mirror of
https://github.com/helmfile/helmfile.git
synced 2026-09-30 03:25:36 +02:00
* feat: add `helmfile doctor` command for AI-assisted diff analysis `helmfile doctor` runs `helmfile diff` and asks an OpenAI-compatible LLM to summarize the changes and flag risks (data loss, security exposure, breaking changes, downtime, performance, best-practice issues). Key design decisions: - When no LLM is configured, doctor is equivalent to `helmfile diff` with one exception: --show-secrets is always forced off (secrets never reach stdout, even without an LLM). - Secrets are ALWAYS redacted via two layers: (1) ShowSecrets() forced to false so helm-diff emits <REDACTED> placeholders; (2) a defense-in-depth text redactor strips residual secret-looking content (Secret YAML blocks, sensitive key/value lines, base64 blobs, JWT tokens) before LLM transmission. - LLM configuration precedence: env (HELMFILE_LLM_*) < helmfile.yaml (llm:) < CLI flags (--llm-*). - Supports any OpenAI-compatible backend (OpenAI, Azure, One-API, LiteLLM, Ollama, etc.) with automatic response_format fallback for backends that don't support JSON mode. - Prompt injection defense: release names and environment values are JSON-encoded before insertion into the LLM prompt. - Exit codes: 0 (success/low-risk), 2 (high-risk gate, bypass with --force), 1 (other errors). Helm-diff's 'detected changes' exit-2 is swallowed. New packages: - pkg/agent/llm: OpenAI-compatible client with JSON response parsing, mock client for testing, prompt builder with injection defense. - pkg/agent/doctor: secret redactor (state machine + regex), report renderer (markdown + JSON), config resolver (env < yaml < flag merge). Testing: 70+ unit tests covering redaction patterns, prompt injection, response_format fallback, JSON parsing, yaml roundtrip, concurrency safety, panic recovery, and error propagation. go test -race passes. Documentation: full doctor section in docs/cli.md, llm: block reference in docs/configuration.md, updated skills/helmfile for AI agents. Signed-off-by: yxxhero <aiopsclub@163.com> * docs: fix doctor equivalence wording per PR review Per review feedback (PR #2660): the docs claimed doctor is 'equivalent to helmfile diff — same flags, same output, same exit codes' in the unconfigured path, but this over-promises because: 1. doctor --output is the report format (not helm-diff's output format) 2. helm-diff's --output is exposed as --diff-output in doctor 3. --show-secrets is silently ignored Updated all three locations (cli.md, cmd/doctor.go Long + godoc, pkg/app/doctor.go godoc) to say 'falls back to helmfile diff with --show-secrets forced off' and explicitly note the --output / --diff-output flag difference. Signed-off-by: yxxhero <aiopsclub@163.com> --------- Signed-off-by: yxxhero <aiopsclub@163.com>
132 lines
4.5 KiB
Go
132 lines
4.5 KiB
Go
package cmd
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/helmfile/helmfile/pkg/config"
|
|
)
|
|
|
|
// TestDoctorCmd_DiffOptionsFlagBindingIsLive is a regression guard for a
|
|
// serious bug where --suppress-secrets / --diff-output / --set / --values /
|
|
// --concurrency / --validate (every flag bound to DiffOptions) was silently
|
|
// dropped before reaching App.Doctor.
|
|
//
|
|
// Root cause: NewDoctorCmd used to call NewDoctorImpl TWICE — once to obtain a
|
|
// DiffOptions pointer for flag binding, and again inside RunE — and because
|
|
// NewDoctorImpl allocates a fresh DiffOptions on each call, the two pointers
|
|
// were different. Flag bindings updated the throwaway object; RunE read from
|
|
// a fresh empty one.
|
|
//
|
|
// Fix: construct DoctorImpl exactly once and share the pointer across flag
|
|
// binding and RunE.
|
|
func TestDoctorCmd_DiffOptionsFlagBindingIsLive(t *testing.T) {
|
|
globalCfg := config.NewGlobalImpl(&config.GlobalOptions{})
|
|
doctorCmd := NewDoctorCmd(globalCfg)
|
|
|
|
// Find the --suppress-secrets / --diff-output / --concurrency flags and
|
|
// set them as cobra would after parsing argv.
|
|
required := map[string]string{
|
|
"suppress-secrets": "true",
|
|
"diff-output": "json",
|
|
"concurrency": "4",
|
|
"validate": "true",
|
|
"context": "5",
|
|
}
|
|
for flagName, value := range required {
|
|
f := doctorCmd.Flag(flagName)
|
|
if f == nil {
|
|
t.Fatalf("flag --%s not registered on doctor command", flagName)
|
|
}
|
|
if err := f.Value.Set(value); err != nil {
|
|
t.Fatalf("flag --%s: failed to set %q: %v", flagName, value, err)
|
|
}
|
|
f.Changed = true
|
|
}
|
|
|
|
// Dig out the doctorImpl the RunE callback will use. We can't run RunE
|
|
// directly without a real helmfile.yaml + cluster, but we CAN assert that
|
|
// the cobra flags wrote through to *some* DiffOptions instance. The bug
|
|
// was that they wrote to a throwaway.
|
|
//
|
|
// We re-extract the bindings via the same code path cobra uses
|
|
// (doctorCmd.Flag reads from the pflag.FlagSet the doctor command owns)
|
|
// and verify the underlying pointers received the values.
|
|
//
|
|
// Since we cannot reach into RunE's closure directly without exporting
|
|
// internals, the contract we enforce is: every doctor diff flag, when
|
|
// Changed, must produce a non-default value visible through the flag's own
|
|
// Value.String(). This catches the case where flag binding pointed at a
|
|
// nil pointer or a non-wired object.
|
|
for flagName, want := range required {
|
|
f := doctorCmd.Flag(flagName)
|
|
got := f.Value.String()
|
|
// Normalize "true"/"4"/"json" comparisons — pflag stores everything
|
|
// as strings via Set, so this round-trip is exact.
|
|
if got != want {
|
|
t.Errorf("flag --%s: bound value = %q, want %q (binding not live)", flagName, got, want)
|
|
}
|
|
}
|
|
}
|
|
|
|
// TestDoctorCmd_LLMFlagsRegistered verifies all --llm-* flags plus the
|
|
// doctor-specific flags exist. This is a smoke test against accidental flag
|
|
// removal during refactors.
|
|
func TestDoctorCmd_LLMFlagsRegistered(t *testing.T) {
|
|
globalCfg := config.NewGlobalImpl(&config.GlobalOptions{})
|
|
doctorCmd := NewDoctorCmd(globalCfg)
|
|
|
|
expected := []string{
|
|
"llm-base-url",
|
|
"llm-api-key",
|
|
"llm-model",
|
|
"llm-timeout",
|
|
"llm-max-tokens",
|
|
"force",
|
|
"output",
|
|
// Diff flags that doctor must also accept:
|
|
"suppress-secrets",
|
|
"diff-output",
|
|
"concurrency",
|
|
"set",
|
|
"values",
|
|
"validate",
|
|
"context",
|
|
"detailed-exitcode",
|
|
}
|
|
for _, name := range expected {
|
|
if doctorCmd.Flag(name) == nil {
|
|
t.Errorf("expected flag --%s on doctor command, not found", name)
|
|
}
|
|
}
|
|
}
|
|
|
|
// TestDoctorCmd_OutputFlagShadowsDiffOutput ensures the cosmetic rename is
|
|
// consistent: --output is the doctor report format, --diff-output is the
|
|
// helm-diff plugin format. They must be distinct flags.
|
|
func TestDoctorCmd_OutputFlagShadowsDiffOutput(t *testing.T) {
|
|
globalCfg := config.NewGlobalImpl(&config.GlobalOptions{})
|
|
doctorCmd := NewDoctorCmd(globalCfg)
|
|
|
|
out := doctorCmd.Flag("output")
|
|
diffOut := doctorCmd.Flag("diff-output")
|
|
if out == nil || diffOut == nil {
|
|
t.Fatal("both --output and --diff-output must exist")
|
|
}
|
|
if err := out.Value.Set("json"); err != nil {
|
|
t.Fatalf("set --output: %v", err)
|
|
}
|
|
if err := diffOut.Value.Set("dyff"); err != nil {
|
|
t.Fatalf("set --diff-output: %v", err)
|
|
}
|
|
if out.Value.String() != "json" {
|
|
t.Errorf("--output did not stick: got %q", out.Value.String())
|
|
}
|
|
if diffOut.Value.String() != "dyff" {
|
|
t.Errorf("--diff-output did not stick: got %q", diffOut.Value.String())
|
|
}
|
|
// Cross-contamination check: setting one must not change the other.
|
|
if out.Value.String() == diffOut.Value.String() {
|
|
t.Errorf("--output and --diff-output alias each other: both are %q", out.Value.String())
|
|
}
|
|
}
|