-
Notifications
You must be signed in to change notification settings - Fork 5.6k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(cli): Add Plugin Support to the Argo CD CLI #20074
base: master
Are you sure you want to change the base?
Conversation
🔴 Preview Environment stopped on BunnyshellSee: Environment Details | Pipeline Logs Available commands (reply to this comment):
|
✅ Preview Environment created on Bunnyshell but will not be auto-deployedSee: Environment Details Available commands (reply to this comment):
|
Codecov ReportAttention: Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## master #20074 +/- ##
=========================================
Coverage ? 59.07%
=========================================
Files ? 338
Lines ? 57159
Branches ? 0
=========================================
Hits ? 33768
Misses ? 20579
Partials ? 2812 ☔ View full report in Codecov by Sentry. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please consider adding a new documentation page explaining how to write plugins and how to install and consume them.
92967cd
to
4a260dd
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
plugin_test.go
is kept in separate package because keeping it in the util will create circular dependency.
Update: Resolved
0e8f338
to
c314e43
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@nitishfy Great progress. I think this PR needs to be reviewed by someone from the security sig as I see some potential risks in the code. I added comments to the security issues that I identified at first but a more security driven review would be important in this case.
cc @jannfis @crenshaw-dev
cmd/argocd/commands/plugin.go
Outdated
} | ||
if filepath.Base(name) == name { | ||
lp, err := exec.LookPath(name) | ||
if lp != "" && !shouldSkipOnLookPathErr(err) { |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This may lead to security implications. For example: if someone has their PATH
configured as PATH=.:/usr/bin
, the first .
makes the current directory available in the PATH which enables different types of exploits. Go 1.19+ will return ErrDot
to notify us that the return value from LookPath()
is a relative path. We shouldn't ignore this error. Instead, we should fail and return an error stating that the executable wasn't found. Also, we must state in the docs that the plugin executable must be in the path and should not be provided as relative path.
652887c
to
fea85cd
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We are not using the cmd.Find()
anymore.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Please check my comments
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
PTAL.
Also, I think I'll have to restructure the entire tests for |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Great progress. Tks @nitishfy!
There are a few more open items to be addressed in this PR before we merge.
Please take a look.
go.mod
Outdated
@@ -83,6 +83,7 @@ require ( | |||
go.opentelemetry.io/otel v1.30.0 | |||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.30.0 | |||
go.opentelemetry.io/otel/sdk v1.30.0 | |||
go.uber.org/automaxprocs v1.6.0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think you should probably revert the changes in go.mod
in order for there not to be any conflicts with master
.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
this will lead to dependency issues, resulting in failure of CI checks.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@nitishfy You probably need to run go mod tidy
and push the changes.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you run
git checkout origin/master -- go.mod
?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this needs to be done again once you sync your hook with argocd/master
and then pulling in the latest changes from your hook on the master branch.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Few suggestions needed and once done, I'll start with improving the comments and add the docs. Thanks!
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Added a few pointers which I think would be good to do before proceeding further.
@leoluz I'm personally in the opinion of searching for a plugin, starting with the longest prefix. Why would you want to follow another approach? |
319184f
to
fde718d
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think there's a lot of room to simplify this further - there's also a bunch of test code existing which does not exercise a lot of the actual code (as well as there being a lot of test code which seems redundant?).
By abstracting away exec.LookPath
and cmd.Run
tests can be written which exercises the actual implementation of DefaultPluginHandler
(just create custom functions for lookPath
and run
in your tests)
go.mod
Outdated
@@ -83,6 +83,7 @@ require ( | |||
go.opentelemetry.io/otel v1.30.0 | |||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.30.0 | |||
go.opentelemetry.io/otel/sdk v1.30.0 | |||
go.uber.org/automaxprocs v1.6.0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you run
git checkout origin/master -- go.mod
?
f0fe0f0
to
a1e9407
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@blakebarnett PTAL
6139175
to
7ccd4a7
Compare
@leoluz @blakepettersson I'd need your feedback on this PR. Having said that, there are a few things I'd like to mention:
|
d8723ca
to
d0ba8ce
Compare
What kind of code optimizations and test cases can be done? Why can't they be done in this PR? |
go.mod
Outdated
@@ -83,6 +83,7 @@ require ( | |||
go.opentelemetry.io/otel v1.30.0 | |||
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.30.0 | |||
go.opentelemetry.io/otel/sdk v1.30.0 | |||
go.uber.org/automaxprocs v1.6.0 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I think this needs to be done again once you sync your hook with argocd/master
and then pulling in the latest changes from your hook on the master branch.
Signed-off-by: nitishfy <[email protected]>
Signed-off-by: nitishfy <[email protected]>
Signed-off-by: nitishfy <[email protected]>
Signed-off-by: nitishfy <[email protected]>
fbe994f
to
0cd9b74
Compare
Signed-off-by: nitishfy <[email protected]>
Signed-off-by: nitishfy <[email protected]>
// TODO: verify how errors should be handled | ||
path, err := h.lookPath(pluginName) | ||
if err != nil || len(path) == 0 { | ||
continue |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
shouldn't this error be logged so users know why their plugins are not being registered?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
we are not logging the error here because we try to search for another plugin name based on the longest prefix match. For eg. If a plugin argocd demo plugin
is not found, the err will be non-nil and we then search for a plugin named argocd demo
. This is getting done by ranging over the valid prefixes.
// Unexpected errors (e.g., permission issues) are logged for debugging but do not stop the search. | ||
// This doesn't care about the plugin execution errors since those errors are handled separately by | ||
// the execute function. Only those binaries are considered as argocd plugins if they start with | ||
// argocd and have executable permisssions. If they don't have executable permissions inspite of being |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If they don't have executable permissions
I don't see the executable validation logic as part of this function. Please just document the function specific behaviour and move this doc to where the validation is actually implemented.
func (h *DefaultPluginHandler) lookForPlugin(filename string) (string, bool) { | ||
for _, prefix := range h.ValidPrefixes { | ||
pluginName := fmt.Sprintf("%s-%s", prefix, filename) // Combine prefix and filename | ||
// TODO: verify how errors should be handled |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
We should define how this error should be handled as part of this PR.
Ref: #19624
Checklist: