feat: Enhanced get template function (#513)

`get` is now able to take one more optional argument, that is used as the default value when the value for the key does not exist.

Resolves #465
Fixes #427
Fixes #357
Ref #460

.circleci/config.yml

@@ -0,0 +1,107 @@
+version: 2
+
+jobs:
+
+  build:
+    docker:
+      - image: circleci/golang:1.11.2
+    working_directory: /go/src/github.com/roboll/helmfile
+    steps:
+      - checkout
+      - run: make build
+      - persist_to_workspace:
+          root: /go/src/github.com/roboll/helmfile
+          paths:
+            - .
+
+  test:
+    docker:
+      - image: circleci/golang:1.11.2
+    working_directory: /go/src/github.com/roboll/helmfile
+    steps:
+      - checkout
+      - run: make check
+      - run: make pristine
+      - run: make test
+
+  # thanks to https://raw.githubusercontent.com/weaveworks/launcher/master/.circleci/config.yml
+  integration_tests:
+    machine:
+      image: circleci/classic:201808-01
+    environment:
+      CHANGE_MINIKUBE_NONE_USER: true
+      MINIKUBE_WANTUPDATENOTIFICATION: false
+      MINIKUBE_WANTREPORTERRORPROMPT: false
+    steps:
+      - checkout
+      - run: mkdir ~/build
+      - attach_workspace:
+          at: ~/build
+      - run: cp ~/build/helmfile ~/project/helmfile
+      - run:
+          name: Install helm
+          environment:
+            HELM_VERSION: v2.13.0
+          command: |
+            HELM_FILENAME="helm-${HELM_VERSION}-linux-amd64.tar.gz"
+            curl -Lo ${HELM_FILENAME} "https://kubernetes-helm.storage.googleapis.com/${HELM_FILENAME}"
+            tar zxf ${HELM_FILENAME} linux-amd64/helm
+            chmod +x linux-amd64/helm
+            sudo mv linux-amd64/helm /usr/local/bin/
+      - run:
+          name: Deploy minikube
+          environment:
+            CHANGE_MINIKUBE_NONE_USER: true
+            K8S_VERSION: v1.12.3
+            MINIKUBE_VERSION: v0.30.0
+          command: |
+            curl -Lo kubectl https://storage.googleapis.com/kubernetes-release/release/${K8S_VERSION}/bin/linux/amd64/kubectl
+            chmod +x kubectl && sudo mv kubectl /usr/local/bin/
+            curl -Lo minikube https://storage.googleapis.com/minikube/releases/${MINIKUBE_VERSION}/minikube-linux-amd64
+            chmod +x minikube && sudo mv minikube /usr/local/bin/
+            sudo -E minikube start --vm-driver=none --kubernetes-version=${K8S_VERSION}
+            sudo -E minikube update-context
+      - run:
+          name: Wait for nodes to become ready
+          command: JSONPATH='{range .items[*]}{@.metadata.name}:{range @.status.conditions[*]}{@.type}={@.status};{end}{end}'; until kubectl get nodes -o jsonpath="$JSONPATH" 2>&1 | grep -q "Ready=True"; do sleep 1; done
+      - run:
+          name: Execute integration tests
+          command: |
+            export TERM=xterm
+            make integration
+
+# GITHUB_TOKEN env var must be setup in circleci console
+
+  release:
+    docker:
+      - image: circleci/golang:1.11.2
+    working_directory: /go/src/github.com/roboll/helmfile
+    steps:
+    - checkout
+    - setup_remote_docker
+    - run:
+        command: |
+          docker login -u="$DOCKER_USER" -p="$DOCKER_PASS" quay.io
+          make tools
+          BUILD_URL="$CIRCLE_BUILD_URL" make push release
+
+workflows:
+  version: 2
+  build_and_test:
+    jobs:
+      - build
+      - test
+      - integration_tests:
+          requires:
+            - build
+          filters:
+            branches:
+              only:
+                - master
+                - /pull.*/
+      - release:
+          filters:
+            branches:
+              ignore: /.*/
+            tags:
+              only: /v.*/

.gitignore

@@ -1 +1,3 @@
 dist/
+.idea/
+helmfile

CONTRIBUTING.md

@@ -0,0 +1,39 @@
+# DCO + License
+
+By contributing to `helmfile`, you accept and agree to the following DCO and license terms and
+conditions for your present and future Contributions submitted to the `helmfile` project.
+
+[DCO](https://developercertificate.org/)
+[License](https://github.com/roboll/helmfile/blob/master/LICENSE)
+
+# Developing helmfile
+
+Locate your `GOPATH`, usually `~/go`, and run:
+
+```console
+$ go get github.com/roboll/helmfile
+
+$ cd $GOPATH/src/github.com/roboll/helmfile
+
+$ git checkout -b your-shiny-new-feature origin/master
+
+...
+
+$ git commit -m 'feat: do whatever for whatever purpose
+
+This adds ... by:
+
+- Adding ...
+- Changing ...
+- Removing...
+
+Resolves #ISSUE_NUMBER
+'
+
+$ hub fork
+$ git push YOUR_GITHUB_USER your-shiny-new-feature
+$ hub pull-request
+```
+
+Note that the above tutorial uses [hub](https://github.com/github/hub) just for ease of explanation.
+Please use whatever tool or way to author your pull request!

Dockerfile

@@ -1,9 +1,29 @@
-FROM alpine:3.4
+FROM golang:1.11.2-alpine3.8 as builder
 
-RUN apk add --update curl && \
-	curl -L https://kubernetes-helm.storage.googleapis.com/helm-v2.0.0-linux-amd64.tar.gz | \
-	tar zxf - && mv /linux-amd64/helm /usr/local/bin/ && rm -r /linux-amd64 && apk del curl
+RUN apk add --no-cache make git
+WORKDIR /go/src/github.com/roboll/helmfile/
+COPY . /go/src/github.com/roboll/helmfile/
+RUN make static-linux
 
-COPY dist/helmfile_linux_amd64 /usr/local/bin/helmfile
+# -----------------------------------------------------------------------------
+
+FROM alpine:3.8
+
+RUN apk add --no-cache ca-certificates git bash curl
+
+ARG HELM_VERSION=v2.13.0
+ARG HELM_LOCATION="https://kubernetes-helm.storage.googleapis.com"
+ARG HELM_FILENAME="helm-${HELM_VERSION}-linux-amd64.tar.gz"
+ARG HELM_SHA256="15eca6ad225a8279de80c7ced42305e24bc5ac60bb7d96f2d2fa4af86e02c794"
+RUN wget ${HELM_LOCATION}/${HELM_FILENAME} && \
+    sha256sum ${HELM_FILENAME} | grep -q "${HELM_SHA256}" && \
+    tar zxf ${HELM_FILENAME} && mv /linux-amd64/helm /usr/local/bin/ && \
+    rm ${HELM_FILENAME} && rm -r /linux-amd64
+
+RUN mkdir -p "$(helm home)/plugins"
+RUN helm plugin install https://github.com/databus23/helm-diff && \
+    helm plugin install https://github.com/futuresimple/helm-secrets
+
+COPY --from=builder /go/src/github.com/roboll/helmfile/dist/helmfile_linux_amd64 /usr/local/bin/helmfile
 
 CMD ["/usr/local/bin/helmfile"]

Gopkg.lock

@@ -0,0 +1,121 @@
+# This file is autogenerated, do not edit; changes may be undone by the next 'dep ensure'.
+
+
+[[projects]]
+  digest = "1:d9141c149f722217d35834972878499a4781fe5ae46a152e8ac843ff15efc80f"
+  name = "github.com/Masterminds/semver"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "8d82589cda2d7b5b9167396841975c4535c9bec6"
+  version = "v1.4.1"
+
+[[projects]]
+  digest = "1:46a054a232ea2b7f0a35398d682b433d26ba9975fce9197b1784824402059f5b"
+  name = "github.com/Masterminds/sprig"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "6b2a58267f6a8b1dc8e2eb5519b984008fa85e8c"
+  version = "v2.15.0"
+
+[[projects]]
+  digest = "1:8f5416c7f59da8600725ae1ff00a99af1da8b04c211ae6f3c8f8bcab0164f650"
+  name = "github.com/aokoli/goutils"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "3391d3790d23d03408670993e957e8f408993c34"
+  version = "v1.0.1"
+
+[[projects]]
+  digest = "1:8f8811f9be822914c3a25c6a071e93beb4c805d7b026cbf298bc577bc1cc945b"
+  name = "github.com/google/uuid"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "064e2069ce9c359c118179501254f67d7d37ba24"
+  version = "0.2"
+
+[[projects]]
+  digest = "1:6b1e7618931d0ed9a17fec1c1d84271907aa61172c50b8272327f6cd4fafb650"
+  name = "github.com/huandu/xstrings"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "2bf18b218c51864a87384c06996e40ff9dcff8e1"
+  version = "v1.0.0"
+
+[[projects]]
+  digest = "1:8eb1de8112c9924d59bf1d3e5c26f5eaa2bfc2a5fcbb92dc1c2e4546d695f277"
+  name = "github.com/imdario/mergo"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "9f23e2d6bd2a77f959b2bf6acdbefd708a83a4a4"
+  version = "v0.3.6"
+
+[[projects]]
+  digest = "1:55d0f7127962b0657acfd69650634057b3a08958226feee1b64a379666bb915e"
+  name = "github.com/urfave/cli"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "6011f165dc288c72abd8acd7722f837c5c64198d"
+
+[[projects]]
+  digest = "1:3c1a69cdae3501bf75e76d0d86dc6f2b0a7421bc205c0cb7b96b19eed464a34d"
+  name = "go.uber.org/atomic"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "1ea20fb1cbb1cc08cbd0d913a96dead89aa18289"
+  version = "v1.3.2"
+
+[[projects]]
+  digest = "1:60bf2a5e347af463c42ed31a493d817f8a72f102543060ed992754e689805d1a"
+  name = "go.uber.org/multierr"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "3c4937480c32f4c13a875a1829af76c98ca3d40a"
+  version = "v1.1.0"
+
+[[projects]]
+  digest = "1:9580b1b079114140ade8cec957685344d14f00119e0241f6b369633cb346eeb3"
+  name = "go.uber.org/zap"
+  packages = [
+    ".",
+    "buffer",
+    "internal/bufferpool",
+    "internal/color",
+    "internal/exit",
+    "zapcore",
+  ]
+  pruneopts = "UT"
+  revision = "eeedf312bc6c57391d84767a4cd413f02a917974"
+  version = "v1.8.0"
+
+[[projects]]
+  branch = "master"
+  digest = "1:7b1c378a71f617ec07229a1fcbb90b6a5344295823e1d732398f50fd9ae4bbec"
+  name = "golang.org/x/crypto"
+  packages = [
+    "pbkdf2",
+    "scrypt",
+  ]
+  pruneopts = "UT"
+  revision = "b2aa35443fbc700ab74c586ae79b81c171851023"
+
+[[projects]]
+  branch = "v2"
+  digest = "1:342378ac4dcb378a5448dd723f0784ae519383532f5e70ade24132c4c8693202"
+  name = "gopkg.in/yaml.v2"
+  packages = ["."]
+  pruneopts = "UT"
+  revision = "5420a8b6744d3b0345ab293f6fcba19c978f1183"
+
+[solve-meta]
+  analyzer-name = "dep"
+  analyzer-version = 1
+  input-imports = [
+    "github.com/Masterminds/sprig",
+    "github.com/imdario/mergo",
+    "github.com/urfave/cli",
+    "go.uber.org/zap",
+    "go.uber.org/zap/zapcore",
+    "gopkg.in/yaml.v2",
+  ]
+  solver-name = "gps-cdcl"
+  solver-version = 1

Gopkg.toml

@@ -0,0 +1,15 @@
+[[constraint]]
+  name = "github.com/Masterminds/sprig"
+  version = "2.15.0"
+
+[[constraint]]
+  branch = "v2"
+  name = "gopkg.in/yaml.v2"
+
+[prune]
+  go-tests = true
+  unused-packages = true
+
+[[constraint]]
+  name = "github.com/imdario/mergo"
+  version = "0.3.6"

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 rob boll
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

Makefile

@@ -1,4 +1,4 @@
-ORG     := $(shell basename $(realpath ..))
+ORG     ?= $(shell basename $(realpath ..))
 PKGS    := $(shell go list ./... | grep -v /vendor/)
 
 build:
@@ -21,28 +21,63 @@ test:
 	go test -v ${PKGS} -cover -race -p=1
 .PHONY: test
 
+integration:
+	bash test/integration/run.sh
+.PHONY: integration
+
 cross:
-	gox -os '!freebsd !netbsd' -arch '!arm' -output "dist/{{.Dir}}_{{.OS}}_{{.Arch}}" -ldflags '-X main.Version=${TAG}' ${TARGETS}
+	env CGO_ENABLED=0 gox -os '!freebsd !netbsd' -arch '!arm' -output "dist/{{.Dir}}_{{.OS}}_{{.Arch}}" -ldflags '-X main.Version=${TAG}' ${TARGETS}
 .PHONY: cross
 
+static-linux:
+	env CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o "dist/helmfile_linux_amd64" -ldflags '-X main.Version=${TAG}' ${TARGETS}
+.PHONY: linux
+
+install:
+	env CGO_ENABLED=0 go install -ldflags '-X main.Version=${TAG}' ${TARGETS}
+.PHONY: install
+
+clean:
+	rm dist/helmfile_*
+.PHONY: clean
+
 pristine: generate fmt
-	git ls-files --modified --deleted --others | diff /dev/null -
+	git ls-files --exclude-standard --modified --deleted --others | diff /dev/null -
 .PHONY: pristine
 
 release: pristine cross
-	@ghr -b ${BODY} -t ${GITHUB_TOKEN} -u ${ORG} -replace ${TAG} dist
+	@ghr -b ${BODY} -t ${GITHUB_TOKEN} -u ${ORG} -recreate ${TAG} dist
 .PHONY: release
 
-image: cross
-	docker build -t quay.io/roboll/helmfile:${TAG} .
+image:
+	docker build -t quay.io/${ORG}/helmfile:${TAG} .
+
+run: image
+	docker run --rm -it -t quay.io/${ORG}/helmfile:${TAG} sh
 
 push: image
-	docker push quay.io/roboll/helmfile:${TAG}
+	docker push quay.io/${ORG}/helmfile:${TAG}
 
 tools:
-	go get -u github.com/roboll/ghr github.com/mitchellh/gox
+	go get -u github.com/tcnksm/ghr github.com/mitchellh/gox
 .PHONY: tools
 
 TAG  = $(shell git describe --tags --abbrev=0 HEAD)
 LAST = $(shell git describe --tags --abbrev=0 HEAD^)
 BODY = "`git log ${LAST}..HEAD --oneline --decorate` `printf '\n\#\#\# [Build Info](${BUILD_URL})'`"
+
+release/minor:
+	git checkout master
+	git pull --rebase origin master
+	bash -c 'if git branch | grep autorelease; then git branch -D autorelease; else echo no branch to be cleaned; fi'
+	git checkout -b autorelease origin/master
+	bash -c 'SEMTAG_REMOTE=origin hack/semtag final -s minor'
+	git checkout master
+
+release/patch:
+	git checkout master
+	git pull --rebase origin master
+	bash -c 'if git branch | grep autorelease; then git branch -D autorelease; else echo no branch to be cleaned; fi'
+	git checkout -b autorelease origin/master
+	bash -c 'SEMTAG_REMOTE=origin hack/semtag final -s patch'
+	git checkout master

PATHS.md

@@ -0,0 +1,58 @@
+# Paths Overivew 
+Using manifest files in conjunction with command line argument can be a bit confusing.  
+
+A few rules to clear up this ambiguity: 
+
+- Absolute paths are always resolved as absolute paths
+- Relative paths referenced *in* the helmfile manifest itself are relative to that manifest
+- Relative paths referenced on the command line are relative to the current working directory the user is in
+
+### Examples
+There are several examples that we can go through in the `/examples` folder which demonstrate this.
+
+**Local Execution**
+
+This is an example of a Helmfile manifest referencing a local value directly. 
+
+Indirect:
+```
+helmfile -f examples/deployments/local/charts.yaml sync
+```
+
+Direct: 
+```
+cd examples/deployments/local/
+helmfile sync
+```
+
+**Relative Paths in Helmfile**
+
+This is an example of a Helmfile manifest using relative paths for values. 
+
+Indirect:
+```
+helmfile -f examples/deployments/dev/charts.yaml sync
+```
+
+Direct: 
+```
+cd examples/deployments/dev/
+helmfile sync
+```
+
+**Relative Paths in Helmfile w/ --values overrides**
+
+This is an example of a Helmfile manifest using relative paths for values including an additional `--values` from the command line.  
+
+NOTE: The `--values` is resolved relative to the CWD of the terminal *not* the Helmfile manifest.  You can see this with the `replicas` being adjusted to 3 now for the deployment.
+
+Indirect:
+```
+helmfile -f examples/deployments/dev/charts.yaml sync --values values/replica-values.yaml
+```
+
+Direct: 
+```
+cd examples/deployments/dev/
+helmfile sync --values ../../values/replica-values.yaml
+```

README.md

@@ -4,6 +4,14 @@ Deploy Kubernetes Helm Charts
 
 [![Docker Repository on Quay](https://quay.io/repository/roboll/helmfile/status "Docker Repository on Quay")](https://quay.io/repository/roboll/helmfile)
 
+## status
+
+Even though Helmfile is used in production environments [across multiple organizations](USERS.md), it is still in its early stage of development, hence versioned 0.x.
+
+Helmfile complies to Semantic Versioning 2.0.0 in which v0.x means that there could be backward-incompatible changes for every release.
+
+Note that we will try our best to document any backward incompatibility.
+
 ## about
 
 Helmfile is a declarative spec for deploying helm charts. It lets you...
@@ -14,54 +22,745 @@ Helmfile is a declarative spec for deploying helm charts. It lets you...
 
 To avoid upgrades for each iteration of `helm`, the `helmfile` executable delegates to `helm` - as a result, `helm` must be installed.
 
-The default helmfile is `charts.yaml`:
+## configuration syntax
 
-```
+**CAUTION**: This documentation is for the development version of Helmfile. If you are looking for the documentation for any of releases, please switch to the corresponding release tag like [v0.31.0](https://github.com/roboll/helmfile/tree/v0.31.0).
+
+The default helmfile is `helmfile.yaml`:
+
+```yaml
 repositories:
   - name: roboll
     url: http://roboll.io/charts
+    certFile: optional_client_cert
+    keyFile: optional_client_key
+    username: optional_username
+    password: optional_password
 
-charts:
-  - name: vault                          # helm deployment name
-    namespace: vault                     # target namespace
-    chart: roboll/vault-secret-manager   # chart reference
-    values: [ vault.yaml ]               # value files (--values)
-    set:                                 # values (--set)
-      - name: address
-        value: https://vault.example.com
-    env:                                 # values (--set) but value will be pulled from environment variables. Will throw an error if the environment variable is not set.
-      - name: db.password
-        value: DB_PASSWORD               # $DB_PASSOWRD needs to be set in the calling environment ex: export DB_PASSWORD='password1'
+# context: kube-context # this directive is deprecated, please consider using helmDefaults.kubeContext
+
+#default values to set for args along with dedicated keys that can be set by contributers, cli args take precedence over these
+helmDefaults:
+  tillerNamespace: tiller-namespace  #dedicated default key for tiller-namespace
+  kubeContext: kube-context          #dedicated default key for kube-context (--kube-context)
+  # additional and global args passed to helm
+  args:
+    - "--set k=v"
+  # defaults for verify, wait, force, timeout and recreatePods under releases[]
+  verify: true
+  wait: true
+  timeout: 600
+  recreatePods: true
+  force: true
+
+releases:
+  # Published chart example
+  - name: vault                            # name of this release
+    namespace: vault                       # target namespace
+    labels:                                  # Arbitrary key value pairs for filtering releases
+      foo: bar
+    chart: roboll/vault-secret-manager     # the chart being installed to create this release, referenced by `repository/chart` syntax
+    version: ~1.24.1                       # the semver of the chart. range constraint is supported
+    values:
+      # value files passed via --values
+      - vault.yaml
+      # inline values, passed via a temporary values file and --values
+      - address: https://vault.example.com
+        db:
+          username: {{ requiredEnv "DB_USERNAME" }}
+          # value taken from environment variable. Quotes are necessary. Will throw an error if the environment variable is not set. $DB_PASSWORD needs to be set in the calling environment ex: export DB_PASSWORD='password1'
+          password: {{ requiredEnv "DB_PASSWORD" }}
+        proxy:
+          # Interpolate environment variable with a fixed string
+          domain: {{ requiredEnv "PLATFORM_ID" }}.my-domain.com
+          scheme: {{ env "SCHEME" | default "https" }}
+    set:
+    # single value loaded from a local file, translates to --set-file foo.config=path/to/file
+    - name: foo.config
+      file: path/to/file
+    # set a single array value in an array, translates to --set bar[0]={1,2}
+    - name: bar[0]
+      values:
+      - 1
+      - 2
+    # set a templated value
+    - name: namespace
+      value: {{ .Namespace }}
+    # will attempt to decrypt it using helm-secrets plugin
+    secrets:
+      - vault_secret.yaml
+    # wait for k8s resources via --wait. Defaults to `false`
+    wait: true
+    # time in seconds to wait for any individual Kubernetes operation (like Jobs for hooks, and waits on pod/pvc/svc/deployment readiness) (default 300)
+    timeout: 60
+    # performs pods restart for the resource if applicable
+    recreatePods: true
+    # forces resource update through delete/recreate if needed
+    force: true
+    # set `false` to uninstall on sync
+    installed: true
+    # restores previous state in case of failed release
+    atomic: true
+
+  # Local chart example
+  - name: grafana                            # name of this release
+    namespace: another                       # target namespace
+    chart: ../my-charts/grafana              # the chart being installed to create this release, referenced by relative path to local helmfile
+    values:
+    - "../../my-values/grafana/values.yaml"             # Values file (relative path to manifest)
+    - ./values/{{ requiredEnv "PLATFORM_ENV" }}/config.yaml # Values file taken from path with environment variable. $PLATFORM_ENV must be set in the calling environment.
+    wait: true
 
 ```
 
-## install
+## Templating
 
-`go get github.com/roboll/helmfile` or [releases](https://github.com/roboll/helmfile/releases) or [container](https://quay.io/roboll/helmfile)
+Helmfile uses [Go templates](https://godoc.org/text/template) for templating your helmfile.yaml. While go ships several built-in functions, we have added all of the functions in the [Sprig library](https://godoc.org/github.com/Masterminds/sprig).
 
+We also added one special template function: `requiredEnv`.
+The `requiredEnv` function allows you to declare a particular environment variable as required for template rendering.
+If the environment variable is unset or empty, the template rendering will fail with an error message.
 
-## usage
+## Using environment variables
+
+Environment variables can be used in most places for templating the helmfile. Currently this is supported for `name`, `namespace`, `value` (in set), `values` and `url` (in repositories).
+
+Examples:
+
+```yaml
+respositories:
+- name: your-private-git-repo-hosted-charts
+  url: https://{{ requiredEnv "GITHUB_TOKEN"}}@raw.githubusercontent.com/kmzfs/helm-repo-in-github/master/
+```
+
+```yaml
+releases:
+  - name: {{ requiredEnv "NAME" }}-vault
+    namespace: {{ requiredEnv "NAME" }}
+    chart: roboll/vault-secret-manager
+    values:
+      - db:
+          username: {{ requiredEnv "DB_USERNAME" }}
+          password: {{ requiredEnv "DB_PASSWORD" }}
+    set:
+      - name: proxy.domain
+        value: {{ requiredEnv "PLATFORM_ID" }}.my-domain.com
+      - name: proxy.scheme
+        value: {{ env "SCHEME" | default "https" }}
+```
+
+## installation
+
+- download one of [releases](https://github.com/roboll/helmfile/releases) or
+- run as a [container](https://quay.io/roboll/helmfile) or
+- install from [AUR](https://aur.archlinux.org/packages/kubernetes-helmfile-bin/) for Archlinux or
+- Windows (using [scoop](https://scoop.sh/)): `scoop install helmfile`
+- macOS (using [homebrew](https://brew.sh/)): `brew install helmfile`
+
+## getting started
+
+Let's start with a simple `helmfile` and gradually improve it to fit your use-case!
+
+Suppose the `helmfile.yaml` representing the desired state of your helm releases looks like:
+
+```yaml
+releases:
+- name: prom-norbac-ubuntu
+  namespace: prometheus
+  chart: stable/prometheus
+  set:
+  - name: rbac.create
+    value: false
+```
+
+Sync your Kubernetes cluster state to the desired one by running:
+
+```console
+helmfile apply
+```
+
+Congratulations! You now have your first Prometheus deployment running inside your cluster.
+
+Iterate on the `helmfile.yaml` by referencing:
+
+- [Configuration syntax](#configuration-syntax)
+- [CLI reference](#cli-reference).
+- [Helmfile Best Practices Guide](https://github.com/roboll/helmfile/blob/master/docs/writing-helmfile.md)
+
+## cli reference
 
 ```
 NAME:
    helmfile -
 
 USAGE:
-   main [global options] command [command options] [arguments...]
-
-VERSION:
-   0.1.0
+   helmfile [global options] command [command options] [arguments...]
 
 COMMANDS:
-     repos   sync repositories from state file (helm repo add && helm repo update)
-     charts  sync charts from state file (helm repo upgrade --install)
-     sync    sync all resources from state file (repos && charts)
-     delete  delete charts from state file (helm delete)
+     repos     sync repositories from state file (helm repo add && helm repo update)
+     charts    sync releases from state file (helm upgrade --install)
+     diff      diff releases from state file against env (helm diff)
+     template  template releases from state file against env (helm template)
+     lint      lint charts from state file (helm lint)
+     sync      sync all resources from state file (repos, releases and chart deps)
+     apply     apply all resources from state file only when there are changes
+     status    retrieve status of releases in state file
+     delete    delete releases from state file (helm delete)
+     test      test releases from state file (helm test)
 
 GLOBAL OPTIONS:
-   --file FILE, -f FILE  load config from FILE (default: "charts.yaml")
-   --quiet, -q           silence output
-   --kube-context value  Set kubectl context. Uses current context by default
-   --help, -h            show help
-   --version, -v         print the version
+   --helm-binary value, -b value           path to helm binary
+   --file helmfile.yaml, -f helmfile.yaml  load config from file or directory. defaults to helmfile.yaml or `helmfile.d`(means `helmfile.d/*.yaml`) in this preference
+   --environment default, -e default       specify the environment name. defaults to default
+   --quiet, -q                             Silence output. Equivalent to log-level warn
+   --kube-context value                    Set kubectl context. Uses current context by default
+   --log-level value                       Set log level, default info
+   --namespace value, -n value             Set namespace. Uses the namespace set in the context by default, and is available in templates as {{ .Namespace }}
+   --selector value, -l value              Only run using the releases that match labels. Labels can take the form of foo=bar or foo!=bar.
+                                           A release must match all labels in a group in order to be used. Multiple groups can be specified at once.
+                                           --selector tier=frontend,tier!=proxy --selector tier=backend. Will match all frontend, non-proxy releases AND all backend releases.
+                                           The name of a release can be used as a label. --selector name=myrelease
+   --interactive, -i                       Request confirmation before attempting to modify clusters
+   --help, -h                              show help
+   --version, -v                           print the version
 ```
+
+### sync
+
+The `helmfile sync` sub-command sync your cluster state as described in your `helmfile`. The default helmfile is `helmfile.yaml`, but any yaml file can be passed by specifying a `--file path/to/your/yaml/file` flag.
+
+Under the covers, Helmfile executes `helm upgrade --install` for each `release` declared in the manifest, by optionally decrypting [secrets](#secrets) to be consumed as helm chart values. It also updates specified chart repositories and updates the
+dependencies of any referenced local charts.
+
+For Helm 2.9+ you can use a username and password to authenticate to a remote repository.
+
+### diff
+
+The `helmfile diff` sub-command executes the [helm-diff](https://github.com/databus23/helm-diff) plugin across all of
+the charts/releases defined in the manifest.
+
+To supply the diff functionality Helmfile needs the [helm-diff](https://github.com/databus23/helm-diff) plugin v2.9.0+1 or greater installed. For Helm 2.3+
+you should be able to simply execute `helm plugin install https://github.com/databus23/helm-diff`. For more details
+please look at their [documentation](https://github.com/databus23/helm-diff#helm-diff-plugin).
+
+### apply
+
+The `helmfile apply` sub-command begins by executing `diff`. If `diff` finds that there is any changes, `sync` is executed. Adding `--interactive` instructs Helmfile to request your confirmation before `sync`.
+
+An expected use-case of `apply` is to schedule it to run periodically, so that you can auto-fix skews between the desired and the current state of your apps running on Kubernetes clusters.
+
+### delete
+
+The `helmfile delete` sub-command deletes all the releases defined in the manifests.
+
+`helmfile --interactive delete` instructs Helmfile to request your confirmation before actually deleting releases.
+
+Note that `delete` doesn't purge releases. So `helmfile delete && helmfile sync` results in sync failed due to that releases names are not deleted but preserved for future references. If you really want to remove releases for reuse, add `--purge` flag to run it like `helmfile delete --purge`.
+
+### secrets
+
+The `secrets` parameter in a `helmfile.yaml` causes the [helm-secrets](https://github.com/futuresimple/helm-secrets) plugin to be executed to decrypt the file.
+
+To supply the secret functionality Helmfile needs the `helm secrets` plugin installed. For Helm 2.3+
+you should be able to simply execute `helm plugin install https://github.com/futuresimple/helm-secrets
+`.
+
+### test
+
+The `helmfile test` sub-command runs a `helm test` against specified releases in the manifest, default to all
+
+Use `--cleanup` to delete pods upon completion.
+
+### lint
+
+The `helmfile lint` sub-command runs a `helm lint` across all of the charts/releases defined in the manifest. Non local charts will be fetched into a temporary folder which will be deleted once the task is completed.
+
+## Paths Overview
+Using manifest files in conjunction with command line argument can be a bit confusing.
+
+A few rules to clear up this ambiguity:
+
+- Absolute paths are always resolved as absolute paths
+- Relative paths referenced *in* the Helmfile manifest itself are relative to that manifest
+- Relative paths referenced on the command line are relative to the current working directory the user is in
+
+For additional context, take a look at [paths examples](PATHS.md)
+
+## Labels Overview
+A selector can be used to only target a subset of releases when running Helmfile. This is useful for large helmfiles with releases that are logically grouped together.
+
+Labels are simple key value pairs that are an optional field of the release spec. When selecting by label, the search can be inverted. `tier!=backend` would match all releases that do NOT have the `tier: backend` label. `tier=fronted` would only match releases with the `tier: frontend` label.
+
+Multiple labels can be specified using `,` as a separator. A release must match all selectors in order to be selected for the final helm command.
+
+The `selector` parameter can be specified multiple times. Each parameter is resolved independently so a release that matches any parameter will be used.
+
+`--selector tier=frontend --selector tier=backend` will select all the charts
+
+In addition to user supplied labels the name, namespace, and chart are available to be used as selectors.  The chart will just be the chart name excluding the repository (Example `stable/filebeat` would be selected using `--selector chart=filebeat`).
+
+## Templates
+
+You can use go's text/template expressions in `helmfile.yaml` and `values.yaml.gotmpl` (templated helm values files). `values.yaml` references will be used verbatim. In other words:
+
+- for value files ending with `.gotmpl`, template expressions will be rendered
+- for plain value files (ending in `.yaml`), content will be used as-is
+
+In addition to built-in ones, the following custom template functions are available:
+
+- `readFile` reads the specified local file and generate a golang string
+- `fromYaml` reads a golang string and generates a map
+- `setValueAtPath PATH NEW_VALUE` traverses a golang map, replaces the value at the PATH with NEW_VALUE
+- `toYaml` marshals a map into a string
+
+### Values Files Templates
+
+You can reference a template of values file in your `helmfile.yaml` like below:
+
+```yaml
+releases
+- name: myapp
+  chart: mychart
+  values:
+  - values.yaml.gotmpl
+```
+
+Every values file whose file extension is `.gotmpl` is considered as a template file.
+
+Suppose `values.yaml.gotmpl` was something like:
+
+```yaml
+{{ readFile "values.yaml" | fromYaml | setValueAtPath "foo.bar" "FOO_BAR" | toYaml }}
+```
+
+And `values.yaml` was:
+
+```yaml
+foo:
+  bar: ""
+```
+
+The resulting, temporary values.yaml that is generated from `values.yaml.tpl` would become:
+
+```yaml
+foo:
+  # Notice `setValueAtPath "foo.bar" "FOO_BAR"` in the template above
+  bar: FOO_BAR
+```
+
+## Refactoring `helmfile.yaml` with values files templates
+
+One of expected use-cases of values files templates is to keep `helmfile.yaml` small and concise.
+
+See the example `helmfile.yaml` below:
+
+```yaml
+releases:
+  - name: {{ requiredEnv "NAME" }}-vault
+    namespace: {{ requiredEnv "NAME" }}
+    chart: roboll/vault-secret-manager
+    values:
+      - db:
+          username: {{ requiredEnv "DB_USERNAME" }}
+          password: {{ requiredEnv "DB_PASSWORD" }}
+    set:
+      - name: proxy.domain
+        value: {{ requiredEnv "PLATFORM_ID" }}.my-domain.com
+      - name: proxy.scheme
+        value: {{ env "SCHEME" | default "https" }}
+```
+
+The `values` and `set` sections of the config file can be separated out into a template:
+
+`helmfile.yaml`:
+
+```yaml
+releases:
+  - name: {{ requiredEnv "NAME" }}-vault
+    namespace: {{ requiredEnv "NAME" }}
+    chart: roboll/vault-secret-manager
+    values:
+    - values.yaml.tmpl
+```
+
+`values.yaml.tmpl`:
+
+```yaml
+db:
+  username: {{ requiredEnv "DB_USERNAME" }}
+  password: {{ requiredEnv "DB_PASSWORD" }}
+proxy:
+  domain: {{ requiredEnv "PLATFORM_ID" }}.my-domain.com
+  scheme: {{ env "SCHEME" | default "https" }}
+```
+
+## Environment
+
+When you want to customize the contents of `helmfile.yaml` or `values.yaml` files per environment, use this feature.
+
+You can define as many environments as you want under `environments` in `helmfile.yaml`.
+
+The environment name defaults to `default`, that is, `helmfile sync` implies the `default` environment.
+The selected environment name can be referenced from `helmfile.yaml` and `values.yaml.gotmpl` by `{{ .Environment.Name }}`.
+
+If you want to specify a non-default environment, provide a `--environment NAME` flag to `helmfile` like `helmfile --environment production sync`.
+
+The below example shows how to define a production-only release:
+
+```yaml
+environments:
+  default:
+  production:
+
+releases:
+
+{{ if eq .Environment.Name "production" }}
+- name: newrelic-agent
+  # snip
+{{ end }}
+- name: myapp
+  # snip
+```
+
+## Environment Values
+
+Environment Values allows you to inject a set of values specific to the selected environment, into values.yaml templates.
+Use it to inject common values from the environment to multiple values files, to make your configuration DRY.
+
+Suppose you have three files `helmfile.yaml`, `production.yaml` and `values.yaml.gotmpl`:
+
+`helmfile.yaml`
+
+```yaml
+environments:
+  production:
+    values:
+    - production.yaml
+
+releases:
+- name: myapp
+  values:
+  - values.yaml.gotmpl
+```
+
+`production.yaml`
+
+```yaml
+domain: prod.example.com
+releaseName: prod
+```
+
+`values.yaml.gotmpl`
+
+```yaml
+domain: {{ .Environment.Values | getOrNil "my.domain" | default "dev.example.com" }}
+```
+
+`helmfile sync` installs `myapp` with the value `domain=dev.example.com`,
+whereas `helmfile --environment production sync` installs the app with the value `domain=production.example.com`.
+
+For even more flexibility, you can now use values declared in the `environments:` section in other parts of your helmfiles:
+
+consider:
+`default.yaml`
+
+```yaml
+domain: dev.example.com
+releaseName: dev
+```
+
+```yaml
+environments:
+  default:
+    values:
+    - default.yaml
+  production:
+    values:
+    - production.yaml #  bare .yaml file, content will be used verbatim
+    - other.yaml.gotmpl  #  template directives with potential side-effects like `exec` and `readFile` will be honoured
+
+releases:
+- name: myapp-{{ .Environment.Values.releaseName }} # release name will be one of `dev` or `prod` depending on selected environment
+  values:
+  - values.yaml.gotmpl
+
+{{ if eq (.Environment.Values.releaseName "prod" ) }}
+# this release would be installed only if selected environment is `production`
+- name: production-specific-release
+  ...
+{{ end }}
+```
+
+## Environment Secrets
+
+Environment Secrets (not to be confused with Kubernetes Secrets) are encrypted versions of `Environment Values`.
+You can list any number of `secrets.yaml` files created using `helm secrets` or `sops`, so that
+Helmfile could automatically decrypt and merge the secrets into the environment values.
+
+First you must have the [helm-secrets](https://github.com/futuresimple/helm-secrets) plugin installed along with a
+`.sops.yaml` file to configure the method of encryption (this can be in the same directory as your helmfile or
+in the sub-directory containing your secrets files).
+
+Then suppose you have a a foo.bar secret defined in `environments/production/secrets.yaml`:
+```yaml
+foo.bar: "mysupersecretstring"
+```
+
+You can then encrypt it with `helm secrets enc environments/production/secrets.yaml`
+
+Then reference that encrypted file in `helmfile.yaml`:
+```yaml
+environments:
+  production:
+    secrets:
+    - environments/production/secrets.yaml
+
+releases:
+- name: myapp
+  chart: mychart
+  values:
+  - values.yaml.gotmpl
+```
+
+Then the environment secret `foo.bar` can be referenced by the below template expression in your `values.yaml.gotmpl`:
+
+```yaml
+{{ .Environment.Values.foo.bar }}
+```
+
+## Separating helmfile.yaml into multiple independent files
+
+Once your `helmfile.yaml` got to contain too many releases,
+split it into multiple yaml files.
+
+Recommended granularity of helmfile.yaml files is "per microservice" or "per team".
+And there are two ways to organize your files.
+
+- Single directory
+- Glob patterns
+
+### Single directory
+
+`helmfile -f path/to/directory` loads and runs all the yaml files under the specified directory, each file as an independent helmfile.yaml.
+The default helmfile directory is `helmfile.d`, that is,
+in case helmfile is unable to locate `helmfile.yaml`, it tries to locate `helmfile.d/*.yaml`.
+
+All the yaml files under the specified directory are processed in the alphabetical order. For example, you can use a `<two digit number>-<microservice>.yaml` naming convention to control the sync order.
+
+- `helmfile.d`/
+  - `00-database.yaml`
+  - `00-backend.yaml`
+  - `01-frontend.yaml`
+
+### Glob patterns
+
+In case you want more control over how multiple `helmfile.yaml` files are organized, use `helmfiles:` configuration key in the `helmfile.yaml`:
+
+Suppose you have multiple microservices organized in a Git repository that looks like:
+
+- `myteam/` (sometimes it is equivalent to a k8s ns, that is `kube-system` for `clusterops` team)
+  - `apps/`
+    - `filebeat/`
+      - `helmfile.yaml` (no `charts/` exists, because it depends on the stable/filebeat chart hosted on the official helm charts repository)
+      - `README.md` (each app managed by my team has a dedicated README maintained by the owners of the app)
+    - `metricbeat/`
+      - `helmfile.yaml`
+      - `README.md`
+    - `elastalert-operator/`
+      - `helmfile.yaml`
+      - `README.md`
+      - `charts/`
+        - `elastalert-operator/`
+          - `<the content of the local helm chart>`
+
+The benefits of this structure is that you can run `git diff` to locate in which directory=microservice a git commit has changes.
+It allows your CI system to run a workflow for the changed microservice only.
+
+A downside of this is that you don't have an obvious way to sync all microservices at once. That is, you have to run:
+
+```bash
+for d in apps/*; do helmfile -f $d diff; if [ $? -eq 2 ]; then helmfile -f $d sync; fi; done
+```
+
+At this point, you'll start writing a `Makefile` under `myteam/` so that `make sync-all` will do the job.
+
+It does work, but you can rely on the Helmfile feature instead.
+
+Put `myteam/helmfile.yaml` that looks like:
+
+```yaml
+helmfiles:
+- apps/*/helmfile.yaml
+```
+
+So that you can get rid of the `Makefile` and the bash snippet.
+Just run `helmfile sync` inside `myteam/`, and you are done.
+
+All the files are sorted alphabetically per group = array item inside `helmfiles:`, so that you have granular control over ordering, too.
+
+## Importing values from any source
+
+The `exec` template function that is available in `values.yaml.gotmpl` is useful for importing values from any source
+that is accessible by running a command:
+
+A usual usage of `exec` would look like this:
+
+```
+mysetting: |
+{{ exec "./mycmd" (list "arg1" "arg2" "--flag1") | indent 2 }}
+```
+
+Or even with a pipeline:
+
+```
+mysetting: |
+{{ yourinput | exec "./mycmd-consume-stdin" (list "arg1" "arg2") | indent 2 }}
+```
+
+The possibility is endless. Try importing values from your golang app, bash script, jsonnet, or anything!
+
+## Hooks
+
+A Helmfile hook is a per-release extension point that is composed of:
+
+- `events`
+- `command`
+- `args`
+
+Helmfile triggers various `events` while it is running.
+Once `events` are triggered, associated `hooks` are executed, by running the `command` with `args`.
+
+Currently supported `events` are:
+
+- `prepare`
+- `cleanup`
+
+Hooks associated to `prepare` events are triggered after each release in your helmfile is loaded from YAML, before execution.
+
+Hooks associated to `cleanup` events are triggered after each release is processed.
+
+The following is an example hook that just prints the contextual information provided to hook:
+
+```
+releases:
+- name: myapp
+  chart: mychart
+  # *snip*
+  hooks:
+  - events: ["prepare", "cleanup"]
+    command: "echo"
+    args: ["{{`{{.Environment.Name}}`}}", "{{`{{.Release.Name}}`}}", "{{`{{.HelmfileCommand}}`}}\
+"]
+```
+
+Let's say you ran `helmfile --environment prod sync`, the above hook results in executing:
+
+```
+echo {{Environment.Name}} {{.Release.Name}} {{.HelmfileCommand}}
+```
+
+Whereas the template expressions are executed thus the command becomes:
+
+```
+echo prod myapp sync
+```
+
+Now, replace `echo` with any command you like, and rewrite `args` that actually conforms to the command, so that you can integrate any command that does:
+
+- templating
+- linting
+- testing
+
+For templating, imagine that you created a hook that generates a helm chart on-the-fly by running an external tool like ksonnet, kustomize, or your own template engine.
+It will allow you to write your helm releases with any language you like, while still leveraging goodies provided by helm.
+
+### Helmfile + Kustomize
+
+Do you prefer `kustomize` to write and organize your Kubernetes apps, but still want to leverage helm's useful features
+like rollback, history, and so on? This section is for you!
+
+The combination of `hooks` and [helmify-kustomize](https://gist.github.com/mumoshu/f9d0bd98e0eb77f636f79fc2fb130690)
+enables you to integrate [kustomize](https://github.com/kubernetes-sigs/kustomize) into Helmfile.
+
+That is, you can use `kustommize` to build a local helm chart from a kustomize overlay.
+
+Let's assume you have a kustomize project named `foo-kustomize` like this:
+
+```
+foo-kustomize/
+├── base
+│   ├── configMap.yaml
+│   ├── deployment.yaml
+│   ├── kustomization.yaml
+│   └── service.yaml
+└── overlays
+    ├── default
+    │   ├── kustomization.yaml
+    │   └── map.yaml
+    ├── production
+    │   ├── deployment.yaml
+    │   └── kustomization.yaml
+    └── staging
+        ├── kustomization.yaml
+        └── map.yaml
+
+5 directories, 10 files
+```
+
+Write `helmfile.yaml`:
+
+```yaml
+- name: kustomize
+  chart: ./foo
+  hooks:
+  - events: ["prepare", "cleanup"]
+    command: "../helmify"
+    args: ["{{`{{if eq .Event.Name \"prepare\"}}build{{else}}clean{{end}}`}}", "{{`{{.Release.Ch\
+art}}`}}", "{{`{{.Environment.Name}}`}}"]
+```
+
+Run `helmfile --environment staging sync` and see it results in helmfile running `kustomize build foo-kustomize/overlays/staging > foo/templates/all.yaml`.
+
+Voilà! You can mix helm releases that are backed by remote charts, local charts, and even kustomize overlays.
+
+## Guides
+
+Use the [Helmfile Best Practices Guide](/docs/writing-helmfile.md) to write advanced helmfiles that feature:
+
+- Default values
+- Layering
+
+## Using env files
+
+Helmfile itself doesn't have an ability to load env files. But you can write some bash script to achieve the goal:
+
+```console
+set -a; . .env; set +a; helmfile sync
+```
+
+Please see #203 for more context.
+
+## Running helmfile interactively
+
+`helmfile --interactive [apply|delete]` requests confirmation from you before actually modifying your cluster.
+
+Use it when you're running `helmfile` manually on your local machine or a kind of secure administrative hosts.
+
+For your local use-case, aliasing it like `alias hi='helmfile --interactive'` would be convenient.
+
+## Running Helmfile without an Internet connection
+
+Once you download all required charts into your machine, you can run `helmfile charts` to deploy your apps.
+It basically run only `helm upgrade --install` with your already-downloaded charts, hence no Internet connection is required.
+See #155 for more information on this topic.
+
+
+## Examples
+
+For more examples, see the [examples/README.md](https://github.com/roboll/helmfile/blob/master/examples/README.md) or the [`helmfile`](https://github.com/cloudposse/helmfiles/tree/master/releases) distribution by [Cloud Posse](https://github.com/cloudposse/).
+
+# Attribution
+
+We use:
+
+- [semtag](https://github.com/pnikosis/semtag) for automated semver tagging. I greatly appreciate the author(pnikosis)'s effort on creating it and their kindness to share it!

USERS.md

@@ -0,0 +1,18 @@
+# Helmfile Users
+
+The following table is compiled from public information or from survey responses. If you are using Helmfile in your
+company or organization, we would like to invite you to [participate in our user survey](https://docs.google.com/forms/d/e/1FAIpQLSfrF5kR9nXsr5yWqNZGgN-KquM1mBTuYNn5lRmEVXEvhq0VIQ/viewform)
+to help us extend this list.
+
+<!-- TABLE_START -->
+| Organization | Workload | More Info | Location |
+|---|---|---|---|
+| [reddit.com](https://www.reddit.com/) | production | [GitHub issue](https://github.com/roboll/helmfile/issues/96#issue-312012249) | San Francisco, CA, US |
+| [ricardo.ch](https://www.ricardo.ch/) | proof-of-concept | | Zug, Switzerland |
+<!-- TABLE_END -->
+
+## Contact
+
+Please fill out [the Google form](https://docs.google.com/forms/d/e/1FAIpQLSfrF5kR9nXsr5yWqNZGgN-KquM1mBTuYNn5lRmEVXEvhq0VIQ/viewform) to add your organization instead of opening a PR.
+
+You can also [reach the maintainer on Twitter](https://twitter.com/DerCed).

args/args.go

@@ -0,0 +1,115 @@
+package args
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/roboll/helmfile/state"
+)
+
+type keyVal struct {
+	key       string
+	val       string
+	spaceFlag bool
+}
+type argMap struct {
+	//m map[string]string
+	m     map[string][]*keyVal
+	flags []string
+}
+
+func (a *argMap) SetArg(flag, arg string, isSpace bool) {
+	if _, exists := a.m[flag]; !exists {
+		keyarg := &keyVal{key: flag, val: arg, spaceFlag: isSpace}
+		a.m[flag] = append(a.m[flag], keyarg)
+		a.flags = append(a.flags, flag)
+	} else if flag == "--set" || flag == "-f" || flag == "--values" {
+		keyarg := &keyVal{key: flag, val: arg, spaceFlag: isSpace}
+		a.m[flag] = append(a.m[flag], keyarg)
+	}
+}
+
+func newArgMap() *argMap {
+	return &argMap{m: map[string][]*keyVal{}}
+}
+
+func GetArgs(args string, state *state.HelmState) []string {
+	argsMap := newArgMap()
+
+	if len(args) > 0 {
+		argsVals := strings.Split(args, " ")
+		for index, arg := range argsVals {
+			if strings.HasPrefix(arg, "--") {
+				argVal := strings.SplitN(arg, "=", 2)
+				if len(argVal) > 1 {
+					arg := argVal[0]
+					value := argVal[1]
+					argsMap.SetArg(arg, value, false)
+				} else {
+					//check if next value is arg to flag
+					if index+1 < len(argsVals) {
+						nextVal := argsVals[index+1]
+						if strings.HasPrefix(nextVal, "--") {
+							argsMap.SetArg(arg, "", false)
+						} else {
+							argsMap.SetArg(arg, nextVal, true)
+						}
+					} else {
+						argsMap.SetArg(arg, "", false)
+					}
+				}
+			}
+		}
+	}
+
+	if len(state.HelmDefaults.Args) > 0 {
+		for _, arg := range state.HelmDefaults.Args {
+			var flag string
+			var val string
+
+			argsNum, _ := fmt.Sscanf(arg, "--%s %s", &flag, &val)
+			if argsNum == 2 {
+				argsMap.SetArg(flag, val, true)
+			} else {
+				argVal := strings.SplitN(arg, "=", 2)
+				argFirst := argVal[0]
+				if len(argVal) > 1 {
+					val = argVal[1]
+					argsMap.SetArg(argFirst, val, false)
+				} else {
+					argsMap.SetArg(argFirst, "", false)
+				}
+			}
+		}
+	}
+
+	if state.HelmDefaults.TillerNamespace != "" {
+		argsMap.SetArg("--tiller-namespace", state.HelmDefaults.TillerNamespace, false)
+	}
+	if state.HelmDefaults.KubeContext != "" {
+		argsMap.SetArg("--kube-context", state.HelmDefaults.KubeContext, false)
+	}
+
+	var argArr []string
+
+	for _, flag := range argsMap.flags {
+		val := argsMap.m[flag]
+
+		for _, obj := range val {
+			if obj.val != "" {
+				if obj.spaceFlag {
+					argArr = append(argArr, obj.key, obj.val)
+				} else {
+					argArr = append(argArr, fmt.Sprintf("%s=%s", obj.key, obj.val))
+				}
+			} else {
+				argArr = append(argArr, fmt.Sprintf("%s", obj.key))
+			}
+		}
+
+	}
+
+	state.HelmDefaults.Args = argArr
+
+	return state.HelmDefaults.Args
+}

args/args_test.go

@@ -0,0 +1,46 @@
+package args
+
+import (
+	"strings"
+	"testing"
+
+	"github.com/roboll/helmfile/state"
+)
+
+func TestGetArgs(t *testing.T) {
+	args := "--timeout=3600 --set app1.bootstrap=true --set app2.bootstrap=false --tiller-namespace ns"
+	defaultArgs := []string{"--recreate-pods", "--force"}
+	Helmdefaults := state.HelmSpec{KubeContext: "test", TillerNamespace: "test-namespace", Args: defaultArgs}
+	testState := &state.HelmState{HelmDefaults: Helmdefaults}
+	receivedArgs := GetArgs(args, testState)
+
+	expectedOutput := "--timeout=3600 --set app1.bootstrap=true --set app2.bootstrap=false --tiller-namespace ns --recreate-pods --force --kube-context=test"
+
+	if compareArgs(expectedOutput, receivedArgs) == false {
+		t.Errorf("expected %s, got %s", expectedOutput, strings.Join(receivedArgs, " "))
+	}
+}
+
+func Test2(t *testing.T) {
+	args := "--timeout=3600 --set app1.bootstrap=true --set app2.bootstrap=false,app3.bootstrap=true --tiller-namespace ns"
+	defaultArgs := []string{"--recreate-pods", "--force"}
+	Helmdefaults := state.HelmSpec{KubeContext: "test", TillerNamespace: "test-namespace", Args: defaultArgs}
+	testState := &state.HelmState{HelmDefaults: Helmdefaults}
+	receivedArgs := GetArgs(args, testState)
+
+	expectedOutput := "--timeout=3600 --set app1.bootstrap=true --set app2.bootstrap=false,app3.bootstrap=true --tiller-namespace ns --recreate-pods --force --kube-context=test"
+
+	if compareArgs(expectedOutput, receivedArgs) == false {
+		t.Errorf("expected %s, got %s", expectedOutput, strings.Join(receivedArgs, " "))
+	}
+
+}
+
+func compareArgs(expectedArgs string, args []string) bool {
+
+	if strings.Compare(strings.Join(args, " "), expectedArgs) != 0 {
+		return false
+	}
+	return true
+
+}

ask.go

@@ -0,0 +1,33 @@
+package main
+
+import (
+	"bufio"
+	"fmt"
+	"log"
+	"os"
+	"strings"
+)
+
+// Copyright (c) 2017 Roland Singer [roland.singer@desertbit.com]
+//
+// Shamelessly borrowed from @r0l1's awesome work that is available at https://gist.github.com/r0l1/3dcbb0c8f6cfe9c66ab8008f55f8f28b
+func askForConfirmation(s string) bool {
+	reader := bufio.NewReader(os.Stdin)
+
+	for {
+		fmt.Printf("%s [y/n]: ", s)
+
+		response, err := reader.ReadString('\n')
+		if err != nil {
+			log.Fatal(err)
+		}
+
+		response = strings.ToLower(strings.TrimSpace(response))
+
+		if response == "y" || response == "yes" {
+			return true
+		} else if response == "n" || response == "no" {
+			return false
+		}
+	}
+}

circle.yml

@@ -1,32 +0,0 @@
-machine:
-  post:
-    - mkdir -p download
-    - test -e download/$GODIST || curl -o download/$GODIST https://storage.googleapis.com/golang/$GODIST
-    - sudo rm -rf /usr/local/go
-    - sudo tar -C /usr/local -xzf download/$GODIST
-  environment:
-    GODIST: "go1.7.linux-amd64.tar.gz"
-    GOPATH: "$HOME/go"
-    PATH: "$PATH:$GOPATH/bin"
-    WORK: "$GOPATH/src/github.com/$CIRCLE_PROJECT_USERNAME/$CIRCLE_PROJECT_REPONAME/"
-
-dependencies:
-  override:
-    - mkdir -p "$WORK"
-    - rsync -az --delete ./ "$WORK"
-
-test:
-  pre:
-    - cd "$WORK" && make check
-
-  override:
-    - cd "$WORK" && make test
-
-# GITHUB_TOKEN env var must be setup in circleci console
-deployment:
-  release:
-    tag: /v.*/
-    commands:
-      - docker login -e="." -u="$DOCKER_USER" -p="$DOCKER_PASS" quay.io
-      - cd "$WORK" && make tools
-      - cd "$WORK" && BUILD_URL="$CIRCLE_BUILD_URL" make push release

cmd/cmd.go

@@ -0,0 +1,100 @@
+package cmd
+
+import (
+	"fmt"
+	"github.com/roboll/helmfile/helmexec"
+	"github.com/roboll/helmfile/pkg/app"
+	"github.com/roboll/helmfile/state"
+	"github.com/urfave/cli"
+	"go.uber.org/zap"
+	"os/exec"
+	"strings"
+	"syscall"
+)
+
+func VisitAllDesiredStates(c *cli.Context, converge func(*state.HelmState, helmexec.Interface, app.Context) (bool, []error)) error {
+	a, fileOrDir, err := InitAppEntry(c, false)
+	if err != nil {
+		return err
+	}
+
+	ctx := app.NewContext()
+
+	convergeWithHelmBinary := func(st *state.HelmState, helm helmexec.Interface) (bool, []error) {
+		if c.GlobalString("helm-binary") != "" {
+			helm.SetHelmBinary(c.GlobalString("helm-binary"))
+		}
+		return converge(st, helm, ctx)
+	}
+
+	err = a.VisitDesiredStates(fileOrDir, convergeWithHelmBinary)
+
+	return toCliError(err)
+}
+
+func InitAppEntry(c *cli.Context, reverse bool) (*app.App, string, error) {
+	if c.NArg() > 0 {
+		cli.ShowAppHelp(c)
+		return nil, "", fmt.Errorf("err: extraneous arguments: %s", strings.Join(c.Args(), ", "))
+	}
+
+	fileOrDir := c.GlobalString("file")
+	kubeContext := c.GlobalString("kube-context")
+	namespace := c.GlobalString("namespace")
+	selectors := c.GlobalStringSlice("selector")
+	logger := c.App.Metadata["logger"].(*zap.SugaredLogger)
+
+	env := c.GlobalString("environment")
+	if env == "" {
+		env = state.DefaultEnv
+	}
+
+	app := app.Init(&app.App{
+		KubeContext: kubeContext,
+		Logger:      logger,
+		Reverse:     reverse,
+		Env:         env,
+		Namespace:   namespace,
+		Selectors:   selectors,
+	})
+
+	return app, fileOrDir, nil
+}
+
+func FindAndIterateOverDesiredStatesUsingFlagsWithReverse(c *cli.Context, reverse bool, converge func(*state.HelmState, helmexec.Interface, app.Context) []error) error {
+	a, fileOrDir, err := InitAppEntry(c, reverse)
+	if err != nil {
+		return err
+	}
+
+	ctx := app.NewContext()
+
+	convergeWithHelmBinary := func(st *state.HelmState, helm helmexec.Interface) []error {
+		if c.GlobalString("helm-binary") != "" {
+			helm.SetHelmBinary(c.GlobalString("helm-binary"))
+		}
+		return converge(st, helm, ctx)
+	}
+
+	err = a.VisitDesiredStatesWithReleasesFiltered(fileOrDir, convergeWithHelmBinary)
+
+	return toCliError(err)
+}
+
+func toCliError(err error) error {
+	if err != nil {
+		switch e := err.(type) {
+		case *app.NoMatchingHelmfileError:
+			return cli.NewExitError(e.Error(), 2)
+		case *exec.ExitError:
+			// Propagate any non-zero exit status from the external command like `helm` that is failed under the hood
+			status := e.Sys().(syscall.WaitStatus)
+			return cli.NewExitError(e.Error(), status.ExitStatus())
+		case *state.DiffError:
+			return cli.NewExitError(e.Error(), e.Code)
+		default:
+			return cli.NewExitError(e.Error(), 1)
+		}
+	}
+	return err
+}

cmd/deps.go

@@ -0,0 +1,37 @@
+package cmd
+
+import (
+	"github.com/roboll/helmfile/args"
+	"github.com/roboll/helmfile/helmexec"
+	"github.com/roboll/helmfile/pkg/app"
+	"github.com/roboll/helmfile/state"
+	"github.com/urfave/cli"
+)
+
+func Deps(a *app.App) cli.Command {
+	return cli.Command{
+		Name:  "deps",
+		Usage: "update charts based on the contents of requirements.yaml",
+		Flags: []cli.Flag{
+			cli.StringFlag{
+				Name:  "args",
+				Value: "",
+				Usage: "pass args to helm exec",
+			},
+		},
+		Action: func(c *cli.Context) error {
+			return VisitAllDesiredStates(c, func(state *state.HelmState, helm helmexec.Interface, ctx app.Context) (bool, []error) {
+				args := args.GetArgs(c.String("args"), state)
+				if len(args) > 0 {
+					helm.SetExtraArgs(args...)
+				}
+
+				errs := state.UpdateDeps(helm)
+
+				ok := len(errs) == 0
+
+				return ok, errs
+			})
+		},
+	}
+}

docs/writing-helmfile.md

@@ -0,0 +1,161 @@
+# The Helmfile Best Practices Guide
+
+This guide covers the Helmfile’s considered patterns for writing advanced helmfiles. It focuses on how helmfile should be structured and executed.
+
+## Missing keys and Default values
+
+helmfile tries its best to inform users for noticing potential mistakes.
+
+One example of how helmfile achieves it is that, `helmfile` fails when you tried to access missing keys in environment values.
+
+That is, the following example let `helmfile` fail when you have no `eventApi.replicas` defined in environment values.
+
+```
+{{ .Environment.Values.eventApi.replicas | default 1 }}
+```
+
+In case it isn't a mistake and you do want to allow missing keys, use the `getOrNil` template function:
+
+```
+{{ .Environment.Values | getOrNil "eventApi.replicas" }}
+```
+
+This result in printing `<no value` in your template, that may or may not result in a failure.
+
+If you want a kind of default values that is used when a missing key was referenced, use `default` like:
+
+```
+{{ .Environment.Values | getOrNil "eventApi.replicas" | default 1 }}
+```
+
+Now, you get `1` when there is no `eventApi.replicas` defined in environment values.
+
+## Release Template / Conventional Directory Structure
+
+Introducing helmfile into a large-scale project that involes dozens of releases often results in a lot of repetitions in `helmfile.yaml` files.
+
+The example below shows repetitions in `namespace`, `chart`, `values`, and `secrets`:
+
+```yaml
+releases:
+# *snip*
+- name: heapster
+  namespace: kube-system
+  chart: stable/heapster
+  version: 0.3.2
+  values:
+  - "./config/heapster/values.yaml"
+  - "./config/heapster/{{ .Environment.Name }}.yaml"
+  secrets:
+  - "./config/heapster/secrets.yaml"
+  - "./config/heapster/{{ .Environment.Name }}-secrets.yaml"
+
+- name: kubernetes-dashboard
+  namespace: kube-system
+  chart: stable/kubernetes-dashboard
+  version: 0.10.0
+  values:
+  - "./config/kubernetes-dashboard/values.yaml"
+  - "./config/kubernetes-dashboard/{{ .Environment.Name }}.yaml"
+  values:
+  - "./config/kubernetes-dashboard/secrets.yaml"
+  - "./config/kubernetes-dashboard/{{ .Environment.Name }}-secrets.yaml"
+```
+
+This is where Helmfile's advanced feature called Release Template comes handy.
+
+It allows you to abstract away the repetitions in releases into a template, which is then included and executed by using YAML anchor/alias:
+
+```yaml
+templates:
+  default: &default
+    chart: stable/{{`{{ .Release.Name }}`}}
+    namespace: kube-system
+    # This prevents helmfile exiting when it encounters a missing file
+    # Valid values are "Error", "Warn", "Info", "Debug". The default is "Error"
+    # Use "Debug" to make missing files errors invisible at the default log level(--log-level=INFO)
+    missingFileHandler: Warn
+    values:
+    - config/{{`{{ .Release.Name }}`}}/values.yaml
+    - config/{{`{{ .Release.Name }}`}}/{{`{{ .Environment.Name }}`}}.yaml
+    secrets:
+    - config/{{`{{ .Release.Name }}`}}/secrets.yaml
+    - config/{{`{{ .Release.Name }}`}}/{{`{{ .Environment.Name }}`}}-secrets.yaml
+
+releases:
+- name: heapster
+  <<: *default
+- name: kubernetes-dashboard
+  <<: *default
+```
+
+See the [issue 428](https://github.com/roboll/helmfile/issues/428) for more context on how this is supposed to work.
+
+## Layering
+
+You may occasionally end up with many helmfiles that shares common parts like which repositories to use, and whichi release to be bundled by default.
+
+Use Layering to extract the common parts into a dedicated *library helmfile*s, so that each helmfile becomes DRY.
+
+Let's assume that your `helmfile.yaml` looks like:
+
+```
+{ readFile "commons.yaml" }}
+---
+{{ readFile "environments.yaml" }}
+---
+releases:
+- name: myapp
+  chart: mychart
+```
+
+Whereas `commons.yaml` contained a monitoring agent:
+
+```yaml
+releases:
+- name: metricbaet
+  chart: stable/metricbeat
+```
+
+And `environments.yaml` contained well-known environments:
+
+```yaml
+environments:
+  development:
+  production:
+```
+
+At run time, template expressions in your `helmfile.yaml` are executed:
+
+```yaml
+releases:
+- name: metricbaet
+  chart: stable/metricbeat
+---
+environments:
+  development:
+  production:
+---
+releases:
+- name: myapp
+  chart: mychart
+```
+
+Resulting YAML documents are merged in the order of occurrence,
+so that your `helmfile.yaml` becomes:
+
+```yaml
+environments:
+  development:
+  production:
+
+releases:
+- name: metricbaet
+  chart: stable/metricbeat
+- name: myapp
+  chart: mychart
+```
+
+Great!
+
+Now, repeat the above steps for each your `helmfile.yaml`, so that all your helmfiles becomes DRY.

environment/environment.go

@@ -0,0 +1,8 @@
+package environment
+
+type Environment struct {
+	Name   string
+	Values map[string]interface{}
+}
+
+var EmptyEnvironment Environment

event/bus.go

@@ -0,0 +1,102 @@
+package event
+
+import (
+	"fmt"
+	"github.com/roboll/helmfile/environment"
+	"github.com/roboll/helmfile/helmexec"
+	"github.com/roboll/helmfile/tmpl"
+	"go.uber.org/zap"
+	"os"
+)
+
+type Hook struct {
+	Name    string   `yaml:"name"`
+	Events  []string `yaml:"events"`
+	Command string   `yaml:"command"`
+	Args    []string `yaml:"args"`
+}
+
+type event struct {
+	Name string
+}
+
+type Bus struct {
+	Runner helmexec.Runner
+	Hooks  []Hook
+
+	BasePath      string
+	StateFilePath string
+	Namespace     string
+
+	Env environment.Environment
+
+	ReadFile func(string) ([]byte, error)
+	Logger   *zap.SugaredLogger
+}
+
+func (bus *Bus) Trigger(evt string, context map[string]interface{}) (bool, error) {
+	if bus.Runner == nil {
+		bus.Runner = helmexec.ShellRunner{
+			Dir: bus.BasePath,
+		}
+	}
+
+	executed := false
+
+	for _, hook := range bus.Hooks {
+		contained := false
+		for _, e := range hook.Events {
+			contained = contained || e == evt
+		}
+		if !contained {
+			continue
+		}
+
+		var err error
+
+		name := hook.Name
+		if name == "" {
+			name = hook.Command
+		}
+
+		fmt.Fprintf(os.Stderr, "%s: basePath=%s\n", bus.StateFilePath, bus.BasePath)
+
+		data := map[string]interface{}{
+			"Environment": bus.Env,
+			"Namespace":   bus.Namespace,
+			"Event": event{
+				Name: evt,
+			},
+		}
+		for k, v := range context {
+			data[k] = v
+		}
+		render := tmpl.NewTextRenderer(bus.ReadFile, bus.BasePath, data)
+
+		bus.Logger.Debugf("hook[%s]: triggered by event \"%s\"\n", name, evt)
+
+		command, err := render.RenderTemplateText(hook.Command)
+		if err != nil {
+			return false, fmt.Errorf("hook[%s]: %v", name, err)
+		}
+
