Init

Author: simonklb

.github/workflows/release.yaml

@@ -0,0 +1,63 @@
+on:
+  push:
+    branches:
+      - main
+
+jobs:
+  check-version:
+    runs-on: ubuntu-latest
+    outputs:
+      tag_exists: ${{ steps.check.outputs.tag_exists }}
+      version: ${{ steps.check.outputs.version }}
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Extract and Check
+        id: check
+        run: |
+          VERSION=$(yq '.version' plugin.yaml)
+          echo "version=${VERSION}" >> $GITHUB_OUTPUT
+
+          if git rev-parse "v${VERSION}" >/dev/null 2>&1; then
+            echo Tag v${VERSION} already exists, skipping release.
+            echo "tag_exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "tag_exists=false" >> $GITHUB_OUTPUT
+          fi
+
+  create-release:
+    needs: check-version
+    if: needs.check-version.outputs.tag_exists == 'false'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Setup Helm
+        uses: azure/setup-helm@v4
+
+      - name: Setup Go
+        uses: actions/setup-go@v6
+        with:
+          go-version-file: 'go.mod'
+
+      # TODO: Signing
+      # - name: Import GPG key
+      #   run: gpg --import <(echo "${PRIVATE_SIGNING_KEY}")
+      #   env:
+      #     PRIVATE_SIGNING_KEY: ${{ secrets.PRIVATE_SIGNING_KEY }}
+
+      - name: Package
+        run: make package
+        # TODO: Signing
+        # env:
+        #   HOTPATCH_SIGNING_KEY_EMAIL: ${{ vars.SIGNING_KEY_EMAIL }}
+
+      - name: Release
+        # TODO: Signing
+        # run: gh release create "v${VERSION}" hotpatch-*.tgz hotpatch-*.tgz.prov --generate-notes
+        run: gh release create "v${VERSION}" hotpatch-*.tgz --generate-notes
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          VERSION: ${{ needs.check-version.outputs.version }}

.gitignore

@@ -0,0 +1,3 @@
+hotpatch
+hotpatch-*.tgz
+package/

Makefile

@@ -0,0 +1,33 @@
+.PHONY: build clean install package test test-integration uninstall
+
+HOTPATCH_VERSION=$$(yq .version plugin.yaml)
+HOTPATCH_PACKAGE=hotpatch-$(HOTPATCH_VERSION).tgz
+HOTPATCH_BUILD_OUTPUT=hotpatch
+
+build:
+	@go build -o $(HOTPATCH_BUILD_OUTPUT) ./cmd/hotpatch
+
+clean:
+	@rm -rf $(HOTPATCH_BUILD_OUTPUT) ./package $(HOTPATCH_PACKAGE)
+
+package: build
+	@mkdir -p ./package
+	@cp ./hotpatch ./package/
+	@cp ./plugin.yaml ./package/
+	@helm plugin package ./package --sign=false
+# TODO: Signing
+# 	@helm plugin package ./package --sign --key "${HOTPATCH_SIGNING_KEY_EMAIL}"
+
+install: package
+	@helm plugin install $(HOTPATCH_PACKAGE)
+
+uninstall:
+	@helm plugin uninstall hotpatch
+
+test-flags=$(if $(TEST_FLAGS),$(TEST_FLAGS))
+
+test:
+	@go test ./... $(test-flags)
+
+test-integration:
+	@go test ./integration $(test-flags) -tags integration

cmd/hotpatch/main.go

@@ -0,0 +1,59 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+	"io"
+	"log/slog"
+	"os"
+
+	"github.com/elastisys/helm-hotpatch/internal/yamlpatcher"
+)
+
+var rootPath string
+
+func init() {
+	flag.StringVar(&rootPath, "path", "./patches", "path to patches directory")
+
+	if val, ok := os.LookupEnv("HELM_HOTPATCH_PATH"); ok {
+		rootPath = val
+	}
+}
+
+func run(ctx context.Context) error {
+	// If the patch directory is not found, just pipe.
+	if _, err := os.Stat(rootPath); errors.Is(err, os.ErrNotExist) {
+		slog.DebugContext(ctx, "patches directory not found", slog.String("path", rootPath), slog.String("error", err.Error()))
+
+		if _, err := io.Copy(os.Stdout, os.Stdin); err != nil {
+			return fmt.Errorf("copying stdin to stdout: %w", err)
+		}
+		return nil
+	}
+
+	patches, err := yamlpatcher.LoadPatchesFromDir(ctx, rootPath)
+	if err != nil {
+		return fmt.Errorf("load patches: %w", err)
+	}
+
+	yp := yamlpatcher.NewYAMLPatcher(patches)
+
+	if err := yp.Run(ctx, os.Stdin, os.Stdout); err != nil {
+		return fmt.Errorf("process: %w", err)
+	}
+
+	return nil
+}
+
+func main() {
+	flag.Parse()
+
+	slog.SetLogLoggerLevel(slog.LevelDebug)
+
+	if err := run(context.Background()); err != nil {
+		fmt.Fprintf(os.Stderr, "Error:  %s\n", err)
+		os.Exit(1)
+	}
+}

go.mod

@@ -0,0 +1,33 @@
+module github.com/elastisys/helm-hotpatch
+
+go 1.25.5
+
+require (
+	github.com/stretchr/testify v1.11.1
+	k8s.io/apimachinery v0.35.0
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/fxamacker/cbor/v2 v2.9.0 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
+	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kr/pretty v0.3.1 // indirect
+	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
+	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	go.yaml.in/yaml/v2 v2.4.3 // indirect
+	golang.org/x/net v0.47.0 // indirect
+	golang.org/x/text v0.31.0 // indirect
+	gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c // indirect
+	gopkg.in/inf.v0 v0.9.1 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+	k8s.io/klog/v2 v2.130.1 // indirect
+	k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 // indirect
+	k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 // indirect
+	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v6 v6.3.0 // indirect
+	sigs.k8s.io/yaml v1.6.0 // indirect
+)

go.sum

@@ -0,0 +1,72 @@
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/fxamacker/cbor/v2 v2.9.0 h1:NpKPmjDBgUfBms6tr6JZkTHtfFGcMKsw3eGcmD/sapM=
+github.com/fxamacker/cbor/v2 v2.9.0/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
+github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
+github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
+github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
+github.com/kr/pretty v0.2.1/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
+github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
+github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
+github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
+github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
+github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
+github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
+github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/spf13/pflag v1.0.9 h1:9exaQaMOCwffKiiiYk6/BndUBv+iRViNW+4lEMi0PvY=
+github.com/spf13/pflag v1.0.9/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
+github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
+github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
+github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
+go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
+go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
+go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
+go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
+gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+k8s.io/apimachinery v0.35.0 h1:Z2L3IHvPVv/MJ7xRxHEtk6GoJElaAqDCCU0S6ncYok8=
+k8s.io/apimachinery v0.35.0/go.mod h1:jQCgFZFR1F4Ik7hvr2g84RTJSZegBc8yHgFWKn//hns=
+k8s.io/klog/v2 v2.130.1 h1:n9Xl7H1Xvksem4KFG4PYbdQCQxqc/tTUyrgXaOhHSzk=
+k8s.io/klog/v2 v2.130.1/go.mod h1:3Jpz1GvMt720eyJH1ckRHK1EDfpxISzJ7I9OYgaDtPE=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912 h1:Y3gxNAuB0OBLImH611+UDZcmKS3g6CthxToOb37KgwE=
+k8s.io/kube-openapi v0.0.0-20250910181357-589584f1c912/go.mod h1:kdmbQkyfwUagLfXIad1y2TdrjPFWp2Q89B3qkRwf/pQ=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4 h1:SjGebBtkBqHFOli+05xYbK8YF1Dzkbzn+gDM4X9T4Ck=
+k8s.io/utils v0.0.0-20251002143259-bc988d571ff4/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
+sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
+sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
+sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0 h1:jTijUJbW353oVOd9oTlifJqOGEkUw2jB/fXCbTiQEco=
+sigs.k8s.io/structured-merge-diff/v6 v6.3.0/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
+sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
+sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

