From eb08188e50509a73c14b2457acd5967a99d044c3 Mon Sep 17 00:00:00 2001 From: day0hero Date: Thu, 15 Oct 2026 16:02:53 +0100 Subject: [PATCH 1/2] add ability to honor extra_opts from make install --- Makefile | 4 +- scripts/verify-s3-bucket.sh | 148 ++++++++++++++++++++++++++++++++++-- 2 files changed, 145 insertions(+), 7 deletions(-) diff --git a/Makefile b/Makefile index de74e40d..81e135e0 100644 --- a/Makefile +++ b/Makefile @@ -15,8 +15,8 @@ endif @./scripts/create-public-s3-bucket.sh "$(BUCKET_NAME)" "$(REGION)" .PHONY: verify-s3-bucket -verify-s3-bucket: ## Verify OIDC S3 bucket is defined and exists - @./scripts/verify-s3-bucket.sh values-hypershift.yaml +verify-s3-bucket: ## Verify OIDC S3 bucket is defined and exists (honors EXTRA_HELM_OPTS) + @EXTRA_HELM_OPTS="$(EXTRA_HELM_OPTS)" ./scripts/verify-s3-bucket.sh values-hypershift.yaml .PHONY: install install: verify-s3-bucket pattern-install ## Installs the pattern (verifies S3 bucket first) diff --git a/scripts/verify-s3-bucket.sh b/scripts/verify-s3-bucket.sh index ccd54d81..05be08cf 100755 --- a/scripts/verify-s3-bucket.sh +++ b/scripts/verify-s3-bucket.sh @@ -4,6 +4,10 @@ set -o pipefail # Script to verify that the OIDC S3 bucket is defined and exists # If .global.hypershift.createBucket is true, will create the bucket if it doesn't exist # Usage: ./verify-s3-bucket.sh [values-file] +# +# Honors EXTRA_HELM_OPTS the same way pattern install does: -f/--values files are +# merged in order, then --set/--set-string overrides win. Only keys under +# global.hypershift are considered here. SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" VALUES_FILE="${1:-values-hypershift.yaml}" @@ -19,19 +23,153 @@ if ! command -v yq &> /dev/null; then exit 1 fi -# Extract values from values file -BUCKET_NAME=$(yq '.global.hypershift.oidc.bucketName' "${VALUES_FILE}") -REGION=$(yq '.global.hypershift.oidc.region' "${VALUES_FILE}") -CREATE_BUCKET=$(yq '.global.hypershift.createBucket' "${VALUES_FILE}") +read_hypershift_values_from_file() { + local file="$1" + local bucket region create + + bucket=$(yq '.global.hypershift.oidc.bucketName' "${file}") + region=$(yq '.global.hypershift.oidc.region' "${file}") + create=$(yq '.global.hypershift.createBucket' "${file}") + + if [ -n "${bucket}" ] && [ "${bucket}" != "null" ]; then + BUCKET_NAME="${bucket}" + fi + if [ -n "${region}" ] && [ "${region}" != "null" ]; then + REGION="${region}" + fi + if [ -n "${create}" ] && [ "${create}" != "null" ]; then + CREATE_BUCKET="${create}" + fi +} + +# Apply a single helm --set / --set-string argument (may be comma-separated pairs). +# Escaped commas (\,) are treated as literal commas in values. +apply_set_arg() { + local setarg="$1" + local pair key val rest + + rest="${setarg}" + while [ -n "${rest}" ]; do + # Split on the next unescaped comma + if [[ "${rest}" =~ ^(([^\\,]|\\.)+)(,(.*))?