HYPERFLEET-1218 - chore: remove helm-git plugin dependency #81
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -27,15 +27,16 @@ Two message broker backends are supported: | |
|
|
||
| ### All environments | ||
|
|
||
| - `helm` + [`helm-diff` plugin](https://github.com/databus23/helm-diff) | ||
| - `helmfile` | ||
| - `kubectl` with a configured context | ||
|
|
||
| ```bash | ||
| helm plugin install https://github.com/databus23/helm-diff --verify=false | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- repository status ---'
git status --short
printf '%s\n' '--- relevant file excerpts ---'
sed -n '25,45p' README.md
sed -n '115,160p' AGENTS.md
printf '%s\n' '--- plugin and Helm references ---'
rg -n -C 3 'helm plugin install|helm-git|helm-diff|verify=false' README.md AGENTS.md Makefile CONTRIBUTING.md .github 2>/dev/null || true
printf '%s\n' '--- recent change summary ---'
git diff --stat
git diff -- README.md AGENTS.md Makefile CONTRIBUTING.mdRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 5026 🌐 Web query:
💡 Result: Helm provides built-in mechanisms for plugin security, version management, and verification. Plugin Installation and --verify=false By default, the helm plugin install command automatically verifies plugin signatures when installing from tarballs (.tgz or.tar.gz) [1][2]. For this verification to succeed, a corresponding.prov file must be present alongside the tarball [1][3]. If the file is missing or invalid, installation will fail [1][4]. The --verify=false flag allows users to explicitly skip this signature verification, though its use is strongly discouraged for security reasons [1][3]. Note that plugins installed from local directories for development are automatically treated as local and do not require signatures [1][3]. Plugin Provenance and Checksum Verification Helm's provenance verification ensures the integrity and authenticity of plugins [5]. When signature verification is enabled (the default), Helm verifies the plugin's provenance file against the tarball [6]. This process cryptographically confirms the source and creator of the plugin, protecting against spoofing and network attacks [5]. Internally, verification involves checking the SHA256 hash of the tarball data [7]. If a plugin source does not support verification (such as certain non-tarball installations), Helm will return an error unless --verify=false is used [3][6]. Users can also manually verify already-installed plugins using the helm plugin verify command [5]. Plugin Version Pinning Helm supports version pinning for plugins installed from Version Control Systems (VCS) via the --version flag in both the install and update commands [1][8][9]. - Installation: You can specify a version constraint during initial installation with helm plugin install --version [1][8]. - Updating: The helm plugin update command also supports the --version flag to constrain the version when upgrading an existing plugin [9][10]. There is currently no native mechanism in Helm to enforce plugin version locking within a Chart.yaml file, though this has been discussed by the community as a potential future feature [11]. Citations:
🏁 Script executed (no clone): Length of output: 639 🌐 Web query:
💡 Result: The command helm plugin install [URL] --version [VERSION] --verify=false is a valid Helm CLI command, provided the syntax and flags are used correctly [1][2]. Breakdown of the command components: helm plugin install: The base command used to install a Helm plugin from a URL (e.g., a Git repository) or a local path [1][2]. [URL]: The location of the plugin repository (e.g., a GitHub URL) [1][2]. --version [VERSION]: An optional flag used to specify a version constraint (e.g., a Git tag or branch). If omitted, Helm installs the latest version by default [1][2]. --verify=false: An optional flag used to explicitly skip the verification of the plugin signature [1][2]. While Helm defaults to verifying signatures for tarball-based installations, using this flag will bypass that check [1][2]. Note that signature verification is typically applicable to tarballs (.tgz or.tar.gz); plugins installed from local directories are already treated as local development and do not require signatures [1][2]. For more information, you can view the official Helm documentation for the install command by running helm plugin install --help in your terminal or visiting the official documentation website [1][2]. Citations: 🏁 Script executed (no clone): Length of output: 9040 🏁 Script executed (no clone): Length of output: 11828 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- supported Helm versions and plugin installation ---'
rg -n -i -C 3 'helm[ :].*(version|v[0-9])|helm 4|helm 3|helm plugin install|helm-diff|helm-git' \
.tool-versions README.md AGENTS.md Makefile CONTRIBUTING.md 2>/dev/null || true
printf '%s\n' '--- exact check-helmfile context ---'
sed -n '340,360p' MakefileRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 3903 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- supply-chain and security review standards ---'
rg -n -i -C 3 'supply chain|dependency|plugin|untrusted|provenance|checksum|CWE-494|verification' \
hyperfleet/standards hyperfleet/components 2>/dev/null || trueRepository: openshift-hyperfleet/architecture Length of output: 50391 Pin and verify Helm plugin installations.