integration/integration_test.go

@@ -0,0 +1,118 @@
+//go:build integration
+
+package tests
+
+import (
+	"context"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+const (
+	testdataPath = "./testdata"
+)
+
+var (
+	chartPath   = filepath.Join(testdataPath, "chart")
+	patchesPath = filepath.Join(testdataPath, "patches")
+)
+
+func TestIntegration(t *testing.T) {
+	helmDataDir, err := os.MkdirTemp(os.TempDir(), "helm-hotpatch-data-dir-******")
+	require.NoError(t, err)
+
+	t.Cleanup(func() {
+		if err := os.RemoveAll(helmDataDir); err != nil {
+			t.Logf("error removing temporary Helm data directory: %s", err)
+		}
+
+		runMake(t, context.Background(), "clean")
+	})
+
+	helmPluginsDir := filepath.Join(helmDataDir, "plugins")
+	require.NoError(t, os.Mkdir(helmPluginsDir, 0o755))
+	// The local installer / dev mode (used when installing from directory) doesn't care about HELM_PLUGINS:
+	// https://github.com/helm/helm/blob/4a91f3ad5cc0c1521f6d4dcb5681e2da4baaa157/internal/plugin/installer/local_installer.go#L179
+	// The person that fixes it upstream gets a cookie! :)
+	os.Setenv("HELM_DATA_HOME", helmDataDir)
+	os.Setenv("HELM_PLUGINS", helmPluginsDir)
+
+	runMake(t, t.Context(), "install")
+
+	expected, err := os.ReadFile("./testdata/expected.yaml")
+	require.NoError(t, err)
+
+	t.Run("flag", func(t *testing.T) {
+		cmd := exec.CommandContext(
+			t.Context(),
+			"helm",
+			"template",
+			"--post-renderer",
+			"hotpatch",
+			"--post-renderer-args",
+			"-path",
+			"--post-renderer-args",
+			patchesPath,
+			chartPath,
+		)
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, string(out))
+		assert.Equal(t, string(expected), string(out))
+	})
+
+	t.Run("env", func(t *testing.T) {
+		cmd := exec.CommandContext(
+			t.Context(),
+			"helm",
+			"template",
+			"--post-renderer",
+			"hotpatch",
+			chartPath,
+		)
+		cmd.Env = append(os.Environ(), "HELM_HOTPATCH_PATH="+patchesPath)
+		out, err := cmd.CombinedOutput()
+		require.NoError(t, err, string(out))
+		assert.Equal(t, string(expected), string(out))
+	})
+
+	t.Run("missing-patches-dir", func(t *testing.T) {
+		withoutPostRendering := exec.CommandContext(
+			t.Context(),
+			"helm",
+			"template",
+			chartPath,
+		)
+
+		withPostRendering := exec.CommandContext(
+			t.Context(),
+			"helm",
+			"template",
+			"--post-renderer",
+			"hotpatch",
+			chartPath,
+		)
+		withPostRendering.Env = append(os.Environ(), "HELM_HOTPATCH_PATH=./testdata/doesnotexist")
+
+		outWithoutPostRendering, err := withoutPostRendering.CombinedOutput()
+		require.NoError(t, err, string(outWithoutPostRendering))
+
+		outWithPostRendering, err := withPostRendering.CombinedOutput()
+		require.NoError(t, err, string(outWithPostRendering))
+
+		assert.Equal(t, string(outWithoutPostRendering), string(outWithPostRendering))
+	})
+}
+
+func runMake(t *testing.T, ctx context.Context, target string) {
+	t.Helper()
+
+	cmd := exec.CommandContext(ctx, "make", target)
+	cmd.Dir = ".."
+	out, err := cmd.CombinedOutput()
+	require.NoError(t, err, string(out))
+}