|
| 1 | +#!/usr/bin/env bash |
| 2 | +# Run crdify on copies of CRDs after stripping out known false positives. |
| 3 | +# Usage: |
| 4 | +# crdify.sh <old-crd> <new-crd> [crdify flags] |
| 5 | + |
| 6 | +set -euo pipefail |
| 7 | + |
| 8 | +ROOT_DIR="$(dirname "${BASH_SOURCE[0]}")/../../.." |
| 9 | +readonly ROOT_DIR |
| 10 | + |
| 11 | +if [[ $# -lt 2 ]]; then |
| 12 | + echo "usage: $0 <old-crd> <new-crd> [crdify flags]" >&2 |
| 13 | + exit 2 |
| 14 | +fi |
| 15 | + |
| 16 | +old_crd="${1:?missing required argument 'old-crd'}" |
| 17 | +new_crd="${2:?missing required argument 'new-crd'}" |
| 18 | +shift |
| 19 | +shift |
| 20 | + |
| 21 | +if [[ ! -f "$old_crd" ]]; then |
| 22 | + echo "::error::CRD file not found: $old_crd" >&2 |
| 23 | + exit 1 |
| 24 | +fi |
| 25 | + |
| 26 | +if [[ ! -f "$new_crd" ]]; then |
| 27 | + echo "::error::CRD file not found: $new_crd" >&2 |
| 28 | + exit 1 |
| 29 | +fi |
| 30 | + |
| 31 | + |
| 32 | +# The addition of this particular validation rule, even though considered a breaking change by definition |
| 33 | +# (https://github.com/kubernetes/community/blob/main/contributors/devel/sig-architecture/api_changes.md#backward-compatibility-gotchas) |
| 34 | +# is fine in practice, since the `excludeByKind` branch is being added in the same release cycle as the rule itself, |
| 35 | +# meaning no production CRS could have existed that violated the validation. |
| 36 | +filter_spec_exclusions_one_of() { |
| 37 | + local input="$1" |
| 38 | + local output="$2" |
| 39 | + |
| 40 | + local message='at most one of the fields in [deployment excludeByKind] may be set' |
| 41 | + local rule='(has(self.deployment)?1:0)+(has(self.excludeByKind)?1:0) <= 1' |
| 42 | + |
| 43 | + # Remove matching rule, and the validations list if empty afterwards. |
| 44 | + message="${message}" rule="${rule}" \ |
| 45 | + go run -C "${ROOT_DIR}/operator/tools/yq" github.com/mikefarah/yq/v4 eval ' |
| 46 | + del( |
| 47 | + .spec.versions[].schema.openAPIV3Schema.properties.spec.properties.exclusions.items."x-kubernetes-validations"[] |
| 48 | + | select(.message == strenv(message) and .rule == strenv(rule)) |
| 49 | + ) |
| 50 | + | del( |
| 51 | + .spec.versions[].schema.openAPIV3Schema.properties.spec.properties.exclusions.items."x-kubernetes-validations" |
| 52 | + | select(length == 0) |
| 53 | + ) |
| 54 | + ' "$input" > "$output" |
| 55 | +} |
| 56 | + |
| 57 | + |
| 58 | +crd_basename="$(basename "${old_crd}")" |
| 59 | +case "$crd_basename" in |
| 60 | +config.stackrox.io_securitypolicies.yaml) |
| 61 | + filtered_dir="$(mktemp -d)" |
| 62 | + echo >&2 "Filtering known false positives from ${old_crd} and ${new_crd}" |
| 63 | + filter_spec_exclusions_one_of "${old_crd}" "${filtered_dir}/old-${crd_basename}" |
| 64 | + filter_spec_exclusions_one_of "${new_crd}" "${filtered_dir}/new-${crd_basename}" |
| 65 | + old_crd="${filtered_dir}/old-${crd_basename}" |
| 66 | + new_crd="${filtered_dir}/new-${crd_basename}" |
| 67 | + ;; |
| 68 | +*) |
| 69 | + echo >&2 "No filtering rules for ${old_crd}, running crdify on original CRDs." |
| 70 | + ;; |
| 71 | +esac |
| 72 | + |
| 73 | +set -x |
| 74 | +go run -C "${ROOT_DIR}/operator/tools/crdify" sigs.k8s.io/crdify --config=config.yaml "$@" \ |
| 75 | + "file://${old_crd}" "file://${new_crd}" |
0 commit comments