+		args := make([]string, len(hook.Args))
+		for i, raw := range hook.Args {
+			args[i], err = render.RenderTemplateText(raw)
+			if err != nil {
+				return false, fmt.Errorf("hook[%s]: %v", name, err)
+			}
+		}
+
+		bytes, err := bus.Runner.Execute(command, args)
+		bus.Logger.Debugf("hook[%s]: %s\n", name, string(bytes))
+
+		if err != nil {
+			return false, fmt.Errorf("hook[%s]: command `%s` failed: %v", name, command, err)
+		}
+
+		executed = true
+	}
+
+	return executed, nil
+}

event/bus_test.go

@@ -0,0 +1,113 @@
+package event
+
+import (
+	"fmt"
+	"github.com/roboll/helmfile/environment"
+	"github.com/roboll/helmfile/helmexec"
+	"os"
+	"testing"
+)
+
+var logger = helmexec.NewLogger(os.Stdout, "warn")
+
+type runner struct {
+}
+
+func (r *runner) Execute(cmd string, args []string) ([]byte, error) {
+	if cmd == "ng" {
+		return nil, fmt.Errorf("cmd failed due to invalid cmd: %s", cmd)
+	}
+	for _, a := range args {
+		if a == "ng" {
+			return nil, fmt.Errorf("cmd failed due to invalid arg: %s", a)
+		}
+	}
+	return []byte(""), nil
+}
+
+func TestTrigger(t *testing.T) {
+	cases := []struct {
+		name           string
+		hook           *Hook
+		triggeredEvt   string
+		expectedResult bool
+		expectedErr    string
+	}{
+		{
+			"okhook1",
+			&Hook{"okhook1", []string{"foo"}, "ok", []string{}},
+			"foo",
+			true,
+			"",
+		},
+		{
+			"missinghook1",
+			&Hook{"okhook1", []string{"foo"}, "ok", []string{}},
+			"bar",
+			false,
+			"",
+		},
+		{
+			"nohook1",
+			nil,
+			"bar",
+			false,
+			"",
+		},
+		{
+			"nghook1",
+			&Hook{"nghook1", []string{"foo"}, "ng", []string{}},
+			"foo",
+			false,
+			"hook[nghook1]: command `ng` failed: cmd failed due to invalid cmd: ng",
+		},
+		{
+			"nghook2",
+			&Hook{"nghook2", []string{"foo"}, "ok", []string{"ng"}},
+			"foo",
+			false,
+			"hook[nghook2]: command `ok` failed: cmd failed due to invalid arg: ng",
+		},
+	}
+	readFile := func(filename string) ([]byte, error) {
+		return nil, fmt.Errorf("unexpected call to readFile: %s", filename)
+	}
+	for _, c := range cases {
+		hooks := []Hook{}
+		if c.hook != nil {
+			hooks = append(hooks, *c.hook)
+		}
+		bus := &Bus{
+			Hooks:         hooks,
+			StateFilePath: "path/to/helmfile.yaml",
+			BasePath:      "path/to",
+			Namespace:     "myns",
+			Env:           environment.Environment{Name: "prod"},
+			Logger:        logger,
+			ReadFile:      readFile,
+		}
+
+		bus.Runner = &runner{}
+		data := map[string]interface{}{
+			"Release":         "myrel",
+			"HelmfileCommand": "mycmd",
+		}
+		ok, err := bus.Trigger(c.triggeredEvt, data)
+
+		if ok != c.expectedResult {
+			t.Errorf("unexpected result for case \"%s\": expected=%v, actual=%v", c.name, c.expectedResult, ok)
+		}
+
+		if c.expectedErr != "" {
+			if err == nil {
+				t.Error("error expected, but not occurred")
+			} else if err.Error() != c.expectedErr {
+				t.Errorf("unexpected error for case \"%s\": expected=%s, actual=%v", c.name, c.expectedErr, err)
+			}
+		} else {
+			if err != nil {
+				t.Errorf("unexpected error for case \"%s\": %v", c.name, err)
+			}
+		}
+	}
+}

examples/README.md

@@ -0,0 +1,35 @@
+# Helmfile practical examples and advanced usages
+
+## Managing oneshot-jobs with Helmfile
+
+In case you want to manage oneshot-jobs like a report generation or a database migration and so on, add a dedicated release spec for the job in `helmfile.yaml` like:
+
+```yaml
+repositories:
+  - name: yourorg
+    url: https://yourorg.example.com/charts
+
+releases:
+  - name: dbmigrator
+    labels:
+      job: dbmigrator
+    chart: ./dbmigrator
+    # DB host, port, and connection opts for the environment
+    values:
+    - "deploy/environments/{{ env "RAILS_ENV" }}/values.yaml"
+    # DB username and password encrypted with helm-secrets(mozilla/sops)
+    secrets:
+    - "deploy/environments/{{ env "RAILS_ENV" }}/secrets.yaml"
+```
+
+You would then start a database migration job by executing:
+
+```console
+# Start a database migration for the prod environment
+$ RAILS_ENV=prod helmfile sync --selector job=dbmigrator
+
+# Tail log until you are satisfied
+$ kubectl logs -l job=dbmigrator
+```
+
+For more context, see [this issue](https://github.com/roboll/helmfile/issues/49).

examples/charts/paths-example/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

examples/charts/paths-example/Chart.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+description: demonstration of local file path references in Helmfile
+name: paths-example
+version: 0.1.0

examples/charts/paths-example/templates/_helpers.tpl

@@ -0,0 +1,16 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}

examples/charts/paths-example/templates/deployment.yaml

@@ -0,0 +1,37 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: {{ template "fullname" . }}
+  labels:
+    app: {{ template "name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  replicas: {{ .Values.replicaCount }}
+  template:
+    metadata:
+      labels:
+        app: {{ template "name" . }}
+        release: {{ .Release.Name }}
+    spec:
+      containers:
+        - name: {{ .Chart.Name }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - containerPort: {{ .Values.service.internalPort }}
+          livenessProbe:
+            httpGet:
+              path: /
+              port: {{ .Values.service.internalPort }}
+          readinessProbe:
+            httpGet:
+              path: /
+              port: {{ .Values.service.internalPort }}
+          resources:
+{{ toYaml .Values.resources | indent 12 }}
+    {{- if .Values.nodeSelector }}
+      nodeSelector:
+{{ toYaml .Values.nodeSelector | indent 8 }}
+    {{- end }}

examples/charts/paths-example/templates/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "fullname" . }}
+  labels:
+    app: {{ template "name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.externalPort }}
+      targetPort: {{ .Values.service.internalPort }}
+      protocol: TCP
+      name: {{ .Values.service.name }}
+  selector:
+    app: {{ template "name" . }}
+    release: {{ .Release.Name }}

examples/charts/paths-example/values.yaml

@@ -0,0 +1,13 @@
+# Default values for paths-example.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+replicaCount: 1
+image:
+  repository: nginx
+  tag: stable
+  pullPolicy: IfNotPresent
+service:
+  name: nginx
+  type: ClusterIP
+  externalPort: 80
+  internalPort: 80

examples/deployments/dev/charts.yaml

@@ -0,0 +1,6 @@
+charts:
+  - name: dev-paths-example
+    namespace: dev
+    chart: ../../charts/paths-example/
+    values:
+    - ../../values/dev/paths-example/values.yaml # Values file (relative path to manifest)

examples/deployments/local/charts.yaml

@@ -0,0 +1,6 @@
+charts:
+  - name: local-paths-example
+    namespace: local
+    chart: ../../charts/paths-example/
+    values:
+    - values.yaml # Values file (relative path to manifest)

examples/deployments/local/values.yaml

@@ -0,0 +1,2 @@
+# Dev specific overrides
+nameOverride: local-nginx

examples/deployments/prod/charts.yaml

@@ -0,0 +1,6 @@
+charts:
+  - name: prod-paths-example
+    namespace: prod
+    chart: ../../charts/paths-example/
+    values:
+    - ../../values/prod/paths-example/values.yaml # Values file (relative path to manifest)

examples/deployments/published/charts.yaml

@@ -0,0 +1,5 @@
+charts:
+  # Published chart example
+  - name: grafana                         # helm release name
+    namespace: grafana                    # target namespace
+    chart: stable/grafana                 # chart reference (repository)

examples/values/dev/paths-example/values.yaml

@@ -0,0 +1,2 @@
+# Dev specific overrides
+nameOverride: dev-nginx

examples/values/prod/paths-example/values.yaml

@@ -0,0 +1,2 @@
+# Prod specific overrides
+nameOverride: prod-nginx

examples/values/replica-values.yaml

@@ -0,0 +1,2 @@
+# Example used to override value explicitly via CLI
+replicaCount: 3

hack/semtag

@@ -0,0 +1,623 @@
+#!/usr/bin/env bash
+
+PROG=semtag
+PROG_VERSION="v0.1.0"
+
+SEMVER_REGEX="^v?(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(\-[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?(\+[0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*)?$"
+IDENTIFIER_REGEX="^\-([0-9A-Za-z-]+)\.([0-9A-Za-z-]+)*$"
+
+# Global variables
+FIRST_VERSION="v0.0.0"
+finalversion=$FIRST_VERSION
+lastversion=$FIRST_VERSION
+hasversiontag="false"
+scope="patch"
+displayonly="false"
+forcetag="false"
+forcedversion=
+versionname=
+identifier=
+
+HELP="\
+Usage:
+  $PROG
+  $PROG getlast
+  $PROG getfinal
+  $PROG (final|alpha|beta|candidate) [-s <scope> (major|minor|patch|auto) | -o]
+  $PROG --help
+  $PROG --version
+Options:
+  -s         The scope that must be increased, can be major, minor or patch.
+               The resulting version will match X.Y.Z(-PRERELEASE)(+BUILD)
+               where X, Y and Z are positive integers, PRERELEASE is an optionnal
+               string composed of alphanumeric characters describing if the build is
+               a release candidate, alpha or beta version, with a number.
+               BUILD is also an optional string composed of alphanumeric
+               characters and hyphens.
+               Setting the scope as 'auto', the script will chose the scope between
+               'minor' and 'patch', depending on the amount of lines added (<10% will
+               choose patch).
+  -v         Specifies manually the version to be tagged, must be a valid semantic version
+               in the format X.Y.Z where X, Y and Z are positive integers.
+  -o         Output the version only, shows the bumped version, but doesn't tag.
+  -f         Forces to tag, even if there are unstaged or uncommited changes.
+Commands:
+  --help     Print this help message.
+  --version  Prints the program's version.
+  get        Returns both current final version and last tagged version.
+  getlast    Returns the latest tagged version.
+  getfinal   Returns the latest tagged final version.
+  getcurrent Returns the current version, based on the latest one, if there are uncommited or
+               unstaged changes, they will be reflected in the version, adding the number of
+               pending commits, current branch and commit hash.
+  final      Tags the current build as a final version, this only can be done on the master branch.
+  candidate  Tags the current build as a release candidate, the tag will contain all
+               the commits from the last final version.
+  alpha      Tags the current build as an alpha version, the tag will contain all
+               the commits from the last final version.
+  beta       Tags the current build as a beta version, the tag will contain all
+               the commits from the last final version."
+
+# Commands and options
+ACTION="getlast"
+ACTION="$1"
+shift
+
+# We get the parameters
+while getopts "v:s:of" opt; do
+  case $opt in
+    v)
+      forcedversion="$OPTARG"
+      ;;
+    s)
+      scope="$OPTARG"
+      ;;
+    o)
+      displayonly="true"
+      ;;
+    f)
+      forcetag="true"
+      ;;
+    \?)
+      echo "Invalid option: -$OPTARG" >&2
+      exit 1
+      ;;
+    :)
+      echo "Option -$OPTARG requires an argument." >&2
+      exit 1
+      ;;
+  esac
+done
+
+# Gets a string with the version and returns an array of maximum size of 5 with all the parts of the sematinc version
+# $1 The string containing the version in semantic format
+# $2 The variable to store the result array:
+#      position 0: major number
+#      position 1: minor number
+#      position 2: patch number
+#      position 3: identifier (or prerelease identifier)
+#      position 4: build info
+function explode_version {
+  local __version=$1
+  local __result=$2
+  if [[ $__version =~ $SEMVER_REGEX ]] ; then
+    local __major=${BASH_REMATCH[1]}
+    local __minor=${BASH_REMATCH[2]}
+    local __patch=${BASH_REMATCH[3]}
+    local __prere=${BASH_REMATCH[4]}
+    local __build=${BASH_REMATCH[5]}
+    eval "$__result=(\"$__major\" \"$__minor\" \"$__patch\" \"$__prere\" \"$__build\")"
+  else
+    eval "$__result="
+  fi
+}
+
+# Compare two versions and returns -1, 0 or 1
+# $1 The first version to compare
+# $2 The second version to compare
+# $3 The variable where to store the result
+function compare_versions {
+  local __first
+  local __second
+  explode_version $1 __first
+  explode_version $2 __second
+  local lv=$3
+
+  # Compares MAJOR, MINOR and PATCH
+  for i in 0 1 2; do
+    local __numberfirst=${__first[$i]}
+    local __numbersecond=${__second[$i]}
+    case $(($__numberfirst - $__numbersecond)) in
+      0)
+        ;;
+      -[0-9]*)
+        eval "$lv=-1"
+        return 0
+        ;;
+      [0-9]*)
+        eval "$lv=1"
+        return 0
+        ;;
+    esac
+  done
+
+  # Identifiers should compare with the ASCII order.
+  local __identifierfirst=${__first[3]}
+  local __identifiersecond=${__second[3]}
+  if [[ -n "$__identifierfirst" ]] && [[ -n "$__identifiersecond" ]]; then
+    if [[ "$__identifierfirst" > "$__identifiersecond" ]]; then
+      eval "$lv=1"
+      return 0
+    elif [[ "$__identifierfirst" < "$__identifiersecond" ]]; then
+      eval "$lv=-1"
+      return 0
+    fi
+  elif [[ -z "$__identifierfirst" ]] && [[ -n "$__identifiersecond" ]]; then
+    eval "$lv=1"
+    return 0
+  elif [[ -n "$__identifierfirst" ]] && [[ -z "$__identifiersecond" ]]; then
+    eval "$lv=-1"
+    return 0
+  fi
+
+  eval "$lv=0"
+}
+
+# Returns the last version of two
+# $1 The first version to compare
+# $2 The second version to compare
+# $3 The variable where to store the last one
+function get_latest_of_two {
+  local __first=$1
+  local __second=$2
+  local __result
+  local __latest=$3
+  compare_versions $__first $__second __result
+  case $__result in
+    0)
+      eval "$__latest=$__second"
+      ;;
+    -1)
+      eval "$__latest=$__second"
+      ;;
+    1)
+      eval "$__latest=$__first"
+      ;;
+  esac
+}
+
+# Assigns a 2 size array with the identifier, having the identifier at pos 0, and the number in pos 1
+# $1 The identifier in the format -id.#
+# $2 The vferiable where to store the 2 size array
+function explode_identifier {
+  local __identifier=$1
+  local __result=$2
+  if [[ $__identifier =~ $IDENTIFIER_REGEX ]] ; then
+    local __id=${BASH_REMATCH[1]}
+    local __number=${BASH_REMATCH[2]}
+    if [[ -z "$__number" ]]; then
+      __number=1
+    fi
+    eval "$__result=(\"$__id\" \"$__number\")"
+  else
+    eval "$__result="
+  fi
+}
+
+# Gets a list of tags and assigns the base and latest versions
+# Receives an array with the tags containing the versions
+# Assigns to the global variables finalversion and lastversion the final version and the latest version
+function get_latest {
+  local __taglist=("$@")
+  local __tagsnumber=${#__taglist[@]}
+  local __current
+  case $__tagsnumber in
+    0)
+      finalversion=$FIRST_VERSION
+      lastversion=$FIRST_VERSION
+      ;;
+    1)
+      __current=${__taglist[0]}
+      explode_version $__current ver
+      if [ -n "$ver" ]; then
+        if [ -n "${ver[3]}" ]; then
+          finalversion=$FIRST_VERSION
+        else
+          finalversion=$__current
+        fi
+        lastversion=$__current
+      else
+        finalversion=$FIRST_VERSION
+        lastversion=$FIRST_VERSION
+      fi
+      ;;
+    *)
+      local __lastpos=$(($__tagsnumber-1))
+      for i in $(seq 0 $__lastpos)
+      do
+        __current=${__taglist[i]}
+        explode_version ${__taglist[i]} ver
+        if [ -n "$ver" ]; then
+          if [ -z "${ver[3]}" ]; then
+            get_latest_of_two $finalversion $__current finalversion
+            get_latest_of_two $lastversion $finalversion lastversion
+          else
+            get_latest_of_two $lastversion $__current lastversion
+          fi
+        fi
+      done
+      ;;
+  esac
+
+  if git rev-parse -q --verify "refs/tags/$lastversion" >/dev/null; then
+    hasversiontag="true"
+  else
+    hasversiontag="false"
+  fi
+}
+
+# Gets the next version given the provided scope
+# $1 The version that is going to be bumped
+# $2 The scope to bump
+# $3 The variable where to stoer the result
+function get_next_version {
+  local __exploded
+  local __fromversion=$1
+  local __scope=$2
+  local __result=$3
+  explode_version $__fromversion __exploded
+  case $__scope in
+    major)
+      __exploded[0]=$((${__exploded[0]}+1))
+      __exploded[1]=0
+      __exploded[2]=0
+    ;;
+    minor)
+      __exploded[1]=$((${__exploded[1]}+1))
+      __exploded[2]=0
+    ;;
+    patch)
+      __exploded[2]=$((${__exploded[2]}+1))
+    ;;
+  esac
+
+  eval "$__result=v${__exploded[0]}.${__exploded[1]}.${__exploded[2]}"
+}
+
+function bump_version {
+  ## First we try to get the next version based on the existing last one
+  if [ "$scope" == "auto" ]; then
+    get_scope_auto scope
+  fi
+
+  local __candidatefromlast=$FIRST_VERSION
+  local __explodedlast
+  explode_version $lastversion __explodedlast
+  if [[ -n "${__explodedlast[3]}" ]]; then
+    # Last version is not final
+    local __idlast
+    explode_identifier ${__explodedlast[3]} __idlast
+    
+    # We get the last, given the desired id based on the scope
+    __candidatefromlast="v${__explodedlast[0]}.${__explodedlast[1]}.${__explodedlast[2]}"
+    if [[ -n "$identifier" ]]; then
+      local __nextid="$identifier.1"
+      if [ "$identifier" == "${__idlast[0]}" ]; then
+        # We target the same identifier as the last so we increase one
+        __nextid="$identifier.$(( ${__idlast[1]}+1 ))"
+        __candidatefromlast="$__candidatefromlast-$__nextid"
+      else
+        # Different identifiers, we make sure we are assigning a higher identifier, if not, we increase the version
+        __candidatefromlast="$__candidatefromlast-$__nextid"
+        local __comparedwithlast
+        compare_versions $__candidatefromlast $lastversion __comparedwithlast
+        if [ "$__comparedwithlast" == -1 ]; then
+          get_next_version $__candidatefromlast $scope __candidatefromlast
+          __candidatefromlast="$__candidatefromlast-$__nextid"
+        fi
+      fi
+    fi
+  fi
+
+  # Then we try to get the version based on the latest final one
+  local __candidatefromfinal=$FIRST_VERSION
+  get_next_version $finalversion $scope __candidatefromfinal
+  if [[ -n "$identifier" ]]; then
+    __candidatefromfinal="$__candidatefromfinal-$identifier.1"
+  fi
+
+  # Finally we compare both candidates
+  local __resultversion
+  local __result
+  compare_versions $__candidatefromlast $__candidatefromfinal __result
+  case $__result in
+    0)
+      __resultversion=$__candidatefromlast
+      ;;
+    -1)
+      __resultversion="$__candidatefromfinal"
+      ;;
+    1)
+      __resultversion=$__candidatefromlast
+      ;;
+  esac
+
+  eval "$1=$__resultversion"
+}
+
+function increase_version {
+  local __version=
+
+  if [ -z $forcedversion ]; then
+    bump_version __version
+  else
+    if [[ $forcedversion =~ $SEMVER_REGEX ]] ; then
+      compare_versions $forcedversion $lastversion __result
+      if [ $__result -le 0 ]; then
+        echo "Version can't be lower than last version: $lastversion"
+        exit 1
+      fi
+    else
+      echo "Non valid version to bump"
+      exit 1
+    fi
+    __version=$forcedversion
+  fi
+
+  if [ "$displayonly" == "true" ]; then
+    echo "$__version"
+  else
+    if [ "$forcetag" == "false" ]; then
+      check_git_dirty_status
+    fi
+    local __commitlist
+    if [ "$finalversion" == "$FIRST_VERSION" ] || [ "$hasversiontag" != "true" ]; then
+      __commitlist="$(git log --pretty=oneline | cat)"
+    else
+      __commitlist="$(git log --pretty=oneline $finalversion... | cat)"
+    fi
+
+    # If we are forcing a bump, we add bump to the commit list
+    if [[ -z $__commitlist && "$forcetag" == "true" ]]; then
+      __commitlist="bump"
+    fi
+
+    if [[ -z $__commitlist ]]; then
+      echo "No commits since the last final version, not bumping version"
+    else
+      if [[ -z $versionname ]]; then
+        versionname=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+      fi
+      local __message="$versionname
+$__commitlist"
+
+      # We check we have info on the user
+      local __username=$(git config user.name)
+      if [ -z "$__username" ]; then
+        __username=$(id -u -n)
+        git config user.name $__username
+      fi
+      local __useremail=$(git config user.email)
+      if [ -z "$__useremail" ]; then
+        __useremail=$(hostname)
+        git config user.email "$__username@$__useremail"
+      fi
+
+      git tag -a $__version -m "$__message" 
+
+      # If we have a remote, we push there
+      local __remote=${SEMTAG_REMOTE:-$(git remote)}
+      if [[ -n $__remote ]]; then
+        git push $__remote $__version > /dev/null
+        if [ $? -eq 0 ]; then
+          echo "$__version"
+        else
+          echo "Error pushing the tag $__version to $__remote"
+          exit 1
+        fi
+      else
+        echo "$__version"
+      fi
+    fi
+  fi
+}
+
+function check_git_dirty_status {
+  local __repostatus=
+  get_work_tree_status __repostatus
+
+  if [ "$__repostatus" == "uncommitted" ]; then
+    echo "ERROR: You have uncommitted changes"
+    git status --porcelain
+    exit 1
+  fi
+
+  if [ "$__repostatus" == "unstaged" ]; then
+    echo "ERROR: You have unstaged changes"
+    git status --porcelain
+    exit 1
+  fi
+}
+
+# Get the total amount of lines of code in the repo
+function get_total_lines {
+  local __empty_id="$(git hash-object -t tree /dev/null)"
+  local __changes="$(git diff --numstat $__empty_id | cat)"
+  local __added_deleted=$1
+  get_changed_lines "$__changes" $__added_deleted
+}
+
+# Get the total amount of lines of code since the provided tag
+function get_sincetag_lines {
+  local __sincetag=$1
+  local __changes="$(git diff --numstat $__sincetag | cat)"
+  local __added_deleted=$2
+  get_changed_lines "$__changes" $__added_deleted
+}
+
+function get_changed_lines {
+  local __changes_numstat=$1
+  local __result=$2
+  IFS=$'\n' read -rd '' -a __changes_array <<<"$__changes_numstat"
+  local __diff_regex="^([0-9]+)[[:space:]]+([0-9]+)[[:space:]]+.+$"
+
+  local __total_added=0
+  local __total_deleted=0
+  for i in "${__changes_array[@]}"
+  do
+    if [[ $i =~ $__diff_regex ]] ; then
+      local __added=${BASH_REMATCH[1]}
+      local __deleted=${BASH_REMATCH[2]}
+      __total_added=$(( $__total_added+$__added ))
+      __total_deleted=$(( $__total_deleted+$__deleted ))
+    fi
+  done
+  eval "$2=( $__total_added $__total_deleted )"
+}
+
+function get_scope_auto {
+  local __verbose=$2
+  local __total=0
+  local __since=0
+  local __scope=
+
+  get_total_lines __total
+  get_sincetag_lines $finalversion __since
+
+  local __percentage=0
+  if [ "$__total" != "0" ]; then
+    local __percentage=$(( 100*$__since/$__total ))
+    if [ $__percentage -gt "10" ]; then
+      __scope="minor"
+    else
+      __scope="patch"
+    fi
+  fi
+
+  eval "$1=$__scope"
+  if [[ -n "$__verbose" ]]; then
+    echo "[Auto Scope] Percentage of lines changed: $__percentage"
+    echo "[Auto Scope] : $__scope"
+  fi
+}
+
+function get_work_tree_status {
+  # Update the index
+  git update-index -q --ignore-submodules --refresh > /dev/null
+  eval "$1="
+
+  if ! git diff-files --quiet --ignore-submodules -- > /dev/null
+  then
+    eval "$1=unstaged"
+  fi
+
+  if ! git diff-index --cached --quiet HEAD --ignore-submodules -- > /dev/null
+  then
+    eval "$1=uncommitted"
+  fi
+}
+
+function get_current {
+  if [ "$hasversiontag" == "true" ]; then
+    local __commitcount="$(git rev-list $lastversion.. --count)"
+  else
+    local __commitcount="$(git rev-list --count HEAD)"
+  fi
+  local __status=
+  get_work_tree_status __status
+  
+  if [ "$__commitcount" == "0" ] && [ -z "$__status" ]; then
+    eval "$1=$lastversion"
+  else
+    local __buildinfo="$(git rev-parse --short HEAD)"
+    local __currentbranch="$(git rev-parse --abbrev-ref HEAD)"
+    if [ "$__currentbranch" != "master" ]; then
+      __buildinfo="$__currentbranch.$__buildinfo"
+    fi
+
+    local __suffix=
+    if [ "$__commitcount" != "0" ]; then
+      if [ -n "$__suffix" ]; then
+        __suffix="$__suffix."
+      fi
+      __suffix="$__suffix$__commitcount"
+    fi
+    if [ -n "$__status" ]; then
+      if [ -n "$__suffix" ]; then
+        __suffix="$__suffix."
+      fi
+      __suffix="$__suffix$__status"
+    fi
+
+    __suffix="$__suffix+$__buildinfo"
+    if [ "$lastversion" == "$finalversion" ]; then
+      scope="patch"
+      identifier=
+      local __bumped=
+      bump_version __bumped
+      eval "$1=$__bumped-dev.$__suffix"
+    else
+      eval "$1=$lastversion.$__suffix"
+    fi
+  fi
+}
+
+function init {
+  git fetch > /dev/null
+  TAGS="$(git tag)"
+  IFS=$'\n' read -rd '' -a TAG_ARRAY <<<"$TAGS"
+
+  get_latest ${TAG_ARRAY[@]}
+  currentbranch="$(git rev-parse --abbrev-ref HEAD)"
+}
+
+case $ACTION in
+  --help)
+    echo -e "$HELP"
+    ;;
+  --version)
+    echo -e "${PROG}: $PROG_VERSION"
+    ;;
+  final)
+    init
+    diff=$(git diff master | cat)
+    if [ "$forcetag" == "false" ]; then
+      if [ -n "$diff" ]; then
+        echo "ERROR: Branch must be updated with master for final versions"
+        exit 1
+      fi
+    fi
+    increase_version
+    ;;
+  alpha|beta)
+    init
+    identifier="$ACTION"
+    increase_version
+    ;;
+  candidate)
+    init
+    identifier="rc"
+    increase_version
+    ;;
+  getlast)
+    init
+    echo "$lastversion"
+    ;;
+  getfinal)
+    init
+    echo "$finalversion"
+    ;;
+  getcurrent)
+    init
+    get_current current
+    echo "$current"
+    ;;
+  get)
+    init
+    echo "Current final version: $finalversion"
+    echo "Last tagged version:   $lastversion"
+    ;;
+  *)
+    echo "'$ACTION' is not a valid command, see --help for available commands."
+    ;;
+esac

helmexec/exec.go

@@ -1,14 +1,15 @@
 package helmexec
 
 import (
-	"fmt"
 	"io"
 	"io/ioutil"
 	"os"
-	"os/exec"
-	"path/filepath"
-	"regexp"
 	"strings"
+
+	"sync"
+
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
 )
 
 const (
@@ -16,15 +17,38 @@ const (
 )
 
 type execer struct {
-	writer      io.Writer
-	kubeContext string
-	extra       []string
+	helmBinary      string
+	runner          Runner
+	logger          *zap.SugaredLogger
+	kubeContext     string
+	extra           []string
+	decryptionMutex sync.Mutex
 }
 
-func NewHelmExec(writer io.Writer, kubeContext string) Interface {
+func NewLogger(writer io.Writer, logLevel string) *zap.SugaredLogger {
+	var cfg zapcore.EncoderConfig
+	cfg.MessageKey = "message"
+	out := zapcore.AddSync(writer)
+	var level zapcore.Level
+	err := level.Set(logLevel)
+	if err != nil {
+		panic(err)
+	}
+	core := zapcore.NewCore(
+		zapcore.NewConsoleEncoder(cfg),
+		out,
+		level,
+	)
+	return zap.New(core).Sugar()
+}
+
+// New for running helm commands
+func New(logger *zap.SugaredLogger, kubeContext string) *execer {
 	return &execer{
-		writer:      writer,
+		helmBinary:  command,
+		logger:      logger,
 		kubeContext: kubeContext,
+		runner:      &ShellRunner{},
 	}
 }
 
@@ -32,65 +56,153 @@ func (helm *execer) SetExtraArgs(args ...string) {
 	helm.extra = args
 }
 
-func (helm *execer) AddRepo(name, repository string) error {
-	out, err := helm.exec("repo", "add", name, repository)
-	if helm.writer != nil {
-		helm.writer.Write(out)
+func (helm *execer) SetHelmBinary(bin string) {
+	helm.helmBinary = bin
+}
+
+func (helm *execer) AddRepo(name, repository, certfile, keyfile, username, password string) error {
+	var args []string
+	args = append(args, "repo", "add", name, repository)
+	if certfile != "" && keyfile != "" {
+		args = append(args, "--cert-file", certfile, "--key-file", keyfile)
 	}
+	if username != "" && password != "" {
+		args = append(args, "--username", username, "--password", password)
+	}
+	helm.logger.Infof("Adding repo %v %v", name, repository)
+	out, err := helm.exec(args...)
+	helm.write(out)
 	return err
 }
 
 func (helm *execer) UpdateRepo() error {
+	helm.logger.Info("Updating repo")
 	out, err := helm.exec("repo", "update")
-	if helm.writer != nil {
-		helm.writer.Write(out)
-	}
+	helm.write(out)
 	return err
 }
 
-func normalizeChart(chart string) (string, error) {
-	regex, err := regexp.Compile("^[.]?./")
-	if err != nil {
-		return "", err
-	}
-	if !regex.MatchString(chart) {
-		return chart, nil
-	}
-	wd, err := os.Getwd()
-	if err != nil {
-		return "", err
-	}
-	path := filepath.Join(wd, chart)
-	return path, nil
-}
-
-func (helm *execer) SyncChart(name, chart string, flags ...string) error {
-	chart, err := normalizeChart(chart)
-	if err != nil {
-		return err
-	}
-	out, err := helm.exec(append([]string{"upgrade", "--install", name, chart}, flags...)...)
-	if helm.writer != nil {
-		helm.writer.Write(out)
-	}
+func (helm *execer) UpdateDeps(chart string) error {
+	helm.logger.Infof("Updating dependency %v", chart)
+	out, err := helm.exec("dependency", "update", chart)
+	helm.write(out)
 	return err
 }
 
-func (helm *execer) DeleteChart(name string) error {
-	out, err := helm.exec("delete", name)
-	if helm.writer != nil {
-		helm.writer.Write(out)
+func (helm *execer) BuildDeps(chart string) error {
+	helm.logger.Infof("Building dependency %v", chart)
+	out, err := helm.exec("dependency", "build", chart)
+	helm.write(out)
+	return err
+}
+
+func (helm *execer) SyncRelease(name, chart string, flags ...string) error {
+	helm.logger.Infof("Upgrading %v", chart)
+	out, err := helm.exec(append([]string{"upgrade", "--install", "--reset-values", name, chart}, flags...)...)
+	helm.write(out)
+	return err
+}
+
+func (helm *execer) ReleaseStatus(name string) error {
+	helm.logger.Infof("Getting status %v", name)
+	out, err := helm.exec(append([]string{"status", name})...)
+	helm.write(out)
+	return err
+}
+
+func (helm *execer) List(filter string) (string, error) {
+	helm.logger.Infof("Listing releases matching %v", filter)
+	out, err := helm.exec(append([]string{"list", filter})...)
+	helm.write(out)
+	return string(out), err
+}
+
+func (helm *execer) DecryptSecret(name string) (string, error) {
+	// Prevents https://github.com/roboll/helmfile/issues/258
+	helm.decryptionMutex.Lock()
+	defer helm.decryptionMutex.Unlock()
+
+	helm.logger.Infof("Decrypting secret %v", name)
+	out, err := helm.exec(append([]string{"secrets", "dec", name})...)
+	helm.write(out)
+	if err != nil {
+		return "", err
 	}
+
+	tmpFile, err := ioutil.TempFile("", "secret")
+	if err != nil {
+		return "", err
+	}
+	defer tmpFile.Close()
+
+	// os.Rename seems to results in "cross-device link` errors in some cases
+	// Instead of moving, copy it to the destination temp file as a work-around
+	// See https://github.com/roboll/helmfile/issues/251#issuecomment-417166296f
+	decFilename := name + ".dec"
+	decFile, err := os.Open(decFilename)
+	if err != nil {
+		return "", err
+	}
+	defer decFile.Close()
+
+	_, err = io.Copy(tmpFile, decFile)
+	if err != nil {
+		return "", err
+	}
+
+	if err := decFile.Close(); err != nil {
+		return "", err
+	}
+
+	if err := os.Remove(decFilename); err != nil {
+		return "", err
+	}
+
+	return tmpFile.Name(), err
+}
+
+func (helm *execer) TemplateRelease(chart string, flags ...string) error {
+	out, err := helm.exec(append([]string{"template", chart}, flags...)...)
+	helm.write(out)
+	return err
+}
+
+func (helm *execer) DiffRelease(name, chart string, flags ...string) error {
+	helm.logger.Infof("Comparing %v %v", name, chart)
+	out, err := helm.exec(append([]string{"diff", "upgrade", "--allow-unreleased", name, chart}, flags...)...)
+	helm.write(out)
+	return err
+}
+
+func (helm *execer) Lint(chart string, flags ...string) error {
+	helm.logger.Infof("Linting %v", chart)
+	out, err := helm.exec(append([]string{"lint", chart}, flags...)...)
+	helm.write(out)
+	return err
+}
+
+func (helm *execer) Fetch(chart string, flags ...string) error {
+	helm.logger.Infof("Fetching %v", chart)
+	out, err := helm.exec(append([]string{"fetch", chart}, flags...)...)
+	helm.write(out)
+	return err
+}
+
+func (helm *execer) DeleteRelease(name string, flags ...string) error {
+	helm.logger.Infof("Deleting %v", name)
+	out, err := helm.exec(append([]string{"delete", name}, flags...)...)
+	helm.write(out)
+	return err
+}
+
+func (helm *execer) TestRelease(name string, flags ...string) error {
+	helm.logger.Infof("Testing %v", name)
+	out, err := helm.exec(append([]string{"test", name}, flags...)...)
+	helm.write(out)
 	return err
 }
 
 func (helm *execer) exec(args ...string) ([]byte, error) {
-	dir, err := ioutil.TempDir("", "helmfile-exec")
-	if err != nil {
-		return nil, err
-	}
-	defer os.RemoveAll(dir)
-
 	cmdargs := args
 	if len(helm.extra) > 0 {
 		cmdargs = append(cmdargs, helm.extra...)
@@ -98,11 +210,12 @@ func (helm *execer) exec(args ...string) ([]byte, error) {
 	if helm.kubeContext != "" {
 		cmdargs = append(cmdargs, "--kube-context", helm.kubeContext)
 	}
-	if helm.writer != nil {
-		helm.writer.Write([]byte(fmt.Sprintf("exec: helm %s\n", strings.Join(cmdargs, " "))))
+	helm.logger.Debugf("exec: %s %s", helm.helmBinary, strings.Join(cmdargs, " "))
+	return helm.runner.Execute(helm.helmBinary, cmdargs)
+}
+
+func (helm *execer) write(out []byte) {
+	if len(out) > 0 {
+		helm.logger.Infof("%s", out)
 	}
-
-	cmd := exec.Command(command, args...)
-	cmd.Dir = dir
-	return cmd.CombinedOutput()
 }

helmexec/exec_test.go

@@ -0,0 +1,378 @@
+package helmexec
+
+import (
+	"bytes"
+	"os"
+	"reflect"
+	"testing"
+
+	"go.uber.org/zap"
+)
+
+// Mocking the command-line runner
+
+type mockRunner struct {
+	output []byte
+	err    error
+}
+
+func (mock *mockRunner) Execute(cmd string, args []string) ([]byte, error) {
+	return []byte{}, nil
+}
+
+func MockExecer(logger *zap.SugaredLogger, kubeContext string) *execer {
+	execer := New(logger, kubeContext)
+	execer.runner = &mockRunner{}
+	return execer
+}
+
+// Test methods
+
+func TestNewHelmExec(t *testing.T) {
+	buffer := bytes.NewBufferString("something")
+	logger := NewLogger(buffer, "debug")
+	helm := New(logger, "dev")
+	if helm.kubeContext != "dev" {
+		t.Error("helmexec.New() - kubeContext")
+	}
+	if buffer.String() != "something" {
+		t.Error("helmexec.New() - changed buffer")
+	}
+	if len(helm.extra) != 0 {
+		t.Error("helmexec.New() - extra args not empty")
+	}
+}
+
+func Test_SetExtraArgs(t *testing.T) {
+	helm := New(NewLogger(os.Stdout, "info"), "dev")
+	helm.SetExtraArgs()
+	if len(helm.extra) != 0 {
+		t.Error("helmexec.SetExtraArgs() - passing no arguments should not change extra field")
+	}
+	helm.SetExtraArgs("foo")
+	if !reflect.DeepEqual(helm.extra, []string{"foo"}) {
+		t.Error("helmexec.SetExtraArgs() - one extra argument missing")
+	}
+	helm.SetExtraArgs("alpha", "beta")
+	if !reflect.DeepEqual(helm.extra, []string{"alpha", "beta"}) {
+		t.Error("helmexec.SetExtraArgs() - two extra arguments missing (overwriting the previous value)")
+	}
+}
+
+func Test_SetHelmBinary(t *testing.T) {
+	helm := New(NewLogger(os.Stdout, "info"), "dev")
+	if helm.helmBinary != "helm" {
+		t.Error("helmexec.command - default command is not helm")
+	}
+	helm.SetHelmBinary("foo")
+	if helm.helmBinary != "foo" {
+		t.Errorf("helmexec.SetHelmBinary() - actual = %s expect = foo", helm.helmBinary)
+	}
+}
+
+func Test_AddRepo(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.AddRepo("myRepo", "https://repo.example.com/", "cert.pem", "key.pem", "", "")
+	expected := `Adding repo myRepo https://repo.example.com/
+exec: helm repo add myRepo https://repo.example.com/ --cert-file cert.pem --key-file key.pem --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "", "")
+	expected = `Adding repo myRepo https://repo.example.com/
+exec: helm repo add myRepo https://repo.example.com/ --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "example_user", "example_password")
+	expected = `Adding repo myRepo https://repo.example.com/
+exec: helm repo add myRepo https://repo.example.com/ --username example_user --password example_password --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_UpdateRepo(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.UpdateRepo()
+	expected := `Updating repo
+exec: helm repo update --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.UpdateRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_SyncRelease(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.SyncRelease("release", "chart", "--timeout 10", "--wait")
+	expected := `Upgrading chart
+exec: helm upgrade --install --reset-values release chart --timeout 10 --wait --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.SyncRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.SyncRelease("release", "chart")
+	expected = `Upgrading chart
+exec: helm upgrade --install --reset-values release chart --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.SyncRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_UpdateDeps(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.UpdateDeps("./chart/foo")
+	expected := `Updating dependency ./chart/foo
+exec: helm dependency update ./chart/foo --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.UpdateDeps()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.SetExtraArgs("--verify")
+	helm.UpdateDeps("./chart/foo")
+	expected = `Updating dependency ./chart/foo
+exec: helm dependency update ./chart/foo --verify --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_BuildDeps(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.BuildDeps("./chart/foo")
+	expected := `Building dependency ./chart/foo
+exec: helm dependency build ./chart/foo --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.BuildDeps()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.SetExtraArgs("--verify")
+	helm.BuildDeps("./chart/foo")
+	expected = `Building dependency ./chart/foo
+exec: helm dependency build ./chart/foo --verify --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.BuildDeps()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_DecryptSecret(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.DecryptSecret("secretName")
+	expected := `Decrypting secret secretName
+exec: helm secrets dec secretName --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.DecryptSecret()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_DiffRelease(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.DiffRelease("release", "chart", "--timeout 10", "--wait")
+	expected := `Comparing release chart
+exec: helm diff upgrade --allow-unreleased release chart --timeout 10 --wait --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.DiffRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.DiffRelease("release", "chart")
+	expected = `Comparing release chart
+exec: helm diff upgrade --allow-unreleased release chart --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.DiffRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_DeleteRelease(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.DeleteRelease("release")
+	expected := `Deleting release
+exec: helm delete release --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.DeleteRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+func Test_DeleteRelease_Flags(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.DeleteRelease("release", "--purge")
+	expected := `Deleting release
+exec: helm delete release --purge --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.DeleteRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_TestRelease(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.TestRelease("release")
+	expected := `Testing release
+exec: helm test release --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.TestRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+func Test_TestRelease_Flags(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.TestRelease("release", "--cleanup", "--timeout", "60")
+	expected := `Testing release
+exec: helm test release --cleanup --timeout 60 --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.TestRelease()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_ReleaseStatus(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.ReleaseStatus("myRelease")
+	expected := `Getting status myRelease
+exec: helm status myRelease --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.ReleaseStatus()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_exec(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "")
+	helm.exec("version")
+	expected := "exec: helm version\n"
+	if buffer.String() != expected {
+		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	helm = MockExecer(logger, "dev")
+	ret, _ := helm.exec("diff")
+	if len(ret) != 0 {
+		t.Error("helmexec.exec() - expected empty return value")
+	}
+
+	buffer.Reset()
+	helm = MockExecer(logger, "dev")
+	helm.exec("diff", "release", "chart", "--timeout 10", "--wait")
+	expected = "exec: helm diff release chart --timeout 10 --wait --kube-context dev\n"
+	if buffer.String() != expected {
+		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.exec("version")
+	expected = "exec: helm version --kube-context dev\n"
+	if buffer.String() != expected {
+		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm.SetExtraArgs("foo")
+	helm.exec("version")
+	expected = "exec: helm version foo --kube-context dev\n"
+	if buffer.String() != expected {
+		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+
+	buffer.Reset()
+	helm = MockExecer(logger, "")
+	helm.SetHelmBinary("overwritten")
+	helm.exec("version")
+	expected = "exec: overwritten version\n"
+	if buffer.String() != expected {
+		t.Errorf("helmexec.exec()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_Lint(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.Lint("path/to/chart", "--values", "file.yml")
+	expected := `Linting path/to/chart
+exec: helm lint path/to/chart --values file.yml --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.Lint()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+func Test_Fetch(t *testing.T) {
+	var buffer bytes.Buffer
+	logger := NewLogger(&buffer, "debug")
+	helm := MockExecer(logger, "dev")
+	helm.Fetch("chart", "--version", "1.2.3", "--untar", "--untardir", "/tmp/dir")
+	expected := `Fetching chart
+exec: helm fetch chart --version 1.2.3 --untar --untardir /tmp/dir --kube-context dev
+`
+	if buffer.String() != expected {
+		t.Errorf("helmexec.Lint()\nactual = %v\nexpect = %v", buffer.String(), expected)
+	}
+}
+
+var logLevelTests = map[string]string{
+	"debug": `Adding repo myRepo https://repo.example.com/
+exec: helm repo add myRepo https://repo.example.com/ --username example_user --password example_password
+`,
+	"info": `Adding repo myRepo https://repo.example.com/
+`,
+	"warn": ``,
+}
+
+func Test_LogLevels(t *testing.T) {
+	var buffer bytes.Buffer
+	for logLevel, expected := range logLevelTests {
+		buffer.Reset()
+		logger := NewLogger(&buffer, logLevel)
+		helm := MockExecer(logger, "")
+		helm.AddRepo("myRepo", "https://repo.example.com/", "", "", "example_user", "example_password")
+		if buffer.String() != expected {
+			t.Errorf("helmexec.AddRepo()\nactual = %v\nexpect = %v", buffer.String(), expected)
+		}
+	}
+}

helmexec/helmexec.go

@@ -1,11 +1,22 @@
 package helmexec
 
+// Interface for executing helm commands
 type Interface interface {
 	SetExtraArgs(args ...string)
+	SetHelmBinary(bin string)
 
-	AddRepo(name, repository string) error
+	AddRepo(name, repository, certfile, keyfile, username, password string) error
 	UpdateRepo() error
-
-	SyncChart(name, chart string, flags ...string) error
-	DeleteChart(name string) error
+	BuildDeps(chart string) error
+	UpdateDeps(chart string) error
+	SyncRelease(name, chart string, flags ...string) error
+	DiffRelease(name, chart string, flags ...string) error
+	TemplateRelease(chart string, flags ...string) error
+	Fetch(chart string, flags ...string) error
+	Lint(chart string, flags ...string) error
+	ReleaseStatus(name string) error
+	DeleteRelease(name string, flags ...string) error
+	TestRelease(name string, flags ...string) error
+	List(filter string) (string, error)
+	DecryptSecret(name string) (string, error)
 }

helmexec/runner.go

@@ -0,0 +1,27 @@
+package helmexec
+
+import (
+	"os/exec"
+)
+
+const (
+	tmpPrefix = "helmfile-"
+	tmpSuffix = "-exec"
+)
+
+// Runner interface for shell commands
+type Runner interface {
+	Execute(cmd string, args []string) ([]byte, error)
+}
+
+// ShellRunner implemention for shell commands
+type ShellRunner struct {
+	Dir string
+}
+
+// Execute a shell command
+func (shell ShellRunner) Execute(cmd string, args []string) ([]byte, error) {
+	preparedCmd := exec.Command(cmd, args...)
+	preparedCmd.Dir = shell.Dir
+	return preparedCmd.CombinedOutput()
+}

main.go

@@ -2,45 +2,94 @@ package main
 
 import (
 	"fmt"
-	"io"
-	"log"
-	"os"
-	"strings"
-
+	"github.com/roboll/helmfile/args"
+	"github.com/roboll/helmfile/cmd"
 	"github.com/roboll/helmfile/helmexec"
+	"github.com/roboll/helmfile/pkg/app"
 	"github.com/roboll/helmfile/state"
 	"github.com/urfave/cli"
-)
-
-const (
-	helmfile = "charts.yaml"
+	"go.uber.org/zap"
+	"go.uber.org/zap/zapcore"
+	"os"
+	"strings"
 )
 
 var Version string
 
+var logger *zap.SugaredLogger
+
+func configureLogging(c *cli.Context) error {
+	// Valid levels:
+	// https://github.com/uber-go/zap/blob/7e7e266a8dbce911a49554b945538c5b950196b8/zapcore/level.go#L126
+	logLevel := c.GlobalString("log-level")
+	if c.GlobalBool("quiet") {
+		logLevel = "warn"
+	}
+	var level zapcore.Level
+	err := level.Set(logLevel)
+	if err != nil {
+		return err
+	}
+	logger = helmexec.NewLogger(os.Stdout, logLevel)
+	if c.App.Metadata == nil {
+		// Auto-initialised in 1.19.0
+		// https://github.com/urfave/cli/blob/master/CHANGELOG.md#1190---2016-11-19
+		c.App.Metadata = make(map[string]interface{})
+	}
+	c.App.Metadata["logger"] = logger
+	return nil
+}
+
 func main() {
 
-	app := cli.NewApp()
-	app.Name = "helmfile"
-	app.Usage = ""
-	app.Version = Version
-	app.Flags = []cli.Flag{
+	cliApp := cli.NewApp()
+	cliApp.Name = "helmfile"
+	cliApp.Usage = ""
+	cliApp.Version = Version
+	cliApp.Flags = []cli.Flag{
+		cli.StringFlag{
+			Name:  "helm-binary, b",
+			Usage: "path to helm binary",
+		},
 		cli.StringFlag{
 			Name:  "file, f",
-			Value: helmfile,
-			Usage: "load config from `FILE`",
+			Usage: "load config from file or directory. defaults to `helmfile.yaml` or `helmfile.d`(means `helmfile.d/*.yaml`) in this preference",
+		},
+		cli.StringFlag{
+			Name:  "environment, e",
+			Usage: "specify the environment name. defaults to `default`",
 		},
 		cli.BoolFlag{
 			Name:  "quiet, q",
-			Usage: "silence output",
+			Usage: "Silence output. Equivalent to log-level warn",
 		},
 		cli.StringFlag{
 			Name:  "kube-context",
 			Usage: "Set kubectl context. Uses current context by default",
 		},
+		cli.StringFlag{
+			Name:  "log-level",
+			Usage: "Set log level, default info",
+		},
+		cli.StringFlag{
+			Name:  "namespace, n",
+			Usage: "Set namespace. Uses the namespace set in the context by default, and is available in templates as {{ .Namespace }}",
+		},
+		cli.StringSliceFlag{
+			Name: "selector, l",
+			Usage: `Only run using the releases that match labels. Labels can take the form of foo=bar or foo!=bar.
+	A release must match all labels in a group in order to be used. Multiple groups can be specified at once.
+	--selector tier=frontend,tier!=proxy --selector tier=backend. Will match all frontend, non-proxy releases AND all backend releases.
+	The name of a release can be used as a label. --selector name=myrelease`,
+		},
+		cli.BoolFlag{
+			Name:  "interactive, i",
+			Usage: "Request confirmation before attempting to modify clusters",
+		},
 	}
 
-	app.Commands = []cli.Command{
+	cliApp.Before = configureLogging
+	cliApp.Commands = []cli.Command{
 		{
 			Name:  "repos",
 			Usage: "sync repositories from state file (helm repo add && helm repo update)",
@@ -52,28 +101,23 @@ func main() {
 				},
 			},
 			Action: func(c *cli.Context) error {
-				state, helm, err := before(c)
-				if err != nil {
-					return err
-				}
-
-				args := c.String("args")
-				if len(args) > 0 {
-					helm.SetExtraArgs(strings.Split(args, " ")...)
-				}
-
-				if errs := state.SyncRepos(helm); err != nil && len(errs) > 0 {
-					for _, err := range errs {
-						fmt.Printf("err: %s", err.Error())
+				return cmd.VisitAllDesiredStates(c, func(state *state.HelmState, helm helmexec.Interface, ctx app.Context) (bool, []error) {
+					args := args.GetArgs(c.String("args"), state)
+					if len(args) > 0 {
+						helm.SetExtraArgs(args...)
 					}
-					os.Exit(1)
-				}
-				return nil
+
+					errs := ctx.SyncReposOnce(state, helm)
+
+					ok := len(state.Repositories) > 0 && len(errs) == 0
+
+					return ok, errs
+				})
 			},
 		},
 		{
 			Name:  "charts",
-			Usage: "sync charts from state file (helm repo upgrade --install)",
+			Usage: "sync releases from state file (helm upgrade --install)",
 			Flags: []cli.Flag{
 				cli.StringFlag{
 					Name:  "args",
@@ -84,103 +128,435 @@ func main() {
 					Name:  "values",
 					Usage: "additional value files to be merged into the command",
 				},
+				cli.IntFlag{
+					Name:  "concurrency",
+					Value: 0,
+					Usage: "maximum number of concurrent helm processes to run, 0 is unlimited",
+				},
 			},
 			Action: func(c *cli.Context) error {
-				state, helm, err := before(c)
-				if err != nil {
-					return err
-				}
-
-				args := c.String("args")
-				if len(args) > 0 {
-					helm.SetExtraArgs(strings.Split(args, " ")...)
-				}
-
-				values := c.StringSlice("values")
-
-				if errs := state.SyncCharts(helm, values); err != nil && len(errs) > 0 {
-					for _, err := range errs {
-						fmt.Printf("err: %s", err.Error())
+				return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface, _ app.Context) []error {
+					return executeSyncCommand(c, state, helm)
+				})
+			},
+		},
+		{
+			Name:  "diff",
+			Usage: "diff releases from state file against env (helm diff)",
+			Flags: []cli.Flag{
+				cli.StringFlag{
+					Name:  "args",
+					Value: "",
+					Usage: "pass args to helm exec",
+				},
+				cli.StringSliceFlag{
+					Name:  "values",
+					Usage: "additional value files to be merged into the command",
+				},
+				cli.BoolFlag{
+					Name:  "skip-deps",
+					Usage: "skip running `helm repo update` and `helm dependency build`",
+				},
+				cli.BoolFlag{
+					Name:  "detailed-exitcode",
+					Usage: "return a non-zero exit code when there are changes",
+				},
+				cli.BoolFlag{
+					Name:  "suppress-secrets",
+					Usage: "suppress secrets in the output. highly recommended to specify on CI/CD use-cases",
+				},
+				cli.IntFlag{
+					Name:  "concurrency",
+					Value: 0,
+					Usage: "maximum number of concurrent helm processes to run, 0 is unlimited",
+				},
+			},
+			Action: func(c *cli.Context) error {
+				return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface, ctx app.Context) []error {
+					if !c.Bool("skip-deps") {
+						if errs := ctx.SyncReposOnce(state, helm); errs != nil && len(errs) > 0 {
+							return errs
+						}
+						if errs := state.BuildDeps(helm); errs != nil && len(errs) > 0 {
+							return errs
+						}
 					}
-					os.Exit(1)
-				}
-				return nil
+					if errs := state.PrepareRelease(helm, "diff"); errs != nil && len(errs) > 0 {
+						return errs
+					}
+
+					_, errs := executeDiffCommand(c, state, helm, c.Bool("detailed-exitcode"), c.Bool("suppress-secrets"))
+					return errs
+				})
+			},
+		},
+		{
+			Name:  "template",
+			Usage: "template releases from state file against env (helm template)",
+			Flags: []cli.Flag{
+				cli.StringFlag{
+					Name:  "args",
+					Value: "",
+					Usage: "pass args to helm template",
+				},
+				cli.StringSliceFlag{
+					Name:  "values",
+					Usage: "additional value files to be merged into the command",
+				},
+				cli.IntFlag{
+					Name:  "concurrency",
+					Value: 0,
+					Usage: "maximum number of concurrent downloads of release charts",
+				},
+				cli.BoolFlag{
+					Name:  "skip-deps",
+					Usage: "skip running `helm repo update` and `helm dependency build`",
+				},
+			},
+			Action: func(c *cli.Context) error {
+				return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface, ctx app.Context) []error {
+					if !c.Bool("skip-deps") {
+						if errs := ctx.SyncReposOnce(state, helm); errs != nil && len(errs) > 0 {
+							return errs
+						}
+						if errs := state.BuildDeps(helm); errs != nil && len(errs) > 0 {
+							return errs
+						}
+					}
+					if errs := state.PrepareRelease(helm, "template"); errs != nil && len(errs) > 0 {
+						return errs
+					}
+					return executeTemplateCommand(c, state, helm)
+				})
+			},
+		},
+		{
+			Name:  "lint",
+			Usage: "lint charts from state file (helm lint)",
+			Flags: []cli.Flag{
+				cli.StringFlag{
+					Name:  "args",
+					Value: "",
+					Usage: "pass args to helm exec",
+				},
+				cli.StringSliceFlag{
+					Name:  "values",
+					Usage: "additional value files to be merged into the command",
+				},
+				cli.IntFlag{
+					Name:  "concurrency",
+					Value: 0,
+					Usage: "maximum number of concurrent downloads of release charts",
+				},
+			},
+			Action: func(c *cli.Context) error {
+				return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface, ctx app.Context) []error {
+					values := c.StringSlice("values")
+					args := args.GetArgs(c.String("args"), state)
+					workers := c.Int("concurrency")
+					if errs := ctx.SyncReposOnce(state, helm); errs != nil && len(errs) > 0 {
+						return errs
+					}
+					if errs := state.PrepareRelease(helm, "lint"); errs != nil && len(errs) > 0 {
+						return errs
+					}
+					return state.LintReleases(helm, values, args, workers)
+				})
 			},
 		},
 		{
 			Name:  "sync",
-			Usage: "sync all resources from state file (repos && charts)",
+			Usage: "sync all resources from state file (repos, releases and chart deps)",
 			Flags: []cli.Flag{
 				cli.StringSliceFlag{
 					Name:  "values",
 					Usage: "additional value files to be merged into the command",
 				},
+				cli.IntFlag{
+					Name:  "concurrency",
+					Value: 0,
+					Usage: "maximum number of concurrent helm processes to run, 0 is unlimited",
+				},
+				cli.StringFlag{
+					Name:  "args",
+					Value: "",
+					Usage: "pass args to helm exec",
+				},
+				cli.BoolFlag{
+					Name:  "skip-deps",
+					Usage: "skip running `helm repo update` and `helm dependency build`",
+				},
 			},
 			Action: func(c *cli.Context) error {
-				state, helm, err := before(c)
-				if err != nil {
-					return err
-				}
-
-				if errs := state.SyncRepos(helm); err != nil && len(errs) > 0 {
-					for _, err := range errs {
-						fmt.Printf("err: %s", err.Error())
+				return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface, ctx app.Context) []error {
+					if !c.Bool("skip-deps") {
+						if errs := ctx.SyncReposOnce(state, helm); errs != nil && len(errs) > 0 {
+							return errs
+						}
+						if errs := state.BuildDeps(helm); errs != nil && len(errs) > 0 {
+							return errs
+						}
 					}
-					os.Exit(1)
-				}
-
-				values := c.StringSlice("values")
-
-				if errs := state.SyncCharts(helm, values); err != nil && len(errs) > 0 {
-					for _, err := range errs {
-						fmt.Printf("err: %s", err.Error())
+					if errs := state.PrepareRelease(helm, "sync"); errs != nil && len(errs) > 0 {
+						return errs
 					}
-					os.Exit(1)
-				}
-				return nil
+					return executeSyncCommand(c, state, helm)
+				})
+			},
+		},
+		{
+			Name:  "apply",
+			Usage: "apply all resources from state file only when there are changes",
+			Flags: []cli.Flag{
+				cli.StringSliceFlag{
+					Name:  "values",
+					Usage: "additional value files to be merged into the command",
+				},
+				cli.IntFlag{
+					Name:  "concurrency",
+					Value: 0,
+					Usage: "maximum number of concurrent helm processes to run, 0 is unlimited",
+				},
+				cli.StringFlag{
+					Name:  "args",
+					Value: "",
+					Usage: "pass args to helm exec",
+				},
+				cli.BoolFlag{
+					Name:  "suppress-secrets",
+					Usage: "suppress secrets in the diff output. highly recommended to specify on CI/CD use-cases",
+				},
+				cli.BoolFlag{
+					Name:  "skip-deps",
+					Usage: "skip running `helm repo update` and `helm dependency build`",
+				},
+			},
+			Action: func(c *cli.Context) error {
+				return findAndIterateOverDesiredStatesUsingFlags(c, func(st *state.HelmState, helm helmexec.Interface, ctx app.Context) []error {
+					if !c.Bool("skip-deps") {
+						if errs := ctx.SyncReposOnce(st, helm); errs != nil && len(errs) > 0 {
+							return errs
+						}
+						if errs := st.BuildDeps(helm); errs != nil && len(errs) > 0 {
+							return errs
+						}
+					}
+					if errs := st.PrepareRelease(helm, "apply"); errs != nil && len(errs) > 0 {
+						return errs
+					}
+
+					releases, errs := executeDiffCommand(c, st, helm, true, c.Bool("suppress-secrets"))
+
+					releasesToBeDeleted, err := st.DetectReleasesToBeDeleted(helm)
+					if err != nil {
+						errs = append(errs, err)
+					}
+
+					noError := true
+					for _, e := range errs {
+						switch err := e.(type) {
+						case *state.DiffError:
+							noError = noError && err.Code == 2
+						default:
+							noError = false
+						}
+					}
+
+					// sync only when there are changes
+					if noError {
+						if len(releases) == 0 && len(releasesToBeDeleted) == 0 {
+							// TODO better way to get the logger
+							logger := c.App.Metadata["logger"].(*zap.SugaredLogger)
+							logger.Infof("")
+							logger.Infof("No affected releases")
+						} else {
+							names := []string{}
+							for _, r := range releases {
+								names = append(names, fmt.Sprintf("  %s (%s) UPDATED", r.Name, r.Chart))
+							}
+							for _, r := range releasesToBeDeleted {
+								names = append(names, fmt.Sprintf("  %s (%s) DELETED", r.Name, r.Chart))
+							}
+
+							msg := fmt.Sprintf(`Affected releases are:
+%s
+
+Do you really want to apply?
+  Helmfile will apply all your changes, as shown above.
+
+`, strings.Join(names, "\n"))
+							interactive := c.GlobalBool("interactive")
+							if !interactive || interactive && askForConfirmation(msg) {
+								rs := []state.ReleaseSpec{}
+								for _, r := range releases {
+									rs = append(rs, *r)
+								}
+								for _, r := range releasesToBeDeleted {
+									rs = append(rs, *r)
+								}
+
+								st.Releases = rs
+								return executeSyncCommand(c, st, helm)
+							}
+						}
+					}
+
+					return errs
+				})
+			},
+		},
+		{
+			Name:  "status",
+			Usage: "retrieve status of releases in state file",
+			Flags: []cli.Flag{
+				cli.IntFlag{
+					Name:  "concurrency",
+					Value: 0,
+					Usage: "maximum number of concurrent helm processes to run, 0 is unlimited",
+				},
+				cli.StringFlag{
+					Name:  "args",
+					Value: "",
+					Usage: "pass args to helm exec",
+				},
+			},
+			Action: func(c *cli.Context) error {
+				return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface, _ app.Context) []error {
+					workers := c.Int("concurrency")
+
+					args := args.GetArgs(c.String("args"), state)
+					if len(args) > 0 {
+						helm.SetExtraArgs(args...)
+					}
+
+					return state.ReleaseStatuses(helm, workers)
+				})
 			},
 		},
 		{
 			Name:  "delete",
-			Usage: "delete charts from state file (helm delete)",
+			Usage: "delete releases from state file (helm delete)",
+			Flags: []cli.Flag{
+				cli.StringFlag{
+					Name:  "args",
+					Value: "",
+					Usage: "pass args to helm exec",
+				},
+				cli.BoolFlag{
+					Name:  "purge",
+					Usage: "purge releases i.e. free release names and histories",
+				},
+			},
 			Action: func(c *cli.Context) error {
-				state, helm, err := before(c)
-				if err != nil {
-					return err
-				}
+				return cmd.FindAndIterateOverDesiredStatesUsingFlagsWithReverse(c, true, func(state *state.HelmState, helm helmexec.Interface, _ app.Context) []error {
+					purge := c.Bool("purge")
 
-				if errs := state.DeleteCharts(helm); err != nil && len(errs) > 0 {
-					for _, err := range errs {
-						fmt.Printf("err: %s", err.Error())
+					args := args.GetArgs(c.String("args"), state)
+					if len(args) > 0 {
+						helm.SetExtraArgs(args...)
 					}
-					os.Exit(1)
-				}
-				return nil
+
+					names := make([]string, len(state.Releases))
+					for i, r := range state.Releases {
+						names[i] = fmt.Sprintf("  %s (%s)", r.Name, r.Chart)
+					}
+
+					msg := fmt.Sprintf(`Affected releases are:
+%s
+
+Do you really want to delete?
+  Helmfile will delete all your releases, as shown above.
+
+`, strings.Join(names, "\n"))
+					interactive := c.GlobalBool("interactive")
+					if !interactive || interactive && askForConfirmation(msg) {
+						return state.DeleteReleases(helm, purge)
+					}
+					return nil
+				})
+			},
+		},
+		{
+			Name:  "test",
+			Usage: "test releases from state file (helm test)",
+			Flags: []cli.Flag{
+				cli.BoolFlag{
+					Name:  "cleanup",
+					Usage: "delete test pods upon completion",
+				},
+				cli.StringFlag{
+					Name:  "args",
+					Value: "",
+					Usage: "pass additional args to helm exec",
+				},
+				cli.IntFlag{
+					Name:  "timeout",
+					Value: 300,
+					Usage: "maximum time for tests to run before being considered failed",
+				},
+				cli.IntFlag{
+					Name:  "concurrency",
+					Value: 0,
+					Usage: "maximum number of concurrent helm processes to run, 0 is unlimited",
+				},
+			},
+			Action: func(c *cli.Context) error {
+				return findAndIterateOverDesiredStatesUsingFlags(c, func(state *state.HelmState, helm helmexec.Interface, _ app.Context) []error {
+					cleanup := c.Bool("cleanup")
+					timeout := c.Int("timeout")
+					concurrency := c.Int("concurrency")
+
+					args := args.GetArgs(c.String("args"), state)
+					if len(args) > 0 {
+						helm.SetExtraArgs(args...)
+					}
+
+					return state.TestReleases(helm, cleanup, timeout, concurrency)
+				})
 			},
 		},
 	}
 
-	err := app.Run(os.Args)
+	err := cliApp.Run(os.Args)
 	if err != nil {
-		log.Printf("err: %s", err.Error())
-		os.Exit(1)
+		fmt.Fprintf(os.Stderr, "%v\n", err)
+		os.Exit(3)
 	}
 }
 
-func before(c *cli.Context) (*state.HelmState, helmexec.Interface, error) {
-	file := c.GlobalString("file")
-	quiet := c.GlobalBool("quiet")
-	kubeContext := c.GlobalString("kube-context")
-
-	state, err := state.ReadFromFile(file)
-	if err != nil {
-		return nil, nil, err
+func executeSyncCommand(c *cli.Context, state *state.HelmState, helm helmexec.Interface) []error {
+	args := args.GetArgs(c.String("args"), state)
+	if len(args) > 0 {
+		helm.SetExtraArgs(args...)
 	}
 
-	var writer io.Writer
-	if !quiet {
-		writer = os.Stdout
-	}
+	values := c.StringSlice("values")
+	workers := c.Int("concurrency")
 
-	return state, helmexec.NewHelmExec(writer, kubeContext), nil
+	return state.SyncReleases(helm, values, workers)
+}
+
+func executeTemplateCommand(c *cli.Context, state *state.HelmState, helm helmexec.Interface) []error {
+	args := args.GetArgs(c.String("args"), state)
+	values := c.StringSlice("values")
+	workers := c.Int("concurrency")
+
+	return state.TemplateReleases(helm, values, args, workers)
+}
+
+func executeDiffCommand(c *cli.Context, st *state.HelmState, helm helmexec.Interface, detailedExitCode, suppressSecrets bool) ([]*state.ReleaseSpec, []error) {
+	args := args.GetArgs(c.String("args"), st)
+	if len(args) > 0 {
+		helm.SetExtraArgs(args...)
+	}
+
+	values := c.StringSlice("values")
+	workers := c.Int("concurrency")
+	triggerCleanupEvents := c.Command.HasName("diff")
+
+	return st.DiffReleases(helm, values, workers, detailedExitCode, suppressSecrets, triggerCleanupEvents)
+}
+
+func findAndIterateOverDesiredStatesUsingFlags(c *cli.Context, converge func(*state.HelmState, helmexec.Interface, app.Context) []error) error {
+	return cmd.FindAndIterateOverDesiredStatesUsingFlagsWithReverse(c, false, converge)
 }

pkg/app/app.go

@@ -0,0 +1,391 @@
+package app
+
+import (
+	"fmt"
+	"github.com/roboll/helmfile/helmexec"
+	"github.com/roboll/helmfile/state"
+	"go.uber.org/zap"
+	"io/ioutil"
+	"log"
+	"os"
+	"os/signal"
+	"path/filepath"
+	"sort"
+	"syscall"
+)
+
+type App struct {
+	KubeContext string
+	Logger      *zap.SugaredLogger
+	Reverse     bool
+	Env         string
+	Namespace   string
+	Selectors   []string
+
+	readFile          func(string) ([]byte, error)
+	glob              func(string) ([]string, error)
+	abs               func(string) (string, error)
+	fileExistsAt      func(string) bool
+	directoryExistsAt func(string) bool
+
+	getwd func() (string, error)
+	chdir func(string) error
+}
+
+func Init(app *App) *App {
+	app.readFile = ioutil.ReadFile
+	app.glob = filepath.Glob
+	app.abs = filepath.Abs
+	app.getwd = os.Getwd
+	app.chdir = os.Chdir
+	app.fileExistsAt = fileExistsAt
+	app.directoryExistsAt = directoryExistsAt
+	return app
+}
+
+func (a *App) within(dir string, do func() error) error {
+	if dir == "." {
+		return do()
+	}
+
+	prev, err := a.getwd()
+	if err != nil {
+		return fmt.Errorf("failed getting current working direcotyr: %v", err)
+	}
+
+	absDir, err := a.abs(dir)
+	if err != nil {
+		return err
+	}
+
+	a.Logger.Debugf("changing working directory to \"%s\"", absDir)
+
+	if err := a.chdir(absDir); err != nil {
+		return fmt.Errorf("failed changing working directory to \"%s\": %v", absDir, err)
+	}
+
+	appErr := do()
+
+	a.Logger.Debugf("changing working directory back to \"%s\"", prev)
+
+	if chdirBackErr := a.chdir(prev); chdirBackErr != nil {
+		if appErr != nil {
+			a.Logger.Warnf("%v", appErr)
+		}
+		return fmt.Errorf("failed chaging working directory back to \"%s\": %v", prev, chdirBackErr)
+	}
+
+	return appErr
+}
+
+func (a *App) visitStateFiles(fileOrDir string, do func(string) error) error {
+	desiredStateFiles, err := a.findDesiredStateFiles(fileOrDir)
+	if err != nil {
+		return err
+	}
+
+	for _, relPath := range desiredStateFiles {
+		var file string
+		var dir string
+		if a.directoryExistsAt(relPath) {
+			file = relPath
+			dir = relPath
+		} else {
+			file = filepath.Base(relPath)
+			dir = filepath.Dir(relPath)
+		}
+
+		a.Logger.Debugf("processing file \"%s\" in directory \"%s\"", file, dir)
+
+		err := a.within(dir, func() error {
+			return do(file)
+		})
+		if err != nil {
+			return err
+		}
+	}
+
+	return nil
+}
+
+func (a *App) VisitDesiredStates(fileOrDir string, converge func(*state.HelmState, helmexec.Interface) (bool, []error)) error {
+	noMatchInHelmfiles := true
+	err := a.visitStateFiles(fileOrDir, func(f string) error {
+		content, err := a.readFile(f)
+		if err != nil {
+			return err
+		}
+		// render template, in two runs
+		r := &twoPassRenderer{
+			reader:    a.readFile,
+			env:       a.Env,
+			namespace: a.Namespace,
+			filename:  f,
+			logger:    a.Logger,
+			abs:       a.abs,
+		}
+		yamlBuf, err := r.renderTemplate(content)
+		if err != nil {
+			return fmt.Errorf("error during %s parsing: %v", f, err)
+		}
+
+		st, err := a.loadDesiredStateFromYaml(
+			yamlBuf.Bytes(),
+			f,
+			a.Namespace,
+			a.Env,
+		)
+
+		helm := helmexec.New(a.Logger, a.KubeContext)
+
+		if err != nil {
+			switch stateLoadErr := err.(type) {
+			// Addresses https://github.com/roboll/helmfile/issues/279
+			case *state.StateLoadError:
+				switch stateLoadErr.Cause.(type) {
+				case *state.UndefinedEnvError:
+					return nil
+				default:
+					return err
+				}
+			default:
+				return err
+			}
+		}
+
+		errs := []error{}
+
+		if len(st.Helmfiles) > 0 {
+			noMatchInSubHelmfiles := true
+			for _, m := range st.Helmfiles {
+				if err := a.VisitDesiredStates(m, converge); err != nil {
+					switch err.(type) {
+					case *NoMatchingHelmfileError:
+
+					default:
+						return fmt.Errorf("failed processing %s: %v", m, err)
+					}
+				} else {
+					noMatchInSubHelmfiles = false
+				}
+			}
+			noMatchInHelmfiles = noMatchInHelmfiles && noMatchInSubHelmfiles
+		} else {
+			var err error
+			st, err = st.ExecuteTemplates()
+			if err != nil {
+				return fmt.Errorf("failed executing release templates in \"%s\": %v", f, err)
+			}
+
+			var processed bool
+			processed, errs = converge(st, helm)
+			noMatchInHelmfiles = noMatchInHelmfiles && !processed
+		}
+
+		return clean(st, errs)
+	})
+	if err != nil {
+		return err
+	}
+	if noMatchInHelmfiles {
+		return &NoMatchingHelmfileError{selectors: a.Selectors, env: a.Env}
+	}
+	return nil
+}
+
+func (a *App) VisitDesiredStatesWithReleasesFiltered(fileOrDir string, converge func(*state.HelmState, helmexec.Interface) []error) error {
+	selectors := a.Selectors
+
+	err := a.VisitDesiredStates(fileOrDir, func(st *state.HelmState, helm helmexec.Interface) (bool, []error) {
+		if len(selectors) > 0 {
+			err := st.FilterReleases(selectors)
+			if err != nil {
+				return false, []error{err}
+			}
+		}
+
+		releaseNameCounts := map[string]int{}
+		for _, r := range st.Releases {
+			releaseNameCounts[r.Name]++
+		}
+		for name, c := range releaseNameCounts {
+			if c > 1 {
+				return false, []error{fmt.Errorf("duplicate release \"%s\" found: there were %d releases named \"%s\" matching specified selector", name, c, name)}
+			}
+		}
+
+		errs := converge(st, helm)
+
+		processed := len(st.Releases) != 0 && len(errs) == 0
+
+		return processed, errs
+	})
+	if err != nil {
+		return err
+	}
+	return nil
+}
+
+func (a *App) findStateFilesInAbsPaths(specifiedPath string) ([]string, error) {
+	rels, err := a.findDesiredStateFiles(specifiedPath)
+	if err != nil {
+		return rels, err
+	}
+
+	files := make([]string, len(rels))
+	for i := range rels {
+		files[i], err = filepath.Abs(rels[i])
+		if err != nil {
+			return []string{}, err
+		}
+	}
+	return files, nil
+}
+
+func (a *App) findDesiredStateFiles(specifiedPath string) ([]string, error) {
+	var helmfileDir string
+	if specifiedPath != "" {
+		if a.fileExistsAt(specifiedPath) {
+			return []string{specifiedPath}, nil
+		} else if a.directoryExistsAt(specifiedPath) {
+			helmfileDir = specifiedPath
+		} else {
+			return []string{}, fmt.Errorf("specified state file %s is not found", specifiedPath)
+		}
+	} else {
+		var defaultFile string
+		if a.fileExistsAt(DefaultHelmfile) {
+			defaultFile = DefaultHelmfile
+		} else if a.fileExistsAt(DeprecatedHelmfile) {
+			log.Printf(
+				"warn: %s is being loaded: %s is deprecated in favor of %s. See https://github.com/roboll/helmfile/issues/25 for more information",
+				DeprecatedHelmfile,
+				DeprecatedHelmfile,
+				DefaultHelmfile,
+			)
+			defaultFile = DeprecatedHelmfile
+		}
+
+		if a.directoryExistsAt(DefaultHelmfileDirectory) {
+			if defaultFile != "" {
+				return []string{}, fmt.Errorf("configuration conlict error: you can have either %s or %s, but not both", defaultFile, DefaultHelmfileDirectory)
+			}
+
+			helmfileDir = DefaultHelmfileDirectory
+		} else if defaultFile != "" {
+			return []string{defaultFile}, nil
+		} else {
+			return []string{}, fmt.Errorf("no state file found. It must be named %s/*.yaml, %s, or %s, or otherwise specified with the --file flag", DefaultHelmfileDirectory, DefaultHelmfile, DeprecatedHelmfile)
+		}
+	}
+
+	files, err := a.glob(filepath.Join(helmfileDir, "*.yaml"))
+	if err != nil {
+		return []string{}, err
+	}
+	sort.Slice(files, func(i, j int) bool {
+		return files[i] < files[j]
+	})
+	return files, nil
+}
+
+func fileExistsAt(path string) bool {
+	fileInfo, err := os.Stat(path)
+	return err == nil && fileInfo.Mode().IsRegular()
+}
+
+func directoryExistsAt(path string) bool {
+	fileInfo, err := os.Stat(path)
+	return err == nil && fileInfo.Mode().IsDir()
+}
+
+func (a *App) loadDesiredStateFromYaml(yaml []byte, file string, namespace string, env string) (*state.HelmState, error) {
+	c := state.NewCreator(a.Logger, a.readFile, a.abs)
+	st, err := c.CreateFromYaml(yaml, file, env)
+	if err != nil {
+		return nil, err
+	}
+
+	helmfiles := []string{}
+	for _, globPattern := range st.Helmfiles {
+		var absPathPattern string
+		if filepath.IsAbs(globPattern) {
+			absPathPattern = globPattern
+		} else {
+			absPathPattern = st.JoinBase(globPattern)
+		}
+		matches, err := a.glob(absPathPattern)
+		if err != nil {
+			return nil, fmt.Errorf("failed processing %s: %v", globPattern, err)
+		}
+		sort.Strings(matches)
+
+		helmfiles = append(helmfiles, matches...)
+	}
+	st.Helmfiles = helmfiles
+
+	if a.Reverse {
+		rev := func(i, j int) bool {
+			return j < i
+		}
+		sort.Slice(st.Releases, rev)
+		sort.Slice(st.Helmfiles, rev)
+	}
+
+	if a.KubeContext != "" {
+		if st.HelmDefaults.KubeContext != "" {
+			log.Printf("err: Cannot use option --kube-context and set attribute helmDefaults.kubeContext.")
+			os.Exit(1)
+		}
+		st.HelmDefaults.KubeContext = a.KubeContext
+	}
+	if namespace != "" {
+		if st.Namespace != "" {
+			log.Printf("err: Cannot use option --namespace and set attribute namespace.")
+			os.Exit(1)
+		}
+		st.Namespace = namespace
+	}
+
+	sigs := make(chan os.Signal, 1)
+	signal.Notify(sigs, syscall.SIGINT, syscall.SIGTERM)
+	go func() {
+		sig := <-sigs
+
+		errs := []error{fmt.Errorf("Received [%s] to shutdown ", sig)}
+		_ = clean(st, errs)
+		// See http://tldp.org/LDP/abs/html/exitcodes.html
+		switch sig {
+		case syscall.SIGINT:
+			os.Exit(130)
+		case syscall.SIGTERM:
+			os.Exit(143)
+		}
+	}()
+
+	return st, nil
+}
+
+func clean(st *state.HelmState, errs []error) error {
+	if errs == nil {
+		errs = []error{}
+	}
+
+	cleanErrs := st.Clean()
+	if cleanErrs != nil {
+		errs = append(errs, cleanErrs...)
+	}
+
+	if errs != nil && len(errs) > 0 {
+		for _, err := range errs {
+			switch e := err.(type) {
+			case *state.ReleaseError:
+				fmt.Printf("err: release \"%s\" in \"%s\" failed: %v\n", e.Name, st.FilePath, e)
+			default:
+				fmt.Printf("err: %v\n", e)
+			}
+		}
+		return errs[0]
+	}
+	return nil
+}

pkg/app/app_test.go

@@ -0,0 +1,403 @@
+package app
+
+import (
+	"fmt"
+	"github.com/roboll/helmfile/helmexec"
+	"github.com/roboll/helmfile/state"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+)
+
+type testFs struct {
+	wd    string
+	dirs  map[string]bool
+	files map[string]string
+}
+
+func appWithFs(app *App, files map[string]string) *App {
+	fs := newTestFs(files)
+	return injectFs(app, fs)
+}
+
+func injectFs(app *App, fs *testFs) *App {
+	app.readFile = fs.readFile
+	app.glob = fs.glob
+	app.abs = fs.abs
+	app.getwd = fs.getwd
+	app.chdir = fs.chdir
+	app.fileExistsAt = fs.fileExistsAt
+	app.directoryExistsAt = fs.directoryExistsAt
+	return app
+}
+
+func newTestFs(files map[string]string) *testFs {
+	dirs := map[string]bool{}
+	for abs, _ := range files {
+		d := filepath.Dir(abs)
+		dirs[d] = true
+	}
+	return &testFs{
+		wd:    "/path/to",
+		dirs:  dirs,
+		files: files,
+	}
+}
+
+func (f *testFs) fileExistsAt(path string) bool {
+	var ok bool
+	if strings.Contains(path, "/") {
+		_, ok = f.files[path]
+	} else {
+		_, ok = f.files[filepath.Join(f.wd, path)]
+	}
+	return ok
+}
+
+func (f *testFs) directoryExistsAt(path string) bool {
+	var ok bool
+	if strings.Contains(path, "/") {
+		_, ok = f.dirs[path]
+	} else {
+		_, ok = f.dirs[filepath.Join(f.wd, path)]
+	}
+	return ok
+}
+
+func (f *testFs) readFile(filename string) ([]byte, error) {
+	var str string
+	var ok bool
+	if strings.Contains(filename, "/") {
+		str, ok = f.files[filename]
+	} else {
+		str, ok = f.files[filepath.Join(f.wd, filename)]
+	}
+	if !ok {
+		return []byte(nil), fmt.Errorf("no file found: %s", filename)
+	}
+	return []byte(str), nil
+}
+
+func (f *testFs) glob(pattern string) ([]string, error) {
+	matches := []string{}
+	for name, _ := range f.files {
+		matched, err := filepath.Match(pattern, name)
+		if err != nil {
+			return nil, err
+		}
+		if matched {
+			matches = append(matches, name)
+		}
+	}
+	if len(matches) == 0 {
+		return []string(nil), fmt.Errorf("no file matched: %s", pattern)
+	}
+	return matches, nil
+}
+
+func (f *testFs) abs(path string) (string, error) {
+	var p string
+	if path[0] == '/' {
+		p = path
+	} else {
+		p = filepath.Join(f.wd, path)
+	}
+	return filepath.Clean(p), nil
+}
+
+func (f *testFs) getwd() (string, error) {
+	return f.wd, nil
+}
+
+func (f *testFs) chdir(dir string) error {
+	if dir == "/path/to" || dir == "/path/to/helmfile.d" {
+		f.wd = dir
+		return nil
+	}
+	return fmt.Errorf("unexpected chdir \"%s\"", dir)
+}
+
+// See https://github.com/roboll/helmfile/issues/193
+func TestVisitDesiredStatesWithReleasesFiltered(t *testing.T) {
+	files := map[string]string{
+		"/path/to/helmfile.yaml": `
+helmfiles:
+- helmfile.d/a*.yaml
+- helmfile.d/b*.yaml
+`,
+		"/path/to/helmfile.d/a1.yaml": `
+releases:
+- name: zipkin
+  chart: stable/zipkin
+`,
+		"/path/to/helmfile.d/a2.yaml": `
+releases:
+- name: prometheus
+  chart: stable/prometheus
+`,
+		"/path/to/helmfile.d/b.yaml": `
+releases:
+- name: grafana
+  chart: stable/grafana
+`,
+	}
+	noop := func(st *state.HelmState, helm helmexec.Interface) []error {
+		return []error{}
+	}
+
+	testcases := []struct {
+		name      string
+		expectErr bool
+	}{
+		{name: "prometheus", expectErr: false},
+		{name: "zipkin", expectErr: false},
+		{name: "grafana", expectErr: false},
+		{name: "elasticsearch", expectErr: true},
+	}
+
+	for _, testcase := range testcases {
+		app := appWithFs(&App{
+			KubeContext: "default",
+			Logger:      helmexec.NewLogger(os.Stderr, "debug"),
+			Selectors:   []string{fmt.Sprintf("name=%s", testcase.name)},
+			Namespace:   "",
+			Env:         "default",
+		}, files)
+		err := app.VisitDesiredStatesWithReleasesFiltered(
+			"helmfile.yaml", noop,
+		)
+		if testcase.expectErr && err == nil {
+			t.Errorf("error expected but not happened for name=%s", testcase.name)
+		} else if !testcase.expectErr && err != nil {
+			t.Errorf("unexpected error for name=%s: %v", testcase.name, err)
+		}
+	}
+}
+
+// See https://github.com/roboll/helmfile/issues/320
+func TestVisitDesiredStatesWithReleasesFiltered_UndefinedEnv(t *testing.T) {
+	files := map[string]string{
+		"/path/to/helmfile.yaml": `
+environments:
+  prod:
+
+helmfiles:
+- helmfile.d/a*.yaml
+`,
+		"/path/to/helmfile.d/a1.yaml": `
+environments:
+  prod:
+
+releases:
+- name: zipkin
+  chart: stable/zipkin
+`,
+	}
+	noop := func(st *state.HelmState, helm helmexec.Interface) []error {
+		return []error{}
+	}
+
+	testcases := []struct {
+		name      string
+		expectErr bool
+	}{
+		{name: "undefined_env", expectErr: true},
+		{name: "default", expectErr: false},
+		{name: "prod", expectErr: false},
+	}
+
+	for _, testcase := range testcases {
+		app := appWithFs(&App{
+			KubeContext: "default",
+			Logger:      helmexec.NewLogger(os.Stderr, "debug"),
+			Namespace:   "",
+			Selectors:   []string{},
+			Env:         testcase.name,
+		}, files)
+		err := app.VisitDesiredStatesWithReleasesFiltered(
+			"helmfile.yaml", noop,
+		)
+		if testcase.expectErr && err == nil {
+			t.Errorf("error expected but not happened for environment=%s", testcase.name)
+		} else if !testcase.expectErr && err != nil {
+			t.Errorf("unexpected error for environment=%s: %v", testcase.name, err)
+		}
+	}
+}
+
+// See https://github.com/roboll/helmfile/issues/322
+func TestVisitDesiredStatesWithReleasesFiltered_Selectors(t *testing.T) {
+	files := map[string]string{
+		"/path/to/helmfile.yaml": `
+helmfiles:
+- helmfile.d/a*.yaml
+- helmfile.d/b*.yaml
+`,
+		"/path/to/helmfile.d/a1.yaml": `
+releases:
+- name: zipkin
+  chart: stable/zipkin
+`,
+		"/path/to/helmfile.d/a2.yaml": `
+releases:
+- name: prometheus
+  chart: stable/prometheus
+`,
+		"/path/to/helmfile.d/b.yaml": `
+releases:
+- name: grafana
+  chart: stable/grafana
+- name: foo
+  chart: charts/foo
+  labels:
+    duplicated: yes
+- name: foo
+  chart: charts/foo
+  labels:
+    duplicated: yes
+`,
+	}
+
+	testcases := []struct {
+		label         string
+		expectedCount int
+		expectErr     bool
+		errMsg        string
+	}{
+		{label: "name=prometheus", expectedCount: 1, expectErr: false},
+		{label: "name=", expectedCount: 0, expectErr: true, errMsg: "failed processing /path/to/helmfile.d/a1.yaml: Malformed label: name=. Expected label in form k=v or k!=v"},
+		{label: "name!=", expectedCount: 0, expectErr: true, errMsg: "failed processing /path/to/helmfile.d/a1.yaml: Malformed label: name!=. Expected label in form k=v or k!=v"},
+		{label: "name", expectedCount: 0, expectErr: true, errMsg: "failed processing /path/to/helmfile.d/a1.yaml: Malformed label: name. Expected label in form k=v or k!=v"},
+		// See https://github.com/roboll/helmfile/issues/193
+		{label: "duplicated=yes", expectedCount: 0, expectErr: true, errMsg: "failed processing /path/to/helmfile.d/b.yaml: duplicate release \"foo\" found: there were 2 releases named \"foo\" matching specified selector"},
+	}
+
+	for _, testcase := range testcases {
+		actual := []string{}
+
+		collectReleases := func(st *state.HelmState, helm helmexec.Interface) []error {
+			for _, r := range st.Releases {
+				actual = append(actual, r.Name)
+			}
+			return []error{}
+		}
+
+		app := appWithFs(&App{
+			KubeContext: "default",
+			Logger:      helmexec.NewLogger(os.Stderr, "debug"),
+			Namespace:   "",
+			Selectors:   []string{testcase.label},
+			Env:         "default",
+		}, files)
+
+		err := app.VisitDesiredStatesWithReleasesFiltered(
+			"helmfile.yaml", collectReleases,
+		)
+		if testcase.expectErr {
+			if err == nil {
+				t.Errorf("error expected but not happened for selector %s", testcase.label)
+			} else if err.Error() != testcase.errMsg {
+				t.Errorf("unexpected error message: expected=\"%s\", actual=\"%s\"", testcase.errMsg, err.Error())
+			}
+		} else if !testcase.expectErr && err != nil {
+			t.Errorf("unexpected error for selector %s: %v", testcase.label, err)
+		}
+		if len(actual) != testcase.expectedCount {
+			t.Errorf("unexpected release count for selector %s: expected=%d, actual=%d", testcase.label, testcase.expectedCount, len(actual))
+		}
+	}
+}
+
+// See https://github.com/roboll/helmfile/issues/312
+func TestVisitDesiredStatesWithReleasesFiltered_ReverseOrder(t *testing.T) {
+	files := map[string]string{
+		"/path/to/helmfile.yaml": `
+helmfiles:
+- helmfile.d/a*.yaml
+- helmfile.d/b*.yaml
+`,
+		"/path/to/helmfile.d/a1.yaml": `
+releases:
+- name: zipkin
+  chart: stable/zipkin
+`,
+		"/path/to/helmfile.d/a2.yaml": `
+releases:
+- name: prometheus
+  chart: stable/prometheus
+- name: elasticsearch
+  chart: stable/elasticsearch
+`,
+		"/path/to/helmfile.d/b.yaml": `
+releases:
+- name: grafana
+  chart: stable/grafana
+`,
+	}
+
+	expected := []string{"grafana", "elasticsearch", "prometheus", "zipkin"}
+
+	testcases := []struct {
+		reverse  bool
+		expected []string
+	}{
+		{reverse: false, expected: []string{"zipkin", "prometheus", "elasticsearch", "grafana"}},
+		{reverse: true, expected: []string{"grafana", "elasticsearch", "prometheus", "zipkin"}},
+	}
+	for _, testcase := range testcases {
+		actual := []string{}
+
+		collectReleases := func(st *state.HelmState, helm helmexec.Interface) []error {
+			for _, r := range st.Releases {
+				actual = append(actual, r.Name)
+			}
+			return []error{}
+		}
+		app := appWithFs(&App{
+			KubeContext: "default",
+			Logger:      helmexec.NewLogger(os.Stderr, "debug"),
+			Reverse:     testcase.reverse,
+			Namespace:   "",
+			Selectors:   []string{},
+			Env:         "default",
+		}, files)
+		err := app.VisitDesiredStatesWithReleasesFiltered(
+			"helmfile.yaml", collectReleases,
+		)
+		if err != nil {
+			t.Errorf("unexpected error: %v", err)
+		}
+		if !reflect.DeepEqual(testcase.expected, actual) {
+			t.Errorf("releases did not match: expected=%v actual=%v", expected, actual)
+		}
+	}
+}
+
+func TestLoadDesiredStateFromYaml_DuplicateReleaseName(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease1
+  chart: mychart1
+  labels:
+    stage: pre
+    foo: bar
+- name: myrelease1
+  chart: mychart2
+  labels:
+    stage: post
+`)
+	app := &App{
+		readFile:    ioutil.ReadFile,
+		glob:        filepath.Glob,
+		abs:         filepath.Abs,
+		KubeContext: "default",
+		Logger:      helmexec.NewLogger(os.Stderr, "debug"),
+	}
+	_, err := app.loadDesiredStateFromYaml(yamlContent, yamlFile, "default", "default")
+	if err != nil {
+		t.Error("unexpected error")
+	}
+}

pkg/app/constants.go

@@ -0,0 +1,7 @@
+package app
+
+const (
+	DefaultHelmfile          = "helmfile.yaml"
+	DeprecatedHelmfile       = "charts.yaml"
+	DefaultHelmfileDirectory = "helmfile.d"
+)

pkg/app/context.go

@@ -0,0 +1,33 @@
+package app
+
+import "github.com/roboll/helmfile/state"
+
+type Context struct {
+	updatedRepos map[string]struct{}
+}
+
+func NewContext() Context {
+	return Context{
+		updatedRepos: map[string]struct{}{},
+	}
+}
+
+func (ctx Context) SyncReposOnce(st *state.HelmState, helm state.RepoUpdater) []error {
+	var errs []error
+
+	allUpdated := true
+	for _, r := range st.Repositories {
+		_, exists := ctx.updatedRepos[r.Name]
+		allUpdated = allUpdated && exists
+	}
+
+	if !allUpdated {
+		errs = st.SyncRepos(helm)
+
+		for _, r := range st.Repositories {
+			ctx.updatedRepos[r.Name] = struct{}{}
+		}
+	}
+
+	return errs
+}

pkg/app/errors.go

@@ -0,0 +1,19 @@
+package app
+
+import (
+	"fmt"
+	"strings"
+)
+
+type NoMatchingHelmfileError struct {
+	selectors []string
+	env       string
+}
+
+func (e *NoMatchingHelmfileError) Error() string {
+	return fmt.Sprintf(
+		"err: no releases found that matches specified selector(%s) and environment(%s), in any helmfile",
+		strings.Join(e.selectors, ", "),
+		e.env,
+	)
+}

pkg/app/two_pass_renderer.go

@@ -0,0 +1,80 @@
+package app
+
+import (
+	"bytes"
+	"fmt"
+	"github.com/roboll/helmfile/environment"
+	"github.com/roboll/helmfile/state"
+	"github.com/roboll/helmfile/tmpl"
+	"go.uber.org/zap"
+	"path/filepath"
+	"strings"
+)
+
+func prependLineNumbers(text string) string {
+	buf := bytes.NewBufferString("")
+	lines := strings.Split(text, "\n")
+	for i, line := range lines {
+		buf.WriteString(fmt.Sprintf("%2d: %s\n", i, line))
+	}
+	return buf.String()
+}
+
+type twoPassRenderer struct {
+	reader    func(string) ([]byte, error)
+	env       string
+	namespace string
+	filename  string
+	logger    *zap.SugaredLogger
+	abs       func(string) (string, error)
+}
+
+func (r *twoPassRenderer) renderEnvironment(content []byte) environment.Environment {
+	firstPassEnv := environment.Environment{Name: r.env, Values: map[string]interface{}(nil)}
+	tmplData := state.EnvironmentTemplateData{Environment: firstPassEnv, Namespace: r.namespace}
+	firstPassRenderer := tmpl.NewFirstPassRenderer(filepath.Dir(r.filename), tmplData)
+
+	// parse as much as we can, tolerate errors, this is a preparse
+	yamlBuf, err := firstPassRenderer.RenderTemplateContentToBuffer(content)
+	if err != nil && r.logger != nil {
+		r.logger.Debugf("first-pass rendering input of \"%s\":\n%s", r.filename, prependLineNumbers(string(content)))
+		if yamlBuf == nil { // we have a template syntax error, let the second parse report
+			r.logger.Debugf("template syntax error: %v", err)
+			return firstPassEnv
+		}
+	}
+	c := state.NewCreator(r.logger, r.reader, r.abs)
+	c.Strict = false
+	// create preliminary state, as we may have an environment. Tolerate errors.
+	prestate, err := c.CreateFromYaml(yamlBuf.Bytes(), r.filename, r.env)
+	if err != nil && r.logger != nil {
+		switch err.(type) {
+		case *state.StateLoadError:
+			r.logger.Infof("could not deduce `environment:` block, configuring only .Environment.Name. error: %v", err)
+		}
+		r.logger.Debugf("error in first-pass rendering: result of \"%s\":\n%s", r.filename, prependLineNumbers(yamlBuf.String()))
+	}
+	if prestate != nil {
+		firstPassEnv = prestate.Env
+	}
+	return firstPassEnv
+}
+
+func (r *twoPassRenderer) renderTemplate(content []byte) (*bytes.Buffer, error) {
+	// try a first pass render. This will always succeed, but can produce a limited env
+	firstPassEnv := r.renderEnvironment(content)
+
+	tmplData := state.EnvironmentTemplateData{Environment: firstPassEnv, Namespace: r.namespace}
+	secondPassRenderer := tmpl.NewFileRenderer(r.reader, filepath.Dir(r.filename), tmplData)
+	yamlBuf, err := secondPassRenderer.RenderTemplateContentToBuffer(content)
+	if err != nil {
+		if r.logger != nil {
+			r.logger.Debugf("second-pass rendering failed, input of \"%s\":\n%s", r.filename, prependLineNumbers(string(content)))
+		}
+		return nil, err
+	}
+	if r.logger != nil {
+		r.logger.Debugf("second-pass rendering result of \"%s\":\n%s", r.filename, prependLineNumbers(yamlBuf.String()))
+	}
+	return yamlBuf, nil
+}

pkg/app/two_pass_renderer_test.go

@@ -0,0 +1,256 @@
+package app
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"github.com/roboll/helmfile/helmexec"
+	"github.com/roboll/helmfile/state"
+	"gopkg.in/yaml.v2"
+)
+
+func makeRenderer(readFile func(string) ([]byte, error), env string) *twoPassRenderer {
+	return &twoPassRenderer{
+		reader:    readFile,
+		env:       env,
+		namespace: "namespace",
+		filename:  "",
+		logger:    helmexec.NewLogger(os.Stdout, "debug"),
+		abs:       filepath.Abs,
+	}
+}
+
+func TestReadFromYaml_MakeEnvironmentHasNoSideEffects(t *testing.T) {
+
+	yamlContent := []byte(`
+environments:
+  staging:
+    values:
+    - default/values.yaml
+  production:
+
+releases:
+- name: {{ readFile "other/default/values.yaml" }}
+  chart: mychart1
+`)
+
+	fileReaderCalls := 0
+	// make a reader that returns a simulated context
+	fileReader := func(filename string) ([]byte, error) {
+		expectedFilename := filepath.Clean("default/values.yaml")
+		if !strings.HasSuffix(filename, expectedFilename) {
+			return nil, fmt.Errorf("unexpected filename: expected=%s, actual=%s", expectedFilename, filename)
+		}
+		fileReaderCalls++
+		if fileReaderCalls == 2 {
+			return []byte("SecondPass"), nil
+		}
+		return []byte(""), nil
+	}
+
+	r := makeRenderer(fileReader, "staging")
+	yamlBuf, err := r.renderTemplate(yamlContent)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	var state state.HelmState
+	err = yaml.Unmarshal(yamlBuf.Bytes(), &state)
+
+	if fileReaderCalls > 2 {
+		t.Error("reader should be called only twice")
+	}
+
+	if state.Releases[0].Name != "SecondPass" {
+		t.Errorf("release name should have ben set as SecondPass")
+	}
+}
+
+func TestReadFromYaml_RenderTemplate(t *testing.T) {
+
+	defaultValuesYaml := []byte(`
+releaseName: "hello"
+conditionalReleaseTag: "yes"
+`)
+
+	yamlContent := []byte(`
+environments:
+  staging:
+    values:
+    - default/values.yaml
+  production:
+
+releases:
+- name: {{ .Environment.Values.releaseName }}
+  chart: mychart1
+
+{{ if (eq .Environment.Values.conditionalReleaseTag "yes") }}
+- name: conditionalRelease
+{{ end }}
+
+`)
+
+	// make a reader that returns a simulated context
+	fileReader := func(filename string) ([]byte, error) {
+		expectedFilename := filepath.Clean("default/values.yaml")
+		if !strings.HasSuffix(filename, expectedFilename) {
+			return nil, fmt.Errorf("unexpected filename: expected=%s, actual=%s", expectedFilename, filename)
+		}
+		return defaultValuesYaml, nil
+	}
+
+	r := makeRenderer(fileReader, "staging")
+	// test the double rendering
+	yamlBuf, err := r.renderTemplate(yamlContent)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	var state state.HelmState
+	err = yaml.Unmarshal(yamlBuf.Bytes(), &state)
+
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	if len(state.Releases) != 2 {
+		t.Fatal("there should be 2 releases")
+	}
+
+	if state.Releases[0].Name != "hello" {
+		t.Errorf("release name should be hello")
+	}
+
+	if state.Releases[1].Name != "conditionalRelease" {
+		t.Error("conditional release should have been present")
+	}
+}
+
+func TestReadFromYaml_RenderTemplateWithValuesReferenceError(t *testing.T) {
+	defaultValuesYaml := []byte("")
+
+	yamlContent := []byte(`
+environments:
+  staging:
+    values:
+    - default/values.yaml
+  production:
+
+{{ if (eq .Environment.Values.releaseName "a") }} # line 8
+releases:
+- name: a
+	chart: mychart1
+{{ end }}
+`)
+
+	// make a reader that returns a simulated context
+	fileReader := func(filename string) ([]byte, error) {
+		return defaultValuesYaml, nil
+	}
+
+	r := makeRenderer(fileReader, "staging")
+	// test the double rendering
+	_, err := r.renderTemplate(yamlContent)
+
+	if !strings.Contains(err.Error(), "stringTemplate:8") {
+		t.Fatalf("error should contain a stringTemplate error (reference to unknow key) %v", err)
+	}
+}
+
+// This test shows that a gotmpl reference will get rendered correctly
+// even if the pre-render disables the readFile and exec functions.
+// This does not apply to .gotmpl files, which is a nice side-effect.
+func TestReadFromYaml_RenderTemplateWithGotmpl(t *testing.T) {
+
+	defaultValuesYamlGotmpl := []byte(`
+releaseName: {{ readFile "nonIgnoredFile" }}
+`)
+
+	yamlContent := []byte(`
+environments:
+  staging:
+    values:
+    - values.yaml.gotmpl
+  production:
+
+{{ if (eq .Environment.Values.releaseName "release-a") }} # line 8
+releases:
+- name: a
+  chart: mychart1
+{{ end }}
+`)
+
+	fileReader := func(filename string) ([]byte, error) {
+		if strings.HasSuffix(filename, "nonIgnoredFile") {
+			return []byte("release-a"), nil
+		}
+		return defaultValuesYamlGotmpl, nil
+	}
+
+	r := makeRenderer(fileReader, "staging")
+	rendered, _ := r.renderTemplate(yamlContent)
+
+	var state state.HelmState
+	yaml.Unmarshal(rendered.Bytes(), &state)
+
+	if len(state.Releases) != 1 {
+		t.Fatal("there should be 1 release")
+	}
+
+	if state.Releases[0].Name != "a" {
+		t.Fatal("release should have been declared")
+	}
+}
+
+func TestReadFromYaml_RenderTemplateWithNamespace(t *testing.T) {
+	defaultValuesYaml := []byte(``)
+	yamlContent := []byte(`releases:
+- name: {{ .Namespace }}-myrelease
+  chart: mychart
+`)
+
+	// make a reader that returns a simulated context
+	fileReader := func(filename string) ([]byte, error) {
+		return defaultValuesYaml, nil
+	}
+
+	r := makeRenderer(fileReader, "staging")
+	yamlBuf, err := r.renderTemplate(yamlContent)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+
+	var state state.HelmState
+	err = yaml.Unmarshal(yamlBuf.Bytes(), &state)
+
+	if state.Releases[0].Name != "namespace-myrelease" {
+		t.Errorf("release name should be namespace-myrelease")
+	}
+}
+
+func TestReadFromYaml_HelfileShouldBeResilentToTemplateErrors(t *testing.T) {
+	yamlContent := []byte(`environments:
+  staging:
+	production:
+
+releases:
+{{ if (eq .Environment.Name "production" }}  # notice syntax error: unclosed left paren
+- name: prod-myrelease
+{{ else }}
+- name: myapp
+{{ end }}
+  chart: mychart
+`)
+	fileReader := func(filename string) ([]byte, error) {
+		return yamlContent, nil
+	}
+
+	r := makeRenderer(fileReader, "staging")
+	_, err := r.renderTemplate(yamlContent)
+	if err == nil {
+		t.Fatalf("wanted error, none returned")
+	}
+}

state/create.go

@@ -0,0 +1,172 @@
+package state
+
+import (
+	"bytes"
+	"fmt"
+	"github.com/imdario/mergo"
+	"github.com/roboll/helmfile/environment"
+	"github.com/roboll/helmfile/helmexec"
+	"github.com/roboll/helmfile/tmpl"
+	"go.uber.org/zap"
+	"gopkg.in/yaml.v2"
+	"io"
+	"io/ioutil"
+	"os"
+	"path/filepath"
+)
+
+type StateLoadError struct {
+	msg   string
+	Cause error
+}
+
+func (e *StateLoadError) Error() string {
+	return fmt.Sprintf("%s: %v", e.msg, e.Cause)
+}
+
+type UndefinedEnvError struct {
+	msg string
+}
+
+func (e *UndefinedEnvError) Error() string {
+	return e.msg
+}
+
+func createFromYaml(content []byte, file string, env string, logger *zap.SugaredLogger) (*HelmState, error) {
+	c := &creator{
+		logger,
+		ioutil.ReadFile,
+		filepath.Abs,
+		true,
+	}
+	return c.CreateFromYaml(content, file, env)
+}
+
+type creator struct {
+	logger   *zap.SugaredLogger
+	readFile func(string) ([]byte, error)
+	abs      func(string) (string, error)
+
+	Strict bool
+}
+
+func NewCreator(logger *zap.SugaredLogger, readFile func(string) ([]byte, error), abs func(string) (string, error)) *creator {
+	return &creator{
+		logger:   logger,
+		readFile: readFile,
+		abs:      abs,
+		Strict:   true,
+	}
+}
+
+func (c *creator) CreateFromYaml(content []byte, file string, env string) (*HelmState, error) {
+	var state HelmState
+
+	basePath, err := c.abs(filepath.Dir(file))
+	if err != nil {
+		return nil, &StateLoadError{fmt.Sprintf("failed to read %s", file), err}
+	}
+	state.FilePath = file
+	state.basePath = basePath
+
+	decoder := yaml.NewDecoder(bytes.NewReader(content))
+	if !c.Strict {
+		decoder.SetStrict(false)
+	} else {
+		decoder.SetStrict(true)
+	}
+	i := 0
+	for {
+		i++
+
+		var intermediate HelmState
+
+		err := decoder.Decode(&intermediate)
+		if err == io.EOF {
+			break
+		} else if err != nil {
+			return nil, &StateLoadError{fmt.Sprintf("failed to read %s: reading document at index %d", file, i), err}
+		}
+
+		if err := mergo.Merge(&state, &intermediate, mergo.WithAppendSlice); err != nil {
+			return nil, &StateLoadError{fmt.Sprintf("failed to read %s: merging document at index %d", file, i), err}
+		}
+	}
+
+	if len(state.DeprecatedReleases) > 0 {
+		if len(state.Releases) > 0 {
+			return nil, fmt.Errorf("failed to parse %s: you can't specify both `charts` and `releases` sections", file)
+		}
+		state.Releases = state.DeprecatedReleases
+		state.DeprecatedReleases = []ReleaseSpec{}
+	}
+
+	if state.DeprecatedContext != "" && state.HelmDefaults.KubeContext == "" {
+		state.HelmDefaults.KubeContext = state.DeprecatedContext
+	}
+
+	state.logger = c.logger
+
+	e, err := state.loadEnv(env, c.readFile)
+	if err != nil {
+		return nil, &StateLoadError{fmt.Sprintf("failed to read %s", file), err}
+	}
+	state.Env = *e
+
+	state.readFile = c.readFile
+
+	return &state, nil
+}
+
+func (st *HelmState) loadEnv(name string, readFile func(string) ([]byte, error)) (*environment.Environment, error) {
+	envVals := map[string]interface{}{}
+	envSpec, ok := st.Environments[name]
+	if ok {
+		for _, envvalFile := range envSpec.Values {
+			envvalFullPath := filepath.Join(st.basePath, envvalFile)
+			tmplData := EnvironmentTemplateData{Environment: environment.EmptyEnvironment, Namespace: ""}
+			r := tmpl.NewFileRenderer(readFile, filepath.Dir(envvalFullPath), tmplData)
+			bytes, err := r.RenderToBytes(envvalFullPath)
+			if err != nil {
+				return nil, fmt.Errorf("failed to load environment values file \"%s\": %v", envvalFile, err)
+			}
+			m := map[string]interface{}{}
+			if err := yaml.Unmarshal(bytes, &m); err != nil {
+				return nil, fmt.Errorf("failed to load environment values file \"%s\": %v", envvalFile, err)
+			}
+			if err := mergo.Merge(&envVals, &m, mergo.WithOverride); err != nil {
+				return nil, fmt.Errorf("failed to load \"%s\": %v", envvalFile, err)
+			}
+		}
+
+		if len(envSpec.Secrets) > 0 {
+			helm := helmexec.New(st.logger, "")
+			for _, secFile := range envSpec.Secrets {
+				path := filepath.Join(st.basePath, secFile)
+				if _, err := os.Stat(path); os.IsNotExist(err) {
+					return nil, err
+				}
+
+				decFile, err := helm.DecryptSecret(path)
+				if err != nil {
+					return nil, err
+				}
+				bytes, err := readFile(decFile)
+				if err != nil {
+					return nil, fmt.Errorf("failed to load environment secrets file \"%s\": %v", secFile, err)
+				}
+				m := map[string]interface{}{}
+				if err := yaml.Unmarshal(bytes, &m); err != nil {
+					return nil, fmt.Errorf("failed to load environment secrets file \"%s\": %v", secFile, err)
+				}
+				if err := mergo.Merge(&envVals, &m, mergo.WithOverride); err != nil {
+					return nil, fmt.Errorf("failed to load \"%s\": %v", secFile, err)
+				}
+			}
+		}
+	} else if name != DefaultEnv {
+		return nil, &UndefinedEnvError{msg: fmt.Sprintf("environment \"%s\" is not defined", name)}
+	}
+
+	return &environment.Environment{Name: name, Values: envVals}, nil
+}

state/create_test.go

@@ -0,0 +1,249 @@
+package state
+
+import (
+	"fmt"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+func TestReadFromYaml(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease
+  namespace: mynamespace
+  chart: mychart
+`)
+	state, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err != nil {
+		t.Errorf("unxpected error: %v", err)
+	}
+
+	if state.Releases[0].Name != "myrelease" {
+		t.Errorf("unexpected release name: expected=myrelease actual=%s", state.Releases[0].Name)
+	}
+	if state.Releases[0].Namespace != "mynamespace" {
+		t.Errorf("unexpected chart namespace: expected=mynamespace actual=%s", state.Releases[0].Chart)
+	}
+	if state.Releases[0].Chart != "mychart" {
+		t.Errorf("unexpected chart name: expected=mychart actual=%s", state.Releases[0].Chart)
+	}
+}
+
+func TestReadFromYaml_InexistentEnv(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease
+  namespace: mynamespace
+  chart: mychart
+`)
+	_, err := createFromYaml(yamlContent, yamlFile, "production", logger)
+	if err == nil {
+		t.Error("expected error")
+	}
+}
+
+func TestReadFromYaml_NonDefaultEnv(t *testing.T) {
+	yamlFile := "/example/path/to/helmfile.yaml"
+	yamlContent := []byte(`environments:
+  production:
+    values:
+    - foo.yaml
+    - bar.yaml.gotmpl
+
+releases:
+- name: myrelease
+  namespace: mynamespace
+  chart: mychart
+  values:
+  - values.yaml.gotmpl
+`)
+
+	fooYamlFile := "/example/path/to/foo.yaml"
+	fooYamlContent := []byte(`foo: foo
+# As this file doesn't have an file extension ".gotmpl", this template expression should not be evaluated
+baz: "{{ readFile \"baz.txt\" }}"`)
+
+	barYamlFile := "/example/path/to/bar.yaml.gotmpl"
+	barYamlContent := []byte(`foo: FOO
+bar: {{ readFile "bar.txt" }}
+`)
+
+	barTextFile := "/example/path/to/bar.txt"
+	barTextContent := []byte("BAR")
+
+	expected := map[string]interface{}{
+		"foo": "FOO",
+		"bar": "BAR",
+		// As the file doesn't have an file extension ".gotmpl", this template expression should not be evaluated
+		"baz": "{{ readFile \"baz.txt\" }}",
+	}
+
+	valuesFile := "/example/path/to/values.yaml.gotmpl"
+	valuesContent := []byte(`env: {{ .Environment.Name }}`)
+
+	expectedValues := `env: production`
+
+	readFile := func(filename string) ([]byte, error) {
+		switch filename {
+		case fooYamlFile:
+			return fooYamlContent, nil
+		case barYamlFile:
+			return barYamlContent, nil
+		case barTextFile:
+			return barTextContent, nil
+		case valuesFile:
+			return valuesContent, nil
+		}
+		return nil, fmt.Errorf("unexpected filename: %s", filename)
+	}
+
+	state, err := NewCreator(logger, readFile, filepath.Abs).CreateFromYaml(yamlContent, yamlFile, "production")
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+
+	actual := state.Env.Values
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected environment values: expected=%v, actual=%v", expected, actual)
+	}
+
+	actualValuesData, err := state.RenderValuesFileToBytes(valuesFile)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	actualValues := string(actualValuesData)
+
+	if !reflect.DeepEqual(expectedValues, actualValues) {
+		t.Errorf("unexpected values: expected=%v, actual=%v", expectedValues, actualValues)
+	}
+}
+
+func TestReadFromYaml_StrictUnmarshalling(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease
+  namespace: mynamespace
+  releases: mychart
+`)
+	_, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err == nil {
+		t.Error("expected an error for wrong key 'releases' which is not in struct")
+	}
+}
+
+func TestReadFromYaml_DeprecatedReleaseReferences(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`charts:
+- name: myrelease
+  chart: mychart
+`)
+	state, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err != nil {
+		t.Errorf("unxpected error: %v", err)
+	}
+
+	if state.Releases[0].Name != "myrelease" {
+		t.Errorf("unexpected release name: expected=myrelease actual=%s", state.Releases[0].Name)
+	}
+	if state.Releases[0].Chart != "mychart" {
+		t.Errorf("unexpected chart name: expected=mychart actual=%s", state.Releases[0].Chart)
+	}
+}
+
+func TestReadFromYaml_ConflictingReleasesConfig(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`charts:
+- name: myrelease1
+  chart: mychart1
+releases:
+- name: myrelease2
+  chart: mychart2
+`)
+	_, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err == nil {
+		t.Error("expected error")
+	}
+}
+
+func TestReadFromYaml_FilterReleasesOnLabels(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease1
+  chart: mychart1
+  labels:
+    tier: frontend
+    foo: bar
+- name: myrelease2
+  chart: mychart2
+  labels:
+    tier: frontend
+- name: myrelease3
+  chart: mychart3
+  labels:
+    tier: backend
+`)
+	cases := []struct {
+		filter  LabelFilter
+		results []bool
+	}{
+		{LabelFilter{positiveLabels: [][]string{[]string{"tier", "frontend"}}},
+			[]bool{true, true, false}},
+		{LabelFilter{positiveLabels: [][]string{[]string{"tier", "frontend"}, []string{"foo", "bar"}}},
+			[]bool{true, false, false}},
+		{LabelFilter{negativeLabels: [][]string{[]string{"tier", "frontend"}}},
+			[]bool{false, false, true}},
+		{LabelFilter{positiveLabels: [][]string{[]string{"tier", "frontend"}}, negativeLabels: [][]string{[]string{"foo", "bar"}}},
+			[]bool{false, true, false}},
+	}
+	state, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	for idx, c := range cases {
+		for idx2, expected := range c.results {
+			if f := c.filter.Match(state.Releases[idx2]); f != expected {
+				t.Errorf("[case: %d][outcome: %d] Unexpected outcome wanted %t, got %t", idx, idx2, expected, f)
+			}
+		}
+	}
+}
+
+func TestReadFromYaml_FilterNegatives(t *testing.T) {
+	yamlFile := "example/path/to/yaml/file"
+	yamlContent := []byte(`releases:
+- name: myrelease1
+  chart: mychart1
+  labels:
+    stage: pre
+    foo: bar
+- name: myrelease2
+  chart: mychart2
+  labels:
+    stage: post
+- name: myrelease3
+  chart: mychart3
+`)
+	cases := []struct {
+		filter  LabelFilter
+		results []bool
+	}{
+		{LabelFilter{positiveLabels: [][]string{[]string{"stage", "pre"}}},
+			[]bool{true, false, false}},
+		{LabelFilter{positiveLabels: [][]string{[]string{"stage", "post"}}},
+			[]bool{false, true, false}},
+		{LabelFilter{negativeLabels: [][]string{[]string{"stage", "pre"}, []string{"stage", "post"}}},
+			[]bool{false, false, true}},
+	}
+	state, err := createFromYaml(yamlContent, yamlFile, DefaultEnv, logger)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	for idx, c := range cases {
+		for idx2, expected := range c.results {
+			if f := c.filter.Match(state.Releases[idx2]); f != expected {
+				t.Errorf("[case: %d][outcome: %d] Unexpected outcome wanted %t, got %t", idx, idx2, expected, f)
+			}
+		}
+	}
+}

state/environment.go

@@ -0,0 +1,6 @@
+package state
+
+type EnvironmentSpec struct {
+	Values  []string `yaml:"values"`
+	Secrets []string `yaml:"secrets"`
+}

state/release.go

@@ -0,0 +1,69 @@
+package state
+
+import (
+	"fmt"
+	"github.com/roboll/helmfile/tmpl"
+	"gopkg.in/yaml.v2"
+)
+
+func (r ReleaseSpec) ExecuteTemplateExpressions(renderer *tmpl.FileRenderer) (*ReleaseSpec, error) {
+	var result *ReleaseSpec
+	var err error
+
+	result, err = r.Clone()
+	if err != nil {
+		return nil, fmt.Errorf("failed executing template expressions in release \"%s\": %v", r.Name, err)
+	}
+
+	{
+		ts := result.Chart
+		result.Chart, err = renderer.RenderTemplateContentToString([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".chart = \"%s\": %v", r.Name, ts, err)
+		}
+	}
+
+	{
+		ts := result.Namespace
+		result.Namespace, err = renderer.RenderTemplateContentToString([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".namespace = \"%s\": %v", r.Name, ts, err)
+		}
+	}
+
+	for i, t := range result.Values {
+		switch ts := t.(type) {
+		case string:
+			s, err := renderer.RenderTemplateContentToBuffer([]byte(ts))
+			if err != nil {
+				return nil, fmt.Errorf("failed executing template expressions in release \"%s\".values[%d] = \"%s\": %v", r.Name, i, ts, err)
+			}
+			result.Values[i] = s.String()
+		}
+	}
+
+	for i, ts := range result.Secrets {
+		s, err := renderer.RenderTemplateContentToBuffer([]byte(ts))
+		if err != nil {
+			return nil, fmt.Errorf("failed executing template expressions in release \"%s\".secrets[%d] = \"%s\": %v", r.Name, i, ts, err)
+		}
+		result.Secrets[i] = s.String()
+	}
+
+	return result, nil
+}
+
+func (r ReleaseSpec) Clone() (*ReleaseSpec, error) {
+	serialized, err := yaml.Marshal(r)
+	if err != nil {
+		return nil, fmt.Errorf("failed cloning release \"%s\": %v", r.Name, err)
+	}
+
+	var deserialized ReleaseSpec
+
+	if err := yaml.Unmarshal(serialized, &deserialized); err != nil {
+		return nil, fmt.Errorf("failed cloning release \"%s\": %v", r.Name, err)
+	}
+
+	return &deserialized, nil
+}

state/release_filters.go

@@ -0,0 +1,69 @@
+package state
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// ReleaseFilter is used to determine if a given release should be used during helmfile execution
+type ReleaseFilter interface {
+	// Match returns true if the ReleaseSpec matches the Filter
+	Match(r ReleaseSpec) bool
+}
+
+// LabelFilter matches a release with the given positive lables. Negative labels
+// invert the match for cases such as tier!=backend
+type LabelFilter struct {
+	positiveLabels [][]string
+	negativeLabels [][]string
+}
+
+// Match will match a release that has the same labels as the filter
+func (l LabelFilter) Match(r ReleaseSpec) bool {
+	if len(l.positiveLabels) > 0 {
+		for _, element := range l.positiveLabels {
+			k := element[0]
+			v := element[1]
+			if rVal, ok := r.Labels[k]; !ok {
+				return false
+			} else if rVal != v {
+				return false
+			}
+		}
+	}
+
+	if len(l.negativeLabels) > 0 {
+		for _, element := range l.negativeLabels {
+			k := element[0]
+			v := element[1]
+			if rVal, ok := r.Labels[k]; !ok {
+				return true
+			} else if rVal == v {
+				return false
+			}
+		}
+	}
+	return true
+}
+
+// ParseLabels takes a label in the form foo=bar,baz!=bat and returns a LabelFilter that will match the labels
+func ParseLabels(l string) (LabelFilter, error) {
+	lf := LabelFilter{}
+	lf.positiveLabels = [][]string{}
+	lf.negativeLabels = [][]string{}
+	var err error
+	labels := strings.Split(l, ",")
+	for _, label := range labels {
+		if match, _ := regexp.MatchString("^[a-zA-Z0-9_-]+!=[a-zA-Z0-9_-]+$", label); match == true { // k!=v case
+			kv := strings.Split(label, "!=")
+			lf.negativeLabels = append(lf.negativeLabels, kv)
+		} else if match, _ := regexp.MatchString("^[a-zA-Z0-9_-]+=[a-zA-Z0-9_-]+$", label); match == true { // k=v case
+			kv := strings.Split(label, "=")
+			lf.positiveLabels = append(lf.positiveLabels, kv)
+		} else { // malformed case
+			return lf, fmt.Errorf("Malformed label: %s. Expected label in form k=v or k!=v", label)
+		}
+	}
+	return lf, err
+}

state/state_exec_tmpl.go

@@ -0,0 +1,32 @@
+package state
+
+import (
+	"fmt"
+	"github.com/roboll/helmfile/tmpl"
+)
+
+func (st *HelmState) envTemplateData() EnvironmentTemplateData {
+	return EnvironmentTemplateData{
+		st.Env,
+		st.Namespace,
+	}
+}
+
+func (st *HelmState) ExecuteTemplates() (*HelmState, error) {
+	r := *st
+
+	for i, rt := range st.Releases {
+		tmplData := ReleaseTemplateData{
+			Environment: st.Env,
+			Release:     rt,
+		}
+		renderer := tmpl.NewFileRenderer(st.readFile, st.basePath, tmplData)
+		r, err := rt.ExecuteTemplateExpressions(renderer)
+		if err != nil {
+			return nil, fmt.Errorf("failed executing templates in release \"%s\".\"%s\": %v", st.FilePath, rt.Name, err)
+		}
+		st.Releases[i] = *r
+	}
+
+	return &r, nil
+}

state/state_exec_tmpl_test.go

@@ -0,0 +1,76 @@
+package state
+
+import (
+	"reflect"
+	"testing"
+
+	"github.com/roboll/helmfile/environment"
+)
+
+func TestHelmState_executeTemplates(t *testing.T) {
+	tests := []struct {
+		name  string
+		input ReleaseSpec
+		want  ReleaseSpec
+	}{
+		{
+			name: "Has template expressions in chart, values, and secrets",
+			input: ReleaseSpec{
+				Chart:     "test-charts/{{ .Release.Name }}",
+				Version:   "0.1",
+				Verify:    nil,
+				Name:      "test-app",
+				Namespace: "test-namespace-{{ .Release.Name }}",
+				Values:    []interface{}{"config/{{ .Environment.Name }}/{{ .Release.Name }}/values.yaml"},
+				Secrets:   []string{"config/{{ .Environment.Name }}/{{ .Release.Name }}/secrets.yaml"},
+			},
+			want: ReleaseSpec{
+				Chart:     "test-charts/test-app",
+				Version:   "0.1",
+				Verify:    nil,
+				Name:      "test-app",
+				Namespace: "test-namespace-test-app",
+				Values:    []interface{}{"config/test_env/test-app/values.yaml"},
+				Secrets:   []string{"config/test_env/test-app/secrets.yaml"},
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			state := &HelmState{
+				basePath: ".",
+				HelmDefaults: HelmSpec{
+					KubeContext: "test_context",
+				},
+				Env:          environment.Environment{Name: "test_env"},
+				Namespace:    "test-namespace_",
+				Repositories: nil,
+				Releases: []ReleaseSpec{
+					tt.input,
+				},
+			}
+
+			r, err := state.ExecuteTemplates()
+			if err != nil {
+				t.Errorf("Unexpected error: %v", err)
+				t.FailNow()
+			}
+
+			actual := r.Releases[0]
+
+			if !reflect.DeepEqual(actual.Chart, tt.want.Chart) {
+				t.Errorf("expected %+v, got %+v", tt.want.Chart, actual.Chart)
+			}
+			if !reflect.DeepEqual(actual.Namespace, tt.want.Namespace) {
+				t.Errorf("expected %+v, got %+v", tt.want.Namespace, actual.Namespace)
+			}
+			if !reflect.DeepEqual(actual.Values, tt.want.Values) {
+				t.Errorf("expected %+v, got %+v", tt.want.Values, actual.Values)
+			}
+			if !reflect.DeepEqual(actual.Secrets, tt.want.Secrets) {
+				t.Errorf("expected %+v, got %+v", tt.want.Secrets, actual.Secrets)
+			}
+		})
+	}
+}

state/state_run.go

@@ -0,0 +1,88 @@
+package state
+
+import (
+	"fmt"
+	"github.com/roboll/helmfile/helmexec"
+	"sync"
+)
+
+type result struct {
+	release ReleaseSpec
+	err     error
+}
+
+func (st *HelmState) scatterGather(concurrency int, items int, produceInputs func(), receiveInputsAndProduceIntermediates func(int), aggregateIntermediates func()) {
+	numReleases := len(st.Releases)
+	if concurrency < 1 {
+		concurrency = numReleases
+	} else if concurrency > numReleases {
+		concurrency = numReleases
+	}
+
+	// WaitGroup is required to wait until goroutine per job in job queue cleanly stops.
+	var waitGroup sync.WaitGroup
+	waitGroup.Add(concurrency)
+
+	go produceInputs()
+
+	for w := 1; w <= concurrency; w++ {
+		go func(id int) {
+			st.logger.Debugf("worker %d/%d started", id, concurrency)
+			receiveInputsAndProduceIntermediates(id)
+			st.logger.Debugf("worker %d/%d finished", id, concurrency)
+			waitGroup.Done()
+		}(w)
+	}
+
+	aggregateIntermediates()
+
+	// Wait until all the goroutines to gracefully finish
+	waitGroup.Wait()
+}
+
+func (st *HelmState) scatterGatherReleases(helm helmexec.Interface, concurrency int, do func(ReleaseSpec) error) []error {
+	var errs []error
+
+	inputs := st.Releases
+	inputsSize := len(inputs)
+
+	releases := make(chan ReleaseSpec)
+	results := make(chan result)
+
+	st.scatterGather(
+		concurrency,
+		inputsSize,
+		func() {
+			for _, release := range inputs {
+				releases <- release
+			}
+			close(releases)
+		},
+		func(id int) {
+			for release := range releases {
+				err := do(release)
+				st.logger.Debugf("sending result for release: %s\n", release.Name)
+				results <- result{release: release, err: err}
+				st.logger.Debugf("sent result for release: %s\n", release.Name)
+			}
+		},
+		func() {
+			for i := range inputs {
+				st.logger.Debugf("receiving result %d", i)
+				r := <-results
+				if r.err != nil {
+					errs = append(errs, fmt.Errorf("release \"%s\" failed: %v", r.release.Name, r.err))
+				} else {
+					st.logger.Debugf("received result for release \"%s\"", r.release.Name)
+				}
+				st.logger.Debugf("received result for %d", i)
+			}
+		},
+	)
+
+	if len(errs) != 0 {
+		return errs
+	}
+
+	return nil
+}

state/state_test.go

@@ -0,0 +1,998 @@
+package state
+
+import (
+	"os"
+	"reflect"
+	"testing"
+
+	"errors"
+	"strings"
+
+	"github.com/roboll/helmfile/helmexec"
+)
+
+var logger = helmexec.NewLogger(os.Stdout, "warn")
+
+func TestLabelParsing(t *testing.T) {
+	cases := []struct {
+		labelString    string
+		expectedFilter LabelFilter
