merge in main

Makefile

@@ -0,0 +1,29 @@
+BINARY=helm-guard
+CMD_PATH=./cmd/helm-guard
+BIN_DIR=bin
+
+.PHONY: build run test lint fmt clean install
+
+build:
+	mkdir -p $(BIN_DIR)
+	go build -o $(BIN_DIR)/$(BINARY) $(CMD_PATH)
+
+run:
+	go run $(CMD_PATH)
+
+test:
+	go test ./...
+
+fmt:
+	go fmt ./...
+
+vet:
+	go vet ./...
+
+lint: fmt vet
+
+install:
+	go install $(CMD_PATH)
+
+clean:
+	rm -rf $(BIN_DIR)

internal/cli/analyze.go

@@ -1,24 +1,102 @@
 package cli
 
 import (
-	"fmt"
+	"os"
+	"strings"
 
 	"github.com/spf13/cobra"
+
+	"github.com/r3based/helm-guard/internal/helm"
+	"github.com/r3based/helm-guard/internal/kube"
+	"github.com/r3based/helm-guard/internal/model"
+	"github.com/r3based/helm-guard/internal/report"
+	"github.com/r3based/helm-guard/internal/rules"
+	"github.com/r3based/helm-guard/internal/rules/builtin"
 )
 
-var valuesFiles []string
+var (
+	valuesFiles []string
+	setValues   []string
+	namespace   string
+	releaseName string
+
+	failOn  string
+	disable []string
+)
 
 var analyzeCmd = &cobra.Command{
 	Use:   "analyze <chartPath>",
 	Args:  cobra.ExactArgs(1),
 	Short: "Render chart and analyze manifests",
 	RunE: func(cmd *cobra.Command, args []string) error {
-		fmt.Println("analyze:", args[0])
-		fmt.Println("values:", valuesFiles)
+		chartPath := args[0]
+
+		rendered, err := helm.Template(helm.TemplateParams{
+			ChartPath: chartPath,
+			Release:   releaseName,
+			Namespace: namespace,
+			Values:    valuesFiles,
+			Set:       setValues,
+		})
+		if err != nil {
+			return err
+		}
+
+		objs, err := kube.ParseManifests(rendered)
+		if err != nil {
+			return err
+		}
+
+		m := model.Build(objs)
+
+		disableIDs := map[string]bool{}
+		for _, x := range disable {
+			for _, id := range strings.Split(x, ",") {
+				id = strings.TrimSpace(id)
+				if id != "" {
+					disableIDs[id] = true
+				}
+			}
+		}
+
+		engine := rules.New(builtin.All(), rules.Options{DisableIDs: disableIDs})
+		findings := engine.Run(m)
+
+		report.Pretty(os.Stdout, len(objs), m, findings)
+
+		failSeverity := parseFailOn(failOn)
+		if failSeverity >= 0 {
+			os.Exit(rules.ExitCode(findings, failSeverity))
+		}
 		return nil
 	},
 }
 
 func init() {
 	analyzeCmd.Flags().StringArrayVarP(&valuesFiles, "values", "f", nil, "Values files")
+	analyzeCmd.Flags().StringArrayVar(&setValues, "set", nil, "Set values (key=val)")
+	analyzeCmd.Flags().StringVar(&namespace, "namespace", "", "Namespace")
+	analyzeCmd.Flags().StringVar(&releaseName, "release", "release", "Release name")
+
+	analyzeCmd.Flags().StringVar(&failOn, "fail-on", "off", "Fail on severity: off|cosmetic|low|medium|high|critical")
+	analyzeCmd.Flags().StringArrayVar(&disable, "disable", nil, "Disable rule IDs (comma-separated)")
+}
+
+func parseFailOn(s string) rules.Severity {
+	switch strings.ToLower(strings.TrimSpace(s)) {
+	case "off", "":
+		return -1
+	case "cosmetic":
+		return rules.Cosmetic
+	case "low":
+		return rules.Low
+	case "medium":
+		return rules.Medium
+	case "high":
+		return rules.High
+	case "critical":
+		return rules.Critical
+	default:
+		return -1
+	}
 }

