From 3a891374da57d6a007a49792d51061763c53dda3 Mon Sep 17 00:00:00 2001 From: Andre Arcaina Date: Mon, 26 Oct 2026 13:36:26 -0400 Subject: [PATCH] Run go fix after v2.10.0 release Signed-off-by: Andre Arcaina --- Makefile | 9 +- docs/api/v1/kustomize.md | 15 +- go.mod | 4 +- internal/controller/kustomization_acl_test.go | 6 +- .../kustomization_commit_status_test.go | 6 +- .../kustomization_configuration_error_test.go | 24 +-- .../controller/kustomization_controller.go | 5 +- .../kustomization_controller_test.go | 4 +- .../kustomization_decryptor_test.go | 44 ++--- .../kustomization_deletion_policy_test.go | 6 +- .../kustomization_dependson_test.go | 22 +-- .../kustomization_direct_source_fetch_test.go | 36 ++-- .../kustomization_disallowed_managers_test.go | 12 +- .../kustomization_drift_ignore_test.go | 18 +- .../kustomization_externalartifact_test.go | 22 +-- .../controller/kustomization_fetcher_test.go | 12 +- .../controller/kustomization_force_test.go | 6 +- .../kustomization_impersonation_test.go | 34 ++-- .../kustomization_inventory_test.go | 12 +- .../kustomization_origin_revision_test.go | 6 +- ...on_override_manager_before_dry_run_test.go | 6 +- .../kustomization_patch_delete_test.go | 12 +- .../controller/kustomization_prune_test.go | 36 ++-- .../controller/kustomization_rbac_test.go | 20 +-- .../kustomization_substitute_redact_test.go | 12 +- .../kustomization_transformer_test.go | 36 ++-- .../kustomization_validation_test.go | 6 +- .../controller/kustomization_varsub_test.go | 64 +++---- .../controller/kustomization_wait_test.go | 34 ++-- internal/controller/suite_test.go | 24 +-- internal/decryptor/decryptor.go | 18 +- internal/decryptor/decryptor_test.go | 166 ++++++------------ internal/decryptor/transit_engine_test.go | 33 ++-- internal/sops/azkv/config.go | 12 +- internal/sops/keyservice/server.go | 18 +- internal/sops/keyservice/server_test.go | 36 ++-- main.go | 3 +- 37 files changed, 297 insertions(+), 542 deletions(-) diff --git a/Makefile b/Makefile index 7e1646b8a..b65f7c877 100644 --- a/Makefile +++ b/Makefile @@ -65,7 +65,7 @@ $(SOPS): ## Download latest sops binary if none is found. # Run controller tests KUBEBUILDER_ASSETS?="$(shell $(ENVTEST) --arch=$(ENVTEST_ARCH) use -i $(ENVTEST_KUBERNETES_VERSION) --bin-dir=$(ENVTEST_ASSETS_DIR) -p path)" -test: tidy generate fmt vet manifests api-docs download-crd-deps install-envtest $(SOPS) +test: fix tidy generate fmt vet manifests api-docs download-crd-deps install-envtest $(SOPS) KUBEBUILDER_ASSETS=$(KUBEBUILDER_ASSETS) go test ./... $(GO_TEST_ARGS) -v -coverprofile cover.out # Build manager binary @@ -144,6 +144,11 @@ tidy: cd api; rm -f go.sum; go mod tidy -compat=1.27 rm -f go.sum; go mod tidy -compat=1.27 +# Run go fix against code +fix: + go fix ./... + cd api; go fix ./... + # Run go fmt against code fmt: go fmt ./... @@ -234,7 +239,7 @@ fuzz-smoketest: fuzz-build bash -c "/runner.sh" # Run fuzz tests for the duration set in FUZZ_TIME. -fuzz-native: +fuzz-native: KUBEBUILDER_ASSETS=$(KUBEBUILDER_ASSETS) \ FUZZ_TIME=$(FUZZ_TIME) \ ./tests/fuzz/native_go_run.sh diff --git a/docs/api/v1/kustomize.md b/docs/api/v1/kustomize.md index 420008723..66852b42f 100644 --- a/docs/api/v1/kustomize.md +++ b/docs/api/v1/kustomize.md @@ -89,8 +89,8 @@ overridden if its key matches a common one.

dependsOn
- -[]DependencyReference + +[]github.com/fluxcd/pkg/apis/meta.DependencyReference @@ -668,13 +668,6 @@ field.

-

DependencyReference -

-

-(Appears on: -KustomizationSpec) -

-

DependencyReference defines a Kustomization dependency on another Kustomization resource.

IgnoreRule

@@ -764,8 +757,8 @@ overridden if its key matches a common one.

dependsOn
- -[]DependencyReference + +[]github.com/fluxcd/pkg/apis/meta.DependencyReference diff --git a/go.mod b/go.mod index 3ec586c20..5f34aa0d7 100644 --- a/go.mod +++ b/go.mod @@ -45,12 +45,10 @@ require ( github.com/ory/dockertest/v3 v3.12.0 github.com/spf13/pflag v1.0.10 github.com/spiffe/go-spiffe/v2 v2.9.0 - golang.org/x/net v0.61.0 golang.org/x/oauth2 v0.37.0 k8s.io/api v0.37.1 k8s.io/apimachinery v0.37.1 k8s.io/client-go v0.37.1 - k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 sigs.k8s.io/controller-runtime v0.25.2 sigs.k8s.io/kustomize/api v0.21.2 sigs.k8s.io/kustomize/kyaml v0.21.2 @@ -254,6 +252,7 @@ require ( go.yaml.in/yaml/v3 v3.0.5 // indirect golang.org/x/crypto v0.58.0 // indirect golang.org/x/exp v0.0.0-20260824195058-e88cd73687aa // indirect + golang.org/x/net v0.61.0 // indirect golang.org/x/sync v0.24.0 // indirect golang.org/x/sys v0.49.0 // indirect golang.org/x/term v0.47.0 // indirect @@ -275,6 +274,7 @@ require ( k8s.io/klog/v2 v2.140.0 // indirect k8s.io/kube-openapi v0.0.0-20260821135717-be32def86098 // indirect k8s.io/kubectl v0.37.1 // indirect + k8s.io/utils v0.0.0-20260707023825-cf1189d6abe3 // indirect sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect sigs.k8s.io/randfill v1.0.0 // indirect sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect diff --git a/internal/controller/kustomization_acl_test.go b/internal/controller/kustomization_acl_test.go index 7ad962b40..a6a9e5a71 100644 --- a/internal/controller/kustomization_acl_test.go +++ b/internal/controller/kustomization_acl_test.go @@ -82,10 +82,8 @@ stringData: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", diff --git a/internal/controller/kustomization_commit_status_test.go b/internal/controller/kustomization_commit_status_test.go index 3f1f8567e..c6dc61093 100644 --- a/internal/controller/kustomization_commit_status_test.go +++ b/internal/controller/kustomization_commit_status_test.go @@ -72,10 +72,8 @@ data: // newKustomization creates a Kustomization referencing the test artifact. newKustomization := func() *kustomizev1.Kustomization { return &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: "commit-status-" + randStringRunes(5), - Namespace: id, - }, + Name: "commit-status-" + randStringRunes(5), + Namespace: id, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: time.Hour}, Path: "./", diff --git a/internal/controller/kustomization_configuration_error_test.go b/internal/controller/kustomization_configuration_error_test.go index f7d9ab9af..5c4568e29 100644 --- a/internal/controller/kustomization_configuration_error_test.go +++ b/internal/controller/kustomization_configuration_error_test.go @@ -82,10 +82,8 @@ data: {} Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ TargetNamespace: id, Interval: metav1.Duration{Duration: 2 * time.Minute}, @@ -100,10 +98,8 @@ data: {} HealthCheckExprs: []kustomize.CustomHealthCheck{{ APIVersion: "v1", Kind: "ConfigMap", - HealthCheckExpressions: kustomize.HealthCheckExpressions{ - InProgress: "foo.", - Current: "true", - }, + InProgress: "foo.", + Current: "true", }}, }, } @@ -134,10 +130,8 @@ data: {} Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ TargetNamespace: id, Interval: metav1.Duration{Duration: 2 * time.Minute}, @@ -155,10 +149,8 @@ data: {} } sa := &corev1.ServiceAccount{ - ObjectMeta: metav1.ObjectMeta{ - Name: "foo", - Namespace: id, - }, + Name: "foo", + Namespace: id, } g.Expect(k8sClient.Create(context.Background(), sa)).To(Succeed()) t.Cleanup(func() { _ = k8sClient.Delete(context.Background(), sa) }) diff --git a/internal/controller/kustomization_controller.go b/internal/controller/kustomization_controller.go index 019f4f585..0d98fb087 100644 --- a/internal/controller/kustomization_controller.go +++ b/internal/controller/kustomization_controller.go @@ -22,6 +22,7 @@ import ( "crypto/tls" "errors" "fmt" + "maps" "os" "strings" "time" @@ -455,9 +456,7 @@ func (r *KustomizationReconciler) reconcile( // be redacted from any apply error surfaced below. substituteVars := make(map[string]string) buildCtx := generator.ContextWithSecretVarsCollector(ctx, func(vars map[string]string) { - for