+		errorExected   bool
+	}{
+		{"foo=bar", LabelFilter{positiveLabels: [][]string{[]string{"foo", "bar"}}, negativeLabels: [][]string{}}, false},
+		{"foo!=bar", LabelFilter{positiveLabels: [][]string{}, negativeLabels: [][]string{[]string{"foo", "bar"}}}, false},
+		{"foo!=bar,baz=bat", LabelFilter{positiveLabels: [][]string{[]string{"baz", "bat"}}, negativeLabels: [][]string{[]string{"foo", "bar"}}}, false},
+		{"foo", LabelFilter{positiveLabels: [][]string{}, negativeLabels: [][]string{}}, true},
+		{"foo!=bar=baz", LabelFilter{positiveLabels: [][]string{}, negativeLabels: [][]string{}}, true},
+		{"=bar", LabelFilter{positiveLabels: [][]string{}, negativeLabels: [][]string{}}, true},
+	}
+	for idx, c := range cases {
+		filter, err := ParseLabels(c.labelString)
+		if err != nil && !c.errorExected {
+			t.Errorf("[%d] Didn't expect an error parsing labels: %s", idx, err)
+		} else if err == nil && c.errorExected {
+			t.Errorf("[%d] Expected %s to result in an error but got none", idx, c.labelString)
+		} else if !reflect.DeepEqual(filter, c.expectedFilter) {
+			t.Errorf("[%d] parsed label did not result in expected filter: %v, expected: %v", idx, filter, c.expectedFilter)
+		}
+	}
+}
+
+func TestHelmState_applyDefaultsTo(t *testing.T) {
+	type fields struct {
+		BaseChartPath      string
+		Context            string
+		DeprecatedReleases []ReleaseSpec
+		Namespace          string
+		Repositories       []RepositorySpec
+		Releases           []ReleaseSpec
+	}
+	type args struct {
+		spec ReleaseSpec
+	}
+	verify := false
+	specWithNamespace := ReleaseSpec{
+		Chart:     "test/chart",
+		Version:   "0.1",
+		Verify:    &verify,
+		Name:      "test-charts",
+		Namespace: "test-namespace",
+		Values:    nil,
+		SetValues: nil,
+		EnvValues: nil,
+	}
+
+	specWithoutNamespace := specWithNamespace
+	specWithoutNamespace.Namespace = ""
+	specWithNamespaceFromFields := specWithNamespace
+	specWithNamespaceFromFields.Namespace = "test-namespace-field"
+
+	fieldsWithNamespace := fields{
+		BaseChartPath:      ".",
+		Context:            "test_context",
+		DeprecatedReleases: nil,
+		Namespace:          specWithNamespaceFromFields.Namespace,
+		Repositories:       nil,
+		Releases: []ReleaseSpec{
+			specWithNamespace,
+		},
+	}
+
+	fieldsWithoutNamespace := fieldsWithNamespace
+	fieldsWithoutNamespace.Namespace = ""
+
+	tests := []struct {
+		name   string
+		fields fields
+		args   args
+		want   ReleaseSpec
+	}{
+		{
+			name:   "Has a namespace from spec",
+			fields: fieldsWithoutNamespace,
+			args: args{
+				spec: specWithNamespace,
+			},
+			want: specWithNamespace,
+		},
+		{
+			name:   "Has a namespace from flags",
+			fields: fieldsWithoutNamespace,
+			args: args{
+				spec: specWithNamespace,
+			},
+			want: specWithNamespace,
+		},
+		{
+			name:   "Has a namespace from flags and from spec",
+			fields: fieldsWithNamespace,
+			args: args{
+				spec: specWithNamespace,
+			},
+			want: specWithNamespaceFromFields,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			state := &HelmState{
+				basePath:           tt.fields.BaseChartPath,
+				DeprecatedContext:  tt.fields.Context,
+				DeprecatedReleases: tt.fields.DeprecatedReleases,
+				Namespace:          tt.fields.Namespace,
+				Repositories:       tt.fields.Repositories,
+				Releases:           tt.fields.Releases,
+			}
+			if state.applyDefaultsTo(&tt.args.spec); !reflect.DeepEqual(tt.args.spec, tt.want) {
+				t.Errorf("HelmState.applyDefaultsTo() = %v, want %v", tt.args.spec, tt.want)
+			}
+		})
+	}
+}
+
+func TestHelmState_flagsForUpgrade(t *testing.T) {
+	enable := true
+	disable := false
+
+	some := func(v int) *int {
+		return &v
+	}
+
+	tests := []struct {
+		name     string
+		defaults HelmSpec
+		release  *ReleaseSpec
+		want     []string
+	}{
+		{
+			name: "no-options",
+			defaults: HelmSpec{
+				Verify: false,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Verify:    &disable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "verify",
+			defaults: HelmSpec{
+				Verify: false,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Verify:    &enable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--verify",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "verify-from-default",
+			defaults: HelmSpec{
+				Verify: true,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Verify:    &disable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "force",
+			defaults: HelmSpec{
+				Force: false,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Force:     &enable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--force",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "force-from-default",
+			defaults: HelmSpec{
+				Force: true,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Force:     &disable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "recreate-pods",
+			defaults: HelmSpec{
+				RecreatePods: false,
+			},
+			release: &ReleaseSpec{
+				Chart:        "test/chart",
+				Version:      "0.1",
+				RecreatePods: &enable,
+				Name:         "test-charts",
+				Namespace:    "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--recreate-pods",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "recreate-pods-from-default",
+			defaults: HelmSpec{
+				RecreatePods: true,
+			},
+			release: &ReleaseSpec{
+				Chart:        "test/chart",
+				Version:      "0.1",
+				RecreatePods: &disable,
+				Name:         "test-charts",
+				Namespace:    "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "wait",
+			defaults: HelmSpec{
+				Wait: false,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Wait:      &enable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--wait",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "devel",
+			defaults: HelmSpec{
+				Devel: true,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Wait:      &enable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--devel",
+				"--wait",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "devel-release",
+			defaults: HelmSpec{
+				Devel: true,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Devel:     &disable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "wait-from-default",
+			defaults: HelmSpec{
+				Wait: true,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Wait:      &disable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "timeout",
+			defaults: HelmSpec{
+				Timeout: 0,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Timeout:   some(123),
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--timeout", "123",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "timeout-from-default",
+			defaults: HelmSpec{
+				Timeout: 123,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Timeout:   nil,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--timeout", "123",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "atomic",
+			defaults: HelmSpec{
+				Atomic: false,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Atomic:    &enable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--atomic",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "atomic-override-default",
+			defaults: HelmSpec{
+				Atomic: true,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Atomic:    &disable,
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--namespace", "test-namespace",
+			},
+		},
+		{
+			name: "atomic-from-default",
+			defaults: HelmSpec{
+				Atomic: true,
+			},
+			release: &ReleaseSpec{
+				Chart:     "test/chart",
+				Version:   "0.1",
+				Name:      "test-charts",
+				Namespace: "test-namespace",
+			},
+			want: []string{
+				"--version", "0.1",
+				"--atomic",
+				"--namespace", "test-namespace",
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			state := &HelmState{
+				basePath:          "./",
+				DeprecatedContext: "default",
+				Releases:          []ReleaseSpec{*tt.release},
+				HelmDefaults:      tt.defaults,
+			}
+			helm := helmexec.New(logger, "default")
+			args, err := state.flagsForUpgrade(helm, tt.release)
+			if err != nil {
+				t.Errorf("unexpected error flagsForUpgade: %v", err)
+			}
+			if !reflect.DeepEqual(args, tt.want) {
+				t.Errorf("flagsForUpgrade returned = %v, want %v", args, tt.want)
+			}
+		})
+	}
+}
+
+func Test_isLocalChart(t *testing.T) {
+	type args struct {
+		chart string
+	}
+	tests := []struct {
+		name string
+		args args
+		want bool
+	}{
+		{
+			name: "local chart",
+			args: args{
+				chart: "./",
+			},
+			want: true,
+		},
+		{
+			name: "repo chart",
+			args: args{
+				chart: "stable/genius",
+			},
+			want: false,
+		},
+		{
+			name: "empty",
+			args: args{
+				chart: "",
+			},
+			want: false,
+		},
+		{
+			name: "parent local path",
+			args: args{
+				chart: "../examples",
+			},
+			want: true,
+		},
+		{
+			name: "parent-parent local path",
+			args: args{
+				chart: "../../",
+			},
+			want: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := isLocalChart(tt.args.chart); got != tt.want {
+				t.Errorf("pathExists() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func Test_normalizeChart(t *testing.T) {
+	type args struct {
+		basePath string
+		chart    string
+	}
+	tests := []struct {
+		name string
+		args args
+		want string
+	}{
+		{
+			name: "construct local chart path",
+			args: args{
+				basePath: "/Users/jane/code/deploy/charts",
+				chart:    "./app",
+			},
+			want: "/Users/jane/code/deploy/charts/app",
+		},
+		{
+			name: "repo path",
+			args: args{
+				basePath: "/Users/jane/code/deploy/charts",
+				chart:    "remote/app",
+			},
+			want: "remote/app",
+		},
+		{
+			name: "construct local chart path, parent dir",
+			args: args{
+				basePath: "/Users/jane/code/deploy/charts",
+				chart:    "../app",
+			},
+			want: "/Users/jane/code/deploy/app",
+		},
+		{
+			name: "too much parent levels",
+			args: args{
+				basePath: "/src",
+				chart:    "../../app",
+			},
+			want: "/app",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := normalizeChart(tt.args.basePath, tt.args.chart); got != tt.want {
+				t.Errorf("normalizeChart() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+// mocking helmexec.Interface
+
+type mockHelmExec struct {
+	charts   []string
+	repo     []string
+	releases []mockRelease
+}
+
+type mockRelease struct {
+	name  string
+	flags []string
+}
+
+func (helm *mockHelmExec) UpdateDeps(chart string) error {
+	if strings.Contains(chart, "error") {
+		return errors.New("error")
+	}
+	helm.charts = append(helm.charts, chart)
+	return nil
+}
+
+func (helm *mockHelmExec) BuildDeps(chart string) error {
+	if strings.Contains(chart, "error") {
+		return errors.New("error")
+	}
+	helm.charts = append(helm.charts, chart)
+	return nil
+}
+
+func (helm *mockHelmExec) SetExtraArgs(args ...string) {
+	return
+}
+func (helm *mockHelmExec) SetHelmBinary(bin string) {
+	return
+}
+func (helm *mockHelmExec) AddRepo(name, repository, certfile, keyfile, username, password string) error {
+	helm.repo = []string{name, repository, certfile, keyfile, username, password}
+	return nil
+}
+func (helm *mockHelmExec) UpdateRepo() error {
+	return nil
+}
+func (helm *mockHelmExec) SyncRelease(name, chart string, flags ...string) error {
+	if strings.Contains(name, "error") {
+		return errors.New("error")
+	}
+	helm.releases = append(helm.releases, mockRelease{name: name, flags: flags})
+	helm.charts = append(helm.charts, chart)
+	return nil
+}
+func (helm *mockHelmExec) DiffRelease(name, chart string, flags ...string) error {
+	return nil
+}
+func (helm *mockHelmExec) ReleaseStatus(release string) error {
+	if strings.Contains(release, "error") {
+		return errors.New("error")
+	}
+	helm.releases = append(helm.releases, mockRelease{name: release, flags: []string{}})
+	return nil
+}
+func (helm *mockHelmExec) DeleteRelease(name string, flags ...string) error {
+	return nil
+}
+func (helm *mockHelmExec) List(filter string) (string, error) {
+	return "", nil
+}
+func (helm *mockHelmExec) DecryptSecret(name string) (string, error) {
+	return "", nil
+}
+func (helm *mockHelmExec) TestRelease(name string, flags ...string) error {
+	if strings.Contains(name, "error") {
+		return errors.New("error")
+	}
+	helm.releases = append(helm.releases, mockRelease{name: name, flags: flags})
+	return nil
+}
+func (helm *mockHelmExec) Fetch(chart string, flags ...string) error {
+	return nil
+}
+func (helm *mockHelmExec) Lint(chart string, flags ...string) error {
+	return nil
+}
+func (helm *mockHelmExec) TemplateRelease(chart string, flags ...string) error {
+	return nil
+}
+func TestHelmState_SyncRepos(t *testing.T) {
+	tests := []struct {
+		name  string
+		repos []RepositorySpec
+		helm  *mockHelmExec
+		envs  map[string]string
+		want  []string
+	}{
+		{
+			name: "normal repository",
+			repos: []RepositorySpec{
+				{
+					Name:     "name",
+					URL:      "http://example.com/",
+					CertFile: "",
+					KeyFile:  "",
+					Username: "",
+					Password: "",
+				},
+			},
+			helm: &mockHelmExec{},
+			want: []string{"name", "http://example.com/", "", "", "", ""},
+		},
+		{
+			name: "repository with cert and key",
+			repos: []RepositorySpec{
+				{
+					Name:     "name",
+					URL:      "http://example.com/",
+					CertFile: "certfile",
+					KeyFile:  "keyfile",
+					Username: "",
+					Password: "",
+				},
+			},
+			helm: &mockHelmExec{},
+			want: []string{"name", "http://example.com/", "certfile", "keyfile", "", ""},
+		},
+		{
+			name: "repository with username and password",
+			repos: []RepositorySpec{
+				{
+					Name:     "name",
+					URL:      "http://example.com/",
+					CertFile: "",
+					KeyFile:  "",
+					Username: "example_user",
+					Password: "example_password",
+				},
+			},
+			helm: &mockHelmExec{},
+			want: []string{"name", "http://example.com/", "", "", "example_user", "example_password"},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			for k, v := range tt.envs {
+				err := os.Setenv(k, v)
+				if err != nil {
+					t.Error("HelmState.SyncRepos() could not set env var for testing")
+				}
+			}
+			state := &HelmState{
+				Repositories: tt.repos,
+			}
+			if _ = state.SyncRepos(tt.helm); !reflect.DeepEqual(tt.helm.repo, tt.want) {
+				t.Errorf("HelmState.SyncRepos() for [%s] = %v, want %v", tt.name, tt.helm.repo, tt.want)
+			}
+		})
+	}
+}
+
+func TestHelmState_SyncReleases(t *testing.T) {
+	tests := []struct {
+		name         string
+		releases     []ReleaseSpec
+		helm         *mockHelmExec
+		wantReleases []mockRelease
+	}{
+		{
+			name: "normal release",
+			releases: []ReleaseSpec{
+				{
+					Name:  "releaseName",
+					Chart: "foo",
+				},
+			},
+			helm:         &mockHelmExec{},
+			wantReleases: []mockRelease{{"releaseName", []string{}}},
+		},
+		{
+			name: "escaped values",
+			releases: []ReleaseSpec{
+				{
+					Name:  "releaseName",
+					Chart: "foo",
+					SetValues: []SetValue{
+						{
+							Name:  "someList",
+							Value: "a,b,c",
+						},
+						{
+							Name:  "json",
+							Value: "{\"name\": \"john\"}",
+						},
+					},
+				},
+			},
+			helm:         &mockHelmExec{},
+			wantReleases: []mockRelease{{"releaseName", []string{"--set", "someList=a\\,b\\,c", "--set", "json=\\{\"name\": \"john\"\\}"}}},
+		},
+		{
+			name: "set single value from file",
+			releases: []ReleaseSpec{
+				{
+					Name:  "releaseName",
+					Chart: "foo",
+					SetValues: []SetValue{
+						{
+							Name:  "foo",
+							Value: "FOO",
+						},
+						{
+							Name: "bar",
+							File: "path/to/bar",
+						},
+						{
+							Name:  "baz",
+							Value: "BAZ",
+						},
+					},
+				},
+			},
+			helm:         &mockHelmExec{},
+			wantReleases: []mockRelease{{"releaseName", []string{"--set", "foo=FOO", "--set-file", "bar=path/to/bar", "--set", "baz=BAZ"}}},
+		},
+		{
+			name: "set single array value in an array",
+			releases: []ReleaseSpec{
+				{
+					Name:  "releaseName",
+					Chart: "foo",
+					SetValues: []SetValue{
+						{
+							Name: "foo.bar[0]",
+							Values: []string{
+								"A",
+								"B",
+							},
+						},
+					},
+				},
+			},
+			helm:         &mockHelmExec{},
+			wantReleases: []mockRelease{{"releaseName", []string{"--set", "foo.bar[0]={A,B}"}}},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			state := &HelmState{
+				Releases: tt.releases,
+				logger:   logger,
+			}
+			if _ = state.SyncReleases(tt.helm, []string{}, 1); !reflect.DeepEqual(tt.helm.releases, tt.wantReleases) {
+				t.Errorf("HelmState.SyncReleases() for [%s] = %v, want %v", tt.name, tt.helm.releases, tt.wantReleases)
+			}
+		})
+	}
+}
+
+func TestHelmState_UpdateDeps(t *testing.T) {
+	state := &HelmState{
+		basePath: "/src",
+		Releases: []ReleaseSpec{
+			{
+				Chart: "./..",
+			},
+			{
+				Chart: "../examples",
+			},
+			{
+				Chart: "../../helmfile",
+			},
+			{
+				Chart: "published",
+			},
+			{
+				Chart: "published/deeper",
+			},
+			{
+				Chart: ".error",
+			},
+		},
+	}
+
+	want := []string{"/", "/examples", "/helmfile"}
+	helm := &mockHelmExec{}
+	errs := state.UpdateDeps(helm)
+	if !reflect.DeepEqual(helm.charts, want) {
+		t.Errorf("HelmState.UpdateDeps() = %v, want %v", helm.charts, want)
+	}
+	if len(errs) != 0 {
+		t.Errorf("HelmState.UpdateDeps() - no errors, but got: %v", len(errs))
+	}
+}
+
+func TestHelmState_ReleaseStatuses(t *testing.T) {
+	tests := []struct {
+		name     string
+		releases []ReleaseSpec
+		helm     *mockHelmExec
+		want     []mockRelease
+		wantErr  bool
+	}{
+		{
+			name: "happy path",
+			releases: []ReleaseSpec{
+				{
+					Name: "releaseA",
+				},
+			},
+			helm: &mockHelmExec{},
+			want: []mockRelease{{"releaseA", []string{}}},
+		},
+		{
+			name: "happy path",
+			releases: []ReleaseSpec{
+				{
+					Name: "error",
+				},
+			},
+			helm:    &mockHelmExec{},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		i := func(t *testing.T) {
+			state := &HelmState{
+				Releases: tt.releases,
+				logger:   logger,
+			}
+			errs := state.ReleaseStatuses(tt.helm, 1)
+			if (errs != nil) != tt.wantErr {
+				t.Errorf("ReleaseStatuses() for %s error = %v, wantErr %v", tt.name, errs, tt.wantErr)
+				return
+			}
+			if !reflect.DeepEqual(tt.helm.releases, tt.want) {
+				t.Errorf("HelmState.ReleaseStatuses() for [%s] = %v, want %v", tt.name, tt.helm.releases, tt.want)
+			}
+		}
+		t.Run(tt.name, i)
+	}
+}
+
+func TestHelmState_TestReleasesNoCleanUp(t *testing.T) {
+	tests := []struct {
+		name     string
+		cleanup  bool
+		releases []ReleaseSpec
+		helm     *mockHelmExec
+		want     []mockRelease
+		wantErr  bool
+	}{
+		{
+			name: "happy path",
+			releases: []ReleaseSpec{
+				{
+					Name: "releaseA",
+				},
+			},
+			helm: &mockHelmExec{},
+			want: []mockRelease{{"releaseA", []string{"--timeout", "1"}}},
+		},
+		{
+			name:    "do cleanup",
+			cleanup: true,
+			releases: []ReleaseSpec{
+				{
+					Name: "releaseB",
+				},
+			},
+			helm: &mockHelmExec{},
+			want: []mockRelease{{"releaseB", []string{"--cleanup", "--timeout", "1"}}},
+		},
+		{
+			name: "happy path",
+			releases: []ReleaseSpec{
+				{
+					Name: "error",
+				},
+			},
+			helm:    &mockHelmExec{},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		i := func(t *testing.T) {
+			state := &HelmState{
+				Releases: tt.releases,
+				logger:   logger,
+			}
+			errs := state.TestReleases(tt.helm, tt.cleanup, 1, 1)
+			if (errs != nil) != tt.wantErr {
+				t.Errorf("TestReleases() for %s error = %v, wantErr %v", tt.name, errs, tt.wantErr)
+				return
+			}
+			if !reflect.DeepEqual(tt.helm.releases, tt.want) {
+				t.Errorf("HelmState.TestReleases() for [%s] = %v, want %v", tt.name, tt.helm.releases, tt.want)
+			}
+		}
+		t.Run(tt.name, i)
+	}
+}
+
+func TestHelmState_NoReleaseMatched(t *testing.T) {
+	releases := []ReleaseSpec{
+		{
+			Name: "releaseA",
+			Labels: map[string]string{
+				"foo": "bar",
+			},
+		},
+	}
+	tests := []struct {
+		name    string
+		labels  string
+		wantErr bool
+	}{
+		{
+			name: "happy path",
+
+			labels:  "foo=bar",
+			wantErr: false,
+		},
+		{
+			name:    "name does not exist",
+			labels:  "name=releaseB",
+			wantErr: false,
+		},
+		{
+			name:    "label does not match anything",
+			labels:  "foo=notbar",
+			wantErr: false,
+		},
+	}
+	for _, tt := range tests {
+		i := func(t *testing.T) {
+			state := &HelmState{
+				Releases: releases,
+				logger:   logger,
+			}
+			errs := state.FilterReleases([]string{tt.labels})
+			if (errs != nil) != tt.wantErr {
+				t.Errorf("ReleaseStatuses() for %s error = %v, wantErr %v", tt.name, errs, tt.wantErr)
+				return
+			}
+		}
+		t.Run(tt.name, i)
+	}
+}

state/types.go

@@ -0,0 +1,24 @@
+package state
+
+import "github.com/roboll/helmfile/environment"
+
+// TemplateSpec defines the structure of a reusable and composable template for helm releases.
+type TemplateSpec struct {
+	ReleaseSpec `yaml:",inline"`
+}
+
+// EnvironmentTemplateData provides variables accessible while executing golang text/template expressions in helmfile and values YAML files
+type EnvironmentTemplateData struct {
+	// Environment is accessible as `.Environment` from any template executed by the renderer
+	Environment environment.Environment
+	// Namespace is accessible as `.Namespace` from any non-values template executed by the renderer
+	Namespace string
+}
+
+// ReleaseTemplateData provides variables accessible while executing golang text/template expressions in releases of a helmfile YAML file
+type ReleaseTemplateData struct {
+	// Environment is accessible as `.Environment` from any template expression executed by the renderer
+	Environment environment.Environment
+	// Release is accessible as `.Release` from any template expression executed by the renderer
+	Release ReleaseSpec
+}

test/integration/charts/httpbin/.helmignore

@@ -0,0 +1,21 @@
+# Patterns to ignore when building packages.
+# This supports shell glob matching, relative path matching, and
+# negation (prefixed with !). Only one pattern per line.
+.DS_Store
+# Common VCS dirs
+.git/
+.gitignore
+.bzr/
+.bzrignore
+.hg/
+.hgignore
+.svn/
+# Common backup files
+*.swp
+*.bak
+*.tmp
+*~
+# Various IDEs
+.project
+.idea/
+*.tmproj

test/integration/charts/httpbin/Chart.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+description: HTTP Request & Response Service, written in Python + Flask. https://httpbin.org
+name: httpbin
+version: 0.1.0
+

test/integration/charts/httpbin/templates/_helpers.tpl

@@ -0,0 +1,16 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "httpbin.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{/*
+Create a default fully qualified app name.
+We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
+*/}}
+{{- define "httpbin.fullname" -}}
+{{- $name := default .Chart.Name .Values.nameOverride -}}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}

test/integration/charts/httpbin/templates/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+metadata:
+  name: {{ template "httpbin.fullname" . }}
+  labels:
+    app: {{ template "httpbin.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}  
+spec:
+  replicas: 1
+  strategy: {}
+  template:
+    metadata:
+      labels:
+        app: {{ template "httpbin.name" . }}
+        release: {{ .Release.Name }}
+    spec:
+      containers:
+      - name: {{ .Chart.Name }}
+        image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+        imagePullPolicy: {{ .Values.image.pullPolicy }}
+        livenessProbe:
+          httpGet:
+            path: /
+            port: {{ .Values.service.internalPort }}
+        readinessProbe:
+          httpGet:
+            path: /
+            port: {{ .Values.service.internalPort }}        
+        ports:
+          - containerPort: {{ .Values.service.internalPort }}
+        resources:
+{{ toYaml .Values.resources | indent 10 }}
+
+status: {}
+---

test/integration/charts/httpbin/templates/ingress.yaml

@@ -0,0 +1,33 @@
+{{- if .Values.ingress.enabled -}}
+{{- $serviceName := include "httpbin.fullname" . -}}
+{{- $servicePort := .Values.service.externalPort -}}
+{{- $prefix := .Values.ingress.prefix -}}
+apiVersion: extensions/v1beta1
+kind: Ingress
+metadata:
+  name: {{ template "httpbin.fullname" . }}
+  labels:
+    app: {{ template "httpbin.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+  annotations:
+    {{- range $key, $value := .Values.ingress.annotations }}
+      {{ $key }}: {{ $value | quote }}
+    {{- end }}
+spec:
+  rules:
+    {{- range $host := .Values.ingress.hosts }}
+    - host: {{ $host }}
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: {{ $serviceName }}
+              servicePort: {{ $servicePort }}
+    {{- end -}}
+  {{- if .Values.ingress.tls }}
+  tls:
+{{ toYaml .Values.ingress.tls | indent 4 }}
+  {{- end -}}
+{{- end -}}

test/integration/charts/httpbin/templates/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ template "httpbin.fullname" . }}
+  labels:
+    app: {{ template "httpbin.name" . }}
+    chart: {{ .Chart.Name }}-{{ .Chart.Version | replace "+" "_" }}
+    release: {{ .Release.Name }}
+    heritage: {{ .Release.Service }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.externalPort }}
+      targetPort: {{ .Values.service.internalPort }}
+      protocol: TCP
+      name: {{ .Values.service.name }}
+  selector:
+    app: {{ template "httpbin.name" . }}
+    release: {{ .Release.Name }}

test/integration/charts/httpbin/values.yaml

@@ -0,0 +1,14 @@
+image:
+  repository: docker.io/citizenstig/httpbin
+  tag: latest
+  pullPolicy: IfNotPresent
+service:
+  name: httpbin
+  type: LoadBalancer
+  externalPort: 8000
+  internalPort: 8000
+ingress:
+  enabled: false
+  hosts:
+    - httpbin.local
+resources: {}

test/integration/happypath.yaml

@@ -0,0 +1,14 @@
+repositories:
+  - name: stable
+    url: https://kubernetes-charts.storage.googleapis.com/
+
+helmDefaults:
+  kubeContext: minikube
+
+releases:
+
+  - name: httpbin
+    chart: ./charts/httpbin
+    set:
+      - name: ingress.enabled
+        value: false

test/integration/lib/ensure.sh

@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+
+# Check environment is correctly setup
+
+if ! hash minikube 2>/dev/null; then
+    fail "Minikube needs to be installed."
+fi
+if [ ! $(minikube status --format '{{.MinikubeStatus}}') == "Running" ]; then
+    fail "Minikube is not running."
+fi
+if [ ! $(minikube status --format '{{.ClusterStatus}}') == "Running" ]; then
+    fail "Minikube Cluster is not running."
+fi
+if ! kubectl version --short 1> /dev/null; then
+    fail "Could not connect to minikube apiserver"
+fi
+if ! hash curl 1>/dev/null; then
+    fail "curl needs to be installed."
+fi
+if ! hash docker 1>/dev/null; then
+    fail "Docker needs to be installed."
+fi
+if ! docker version 1> /dev/null; then
+    fail "Could not connect to Docker daemon"
+fi
+if ! hash helm 1>/dev/null; then
+    fail "Helm needs to be installed."
+fi

test/integration/lib/output.sh

@@ -0,0 +1,24 @@
+#!/usr/bin/env bash
+
+declare -i tests_total=0
+
+function info () {
+    tput bold; tput setaf 4; echo -n "INFO: "; tput sgr0; echo "${@}"
+}
+function warn () {
+    tput bold; tput setaf 3; echo -n "WARN: "; tput sgr0; echo "${@}"
+}
+function fail () {
+    tput bold; tput setaf 1; echo -n "FAIL: "; tput sgr0; echo "${@}"
+    exit 1
+}
+function test_start () {
+    tput bold; tput setaf 6; echo -n "TEST: "; tput sgr0; echo "${@}"
+}
+function test_pass () {
+    tests_total=$((tests_total+1))
+    tput bold; tput setaf 2; echo -n "PASS: "; tput sgr0; echo "${@}"
+}
+function all_tests_passed () {
+    tput bold; tput setaf 2; echo -n "PASS: "; tput sgr0; echo "${tests_total} tests passed"
+}

test/integration/run.sh

@@ -0,0 +1,91 @@
+#!/usr/bin/env bash
+
+# IMPORTS -----------------------------------------------------------------------------------------------------------
+
+# determine working directory to use to relative paths irrespective of starting directory
+dir="${BASH_SOURCE%/*}"
+if [[ ! -d "${dir}" ]]; then dir="${PWD}"; fi
+
+. "${dir}/lib/output.sh"
+. "${dir}/lib/ensure.sh"
+
+
+# GLOBALS -----------------------------------------------------------------------------------------------------------
+
+test_ns="helmfile-tests-$(date +"%Y%m%d-%H%M%S")"
+helmfile="./helmfile --namespace=${test_ns}"
+helm="helm --kube-context=minikube"
+kubectl="kubectl --context=minikube --namespace=${test_ns}"
+
+# FUNCTIONS ----------------------------------------------------------------------------------------------------------
+
+function wait_deploy_ready() {
+    ${kubectl} rollout status deployment ${1}
+    while [ "$(${kubectl} get deploy ${1} -o=jsonpath='{.status.readyReplicas}')" == "0" ]; do
+        info "Waiting for deployment ${1} to be ready"
+        sleep 1
+    done
+}
+function retry() {
+    local -r max=${1}
+    local -r command=${2}
+    n=0
+    retry_result=0
+    until [ ${n} -ge ${max} ]; do
+        info "Executing: ${command} (attempt $((n+1)))"
+        ${command} && break  # substitute your command here
+        retry_result=$?
+        n=$[$n+1]
+        # approximated binary exponential backoff to reduce flakiness
+        sleep $((n ** 2))
+    done
+}
+
+# SETUP --------------------------------------------------------------------------------------------------------------
+
+set -e
+info "Using namespace: ${test_ns}"
+info "Using Helm version: $(helm version --short --client | grep -o v.*$)"
+${helm} init --wait --override spec.template.spec.automountServiceAccountToken=true
+${helm} plugin install https://github.com/databus23/helm-diff --version master
+${kubectl} get namespace ${test_ns} &> /dev/null && warn "Namespace ${test_ns} exists, from a previous test run?"
+$kubectl create namespace ${test_ns} || fail "Could not create namespace ${test_ns}"
+trap "{ $kubectl delete namespace ${test_ns}; }" EXIT # remove namespace whenever we exit this script
+
+
+# TEST CASES----------------------------------------------------------------------------------------------------------
+
+test_start "happypath - simple rollout of httpbin chart"
+
+info "Diffing ${dir}/happypath.yaml"
+bash -c "${helmfile} -f ${dir}/happypath.yaml diff --detailed-exitcode; code="'$?'"; [ "'${code}'" -eq 2 ]" || fail "unexpected exit code returned by helmfile diff"
+
+info "Templating ${dir}/happypath.yaml"
+${helmfile} -f ${dir}/happypath.yaml template
+code=$?
+[ ${code} -eq 0 ] || fail "unexpected exit code returned by helmfile template: ${code}"
+
+info "Syncing ${dir}/happypath.yaml"
+${helmfile} -f ${dir}/happypath.yaml sync
+wait_deploy_ready httpbin-httpbin
+retry 5 "curl --fail $(minikube service --url --namespace=${test_ns} httpbin-httpbin)/status/200"
+[ ${retry_result} -eq 0 ] || fail "httpbin failed to return 200 OK"
+
+info "Applying ${dir}/happypath.yaml"
+${helmfile} -f ${dir}/happypath.yaml apply
+code=$?
+[ ${code} -eq 0 ] || fail "unexpected exit code returned by helmfile apply: ${code}"
+
+info "Deleting release"
+${helmfile} -f ${dir}/happypath.yaml delete
+${helm} status --namespace=${test_ns} httpbin &> /dev/null && fail "release should not exist anymore after a delete"
+
+info "Ensuring \"helmfile delete\" doesn't fail when no releases installed"
+${helmfile} -f ${dir}/happypath.yaml delete || fail "\"helmfile delete\" shouldn't fail when there are no installed releases"
+
+test_pass "happypath"
+
+
+# ALL DONE -----------------------------------------------------------------------------------------------------------
+
+all_tests_passed

tmpl/context.go

@@ -0,0 +1,7 @@
+package tmpl
+
+type Context struct {
+	preRender bool
+	basePath  string
+	readFile  func(string) ([]byte, error)
+}

tmpl/context_funcs.go

@@ -0,0 +1,208 @@
+package tmpl
+
+import (
+	"fmt"
+	"gopkg.in/yaml.v2"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"text/template"
+)
+
+type Values = map[string]interface{}
+
+func (c *Context) createFuncMap() template.FuncMap {
+	funcMap := template.FuncMap{
+		"exec":           c.Exec,
+		"readFile":       c.ReadFile,
+		"toYaml":         ToYaml,
+		"fromYaml":       FromYaml,
+		"setValueAtPath": SetValueAtPath,
+		"requiredEnv":    RequiredEnv,
+		"get":            get,
+		"getOrNil":       getOrNil,
+		"tpl":            c.Tpl,
+	}
+	if c.preRender {
+		// disable potential side-effect template calls
+		funcMap["exec"] = func(string, []interface{}, ...string) (string, error) {
+			return "", nil
+		}
+		funcMap["readFile"] = func(string) (string, error) {
+			return "", nil
+		}
+	}
+
+	return funcMap
+}
+
+func (c *Context) Exec(command string, args []interface{}, inputs ...string) (string, error) {
+	var input string
+	if len(inputs) > 0 {
+		input = inputs[0]
+	}
+
+	strArgs := make([]string, len(args))
+	for i, a := range args {
+		switch a.(type) {
+		case string:
+			strArgs[i] = a.(string)
+		default:
+			return "", fmt.Errorf("unexpected type of arg \"%s\" in args %v at index %d", reflect.TypeOf(a), args, i)
+		}
+	}
+
+	cmd := exec.Command(command, strArgs...)
+	cmd.Dir = c.basePath
+
+	writeErrs := make(chan error)
+	cmdErrs := make(chan error)
+	cmdOuts := make(chan []byte)
+
+	if len(input) > 0 {
+		stdin, err := cmd.StdinPipe()
+		if err != nil {
+			return "", err
+		}
+		go func(input string, stdin io.WriteCloser) {
+			defer stdin.Close()
+			defer close(writeErrs)
+
+			size := len(input)
+
+			var n int
+			var err error
+			i := 0
+			for {
+				n, err = io.WriteString(stdin, input[i:])
+				if err != nil {
+					writeErrs <- fmt.Errorf("failed while writing %d bytes to stdin of \"%s\": %v", len(input), command, err)
+					break
+				}
+				i += n
+				if n == size {
+					break
+				}
+			}
+		}(input, stdin)
+	}
+
+	go func() {
+		defer close(cmdOuts)
+		defer close(cmdErrs)
+
+		bytes, err := cmd.Output()
+		if err != nil {
+			cmdErrs <- fmt.Errorf("exec cmd=%s args=[%s] failed: %v", command, strings.Join(strArgs, ", "), err)
+		} else {
+			cmdOuts <- bytes
+		}
+	}()
+
+	for {
+		select {
+		case bytes := <-cmdOuts:
+			return string(bytes), nil
+		case err := <-cmdErrs:
+			return "", err
+		case err := <-writeErrs:
+			return "", err
+		}
+	}
+}
+
+func (c *Context) ReadFile(filename string) (string, error) {
+	var path string
+	if filepath.IsAbs(filename) {
+		path = filename
+	} else {
+		path = filepath.Join(c.basePath, filename)
+	}
+
+	bytes, err := c.readFile(path)
+	if err != nil {
+		return "", err
+	}
+	return string(bytes), nil
+}
+
+func (c *Context) Tpl(text string, data interface{}) (string, error) {
+	buf, err := c.RenderTemplateToBuffer(text, data)
+	if err != nil {
+		return "", err
+	}
+	return buf.String(), nil
+}
+
+func ToYaml(v interface{}) (string, error) {
+	data, err := yaml.Marshal(v)
+	if err != nil {
+		return "", err
+	}
+	return string(data), nil
+}
+
+func FromYaml(str string) (Values, error) {
+	m := Values{}
+
+	if err := yaml.Unmarshal([]byte(str), &m); err != nil {
+		return nil, err
+	}
+	return m, nil
+}
+
+func SetValueAtPath(path string, value interface{}, values Values) (Values, error) {
+	var current interface{}
+	current = values
+	components := strings.Split(path, ".")
+	pathToMap := components[:len(components)-1]
+	key := components[len(components)-1]
+	for _, k := range pathToMap {
+		var elem interface{}
+
+		switch typedCurrent := current.(type) {
+		case map[string]interface{}:
+			v, exists := typedCurrent[k]
+			if !exists {
+				return nil, fmt.Errorf("failed to set value at path \"%s\": value for key \"%s\" does not exist", path, k)
+			}
+			elem = v
+		case map[interface{}]interface{}:
+			v, exists := typedCurrent[k]
+			if !exists {
+				return nil, fmt.Errorf("failed to set value at path \"%s\": value for key \"%s\" does not exist", path, k)
+			}
+			elem = v
+		default:
+			return nil, fmt.Errorf("failed to set value at path \"%s\": value for key \"%s\" was not a map", path, k)
+		}
+
+		switch typedElem := elem.(type) {
+		case map[string]interface{}, map[interface{}]interface{}:
+			current = typedElem
+		default:
+			return nil, fmt.Errorf("failed to set value at path \"%s\": value for key \"%s\" was not a map", path, k)
+		}
+	}
+
+	switch typedCurrent := current.(type) {
+	case map[string]interface{}:
+		typedCurrent[key] = value
+	case map[interface{}]interface{}:
+		typedCurrent[key] = value
+	default:
+		return nil, fmt.Errorf("failed to set value at path \"%s\": value for key \"%s\" was not a map", path, key)
+	}
+	return values, nil
+}
+
+func RequiredEnv(name string) (string, error) {
+	if val, exists := os.LookupEnv(name); exists && len(val) > 0 {
+		return val, nil
+	}
+
+	return "", fmt.Errorf("required env var `%s` is not set", name)
+}

tmpl/context_funcs_test.go

@@ -0,0 +1,135 @@
+package tmpl
+
+import (
+	"fmt"
+	"path/filepath"
+	"reflect"
+	"testing"
+)
+
+func TestReadFile(t *testing.T) {
+	expected := `foo:
+  bar: BAR
+`
+	expectedFilename := "values.yaml"
+	ctx := &Context{basePath: ".", readFile: func(filename string) ([]byte, error) {
+		if filename != expectedFilename {
+			return nil, fmt.Errorf("unexpected filename: expected=%v, actual=%s", expectedFilename, filename)
+		}
+		return []byte(expected), nil
+	}}
+	actual, err := ctx.ReadFile(expectedFilename)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func TestReadFile_PassAbsPath(t *testing.T) {
+	expected := `foo:
+  bar: BAR
+`
+	expectedFilename, _ := filepath.Abs("values.yaml")
+	ctx := &Context{basePath: ".", readFile: func(filename string) ([]byte, error) {
+		if filename != expectedFilename {
+			return nil, fmt.Errorf("unexpected filename: expected=%v, actual=%s", expectedFilename, filename)
+		}
+		return []byte(expected), nil
+	}}
+	actual, err := ctx.ReadFile(expectedFilename)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func TestToYaml(t *testing.T) {
+	expected := `foo:
+  bar: BAR
+`
+	vals := Values(map[string]interface{}{
+		"foo": map[interface{}]interface{}{
+			"bar": "BAR",
+		},
+	})
+	actual, err := ToYaml(vals)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func TestFromYaml(t *testing.T) {
+	raw := `foo:
+  bar: BAR
+`
+	expected := Values(map[string]interface{}{
+		"foo": map[interface{}]interface{}{
+			"bar": "BAR",
+		},
+	})
+	actual, err := FromYaml(raw)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func TestSetValueAtPath_OneComponent(t *testing.T) {
+	input := map[string]interface{}{
+		"foo": "",
+	}
+	expected := map[string]interface{}{
+		"foo": "FOO",
+	}
+	actual, err := SetValueAtPath("foo", "FOO", input)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func TestSetValueAtPath_TwoComponents(t *testing.T) {
+	input := map[string]interface{}{
+		"foo": map[interface{}]interface{}{
+			"bar": "",
+		},
+	}