internal/cli/root.go

@@ -19,4 +19,5 @@ func Execute() {
 
 func init() {
 	rootCmd.AddCommand(analyzeCmd)
+	rootCmd.AddCommand(rulesCmd)
 }

internal/cli/rules.go

@@ -0,0 +1,32 @@
+package cli
+
+import (
+	"fmt"
+	"sort"
+
+	"github.com/spf13/cobra"
+
+	"github.com/r3based/helm-guard/internal/rules/builtin"
+)
+
+var rulesCmd = &cobra.Command{
+	Use:   "rules",
+	Short: "Manage and inspect rule set",
+}
+
+var rulesListCmd = &cobra.Command{
+	Use:   "list",
+	Short: "List all built-in rules",
+	RunE: func(cmd *cobra.Command, args []string) error {
+		rs := builtin.All()
+		sort.Slice(rs, func(i, j int) bool { return rs[i].ID() < rs[j].ID() })
+		for _, r := range rs {
+			fmt.Printf("%s [%s] %s\n", r.ID(), r.Severity().String(), r.Title())
+		}
+		return nil
+	},
+}
+
+func init() {
+	rulesCmd.AddCommand(rulesListCmd)
+}

internal/helm/template.go

@@ -6,24 +6,45 @@ import (
 	"os/exec"
 )
 
-func Template(chartPath string, values []string) ([]byte, error) {
-	args := []string{"template", "release", chartPath}
+type TemplateParams struct {
+	ChartPath string
+	Release   string
+	Namespace string
+	Values    []string
+	Set       []string
+}
 
-	for _, v := range values {
-		args = append(args, "-f", v)
+func Template(p TemplateParams) ([]byte, error) {
+	if p.Release == "" {
+		p.Release = "release"
+	}
+
+	args := []string{"template", p.Release, p.ChartPath}
+
+	if p.Namespace != "" {
+		args = append(args, "--namespace", p.Namespace)
+	}
+
+	for _, vf := range p.Values {
+		args = append(args, "-f", vf)
+	}
+
+	for _, s := range p.Set {
+		args = append(args, "--set", s)
 	}
 
 	cmd := exec.Command("helm", args...)
 
 	var out bytes.Buffer
-	var stderr bytes.Buffer
-
+	var errBuf bytes.Buffer
 	cmd.Stdout = &out
-	cmd.Stderr = &stderr
+	cmd.Stderr = &errBuf
 
-	err := cmd.Run()
-	if err != nil {
-		return nil, fmt.Errorf("helm template failed: %s", stderr.String())
+	if err := cmd.Run(); err != nil {
+		if errBuf.Len() > 0 {
+			return nil, fmt.Errorf("helm template failed: %s", errBuf.String())
+		}
+		return nil, fmt.Errorf("helm template failed: %w", err)
 	}
 
 	return out.Bytes(), nil

internal/kube/parse.go

@@ -2,29 +2,38 @@ package kube
 
 import (
 	"bytes"
+	"io"
 
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/util/yaml"
 )
 
-func ParseManifests(data []byte) ([]unstructured.Unstructured, error) {
-	decoder := yaml.NewYAMLOrJSONDecoder(bytes.NewReader(data), 4096)
+func ParseManifests(rendered []byte) ([]unstructured.Unstructured, error) {
+	dec := yaml.NewYAMLOrJSONDecoder(bytes.NewReader(rendered), 4096)
 
-	var objects []unstructured.Unstructured
+	var objs []unstructured.Unstructured
 
 	for {
-		var obj unstructured.Unstructured
-		err := decoder.Decode(&obj)
-		if err != nil {
+		var u unstructured.Unstructured
+		err := dec.Decode(&u)
+		if err == io.EOF {
 			break
 		}
+		if err != nil {
+			return nil, err
+		}
 
-		if obj.Object == nil {
+		// skip empty docs
+		if u.Object == nil || len(u.Object) == 0 {
+			continue
+		}
+		// some docs may still lack kind/apiVersion; skip them
+		if u.GetKind() == "" {
 			continue
 		}
 
-		objects = append(objects, obj)
+		objs = append(objs, u)
 	}
 
-	return objects, nil
+	return objs, nil
 }