📍 Affects 2 files
🤖 Prompt for AI Agents |
||
| ``` | ||
|
|
||
| **Note**: [`helm-git` plugin](https://github.com/aslafy-z/helm-git) only needed for Maestro external dependency (dev-only). HyperFleet charts consumed via OCI. | ||
|
|
||
| ### GCP only | ||
|
|
||
| - `terraform 1.13.1` (pinned via `.tool-versions`; use [asdf](https://asdf-vm.com/)) | ||
|
|
@@ -176,10 +177,6 @@ Set `TRACING_ENABLED=true` and `OBSERVABILITY_ENABLED=true`. | |
| | `SENTINEL_IMAGE_TAG` | `dev` | `local` | | | ||
| | `ADAPTER_IMAGE_TAG` | `dev` | `local` | | | ||
| | `IMAGE_PULL_POLICY` | `Always` | `IfNotPresent` | | | ||
| | `TF_ENV` | `dev` | N/A | Selects `envs/gke/<TF_ENV>.tfvars` | | ||
| | `RABBITMQ_URL` | N/A | `amqp://guest:guest@rabbitmq:5672` | | | ||
| | `MAESTRO_CONSUMER` | `cluster1` | `cluster1` | | | ||
|
|
@@ -264,7 +261,7 @@ hyperfleet-infra/ | |
| │ │ └── e2e/adapters/ # E2E adapter configs | ||
| │ └── values/ # Helm value templates (.gotmpl) | ||
| ├── helm/ | ||
| │ ├── maestro/ # Maestro umbrella chart (external dependency) | ||
| │ └── rabbitmq/ # Dev-only RabbitMQ (not production-ready) | ||
| ├── scripts/ | ||
| │ ├── add-ttl-labels.sh # Adds TTL labels to existing GKE clusters | ||
|
|
||
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -58,11 +58,11 @@ commonLabels: | |
|
|
||
| repositories: | ||
| - name: hyperfleet-api | ||
| url: oci://quay.io/redhat-services-prod/hyperfleet-tenant/hyperfleet-api-chart | ||
| - name: hyperfleet-sentinel | ||
| url: oci://quay.io/redhat-services-prod/hyperfleet-tenant/hyperfleet-sentinel-chart | ||
| - name: hyperfleet-adapter | ||
| url: oci://quay.io/redhat-services-prod/hyperfleet-tenant/hyperfleet-adapter-chart | ||
|
Comment on lines
+61
to
+65
There was a problem hiding this comment. 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: printf '%s\n' '--- helmfile context ---'
sed -n '1,120p' helmfile/helmfile.yaml.gotmpl
printf '%s\n' '--- Helmfile version and related configuration ---'
rg -n --hidden -g '!vendor' -g '!node_modules' 'helmfile|oci:|repositories:|hyperfleet-(api|sentinel|adapter)' . | head -250
printf '%s\n' '--- tracked files ---'
git ls-files | rg '(^|/)(helmfile|Makefile|README|.*ya?ml|.*toml|.*json)' | head -250Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 18662 🌐 Web query:
💡 Result: To configure an OCI repository in Helmfile, you must set the oci attribute to true for the specific repository entry [1][2]. When configuring the url for an OCI registry, you must provide only the registry host (optionally including the port) and omit any scheme (such as https:// or oci://) or path [1][3]. Configuration requirements summary: - oci: Set this to true to enable OCI integration for the repository [1][4]. - url: Specify only the hostname or host:port [1]. Schemes like https:// or oci:// are not allowed in the repository url field [1][3]. - Authentication: You can use username/password fields, which support environment variable lookups (e.g., _USERNAME) [1][2], or use the registryConfig attribute to specify a docker_config.json file [5]. - Troubleshooting: If your registry requires plain HTTP, you can use the plainHttp: true configuration option in your repository definition [4]. Example configuration: repositories: - name: my-oci-registry url: myregistry.example.com:5000 oci: true For chart references in your releases, you may use the oci:// scheme to specify the full path (e.g., oci://myregistry.example.com:5000/my-repo/my-chart) [1][6]. Citations:
🏁 Script executed: printf '%s\n' '--- OCI migration and published chart paths ---'
rg -n -A8 -B8 'hyperfleet-(api|sentinel|adapter)-chart|helm-git|OCI|oci://' hyperfleet/standards hyperfleet/components hyperfleet/docs | head -300Repository: openshift-hyperfleet/architecture Length of output: 34062 🏁 Script executed: printf '%s\n' '--- repository/chart references and OCI examples ---'
sed -n '1,80p' helmfile/observability.yaml.gotmpl
sed -n '145,180p' AGENTS.md
sed -n '255,275p' CONTRIBUTING.md
rg -n -A3 -B3 'API_CHART_VERSION|SENTINEL_CHART_VERSION|ADAPTER_CHART_VERSION|chartRef|CHART_ORG|CHART_REF' .Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 7054 🌐 Web query:
💡 Result: In Helmfile, setting oci: true in a repository definition is required to explicitly identify that repository as an OCI-compliant registry [1]. Without this setting, Helmfile will attempt to treat the repository as a classic Helm chart repository, which will cause it to fail when interacting with an OCI registry [1]. When configuring an OCI repository in Helmfile, follow these requirements: 1. Repository URL: The url field should contain only the registry host (e.g., myregistry.azurecr.io) without any scheme prefix like https:// or oci:// [1]. 2. Chart References: While the repository definition itself must include oci: true, the actual chart references in your releases should use the oci:// scheme (e.g., oci://myregistry.azurecr.io/helm-repo/my-chart) [1]. 3. Authentication: Credentials can be defined directly in the repository block using username and password, or handled via environment variables [1]. If using environment variables, the naming convention follows the repository name (e.g., a repository named my-oci-registry uses MY_OCI_REGISTRY_USERNAME and MY_OCI_REGISTRY_PASSWORD) [1]. If you encounter authentication errors (such as 401 or 403), verify that oci: true is set correctly and test the connection using the helm CLI directly, as Helmfile delegates these operations to Helm [1]. Citations: 🏁 Script executed (no clone): Length of output: 11742 🏁 Script executed: python3 - <<'PY'
from pathlib import Path
import re
text = Path("helmfile/helmfile.yaml.gotmpl").read_text()
repo_block = text.split("repositories:", 1)[1].split("releases:", 1)[0]
release_charts = re.findall(r'^\s+chart:\s+([^\s]+)', text, re.M)
print("repository entries:")
print(repo_block.strip())
print("release chart references:", release_charts)
print("all OCI repository URLs:", re.findall(r'url:\s*(oci://\S+)', repo_block))
print("all entries with oci: true:", repo_block.count("oci: true"))
PYRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 1013 🌐 Web query:
💡 Result: In Helmfile, setting Citations:
🏁 Script executed (no clone): Length of output: 174 Configure the OCI repositories with the correct Quay chart path. Set each 🤖 Prompt for AI AgentsSources: Path instructions, MCP tools, Linked repositories |
||
|
|
||
| releases: | ||
| {{ if eq .Values.brokerType "rabbitmq" }} | ||
|
|
@@ -76,7 +76,7 @@ releases: | |
| # HyperFleet API | ||
| - name: hyperfleet-api | ||
| namespace: {{ .Values.namespace }} | ||
| chart: hyperfleet-api/hyperfleet-api-chart | ||
|
There was a problem hiding this comment. 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- helmfile excerpt ---'
nl -ba helmfile/helmfile.yaml.gotmpl | sed -n '1,125p'
printf '%s\n' '--- chart/version references ---'
rg -n --glob '!vendor/**' --glob '!node_modules/**' 'chartRef|charts\.(api|sentinel|adapter)|version:|hyperfleet-(api|sentinel|adapter)-chart|oci:' helmfile Makefile .github 2>/dev/null || true