+	expected := map[string]interface{}{
+		"foo": map[interface{}]interface{}{
+			"bar": "FOO_BAR",
+		},
+	}
+	actual, err := SetValueAtPath("foo.bar", "FOO_BAR", input)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func TestTpl(t *testing.T) {
+	text := `foo: {{ .foo }}
+`
+	expected := `foo: FOO
+`
+	ctx := &Context{basePath: "."}
+	actual, err := ctx.Tpl(text, map[string]interface{}{"foo": "FOO"})
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}

tmpl/context_tmpl.go

@@ -0,0 +1,41 @@
+package tmpl
+
+import (
+	"bytes"
+	"github.com/Masterminds/sprig"
+	"text/template"
+)
+
+func (c *Context) stringTemplate() *template.Template {
+	funcMap := sprig.TxtFuncMap()
+	for name, f := range c.createFuncMap() {
+		funcMap[name] = f
+	}
+	tmpl := template.New("stringTemplate").Funcs(funcMap)
+	if c.preRender {
+		tmpl.Option("missingkey=zero")
+	} else {
+		tmpl.Option("missingkey=error")
+	}
+	return tmpl
+}
+
+func (c *Context) RenderTemplateToBuffer(s string, data ...interface{}) (*bytes.Buffer, error) {
+	var t, parseErr = c.stringTemplate().Parse(s)
+	if parseErr != nil {
+		return nil, parseErr
+	}
+
+	var tplString bytes.Buffer
+	var d interface{}
+	if len(data) > 0 {
+		d = data[0]
+	}
+	var execErr = t.Execute(&tplString, d)
+
+	if execErr != nil {
+		return &tplString, execErr
+	}
+
+	return &tplString, nil
+}

tmpl/context_tmpl_test.go

@@ -0,0 +1,251 @@
+package tmpl
+
+import (
+	"fmt"
+	"os"
+	"reflect"
+	"testing"
+)
+
+func TestRenderTemplate_Values(t *testing.T) {
+	valuesYamlContent := `foo:
+  bar: BAR
+`
+	expected := `foo:
+  bar: FOO_BAR
+`
+	expectedFilename := "values.yaml"
+	ctx := &Context{readFile: func(filename string) ([]byte, error) {
+		if filename != expectedFilename {
+			return nil, fmt.Errorf("unexpected filename: expected=%v, actual=%s", expectedFilename, filename)
+		}
+		return []byte(valuesYamlContent), nil
+	}}
+	buf, err := ctx.RenderTemplateToBuffer(`{{ readFile "values.yaml" | fromYaml | setValueAtPath "foo.bar" "FOO_BAR" | toYaml }}`)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	actual := buf.String()
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func TestRenderTemplate_WithData(t *testing.T) {
+	valuesYamlContent := `foo:
+  bar: {{ .foo.bar }}
+`
+	expected := `foo:
+  bar: FOO_BAR
+`
+	expectedFilename := "values.yaml"
+	data := map[string]interface{}{
+		"foo": map[string]interface{}{
+			"bar": "FOO_BAR",
+		},
+	}
+	ctx := &Context{readFile: func(filename string) ([]byte, error) {
+		if filename != expectedFilename {
+			return nil, fmt.Errorf("unexpected filename: expected=%v, actual=%s", expectedFilename, filename)
+		}
+		return []byte(valuesYamlContent), nil
+	}}
+	buf, err := ctx.RenderTemplateToBuffer(valuesYamlContent, data)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	actual := buf.String()
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func TestRenderTemplate_AccessingMissingKeyWithGetOrNil(t *testing.T) {
+	valuesYamlContent := `foo:
+  bar: {{ . | getOrNil "foo.bar" }}
+`
+	expected := `foo:
+  bar: <no value>
+`
+	expectedFilename := "values.yaml"
+	data := map[string]interface{}{}
+	ctx := &Context{readFile: func(filename string) ([]byte, error) {
+		if filename != expectedFilename {
+			return nil, fmt.Errorf("unexpected filename: expected=%v, actual=%s", expectedFilename, filename)
+		}
+		return []byte(valuesYamlContent), nil
+	}}
+	buf, err := ctx.RenderTemplateToBuffer(valuesYamlContent, data)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	actual := buf.String()
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func TestRenderTemplate_Defaulting(t *testing.T) {
+	valuesYamlContent := `foo:
+  bar: {{ . | getOrNil "foo.bar" | default "DEFAULT" }}
+`
+	expected := `foo:
+  bar: DEFAULT
+`
+	expectedFilename := "values.yaml"
+	data := map[string]interface{}{}
+	ctx := &Context{readFile: func(filename string) ([]byte, error) {
+		if filename != expectedFilename {
+			return nil, fmt.Errorf("unexpected filename: expected=%v, actual=%s", expectedFilename, filename)
+		}
+		return []byte(valuesYamlContent), nil
+	}}
+	buf, err := ctx.RenderTemplateToBuffer(valuesYamlContent, data)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	actual := buf.String()
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func renderTemplateToString(s string, data ...interface{}) (string, error) {
+	ctx := &Context{readFile: func(filename string) ([]byte, error) {
+		return nil, fmt.Errorf("unexpected call to readFile: filename=%s", filename)
+	}}
+	tplString, err := ctx.RenderTemplateToBuffer(s, data...)
+	if err != nil {
+		return "", err
+	}
+	return tplString.String(), nil
+}
+
+func Test_renderTemplateToString(t *testing.T) {
+	type args struct {
+		s    string
+		envs map[string]string
+		data interface{}
+	}
+	tests := []struct {
+		name    string
+		args    args
+		want    string
+		wantErr bool
+	}{
+		{
+			name: "simple replacement",
+			args: args{
+				s: "{{ env \"HF_TEST_VAR\" }}",
+				envs: map[string]string{
+					"HF_TEST_VAR": "content",
+				},
+			},
+			want:    "content",
+			wantErr: false,
+		},
+		{
+			name: "two replacements",
+			args: args{
+				s: "{{ env \"HF_TEST_ALPHA\" }}{{ env \"HF_TEST_BETA\" }}",
+				envs: map[string]string{
+					"HF_TEST_ALPHA": "first",
+					"HF_TEST_BETA":  "second",
+				},
+			},
+			want:    "firstsecond",
+			wantErr: false,
+		},
+		{
+			name: "replacement and comment",
+			args: args{
+				s: "{{ env \"HF_TEST_ALPHA\" }}{{/* comment */}}",
+				envs: map[string]string{
+					"HF_TEST_ALPHA": "first",
+				},
+			},
+			want:    "first",
+			wantErr: false,
+		},
+		{
+			name: "global template function",
+			args: args{
+				s: "{{ env \"HF_TEST_ALPHA\" | len }}",
+				envs: map[string]string{
+					"HF_TEST_ALPHA": "abcdefg",
+				},
+			},
+			want:    "7",
+			wantErr: false,
+		},
+		{
+			name: "get",
+			args: args{
+				s:    `{{ . | get "Foo" }}, {{ . | get "Bar" "2" }}`,
+				envs: map[string]string{},
+				data: map[string]interface{}{
+					"Foo": "1",
+				},
+			},
+			want:    "1, 2",
+			wantErr: false,
+		},
+		{
+			name: "env var not set",
+			args: args{
+				s: "{{ env \"HF_TEST_NONE\" }}",
+				envs: map[string]string{
+					"HF_TEST_THIS": "first",
+				},
+			},
+			want: "",
+		},
+		{
+			name: "undefined function",
+			args: args{
+				s: "{{ env foo }}",
+				envs: map[string]string{
+					"foo": "bar",
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "required env var",
+			args: args{
+				s: "{{ requiredEnv \"HF_TEST\" }}",
+				envs: map[string]string{
+					"HF_TEST": "value",
+				},
+			},
+			want:    "value",
+			wantErr: false,
+		},
+		{
+			name: "required env var not set",
+			args: args{
+				s:    "{{ requiredEnv \"HF_TEST_NONE\" }}",
+				envs: map[string]string{},
+			},
+			wantErr: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			for k, v := range tt.args.envs {
+				err := os.Setenv(k, v)
+				if err != nil {
+					t.Error("renderTemplateToString() could not set env var for testing")
+				}
+			}
+			got, err := renderTemplateToString(tt.args.s, tt.args.data)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("renderTemplateToString() for %s error = %v, wantErr %v", tt.name, err, tt.wantErr)
+				return
+			}
+			if got != tt.want {
+				t.Errorf("renderTemplateToString() for %s = %v, want %v", tt.name, got, tt.want)
+			}
+		})
+	}
+}

tmpl/file_renderer.go

@@ -0,0 +1,78 @@
+package tmpl
+
+import (
+	"bytes"
+	"io/ioutil"
+
+	"fmt"
+	"strings"
+)
+
+type FileRenderer struct {
+	ReadFile func(string) ([]byte, error)
+	Context  *Context
+	Data     interface{}
+}
+
+func NewFileRenderer(readFile func(filename string) ([]byte, error), basePath string, data interface{}) *FileRenderer {
+	return &FileRenderer{
+		ReadFile: readFile,
+		Context: &Context{
+			basePath: basePath,
+			readFile: readFile,
+		},
+		Data: data,
+	}
+}
+
+func NewFirstPassRenderer(basePath string, data interface{}) *FileRenderer {
+	return &FileRenderer{
+		ReadFile: ioutil.ReadFile,
+		Context: &Context{
+			preRender: true,
+			basePath:  basePath,
+			readFile:  ioutil.ReadFile,
+		},
+		Data: data,
+	}
+}
+
+func (r *FileRenderer) RenderTemplateFileToBuffer(file string) (*bytes.Buffer, error) {
+	content, err := r.ReadFile(file)
+	if err != nil {
+		return nil, err
+	}
+
+	return r.RenderTemplateContentToBuffer(content)
+}
+
+func (r *FileRenderer) RenderToBytes(path string) ([]byte, error) {
+	var yamlBytes []byte
+	splits := strings.Split(path, ".")
+	if len(splits) > 0 && splits[len(splits)-1] == "gotmpl" {
+		yamlBuf, err := r.RenderTemplateFileToBuffer(path)
+		if err != nil {
+			return nil, fmt.Errorf("failed to render [%s], because of %v", path, err)
+		}
+		yamlBytes = yamlBuf.Bytes()
+	} else {
+		var err error
+		yamlBytes, err = r.ReadFile(path)
+		if err != nil {
+			return nil, fmt.Errorf("failed to load [%s]: %v", path, err)
+		}
+	}
+	return yamlBytes, nil
+}
+
+func (r *FileRenderer) RenderTemplateContentToBuffer(content []byte) (*bytes.Buffer, error) {
+	return r.Context.RenderTemplateToBuffer(string(content), r.Data)
+}
+
+func (r *FileRenderer) RenderTemplateContentToString(content []byte) (string, error) {
+	buf, err := r.Context.RenderTemplateToBuffer(string(content), r.Data)
+	if err != nil {
+		return "", err
+	}
+	return buf.String(), nil
+}

tmpl/file_renderer_test.go

@@ -0,0 +1,67 @@
+package tmpl
+
+import (
+	"fmt"
+	"github.com/roboll/helmfile/environment"
+	"reflect"
+	"testing"
+)
+
+var emptyEnvTmplData = map[string]interface{}{
+	"Environment": environment.EmptyEnvironment,
+	"Namespace":   "",
+}
+
+func TestRenderToBytes_Gotmpl(t *testing.T) {
+	valuesYamlTmplContent := `foo:
+  bar: '{{ readFile "data.txt" }}'
+`
+	dataFileContent := "FOO_BAR"
+	expected := `foo:
+  bar: 'FOO_BAR'
+`
+	dataFile := "data.txt"
+	valuesTmplFile := "values.yaml.gotmpl"
+	r := NewFileRenderer(func(filename string) ([]byte, error) {
+		switch filename {
+		case valuesTmplFile:
+			return []byte(valuesYamlTmplContent), nil
+		case dataFile:
+			return []byte(dataFileContent), nil
+		}
+		return nil, fmt.Errorf("unexpected filename: expected=%v or %v, actual=%s", dataFile, valuesTmplFile, filename)
+	}, "", emptyEnvTmplData)
+	buf, err := r.RenderToBytes(valuesTmplFile)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	actual := string(buf)
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}
+
+func TestRenderToBytes_Yaml(t *testing.T) {
+	valuesYamlContent := `foo:
+  bar: '{{ readFile "data.txt" }}'
+`
+	expected := `foo:
+  bar: '{{ readFile "data.txt" }}'
+`
+	valuesFile := "values.yaml"
+	r := NewFileRenderer(func(filename string) ([]byte, error) {
+		switch filename {
+		case valuesFile:
+			return []byte(valuesYamlContent), nil
+		}
+		return nil, fmt.Errorf("unexpected filename: expected=%v, actual=%s", valuesFile, filename)
+	}, "", emptyEnvTmplData)
+	buf, err := r.RenderToBytes(valuesFile)
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	actual := string(buf)
+	if !reflect.DeepEqual(actual, expected) {
+		t.Errorf("unexpected result: expected=%v, actual=%v", expected, actual)
+	}
+}

tmpl/get_or_nil.go

@@ -0,0 +1,91 @@
+package tmpl
+
+import (
+	"fmt"
+	"reflect"
+	"strings"
+)
+
+type noValueError struct {
+	msg string
+}
+
+func (e *noValueError) Error() string {
+	return e.msg
+}
+
+func get(path string, varArgs ...interface{}) (interface{}, error) {
+	var defSet bool
+	var def interface{}
+	var obj interface{}
+	switch len(varArgs) {
+	case 1:
+		defSet = false
+		def = nil
+		obj = varArgs[0]
+	case 2:
+		defSet = true
+		def = varArgs[0]
+		obj = varArgs[1]
+	default:
+		return nil, fmt.Errorf("unexpected number of args pased to the template function get(path, [def, ]obj): expected 1 or 2, got %d, args was %v", len(varArgs), varArgs)
+	}
+
+	if path == "" {
+		return obj, nil
+	}
+	keys := strings.Split(path, ".")
+	var v interface{}
+	var ok bool
+	switch typedObj := obj.(type) {
+	case map[string]interface{}:
+		v, ok = typedObj[keys[0]]
+		if !ok {
+			if defSet {
+				return def, nil
+			}
+			return nil, &noValueError{fmt.Sprintf("no value exist for key \"%s\" in %v", keys[0], typedObj)}
+		}
+	case map[interface{}]interface{}:
+		v, ok = typedObj[keys[0]]
+		if !ok {
+			if defSet {
+				return def, nil
+			}
+			return nil, &noValueError{fmt.Sprintf("no value exist for key \"%s\" in %v", keys[0], typedObj)}
+		}
+	default:
+		maybeStruct := reflect.ValueOf(typedObj)
+		if maybeStruct.Kind() != reflect.Struct {
+			return nil, &noValueError{fmt.Sprintf("unexpected type(%v) of value for key \"%s\": it must be either map[string]interface{} or any struct", reflect.TypeOf(obj), keys[0])}
+		} else if maybeStruct.NumField() < 1 {
+			return nil, &noValueError{fmt.Sprintf("no accessible struct fields for key \"%s\"", keys[0])}
+		}
+		f := maybeStruct.FieldByName(keys[0])
+		if !f.IsValid() {
+			if defSet {
+				return def, nil
+			}
+			return nil, &noValueError{fmt.Sprintf("no field named \"%s\" exist in %v", keys[0], typedObj)}
+		}
+		v = f.Interface()
+	}
+
+	if defSet {
+		return get(strings.Join(keys[1:], "."), def, v)
+	}
+	return get(strings.Join(keys[1:], "."), v)
+}
+
+func getOrNil(path string, o interface{}) (interface{}, error) {
+	v, err := get(path, o)
+	if err != nil {
+		switch err.(type) {
+		case *noValueError:
+			return nil, nil
+		default:
+			return nil, err
+		}
+	}
+	return v, nil
+}

tmpl/get_or_nil_test.go

@@ -0,0 +1,128 @@
+package tmpl
+
+import (
+	"testing"
+)
+
+type EmptyStruct struct {
+}
+
+func TestGetStruct(t *testing.T) {
+	type Foo struct{ Bar string }
+
+	obj := struct{ Foo }{Foo{Bar: "Bar"}}
+
+	v1, err := get("Foo.Bar", obj)
+
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if v1 != "Bar" {
+		t.Errorf("unexpected value for path Foo.Bar in %v: expected=Bar, actual=%v", obj, v1)
+	}
+
+	_, err = get("Foo.baz", obj)
+
+	if err == nil {
+		t.Errorf("expected error but was not occurred")
+	}
+
+	_, err = get("foo", EmptyStruct{})
+
+	if err == nil {
+		t.Errorf("expected error but was not occurred")
+	}
+}
+
+func TestGetMap(t *testing.T) {
+	obj := map[string]interface{}{"Foo": map[string]interface{}{"Bar": "Bar"}}
+
+	v1, err := get("Foo.Bar", obj)
+
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if v1 != "Bar" {
+		t.Errorf("unexpected value for path Foo.Bar in %v: expected=Bar, actual=%v", obj, v1)
+	}
+
+	_, err = get("Foo.baz", obj)
+
+	if err == nil {
+		t.Errorf("expected error but was not occurred")
+	}
+}
+
+func TestGet_Default(t *testing.T) {
+	obj := map[string]interface{}{"Foo": map[string]interface{}{}, "foo": 1}
+
+	v1, err := get("Foo.Bar", "Bar", obj)
+
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if v1 != "Bar" {
+		t.Errorf("unexpected value for path Foo.Bar in %v: expected=Bar, actual=%v", obj, v1)
+	}
+
+	v2, err := get("Baz", "Baz", obj)
+
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if v2 != "Baz" {
+		t.Errorf("unexpected value for path Baz in %v: expected=Baz, actual=%v", obj, v2)
+	}
+
+	_, err = get("foo.Bar", "fooBar", obj)
+
+	if err == nil {
+		t.Errorf("expected error but was not occurred")
+	}
+}
+
+func TestGetOrNilStruct(t *testing.T) {
+	type Foo struct{ Bar string }
+
+	obj := struct{ Foo }{Foo{Bar: "Bar"}}
+
+	v1, err := getOrNil("Foo.Bar", obj)
+
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if v1 != "Bar" {
+		t.Errorf("unexpected value for path Foo.Bar in %v: expected=Bar, actual=%v", obj, v1)
+	}
+
+	v2, err := getOrNil("Foo.baz", obj)
+
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if v2 != nil {
+		t.Errorf("unexpected value for path Foo.baz in %v: expected=nil, actual=%v", obj, v2)
+	}
+}
+
+func TestGetOrNilMap(t *testing.T) {
+	obj := map[string]interface{}{"Foo": map[string]interface{}{"Bar": "Bar"}}
+
+	v1, err := getOrNil("Foo.Bar", obj)
+
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if v1 != "Bar" {
+		t.Errorf("unexpected value for path Foo.Bar in %v: expected=Bar, actual=%v", obj, v1)
+	}
+
+	v2, err := getOrNil("Foo.baz", obj)
+
+	if err != nil {
+		t.Errorf("unexpected error: %v", err)
+	}
+	if v2 != nil {
+		t.Errorf("unexpected value for path Foo.baz in %v: expected=nil, actual=%v", obj, v2)
+	}
+}

tmpl/text_renderer.go

@@ -0,0 +1,30 @@
+package tmpl
+
+type templateTextRenderer struct {
+	ReadText func(string) ([]byte, error)
+	Context  *Context
+	Data     interface{}
+}
+
+type TextRenderer interface {
+	RenderTemplateText(text string) (string, error)
+}
+
+func NewTextRenderer(readFile func(filename string) ([]byte, error), basePath string, data interface{}) *templateTextRenderer {
+	return &templateTextRenderer{
+		ReadText: readFile,
+		Context: &Context{
+			basePath: basePath,
+			readFile: readFile,
+		},
+		Data: data,
+	}
+}
+
+func (r *templateTextRenderer) RenderTemplateText(text string) (string, error) {
+	buf, err := r.Context.RenderTemplateToBuffer(text, r.Data)
+	if err != nil {
+		return "", err
+	}
+	return buf.String(), nil
+}

vendor/github.com/Masterminds/semver/.travis.yml

@@ -0,0 +1,27 @@
+language: go
+
+go:
+  - 1.6.x
+  - 1.7.x
+  - 1.8.x
+  - 1.9.x
+  - 1.10.x
+  - tip
+
+# Setting sudo access to false will let Travis CI use containers rather than
+# VMs to run the tests. For more details see:
+# - http://docs.travis-ci.com/user/workers/container-based-infrastructure/
+# - http://docs.travis-ci.com/user/workers/standard-infrastructure/
+sudo: false
+
+script:
+  - make setup
+  - make test
+
+notifications:
+  webhooks:
+    urls:
+      - https://webhooks.gitter.im/e/06e3328629952dabe3e0
+    on_success: change  # options: [always|never|change] default: always
+    on_failure: always  # options: [always|never|change] default: always
+    on_start: never     # options: [always|never|change] default: always

vendor/github.com/Masterminds/semver/CHANGELOG.md

@@ -0,0 +1,77 @@
+# 1.4.1 (2018-04-02)
+
+## Fixed
+- Fixed #64: Fix pre-release precedence issue (thanks @uudashr)
+
+# 1.4.0 (2017-10-04)
+
+## Changed
+- #61: Update NewVersion to parse ints with a 64bit int size (thanks @zknill)
+
+# 1.3.1 (2017-07-10)
+
+## Fixed
+- Fixed #57: number comparisons in prerelease sometimes inaccurate
+
+# 1.3.0 (2017-05-02)
+
+## Added
+- #45: Added json (un)marshaling support (thanks @mh-cbon)
+- Stability marker. See https://masterminds.github.io/stability/
+
+## Fixed
+- #51: Fix handling of single digit tilde constraint (thanks @dgodd)
+
+## Changed
+- #55: The godoc icon moved from png to svg
+
+# 1.2.3 (2017-04-03)
+
+## Fixed
+- #46: Fixed 0.x.x and 0.0.x in constraints being treated as *
+
+# Release 1.2.2 (2016-12-13)
+
+## Fixed
+- #34: Fixed issue where hyphen range was not working with pre-release parsing.
+
+# Release 1.2.1 (2016-11-28)
+
+## Fixed
+- #24: Fixed edge case issue where constraint "> 0" does not handle "0.0.1-alpha"
+  properly.
+
+# Release 1.2.0 (2016-11-04)
+
+## Added
+- #20: Added MustParse function for versions (thanks @adamreese)
+- #15: Added increment methods on versions (thanks @mh-cbon)
+
+## Fixed
+- Issue #21: Per the SemVer spec (section 9) a pre-release is unstable and
+  might not satisfy the intended compatibility. The change here ignores pre-releases
+  on constraint checks (e.g., ~ or ^) when a pre-release is not part of the
+  constraint. For example, `^1.2.3` will ignore pre-releases while
+  `^1.2.3-alpha` will include them.
+
+# Release 1.1.1 (2016-06-30)
+
+## Changed
+- Issue #9: Speed up version comparison performance (thanks @sdboyer)
+- Issue #8: Added benchmarks (thanks @sdboyer)
+- Updated Go Report Card URL to new location
+- Updated Readme to add code snippet formatting (thanks @mh-cbon)
+- Updating tagging to v[SemVer] structure for compatibility with other tools.
+
+# Release 1.1.0 (2016-03-11)
+
+- Issue #2: Implemented validation to provide reasons a versions failed a
+  constraint.
+
+# Release 1.0.1 (2015-12-31)
+
+- Fixed #1: * constraint failing on valid versions.
+
+# Release 1.0.0 (2015-10-20)
+
+- Initial release

vendor/github.com/Masterminds/semver/LICENSE.txt

@@ -0,0 +1,20 @@
+The Masterminds
+Copyright (C) 2014-2015, Matt Butcher and Matt Farina
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

vendor/github.com/Masterminds/semver/Makefile

@@ -0,0 +1,36 @@
+.PHONY: setup
+setup:
+	go get -u gopkg.in/alecthomas/gometalinter.v1
+	gometalinter.v1 --install
+
+.PHONY: test
+test: validate lint
+	@echo "==> Running tests"
+	go test -v
+
+.PHONY: validate
+validate:
+	@echo "==> Running static validations"
+	@gometalinter.v1 \
+	  --disable-all \
+	  --enable deadcode \
+	  --severity deadcode:error \
+	  --enable gofmt \
+	  --enable gosimple \
+	  --enable ineffassign \
+	  --enable misspell \
+	  --enable vet \
+	  --tests \
+	  --vendor \
+	  --deadline 60s \
+	  ./... || exit_code=1
+
+.PHONY: lint
+lint:
+	@echo "==> Running linters"
+	@gometalinter.v1 \
+	  --disable-all \
+	  --enable golint \
+	  --vendor \
+	  --deadline 60s \
+	  ./... || :

vendor/github.com/Masterminds/semver/README.md

@@ -0,0 +1,165 @@
+# SemVer
+
+The `semver` package provides the ability to work with [Semantic Versions](http://semver.org) in Go. Specifically it provides the ability to:
+
+* Parse semantic versions
+* Sort semantic versions
+* Check if a semantic version fits within a set of constraints
+* Optionally work with a `v` prefix
+
+[![Stability:
+Active](https://masterminds.github.io/stability/active.svg)](https://masterminds.github.io/stability/active.html)
+[![Build Status](https://travis-ci.org/Masterminds/semver.svg)](https://travis-ci.org/Masterminds/semver) [![Build status](https://ci.appveyor.com/api/projects/status/jfk66lib7hb985k8/branch/master?svg=true&passingText=windows%20build%20passing&failingText=windows%20build%20failing)](https://ci.appveyor.com/project/mattfarina/semver/branch/master) [![GoDoc](https://godoc.org/github.com/Masterminds/semver?status.svg)](https://godoc.org/github.com/Masterminds/semver) [![Go Report Card](https://goreportcard.com/badge/github.com/Masterminds/semver)](https://goreportcard.com/report/github.com/Masterminds/semver)
+
+## Parsing Semantic Versions
+
+To parse a semantic version use the `NewVersion` function. For example,
+
+```go
+    v, err := semver.NewVersion("1.2.3-beta.1+build345")
+```
+
+If there is an error the version wasn't parseable. The version object has methods
+to get the parts of the version, compare it to other versions, convert the
+version back into a string, and get the original string. For more details
+please see the [documentation](https://godoc.org/github.com/Masterminds/semver).
+
+## Sorting Semantic Versions
+
+A set of versions can be sorted using the [`sort`](https://golang.org/pkg/sort/)
+package from the standard library. For example,
+
+```go
+    raw := []string{"1.2.3", "1.0", "1.3", "2", "0.4.2",}
+    vs := make([]*semver.Version, len(raw))
+	for i, r := range raw {
+		v, err := semver.NewVersion(r)
+		if err != nil {
+			t.Errorf("Error parsing version: %s", err)
+		}
+
+		vs[i] = v
+	}
+
+	sort.Sort(semver.Collection(vs))
+```
+
+## Checking Version Constraints
+
+Checking a version against version constraints is one of the most featureful
+parts of the package.
+
+```go
+    c, err := semver.NewConstraint(">= 1.2.3")
+    if err != nil {
+        // Handle constraint not being parseable.
+    }
+
+    v, _ := semver.NewVersion("1.3")
+    if err != nil {
+        // Handle version not being parseable.
+    }
+    // Check if the version meets the constraints. The a variable will be true.
+    a := c.Check(v)
+```
+
+## Basic Comparisons
+
+There are two elements to the comparisons. First, a comparison string is a list
+of comma separated and comparisons. These are then separated by || separated or
+comparisons. For example, `">= 1.2, < 3.0.0 || >= 4.2.3"` is looking for a
+comparison that's greater than or equal to 1.2 and less than 3.0.0 or is
+greater than or equal to 4.2.3.
+
+The basic comparisons are:
+
+* `=`: equal (aliased to no operator)
+* `!=`: not equal
+* `>`: greater than
+* `<`: less than
+* `>=`: greater than or equal to
+* `<=`: less than or equal to
+
+_Note, according to the Semantic Version specification pre-releases may not be
+API compliant with their release counterpart. It says,_
+
+> _A pre-release version indicates that the version is unstable and might not satisfy the intended compatibility requirements as denoted by its associated normal version._
+
+_SemVer comparisons without a pre-release value will skip pre-release versions.
+For example, `>1.2.3` will skip pre-releases when looking at a list of values
+while `>1.2.3-alpha.1` will evaluate pre-releases._
+
+## Hyphen Range Comparisons
+
+There are multiple methods to handle ranges and the first is hyphens ranges.
+These look like:
+
+* `1.2 - 1.4.5` which is equivalent to `>= 1.2, <= 1.4.5`
+* `2.3.4 - 4.5` which is equivalent to `>= 2.3.4, <= 4.5`
+
+## Wildcards In Comparisons
+
+The `x`, `X`, and `*` characters can be used as a wildcard character. This works
+for all comparison operators. When used on the `=` operator it falls
+back to the pack level comparison (see tilde below). For example,
+
+* `1.2.x` is equivalent to `>= 1.2.0, < 1.3.0`
+* `>= 1.2.x` is equivalent to `>= 1.2.0`
+* `<= 2.x` is equivalent to `<= 3`
+* `*` is equivalent to `>= 0.0.0`
+
+## Tilde Range Comparisons (Patch)
+
+The tilde (`~`) comparison operator is for patch level ranges when a minor
+version is specified and major level changes when the minor number is missing.
+For example,
+
+* `~1.2.3` is equivalent to `>= 1.2.3, < 1.3.0`
+* `~1` is equivalent to `>= 1, < 2`
+* `~2.3` is equivalent to `>= 2.3, < 2.4`
+* `~1.2.x` is equivalent to `>= 1.2.0, < 1.3.0`
+* `~1.x` is equivalent to `>= 1, < 2`
+
+## Caret Range Comparisons (Major)
+
+The caret (`^`) comparison operator is for major level changes. This is useful
+when comparisons of API versions as a major change is API breaking. For example,
+
+* `^1.2.3` is equivalent to `>= 1.2.3, < 2.0.0`
+* `^1.2.x` is equivalent to `>= 1.2.0, < 2.0.0`
+* `^2.3` is equivalent to `>= 2.3, < 3`
+* `^2.x` is equivalent to `>= 2.0.0, < 3`
+
+# Validation
+
+In addition to testing a version against a constraint, a version can be validated
+against a constraint. When validation fails a slice of errors containing why a
+version didn't meet the constraint is returned. For example,
+
+```go
+    c, err := semver.NewConstraint("<= 1.2.3, >= 1.4")
+    if err != nil {
+        // Handle constraint not being parseable.
+    }
+
+    v, _ := semver.NewVersion("1.3")
+    if err != nil {
+        // Handle version not being parseable.
+    }
+
+    // Validate a version against a constraint.
+    a, msgs := c.Validate(v)
+    // a is false
+    for _, m := range msgs {
+        fmt.Println(m)
+
+        // Loops over the errors which would read
+        // "1.3 is greater than 1.2.3"
+        // "1.3 is less than 1.4"
+    }
+```
+
+# Contribute
+
+If you find an issue or want to contribute please file an [issue](https://github.com/Masterminds/semver/issues)
+or [create a pull request](https://github.com/Masterminds/semver/pulls).

vendor/github.com/Masterminds/semver/appveyor.yml

@@ -0,0 +1,44 @@
+version: build-{build}.{branch}
+
+clone_folder: C:\gopath\src\github.com\Masterminds\semver
+shallow_clone: true
+
+environment:
+  GOPATH: C:\gopath
+
+platform:
+  - x64
+
+install:
+  - go version
+  - go env
+  - go get -u gopkg.in/alecthomas/gometalinter.v1
+  - set PATH=%PATH%;%GOPATH%\bin
+  - gometalinter.v1.exe --install
+
+build_script:
+  - go install -v ./...
+
+test_script:
+  - "gometalinter.v1 \
+    --disable-all \
+    --enable deadcode \
+    --severity deadcode:error \
+    --enable gofmt \
+    --enable gosimple \
+    --enable ineffassign \
+    --enable misspell \
+    --enable vet \
+    --tests \
+    --vendor \
+    --deadline 60s \
+    ./... || exit_code=1"
+  - "gometalinter.v1 \
+    --disable-all \
+    --enable golint \
+    --vendor \
+    --deadline 60s \
+    ./... || :"
+  - go test -v
+
+deploy: off

vendor/github.com/Masterminds/semver/collection.go

@@ -0,0 +1,24 @@
+package semver
+
+// Collection is a collection of Version instances and implements the sort
+// interface. See the sort package for more details.
+// https://golang.org/pkg/sort/
+type Collection []*Version
+
+// Len returns the length of a collection. The number of Version instances
+// on the slice.
+func (c Collection) Len() int {
+	return len(c)
+}
+
+// Less is needed for the sort interface to compare two Version objects on the
+// slice. If checks if one is less than the other.
+func (c Collection) Less(i, j int) bool {
+	return c[i].LessThan(c[j])
+}
+
+// Swap is needed for the sort interface to replace the Version objects
+// at two different positions in the slice.
+func (c Collection) Swap(i, j int) {
+	c[i], c[j] = c[j], c[i]
+}

vendor/github.com/Masterminds/semver/constraints.go

@@ -0,0 +1,426 @@
+package semver
+
+import (
+	"errors"
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// Constraints is one or more constraint that a semantic version can be
+// checked against.
+type Constraints struct {
+	constraints [][]*constraint
+}
+
+// NewConstraint returns a Constraints instance that a Version instance can
+// be checked against. If there is a parse error it will be returned.
+func NewConstraint(c string) (*Constraints, error) {
+
+	// Rewrite - ranges into a comparison operation.
+	c = rewriteRange(c)
+
+	ors := strings.Split(c, "||")
+	or := make([][]*constraint, len(ors))
+	for k, v := range ors {
+		cs := strings.Split(v, ",")
+		result := make([]*constraint, len(cs))
+		for i, s := range cs {
+			pc, err := parseConstraint(s)
+			if err != nil {
+				return nil, err
+			}
+
+			result[i] = pc
+		}
+		or[k] = result
+	}
+
+	o := &Constraints{constraints: or}
+	return o, nil
+}
+
+// Check tests if a version satisfies the constraints.
+func (cs Constraints) Check(v *Version) bool {
+	// loop over the ORs and check the inner ANDs
+	for _, o := range cs.constraints {
+		joy := true
+		for _, c := range o {
+			if !c.check(v) {
+				joy = false
+				break
+			}
+		}
+
+		if joy {
+			return true
+		}
+	}
+
+	return false
+}
+
+// Validate checks if a version satisfies a constraint. If not a slice of
+// reasons for the failure are returned in addition to a bool.
+func (cs Constraints) Validate(v *Version) (bool, []error) {
+	// loop over the ORs and check the inner ANDs
+	var e []error
+	for _, o := range cs.constraints {
+		joy := true
+		for _, c := range o {
+			if !c.check(v) {
+				em := fmt.Errorf(c.msg, v, c.orig)
+				e = append(e, em)
+				joy = false
+			}
+		}
+
+		if joy {
+			return true, []error{}
+		}
+	}
+
+	return false, e
+}
+
+var constraintOps map[string]cfunc
+var constraintMsg map[string]string
+var constraintRegex *regexp.Regexp
+
+func init() {
+	constraintOps = map[string]cfunc{
+		"":   constraintTildeOrEqual,
+		"=":  constraintTildeOrEqual,
+		"!=": constraintNotEqual,
+		">":  constraintGreaterThan,
+		"<":  constraintLessThan,
+		">=": constraintGreaterThanEqual,
+		"=>": constraintGreaterThanEqual,
+		"<=": constraintLessThanEqual,
+		"=<": constraintLessThanEqual,
+		"~":  constraintTilde,
+		"~>": constraintTilde,
+		"^":  constraintCaret,
+	}
+
+	constraintMsg = map[string]string{
+		"":   "%s is not equal to %s",
+		"=":  "%s is not equal to %s",
+		"!=": "%s is equal to %s",
+		">":  "%s is less than or equal to %s",
+		"<":  "%s is greater than or equal to %s",
+		">=": "%s is less than %s",
+		"=>": "%s is less than %s",
+		"<=": "%s is greater than %s",
+		"=<": "%s is greater than %s",
+		"~":  "%s does not have same major and minor version as %s",
+		"~>": "%s does not have same major and minor version as %s",
+		"^":  "%s does not have same major version as %s",
+	}
+
+	ops := make([]string, 0, len(constraintOps))
+	for k := range constraintOps {
+		ops = append(ops, regexp.QuoteMeta(k))
+	}
+
+	constraintRegex = regexp.MustCompile(fmt.Sprintf(
+		`^\s*(%s)\s*(%s)\s*$`,
+		strings.Join(ops, "|"),
+		cvRegex))
+
+	constraintRangeRegex = regexp.MustCompile(fmt.Sprintf(
+		`\s*(%s)\s+-\s+(%s)\s*`,
+		cvRegex, cvRegex))
+}
+
+// An individual constraint
+type constraint struct {
+	// The callback function for the restraint. It performs the logic for
+	// the constraint.
+	function cfunc
+
+	msg string
+
+	// The version used in the constraint check. For example, if a constraint
+	// is '<= 2.0.0' the con a version instance representing 2.0.0.
+	con *Version
+
+	// The original parsed version (e.g., 4.x from != 4.x)
+	orig string
+
+	// When an x is used as part of the version (e.g., 1.x)
+	minorDirty bool
+	dirty      bool
+	patchDirty bool
+}
+
+// Check if a version meets the constraint
+func (c *constraint) check(v *Version) bool {
+	return c.function(v, c)
+}
+
+type cfunc func(v *Version, c *constraint) bool
+
+func parseConstraint(c string) (*constraint, error) {
+	m := constraintRegex.FindStringSubmatch(c)
+	if m == nil {
+		return nil, fmt.Errorf("improper constraint: %s", c)
+	}
+
+	ver := m[2]
+	orig := ver
+	minorDirty := false
+	patchDirty := false
+	dirty := false
+	if isX(m[3]) {
+		ver = "0.0.0"
+		dirty = true
+	} else if isX(strings.TrimPrefix(m[4], ".")) || m[4] == "" {
+		minorDirty = true
+		dirty = true
+		ver = fmt.Sprintf("%s.0.0%s", m[3], m[6])
+	} else if isX(strings.TrimPrefix(m[5], ".")) {
+		dirty = true
+		patchDirty = true
+		ver = fmt.Sprintf("%s%s.0%s", m[3], m[4], m[6])
+	}
+
+	con, err := NewVersion(ver)
+	if err != nil {
+
+		// The constraintRegex should catch any regex parsing errors. So,
+		// we should never get here.
+		return nil, errors.New("constraint Parser Error")
+	}
+
+	cs := &constraint{
+		function:   constraintOps[m[1]],
+		msg:        constraintMsg[m[1]],
+		con:        con,
+		orig:       orig,
+		minorDirty: minorDirty,
+		patchDirty: patchDirty,
+		dirty:      dirty,
+	}
+	return cs, nil
+}
+
+// Constraint functions
+func constraintNotEqual(v *Version, c *constraint) bool {
+	if c.dirty {
+
+		// If there is a pre-release on the version but the constraint isn't looking
+		// for them assume that pre-releases are not compatible. See issue 21 for
+		// more details.
+		if v.Prerelease() != "" && c.con.Prerelease() == "" {
+			return false
+		}
+
+		if c.con.Major() != v.Major() {
+			return true
+		}
+		if c.con.Minor() != v.Minor() && !c.minorDirty {
+			return true
+		} else if c.minorDirty {
+			return false
+		}
+
+		return false
+	}
+
+	return !v.Equal(c.con)
+}
+
+func constraintGreaterThan(v *Version, c *constraint) bool {
+
+	// An edge case the constraint is 0.0.0 and the version is 0.0.0-someprerelease
+	// exists. This that case.
+	if !isNonZero(c.con) && isNonZero(v) {
+		return true
+	}
+
+	// If there is a pre-release on the version but the constraint isn't looking
+	// for them assume that pre-releases are not compatible. See issue 21 for
+	// more details.
+	if v.Prerelease() != "" && c.con.Prerelease() == "" {
+		return false
+	}
+
+	return v.Compare(c.con) == 1
+}
+
+func constraintLessThan(v *Version, c *constraint) bool {
+	// If there is a pre-release on the version but the constraint isn't looking
+	// for them assume that pre-releases are not compatible. See issue 21 for
+	// more details.
+	if v.Prerelease() != "" && c.con.Prerelease() == "" {
+		return false
+	}
+
+	if !c.dirty {
+		return v.Compare(c.con) < 0
+	}
+
+	if v.Major() > c.con.Major() {
+		return false
+	} else if v.Minor() > c.con.Minor() && !c.minorDirty {
+		return false
+	}
+
+	return true
+}
+
+func constraintGreaterThanEqual(v *Version, c *constraint) bool {
+	// An edge case the constraint is 0.0.0 and the version is 0.0.0-someprerelease
+	// exists. This that case.
+	if !isNonZero(c.con) && isNonZero(v) {
+		return true
+	}
+
+	// If there is a pre-release on the version but the constraint isn't looking
+	// for them assume that pre-releases are not compatible. See issue 21 for
+	// more details.
+	if v.Prerelease() != "" && c.con.Prerelease() == "" {
+		return false
+	}
+
+	return v.Compare(c.con) >= 0
+}
+
+func constraintLessThanEqual(v *Version, c *constraint) bool {
+	// If there is a pre-release on the version but the constraint isn't looking
+	// for them assume that pre-releases are not compatible. See issue 21 for
+	// more details.
+	if v.Prerelease() != "" && c.con.Prerelease() == "" {
+		return false
+	}
+
+	if !c.dirty {
+		return v.Compare(c.con) <= 0
+	}
+
+	if v.Major() > c.con.Major() {
+		return false
+	} else if v.Minor() > c.con.Minor() && !c.minorDirty {
+		return false
+	}
+
+	return true
+}
+
+// ~*, ~>* --> >= 0.0.0 (any)
+// ~2, ~2.x, ~2.x.x, ~>2, ~>2.x ~>2.x.x --> >=2.0.0, <3.0.0
+// ~2.0, ~2.0.x, ~>2.0, ~>2.0.x --> >=2.0.0, <2.1.0
+// ~1.2, ~1.2.x, ~>1.2, ~>1.2.x --> >=1.2.0, <1.3.0
+// ~1.2.3, ~>1.2.3 --> >=1.2.3, <1.3.0
+// ~1.2.0, ~>1.2.0 --> >=1.2.0, <1.3.0
+func constraintTilde(v *Version, c *constraint) bool {
+	// If there is a pre-release on the version but the constraint isn't looking
+	// for them assume that pre-releases are not compatible. See issue 21 for
+	// more details.
+	if v.Prerelease() != "" && c.con.Prerelease() == "" {
+		return false
+	}
+
+	if v.LessThan(c.con) {
+		return false
+	}
+
+	// ~0.0.0 is a special case where all constraints are accepted. It's
+	// equivalent to >= 0.0.0.
+	if c.con.Major() == 0 && c.con.Minor() == 0 && c.con.Patch() == 0 &&
+		!c.minorDirty && !c.patchDirty {
+		return true
+	}
+
+	if v.Major() != c.con.Major() {
+		return false
+	}
+
+	if v.Minor() != c.con.Minor() && !c.minorDirty {
+		return false
+	}
+
+	return true
+}
+
+// When there is a .x (dirty) status it automatically opts in to ~. Otherwise
+// it's a straight =
+func constraintTildeOrEqual(v *Version, c *constraint) bool {
+	// If there is a pre-release on the version but the constraint isn't looking
+	// for them assume that pre-releases are not compatible. See issue 21 for
+	// more details.
+	if v.Prerelease() != "" && c.con.Prerelease() == "" {
+		return false
+	}
+
+	if c.dirty {
+		c.msg = constraintMsg["~"]
+		return constraintTilde(v, c)
+	}
+
+	return v.Equal(c.con)
+}
+
+// ^* --> (any)
+// ^2, ^2.x, ^2.x.x --> >=2.0.0, <3.0.0
+// ^2.0, ^2.0.x --> >=2.0.0, <3.0.0
+// ^1.2, ^1.2.x --> >=1.2.0, <2.0.0
+// ^1.2.3 --> >=1.2.3, <2.0.0
+// ^1.2.0 --> >=1.2.0, <2.0.0
+func constraintCaret(v *Version, c *constraint) bool {
+	// If there is a pre-release on the version but the constraint isn't looking
+	// for them assume that pre-releases are not compatible. See issue 21 for
+	// more details.
+	if v.Prerelease() != "" && c.con.Prerelease() == "" {
+		return false
+	}
+
+	if v.LessThan(c.con) {
+		return false
+	}
+
+	if v.Major() != c.con.Major() {
+		return false
+	}
+
