@leverege/build-tools 2.66.5 → 2.66.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leverege/build-tools",
-  "version": "2.66.5",
+  "version": "2.66.7",
   "description": "A collection of build / support tools for Leverege developers",
   "main": "index.js",
   "repository": {
@@ -34,6 +34,7 @@
     "getfbcfg": "src/getfbcfg.mjs",
     "getjson": "src/getjson.mjs",
     "git-tar": "src/git-tar.sh",
+    "helm-audit": "src/helm-audit.mjs",
     "helmcycle": "src/helmup.sh",
     "helmdn": "src/helmdn.sh",
     "helmup": "src/helmup.sh",
@@ -68,7 +69,7 @@
     "commander": "^13.1.0",
     "deepmerge": "^4.3.1",
     "enquirer": "^2.4.1",
-    "execa": "^9.5.2",
+    "execa": "^9.5.3",
     "glob": "^11.0.2",
     "handlebars": "^4.7.8",
     "ignore": "^7.0.4",
@@ -78,12 +79,14 @@
     "ms": "^2.1.3",
     "npm-registry-fetch": "^18.0.2",
     "ora": "^8.2.0",
+    "p-limit": "^6.2.0",
     "package-up": "^5.0.0",
     "readline-sync": "^1.4.10",
     "semver": "^7.7.1",
+    "shell-quote": "^1.8.2",
     "simple-git": "^3.27.0",
     "toml": "^3.0.0",
-    "zx": "^8.5.3"
+    "zx": "^8.5.4"
   },
   "devDependencies": {
     "@leverege/eslint-config-leverege": "^5.0.1",

package/src/Docker.mjs

@@ -215,6 +215,8 @@ const buildContainerImage = async ( {
 
   const { fullName : builderName } = await getGcpAccount()
   const gcloudBuild = `gcloud builds submit --project ${artifactProject}`
+  const gcloudProjectNumber = await shellCmd( `gcloud projects describe ${artifactProject} --format="value(projectNumber)"` )
+  const cloudBuildSA = `--service-account=${gcloudProjectNumber}-compute@cloudbuild.gserviceaccount.com`
   const gcloudLogs = `--gcs-log-dir ${formCloudBuildBucketName( artifactProject )}/log`
   let gcloudTags = `--tag ${imageName}:${imageVersion}`
   
@@ -231,7 +233,8 @@ const buildContainerImage = async ( {
   *** Submitting Build as ${builderName} ***
       ${gcloudBuild} \\
            ${gcloudLogs}  \\
-           ${gcloudTags}
+           ${gcloudTags} \\
+           ${cloudBuildSA}
   ` ) )
 
   if ( process.env.DRY_RUN === '1' ) {

package/src/DockerPy.mjs

@@ -185,6 +185,8 @@ async function buildContainerImage( {
 
   const { fullName : builderName } = await getGcpAccount()
   const gcloudBuild = `gcloud builds submit --project ${artifactProject}`
+  const gcloudProjectNumber = await shellCmd( `gcloud projects describe ${artifactProject} --format="value(projectNumber)"` )
+  const cloudBuildSA = `--service-account=${gcloudProjectNumber}-compute@cloudbuild.gserviceaccount.com`
   const gcloudLogs = `--gcs-log-dir ${formCloudBuildBucketName( artifactProject )}/log`
   let gcloudTags = `--tag ${imageName}:${imageVersion}`
   
@@ -201,7 +203,8 @@ async function buildContainerImage( {
   *** Submitting Build as ${builderName} ***
       ${gcloudBuild} \\
            ${gcloudLogs}  \\
-           ${gcloudTags}
+           ${gcloudTags} \\
+           ${cloudBuildSA}
   ` ) )
 
   if ( process.env.DRY_RUN === '1' ) {

package/src/Utils.mjs

@@ -8,6 +8,7 @@ import ignore from 'ignore'
 import inquirer from 'inquirer'
 import { glob } from 'glob'
 import { packageUp } from 'package-up'
+import { parse } from 'shell-quote'
 import YAML from 'js-yaml'
 
 // __dirname goes away with ESM so we take this approach instead and
@@ -72,20 +73,25 @@ export const proceed = async ( query = 'Do you wish to proceed?' ) => {
   } )
 }
 
-export const shellCmd = async ( cmdstr, opts = {} ) => {
+export const shellCmd = async ( cmd, opts = {} ) => {
   try {
-    // due to the escaping rules we pull apart the cmdstr and invoke $ using
-    // the (command, argsArray) or the escaped command sent to spawn will have
-    // addition double quotes which causes fail
-    const [ command, ...args ] = cmdstr.split( ' ' )
+    let command, args
+
+    if ( Array.isArray( cmd ) ) {
+      [ command, ...args ] = cmd
+    } else {
+      const parsed = parse( cmd ).filter( x => typeof x === 'string' )
+      // the leading ; forces a break from previous line otherwise trailing ) and leading [ collide
+      ;[ command, ...args ] = parsed // eslint-disable-line semi-style
+    }
 
