Add a DryRun CLI

[JustinKuli]

See each commit, or this story: https://issues.redhat.com/browse/ACM-14161

[mprahl]

Not sure if this is useful, but this is how I pull up all nested YAML files from the current directory (could be modified for your case):

func getYAMLFiles() ([]string, error) {
	workingDir, err := os.Getwd()
	if err != nil {
		return nil, err
	}

	yamlFiles := []string{}

	err = filepath.WalkDir(workingDir, func(path string, d fs.DirEntry, err error) error {
		if err != nil {
			return nil
		}

		if d.IsDir() {
			return nil
		}

		fileExt := filepath.Ext(d.Name())
		if fileExt == ".yaml" || fileExt == ".yml" {
			yamlFiles = append(yamlFiles, path)
		}

		return nil
	})
	if err != nil {
		return nil, err
	}

	return yamlFiles, nil
}

[mprahl]

Is this already sorted by timestamp?

[JustinKuli]

I believe the items in the event list are sorted lexically, but since a timestamp is in the name, effectively it is sorted by time.

[mprahl]

@JustinKuli this is how I got the template lookups to work:

diff --git a/cmd/dryrun/dryrun.go b/cmd/dryrun/dryrun.go
index e69978e..20e3723 100644
--- a/cmd/dryrun/dryrun.go
+++ b/cmd/dryrun/dryrun.go
@@ -447,14 +447,15 @@ func (d *DryRunner) setupReconciler(
 			return nil, err
 		}
 
-		rec.RestMapper = mappings.MapperFrom(apiMappings)
+		rec.RestMapper, clientset.Resources = mappings.MapperFrom(apiMappings)
 	} else {
-		mapper, err := mappings.DefaultMapper()
+		mapper, resourceList, err := mappings.DefaultMapper()
 		if err != nil {
 			return nil, err
 		}
 
 		rec.RestMapper = mapper
+		clientset.Resources = resourceList
 	}
 
 	// wait for dynamic watcher to have started
diff --git a/pkg/mappings/mappings.go b/pkg/mappings/mappings.go
index e4ea0f6..088b6a2 100644
--- a/pkg/mappings/mappings.go
+++ b/pkg/mappings/mappings.go
@@ -11,6 +11,7 @@ import (
 
 	"github.com/spf13/cobra"
 	"k8s.io/apimachinery/pkg/api/meta"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
@@ -32,9 +33,11 @@ type APIMapping struct {
 // MapperFrom takes a list of APIMappings and uses them to populate a
 // DefaultRESTMapper which can be used locally without connecting to a Discovery
 // client.
-func MapperFrom(mappings []APIMapping) meta.RESTMapper {
+func MapperFrom(mappings []APIMapping) (meta.RESTMapper, []*metav1.APIResourceList) {
 	mapper := meta.NewDefaultRESTMapper(scheme.Scheme.PreferredVersionAllGroups())
 
+	resourceListMapping := map[schema.GroupVersion][]metav1.APIResource{}
+
 	for _, mapping := range mappings {
 		gv := schema.GroupVersion{
 			Group:   mapping.Group,
@@ -56,9 +59,25 @@ func MapperFrom(mappings []APIMapping) meta.RESTMapper {
 				namespaced,
 			)
 		}
+
+		resourceListMapping[gv] = append(resourceListMapping[gv], metav1.APIResource{
+			Kind:         mapping.Kind,
+			Name:         mapping.Plural,
+			SingularName: mapping.Singular,
+			Namespaced:   mapping.Scope == "Namespaced",
+		})
+	}
+
+	resourceLists := []*metav1.APIResourceList{}
+
+	for gv := range resourceListMapping {
+		resourceLists = append(resourceLists, &metav1.APIResourceList{
+			GroupVersion: gv.String(),
+			APIResources: resourceListMapping[gv],
+		})
 	}
 
-	return mapper
+	return mapper, resourceLists
 }
 
 //go:embed default-mappings.json
@@ -66,14 +85,16 @@ var defaultMappingsJSON []byte
 
 // DefaultMapper returns a RESTMapper initialized on default mappings that were
 // embedded into this package. It should include built-in Kubernetes types.
-func DefaultMapper() (meta.RESTMapper, error) {
+func DefaultMapper() (meta.RESTMapper, []*metav1.APIResourceList, error) {
 	mappings := []APIMapping{}
 
 	if err := json.Unmarshal(defaultMappingsJSON, &mappings); err != nil {
-		return nil, err
+		return nil, nil, err
 	}
 
-	return MapperFrom(mappings), nil
+	mapper, resourceList := MapperFrom(mappings)
+
+	return mapper, resourceList, nil
 }
 
 // GenerateMappings connects to a Kubernetes cluster and discovers the available

[JustinKuli]

@mprahl FYI, GroupsAndMaybeResources includes the subresources, which I was ignoring when parsing /api and /apis "by hand"... I didn't see a better way to determine if something was a subresource, but if I included them in the mappings / resources used by dryrun, tests would fail and it looked like it was incorrectly checking things in subresources (eg a noncompliant message indicated that a "pod/status did not match")

[mprahl]

Not entirely sure if this is the correct fix, but when running it through the debugger where it has no stdin, it would just hang forever for the YAML decoder to get something from stdin.

Suggested change

	if stdinInfo.Mode()&os.ModeCharDevice == 0 {
	if stdinInfo.Mode()&os.ModeCharDevice == 0 && stdinInfo.Size() != 0 {

[JustinKuli]

Interesting, I don't have any issue when I run the cli locally without any stdin, but this change seems reasonable

[JustinKuli]

We'll need to look at this more. With && stdinInfo.Size() != 0, I found that the cli doesn't successfully read inputs from stdin anymore when you run it directly. The tests still pass, I think because I kind of hacked the inputs for the tests...

So based on the test_multiple_resources case:

❯ cat input_stdin.yaml | ./dryrun-original -p policy.yaml input_3.yaml input_4.yaml 
# Diffs:
v1 Pod default/nginx-pod-e2e:

v1 Pod default/nginx-pod-e2e-2:

v1 Pod default/nginx-pod-e2e-3:

v1 Pod default/nginx-pod-e2e-4:

# Compliance messages:
Compliant; notification - pods [nginx-pod-e2e] found as specified in namespace default; notification - pods [nginx-pod-e2e-2] found as specified in namespace default; notification - pods [nginx-pod-e2e-3] found as specified in namespace default; notification - pods [nginx-pod-e2e-4] found as specified in namespace default

❯ cat input_stdin.yaml | ./dryrun-sizene0 -p policy.yaml input_3.yaml input_4.yaml                 
# Diffs:
v1 Pod default/nginx-pod-e2e-3:

v1 Pod default/nginx-pod-e2e-4:

# Compliance messages:
Compliant; notification - pods [nginx-pod-e2e-3] found as specified in namespace default; notification - pods [nginx-pod-e2e-4] found as specified in namespace default

[JustinKuli]

Is there a debugger setting where you can set stdin?

[mprahl]

@JustinKuli I don't know of one but this is the launch.json section that I had with this issue:

        {
            "name": "Launch dryrun",
            "type": "go",
            "request": "launch",
            "mode": "auto",
            "program": "${workspaceFolder}/cmd/main.go",
            "args": [
                "-p",
                "${workspaceFolder}/cmd/dryrun/testdata/test_basic_compliant/policy.yaml",
                "${workspaceFolder}/cmd/dryrun/testdata/test_basic_compliant/input_1.yaml"
            ]
        }

[mprahl]

We can leave that out for now though!

[mprahl]

@JustinKuli could we please remove the RestMapper in the controller? I think this works pretty well:

diff --git a/cmd/dryrun/dryrun.go b/cmd/dryrun/dryrun.go
index 662e716..f93b601 100644
--- a/cmd/dryrun/dryrun.go
+++ b/cmd/dryrun/dryrun.go
@@ -22,7 +22,6 @@ import (
 	yaml "gopkg.in/yaml.v3"
 	corev1 "k8s.io/api/core/v1"
 	extv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
-	"k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/types"
@@ -71,17 +70,17 @@ func (d *DryRunner) dryRun(cmd *cobra.Command, args []string) error {
 	for _, obj := range inputObjects {
 		gvk := obj.GroupVersionKind()
 
-		mapping, err := rec.RestMapper.RESTMapping(gvk.GroupKind(), gvk.Version)
+		scopedGVR, err := rec.DynamicWatcher.GVKToGVR(gvk)
 		if err != nil {
 			return err
 		}
 
 		var resInt dynamic.ResourceInterface
 
-		if mapping.Scope.Name() == meta.RESTScopeNameNamespace {
-			resInt = rec.TargetK8sDynamicClient.Resource(mapping.Resource).Namespace(obj.GetNamespace())
+		if scopedGVR.Namespaced {
+			resInt = rec.TargetK8sDynamicClient.Resource(scopedGVR.GroupVersionResource).Namespace(obj.GetNamespace())
 		} else {
-			resInt = rec.TargetK8sDynamicClient.Resource(mapping.Resource)
+			resInt = rec.TargetK8sDynamicClient.Resource(scopedGVR.GroupVersionResource)
 		}
 
 		if _, err := resInt.Create(ctx, obj, metav1.CreateOptions{}); err != nil {
@@ -247,7 +246,7 @@ func (d *DryRunner) readInputResources(cmd *cobra.Command, args []string) (
 
 	filepaths := []string{}
 
-	if stdinInfo.Mode()&os.ModeCharDevice == 0 {
+	if stdinInfo.Mode()&os.ModeCharDevice == 0 && stdinInfo.Size() != 0 {
 		filepaths = append(filepaths, "-")
 	}
 
@@ -447,9 +446,9 @@ func (d *DryRunner) setupReconciler(
 			return nil, err
 		}
 
-		rec.RestMapper, clientset.Resources = mappings.MapperFrom(apiMappings)
+		clientset.Resources = mappings.ResourceListFromMapping(apiMappings)
 	} else {
-		rec.RestMapper, clientset.Resources, err = mappings.DefaultMapper()
+		clientset.Resources, err = mappings.DefaultResourceList()
 		if err != nil {
 			return nil, err
 		}
diff --git a/controllers/configurationpolicy_controller.go b/controllers/configurationpolicy_controller.go
index 135fccf..007aafd 100644
--- a/controllers/configurationpolicy_controller.go
+++ b/controllers/configurationpolicy_controller.go
@@ -27,7 +27,6 @@ import (
 	corev1 "k8s.io/api/core/v1"
 	extensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
 	k8serrors "k8s.io/apimachinery/pkg/api/errors"
-	apimachinerymeta "k8s.io/apimachinery/pkg/api/meta"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -203,7 +202,6 @@ type ConfigurationPolicyReconciler struct {
 	// This is a workaround to account for race conditions where the status is updated but the controller-runtime cache
 	// has not updated yet.
 	lastEvaluatedCache sync.Map
-	RestMapper         apimachinerymeta.RESTMapper
 }
 
 //+kubebuilder:rbac:groups=*,resources=*,verbs=*
@@ -1901,16 +1899,6 @@ func (r *ConfigurationPolicyReconciler) getMapping(
 		return depclient.ScopedGVR{}, err
 	}
 
-	if r.RestMapper != nil {
-		mapping, err := r.RestMapper.RESTMapping(gvk.GroupKind(), gvk.Version)
-		if err == nil {
-			return depclient.ScopedGVR{
-				GroupVersionResource: mapping.Resource,
-				Namespaced:           mapping.Scope.Name() == apimachinerymeta.RESTScopeNameNamespace,
-			}, nil
-		}
-	}
-
 	scopedGVR, err := r.DynamicWatcher.GVKToGVR(gvk)
 	if err != nil {
 		if !errors.Is(err, depclient.ErrNoVersionedResource) {
diff --git a/pkg/mappings/mappings.go b/pkg/mappings/mappings.go
index 38fe86c..88998ba 100644
--- a/pkg/mappings/mappings.go
+++ b/pkg/mappings/mappings.go
@@ -13,7 +13,6 @@ import (
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	"k8s.io/client-go/kubernetes"
 	"k8s.io/client-go/tools/clientcmd"
-	"k8s.io/kubectl/pkg/scheme"
 	"sigs.k8s.io/yaml"
 )
 
@@ -32,12 +31,9 @@ func (a APIMapping) String() string {
 	return a.Group + "/" + a.Version + " " + a.Plural
 }
 
-// MapperFrom takes a list of APIMappings and uses them to populate a
-// DefaultRESTMapper which can be used locally without connecting to a Discovery
-// client.
-func MapperFrom(mappings []APIMapping) (meta.RESTMapper, []*metav1.APIResourceList) {
-	mapper := meta.NewDefaultRESTMapper(scheme.Scheme.PreferredVersionAllGroups())
-
+// ResourceListFromMapping takes a list of APIMappings and uses them to populate an
+// APIResourceList which can be used to populate the fake discovery client.
+func ResourceListFromMapping(mappings []APIMapping) []*metav1.APIResourceList {
 	resourceListMapping := map[schema.GroupVersion][]metav1.APIResource{}
 
 	for _, mapping := range mappings {
@@ -46,13 +42,6 @@ func MapperFrom(mappings []APIMapping) (meta.RESTMapper, []*metav1.APIResourceLi
 			Version: mapping.Version,
 		}
 
-		mapper.AddSpecific(
-			gv.WithKind(mapping.Kind),
-			gv.WithResource(mapping.Plural),
-			gv.WithResource(mapping.Singular),
-			mapping.Scope,
-		)
-
 		resourceListMapping[gv] = append(resourceListMapping[gv], metav1.APIResource{
 			Kind:         mapping.Kind,
 			Name:         mapping.Plural,
@@ -70,24 +59,24 @@ func MapperFrom(mappings []APIMapping) (meta.RESTMapper, []*metav1.APIResourceLi
 		})
 	}
 
-	return mapper, resourceLists
+	return resourceLists
 }
 
 //go:embed default-mappings.yaml
 var defaultMappings []byte
 
-// DefaultMapper returns a RESTMapper initialized on default mappings that were
-// embedded into this package. It should include built-in Kubernetes types.
-func DefaultMapper() (meta.RESTMapper, []*metav1.APIResourceList, error) {
+// ResourceListFromMapping uses the default list of APIMappings and uses them to populate an
+// APIResourceList which can be used to populate the fake discovery client.
+func DefaultResourceList() ([]*metav1.APIResourceList, error) {
 	mappings := []APIMapping{}
 
 	if err := yaml.Unmarshal(defaultMappings, &mappings); err != nil {
-		return nil, nil, err
+		return nil, err
 	}
 
-	mapper, resList := MapperFrom(mappings)
+	resList := ResourceListFromMapping(mappings)
 
-	return mapper, resList, nil
+	return resList, nil
 }
 
 // GenerateMappings connects to a Kubernetes cluster and discovers the available

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: JustinKuli, mprahl

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [JustinKuli,mprahl]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment