feat: wg-easy add preflights #59

nvanthao · 2025-05-07T04:16:27Z

Add Preflight Checks to WireGuard Easy (wg-easy)

Overview

This PR adds preflight checks to the wg-easy chart.

Implementation Details

Each chart-specific preflight is defined as a Kubernetes Secret with label troubleshoot.sh/kind: preflight

Preflight specs are stored in each chart's templates directory:

cert-manager/templates/secret-preflights.yaml
wg-easy/templates/secret-preflights.yaml

Added new task helm-preflight to streamline verification
Updated container image to include the preflight binary

Current Status

The PR is based on In container only #55 and will be rebased once that PR is merged
The cert-manager preflight is currently a placeholder to demonstrate multiple preflight specs merging, not the final preflight content
The wg-easy preflight has been implemented with actual checks relevant to the chart

Testing

Locally verify preflight specs with:

helm template <chart-dir> | preflight - --dry-run

Next Steps

Finalize cert-manager preflights with actual checks
Consider adding preflights to additional charts

Signed-off-by: Scott Rigby <[email protected]>

…ion) Signed-off-by: Scott Rigby <[email protected]>

…ntrypoint Taskfile Signed-off-by: Scott Rigby <[email protected]>

…ainer Signed-off-by: Scott Rigby <[email protected]>

…ntainer Signed-off-by: Scott Rigby <[email protected]>

chris-sanders

I was trying to do a review and then I realized you've based this on another active development branch but targeted the PR against main.

The problem is that means I'm not reviewing both PR's and I can't tell what you've changed and what the other PR is chaning.

If you base a PR on top of another existing branch I think we need to review against that other PR until it's merged so that the review is only of your current changes not everything from both branches.

chris-sanders · 2025-05-07T15:19:21Z

applications/wg-easy/README.md

@@ -48,6 +48,7 @@ Use tools to automate repetitive tasks, reducing human error and increasing deve

 - Task-based workflow automation
 - Helmfile for orchestration
+- Container-based dev environment for consistency


I don't like the phrase "dev environment" because that's not what it actually is and starts to imply you should shell into the container and install dev tools.

Suggested change

- Container-based dev environment for consistency

- Container-based workflow execution for consistency

chris-sanders

Just watching the asciinema and again I don't know for sure if this is feedback from your PR or the branch you're building on top of but I'll note what I see either way.

You ran a command 'ag' which I'm guessing is an alias or shortcut you've setup yourself? If so you shouldn't do that in a demo I don't know what that command does, hence I can't understand what you're trying to show us by running it.
You've exposed your REPLICATED_API_TOKEN please rotate it and be more careful in the future about recording sensitive values.
The output here is far to verbose, that's part of the cause of item 2 above, slim it down we shouldn't be showing task commands like you show here. Especially when they have API TOKENS in them. That goes for both the green and the white text, it's noisy look at the Embedded Cluster CLI outputs for a target of what good looks like. I think just disable all of the verbose output would be a good start.
As I mentioned in yesterdays' standup, you shouldn't need cluster-create and setup-kubeconfig in your dependencies. As far as I can tell just setup-kubeconfig is sufficient because it already includes creating a cluster. We need to be careful not to unnecessarily re-run and steps for no reason.
This is the biggest one, you're using a bash loop to make this work which is fine for development purposes however how do you see this working in a real install? An end user won't be using Taskfile or this repository, the preflight needs to work through Enterprise Portal and Embedded Cluster installs. Are you addressing that next? I'm fine with this implementation for developers but before we land anything we need to know what this means for end users.

nvanthao · 2025-05-08T00:15:39Z

many thanks @chris-sanders

I use ag as a drop-in replacement for grep as it is faster
many thanks I have rotated the token for the demo
I removed -v=5 flag
I removed dep cluster-create
In real install, let me do a quick record of what I am seeing and share the thoughts with us in a Loom

nvanthao · 2025-05-08T04:13:00Z

This is the biggest one, you're using a bash loop to make this work which is fine for development purposes however how do you see this working in a real install? An end user won't be using Taskfile or this repository, the preflight needs to work through Enterprise Portal and Embedded Cluster installs. Are you addressing that next? I'm fine with this implementation for developers but before we land anything we need to know what this means for end users.