-    debug( { command, args }, '<==execa $ invoke' )
-    const results = await $( opts )`${command} ${args}`
-    debug( { results }, '<==execa $ results' )
+    debug( { command, args }, '<== execa $ invoke' )
+    const results = await $( opts )( command, args )
+    debug( { results }, '<== execa $ results' )
 
     return results.stdout
   } catch ( error ) {
-    debug( { error }, '<==shellCmd' )
+    debug( { error }, '<== shellCmd' )
     throw error
   }
 }

package/src/helm-audit.mjs

@@ -1,71 +1,71 @@
 #!/usr/bin/env node
 
 // helm-audit.mjs
-// Node.js version of helm-audit.sh to display deployed chart/image/audit info
+// kind of a better "helm list" but still experimental
 
-import { shellCmd, log, debug } from './Utils.mjs'
 import ora from 'ora'
 import pLimit from 'p-limit'
 import chalk from 'chalk'
+import { shellCmd, log, errorExit } from './Utils.mjs'
 
-const spinner = ora('Gathering Helm release info...').start()
-const limit = pLimit(5) // limit concurrent shellCmds to avoid API overload
-const OMIT_NAMESPACES = new Set(['estafette'])
+const spinner = ora( 'Gathering Helm release info...' ).start()
+const limit = pLimit( 5 ) // limit concurrent shellCmds to avoid API overload
+const OMIT_NAMESPACES = new Set( [ 'estafette' ] )
 
 async function getHelmReleases() {
-  const json = await shellCmd('helm list -A -o json')
-  return JSON.parse(json).filter(r => !OMIT_NAMESPACES.has(r.namespace))
+  const json = await shellCmd( 'helm list -A -o json' )
+  return JSON.parse( json ).filter( r => !OMIT_NAMESPACES.has( r.namespace ) )
 }
 
-async function getDeployedImageTag(ns, release) {
+async function getDeployedImageTag( ns, release ) {
   try {
-    const image = await shellCmd(`kubectl get deployment -n ${ns} -l app.kubernetes.io/instance=${release} -o jsonpath={.items[0].spec.template.spec.containers[0].image}`)
-    const tag = image.trim().split(':')[1]
+    const image = await shellCmd( `kubectl get deployment -n ${ns} -l app.kubernetes.io/instance=${release} -o jsonpath={.items[0].spec.template.spec.containers[0].image}` )
+    const tag = image.trim().split( ':' )[1]
     return tag && tag !== 'not found' ? tag : ''
   } catch {
     return ''
   }
 }
 
-async function getChartAppVersion(ns, release) {
+async function getChartAppVersion( ns, release ) {
   try {
-    const metadata = await shellCmd(`helm get metadata ${release} -n ${ns}`)
-    const match = metadata.match(/^APP_VERSION:\s*(.*?)\s*$/m)
+    const metadata = await shellCmd( `helm get metadata ${release} -n ${ns}` )
+    const match = metadata.match( /^APP_VERSION:\s*(.*?)\s*$/m )
     return match ? match[1].trim() : '(unknown)'
   } catch {
     return '(unknown)'
   }
 }
 
-async function getHelmValue(ns, release, key) {
+async function getHelmValue( ns, release, key ) {
   try {
-    const values = await shellCmd(`helm get values ${release} -n ${ns} -o json`)
-    const parsed = JSON.parse(values)
+    const values = await shellCmd( `helm get values ${release} -n ${ns} -o json` )
+    const parsed = JSON.parse( values )
     return parsed.helmup?.[key] || ''
   } catch {
     return ''
   }
 }
 
-function normalizeTag(tag) {
-  return tag?.replace(/^v/, '').toLowerCase() || ''
+function normalizeTag( tag ) {
+  return tag?.replace( /^v/, '' ).toLowerCase() || ''
 }
 
-function formatRow(name, chartVersion, appVersion, imageTag, deployT, culprit) {
-  const release = chalk.green(name.slice(0, 25).padEnd(32))
-  const chartVer = chalk.cyan(chartVersion.padEnd(18))
-  const appVer = chalk.cyan(appVersion.padEnd(18))
-  const normApp = normalizeTag(appVersion)
-  const normImage = normalizeTag(imageTag)
-
-  let imageFormatted = imageTag.padEnd(20)
-  if (normImage && normApp && normImage === normApp) {
-    imageFormatted = chalk.green(imageFormatted)
-  } else if (imageTag) {
-    imageFormatted = chalk.red(imageFormatted)
+function formatRow( name, chartVersion, appVersion, imageTag, deployT, culprit ) {
+  const release = chalk.green( name.slice( 0, 25 ).padEnd( 32 ) )
+  const chartVer = chalk.cyan( chartVersion.padEnd( 18 ) )
+  const appVer = chalk.cyan( appVersion.padEnd( 18 ) )
+  const normApp = normalizeTag( appVersion )
+  const normImage = normalizeTag( imageTag )
+
+  let imageFormatted = imageTag.padEnd( 20 )
+  if ( normImage && normApp && normImage === normApp ) {
+    imageFormatted = chalk.green( imageFormatted )
+  } else if ( imageTag ) {
+    imageFormatted = chalk.red( imageFormatted )
   }
 
