Merge pull request #2 from raffis/next

Respect kustomization inventroy and namespace

Author: raffis

.github/workflows/e2e.yaml

@@ -35,9 +35,4 @@ jobs:
             git --no-pager diff
             echo 'run make test and commit changes'
             exit 1
-          fi
-      - name: Setup Kubernetes
-        uses: engineerd/setup-kind@v0.5.0
-        with:
-          version: v0.11.1
-          image: kindest/node:v1.21.1@sha256:69860bda5563ac81e3c0057d654b5253219618a22ec3a346306239bba8cfa1a6
+          fi

.github/workflows/release.yaml

@@ -14,9 +14,6 @@ permissions:
   id-token: write # needed for keyless signing
   packages: write # needed for ghcr access
 
-env:
-  APP: kjournal
-
 jobs:
   build:
     name: Build

README.md

@@ -1,19 +1,25 @@
 # GitOps zombies
 
+![Release](https://img.shields.io/github/v/release/raffis/gitops-zombies)
+[![release](https://github.com/raffis/gitops-zombies/actions/workflows/release.yaml/badge.svg)](https://github.com/raffis/gitops-zombies/actions/workflows/release.yaml)
+[![Go Report Card](https://goreportcard.com/badge/github.com/raffis/gitops-zombies)](https://goreportcard.com/report/github.com/raffis/gitops-zombies)
+[![Coverage Status](https://coveralls.io/repos/github/raffis/gitops-zombies/badge.svg?branch=main)](https://coveralls.io/github/raffis/gitops-zombies?branch=main)
+
 This simple tool will help you find kubernetes resources which are not managed via GitOps (flux2).
 
 <p align="center"><img src="https://github.com/raffis/gitops-zombies/blob/main/assets/logo.png?raw=true" alt="logo"/></p>
 
 ## How does it work?
 
-It will discover all apis installed on a cluster and identify resources which are not part of a Kustomization or a HelmRelease.
-The app will also acknowledge the following things:
+gitops-zombies discovers all apis installed on a cluster and identify resources which are not part of a Kustomization or a HelmRelease.
+It also acknowledges the following facts:
 
 * Ignores resources which are owned by a parent resource (For example pods which are created by a deployment)
 * Ignores resources which are considered dynamic (metrics, leases, events, endpoints, ...)
 * Filter out resources which are created by the apiserver itself (like default rbacs)
 * Filters secrets which are managed by other parties including helm or ServiceAccount tokens
 * Checks if the referenced HelmRelease or Kustomization exists
+* Checks if resources are still part of the kustomization inventory
 
 
 ## How do I install it?

cmd/main.go

@@ -7,15 +7,19 @@ import (
 	"strings"
 	"sync"
 
-	"gihub.com/raffis/flux-zombies/pkg/collector"
+	"gihub.com/raffis/gitops-zombies/pkg/collector"
+	ksapi "github.com/fluxcd/kustomize-controller/api/v1beta2"
 	"github.com/spf13/cobra"
 	"golang.org/x/exp/slices"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
+	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
+	"k8s.io/apimachinery/pkg/runtime/serializer"
 	"k8s.io/cli-runtime/pkg/genericclioptions"
 	"k8s.io/client-go/discovery"
 	"k8s.io/client-go/dynamic"
+	"k8s.io/client-go/rest"
 	k8sget "k8s.io/kubectl/pkg/cmd/get"
 )
 
@@ -84,11 +88,6 @@ func main() {
 	os.Exit(1)
 }
 
-var (
-	helmReleases   []unstructured.Unstructured
-	kustomizations []unstructured.Unstructured
-)
-
 func run(cmd *cobra.Command, args []string) error {
 	if flags.version {
 		fmt.Printf(`{"version":"%s","sha":"%s","date":"%s"}`+"\n", version, commit, date)
@@ -105,6 +104,8 @@ func run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
+	cfg.WarningHandler = rest.NoWarnings{}
+
 	disc, err := discovery.NewDiscoveryClientForConfig(cfg)
 	if err != nil {
 		return err
@@ -115,12 +116,24 @@ func run(cmd *cobra.Command, args []string) error {
 		return err
 	}
 
