Dir(m.ChartPath)
|
|
err = os.MkdirAll(repoPath, os.ModePerm)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
version := ""
|
|
if registry.IsOCI(chartURL) {
|
|
chartURL, version, err = parseOCIRef(chartURL)
|
|
if err != nil {
|
|
return
|
|
}
|
|
dl.Options = append(dl.Options,
|
|
getter.WithRegistryClient(m.RegistryClient),
|
|
getter.WithTagName(version))
|
|
}
|
|
|
|
log.Info().
|
|
Str("url", chartURL).
|
|
Str("repo-path", repoPath).
|
|
Msg("Downloading Helm chart:")
|
|
|
|
if _, _, err = dl.DownloadTo(chartURL, version, repoPath); err != nil {
|
|
return
|
|
}
|
|
|
|
chartPath = m.ChartPath
|
|
}
|
|
var chart *chart.Chart
|
|
chart, err = loader.Load(chartPath)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
log.Info().
|
|
Str("release", chart.Metadata.Name).
|
|
Str("version", chart.Metadata.Version).
|
|
Strs("source", chart.Metadata.Sources).
|
|
Str("kube-version", chart.Metadata.KubeVersion).
|
|
Msg("Installing using Helm:")
|
|
|
|
var configMarshalled []byte
|
|
configMarshalled, err = json.Marshal(config.Config)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
var configUnmarshalled map[string]interface{}
|
|
err = json.Unmarshal(configMarshalled, &configUnmarshalled)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
rel, err = client.Run(chart, configUnmarshalled)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
return
|
|
}
|
|
|
|
func (h *Helm) Uninstall() (resp *release.UninstallReleaseResponse, err error) {
|
|
kubeConfigPath := config.Config.KubeConfigPath()
|
|
actionConfig := new(action.Configuration)
|
|
if err = actionConfig.Init(kube.GetConfig(kubeConfigPath, "", h.releaseNamespace), h.releaseNamespace, os.Getenv(ENV_HELM_DRIVER), func(format string, v ...interface{}) {
|
|
log.Info().Msgf(format, v...)
|
|
}); err != nil {
|
|
return
|
|
}
|
|
|
|
client := action.NewUninstall(actionConfig)
|
|
|
|
resp, err = client.Run(h.releaseName)
|
|
if err != nil {
|
|
return
|
|
}
|
|
|
|
return
|
|
}
|