giantswarm/kubectl-gs

kubectl plugin helping with custom resources by Giant Swarm

The official Giant Swarm kubectl plug-in

Quick start

kubectl krew install gs
kubectl gs

Check the installation docs for details on installation with and without Krew.

Features

• Login via single sign-on: Using the login command, you can quickly set up a kubectl context with OIDC authentication for a Giant Swarm management cluster, or a workload cluster with our dex and athena apps installed.
• Custom resource templating: using the template commands lets you create manifests for creating/updating custom resources for:
  • Clusters
  • Node pools
  • App catalogs
  • Apps
• Gitops repository management: The gitops command family allows to create and modify resources in your GitOps repo clone.
• Resource display: The get commands allow for retrieving a list of resources, or details for a single one.

Documentation

Find the kubectl gs reference in our documentation site.

Publishing a release

See docs/Release.md

kubectl-gs's Issues

Reporting a vulnerability

Hello!

I hope you are doing well!

We are a security research team. Our tool automatically detected a vulnerability in this repository. We want to disclose it responsibly. GitHub has a feature called Private vulnerability reporting, which enables security research to privately disclose a vulnerability. Unfortunately, it is not enabled for this repository.

Can you enable it, so that we can report it?

Thanks in advance!

PS: you can read about how to enable private vulnerability reporting here: https://docs.github.com/en/code-security/security-advisories/repository-security-advisories/configuring-private-vulnerability-reporting-for-a-repository

installation docs has 404 error

in the https://github.com/giantswarm/kubectl-gs page when you click on installation docs you get 404 error :)

Dependabot can't parse your go.mod

Dependabot couldn't parse the go.mod found at /go.mod.

The error Dependabot encountered was:

go: k8s.io/[email protected] requires
	cloud.google.com/[email protected] requires
	golang.org/x/[email protected]: invalid version: git fetch -f origin refs/heads/*:refs/heads/* refs/tags/*:refs/tags/* in /opt/go/gopath/pkg/mod/cache/vcs/38515699458adac9c8b61a0b44f9ad7a5f6edd7bcc2d7fae95930ec78f71e1b4: exit status 128:
	fatal: The remote end hung up unexpectedly
	fatal: early EOF
	fatal: index-pack failed

View the update logs.

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update cimg/base docker tag to v2024.06

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• chore(deps): update dependency kustomization to kustomize.toolkit.fluxcd.io/v1

Detected dependencies

circleci

.circleci/config.yml

• architect 5.2.0
• cimg/base 2024.05
• cimg/go 1.22.3

dockerfile

Dockerfile

• gsoci.azurecr.io/giantswarm/alpine 3.20.0
• gsoci.azurecr.io/giantswarm/alpine 3.20.0

gomod

go.mod

• go 1.21
• dario.cat/mergo v1.0.0
• github.com/3th1nk/cidr v0.2.0
• github.com/Masterminds/semver/v3 v3.2.1
• github.com/Masterminds/sprig/v3 v3.2.3
• github.com/ProtonMail/gopenpgp/v2 v2.7.5
• github.com/blang/semver v3.5.1+incompatible
• github.com/blang/semver/v4 v4.0.0
• github.com/coreos/go-oidc/v3 v3.10.0
• github.com/fatih/color v1.17.0
• github.com/getsops/sops/v3 v3.8.1
• github.com/giantswarm/apiextensions-application v0.6.1
• github.com/giantswarm/apiextensions/v6 v6.6.0
• github.com/giantswarm/app/v7 v7.0.1
• github.com/giantswarm/appcatalog v1.0.0
• github.com/giantswarm/backoff v1.0.0
• github.com/giantswarm/k8sclient/v7 v7.2.0
• github.com/giantswarm/k8smetadata v0.24.0
• github.com/giantswarm/microerror v0.4.1
• github.com/giantswarm/micrologger v1.1.1
• github.com/giantswarm/organization-operator v1.6.3
• github.com/giantswarm/release-operator/v4 v4.2.0
• github.com/golang-jwt/jwt/v5 v5.2.1
• github.com/google/go-cmp v0.6.0
• github.com/pkg/errors v0.9.1
• github.com/rhysd/go-github-selfupdate v1.2.3
• github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966@eef842397966
• github.com/spf13/afero v1.11.0
• github.com/spf13/cobra v1.8.0
• github.com/spf13/pflag v1.0.6-0.20210604193023-d5e0c0615ace@d5e0c0615ace
• github.com/stretchr/testify v1.9.0
• github.com/xeipuuv/gojsonschema v1.2.0
• golang.org/x/oauth2 v0.20.0
• gopkg.in/square/go-jose.v2 v2.6.0
• gotest.tools/v3 v3.5.1
• k8s.io/api v0.29.1
• k8s.io/apiextensions-apiserver v0.29.1
• k8s.io/apimachinery v0.29.1
• k8s.io/cli-runtime v0.29.1
• k8s.io/client-go v0.29.1
• k8s.io/utils v0.0.0-20240502163921-fe8a2dddb1d0@fe8a2dddb1d0
• sigs.k8s.io/controller-runtime v0.17.0
• sigs.k8s.io/yaml v1.4.0
• github.com/spf13/viper v1.18.2
• github.com/moby/moby v26.1.3+incompatible
• github.com/gogo/protobuf v1.3.2
• github.com/hashicorp/vault/api v1.14.0
• github.com/getsops/sops/v3 v3.8.1
• golang.org/x/crypto v0.23.0
• golang.org/x/text v0.15.0

kubernetes

internal/gitops/filesystem/creator/testdata/input/0-kustomization.yaml

• Kustomization kustomize.config.k8s.io/v1beta1

internal/gitops/filesystem/creator/testdata/input/1-kustomization.yaml

• Kustomization kustomize.config.k8s.io/v1beta1

internal/gitops/filesystem/creator/testdata/input/demomc.yaml

• Kustomization kustomize.toolkit.fluxcd.io/v1beta2

internal/gitops/filesystem/creator/testdata/input/demowc.yaml

• Kustomization kustomize.toolkit.fluxcd.io/v1beta2

---

• Check this box to trigger a request for Renovate to run again on this repository

selfupdate: Sync from devctl.

There are changes made in devctl which could be useful for kubectl-gs.

Background: I had some trouble with generating the cache directory in opsctl and determined differences in common update routines in devctl, kubectl-gs and opsctl repository. I there would like to synchronize those changes.

Kubectl-gs does not update WC client certificates in existing self.contained files

When updating a client certificate in an existing self-contained file, the new certificate is not stored.

Creating a new self-contained file with the same data works fine:

Steps to reproduce

1. Generate an invalid certificate to access a workload cluster and store it in a self-contained file

kubectl gs login INSTALLATION --workload-cluster WC_NAME --certificate-group INVALID_GROUP --certificate-ttl 1h --self-contained /path/to/self-contained

2. Generate a valid certificate to access the same workload cluster and store it in the same self-contained file

kubectl gs login INSTALLATION --workload-cluster WC_NAME --certificate-group system:masters --certificate-ttl 1h --self-contained /path/to/self-contained

3. Generate the same valid certificate to access the same workload cluster and store it in a new self-contained file

kubectl gs login INSTALLATION --workload-cluster WC_NAME --certificate-group system:masters --certificate-ttl 1h --self-contained /path/to/new-self-contained

Expected behaviour:

• kubectl --kubeconfig /path/to/self-contained get nodes executed after creation of the first self-contained file should fail
• kubectl --kubeconfig /path/to/self-contained get nodes executed after the first self-contained file is updated with correct credentials should succeed and print nodes
• kubectl --kubeconfig /path/to/new-self-contained get nodes executed after creation of the new self-contained file should succeed and print nodes

Observed behaviour:

• kubectl --kubeconfig /path/to/self-contained get nodes executed after creation of the first self-contained file fails
• kubectl --kubeconfig /path/to/self-contained get nodes executed after the first self-contained file is updated with correct credentials fails with the same error as before the update
• kubectl --kubeconfig /path/to/new-self-contained get nodes executed after creation of the new self-contained file succeeds and prints nodes

Action Required: Fix Renovate Configuration

There is an error with this repository's Renovate configuration that needs to be fixed. As a precaution, Renovate will stop PRs until it is resolved.

Error type: Preset is invalid JSON (github>giantswarm/renovate-presets:default.json5)