-	client, err := dynamic.NewForConfig(cfg)
+	dynClient, err := dynamic.NewForConfig(cfg)
+	if err != nil {
+		return err
+	}
+
+	cfg.GroupVersion = &ksapi.GroupVersion
+	var scheme = runtime.NewScheme()
+	ksapi.AddToScheme(scheme)
+	var codecs = serializer.NewCodecFactory(scheme)
+	cfg.NegotiatedSerializer = codecs.WithoutConversion()
+	cfg.APIPath = "/apis"
+
+	structClient, err := rest.RESTClientFor(cfg)
 	if err != nil {
 		return err
 	}
 
-	helmReleases, err = listResources(context.TODO(), client.Resource(schema.GroupVersionResource{
+	helmReleases, err := listResources(context.TODO(), dynClient.Resource(schema.GroupVersionResource{
 		Group:    "helm.toolkit.fluxcd.io",
 		Version:  "v2beta1",
 		Resource: "helmreleases",
@@ -130,12 +143,7 @@ func run(cmd *cobra.Command, args []string) error {
 		return fmt.Errorf("failed to get helmreleases: %w", err)
 	}
 
-	kustomizations, err = listResources(context.TODO(), client.Resource(schema.GroupVersionResource{
-		Group:    "kustomize.toolkit.fluxcd.io",
-		Version:  "v1beta2",
-		Resource: "kustomizations",
-	}))
-
+	kustomizations, err := listKustomizations(context.TODO(), structClient)
 	if err != nil {
 		return fmt.Errorf("failed to get kustomizations: %w", err)
 	}
@@ -163,6 +171,11 @@ func run(cmd *cobra.Command, args []string) error {
 		for _, resource := range group.APIResources {
 			logger.Debugf("discover resource %#v.%#v.%#v", resource.Name, resource.Group, resource.Version)
 
+			if *kubeconfigArgs.Namespace != "" && !resource.Namespaced {
+				logger.Debugf("skipping cluster scoped resource %#v.%#v.%#v, namespaced scope was requested", resource.Name, resource.Group, resource.Version)
+				continue
+			}
+
 			gvr := schema.GroupVersionResource{
 				Group:    gv.Group,
 				Version:  gv.Version,
@@ -177,7 +190,7 @@ func run(cmd *cobra.Command, args []string) error {
 				}
 			}
 
-			resAPI := client.Resource(gvr)
+			resAPI := dynClient.Resource(gvr).Namespace(*kubeconfigArgs.Namespace)
 
 			// Skip APIS which do not support list
 			if !slices.Contains(resource.Verbs, "list") {
@@ -190,7 +203,7 @@ func run(cmd *cobra.Command, args []string) error {
 				defer wgProducer.Done()
 
 				if err := handleResource(context.TODO(), discover, resAPI, ch); err != nil {
-					logger.Failuref("could not hanlder resource: %s", err)
+					logger.Failuref("could not handle resource: %s", err)
 				}
 			}(resAPI)
 		}
@@ -221,6 +234,22 @@ func listResources(ctx context.Context, resAPI dynamic.ResourceInterface) (items
 	return list.Items, err
 }
 
+func listKustomizations(ctx context.Context, client *rest.RESTClient) (items []ksapi.Kustomization, err error) {
+	ks := &ksapi.KustomizationList{}
+
+	r := client.
+		Get().
+		Resource("kustomizations").
+		Do(ctx)
+
+	err = r.Into(ks)
+	if err != nil {
+		return []ksapi.Kustomization{}, err
+	}
+
+	return ks.Items, err
+}
+
 func getLabelSelector() string {
 	selector := ""
 	if !flags.includeAll {

go.mod

@@ -1,14 +1,15 @@
-module gihub.com/raffis/flux-zombies
+module gihub.com/raffis/gitops-zombies
 
 go 1.18
 
 require (
+	github.com/fluxcd/kustomize-controller/api v0.30.0
 	github.com/spf13/cobra v1.5.0
 	golang.org/x/exp v0.0.0-20221004215720-b9f4876ce741
 	gotest.tools/v3 v3.0.3
-	k8s.io/apimachinery v0.25.2
-	k8s.io/cli-runtime v0.25.2
-	k8s.io/client-go v0.25.2
+	k8s.io/apimachinery v0.25.3
+	k8s.io/cli-runtime v0.25.3
+	k8s.io/client-go v0.25.3
 	k8s.io/kubectl v0.25.2
 )
 
@@ -20,8 +21,10 @@ require (
 	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.8.0 // indirect
-	github.com/evanphx/json-patch v4.12.0+incompatible // indirect
+	github.com/evanphx/json-patch v5.6.0+incompatible // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d // indirect
+	github.com/fluxcd/pkg/apis/kustomize v0.6.0 // indirect
+	github.com/fluxcd/pkg/apis/meta v0.17.0 // indirect
 	github.com/fvbommel/sortorder v1.0.1 // indirect
 	github.com/go-errors/errors v1.0.1 // indirect
 	github.com/go-logr/logr v1.2.3 // indirect
@@ -32,49 +35,55 @@ require (
 	github.com/golang/protobuf v1.5.2 // indirect
 	github.com/google/btree v1.0.1 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect
-	github.com/google/go-cmp v0.5.8 // indirect
-	github.com/google/gofuzz v1.1.0 // indirect
+	github.com/google/go-cmp v0.5.9 // indirect
+	github.com/google/gofuzz v1.2.0 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
-	github.com/google/uuid v1.1.2 // indirect
+	github.com/google/uuid v1.3.0 // indirect
 	github.com/gregjones/httpcache v0.0.0-20180305231024-9cad4c3443a7 // indirect
-	github.com/imdario/mergo v0.3.6 // indirect
+	github.com/imdario/mergo v0.3.12 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
+	github.com/kr/pretty v0.2.1 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/mailru/easyjson v0.7.6 // indirect
-	github.com/mitchellh/go-wordwrap v1.0.0 // indirect
+	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/moby/spdystream v0.2.0 // indirect
 	github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/onsi/ginkgo/v2 v2.3.0 // indirect
+	github.com/onsi/gomega v1.22.1 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/russross/blackfriday v1.5.2 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/stretchr/objx v0.3.0 // indirect
 	github.com/xlab/treeprint v1.1.0 // indirect
 	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
-	golang.org/x/net v0.0.0-20220722155237-a158d28d115b // indirect
-	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
-	golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f // indirect
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
-	golang.org/x/text v0.3.7 // indirect
-	golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
+	golang.org/x/net v0.1.0 // indirect
+	golang.org/x/oauth2 v0.0.0-20221014153046-6fdb5e3db783 // indirect
+	golang.org/x/sys v0.1.0 // indirect
+	golang.org/x/term v0.1.0 // indirect
+	golang.org/x/text v0.4.0 // indirect
+	golang.org/x/time v0.0.0-20220609170525-579cf78fd858 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
-	google.golang.org/protobuf v1.28.0 // indirect
+	google.golang.org/protobuf v1.28.1 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	k8s.io/api v0.25.2 // indirect
-	k8s.io/component-base v0.25.2 // indirect
-	k8s.io/klog/v2 v2.70.1 // indirect
+	k8s.io/api v0.25.3 // indirect
+	k8s.io/apiextensions-apiserver v0.25.3 // indirect
+	k8s.io/component-base v0.25.3 // indirect
+	k8s.io/klog/v2 v2.80.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20220803162953-67bda5d908f1 // indirect
-	k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed // indirect
+	k8s.io/utils v0.0.0-20221012122500-cfd413dd9e85 // indirect
+	sigs.k8s.io/controller-runtime v0.13.0 // indirect
 	sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect
 	sigs.k8s.io/kustomize/api v0.12.1 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.13.9 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
-	sigs.k8s.io/yaml v1.2.0 // indirect
+	sigs.k8s.io/yaml v1.3.0 // indirect
 )