printf '%s\n' '--- tracked helmfile-related files ---'
git ls-files | rg '(^|/)(helmfile|helm|Chart\.yaml|values).*'Repository: openshift-hyperfleet/hyperfleet-infra Length of output: 6843 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- helmfile template ---'
sed -n '1,125p' helmfile/helmfile.yaml.gotmpl
printf '%s\n' '--- chartRef consumers and chart values ---'
rg -n -C 4 'chartRef|API_CHART_REF|SENTINEL_CHART_REF|ADAPTER_CHART_REF|charts:' helmfile . --glob '!vendor/**' --glob '!node_modules/**' --glob '!*.lock' 2>/dev/null || true
printf '%s\n' '--- repository history summary for the template ---'
git log --oneline -8 -- helmfile/helmfile.yaml.gotmplRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 6880 🏁 Script executed: #!/bin/bash
set -eu
printf '%s\n' '--- deployment targets and environment loading ---'
rg -n -C 5 'helmfile|API_CHART_REF|SENTINEL_CHART_REF|ADAPTER_CHART_REF|env\.(kind|gcp)' Makefile '*.mk' scripts .github 2>/dev/null || true
printf '%s\n' '--- chart-related documentation and configuration ---'
rg -n -C 4 'chartRef|chart version|OCI|hyperfleet-(api|sentinel|adapter)-chart|API_CHART_REF|SENTINEL_CHART_REF|ADAPTER_CHART_REF' . --glob '!vendor/**' --glob '!node_modules/**' --glob '!*.lock' 2>/dev/null || true
printf '%s\n' '--- release blocks without executing repository code ---'
python3 - <<'PY'
from pathlib import Path
import re
p = Path("helmfile/helmfile.yaml.gotmpl").read_text()
for m in re.finditer(r'(?ms)^ - name: ([^\n]+).*?(?=^ - name: |\Z)', p):
block = m.group(0)
name = m.group(1)
chart = re.search(r'(?m)^\s+chart:\s*(.+)$', block)
version = re.search(r'(?m)^\s+version:\s*(.+)$', block)
print(f"{name}: chart={chart.group(1) if chart else None}; version={version.group(1) if version else None}")
print("release version fields:", len(re.findall(r'(?m)^\s+version:', p)))
print("chartRef interpolations:", len(re.findall(r'\.Values\.charts\.[A-Za-z0-9_]+\.chartRef', p)))
PYRepository: openshift-hyperfleet/hyperfleet-infra Length of output: 20151 🏁 Script executed on selected repositories: Repositories: openshift-hyperfleet/hyperfleet-infra, openshift-hyperfleet/architecture Length of output: 2612 Pin the OCI chart version for all HyperFleet releases.
🤖 Prompt for AI AgentsSources: Path instructions, MCP tools, Linked repositories |
||
| labels: | ||
| component: api | ||
| values: | ||
|
|
@@ -85,7 +85,7 @@ releases: | |
| {{ range .Values.sentinels }} | ||
| - name: {{ .name }} | ||
| namespace: {{ $.Values.namespace }} | ||
| chart: hyperfleet-sentinel/hyperfleet-sentinel-chart | ||
| needs: | ||
| - hyperfleet-api | ||
| labels: | ||
|
|
@@ -104,7 +104,7 @@ releases: | |
| {{ range .Values.adapters }} | ||
| - name: {{ .name }} | ||
| namespace: {{ $.Values.namespace }} | ||
| chart: hyperfleet-adapter/hyperfleet-adapter-chart | ||
| labels: | ||
| component: adapter | ||
| values: | ||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-infra
Length of output: 11949
🏁 Script executed:
Repository: openshift-hyperfleet/hyperfleet-infra
Length of output: 50395
Use a pinned and integrity-verified
helm-gitinstallation procedure.The unpinned GitHub URL can install arbitrary plugin code if the repository is compromised (CWE-494). Replace it with repository-controlled instructions that pin an immutable revision and verify its checksum or signature before installation.
🤖 Prompt for AI Agents
Sources: Coding guidelines, Path instructions