k, v := range vars { - substituteVars[k] = v - } + maps.Copy(substituteVars, vars) }) // Build the Kustomize overlay and decrypt secrets if needed. diff --git a/internal/controller/kustomization_controller_test.go b/internal/controller/kustomization_controller_test.go index e1637522e..b8f5f4863 100644 --- a/internal/controller/kustomization_controller_test.go +++ b/internal/controller/kustomization_controller_test.go @@ -41,7 +41,7 @@ func TestKustomizationReconciler_StagedApply(t *testing.T) { namespaceName := "kust-" + randStringRunes(5) namespace := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: namespaceName}, + Name: namespaceName, } g.Expect(k8sClient.Create(ctx, namespace)).ToNot(HaveOccurred()) t.Cleanup(func() { @@ -104,7 +104,7 @@ func TestKustomizationReconciler_deleteBeforeFinalizer(t *testing.T) { namespaceName := "kust-" + randStringRunes(5) namespace := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: namespaceName}, + Name: namespaceName, } g.Expect(k8sClient.Create(ctx, namespace)).ToNot(HaveOccurred()) t.Cleanup(func() { diff --git a/internal/controller/kustomization_decryptor_test.go b/internal/controller/kustomization_decryptor_test.go index 17913ab25..d437cb2de 100644 --- a/internal/controller/kustomization_decryptor_test.go +++ b/internal/controller/kustomization_decryptor_test.go @@ -45,7 +45,7 @@ func TestKustomizationReconciler_Decryptor(t *testing.T) { g.Expect(err).NotTo(HaveOccurred(), "failed to create vault client") // create a master key on the vault transit engine - path, data := "sops/keys/vault", map[string]interface{}{"type": "rsa-4096"} + path, data := "sops/keys/vault", map[string]any{"type": "rsa-4096"} _, err = cli.Logical().Write(path, data) g.Expect(err).NotTo(HaveOccurred(), "failed to write key") @@ -92,10 +92,8 @@ func TestKustomizationReconciler_Decryptor(t *testing.T) { Namespace: id, } sopsSecret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: sopsSecretKey.Name, - Namespace: sopsSecretKey.Namespace, - }, + Name: sopsSecretKey.Name, + Namespace: sopsSecretKey.Namespace, StringData: map[string]string{ "pgp.asc": string(pgpKey), "age.agekey": string(ageKey), @@ -111,10 +109,8 @@ func TestKustomizationReconciler_Decryptor(t *testing.T) { Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -216,10 +212,8 @@ func TestKustomizationReconciler_Decryptor(t *testing.T) { g.Expect(err).NotTo(HaveOccurred()) globalSOPSSecret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: sopsAgeSecret, - Namespace: namespace, - }, + Name: sopsAgeSecret, + Namespace: namespace, StringData: map[string]string{ "identity.agekey": string(ageKey), }, @@ -244,10 +238,8 @@ func TestKustomizationReconciler_Decryptor(t *testing.T) { Namespace: namespace, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -290,10 +282,8 @@ func TestKustomizationReconciler_Decryptor(t *testing.T) { g.Expect(err).NotTo(HaveOccurred()) globalSOPSSecret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: sopsAgeSecret, - Namespace: namespace, - }, + Name: sopsAgeSecret, + Namespace: namespace, StringData: map[string]string{ "identity.agekey": string(ageGlobalKey), }, @@ -305,10 +295,8 @@ func TestKustomizationReconciler_Decryptor(t *testing.T) { Namespace: namespace, } localSOPSSecret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: localSOPSSecretKey.Name, - Namespace: localSOPSSecretKey.Namespace, - }, + Name: localSOPSSecretKey.Name, + Namespace: localSOPSSecretKey.Namespace, StringData: map[string]string{ "pgp.asc": string(pgpKey), "age.agekey": string(ageKey), @@ -336,10 +324,8 @@ func TestKustomizationReconciler_Decryptor(t *testing.T) { Namespace: namespace, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", diff --git a/internal/controller/kustomization_deletion_policy_test.go b/internal/controller/kustomization_deletion_policy_test.go index c223fb7c5..1b1442f53 100644 --- a/internal/controller/kustomization_deletion_policy_test.go +++ b/internal/controller/kustomization_deletion_policy_test.go @@ -117,10 +117,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", diff --git a/internal/controller/kustomization_dependson_test.go b/internal/controller/kustomization_dependson_test.go index 14eac8032..227c8b0ca 100644 --- a/internal/controller/kustomization_dependson_test.go +++ b/internal/controller/kustomization_dependson_test.go @@ -114,10 +114,8 @@ spec: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: time.Hour}, Path: "./", @@ -227,10 +225,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: time.Hour}, Path: "./", @@ -263,12 +259,10 @@ data: // Create a dependency Kustomization with matching annotations dependency := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: depID, - Namespace: id, - Annotations: map[string]string{ - "app/version": "v1.2.3", - }, + Name: depID, + Namespace: id, + Annotations: map[string]string{ + "app/version": "v1.2.3", }, Spec: kustomizev1.KustomizationSpec{ Suspend: true, // Suspended dependency should work with readyExpr and AdditiveCELDependencyCheck disabled diff --git a/internal/controller/kustomization_direct_source_fetch_test.go b/internal/controller/kustomization_direct_source_fetch_test.go index 493196a2a..9e1412556 100644 --- a/internal/controller/kustomization_direct_source_fetch_test.go +++ b/internal/controller/kustomization_direct_source_fetch_test.go @@ -85,10 +85,8 @@ data: defer func() { reconciler.DirectSourceFetch = false }() // Reset after test kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name + "-direct", - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name + "-direct", + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -127,10 +125,8 @@ data: defer func() { reconciler.DirectSourceFetch = false }() // Reset after test kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name + "-notfound", - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name + "-notfound", + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -190,10 +186,8 @@ func TestKustomizationReconciler_DirectSourceFetch_OCIRepository(t *testing.T) { } ociRepo := &sourcev1.OCIRepository{ - ObjectMeta: metav1.ObjectMeta{ - Name: ociRepoName.Name, - Namespace: ociRepoName.Namespace, - }, + Name: ociRepoName.Name, + Namespace: ociRepoName.Namespace, Spec: sourcev1.OCIRepositorySpec{ URL: "oci://ghcr.io/test/repo", Interval: &metav1.Duration{Duration: time.Minute}, @@ -205,10 +199,8 @@ func TestKustomizationReconciler_DirectSourceFetch_OCIRepository(t *testing.T) { }) kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: fmt.Sprintf("kust-oci-%s", randStringRunes(5)), - Namespace: id, - }, + Name: fmt.Sprintf("kust-oci-%s", randStringRunes(5)), + Namespace: id, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -266,10 +258,8 @@ func TestKustomizationReconciler_DirectSourceFetch_Bucket(t *testing.T) { } bucket := &sourcev1.Bucket{ - ObjectMeta: metav1.ObjectMeta{ - Name: bucketName.Name, - Namespace: bucketName.Namespace, - }, + Name: bucketName.Name, + Namespace: bucketName.Namespace, Spec: sourcev1.BucketSpec{ BucketName: "test-bucket", Endpoint: "s3.amazonaws.com", @@ -282,10 +272,8 @@ func TestKustomizationReconciler_DirectSourceFetch_Bucket(t *testing.T) { }) kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: fmt.Sprintf("kust-bucket-%s", randStringRunes(5)), - Namespace: id, - }, + Name: fmt.Sprintf("kust-bucket-%s", randStringRunes(5)), + Namespace: id, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", diff --git a/internal/controller/kustomization_disallowed_managers_test.go b/internal/controller/kustomization_disallowed_managers_test.go index f11ed8d5c..8004ae040 100644 --- a/internal/controller/kustomization_disallowed_managers_test.go +++ b/internal/controller/kustomization_disallowed_managers_test.go @@ -78,10 +78,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -129,10 +127,8 @@ data: t.Run("update configmap with new data", func(t *testing.T) { configMap := corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - Namespace: id, - }, + Name: id, + Namespace: id, } err = k8sClient.Patch(context.Background(), &configMap, client.RawPatch(types.MergePatchType, []byte(`{"data":{"bad-key":"overridden field manager"}}`)), &client.PatchOptions{FieldManager: overrideManagerName}) g.Expect(err).NotTo(HaveOccurred()) diff --git a/internal/controller/kustomization_drift_ignore_test.go b/internal/controller/kustomization_drift_ignore_test.go index 6e404109d..12badccbc 100644 --- a/internal/controller/kustomization_drift_ignore_test.go +++ b/internal/controller/kustomization_drift_ignore_test.go @@ -78,10 +78,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -127,10 +125,8 @@ data: // Modify the ignored field out-of-band. patch := client.RawPatch(types.MergePatchType, []byte(`{"data":{"ignored-key":"modified-externally"}}`)) configMap := &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - Namespace: id, - }, + Name: id, + Namespace: id, } err = k8sClient.Patch(context.Background(), configMap, patch) g.Expect(err).NotTo(HaveOccurred()) @@ -165,10 +161,8 @@ data: // Modify the managed field out-of-band. patch := client.RawPatch(types.MergePatchType, []byte(`{"data":{"managed-key":"tampered"}}`)) configMap := &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - Namespace: id, - }, + Name: id, + Namespace: id, } err = k8sClient.Patch(context.Background(), configMap, patch) g.Expect(err).NotTo(HaveOccurred()) diff --git a/internal/controller/kustomization_externalartifact_test.go b/internal/controller/kustomization_externalartifact_test.go index 06309092a..c293fec69 100644 --- a/internal/controller/kustomization_externalartifact_test.go +++ b/internal/controller/kustomization_externalartifact_test.go @@ -84,10 +84,8 @@ stringData: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: time.Hour}, Path: "./", @@ -174,14 +172,10 @@ stringData: func applyExternalArtifact(objKey client.ObjectKey, artifactName string, revision string) error { ea := &sourcev1.ExternalArtifact{ - TypeMeta: metav1.TypeMeta{ - Kind: sourcev1.ExternalArtifactKind, - APIVersion: sourcev1.GroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: objKey.Name, - Namespace: objKey.Namespace, - }, + Kind: sourcev1.ExternalArtifactKind, + APIVersion: sourcev1.GroupVersion.String(), + Name: objKey.Name, + Namespace: objKey.Namespace, } b, _ := os.ReadFile(filepath.Join(testServer.Root(), artifactName)) @@ -220,9 +214,7 @@ func applyExternalArtifact(objKey client.ObjectKey, artifactName string, revisio ea.Status = status statusOpts := &client.SubResourcePatchOptions{ - PatchOptions: client.PatchOptions{ - FieldManager: "source-controller", - }, + FieldManager: "source-controller", } if err := k8sClient.Status().Patch(context.Background(), ea, client.Apply, statusOpts); err != nil { diff --git a/internal/controller/kustomization_fetcher_test.go b/internal/controller/kustomization_fetcher_test.go index 2830de8ed..811a2d447 100644 --- a/internal/controller/kustomization_fetcher_test.go +++ b/internal/controller/kustomization_fetcher_test.go @@ -81,10 +81,8 @@ stringData: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -115,10 +113,8 @@ stringData: resultK := &kustomizev1.Kustomization{} repo := &sourcev1.GitRepository{ - TypeMeta: metav1.TypeMeta{ - Kind: sourcev1.GitRepositoryKind, - APIVersion: sourcev1.GroupVersion.String(), - }, + Kind: sourcev1.GitRepositoryKind, + APIVersion: sourcev1.GroupVersion.String(), } g.Expect(k8sClient.Get(context.Background(), repositoryName, repo)).Should(Succeed()) repoURL := repo.Status.Artifact.URL diff --git a/internal/controller/kustomization_force_test.go b/internal/controller/kustomization_force_test.go index 48af805f8..4c9097ef6 100644 --- a/internal/controller/kustomization_force_test.go +++ b/internal/controller/kustomization_force_test.go @@ -81,10 +81,8 @@ stringData: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", diff --git a/internal/controller/kustomization_impersonation_test.go b/internal/controller/kustomization_impersonation_test.go index 70de22f8c..74bedbabd 100644 --- a/internal/controller/kustomization_impersonation_test.go +++ b/internal/controller/kustomization_impersonation_test.go @@ -85,10 +85,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: time.Minute}, Path: "./", @@ -139,22 +137,16 @@ data: t.Run("reconciles impersonating service account", func(t *testing.T) { sa := corev1.ServiceAccount{ - TypeMeta: metav1.TypeMeta{ - Kind: "ServiceAccount", - APIVersion: "v1", - }, - ObjectMeta: metav1.ObjectMeta{ - Name: "test", - Namespace: id, - }, + Kind: "ServiceAccount", + APIVersion: "v1", + Name: "test", + Namespace: id, } g.Expect(k8sClient.Create(context.Background(), &sa)).To(Succeed()) crb := rbacv1.ClusterRoleBinding{ TypeMeta: metav1.TypeMeta{}, - ObjectMeta: metav1.ObjectMeta{ - Name: id, - }, + Name: id, Subjects: []rbacv1.Subject{ { Kind: "ServiceAccount", @@ -253,10 +245,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: time.Minute}, Path: "./", @@ -293,10 +283,8 @@ data: }) secret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: secretName, - Namespace: id, - }, + Name: secretName, + Namespace: id, Data: map[string][]byte{ secretKey: kubeConfig, }, diff --git a/internal/controller/kustomization_inventory_test.go b/internal/controller/kustomization_inventory_test.go index f11c38bb4..7bf5985b0 100644 --- a/internal/controller/kustomization_inventory_test.go +++ b/internal/controller/kustomization_inventory_test.go @@ -89,10 +89,8 @@ stringData: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -127,10 +125,8 @@ stringData: configMapName := types.NamespacedName{Name: id, Namespace: id} secret := &corev1.Secret{ - TypeMeta: metav1.TypeMeta{ - Kind: "Secret", - APIVersion: "v1", - }, + Kind: "Secret", + APIVersion: "v1", } secretName := types.NamespacedName{Name: id, Namespace: id} diff --git a/internal/controller/kustomization_origin_revision_test.go b/internal/controller/kustomization_origin_revision_test.go index d48ded5ba..6ae2c5814 100644 --- a/internal/controller/kustomization_origin_revision_test.go +++ b/internal/controller/kustomization_origin_revision_test.go @@ -81,10 +81,8 @@ stringData: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", diff --git a/internal/controller/kustomization_override_manager_before_dry_run_test.go b/internal/controller/kustomization_override_manager_before_dry_run_test.go index 71fc8c3ae..175d57f2c 100644 --- a/internal/controller/kustomization_override_manager_before_dry_run_test.go +++ b/internal/controller/kustomization_override_manager_before_dry_run_test.go @@ -123,10 +123,8 @@ spec: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", diff --git a/internal/controller/kustomization_patch_delete_test.go b/internal/controller/kustomization_patch_delete_test.go index 582ec8007..b1baddccb 100644 --- a/internal/controller/kustomization_patch_delete_test.go +++ b/internal/controller/kustomization_patch_delete_test.go @@ -104,10 +104,8 @@ data: // This test verifies that multiple $patch: delete directives in a single patch work correctly // Ref: https://github.com/fluxcd/kustomize-controller/issues/1306 kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -174,10 +172,8 @@ metadata: t.Run("multiple patch delete in separate patches should work", func(t *testing.T) { // This test verifies that separate patches (which was previously a workaround) still work correctly kustomizationSeparate := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name + "-separate", - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name + "-separate", + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", diff --git a/internal/controller/kustomization_prune_test.go b/internal/controller/kustomization_prune_test.go index 3cdbfb239..0910a632d 100644 --- a/internal/controller/kustomization_prune_test.go +++ b/internal/controller/kustomization_prune_test.go @@ -93,10 +93,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -201,10 +199,8 @@ data: g.Expect(applyGitRepository(repositoryName, artifact, revision)).To(Succeed()) kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: fmt.Sprintf("gc-%s", randStringRunes(5)), - Namespace: id, - }, + Name: fmt.Sprintf("gc-%s", randStringRunes(5)), + Namespace: id, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -380,10 +376,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -538,10 +532,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -679,10 +671,8 @@ stringData: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -842,10 +832,8 @@ stringData: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", diff --git a/internal/controller/kustomization_rbac_test.go b/internal/controller/kustomization_rbac_test.go index 02518a360..00d0a1278 100644 --- a/internal/controller/kustomization_rbac_test.go +++ b/internal/controller/kustomization_rbac_test.go @@ -52,17 +52,13 @@ func TestKustomizationReconciler_AppliesRoleAndRoleBinding(t *testing.T) { // The SA can create Roles and RoleBindings, and has the permissions // that the test Role will grant (configmaps get/list). sa := corev1.ServiceAccount{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - Namespace: id, - }, + Name: id, + Namespace: id, } g.Expect(k8sClient.Create(context.Background(), &sa)).To(Succeed()) cr := rbacv1.ClusterRole{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - }, + Name: id, Rules: []rbacv1.PolicyRule{ { APIGroups: []string{"rbac.authorization.k8s.io"}, @@ -82,9 +78,7 @@ func TestKustomizationReconciler_AppliesRoleAndRoleBinding(t *testing.T) { g.Expect(k8sClient.Create(context.Background(), &cr)).To(Succeed()) crb := rbacv1.ClusterRoleBinding{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - }, + Name: id, Subjects: []rbacv1.Subject{ { Kind: "ServiceAccount", @@ -156,10 +150,8 @@ subjects: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", diff --git a/internal/controller/kustomization_substitute_redact_test.go b/internal/controller/kustomization_substitute_redact_test.go index edd45b9cd..d97d5b6a4 100644 --- a/internal/controller/kustomization_substitute_redact_test.go +++ b/internal/controller/kustomization_substitute_redact_test.go @@ -71,10 +71,8 @@ func TestKustomizationReconciler_SubstituteFromRedactedOnValidationError(t *test Namespace: id, } secret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: secretName.Name, - Namespace: secretName.Namespace, - }, + Name: secretName.Name, + Namespace: secretName.Namespace, StringData: map[string]string{secretKey: syntheticSecretValue}, } g.Expect(k8sClient.Create(ctx, secret)).To(Succeed()) @@ -108,10 +106,8 @@ data: g.Expect(applyGitRepository(repositoryName, artifact, revision)).To(Succeed()) inputK := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - Namespace: id, - }, + Name: id, + Namespace: id, Spec: kustomizev1.KustomizationSpec{ KubeConfig: &meta.KubeConfigReference{ SecretRef: &meta.SecretKeyReference{ diff --git a/internal/controller/kustomization_transformer_test.go b/internal/controller/kustomization_transformer_test.go index 954885d12..a94fbc71b 100644 --- a/internal/controller/kustomization_transformer_test.go +++ b/internal/controller/kustomization_transformer_test.go @@ -83,10 +83,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -192,10 +190,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -262,10 +258,8 @@ func TestKustomizationReconciler_KustomizeTransformer(t *testing.T) { Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -385,10 +379,8 @@ func TestKustomizationReconciler_KustomizeTransformerFiles(t *testing.T) { Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -504,10 +496,8 @@ func TestKustomizationReconciler_FluxTransformers(t *testing.T) { Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: reconciliationInterval}, Path: "./", @@ -649,10 +639,8 @@ data: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", diff --git a/internal/controller/kustomization_validation_test.go b/internal/controller/kustomization_validation_test.go index 674d96290..6751966c7 100644 --- a/internal/controller/kustomization_validation_test.go +++ b/internal/controller/kustomization_validation_test.go @@ -72,10 +72,8 @@ func TestKustomizationReconciler_Validation(t *testing.T) { Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", diff --git a/internal/controller/kustomization_varsub_test.go b/internal/controller/kustomization_varsub_test.go index c9a154587..7a4e54c12 100644 --- a/internal/controller/kustomization_varsub_test.go +++ b/internal/controller/kustomization_varsub_test.go @@ -92,11 +92,9 @@ stringData: Namespace: id, } config := &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: configName.Name, - Namespace: configName.Namespace, - }, - Data: map[string]string{"zone": "\naz-1a\n"}, + Name: configName.Name, + Namespace: configName.Namespace, + Data: map[string]string{"zone": "\naz-1a\n"}, } g.Expect(k8sClient.Create(context.Background(), config)).Should(Succeed()) @@ -105,19 +103,15 @@ stringData: Namespace: id, } secret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: secretName.Name, - Namespace: secretName.Namespace, - }, + Name: secretName.Name, + Namespace: secretName.Namespace, StringData: map[string]string{"zone": "\naz-1b\n"}, } g.Expect(k8sClient.Create(context.Background(), secret)).Should(Succeed()) inputK := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - Namespace: id, - }, + Name: id, + Namespace: id, Spec: kustomizev1.KustomizationSpec{ KubeConfig: &meta.KubeConfigReference{ SecretRef: &meta.SecretKeyReference{ @@ -241,11 +235,9 @@ metadata: Namespace: id, } configMap := &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: configName.Name, - Namespace: configName.Namespace, - }, - Data: map[string]string{"color": "\nred\n"}, + Name: configName.Name, + Namespace: configName.Namespace, + Data: map[string]string{"color": "\nred\n"}, } g.Expect(k8sClient.Create(ctx, configMap)).Should(Succeed()) @@ -254,19 +246,15 @@ metadata: Namespace: id, } secret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: secretName.Name, - Namespace: secretName.Namespace, - }, + Name: secretName.Name, + Namespace: secretName.Namespace, StringData: map[string]string{"shape": "\ntriangle\n"}, } g.Expect(k8sClient.Create(ctx, secret)).Should(Succeed()) inputK := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - Namespace: id, - }, + Name: id, + Namespace: id, Spec: kustomizev1.KustomizationSpec{ KubeConfig: &meta.KubeConfigReference{ SecretRef: &meta.SecretKeyReference{ @@ -401,10 +389,8 @@ metadata: name := id + "-with-variables" inputK := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: name, - Namespace: id, - }, + Name: name, + Namespace: id, Spec: kustomizev1.KustomizationSpec{ KubeConfig: &meta.KubeConfigReference{ SecretRef: &meta.SecretKeyReference{ @@ -446,10 +432,8 @@ metadata: name := id + "-always" inputK := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: name, - Namespace: id, - }, + Name: name, + Namespace: id, Spec: kustomizev1.KustomizationSpec{ KubeConfig: &meta.KubeConfigReference{ SecretRef: &meta.SecretKeyReference{ @@ -567,10 +551,8 @@ data: g.Expect(err).NotTo(HaveOccurred()) inputK := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - Namespace: id, - }, + Name: id, + Namespace: id, Spec: kustomizev1.KustomizationSpec{ KubeConfig: &meta.KubeConfigReference{ SecretRef: &meta.SecretKeyReference{ @@ -673,10 +655,8 @@ metadata: g.Expect(err).NotTo(HaveOccurred()) inputK := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: id, - Namespace: id, - }, + Name: id, + Namespace: id, Spec: kustomizev1.KustomizationSpec{ KubeConfig: &meta.KubeConfigReference{ SecretRef: &meta.SecretKeyReference{ diff --git a/internal/controller/kustomization_wait_test.go b/internal/controller/kustomization_wait_test.go index 9874b46a3..6e64ea430 100644 --- a/internal/controller/kustomization_wait_test.go +++ b/internal/controller/kustomization_wait_test.go @@ -100,10 +100,8 @@ parameters: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -383,10 +381,8 @@ spec: Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -478,10 +474,8 @@ data: {} Namespace: id, } kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: kustomizationKey.Name, - Namespace: kustomizationKey.Namespace, - }, + Name: kustomizationKey.Name, + Namespace: kustomizationKey.Namespace, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -502,10 +496,8 @@ data: {} HealthCheckExprs: []kustomize.CustomHealthCheck{{ APIVersion: "v1", Kind: "ConfigMap", - HealthCheckExpressions: kustomize.HealthCheckExpressions{ - InProgress: "has(data.foo.bar)", - Current: "true", - }, + InProgress: "has(data.foo.bar)", + Current: "true", }}, }, } @@ -884,10 +876,8 @@ spec: g.Expect(err).NotTo(HaveOccurred()) kustomization := &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: fmt.Sprintf("grp-%s", randStringRunes(5)), - Namespace: id, - }, + Name: fmt.Sprintf("grp-%s", randStringRunes(5)), + Namespace: id, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -907,9 +897,7 @@ spec: // to both Foo and Bar custom resources. HealthCheckExprs: []kustomize.CustomHealthCheck{{ APIVersion: group + "/v1", - HealthCheckExpressions: kustomize.HealthCheckExpressions{ - Current: "has(spec.ready) && spec.ready == true", - }, + Current: "has(spec.ready) && spec.ready == true", }}, }, } diff --git a/internal/controller/suite_test.go b/internal/controller/suite_test.go index b57c5c40d..8e2f1e8d5 100644 --- a/internal/controller/suite_test.go +++ b/internal/controller/suite_test.go @@ -255,17 +255,15 @@ func logStatus(t *testing.T, k *kustomizev1.Kustomization) { func createNamespace(name string) error { namespace := &corev1.Namespace{ - ObjectMeta: metav1.ObjectMeta{Name: name}, + Name: name, } return k8sClient.Create(context.Background(), namespace) } func createKubeConfigSecret(namespace string) error { secret := &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "kubeconfig", - Namespace: namespace, - }, + Name: "kubeconfig", + Namespace: namespace, Data: map[string][]byte{ "value.yaml": kubeConfig, }, @@ -297,14 +295,10 @@ func applyGitRepository(objKey client.ObjectKey, artifactName string, } repo := &sourcev1.GitRepository{ - TypeMeta: metav1.TypeMeta{ - Kind: sourcev1.GitRepositoryKind, - APIVersion: sourcev1.GroupVersion.String(), - }, - ObjectMeta: metav1.ObjectMeta{ - Name: objKey.Name, - Namespace: objKey.Namespace, - }, + Kind: sourcev1.GitRepositoryKind, + APIVersion: sourcev1.GroupVersion.String(), + Name: objKey.Name, + Namespace: objKey.Namespace, Spec: sourcev1.GitRepositorySpec{ URL: "https://github.com/test/repository", Interval: metav1.Duration{Duration: time.Minute}, @@ -348,9 +342,7 @@ func applyGitRepository(objKey client.ObjectKey, artifactName string, repo.Status = status statusOpts := &client.SubResourcePatchOptions{ - PatchOptions: client.PatchOptions{ - FieldManager: "source-controller", - }, + FieldManager: "source-controller", } if err := k8sClient.Status().Patch(context.Background(), repo, client.Apply, statusOpts); err != nil { diff --git a/internal/decryptor/decryptor.go b/internal/decryptor/decryptor.go index 923253de8..e2922d76b 100644 --- a/internal/decryptor/decryptor.go +++ b/internal/decryptor/decryptor.go @@ -975,10 +975,8 @@ func secureLoadKustomizationFile(root, path string) (*kustypes.Kustomization, er } kus := kustypes.Kustomization{ - TypeMeta: kustypes.TypeMeta{ - APIVersion: kustypes.KustomizationVersion, - Kind: kustypes.KustomizationKind, - }, + APIVersion: kustypes.KustomizationVersion, + Kind: kustypes.KustomizationKind, } if err := yaml.Unmarshal(data, &kus); err != nil { return nil, fmt.Errorf("failed to unmarshal kustomization file from '%s': %w", loadPath, err) @@ -1180,20 +1178,20 @@ func safeDecrypt[T any](mac T, err error) (T, error) { // encrypted value, which is not authenticated. The conversion errors // of strconv and time contain the decrypted value. for _, marker := range []string{"strconv.", "parsing time "} { - if i := strings.Index(e, marker); i != -1 { - return zero, errors.New(e[:i] + "failed to convert the decrypted value to its data type: ") + if before, _, ok := strings.Cut(e, marker); ok { + return zero, errors.New(before + "failed to convert the decrypted value to its data type: ") } } var buf strings.Builder - prefIdx := strings.Index(e, prefix) - suffIdx := strings.Index(e, suffix) + before, _, ok := strings.Cut(e, prefix) + found0 := strings.Contains(e, suffix) - if prefIdx == -1 || suffIdx == -1 { + if !ok || !found0 { return zero, err } - buf.WriteString(e[:prefIdx]) + buf.WriteString(before) buf.WriteString(prefix) buf.WriteString("") buf.WriteString(suffix) diff --git a/internal/decryptor/decryptor_test.go b/internal/decryptor/decryptor_test.go index 32836d548..88b37908e 100644 --- a/internal/decryptor/decryptor_test.go +++ b/internal/decryptor/decryptor_test.go @@ -101,10 +101,8 @@ func TestDecryptor_ImportKeys(t *testing.T) { }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "pgp-secret", - Namespace: provider, - }, + Name: "pgp-secret", + Namespace: provider, Data: map[string][]byte{ "pgp" + DecryptionPGPExt: pgpKey, }, @@ -119,10 +117,8 @@ func TestDecryptor_ImportKeys(t *testing.T) { }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "pgp-secret", - Namespace: provider, - }, + Name: "pgp-secret", + Namespace: provider, Data: map[string][]byte{ "pgp" + DecryptionPGPExt: []byte("not-a-valid-armored-key"), }, @@ -138,10 +134,8 @@ func TestDecryptor_ImportKeys(t *testing.T) { }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "age-secret", - Namespace: provider, - }, + Name: "age-secret", + Namespace: provider, Data: map[string][]byte{ "age" + DecryptionAgeExt: ageKey, }, @@ -159,10 +153,8 @@ func TestDecryptor_ImportKeys(t *testing.T) { }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "age-secret", - Namespace: provider, - }, + Name: "age-secret", + Namespace: provider, Data: map[string][]byte{ "age" + DecryptionAgeExt: []byte("not-a-valid-key"), }, @@ -181,10 +173,8 @@ func TestDecryptor_ImportKeys(t *testing.T) { }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "hcvault-secret", - Namespace: provider, - }, + Name: "hcvault-secret", + Namespace: provider, Data: map[string][]byte{ DecryptionVaultTokenFileName: []byte("some-hcvault-token"), }, @@ -202,10 +192,8 @@ func TestDecryptor_ImportKeys(t *testing.T) { }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "awskms-secret", - Namespace: provider, - }, + Name: "awskms-secret", + Namespace: provider, Data: map[string][]byte{ DecryptionAWSKmsFile: []byte(`aws_access_key_id: test-id aws_secret_access_key: test-secret @@ -225,10 +213,8 @@ aws_session_token: test-token`), }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "gcpkms-secret", - Namespace: provider, - }, + Name: "gcpkms-secret", + Namespace: provider, Data: map[string][]byte{ DecryptionGCPCredsFile: []byte(`{ "client_id": ".apps.googleusercontent.com", "client_secret": "", @@ -248,10 +234,8 @@ aws_session_token: test-token`), }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "azkv-secret", - Namespace: provider, - }, + Name: "azkv-secret", + Namespace: provider, Data: map[string][]byte{ DecryptionAzureAuthFile: []byte(`tenantId: some-tenant-id clientId: some-client-id @@ -271,10 +255,8 @@ clientSecret: some-client-secret`), }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "azkv-secret", - Namespace: provider, - }, + Name: "azkv-secret", + Namespace: provider, Data: map[string][]byte{ DecryptionAzureAuthFile: []byte(`{"malformed\: JSON"}`), }, @@ -293,10 +275,8 @@ clientSecret: some-client-secret`), }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "azkv-secret", - Namespace: provider, - }, + Name: "azkv-secret", + Namespace: provider, Data: map[string][]byte{ DecryptionAzureAuthFile: []byte(`tenantId: incomplete`), }, @@ -315,10 +295,8 @@ clientSecret: some-client-secret`), }, }, secret: &corev1.Secret{ - ObjectMeta: metav1.ObjectMeta{ - Name: "multiple-secret", - Namespace: provider, - }, + Name: "multiple-secret", + Namespace: provider, Data: map[string][]byte{ "age" + DecryptionAgeExt: ageKey, DecryptionVaultTokenFileName: []byte("some-hcvault-token"), @@ -368,10 +346,8 @@ clientSecret: some-client-secret`), cb.WithObjects(tt.secret) } kustomization := kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: provider + "-" + tt.name, - Namespace: provider, - }, + Name: provider + "-" + tt.name, + Namespace: provider, Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -492,10 +468,8 @@ func TestDecryptor_SetAuthOptions(t *testing.T) { d := &Decryptor{ kustomization: &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test", - Namespace: "test-ns", - }, + Name: "test", + Namespace: "test-ns", Spec: kustomizev1.KustomizationSpec{ Decryption: &kustomizev1.Decryption{ Provider: DecryptionProviderSOPS, @@ -670,14 +644,14 @@ func TestDecryptor_SopsDecryptWithFormat(t *testing.T) { func TestDecryptor_DecryptResource(t *testing.T) { var ( resourceFactory = provider.NewDefaultDepProvider().GetResourceFactory() - emptyResource, _ = resourceFactory.FromMap(map[string]interface{}{}) + emptyResource, _ = resourceFactory.FromMap(map[string]any{}) ) - newSecretResource := func(namespace, name string, data map[string]interface{}) (*resource.Resource, error) { - return resourceFactory.FromMap(map[string]interface{}{ + newSecretResource := func(namespace, name string, data map[string]any) (*resource.Resource, error) { + return resourceFactory.FromMap(map[string]any{ "apiVersion": "v1", "kind": "Secret", - "metadata": map[string]interface{}{ + "metadata": map[string]any{ "name": name, "namespace": namespace, }, @@ -686,10 +660,8 @@ func TestDecryptor_DecryptResource(t *testing.T) { } kustomization := kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: "decrypt", - Namespace: "decrypt", - }, + Name: "decrypt", + Namespace: "decrypt", Spec: kustomizev1.KustomizationSpec{ Interval: metav1.Duration{Duration: 2 * time.Minute}, Path: "./", @@ -712,7 +684,7 @@ func TestDecryptor_DecryptResource(t *testing.T) { g.Expect(err).ToNot(HaveOccurred()) d.ageIdentities = append(d.ageIdentities, ageID) - secret, _ := newSecretResource("test", "secret", map[string]interface{}{ + secret, _ := newSecretResource("test", "secret", map[string]any{ "key": "value", }) g.Expect(isSOPSEncryptedResource(secret)).To(BeFalse()) @@ -763,7 +735,7 @@ func TestDecryptor_DecryptResource(t *testing.T) { g.Expect(err).ToNot(HaveOccurred()) d.ageIdentities = append(d.ageIdentities, ageID) - secret, _ := newSecretResource("test", "secret", map[string]interface{}{ + secret, _ := newSecretResource("test", "secret", map[string]any{ "key": "value", }) g.Expect(isSOPSEncryptedResource(secret)).To(BeFalse()) @@ -822,7 +794,7 @@ func TestDecryptor_DecryptResource(t *testing.T) { }, plainData, formats.Ini, formats.Yaml) g.Expect(err).ToNot(HaveOccurred()) - secret, _ := newSecretResource("test", "secret-data", map[string]interface{}{ + secret, _ := newSecretResource("test", "secret-data", map[string]any{ "file.ini": base64.StdEncoding.EncodeToString(encData), }) g.Expect(isSOPSEncryptedResource(secret)).To(BeFalse()) @@ -857,7 +829,7 @@ func TestDecryptor_DecryptResource(t *testing.T) { }, plainData, formats.Yaml, formats.Yaml) g.Expect(err).ToNot(HaveOccurred()) - secret, _ := newSecretResource("test", "secret-data", map[string]interface{}{ + secret, _ := newSecretResource("test", "secret-data", map[string]any{ "key.yaml": base64.StdEncoding.EncodeToString(encData), }) g.Expect(isSOPSEncryptedResource(secret)).To(BeFalse()) @@ -901,15 +873,15 @@ func TestDecryptor_DecryptResource(t *testing.T) { }, plainData, formats.Json, formats.Yaml) g.Expect(err).ToNot(HaveOccurred()) - secret, _ := resourceFactory.FromMap(map[string]interface{}{ + secret, _ := resourceFactory.FromMap(map[string]any{ "apiVersion": "v1", "kind": "Secret", - "metadata": map[string]interface{}{ + "metadata": map[string]any{ "name": "secret", "namespace": "test", }, "type": corev1.SecretTypeDockerConfigJson, - "data": map[string]interface{}{ + "data": map[string]any{ corev1.DockerConfigJsonKey: base64.StdEncoding.EncodeToString(encData), }, }) @@ -1338,13 +1310,9 @@ func TestDecryptor_decryptKustomizationSources(t *testing.T) { }, secretGenerator: []kustypes.SecretArgs{ { - GeneratorArgs: kustypes.GeneratorArgs{ - Name: "envSecret", - KvPairSources: kustypes.KvPairSources{ - FileSources: []string{"file.txt", "combo=combination.json"}, - EnvSources: []string{"app.env", "../secret.env"}, - }, - }, + Name: "envSecret", + FileSources: []string{"file.txt", "combo=combination.json"}, + EnvSources: []string{"app.env", "../secret.env"}, }, }, expectVisited: []string{"subdir/app.env", "subdir/combination.json", "subdir/file.txt", "secret.env"}, @@ -1354,12 +1322,8 @@ func TestDecryptor_decryptKustomizationSources(t *testing.T) { files: []file{}, secretGenerator: []kustypes.SecretArgs{ { - GeneratorArgs: kustypes.GeneratorArgs{ - Name: "envSecret", - KvPairSources: kustypes.KvPairSources{ - EnvSources: []string{"file.txt"}, - }, - }, + Name: "envSecret", + EnvSources: []string{"file.txt"}, }, }, expectVisited: []string{}, @@ -1374,12 +1338,8 @@ func TestDecryptor_decryptKustomizationSources(t *testing.T) { }, secretGenerator: []kustypes.SecretArgs{ { - GeneratorArgs: kustypes.GeneratorArgs{ - Name: "envSecret", - KvPairSources: kustypes.KvPairSources{ - EnvSources: []string{"symlink"}, - }, - }, + Name: "envSecret", + EnvSources: []string{"symlink"}, }, }, expectVisited: []string{"otherdir/data.env"}, @@ -1394,12 +1354,8 @@ func TestDecryptor_decryptKustomizationSources(t *testing.T) { }, secretGenerator: []kustypes.SecretArgs{ { - GeneratorArgs: kustypes.GeneratorArgs{ - Name: "envSecret", - KvPairSources: kustypes.KvPairSources{ - EnvSources: []string{"symlink"}, - }, - }, + Name: "envSecret", + EnvSources: []string{"symlink"}, }, }, wantErr: &fs.PathError{Op: "lstat", Path: "otherdir/data.env", Err: fmt.Errorf("")}, @@ -1414,12 +1370,8 @@ func TestDecryptor_decryptKustomizationSources(t *testing.T) { }, secretGenerator: []kustypes.SecretArgs{ { - GeneratorArgs: kustypes.GeneratorArgs{ - Name: "envSecret", - KvPairSources: kustypes.KvPairSources{ - EnvSources: []string{"../data.env"}, - }, - }, + Name: "envSecret", + EnvSources: []string{"../data.env"}, }, }, wantErr: &fs.PathError{Op: "lstat", Path: "data.env", Err: fmt.Errorf("")}, @@ -1443,12 +1395,8 @@ func TestDecryptor_decryptKustomizationSources(t *testing.T) { }, secretGenerator: []kustypes.SecretArgs{ { - GeneratorArgs: kustypes.GeneratorArgs{ - Name: "envSecret", - KvPairSources: kustypes.KvPairSources{ - FileSources: []string{"file.txt"}, - }, - }, + Name: "envSecret", + FileSources: []string{"file.txt"}, }, }, expectVisited: []string{"subdir/patch.yaml", "subdir/file.txt"}, @@ -2016,10 +1964,8 @@ func TestDecryptor_recurseKustomizationFiles(t *testing.T) { return } kus := kustypes.Kustomization{ - TypeMeta: kustypes.TypeMeta{ - APIVersion: kustypes.KustomizationVersion, - Kind: kustypes.KustomizationKind, - }, + APIVersion: kustypes.KustomizationVersion, + Kind: kustypes.KustomizationKind, } for _, res := range n.resources { res = strings.Replace(res, "", tmpDir, 1) @@ -2077,12 +2023,12 @@ func TestDecryptor_isSOPSEncryptedResource(t *testing.T) { g := NewWithT(t) resourceFactory := provider.NewDefaultDepProvider().GetResourceFactory() - encrypted, _ := resourceFactory.FromMap(map[string]interface{}{ + encrypted, _ := resourceFactory.FromMap(map[string]any{ "sops": map[string]string{ "mac": "some mac value", }, }) - empty, _ := resourceFactory.FromMap(map[string]interface{}{}) + empty, _ := resourceFactory.FromMap(map[string]any{}) g.Expect(isSOPSEncryptedResource(encrypted)).To(BeTrue()) g.Expect(isSOPSEncryptedResource(empty)).To(BeFalse()) diff --git a/internal/decryptor/transit_engine_test.go b/internal/decryptor/transit_engine_test.go index ea4627aa8..431598511 100644 --- a/internal/decryptor/transit_engine_test.go +++ b/internal/decryptor/transit_engine_test.go @@ -28,7 +28,6 @@ import ( . "github.com/onsi/gomega" corev1 "k8s.io/api/core/v1" - metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" "k8s.io/apimachinery/pkg/runtime" "k8s.io/apimachinery/pkg/types" "sigs.k8s.io/controller-runtime/pkg/client/fake" @@ -45,25 +44,21 @@ func TestDecryptor_SetAuthOptionsTransitEngine(t *testing.T) { g.Expect(corev1.AddToScheme(scheme)).To(Succeed()) sa := &corev1.ServiceAccount{ - ObjectMeta: metav1.ObjectMeta{ - Name: "sops-identity", - Namespace: "default", - Annotations: map[string]string{ - cryptov1.AnnotationCredentialProvider: cryptov1.CredentialProviderKubernetes, - cryptov1.AnnotationCredentialType: cryptov1.CredentialTypeJWT, - cryptov1.AnnotationTransitEngineLoginPath: "auth/jwt/login", - cryptov1.AnnotationTransitEngineRole: "my-role", - }, + Name: "sops-identity", + Namespace: "default", + Annotations: map[string]string{ + cryptov1.AnnotationCredentialProvider: cryptov1.CredentialProviderKubernetes, + cryptov1.AnnotationCredentialType: cryptov1.CredentialTypeJWT, + cryptov1.AnnotationTransitEngineLoginPath: "auth/jwt/login", + cryptov1.AnnotationTransitEngineRole: "my-role", }, } d := &Decryptor{ client: fake.NewClientBuilder().WithScheme(scheme).WithObjects(sa).Build(), kustomization: &kustomizev1.Kustomization{ - ObjectMeta: metav1.ObjectMeta{ - Name: "test", - Namespace: sa.Namespace, - }, + Name: "test", + Namespace: sa.Namespace, Spec: kustomizev1.KustomizationSpec{ Decryption: &kustomizev1.Decryption{ Provider: DecryptionProviderSOPS, @@ -175,11 +170,9 @@ func TestDecryptorLoadVaultLoginPaths(t *testing.T) { key := types.NamespacedName{Namespace: "flux-system", Name: "sops-vault-config"} configMap := func(data map[string]string) *corev1.ConfigMap { return &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{ - Name: key.Name, - Namespace: key.Namespace, - }, - Data: data, + Name: key.Name, + Namespace: key.Namespace, + Data: data, } } newDecryptor := func(objects ...*corev1.ConfigMap) *Decryptor { @@ -382,7 +375,7 @@ func TestConfigMapVaultAuthFunc(t *testing.T) { key := types.NamespacedName{Namespace: "flux-system", Name: "sops-vault-config"} cm := &corev1.ConfigMap{ - ObjectMeta: metav1.ObjectMeta{Name: key.Name, Namespace: key.Namespace}, + Name: key.Name, Namespace: key.Namespace, Data: map[string]string{ "config.yaml": `instances: - address: https://vault.example.com:8200 diff --git a/internal/sops/azkv/config.go b/internal/sops/azkv/config.go index fa7866336..f8e97ee08 100644 --- a/internal/sops/azkv/config.go +++ b/internal/sops/azkv/config.go @@ -83,9 +83,7 @@ func TokenCredentialFromAADConfig(c AADConfig) (token azcore.TokenCredential, er if c.TenantID != "" && c.ClientID != "" { if c.ClientSecret != "" { return azidentity.NewClientSecretCredential(c.TenantID, c.ClientID, c.ClientSecret, &azidentity.ClientSecretCredentialOptions{ - ClientOptions: azcore.ClientOptions{ - Cloud: c.GetCloudConfig(), - }, + Cloud: c.GetCloudConfig(), }) } if c.ClientCertificate != "" { @@ -95,9 +93,7 @@ func TokenCredentialFromAADConfig(c AADConfig) (token azcore.TokenCredential, er } return azidentity.NewClientCertificateCredential(c.TenantID, c.ClientID, certs, pk, &azidentity.ClientCertificateCredentialOptions{ SendCertificateChain: c.ClientCertificateSendChain, - ClientOptions: azcore.ClientOptions{ - Cloud: c.GetCloudConfig(), - }, + Cloud: c.GetCloudConfig(), }) } return nil, fmt.Errorf("invalid data: requires 'clientSecret' or 'clientCertificate' when both 'tenantId' and 'clientId' are set") @@ -106,9 +102,7 @@ func TokenCredentialFromAADConfig(c AADConfig) (token azcore.TokenCredential, er switch { case c.Tenant != "" && c.AppID != "" && c.Password != "": return azidentity.NewClientSecretCredential(c.Tenant, c.AppID, c.Password, &azidentity.ClientSecretCredentialOptions{ - ClientOptions: azcore.ClientOptions{ - Cloud: c.GetCloudConfig(), - }, + Cloud: c.GetCloudConfig(), }) case c.ClientID != "": return azidentity.NewManagedIdentityCredential(&azidentity.ManagedIdentityCredentialOptions{ diff --git a/internal/sops/keyservice/server.go b/internal/sops/keyservice/server.go index 415ed6a00..bafb65e0e 100644 --- a/internal/sops/keyservice/server.go +++ b/internal/sops/keyservice/server.go @@ -17,6 +17,7 @@ limitations under the License. package keyservice import ( + context0 "context" "fmt" "github.com/getsops/sops/v3/age" @@ -27,7 +28,6 @@ import ( awskms "github.com/getsops/sops/v3/kms" "github.com/getsops/sops/v3/logging" "github.com/getsops/sops/v3/pgp" - "golang.org/x/net/context" ) // Server is a key service server that uses SOPS MasterKeys to fulfill @@ -61,7 +61,7 @@ type Server struct { // decrypted (similar to how the AWS region is derived from the KMS ARN). // When nil, and vaultToken is also empty, the request is handled by // defaultServer. - vaultK8sAuth func(ctx context.Context, vaultAddress string) (string, error) + vaultK8sAuth func(ctx context0.Context, vaultAddress string) (string, error) // azureTokenCredential is the credential token used for Encrypt and Decrypt // operations of Azure Key Vault requests. @@ -107,7 +107,7 @@ func NewServer(options ...ServerOption) keyservice.KeyServiceServer { // Encrypt takes an encrypt request and encrypts the provided plaintext with // the provided key, returning the encrypted result. -func (ks Server) Encrypt(ctx context.Context, req *keyservice.EncryptRequest) (*keyservice.EncryptResponse, error) { +func (ks Server) Encrypt(ctx context0.Context, req *keyservice.EncryptRequest) (*keyservice.EncryptResponse, error) { key := req.Key switch k := key.KeyType.(type) { case *keyservice.Key_PgpKey: @@ -169,7 +169,7 @@ func (ks Server) Encrypt(ctx context.Context, req *keyservice.EncryptRequest) (* // Decrypt takes a decrypt request and decrypts the provided ciphertext with // the provided key, returning the decrypted result. -func (ks Server) Decrypt(ctx context.Context, req *keyservice.DecryptRequest) (*keyservice.DecryptResponse, error) { +func (ks Server) Decrypt(ctx context0.Context, req *keyservice.DecryptRequest) (*keyservice.DecryptResponse, error) { key := req.Key switch k := key.KeyType.(type) { case *keyservice.Key_PgpKey: @@ -277,7 +277,7 @@ func (ks *Server) decryptWithAge(key *keyservice.AgeKey, ciphertext []byte) ([]b return plaintext, err } -func (ks *Server) encryptWithHCVault(ctx context.Context, key *keyservice.VaultKey, plaintext []byte) ([]byte, error) { +func (ks *Server) encryptWithHCVault(ctx context0.Context, key *keyservice.VaultKey, plaintext []byte) ([]byte, error) { vaultKey := hcvault.MasterKey{ VaultAddress: key.VaultAddress, EnginePath: key.EnginePath, @@ -294,13 +294,13 @@ func (ks *Server) encryptWithHCVault(ctx context.Context, key *keyservice.VaultK return []byte(vaultKey.EncryptedKey), nil } -func (ks *Server) decryptWithHCVault(ctx context.Context, key *keyservice.VaultKey, ciphertext []byte) ([]byte, error) { +func (ks *Server) decryptWithHCVault(ctx context0.Context, key *keyservice.VaultKey, ciphertext []byte) ([]byte, error) { vaultKey := hcvault.MasterKey{ VaultAddress: key.VaultAddress, EnginePath: key.EnginePath, KeyName: key.KeyName, - } - vaultKey.EncryptedKey = string(ciphertext) + + EncryptedKey: string(ciphertext)} token, err := ks.resolveVaultToken(ctx, key.VaultAddress) if err != nil { return nil, err @@ -313,7 +313,7 @@ func (ks *Server) decryptWithHCVault(ctx context.Context, key *keyservice.VaultK // resolveVaultToken returns the OpenBao/Vault token to use for the // Vault server at the given address. A statically configured token takes // precedence; otherwise the token is obtained via the Kubernetes auth method. -func (ks *Server) resolveVaultToken(ctx context.Context, vaultAddress string) (hcvault.Token, error) { +func (ks *Server) resolveVaultToken(ctx context0.Context, vaultAddress string) (hcvault.Token, error) { if ks.vaultToken != "" { return ks.vaultToken, nil } diff --git a/internal/sops/keyservice/server_test.go b/internal/sops/keyservice/server_test.go index 996f6f570..3ee3fb3e5 100644 --- a/internal/sops/keyservice/server_test.go +++ b/internal/sops/keyservice/server_test.go @@ -17,6 +17,7 @@ limitations under the License. package keyservice import ( + context0 "context" "fmt" "os" "testing" @@ -33,7 +34,6 @@ import ( awskms "github.com/getsops/sops/v3/kms" "github.com/getsops/sops/v3/pgp" . "github.com/onsi/gomega" - "golang.org/x/net/context" "golang.org/x/oauth2/google" ) @@ -56,7 +56,7 @@ func TestServer_EncryptDecrypt_PGP(t *testing.T) { s := NewServer(WithGnuPGHome(gnuPGHome)) key := KeyFromMasterKey(pgp.NewMasterKeyFromFingerprint(mockFingerprint)) dataKey := []byte("some data key") - encResp, err := s.Encrypt(context.TODO(), &keyservice.EncryptRequest{ + encResp, err := s.Encrypt(context0.TODO(), &keyservice.EncryptRequest{ Key: &key, Plaintext: dataKey, }) @@ -65,7 +65,7 @@ func TestServer_EncryptDecrypt_PGP(t *testing.T) { g.Expect(encResp.Ciphertext).ToNot(Equal(dataKey)) g.Expect(gnuPGHome.ImportFile(mockPrivateKey)).To(Succeed()) - decResp, err := s.Decrypt(context.TODO(), &keyservice.DecryptRequest{ + decResp, err := s.Decrypt(context0.TODO(), &keyservice.DecryptRequest{ Key: &key, Ciphertext: encResp.Ciphertext, }) @@ -84,7 +84,7 @@ func TestServer_EncryptDecrypt_age(t *testing.T) { s := NewServer() key := KeyFromMasterKey(&age.MasterKey{Recipient: mockRecipient}) dataKey := []byte("some data key") - encResp, err := s.Encrypt(context.TODO(), &keyservice.EncryptRequest{ + encResp, err := s.Encrypt(context0.TODO(), &keyservice.EncryptRequest{ Key: &key, Plaintext: dataKey, }) @@ -96,7 +96,7 @@ func TestServer_EncryptDecrypt_age(t *testing.T) { g.Expect(i.Import(mockIdentity)).To(Succeed()) s = NewServer(WithAgeIdentities(i)) - decResp, err := s.Decrypt(context.TODO(), &keyservice.DecryptRequest{ + decResp, err := s.Decrypt(context0.TODO(), &keyservice.DecryptRequest{ Key: &key, Ciphertext: encResp.Ciphertext, }) @@ -109,13 +109,13 @@ func TestServer_EncryptDecrypt_HCVault(t *testing.T) { s := NewServer(WithVaultToken("token")) key := KeyFromMasterKey(hcvault.NewMasterKey("https://example.com", "engine-path", "key-name")) - _, err := s.Encrypt(context.TODO(), &keyservice.EncryptRequest{ + _, err := s.Encrypt(context0.TODO(), &keyservice.EncryptRequest{ Key: &key, }) g.Expect(err).To(HaveOccurred()) g.Expect(err.Error()).To(ContainSubstring("failed to encrypt sops data key to Vault transit backend")) - _, err = s.Decrypt(context.TODO(), &keyservice.DecryptRequest{ + _, err = s.Decrypt(context0.TODO(), &keyservice.DecryptRequest{ Key: &key, }) g.Expect(err).To(HaveOccurred()) @@ -133,7 +133,7 @@ func TestServer_EncryptDecrypt_HCVault_Fallback(t *testing.T) { Key: &key, Plaintext: []byte("some data key"), } - _, err := s.Encrypt(context.TODO(), encReq) + _, err := s.Encrypt(context0.TODO(), encReq) g.Expect(err).To(HaveOccurred()) g.Expect(fallback.encryptReqs).To(HaveLen(1)) g.Expect(fallback.encryptReqs).To(ContainElement(encReq)) @@ -145,7 +145,7 @@ func TestServer_EncryptDecrypt_HCVault_Fallback(t *testing.T) { Key: &key, Ciphertext: []byte("some ciphertext"), } - _, err = s.Decrypt(context.TODO(), decReq) + _, err = s.Decrypt(context0.TODO(), decReq) g.Expect(err).To(HaveOccurred()) g.Expect(fallback.decryptReqs).To(HaveLen(1)) g.Expect(fallback.decryptReqs).To(ContainElement(decReq)) @@ -159,13 +159,13 @@ func TestServer_EncryptDecrypt_awskms(t *testing.T) { }) key := KeyFromMasterKey(awskms.NewMasterKeyFromArn("arn:aws:kms:us-west-2:107501996527:key/612d5f0p-p1l3-45e6-aca6-a5b005693a48", nil, "")) - _, err := s.Encrypt(context.TODO(), &keyservice.EncryptRequest{ + _, err := s.Encrypt(context0.TODO(), &keyservice.EncryptRequest{ Key: &key, }) g.Expect(err).To(HaveOccurred()) g.Expect(err.Error()).To(ContainSubstring("failed to encrypt sops data key with AWS KMS")) - _, err = s.Decrypt(context.TODO(), &keyservice.DecryptRequest{ + _, err = s.Decrypt(context0.TODO(), &keyservice.DecryptRequest{ Key: &key, }) g.Expect(err).To(HaveOccurred()) @@ -180,13 +180,13 @@ func TestServer_EncryptDecrypt_azkv(t *testing.T) { s := NewServer(WithAzureTokenCredential{TokenCredential: identity}) key := KeyFromMasterKey(azkv.NewMasterKey("", "", "")) - _, err = s.Encrypt(context.TODO(), &keyservice.EncryptRequest{ + _, err = s.Encrypt(context0.TODO(), &keyservice.EncryptRequest{ Key: &key, }) g.Expect(err).To(HaveOccurred()) g.Expect(err.Error()).To(ContainSubstring("failed to encrypt sops data key with Azure Key Vault")) - _, err = s.Decrypt(context.TODO(), &keyservice.DecryptRequest{ + _, err = s.Decrypt(context0.TODO(), &keyservice.DecryptRequest{ Key: &key, }) g.Expect(err).To(HaveOccurred()) @@ -197,20 +197,20 @@ func TestServer_EncryptDecrypt_azkv(t *testing.T) { func TestServer_EncryptDecrypt_gcpkms(t *testing.T) { g := NewWithT(t) - creds, err := google.CredentialsFromJSON(context.Background(), + creds, err := google.CredentialsFromJSON(context0.Background(), []byte(`{"type":"service_account"}`), gcpkmsapi.DefaultAuthScopes()...) g.Expect(err).ToNot(HaveOccurred()) s := NewServer(WithGCPTokenSource{TokenSource: creds.TokenSource}) resourceID := "projects/test-flux/locations/global/keyRings/test-flux/cryptoKeys/sops" key := KeyFromMasterKey(gcpkms.NewMasterKeyFromResourceID(resourceID)) - _, err = s.Encrypt(context.TODO(), &keyservice.EncryptRequest{ + _, err = s.Encrypt(context0.TODO(), &keyservice.EncryptRequest{ Key: &key, }) g.Expect(err).To(HaveOccurred()) g.Expect(err.Error()).To(ContainSubstring("failed to encrypt sops data key with GCP KMS key")) - _, err = s.Decrypt(context.TODO(), &keyservice.DecryptRequest{ + _, err = s.Decrypt(context0.TODO(), &keyservice.DecryptRequest{ Key: &key, }) g.Expect(err).To(HaveOccurred()) @@ -225,9 +225,9 @@ func TestServer_EncryptDecrypt_Nil_KeyType(t *testing.T) { expectErr := fmt.Errorf("must provide a key") - _, err := s.Encrypt(context.TODO(), &keyservice.EncryptRequest{Key: &keyservice.Key{KeyType: nil}}) + _, err := s.Encrypt(context0.TODO(), &keyservice.EncryptRequest{Key: &keyservice.Key{KeyType: nil}}) g.Expect(err).To(Equal(expectErr)) - _, err = s.Decrypt(context.TODO(), &keyservice.DecryptRequest{Key: &keyservice.Key{KeyType: nil}}) + _, err = s.Decrypt(context0.TODO(), &keyservice.DecryptRequest{Key: &keyservice.Key{KeyType: nil}}) g.Expect(err).To(Equal(expectErr)) } diff --git a/main.go b/main.go index e51b3e233..5d37468a3 100644 --- a/main.go +++ b/main.go @@ -30,7 +30,6 @@ import ( clientgoscheme "k8s.io/client-go/kubernetes/scheme" _ "k8s.io/client-go/plugin/pkg/client/auth/azure" _ "k8s.io/client-go/plugin/pkg/client/auth/gcp" - "k8s.io/utils/ptr" ctrl "sigs.k8s.io/controller-runtime" ctrlcache "sigs.k8s.io/controller-runtime/pkg/cache" ctrlclient "sigs.k8s.io/controller-runtime/pkg/client" @@ -233,7 +232,7 @@ func main() { }, Controller: ctrlcfg.Controller{ MaxConcurrentReconciles: concurrent, - RecoverPanic: ptr.To(true), + RecoverPanic: new(true), }, }