$ ]]; then + pair="${BASH_REMATCH[1]}" + rest="${BASH_REMATCH[4]}" + else + pair="${rest}" + rest="" + fi + # Unescape \, + pair="${pair//\\,/,}" + + key="${pair%%=*}" + if [ "${key}" = "${pair}" ]; then + continue + fi + val="${pair#*=}" + + case "${key}" in + global.hypershift.createBucket) + CREATE_BUCKET="${val}" + ;; + global.hypershift.oidc.region) + REGION="${val}" + ;; + global.hypershift.oidc.bucketName) + BUCKET_NAME="${val}" + ;; + esac + done +} + +# Merge EXTRA_HELM_OPTS over values already loaded from VALUES_FILE. +# Precedence matches helm: later -f/--values override earlier; --set wins over files. +apply_extra_helm_opts() { + local opts="${EXTRA_HELM_OPTS:-}" + [ -z "${opts}" ] && return 0 + + echo "Applying EXTRA_HELM_OPTS: ${opts}" + + # Word-split like make/helm (EXTRA_HELM_OPTS is a helm argv string) + # shellcheck disable=SC2206 + local -a args=( ${opts} ) + local i=0 + local -a set_args=() + + while [ "${i}" -lt "${#args[@]}" ]; do + local arg="${args[$i]}" + case "${arg}" in + -f|--values) + i=$((i + 1)) + if [ "${i}" -ge "${#args[@]}" ]; then + echo "Error: ${arg} in EXTRA_HELM_OPTS requires a file path" + exit 1 + fi + if [ ! -f "${args[$i]}" ]; then + echo "Error: values file '${args[$i]}' from EXTRA_HELM_OPTS not found" + exit 1 + fi + read_hypershift_values_from_file "${args[$i]}" + ;; + -f*) + local fpath="${arg#-f}" + if [ ! -f "${fpath}" ]; then + echo "Error: values file '${fpath}' from EXTRA_HELM_OPTS not found" + exit 1 + fi + read_hypershift_values_from_file "${fpath}" + ;; + --values=*) + local fpath="${arg#--values=}" + if [ ! -f "${fpath}" ]; then + echo "Error: values file '${fpath}' from EXTRA_HELM_OPTS not found" + exit 1 + fi + read_hypershift_values_from_file "${fpath}" + ;; + --set|--set-string) + i=$((i + 1)) + if [ "${i}" -ge "${#args[@]}" ]; then + echo "Error: ${arg} in EXTRA_HELM_OPTS requires a value" + exit 1 + fi + set_args+=("${args[$i]}") + ;; + --set=*) + set_args+=("${arg#--set=}") + ;; + --set-string=*) + set_args+=("${arg#--set-string=}") + ;; + esac + i=$((i + 1)) + done + + # --set overrides apply after all values files + local s + for s in "${set_args[@]}"; do + apply_set_arg "${s}" + done +} + +# Extract base values from values file, then overlay EXTRA_HELM_OPTS +BUCKET_NAME="" +REGION="" +CREATE_BUCKET="" +read_hypershift_values_from_file "${VALUES_FILE}" +apply_extra_helm_opts # Check if bucket name is defined and not empty if [ -z "${BUCKET_NAME}" ] || [ "${BUCKET_NAME}" == "null" ] || [ "${BUCKET_NAME}" == "''" ] || [ "${BUCKET_NAME}" == "" ]; then echo "Error: .global.hypershift.oidc.bucketName is not defined in ${VALUES_FILE}" + if [ -n "${EXTRA_HELM_OPTS:-}" ]; then + echo " (also not overridden via EXTRA_HELM_OPTS)" + fi exit 1 fi # Remove any quotes from the values BUCKET_NAME=$(echo "${BUCKET_NAME}" | tr -d "'" | tr -d '"') +CREATE_BUCKET=$(echo "${CREATE_BUCKET}" | tr -d "'" | tr -d '"' | tr '[:upper:]' '[:lower:]') if [ -z "${BUCKET_NAME}" ]; then echo "Error: .global.hypershift.oidc.bucketName is empty in ${VALUES_FILE}" @@ -145,7 +283,7 @@ if [ "${BUCKET_EXISTS}" != "true" ]; then echo "Error: S3 bucket '${BUCKET_NAME}' does not exist or is not accessible" echo "" echo "To create the bucket, either:" - echo " 1. Set .global.hypershift.createBucket to true in ${VALUES_FILE}" + echo " 1. Set .global.hypershift.createBucket to true in ${VALUES_FILE} (or via EXTRA_HELM_OPTS --set)" echo " 2. Or run manually:" if [ -n "${REGION}" ]; then echo " ./pattern.sh make create-s3-bucket BUCKET_NAME=${BUCKET_NAME} REGION=${REGION}" From b4db43a2a3488f3061e8d7821a4c0ea5c2b580fe Mon Sep 17 00:00:00 2001 From: day0hero Date: Thu, 15 Oct 2026 16:20:53 +0100 Subject: [PATCH 2/2] fixing lookup path --- scripts/verify-s3-bucket.sh | 42 +++++++++++++++++++++++++++++++++++-- 1 file changed, 40 insertions(+), 2 deletions(-) diff --git a/scripts/verify-s3-bucket.sh b/scripts/verify-s3-bucket.sh index 05be08cf..e734d5c1 100755 --- a/scripts/verify-s3-bucket.sh +++ b/scripts/verify-s3-bucket.sh @@ -185,6 +185,37 @@ fi echo "Checking S3 bucket: ${BUCKET_NAME}" +# Wire up AWS credentials without breaking local/default CLI auth. +# +# CI copies the pattern awsCreds shared-credentials file to ~/credentials +# (see values-secret path: ~/credentials). That is not on the AWS CLI default +# search path, so only in that case we set AWS_SHARED_CREDENTIALS_FILE. +# +# Otherwise leave the normal chain alone: env vars, AWS_PROFILE, ~/.aws/*, +# SSO, instance roles, etc. +setup_aws_credentials() { + if [ -n "${AWS_SHARED_CREDENTIALS_FILE:-}" ]; then + if [ ! -f "${AWS_SHARED_CREDENTIALS_FILE}" ]; then + echo "Error: AWS_SHARED_CREDENTIALS_FILE=${AWS_SHARED_CREDENTIALS_FILE} does not exist" + exit 1 + fi + echo "Using AWS credentials file: ${AWS_SHARED_CREDENTIALS_FILE}" + elif [ -z "${AWS_ACCESS_KEY_ID:-}" ] && [ -z "${AWS_PROFILE:-}" ] && \ + [ -n "${HOME:-}" ] && [ -f "${HOME}/credentials" ]; then + export AWS_SHARED_CREDENTIALS_FILE="${HOME}/credentials" + echo "Using AWS credentials file: ${AWS_SHARED_CREDENTIALS_FILE}" + fi + + # Prefer the bucket's configured region for this check; do not override if + # the caller already set one explicitly. + if [ -n "${REGION}" ]; then + export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-${REGION}}" + export AWS_REGION="${AWS_REGION:-${REGION}}" + fi +} + +setup_aws_credentials + # Function to check if bucket is public check_bucket_public() { local bucket="$1" @@ -233,11 +264,14 @@ show_not_public_error() { echo " --public-access-block-configuration 'BlockPublicAcls=false,IgnorePublicAcls=false,BlockPublicPolicy=false,RestrictPublicBuckets=false'" } -# Check if bucket exists +# Check if bucket exists (capture stderr — "not accessible" is often missing creds/perms) BUCKET_EXISTS=false -if aws s3api head-bucket --bucket "${BUCKET_NAME}" 2>/dev/null; then +HEAD_BUCKET_ERR=$(mktemp) +if aws s3api head-bucket --bucket "${BUCKET_NAME}" 2>"${HEAD_BUCKET_ERR}"; then BUCKET_EXISTS=true fi +HEAD_BUCKET_MSG=$(tr -d '\r' < "${HEAD_BUCKET_ERR}" | sed '/^$/d' || true) +rm -f "${HEAD_BUCKET_ERR}" # Handle createBucket=true if [ "${CREATE_BUCKET}" == "true" ]; then @@ -281,6 +315,10 @@ fi # createBucket is not true - just verify bucket exists and is public if [ "${BUCKET_EXISTS}" != "true" ]; then echo "Error: S3 bucket '${BUCKET_NAME}' does not exist or is not accessible" + if [ -n "${HEAD_BUCKET_MSG}" ]; then + echo "aws s3api head-bucket error:" + echo "${HEAD_BUCKET_MSG}" + fi echo "" echo "To create the bucket, either:" echo " 1. Set .global.hypershift.createBucket to true in ${VALUES_FILE} (or via EXTRA_HELM_OPTS --set)"