+	return true
+}
+
+var constraintRangeRegex *regexp.Regexp
+
+const cvRegex string = `v?([0-9|x|X|\*]+)(\.[0-9|x|X|\*]+)?(\.[0-9|x|X|\*]+)?` +
+	`(-([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?` +
+	`(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?`
+
+func isX(x string) bool {
+	switch x {
+	case "x", "*", "X":
+		return true
+	default:
+		return false
+	}
+}
+
+func rewriteRange(i string) string {
+	m := constraintRangeRegex.FindAllStringSubmatch(i, -1)
+	if m == nil {
+		return i
+	}
+	o := i
+	for _, v := range m {
+		t := fmt.Sprintf(">= %s, <= %s", v[1], v[11])
+		o = strings.Replace(o, v[0], t, 1)
+	}
+
+	return o
+}
+
+// Detect if a version is not zero (0.0.0)
+func isNonZero(v *Version) bool {
+	if v.Major() != 0 || v.Minor() != 0 || v.Patch() != 0 || v.Prerelease() != "" {
+		return true
+	}
+
+	return false
+}

vendor/github.com/Masterminds/semver/doc.go

@@ -0,0 +1,115 @@
+/*
+Package semver provides the ability to work with Semantic Versions (http://semver.org) in Go.
+
+Specifically it provides the ability to:
+
+    * Parse semantic versions
+    * Sort semantic versions
+    * Check if a semantic version fits within a set of constraints
+    * Optionally work with a `v` prefix
+
+Parsing Semantic Versions
+
+To parse a semantic version use the `NewVersion` function. For example,
+
+    v, err := semver.NewVersion("1.2.3-beta.1+build345")
+
+If there is an error the version wasn't parseable. The version object has methods
+to get the parts of the version, compare it to other versions, convert the
+version back into a string, and get the original string. For more details
+please see the documentation at https://godoc.org/github.com/Masterminds/semver.
+
+Sorting Semantic Versions
+
+A set of versions can be sorted using the `sort` package from the standard library.
+For example,
+
+    raw := []string{"1.2.3", "1.0", "1.3", "2", "0.4.2",}
+    vs := make([]*semver.Version, len(raw))
+	for i, r := range raw {
+		v, err := semver.NewVersion(r)
+		if err != nil {
+			t.Errorf("Error parsing version: %s", err)
+		}
+
+		vs[i] = v
+	}
+
+	sort.Sort(semver.Collection(vs))
+
+Checking Version Constraints
+
+Checking a version against version constraints is one of the most featureful
+parts of the package.
+
+    c, err := semver.NewConstraint(">= 1.2.3")
+    if err != nil {
+        // Handle constraint not being parseable.
+    }
+
+    v, _ := semver.NewVersion("1.3")
+    if err != nil {
+        // Handle version not being parseable.
+    }
+    // Check if the version meets the constraints. The a variable will be true.
+    a := c.Check(v)
+
+Basic Comparisons
+
+There are two elements to the comparisons. First, a comparison string is a list
+of comma separated and comparisons. These are then separated by || separated or
+comparisons. For example, `">= 1.2, < 3.0.0 || >= 4.2.3"` is looking for a
+comparison that's greater than or equal to 1.2 and less than 3.0.0 or is
+greater than or equal to 4.2.3.
+
+The basic comparisons are:
+
+    * `=`: equal (aliased to no operator)
+    * `!=`: not equal
+    * `>`: greater than
+    * `<`: less than
+    * `>=`: greater than or equal to
+    * `<=`: less than or equal to
+
+Hyphen Range Comparisons
+
+There are multiple methods to handle ranges and the first is hyphens ranges.
+These look like:
+
+    * `1.2 - 1.4.5` which is equivalent to `>= 1.2, <= 1.4.5`
+    * `2.3.4 - 4.5` which is equivalent to `>= 2.3.4, <= 4.5`
+
+Wildcards In Comparisons
+
+The `x`, `X`, and `*` characters can be used as a wildcard character. This works
+for all comparison operators. When used on the `=` operator it falls
+back to the pack level comparison (see tilde below). For example,
+
+    * `1.2.x` is equivalent to `>= 1.2.0, < 1.3.0`
+    * `>= 1.2.x` is equivalent to `>= 1.2.0`
+    * `<= 2.x` is equivalent to `<= 3`
+    * `*` is equivalent to `>= 0.0.0`
+
+Tilde Range Comparisons (Patch)
+
+The tilde (`~`) comparison operator is for patch level ranges when a minor
+version is specified and major level changes when the minor number is missing.
+For example,
+
+    * `~1.2.3` is equivalent to `>= 1.2.3, < 1.3.0`
+    * `~1` is equivalent to `>= 1, < 2`
+    * `~2.3` is equivalent to `>= 2.3, < 2.4`
+    * `~1.2.x` is equivalent to `>= 1.2.0, < 1.3.0`
+    * `~1.x` is equivalent to `>= 1, < 2`
+
+Caret Range Comparisons (Major)
+
+The caret (`^`) comparison operator is for major level changes. This is useful
+when comparisons of API versions as a major change is API breaking. For example,
+
+    * `^1.2.3` is equivalent to `>= 1.2.3, < 2.0.0`
+    * `^1.2.x` is equivalent to `>= 1.2.0, < 2.0.0`
+    * `^2.3` is equivalent to `>= 2.3, < 3`
+    * `^2.x` is equivalent to `>= 2.0.0, < 3`
+*/
+package semver

vendor/github.com/Masterminds/semver/version.go

@@ -0,0 +1,421 @@
+package semver
+
+import (
+	"bytes"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// The compiled version of the regex created at init() is cached here so it
+// only needs to be created once.
+var versionRegex *regexp.Regexp
+var validPrereleaseRegex *regexp.Regexp
+
+var (
+	// ErrInvalidSemVer is returned a version is found to be invalid when
+	// being parsed.
+	ErrInvalidSemVer = errors.New("Invalid Semantic Version")
+
+	// ErrInvalidMetadata is returned when the metadata is an invalid format
+	ErrInvalidMetadata = errors.New("Invalid Metadata string")
+
+	// ErrInvalidPrerelease is returned when the pre-release is an invalid format
+	ErrInvalidPrerelease = errors.New("Invalid Prerelease string")
+)
+
+// SemVerRegex is the regular expression used to parse a semantic version.
+const SemVerRegex string = `v?([0-9]+)(\.[0-9]+)?(\.[0-9]+)?` +
+	`(-([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?` +
+	`(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?`
+
+// ValidPrerelease is the regular expression which validates
+// both prerelease and metadata values.
+const ValidPrerelease string = `^([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*)`
+
+// Version represents a single semantic version.
+type Version struct {
+	major, minor, patch int64
+	pre                 string
+	metadata            string
+	original            string
+}
+
+func init() {
+	versionRegex = regexp.MustCompile("^" + SemVerRegex + "$")
+	validPrereleaseRegex = regexp.MustCompile(ValidPrerelease)
+}
+
+// NewVersion parses a given version and returns an instance of Version or
+// an error if unable to parse the version.
+func NewVersion(v string) (*Version, error) {
+	m := versionRegex.FindStringSubmatch(v)
+	if m == nil {
+		return nil, ErrInvalidSemVer
+	}
+
+	sv := &Version{
+		metadata: m[8],
+		pre:      m[5],
+		original: v,
+	}
+
+	var temp int64
+	temp, err := strconv.ParseInt(m[1], 10, 64)
+	if err != nil {
+		return nil, fmt.Errorf("Error parsing version segment: %s", err)
+	}
+	sv.major = temp
+
+	if m[2] != "" {
+		temp, err = strconv.ParseInt(strings.TrimPrefix(m[2], "."), 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("Error parsing version segment: %s", err)
+		}
+		sv.minor = temp
+	} else {
+		sv.minor = 0
+	}
+
+	if m[3] != "" {
+		temp, err = strconv.ParseInt(strings.TrimPrefix(m[3], "."), 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf("Error parsing version segment: %s", err)
+		}
+		sv.patch = temp
+	} else {
+		sv.patch = 0
+	}
+
+	return sv, nil
+}
+
+// MustParse parses a given version and panics on error.
+func MustParse(v string) *Version {
+	sv, err := NewVersion(v)
+	if err != nil {
+		panic(err)
+	}
+	return sv
+}
+
+// String converts a Version object to a string.
+// Note, if the original version contained a leading v this version will not.
+// See the Original() method to retrieve the original value. Semantic Versions
+// don't contain a leading v per the spec. Instead it's optional on
+// impelementation.
+func (v *Version) String() string {
+	var buf bytes.Buffer
+
+	fmt.Fprintf(&buf, "%d.%d.%d", v.major, v.minor, v.patch)
+	if v.pre != "" {
+		fmt.Fprintf(&buf, "-%s", v.pre)
+	}
+	if v.metadata != "" {
+		fmt.Fprintf(&buf, "+%s", v.metadata)
+	}
+
+	return buf.String()
+}
+
+// Original returns the original value passed in to be parsed.
+func (v *Version) Original() string {
+	return v.original
+}
+
+// Major returns the major version.
+func (v *Version) Major() int64 {
+	return v.major
+}
+
+// Minor returns the minor version.
+func (v *Version) Minor() int64 {
+	return v.minor
+}
+
+// Patch returns the patch version.
+func (v *Version) Patch() int64 {
+	return v.patch
+}
+
+// Prerelease returns the pre-release version.
+func (v *Version) Prerelease() string {
+	return v.pre
+}
+
+// Metadata returns the metadata on the version.
+func (v *Version) Metadata() string {
+	return v.metadata
+}
+
+// originalVPrefix returns the original 'v' prefix if any.
+func (v *Version) originalVPrefix() string {
+
+	// Note, only lowercase v is supported as a prefix by the parser.
+	if v.original != "" && v.original[:1] == "v" {
+		return v.original[:1]
+	}
+	return ""
+}
+
+// IncPatch produces the next patch version.
+// If the current version does not have prerelease/metadata information,
+// it unsets metadata and prerelease values, increments patch number.
+// If the current version has any of prerelease or metadata information,
+// it unsets both values and keeps curent patch value
+func (v Version) IncPatch() Version {
+	vNext := v
+	// according to http://semver.org/#spec-item-9
+	// Pre-release versions have a lower precedence than the associated normal version.
+	// according to http://semver.org/#spec-item-10
+	// Build metadata SHOULD be ignored when determining version precedence.
+	if v.pre != "" {
+		vNext.metadata = ""
+		vNext.pre = ""
+	} else {
+		vNext.metadata = ""
+		vNext.pre = ""
+		vNext.patch = v.patch + 1
+	}
+	vNext.original = v.originalVPrefix() + "" + vNext.String()
+	return vNext
+}
+
+// IncMinor produces the next minor version.
+// Sets patch to 0.
+// Increments minor number.
+// Unsets metadata.
+// Unsets prerelease status.
+func (v Version) IncMinor() Version {
+	vNext := v
+	vNext.metadata = ""
+	vNext.pre = ""
+	vNext.patch = 0
+	vNext.minor = v.minor + 1
+	vNext.original = v.originalVPrefix() + "" + vNext.String()
+	return vNext
+}
+
+// IncMajor produces the next major version.
+// Sets patch to 0.
+// Sets minor to 0.
+// Increments major number.
+// Unsets metadata.
+// Unsets prerelease status.
+func (v Version) IncMajor() Version {
+	vNext := v
+	vNext.metadata = ""
+	vNext.pre = ""
+	vNext.patch = 0
+	vNext.minor = 0
+	vNext.major = v.major + 1
+	vNext.original = v.originalVPrefix() + "" + vNext.String()
+	return vNext
+}
+
+// SetPrerelease defines the prerelease value.
+// Value must not include the required 'hypen' prefix.
+func (v Version) SetPrerelease(prerelease string) (Version, error) {
+	vNext := v
+	if len(prerelease) > 0 && !validPrereleaseRegex.MatchString(prerelease) {
+		return vNext, ErrInvalidPrerelease
+	}
+	vNext.pre = prerelease
+	vNext.original = v.originalVPrefix() + "" + vNext.String()
+	return vNext, nil
+}
+
+// SetMetadata defines metadata value.
+// Value must not include the required 'plus' prefix.
+func (v Version) SetMetadata(metadata string) (Version, error) {
+	vNext := v
+	if len(metadata) > 0 && !validPrereleaseRegex.MatchString(metadata) {
+		return vNext, ErrInvalidMetadata
+	}
+	vNext.metadata = metadata
+	vNext.original = v.originalVPrefix() + "" + vNext.String()
+	return vNext, nil
+}
+
+// LessThan tests if one version is less than another one.
+func (v *Version) LessThan(o *Version) bool {
+	return v.Compare(o) < 0
+}
+
+// GreaterThan tests if one version is greater than another one.
+func (v *Version) GreaterThan(o *Version) bool {
+	return v.Compare(o) > 0
+}
+
+// Equal tests if two versions are equal to each other.
+// Note, versions can be equal with different metadata since metadata
+// is not considered part of the comparable version.
+func (v *Version) Equal(o *Version) bool {
+	return v.Compare(o) == 0
+}
+
+// Compare compares this version to another one. It returns -1, 0, or 1 if
+// the version smaller, equal, or larger than the other version.
+//
+// Versions are compared by X.Y.Z. Build metadata is ignored. Prerelease is
+// lower than the version without a prerelease.
+func (v *Version) Compare(o *Version) int {
+	// Compare the major, minor, and patch version for differences. If a
+	// difference is found return the comparison.
+	if d := compareSegment(v.Major(), o.Major()); d != 0 {
+		return d
+	}
+	if d := compareSegment(v.Minor(), o.Minor()); d != 0 {
+		return d
+	}
+	if d := compareSegment(v.Patch(), o.Patch()); d != 0 {
+		return d
+	}
+
+	// At this point the major, minor, and patch versions are the same.
+	ps := v.pre
+	po := o.Prerelease()
+
+	if ps == "" && po == "" {
+		return 0
+	}
+	if ps == "" {
+		return 1
+	}
+	if po == "" {
+		return -1
+	}
+
+	return comparePrerelease(ps, po)
+}
+
+// UnmarshalJSON implements JSON.Unmarshaler interface.
+func (v *Version) UnmarshalJSON(b []byte) error {
+	var s string
+	if err := json.Unmarshal(b, &s); err != nil {
+		return err
+	}
+	temp, err := NewVersion(s)
+	if err != nil {
+		return err
+	}
+	v.major = temp.major
+	v.minor = temp.minor
+	v.patch = temp.patch
+	v.pre = temp.pre
+	v.metadata = temp.metadata
+	v.original = temp.original
+	temp = nil
+	return nil
+}
+
+// MarshalJSON implements JSON.Marshaler interface.
+func (v *Version) MarshalJSON() ([]byte, error) {
+	return json.Marshal(v.String())
+}
+
+func compareSegment(v, o int64) int {
+	if v < o {
+		return -1
+	}
+	if v > o {
+		return 1
+	}
+
+	return 0
+}
+
+func comparePrerelease(v, o string) int {
+
+	// split the prelease versions by their part. The separator, per the spec,
+	// is a .
+	sparts := strings.Split(v, ".")
+	oparts := strings.Split(o, ".")
+
+	// Find the longer length of the parts to know how many loop iterations to
+	// go through.
+	slen := len(sparts)
+	olen := len(oparts)
+
+	l := slen
+	if olen > slen {
+		l = olen
+	}
+
+	// Iterate over each part of the prereleases to compare the differences.
+	for i := 0; i < l; i++ {
+		// Since the lentgh of the parts can be different we need to create
+		// a placeholder. This is to avoid out of bounds issues.
+		stemp := ""
+		if i < slen {
+			stemp = sparts[i]
+		}
+
+		otemp := ""
+		if i < olen {
+			otemp = oparts[i]
+		}
+
+		d := comparePrePart(stemp, otemp)
+		if d != 0 {
+			return d
+		}
+	}
+
+	// Reaching here means two versions are of equal value but have different
+	// metadata (the part following a +). They are not identical in string form
+	// but the version comparison finds them to be equal.
+	return 0
+}
+
+func comparePrePart(s, o string) int {
+	// Fastpath if they are equal
+	if s == o {
+		return 0
+	}
+
+	// When s or o are empty we can use the other in an attempt to determine
+	// the response.
+	if s == "" {
+		if o != "" {
+			return -1
+		}
+		return 1
+	}
+
+	if o == "" {
+		if s != "" {
+			return 1
+		}
+		return -1
+	}
+
+	// When comparing strings "99" is greater than "103". To handle
+	// cases like this we need to detect numbers and compare them.
+
+	oi, n1 := strconv.ParseInt(o, 10, 64)
+	si, n2 := strconv.ParseInt(s, 10, 64)
+
+	// The case where both are strings compare the strings
+	if n1 != nil && n2 != nil {
+		if s > o {
+			return 1
+		}
+		return -1
+	} else if n1 != nil {
+		// o is a string and s is a number
+		return -1
+	} else if n2 != nil {
+		// s is a string and o is a number
+		return 1
+	}
+	// Both are numbers
+	if si > oi {
+		return 1
+	}
+	return -1
+
+}

vendor/github.com/Masterminds/sprig/.gitignore

@@ -0,0 +1,2 @@
+vendor/
+/.glide

vendor/github.com/Masterminds/sprig/.travis.yml

@@ -0,0 +1,23 @@
+language: go
+
+go:
+  - 1.9.x
+  - 1.10.x
+  - tip
+
+# Setting sudo access to false will let Travis CI use containers rather than
+# VMs to run the tests. For more details see:
+# - http://docs.travis-ci.com/user/workers/container-based-infrastructure/
+# - http://docs.travis-ci.com/user/workers/standard-infrastructure/
+sudo: false
+
+script:
+  - make setup test
+
+notifications:
+  webhooks:
+    urls:
+      - https://webhooks.gitter.im/e/06e3328629952dabe3e0
+    on_success: change  # options: [always|never|change] default: always
+    on_failure: always  # options: [always|never|change] default: always
+    on_start: never     # options: [always|never|change] default: always

vendor/github.com/Masterminds/sprig/CHANGELOG.md

@@ -0,0 +1,153 @@
+# Changelog
+
+## Release 2.15.0 (2018-04-02)
+
+### Added
+
+- #68 and #69: Add json helpers to docs (thanks @arunvelsriram)
+- #66: Add ternary function (thanks @binoculars)
+- #67: Allow keys function to take multiple dicts (thanks @binoculars)
+- #89: Added sha1sum to crypto function (thanks @benkeil)
+- #81: Allow customizing Root CA that used by genSignedCert (thanks @chenzhiwei)
+- #92: Add travis testing for go 1.10
+- #93: Adding appveyor config for windows testing
+
+### Changed
+
+- #90: Updating to more recent dependencies
+- #73: replace satori/go.uuid with google/uuid (thanks @petterw)
+
+### Fixed
+
+- #76: Fixed documentation typos (thanks @Thiht)
+- Fixed rounding issue on the `ago` function. Note, the removes support for Go 1.8 and older
+
+## Release 2.14.1 (2017-12-01)
+
+### Fixed
+
+- #60: Fix typo in function name documentation (thanks @neil-ca-moore)
+- #61: Removing line with {{ due to blocking github pages genertion
+- #64: Update the list functions to handle int, string, and other slices for compatibility
+
+## Release 2.14.0 (2017-10-06)
+
+This new version of Sprig adds a set of functions for generating and working with SSL certificates.
+
+- `genCA` generates an SSL Certificate Authority
+- `genSelfSignedCert` generates an SSL self-signed certificate
+- `genSignedCert` generates an SSL certificate and key based on a given CA
+
+## Release 2.13.0 (2017-09-18)
+
+This release adds new functions, including:
+
+- `regexMatch`, `regexFindAll`, `regexFind`, `regexReplaceAll`, `regexReplaceAllLiteral`, and `regexSplit` to work with regular expressions
+- `floor`, `ceil`, and `round` math functions
+- `toDate` converts a string to a date
+- `nindent` is just like `indent` but also prepends a new line
+- `ago` returns the time from `time.Now`
+
+### Added
+
+- #40: Added basic regex functionality (thanks @alanquillin)
+- #41: Added ceil floor and round functions (thanks @alanquillin)
+- #48: Added toDate function (thanks @andreynering)
+- #50: Added nindent function (thanks @binoculars)
+- #46: Added ago function (thanks @slayer)
+
+### Changed
+
+- #51: Updated godocs to include new string functions (thanks @curtisallen)
+- #49: Added ability to merge multiple dicts (thanks @binoculars)
+
+## Release 2.12.0 (2017-05-17)
+
+- `snakecase`, `camelcase`, and `shuffle` are three new string functions
+- `fail` allows you to bail out of a template render when conditions are not met
+
+## Release 2.11.0 (2017-05-02)
+
+- Added `toJson` and `toPrettyJson`
+- Added `merge`
+- Refactored documentation
+
+## Release 2.10.0 (2017-03-15)
+
+- Added `semver` and `semverCompare` for Semantic Versions
+- `list` replaces `tuple`
+- Fixed issue with `join`
+- Added `first`, `last`, `intial`, `rest`, `prepend`, `append`, `toString`, `toStrings`, `sortAlpha`, `reverse`, `coalesce`, `pluck`, `pick`, `compact`, `keys`, `omit`, `uniq`, `has`, `without`
+
+## Release 2.9.0 (2017-02-23)
+
+- Added `splitList` to split a list
+- Added crypto functions of `genPrivateKey` and `derivePassword`
+
+## Release 2.8.0 (2016-12-21)
+
+- Added access to several path functions (`base`, `dir`, `clean`, `ext`, and `abs`)
+- Added functions for _mutating_ dictionaries (`set`, `unset`, `hasKey`)
+
+## Release 2.7.0 (2016-12-01)
+
+- Added `sha256sum` to generate a hash of an input
+- Added functions to convert a numeric or string to `int`, `int64`, `float64`
+
+## Release 2.6.0 (2016-10-03)
+
+- Added a `uuidv4` template function for generating UUIDs inside of a template.
+
+## Release 2.5.0 (2016-08-19)
+
+- New `trimSuffix`, `trimPrefix`, `hasSuffix`, and `hasPrefix` functions
+- New aliases have been added for a few functions that didn't follow the naming conventions (`trimAll` and `abbrevBoth`)
+- `trimall` and `abbrevboth` (notice the case) are deprecated and will be removed in 3.0.0
+
+## Release 2.4.0 (2016-08-16)
+
+- Adds two functions: `until` and `untilStep`
+
+## Release 2.3.0 (2016-06-21)
+
+- cat: Concatenate strings with whitespace separators.
+- replace: Replace parts of a string: `replace " " "-" "Me First"` renders "Me-First"
+- plural: Format plurals: `len "foo" | plural "one foo" "many foos"` renders "many foos"
+- indent: Indent blocks of text in a way that is sensitive to "\n" characters.
+
+## Release 2.2.0 (2016-04-21)
+
+- Added a `genPrivateKey` function (Thanks @bacongobbler)
+
+## Release 2.1.0 (2016-03-30)
+
+- `default` now prints the default value when it does not receive a value down the pipeline. It is much safer now to do `{{.Foo | default "bar"}}`.
+- Added accessors for "hermetic" functions. These return only functions that, when given the same input, produce the same output.
+
+## Release 2.0.0 (2016-03-29)
+
+Because we switched from `int` to `int64` as the return value for all integer math functions, the library's major version number has been incremented.
+
+- `min` complements `max` (formerly `biggest`)
+- `empty` indicates that a value is the empty value for its type
+- `tuple` creates a tuple inside of a template: `{{$t := tuple "a", "b" "c"}}`
+- `dict` creates a dictionary inside of a template `{{$d := dict "key1" "val1" "key2" "val2"}}` 
+- Date formatters have been added for HTML dates (as used in `date` input fields)
+- Integer math functions can convert from a number of types, including `string` (via `strconv.ParseInt`).
+
+## Release 1.2.0 (2016-02-01)
+
+- Added quote and squote
+- Added b32enc and b32dec
+- add now takes varargs
+- biggest now takes varargs
+
+## Release 1.1.0 (2015-12-29)
+
+- Added #4: Added contains function. strings.Contains, but with the arguments
+  switched to simplify common pipelines. (thanks krancour)
+- Added Travis-CI testing support
+
+## Release 1.0.0 (2015-12-23)
+
+- Initial release

vendor/github.com/Masterminds/sprig/LICENSE.txt

@@ -0,0 +1,20 @@
+Sprig
+Copyright (C) 2013 Masterminds
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

vendor/github.com/Masterminds/sprig/Makefile

@@ -0,0 +1,13 @@
+
+HAS_GLIDE := $(shell command -v glide;)
+
+.PHONY: test
+test:
+	go test -v .
+
+.PHONY: setup
+setup:
+ifndef HAS_GLIDE
+	go get -u github.com/Masterminds/glide
+endif
+	glide install

vendor/github.com/Masterminds/sprig/README.md

@@ -0,0 +1,81 @@
+# Sprig: Template functions for Go templates
+[![Stability: Sustained](https://masterminds.github.io/stability/sustained.svg)](https://masterminds.github.io/stability/sustained.html)
+[![Build Status](https://travis-ci.org/Masterminds/sprig.svg?branch=master)](https://travis-ci.org/Masterminds/sprig)
+
+The Go language comes with a [built-in template
+language](http://golang.org/pkg/text/template/), but not
+very many template functions. This library provides a group of commonly
+used template functions.
+
+It is inspired by the template functions found in
+[Twig](http://twig.sensiolabs.org/documentation) and also in various
+JavaScript libraries, such as [underscore.js](http://underscorejs.org/).
+
+## Usage
+
+Template developers can read the [Sprig function documentation](http://masterminds.github.io/sprig/) to
+learn about the >100 template functions available.
+
+For Go developers wishing to include Sprig as a library in their programs,
+API documentation is available [at GoDoc.org](http://godoc.org/github.com/Masterminds/sprig), but
+read on for standard usage.
+
+### Load the Sprig library
+
+To load the Sprig `FuncMap`:
+
+```go
+
+import (
+  "github.com/Masterminds/sprig"
+  "html/template"
+)
+
+// This example illustrates that the FuncMap *must* be set before the
+// templates themselves are loaded.
+tpl := template.Must(
+  template.New("base").Funcs(sprig.FuncMap()).ParseGlob("*.html")
+)
+
+
+```
+
+### Call the functions inside of templates
+
+By convention, all functions are lowercase. This seems to follow the Go
+idiom for template functions (as opposed to template methods, which are
+TitleCase).
+
+
+Example:
+
+```
+{{ "hello!" | upper | repeat 5 }}
+```
+
+Produces:
+
+```
+HELLO!HELLO!HELLO!HELLO!HELLO!
+```
+
+## Principles:
+
+The following principles were used in deciding on which functions to add, and
+determining how to implement them.
+
+- Template functions should be used to build layout. Therefore, the following
+  types of operations are within the domain of template functions:
+  - Formatting
+  - Layout
+  - Simple type conversions
+  - Utilities that assist in handling common formatting and layout needs (e.g. arithmetic)
+- Template functions should not return errors unless there is no way to print
+  a sensible value. For example, converting a string to an integer should not
+  produce an error if conversion fails. Instead, it should display a default
+  value that can be displayed.
+- Simple math is necessary for grid layouts, pagers, and so on. Complex math
+  (anything other than arithmetic) should be done outside of templates.
+- Template functions only deal with the data passed into them. They never retrieve
+  data from a source.
+- Finally, do not override core Go template functions.

vendor/github.com/Masterminds/sprig/appveyor.yml

@@ -0,0 +1,26 @@
+
+version: build-{build}.{branch}
+
+clone_folder: C:\gopath\src\github.com\Masterminds\sprig
+shallow_clone: true
+
+environment:
+  GOPATH: C:\gopath
+
+platform:
+  - x64
+
+install:
+  - go get -u github.com/Masterminds/glide
+  - set PATH=%GOPATH%\bin;%PATH%
+  - go version
+  - go env
+
+build_script:
+  - glide install
+  - go install ./...
+
+test_script:
+  - go test -v
+
+deploy: off

vendor/github.com/Masterminds/sprig/crypto.go

@@ -0,0 +1,430 @@
+package sprig
+
+import (
+	"bytes"
+	"crypto/dsa"
+	"crypto/ecdsa"
+	"crypto/elliptic"
+	"crypto/hmac"
+	"crypto/rand"
+	"crypto/rsa"
+	"crypto/sha1"
+	"crypto/sha256"
+	"crypto/x509"
+	"crypto/x509/pkix"
+	"encoding/asn1"
+	"encoding/base64"
+	"encoding/binary"
+	"encoding/hex"
+	"encoding/pem"
+	"errors"
+	"fmt"
+	"math/big"
+	"net"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/crypto/scrypt"
+)
+
+func sha256sum(input string) string {
+	hash := sha256.Sum256([]byte(input))
+	return hex.EncodeToString(hash[:])
+}
+
+func sha1sum(input string) string {
+	hash := sha1.Sum([]byte(input))
+	return hex.EncodeToString(hash[:])
+}
+
+// uuidv4 provides a safe and secure UUID v4 implementation
+func uuidv4() string {
+	return fmt.Sprintf("%s", uuid.New())
+}
+
+var master_password_seed = "com.lyndir.masterpassword"
+
+var password_type_templates = map[string][][]byte{
+	"maximum": {[]byte("anoxxxxxxxxxxxxxxxxx"), []byte("axxxxxxxxxxxxxxxxxno")},
+	"long": {[]byte("CvcvnoCvcvCvcv"), []byte("CvcvCvcvnoCvcv"), []byte("CvcvCvcvCvcvno"), []byte("CvccnoCvcvCvcv"), []byte("CvccCvcvnoCvcv"),
+		[]byte("CvccCvcvCvcvno"), []byte("CvcvnoCvccCvcv"), []byte("CvcvCvccnoCvcv"), []byte("CvcvCvccCvcvno"), []byte("CvcvnoCvcvCvcc"),
+		[]byte("CvcvCvcvnoCvcc"), []byte("CvcvCvcvCvccno"), []byte("CvccnoCvccCvcv"), []byte("CvccCvccnoCvcv"), []byte("CvccCvccCvcvno"),
+		[]byte("CvcvnoCvccCvcc"), []byte("CvcvCvccnoCvcc"), []byte("CvcvCvccCvccno"), []byte("CvccnoCvcvCvcc"), []byte("CvccCvcvnoCvcc"),
+		[]byte("CvccCvcvCvccno")},
+	"medium": {[]byte("CvcnoCvc"), []byte("CvcCvcno")},
+	"short":  {[]byte("Cvcn")},
+	"basic":  {[]byte("aaanaaan"), []byte("aannaaan"), []byte("aaannaaa")},
+	"pin":    {[]byte("nnnn")},
+}
+
+var template_characters = map[byte]string{
+	'V': "AEIOU",
+	'C': "BCDFGHJKLMNPQRSTVWXYZ",
+	'v': "aeiou",
+	'c': "bcdfghjklmnpqrstvwxyz",
+	'A': "AEIOUBCDFGHJKLMNPQRSTVWXYZ",
+	'a': "AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz",
+	'n': "0123456789",
+	'o': "@&%?,=[]_:-+*$#!'^~;()/.",
+	'x': "AEIOUaeiouBCDFGHJKLMNPQRSTVWXYZbcdfghjklmnpqrstvwxyz0123456789!@#$%^&*()",
+}
+
+func derivePassword(counter uint32, password_type, password, user, site string) string {
+	var templates = password_type_templates[password_type]
+	if templates == nil {
+		return fmt.Sprintf("cannot find password template %s", password_type)
+	}
+
+	var buffer bytes.Buffer
+	buffer.WriteString(master_password_seed)
+	binary.Write(&buffer, binary.BigEndian, uint32(len(user)))
+	buffer.WriteString(user)
+
+	salt := buffer.Bytes()
+	key, err := scrypt.Key([]byte(password), salt, 32768, 8, 2, 64)
+	if err != nil {
+		return fmt.Sprintf("failed to derive password: %s", err)
+	}
+
+	buffer.Truncate(len(master_password_seed))
+	binary.Write(&buffer, binary.BigEndian, uint32(len(site)))
+	buffer.WriteString(site)
+	binary.Write(&buffer, binary.BigEndian, counter)
+
+	var hmacv = hmac.New(sha256.New, key)
+	hmacv.Write(buffer.Bytes())
+	var seed = hmacv.Sum(nil)
+	var temp = templates[int(seed[0])%len(templates)]
+
+	buffer.Truncate(0)
+	for i, element := range temp {
+		pass_chars := template_characters[element]
+		pass_char := pass_chars[int(seed[i+1])%len(pass_chars)]
+		buffer.WriteByte(pass_char)
+	}
+
+	return buffer.String()
+}
+
+func generatePrivateKey(typ string) string {
+	var priv interface{}
+	var err error
+	switch typ {
+	case "", "rsa":
+		// good enough for government work
+		priv, err = rsa.GenerateKey(rand.Reader, 4096)
+	case "dsa":
+		key := new(dsa.PrivateKey)
+		// again, good enough for government work
+		if err = dsa.GenerateParameters(&key.Parameters, rand.Reader, dsa.L2048N256); err != nil {
+			return fmt.Sprintf("failed to generate dsa params: %s", err)
+		}
+		err = dsa.GenerateKey(key, rand.Reader)
+		priv = key
+	case "ecdsa":
+		// again, good enough for government work
+		priv, err = ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
+	default:
+		return "Unknown type " + typ
+	}
+	if err != nil {
+		return fmt.Sprintf("failed to generate private key: %s", err)
+	}
+
+	return string(pem.EncodeToMemory(pemBlockForKey(priv)))
+}
+
+type DSAKeyFormat struct {
+	Version       int
+	P, Q, G, Y, X *big.Int
+}
+
+func pemBlockForKey(priv interface{}) *pem.Block {
+	switch k := priv.(type) {
+	case *rsa.PrivateKey:
+		return &pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(k)}
+	case *dsa.PrivateKey:
+		val := DSAKeyFormat{
+			P: k.P, Q: k.Q, G: k.G,
+			Y: k.Y, X: k.X,
+		}
+		bytes, _ := asn1.Marshal(val)
+		return &pem.Block{Type: "DSA PRIVATE KEY", Bytes: bytes}
+	case *ecdsa.PrivateKey:
+		b, _ := x509.MarshalECPrivateKey(k)
+		return &pem.Block{Type: "EC PRIVATE KEY", Bytes: b}
+	default:
+		return nil
+	}
+}
+
+type certificate struct {
+	Cert string
+	Key  string
+}
+
+func buildCustomCertificate(b64cert string, b64key string) (certificate, error) {
+	crt := certificate{}
+
+	cert, err := base64.StdEncoding.DecodeString(b64cert)
+	if err != nil {
+		return crt, errors.New("unable to decode base64 certificate")
+	}
+
+	key, err := base64.StdEncoding.DecodeString(b64key)
+	if err != nil {
+		return crt, errors.New("unable to decode base64 private key")
+	}
+
+	decodedCert, _ := pem.Decode(cert)
+	if decodedCert == nil {
+		return crt, errors.New("unable to decode certificate")
+	}
+	_, err = x509.ParseCertificate(decodedCert.Bytes)
+	if err != nil {
+		return crt, fmt.Errorf(
+			"error parsing certificate: decodedCert.Bytes: %s",
+			err,
+		)
+	}
+
+	decodedKey, _ := pem.Decode(key)
+	if decodedKey == nil {
+		return crt, errors.New("unable to decode key")
+	}
+	_, err = x509.ParsePKCS1PrivateKey(decodedKey.Bytes)
+	if err != nil {
+		return crt, fmt.Errorf(
+			"error parsing prive key: decodedKey.Bytes: %s",
+			err,
+		)
+	}
+
+	crt.Cert = string(cert)
+	crt.Key = string(key)
+
+	return crt, nil
+}
+
+func generateCertificateAuthority(
+	cn string,
+	daysValid int,
+) (certificate, error) {
+	ca := certificate{}
+
+	template, err := getBaseCertTemplate(cn, nil, nil, daysValid)
+	if err != nil {
+		return ca, err
+	}
+	// Override KeyUsage and IsCA
+	template.KeyUsage = x509.KeyUsageKeyEncipherment |
+		x509.KeyUsageDigitalSignature |
+		x509.KeyUsageCertSign
+	template.IsCA = true
+
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return ca, fmt.Errorf("error generating rsa key: %s", err)
+	}
+
+	ca.Cert, ca.Key, err = getCertAndKey(template, priv, template, priv)
+	if err != nil {
+		return ca, err
+	}
+
+	return ca, nil
+}
+
+func generateSelfSignedCertificate(
+	cn string,
+	ips []interface{},
+	alternateDNS []interface{},
+	daysValid int,
+) (certificate, error) {
+	cert := certificate{}
+
+	template, err := getBaseCertTemplate(cn, ips, alternateDNS, daysValid)
+	if err != nil {
+		return cert, err
+	}
+
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return cert, fmt.Errorf("error generating rsa key: %s", err)
+	}
+
+	cert.Cert, cert.Key, err = getCertAndKey(template, priv, template, priv)
+	if err != nil {
+		return cert, err
+	}
+
+	return cert, nil
+}
+
+func generateSignedCertificate(
+	cn string,
+	ips []interface{},
+	alternateDNS []interface{},
+	daysValid int,
+	ca certificate,
+) (certificate, error) {
+	cert := certificate{}
+
+	decodedSignerCert, _ := pem.Decode([]byte(ca.Cert))
+	if decodedSignerCert == nil {
+		return cert, errors.New("unable to decode certificate")
+	}
+	signerCert, err := x509.ParseCertificate(decodedSignerCert.Bytes)
+	if err != nil {
+		return cert, fmt.Errorf(
+			"error parsing certificate: decodedSignerCert.Bytes: %s",
+			err,
+		)
+	}
+	decodedSignerKey, _ := pem.Decode([]byte(ca.Key))
+	if decodedSignerKey == nil {
+		return cert, errors.New("unable to decode key")
+	}
+	signerKey, err := x509.ParsePKCS1PrivateKey(decodedSignerKey.Bytes)
+	if err != nil {
+		return cert, fmt.Errorf(
+			"error parsing prive key: decodedSignerKey.Bytes: %s",
+			err,
+		)
+	}
+
+	template, err := getBaseCertTemplate(cn, ips, alternateDNS, daysValid)
+	if err != nil {
+		return cert, err
+	}
+
+	priv, err := rsa.GenerateKey(rand.Reader, 2048)
+	if err != nil {
+		return cert, fmt.Errorf("error generating rsa key: %s", err)
+	}
+
+	cert.Cert, cert.Key, err = getCertAndKey(
+		template,
+		priv,
+		signerCert,
+		signerKey,
+	)
+	if err != nil {
+		return cert, err
+	}
+
+	return cert, nil
+}
+
+func getCertAndKey(
+	template *x509.Certificate,
+	signeeKey *rsa.PrivateKey,
+	parent *x509.Certificate,
+	signingKey *rsa.PrivateKey,
+) (string, string, error) {
+	derBytes, err := x509.CreateCertificate(
+		rand.Reader,
+		template,
+		parent,
+		&signeeKey.PublicKey,
+		signingKey,
+	)
+	if err != nil {
+		return "", "", fmt.Errorf("error creating certificate: %s", err)
+	}
+
+	certBuffer := bytes.Buffer{}
+	if err := pem.Encode(
+		&certBuffer,
+		&pem.Block{Type: "CERTIFICATE", Bytes: derBytes},
+	); err != nil {
+		return "", "", fmt.Errorf("error pem-encoding certificate: %s", err)
+	}
+
+	keyBuffer := bytes.Buffer{}
+	if err := pem.Encode(
+		&keyBuffer,
+		&pem.Block{
+			Type:  "RSA PRIVATE KEY",
+			Bytes: x509.MarshalPKCS1PrivateKey(signeeKey),
+		},
+	); err != nil {
+		return "", "", fmt.Errorf("error pem-encoding key: %s", err)
+	}
+
+	return string(certBuffer.Bytes()), string(keyBuffer.Bytes()), nil
+}
+
+func getBaseCertTemplate(
+	cn string,
+	ips []interface{},
+	alternateDNS []interface{},
+	daysValid int,
+) (*x509.Certificate, error) {
+	ipAddresses, err := getNetIPs(ips)
+	if err != nil {
+		return nil, err
+	}
+	dnsNames, err := getAlternateDNSStrs(alternateDNS)
+	if err != nil {
+		return nil, err
+	}
+	return &x509.Certificate{
+		SerialNumber: big.NewInt(1),
+		Subject: pkix.Name{
+			CommonName: cn,
+		},
+		IPAddresses: ipAddresses,
+		DNSNames:    dnsNames,
+		NotBefore:   time.Now(),
+		NotAfter:    time.Now().Add(time.Hour * 24 * time.Duration(daysValid)),
+		KeyUsage:    x509.KeyUsageKeyEncipherment | x509.KeyUsageDigitalSignature,
+		ExtKeyUsage: []x509.ExtKeyUsage{
+			x509.ExtKeyUsageServerAuth,
+			x509.ExtKeyUsageClientAuth,
+		},
+		BasicConstraintsValid: true,
+	}, nil
+}
+
+func getNetIPs(ips []interface{}) ([]net.IP, error) {
+	if ips == nil {
+		return []net.IP{}, nil
+	}
+	var ipStr string
+	var ok bool
+	var netIP net.IP
+	netIPs := make([]net.IP, len(ips))
+	for i, ip := range ips {
+		ipStr, ok = ip.(string)
+		if !ok {
+			return nil, fmt.Errorf("error parsing ip: %v is not a string", ip)
+		}
+		netIP = net.ParseIP(ipStr)
+		if netIP == nil {
+			return nil, fmt.Errorf("error parsing ip: %s", ipStr)
+		}
+		netIPs[i] = netIP
+	}
+	return netIPs, nil
+}
+
+func getAlternateDNSStrs(alternateDNS []interface{}) ([]string, error) {
+	if alternateDNS == nil {
+		return []string{}, nil
+	}
+	var dnsStr string
+	var ok bool
+	alternateDNSStrs := make([]string, len(alternateDNS))
+	for i, dns := range alternateDNS {
+		dnsStr, ok = dns.(string)
+		if !ok {
+			return nil, fmt.Errorf(
+				"error processing alternate dns name: %v is not a string",
+				dns,
+			)
+		}
+		alternateDNSStrs[i] = dnsStr
+	}
+	return alternateDNSStrs, nil
+}

vendor/github.com/Masterminds/sprig/date.go

@@ -0,0 +1,76 @@
+package sprig
+
+import (
+	"time"
+)
+
+// Given a format and a date, format the date string.
+//
+// Date can be a `time.Time` or an `int, int32, int64`.
+// In the later case, it is treated as seconds since UNIX
+// epoch.
+func date(fmt string, date interface{}) string {
+	return dateInZone(fmt, date, "Local")
+}
+
+func htmlDate(date interface{}) string {
+	return dateInZone("2006-01-02", date, "Local")
+}
+
+func htmlDateInZone(date interface{}, zone string) string {
+	return dateInZone("2006-01-02", date, zone)
+}
+
+func dateInZone(fmt string, date interface{}, zone string) string {
+	var t time.Time
+	switch date := date.(type) {
+	default:
+		t = time.Now()
+	case time.Time:
+		t = date
+	case int64:
+		t = time.Unix(date, 0)
+	case int:
+		t = time.Unix(int64(date), 0)
+	case int32:
+		t = time.Unix(int64(date), 0)
+	}
+
+	loc, err := time.LoadLocation(zone)
+	if err != nil {
+		loc, _ = time.LoadLocation("UTC")
+	}
+
+	return t.In(loc).Format(fmt)
+}
+
+func dateModify(fmt string, date time.Time) time.Time {
+	d, err := time.ParseDuration(fmt)
+	if err != nil {
+		return date
+	}
+	return date.Add(d)
+}
+
+func dateAgo(date interface{}) string {
+	var t time.Time
+
+	switch date := date.(type) {
+	default:
+		t = time.Now()
+	case time.Time:
+		t = date
+	case int64:
+		t = time.Unix(date, 0)
+	case int:
+		t = time.Unix(int64(date), 0)
+	}
+	// Drop resolution to seconds
+	duration := time.Since(t).Round(time.Second)
+	return duration.String()
+}
+
+func toDate(fmt, str string) time.Time {
+	t, _ := time.ParseInLocation(fmt, str, time.Local)
+	return t
+}