mirror of
https://github.com/helmfile/helmfile.git
synced 2026-09-30 21:30:36 +02:00
yxxhero
9b943adc9e
* feat: add `helmfile doctor` command for AI-assisted diff analysis `helmfile doctor` runs `helmfile diff` and asks an OpenAI-compatible LLM to summarize the changes and flag risks (data loss, security exposure, breaking changes, downtime, performance, best-practice issues). Key design decisions: - When no LLM is configured, doctor is equivalent to `helmfile diff` with one exception: --show-secrets is always forced off (secrets never reach stdout, even without an LLM). - Secrets are ALWAYS redacted via two layers: (1) ShowSecrets() forced to false so helm-diff emits <REDACTED> placeholders; (2) a defense-in-depth text redactor strips residual secret-looking content (Secret YAML blocks, sensitive key/value lines, base64 blobs, JWT tokens) before LLM transmission. - LLM configuration precedence: env (HELMFILE_LLM_*) < helmfile.yaml (llm:) < CLI flags (--llm-*). - Supports any OpenAI-compatible backend (OpenAI, Azure, One-API, LiteLLM, Ollama, etc.) with automatic response_format fallback for backends that don't support JSON mode. - Prompt injection defense: release names and environment values are JSON-encoded before insertion into the LLM prompt. - Exit codes: 0 (success/low-risk), 2 (high-risk gate, bypass with --force), 1 (other errors). Helm-diff's 'detected changes' exit-2 is swallowed. New packages: - pkg/agent/llm: OpenAI-compatible client with JSON response parsing, mock client for testing, prompt builder with injection defense. - pkg/agent/doctor: secret redactor (state machine + regex), report renderer (markdown + JSON), config resolver (env < yaml < flag merge). Testing: 70+ unit tests covering redaction patterns, prompt injection, response_format fallback, JSON parsing, yaml roundtrip, concurrency safety, panic recovery, and error propagation. go test -race passes. Documentation: full doctor section in docs/cli.md, llm: block reference in docs/configuration.md, updated skills/helmfile for AI agents. Signed-off-by: yxxhero <aiopsclub@163.com> * docs: fix doctor equivalence wording per PR review Per review feedback (PR #2660): the docs claimed doctor is 'equivalent to helmfile diff — same flags, same output, same exit codes' in the unconfigured path, but this over-promises because: 1. doctor --output is the report format (not helm-diff's output format) 2. helm-diff's --output is exposed as --diff-output in doctor 3. --show-secrets is silently ignored Updated all three locations (cli.md, cmd/doctor.go Long + godoc, pkg/app/doctor.go godoc) to say 'falls back to helmfile diff with --show-secrets forced off' and explicitly note the --output / --diff-output flag difference. Signed-off-by: yxxhero <aiopsclub@163.com> --------- Signed-off-by: yxxhero <aiopsclub@163.com>
45 lines
1.3 KiB
Go
45 lines
1.3 KiB
Go
package cmd
|
|
|
|
import (
|
|
"github.com/spf13/cobra"
|
|
|
|
"github.com/helmfile/helmfile/pkg/app"
|
|
"github.com/helmfile/helmfile/pkg/config"
|
|
)
|
|
|
|
// NewDiffCmd returns diff subcmd.
|
|
func NewDiffCmd(globalCfg *config.GlobalImpl) *cobra.Command {
|
|
diffOptions := config.NewDiffOptions()
|
|
|
|
cmd := &cobra.Command{
|
|
Use: "diff",
|
|
Short: "Diff releases defined in state file",
|
|
RunE: func(cmd *cobra.Command, args []string) error {
|
|
diffImpl := config.NewDiffImpl(globalCfg, diffOptions)
|
|
err := config.NewCLIConfigImpl(diffImpl.GlobalImpl)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
if err := diffImpl.ValidateConfig(); err != nil {
|
|
return err
|
|
}
|
|
|
|
a := app.New(diffImpl)
|
|
return toCLIError(diffImpl.GlobalImpl, a.Diff(diffImpl))
|
|
},
|
|
}
|
|
|
|
// Common surface shared with `helmfile doctor`.
|
|
bindCommonDiffFlags(cmd.Flags(), diffOptions, &globalCfg.GlobalOptions.Args)
|
|
|
|
// Diff-specific flags (defaults/help differ from doctor).
|
|
f := cmd.Flags()
|
|
f.BoolVar(&diffOptions.ShowSecrets, "show-secrets", false, "do not redact secret values in the output. should be used for debug purpose only")
|
|
f.BoolVar(&diffOptions.DetailedExitcode, "detailed-exitcode", false, "return a detailed exit code")
|
|
f.IntVar(&diffOptions.Context, "context", 0, "output NUM lines of context around changes")
|
|
f.StringVar(&diffOptions.Output, "output", "", "output format for diff plugin")
|
|
|
|
return cmd
|
|
}
|