overlay

Documentation

Index

• Variables
• func AppHasAVPIndicators(app string) bool
• func ExcludeSet(names []string) map[string]bool
• func FilterOverlaysByRefs(app string, overlays, changedFiles []string) []string
• func FindAllOverlays(app string) []string
• func GetOverlaysToTest(app string, changedFiles []string, ignoreTestChanges bool) (overlays []string, fullTest bool, trigger string)
• func HasKustomization(overlay string) bool
• func HasOverlays(app string) bool
• func IsExcluded(overlay string, exclude map[string]bool) bool
• func RefsChangedDir(overlayDir string, changedDirs []string) bool
• func RenderKustomize(dir string) ([]byte, error)
• func RenderWithStrategy(app, overlay string, strategy Strategy, exclude map[string]bool) ([]byte, error)
• type BuildOptions
• type BuildResult
  • func RunBuildLoop(opts BuildOptions) []BuildResult
• type ProgressFunc
• type Strategy
  • func DetectStrategy(app string, avpEnabled bool) Strategy

Variables

var SecretAuthHint func(stderr string) string

SecretAuthHint is an org-injectable AVP auth hint function (mirror of provider).

Functions

func AppHasAVPIndicators

func AppHasAVPIndicators(app string) bool

AppHasAVPIndicators walks every YAML file under app (base/, overlays/, components/, ...) and reports whether any contains an AVP indicator (see hasAVPIndicators). AVP substitution runs against each rendered overlay, so a placeholder anywhere in an overlay's reference chain - not just its own overlay directory - means the app needs an AVP strategy; scanning the whole app tree once per app (rather than per overlay) reflects that.

func ExcludeSet

func ExcludeSet(names []string) map[string]bool

ExcludeSet builds the map IsExcluded/RenderWithStrategy expect from a plain overlay-name list (e.g. hook.Config.AVPExclude, parsed from a test.sh's AVP_EXCLUDE= directive).

func FilterOverlaysByRefs

func FilterOverlaysByRefs(app string, overlays, changedFiles []string) []string

FilterOverlaysByRefs narrows overlays down to only those whose kustomization reference chain (resources/components/bases, resolved transitively via kustomize.ResolveRefs) includes at least one of the directories changed under app (outside overlays/). This is what lets a change to a shared base/component file resolve to just the overlay(s) that actually consume it, instead of naively treating every overlay as affected - or, in the current (pre-fix) code, none at all, since a bare base-file change contains no "overlays/" path segment for the naive detector to key off of.

Safety valve: if scoping would produce an empty set (e.g. the only changes are to files that don't appear in any kustomization ref chain, such as an app-root-level test.sh), the original, unfiltered overlays slice is returned - this function only ever narrows the build scope, it never silently drops it to zero.

func FindAllOverlays

func FindAllOverlays(app string) []string

FindAllOverlays returns all overlay directories under app/overlays.

func GetOverlaysToTest

func GetOverlaysToTest(app string, changedFiles []string, ignoreTestChanges bool) (overlays []string, fullTest bool, trigger string)

GetOverlaysToTest maps changed files to the set of overlays to build.

func HasKustomization

func HasKustomization(overlay string) bool

HasKustomization reports whether an overlay uses kustomize.

func HasOverlays

func HasOverlays(app string) bool

HasOverlays reports whether app has an overlays/ directory containing at least one overlay - the same on-disk signal FindAllOverlays uses to discover overlays, exposed as a boolean predicate for app-root detection (see validator.detectAppRoots, which walks a changed file's ancestor directories looking for the nearest one with an overlays/ dir).

func IsExcluded

func IsExcluded(overlay string, exclude map[string]bool) bool

IsExcluded reports whether overlay is in the exclusion set.

func RefsChangedDir

func RefsChangedDir(overlayDir string, changedDirs []string) bool

RefsChangedDir reports whether the overlay rooted at overlayDir has a kustomization reference chain (resources/components/bases, resolved transitively via kustomize.ResolveRefs) that includes at least one of changedDirs. This is the single-overlay form of the scoping FilterOverlaysByRefs performs across a set: it lets a caller answer "does this one overlay actually consume that changed base/component directory?" - notably distinguishing version-partitioned component directories (e.g. components/foo/v0.21.0 vs components/foo/v0.19.1), so a change to one version only relates to the overlays that reference that version.

changedDirs entries are directories (as given, working-dir-relative); non-resolvable entries are skipped. Returns false when changedDirs is empty or none resolve.

func RenderKustomize

func RenderKustomize(dir string) ([]byte, error)

RenderKustomize builds the given kustomize directory (an overlay, or any other directory containing a kustomization.yaml) and returns the rendered YAML manifest stream. Exported for callers (e.g. schema validation) that need the fully-built manifests rather than raw, pre-build source files.

func RenderWithStrategy

func RenderWithStrategy(app, overlay string, strategy Strategy, exclude map[string]bool) ([]byte, error)

RenderWithStrategy renders overlay (an app's overlay directory) per strategy - kustomize or helm, each optionally piped through AVP secret resolution (see Strategy's docs) - unless overlay is in exclude (see IsExcluded/ExcludeSet), in which case an AVP strategy still renders, but skips the AVP substitution step. Callers that don't need AVP/Helm at all can keep using RenderKustomize directly; this is for callers that first resolved an app's Strategy via DetectStrategy.

Types

type BuildOptions

type BuildOptions struct {
	App          string
	Strategy     Strategy
	Overlays     []string
	OutputDir    string
	AVPExclude   []string
	Parallel     bool
	PreBuildHook func(overlayPath, outputPath string) error
	Progress     ProgressFunc
}

BuildOptions configures the overlay build loop.

type BuildResult

type BuildResult struct {
	Overlay  string
	YAMLFile string
	Err      error
}

BuildResult captures the result of building a single overlay.

func RunBuildLoop

func RunBuildLoop(opts BuildOptions) []BuildResult

RunBuildLoop builds the selected overlays.

type ProgressFunc

type ProgressFunc func(format string, args ...any)

ProgressFunc emits build progress.

type Strategy

type Strategy string

Strategy identifies how to build an overlay.

const (
	StrategyKustomize    Strategy = "kustomize"
	StrategyKustomizeAVP Strategy = "kustomize-avp"
	StrategyHelm         Strategy = "helm"
	StrategyHelmAVP      Strategy = "helm-avp"
)

func DetectStrategy

func DetectStrategy(app string, avpEnabled bool) Strategy

DetectStrategy inspects app's on-disk layout and content to pick which Strategy RenderWithStrategy should use to build its overlays:

• A base/kustomization.yaml → StrategyKustomize (or StrategyKustomizeAVP if avpEnabled and any AVP indicator is found anywhere under app - see AppHasAVPIndicators). A Chart.yaml alongside the kustomization.yaml is still built via kustomize (consumed through kustomize's helmCharts inflator, not this package's own Helm renderer).
• No kustomization.yaml but a base/Chart.yaml → StrategyHelm (or StrategyHelmAVP, same AVP-indicator check).
• Neither → StrategyKustomize (the default; RenderWithStrategy's own kustomize error surfaces the real problem, e.g. a missing base/).

avpEnabled=false skips the AVP-indicator scan entirely and always returns the non-AVP variant - for an operator running without the argocd-vault-plugin binary/a configured secret backend, so an AVP indicator in an app's content never forces a build path that would fail for reasons unrelated to the change being validated.