Initial commit
This commit is contained in:
Zhongwei Li
299
scripts/validate_gitops_repo.py
Normal file
299
scripts/validate_gitops_repo.py
Normal file
@@ -0,0 +1,299 @@
|
||||
#!/usr/bin/env python3
|
||||
"""
|
||||
Validate GitOps repository structure, manifests, and best practices.
|
||||
Supports both monorepo and polyrepo patterns with Kustomize and Helm.
|
||||
"""
|
||||
|
||||
import argparse
|
||||
import sys
|
||||
import os
|
||||
import glob
|
||||
from typing import Dict, List, Any, Tuple
|
||||
from pathlib import Path
|
||||
|
||||
try:
|
||||
import yaml
|
||||
except ImportError:
|
||||
print("⚠️ Warning: 'pyyaml' library not found. Install with: pip install pyyaml")
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
class GitOpsRepoValidator:
|
||||
def __init__(self, repo_path: str):
|
||||
self.repo_path = Path(repo_path).resolve()
|
||||
if not self.repo_path.exists():
|
||||
raise ValueError(f"Path does not exist: {repo_path}")
|
||||
|
||||
self.issues = []
|
||||
self.warnings = []
|
||||
self.recommendations = []
|
||||
|
||||
def validate(self) -> Dict[str, List[str]]:
|
||||
"""Run all validations."""
|
||||
print(f"🔍 Validating GitOps repository: {self.repo_path}\n")
|
||||
|
||||
# Structure validations
|
||||
self._check_repository_structure()
|
||||
self._check_kustomization_files()
|
||||
self._check_yaml_syntax()
|
||||
self._check_best_practices()
|
||||
self._check_secrets_management()
|
||||
|
||||
return {
|
||||
'issues': self.issues,
|
||||
'warnings': self.warnings,
|
||||
'recommendations': self.recommendations
|
||||
}
|
||||
|
||||
def _check_repository_structure(self):
|
||||
"""Check repository structure and organization."""
|
||||
print("📁 Checking repository structure...")
|
||||
|
||||
# Check for common patterns
|
||||
has_apps = (self.repo_path / 'apps').exists()
|
||||
has_clusters = (self.repo_path / 'clusters').exists()
|
||||
has_infrastructure = (self.repo_path / 'infrastructure').exists()
|
||||
has_base = (self.repo_path / 'base').exists()
|
||||
has_overlays = (self.repo_path / 'overlays').exists()
|
||||
|
||||
if not any([has_apps, has_clusters, has_infrastructure, has_base]):
|
||||
self.warnings.append("No standard directory structure detected (apps/, clusters/, infrastructure/, base/)")
|
||||
self.recommendations.append("Consider organizing with: apps/ (applications), infrastructure/ (cluster config), clusters/ (per-cluster)")
|
||||
|
||||
# Check for Flux bootstrap (if Flux)
|
||||
flux_system = self.repo_path / 'clusters' / 'flux-system'
|
||||
if flux_system.exists():
|
||||
print(" ✓ Flux bootstrap detected")
|
||||
if not (flux_system / 'gotk-components.yaml').exists():
|
||||
self.warnings.append("Flux bootstrap directory exists but gotk-components.yaml not found")
|
||||
|
||||
# Check for ArgoCD bootstrap (if ArgoCD)
|
||||
argocd_patterns = list(self.repo_path.rglob('*argocd-*.yaml'))
|
||||
if argocd_patterns:
|
||||
print(" ✓ ArgoCD manifests detected")
|
||||
|
||||
def _check_kustomization_files(self):
|
||||
"""Check Kustomization files for validity."""
|
||||
print("\n🔧 Checking Kustomization files...")
|
||||
|
||||
kustomization_files = list(self.repo_path.rglob('kustomization.yaml')) + \
|
||||
list(self.repo_path.rglob('kustomization.yml'))
|
||||
|
||||
if not kustomization_files:
|
||||
self.warnings.append("No kustomization.yaml files found")
|
||||
return
|
||||
|
||||
print(f" Found {len(kustomization_files)} kustomization files")
|
||||
|
||||
for kfile in kustomization_files:
|
||||
try:
|
||||
with open(kfile, 'r') as f:
|
||||
content = yaml.safe_load(f)
|
||||
|
||||
if not content:
|
||||
self.issues.append(f"Empty kustomization file: {kfile.relative_to(self.repo_path)}")
|
||||
continue
|
||||
|
||||
# Check for required fields
|
||||
if 'resources' not in content and 'bases' not in content and 'components' not in content:
|
||||
self.warnings.append(f"Kustomization has no resources/bases: {kfile.relative_to(self.repo_path)}")
|
||||
|
||||
# Check for deprecated 'bases' (Kustomize 5.7+)
|
||||
if 'bases' in content:
|
||||
self.warnings.append(f"Using deprecated 'bases' field: {kfile.relative_to(self.repo_path)}")
|
||||
self.recommendations.append("Migrate 'bases:' to 'resources:' (Kustomize 5.0+)")
|
||||
|
||||
except yaml.YAMLError as e:
|
||||
self.issues.append(f"Invalid YAML in {kfile.relative_to(self.repo_path)}: {e}")
|
||||
except Exception as e:
|
||||
self.issues.append(f"Error reading {kfile.relative_to(self.repo_path)}: {e}")
|
||||
|
||||
def _check_yaml_syntax(self):
|
||||
"""Check YAML files for syntax errors."""
|
||||
print("\n📝 Checking YAML syntax...")
|
||||
|
||||
yaml_files = list(self.repo_path.rglob('*.yaml')) + list(self.repo_path.rglob('*.yml'))
|
||||
|
||||
# Exclude certain directories
|
||||
exclude_dirs = {'.git', 'node_modules', 'vendor', '.github'}
|
||||
yaml_files = [f for f in yaml_files if not any(ex in f.parts for ex in exclude_dirs)]
|
||||
|
||||
syntax_errors = 0
|
||||
for yfile in yaml_files:
|
||||
try:
|
||||
with open(yfile, 'r') as f:
|
||||
yaml.safe_load_all(f)
|
||||
except yaml.YAMLError as e:
|
||||
self.issues.append(f"YAML syntax error in {yfile.relative_to(self.repo_path)}: {e}")
|
||||
syntax_errors += 1
|
||||
|
||||
if syntax_errors == 0:
|
||||
print(f" ✓ All {len(yaml_files)} YAML files are valid")
|
||||
else:
|
||||
print(f" ✗ {syntax_errors} YAML files have syntax errors")
|
||||
|
||||
def _check_best_practices(self):
|
||||
"""Check GitOps best practices."""
|
||||
print("\n✨ Checking best practices...")
|
||||
|
||||
# Check for namespace definitions
|
||||
namespace_files = list(self.repo_path.rglob('*namespace*.yaml'))
|
||||
if not namespace_files:
|
||||
self.recommendations.append("No namespace definitions found. Consider explicitly defining namespaces.")
|
||||
|
||||
# Check for image tags (not 'latest')
|
||||
all_yamls = list(self.repo_path.rglob('*.yaml')) + list(self.repo_path.rglob('*.yml'))
|
||||
latest_tag_count = 0
|
||||
|
||||
for yfile in all_yamls:
|
||||
try:
|
||||
with open(yfile, 'r') as f:
|
||||
content = f.read()
|
||||
if ':latest' in content or 'image: latest' in content:
|
||||
latest_tag_count += 1
|
||||
except:
|
||||
pass
|
||||
|
||||
if latest_tag_count > 0:
|
||||
self.warnings.append(f"Found {latest_tag_count} files using ':latest' image tag")
|
||||
self.recommendations.append("Pin image tags to specific versions or digests for reproducibility")
|
||||
|
||||
# Check for resource limits
|
||||
deployment_files = [f for f in all_yamls if 'deployment' in str(f).lower() or 'statefulset' in str(f).lower()]
|
||||
missing_limits = 0
|
||||
|
||||
for dfile in deployment_files:
|
||||
try:
|
||||
with open(dfile, 'r') as f:
|
||||
content = yaml.safe_load_all(f)
|
||||
for doc in content:
|
||||
if not doc or doc.get('kind') not in ['Deployment', 'StatefulSet']:
|
||||
continue
|
||||
|
||||
containers = doc.get('spec', {}).get('template', {}).get('spec', {}).get('containers', [])
|
||||
for container in containers:
|
||||
if 'resources' not in container or 'limits' not in container.get('resources', {}):
|
||||
missing_limits += 1
|
||||
break
|
||||
except:
|
||||
pass
|
||||
|
||||
if missing_limits > 0:
|
||||
self.recommendations.append(f"{missing_limits} Deployments/StatefulSets missing resource limits")
|
||||
|
||||
def _check_secrets_management(self):
|
||||
"""Check for secrets management practices."""
|
||||
print("\n🔐 Checking secrets management...")
|
||||
|
||||
# Check for plain Kubernetes secrets
|
||||
secret_files = list(self.repo_path.rglob('*secret*.yaml'))
|
||||
plain_secrets = []
|
||||
|
||||
for sfile in secret_files:
|
||||
try:
|
||||
with open(sfile, 'r') as f:
|
||||
for doc in yaml.safe_load_all(f):
|
||||
if doc and doc.get('kind') == 'Secret' and doc.get('type') != 'kubernetes.io/service-account-token':
|
||||
# Check if it's a SealedSecret or ExternalSecret
|
||||
if doc.get('kind') not in ['SealedSecret'] and 'external-secrets.io' not in doc.get('apiVersion', ''):
|
||||
plain_secrets.append(sfile.relative_to(self.repo_path))
|
||||
except:
|
||||
pass
|
||||
|
||||
if plain_secrets:
|
||||
self.issues.append(f"Found {len(plain_secrets)} plain Kubernetes Secret manifests in Git")
|
||||
self.recommendations.append("Use Sealed Secrets, External Secrets Operator, or SOPS for secrets management")
|
||||
for s in plain_secrets[:3]: # Show first 3
|
||||
self.issues.append(f" - {s}")
|
||||
|
||||
# Check for SOPS configuration
|
||||
sops_config = self.repo_path / '.sops.yaml'
|
||||
if sops_config.exists():
|
||||
print(" ✓ SOPS configuration found (.sops.yaml)")
|
||||
|
||||
# Check for Sealed Secrets
|
||||
sealed_secrets = list(self.repo_path.rglob('*sealedsecret*.yaml'))
|
||||
if sealed_secrets:
|
||||
print(f" ✓ Found {len(sealed_secrets)} SealedSecret manifests")
|
||||
|
||||
# Check for External Secrets
|
||||
external_secrets = [f for f in self.repo_path.rglob('*.yaml')
|
||||
if 'externalsecret' in str(f).lower() or 'secretstore' in str(f).lower()]
|
||||
if external_secrets:
|
||||
print(f" ✓ Found {len(external_secrets)} External Secrets manifests")
|
||||
|
||||
if not sops_config.exists() and not sealed_secrets and not external_secrets and plain_secrets:
|
||||
self.recommendations.append("No secrets management solution detected. Consider implementing Sealed Secrets, ESO, or SOPS+age")
|
||||
|
||||
|
||||
def main():
|
||||
parser = argparse.ArgumentParser(
|
||||
description='Validate GitOps repository structure and manifests',
|
||||
formatter_class=argparse.RawDescriptionHelpFormatter,
|
||||
epilog="""
|
||||
Examples:
|
||||
# Validate current directory
|
||||
python3 validate_gitops_repo.py .
|
||||
|
||||
# Validate specific repository
|
||||
python3 validate_gitops_repo.py /path/to/gitops-repo
|
||||
|
||||
# Show only issues (no warnings)
|
||||
python3 validate_gitops_repo.py . --errors-only
|
||||
|
||||
Checks:
|
||||
- Repository structure (monorepo/polyrepo patterns)
|
||||
- Kustomization file validity
|
||||
- YAML syntax errors
|
||||
- Best practices (image tags, resource limits, namespaces)
|
||||
- Secrets management (detect plain secrets, check for SOPS/Sealed Secrets/ESO)
|
||||
"""
|
||||
)
|
||||
|
||||
parser.add_argument('repo_path', help='Path to GitOps repository')
|
||||
parser.add_argument('--errors-only', action='store_true', help='Show only errors, not warnings')
|
||||
|
||||
args = parser.parse_args()
|
||||
|
||||
try:
|
||||
validator = GitOpsRepoValidator(args.repo_path)
|
||||
results = validator.validate()
|
||||
|
||||
# Print summary
|
||||
print("\n" + "="*60)
|
||||
print("📊 Validation Summary")
|
||||
print("="*60)
|
||||
|
||||
if results['issues']:
|
||||
print(f"\n❌ Issues ({len(results['issues'])}):")
|
||||
for issue in results['issues']:
|
||||
print(f" • {issue}")
|
||||
|
||||
if results['warnings'] and not args.errors_only:
|
||||
print(f"\n⚠️ Warnings ({len(results['warnings'])}):")
|
||||
for warning in results['warnings']:
|
||||
print(f" • {warning}")
|
||||
|
||||
if results['recommendations'] and not args.errors_only:
|
||||
print(f"\n💡 Recommendations ({len(results['recommendations'])}):")
|
||||
for rec in results['recommendations']:
|
||||
print(f" → {rec}")
|
||||
|
||||
if not results['issues'] and not results['warnings']:
|
||||
print("\n✅ No issues found! Repository structure looks good.")
|
||||
|
||||
# Exit code
|
||||
sys.exit(1 if results['issues'] else 0)
|
||||
|
||||
except KeyboardInterrupt:
|
||||
print("\n\nInterrupted by user")
|
||||
sys.exit(1)
|
||||
except Exception as e:
|
||||
print(f"❌ Error: {e}")
|
||||
import traceback
|
||||
traceback.print_exc()
|
||||
sys.exit(1)
|
||||
|
||||
|
||||
if __name__ == '__main__':
|
||||
main()
|
||||
Reference in New Issue
Block a user