I've shared the Loom in our Slack channel, tldr;

for KOTS install in existing cluster, the preflights will run during kots install
for EC install, the preflight will happen in KOTS Admin Console UI
for helm install, Vendor Portal contains the instructions to run helm template | preflight per chart
for helm install, Enterprise Portal is missing preflights run instructions as of now

chris-sanders

I just realized this is still targeting main and not the other PR.
I'm assuming all changes in this PR are yours since you asked for another review, is that accurate?

chris-sanders · 2025-05-08T21:27:45Z

applications/wg-easy/cert-manager/templates/secret-preflights.yaml

+apiVersion: v1
+kind: Secret
+metadata:
+  name: cert-manager-preflights
+  labels:
+    troubleshoot.sh/kind: preflight
+type: Opaque
+stringData:
+  preflight.yaml: |
+    apiVersion: troubleshoot.sh/v1beta2
+    kind: Preflight
+    metadata:
+      name: cert-manager-preflights
+    spec:
+      analyzers:
+        - distribution:
+            outcomes:
+            - pass:
+                when: "== gke"
+                message: GKE is a supported platform
+            - pass:
+                when: "== k3s"
+                message: K3S is a supported platform
+            - fail:
+                when: "== kind"
+                message: This application does not support Kind
+            - warn:
+                message: The Kubernetes platform is not validated, but there are no known compatibility issues.


Let's not use any 'dummy' values. Cert-manager has a list of prerequisites documented. Use real requirements.

chris-sanders · 2025-05-08T21:29:38Z

applications/wg-easy/container/Containerfile

+    # Install yq
+    && BINARY=yq_linux_amd64 \
+    && VERSION=v4.45.1 \
+    && curl -Ls https://github.com/mikefarah/yq/releases/download/${VERSION}/${BINARY}.tar.gz -O \
+    && tar xf ${BINARY}.tar.gz && rm ${BINARY}.tar.gz \
+    && mv ${BINARY} /usr/local/bin/yq


Why did you move yq out of the package manager and into manual install? Are we using something that's so new it's not in packages yet?

chris-sanders · 2025-05-08T21:32:47Z

applications/wg-easy/taskfiles/container.yml

@@ -1,90 +1,111 @@
 version: "3"

+vars:


There's a lot more changed here than the description says. This isn't just adding the preflight binary, can you explain what all of these container tasks are? They feel unrelated to the task at hand but I might just not understand.

chris-sanders · 2025-05-08T22:07:54Z

applications/wg-easy/taskfiles/container.yml

    cmds:
+      - task: check-image-exists
+      # Start with host networking for kubectl port-forward compatibility


The security implications of this are a bit concerning, although if it's necessary it's not something I would loose sleep over.

Can you explain why kubectl port-forward is needed? Is this running port-forward from within the container, or external to the container? Is there a reason you can't just expose a port rather than use host networking?

scottrigby and others added 9 commits May 2, 2025 11:44

run only in container

7a19505

Signed-off-by: Scott Rigby <[email protected]>

Improve DX

8f90b89

Signed-off-by: Scott Rigby <[email protected]>

Use supported version of yq (debian pkg not supported or correct vers…

e45d379

…ion) Signed-off-by: Scott Rigby <[email protected]>

Make container tasks internal, cleanup container tasks and simplify e…

b5fc165

…ntrypoint Taskfile Signed-off-by: Scott Rigby <[email protected]>

remove default task from internal taskfile. List happens outside cont…

832012d

…ainer Signed-off-by: Scott Rigby <[email protected]>

Update docs. TO-DO: make helm and kubectl commands run from inside co…

62595c3

…ntainer Signed-off-by: Scott Rigby <[email protected]>

wip

44ffbcb

revert container.yml

eac2373

wip

c1f1419

nvanthao requested review from chris-sanders, banjoh and hedge-sparrow May 7, 2025 09:22

chris-sanders requested changes May 7, 2025

View reviewed changes

update from review

b270e66

nvanthao requested a review from chris-sanders May 8, 2025 04:13

chris-sanders requested changes May 8, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: wg-easy add preflights #59

feat: wg-easy add preflights #59

nvanthao commented May 7, 2025 •

edited

Loading

chris-sanders left a comment

chris-sanders May 7, 2025

chris-sanders left a comment

nvanthao commented May 8, 2025

nvanthao commented May 8, 2025

chris-sanders left a comment

chris-sanders May 8, 2025

chris-sanders May 8, 2025

chris-sanders May 8, 2025

chris-sanders May 8, 2025

	- Container-based dev environment for consistency
	- Container-based workflow execution for consistency

feat: wg-easy add preflights #59

Are you sure you want to change the base?

feat: wg-easy add preflights #59

Conversation

nvanthao commented May 7, 2025 • edited Loading

Add Preflight Checks to WireGuard Easy (wg-easy)

Overview

Implementation Details

Current Status

Testing

Next Steps

chris-sanders left a comment

Choose a reason for hiding this comment

chris-sanders May 7, 2025

Choose a reason for hiding this comment

chris-sanders left a comment

Choose a reason for hiding this comment

nvanthao commented May 8, 2025

nvanthao commented May 8, 2025

chris-sanders left a comment

Choose a reason for hiding this comment

chris-sanders May 8, 2025

Choose a reason for hiding this comment

chris-sanders May 8, 2025

Choose a reason for hiding this comment

chris-sanders May 8, 2025

Choose a reason for hiding this comment

chris-sanders May 8, 2025

Choose a reason for hiding this comment

nvanthao commented May 7, 2025 •

edited

Loading