-  const deployInfo = deployT ? chalk.gray(`${deployT} by ${culprit || '(unknown)'}`) : ''
+  const deployInfo = deployT ? chalk.gray( `${deployT} by ${culprit || '(unknown)'}` ) : ''
   return `  ${release}${chartVer}${appVer}${imageFormatted}${deployInfo}`
 }
 
@@ -74,43 +74,42 @@ async function audit() {
   const releases = await getHelmReleases()
 
   // sort by namespace, then release name
-  releases.sort((a, b) => {
-    const nsCompare = a.namespace.localeCompare(b.namespace)
-    return nsCompare !== 0 ? nsCompare : a.name.localeCompare(b.name)
-  })
+  releases.sort( ( a, b ) => {
+    const nsCompare = a.namespace.localeCompare( b.namespace )
+    return nsCompare !== 0 ? nsCompare : a.name.localeCompare( b.name )
+  } )
 
   spinner.text = 'Gathering chart, image, and audit metadata...'
 
-  const rows = await Promise.all(releases.map(({ name, namespace, chart }) => limit(async () => {
-    const chartVersion = chart?.split('-').pop() || '(unknown)'
-    const [appVersion, imageTag, deployT, culprit] = await Promise.all([
-      getChartAppVersion(namespace, name),
-      getDeployedImageTag(namespace, name),
-      getHelmValue(namespace, name, 'deployT'),
-      getHelmValue(namespace, name, 'culprit'),
-    ])
+  const rows = await Promise.all( releases.map( ( { name, namespace, chart } ) => limit( async () => {
+    const chartVersion = chart?.split( '-' ).pop() || '(unknown)'
+    const [ appVersion, imageTag, deployT, culprit ] = await Promise.all( [
+      getChartAppVersion( namespace, name ),
+      getDeployedImageTag( namespace, name ),
+      getHelmValue( namespace, name, 'deployT' ),
+      getHelmValue( namespace, name, 'culprit' ),
+    ] )
     return {
-      row: formatRow(name, chartVersion, appVersion, imageTag, deployT, culprit),
+      row : formatRow( name, chartVersion, appVersion, imageTag, deployT, culprit ),
       namespace
     }
-  })))
+  } ) ) )
 
   spinner.stop()
-  log(`${'RELEASE'.padEnd(34)}${'CHART VERSION'.padEnd(18)}${'APP VERSION'.padEnd(18)}${'IMAGE TAG'.padEnd(20)}DEPLOY INFO`)
+  log( `${'RELEASE'.padEnd( 34 )}${'CHART VERSION'.padEnd( 18 )}${'APP VERSION'.padEnd( 18 )}${'IMAGE TAG'.padEnd( 20 )}DEPLOY INFO` )
 
   let lastNamespace = ''
-  for (const { row, namespace } of rows) {
-    if (namespace !== lastNamespace) {
-      if (lastNamespace !== '') log('')
-      log(chalk.bold.green(namespace))
+  for ( const { row, namespace } of rows ) {
+    if ( namespace !== lastNamespace ) {
+      if ( lastNamespace !== '' ) log( '' )
+      log( chalk.bold.green( namespace ) )
       lastNamespace = namespace
     }
-    log(row)
+    log( row )
   }
 }
 
-audit().catch(err => {
+audit().catch( ( err ) => {
   spinner.stop()
-  console.error(err)
-  process.exit(1)
-})
+  errorExit( err )
+} )

package/src/helm-charts/prom-operator/rules/kubestate-rules.yaml

@@ -176,7 +176,7 @@ spec:
 #               LABELS = {{ $labels }}
         - alert: KubernetesHpaMetricsUnavailability
           expr: kube_horizontalpodautoscaler_status_condition{status="false", condition="ScalingActive"} == 1
-          for: 0m
+          for: 3m # awesome was => 0m
           labels:
             severity: warning
           annotations:

package/src/helm-charts/prom-operator/rules/prometheus-rules.yaml

@@ -32,7 +32,7 @@ spec:
                 LABELS = {{ $labels }}
         - alert: PrometheusAllTargetsMissing
           expr: sum by (job) (up) == 0
-          for: 0m
+          for: 3m # awesome was => 0m
           labels:
             severity: critical
           annotations: