Compare commits
23 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 8b8c447983 | |||
| 7b794f540f | |||
| 0f00fd2f29 | |||
| f95a74c6ae | |||
| 60fc377442 | |||
| dd3e877580 | |||
| da1ef7e0c3 | |||
| 39878f63cc | |||
| 374e2f5b57 | |||
| 581219ceae | |||
| 1b905d2bc6 | |||
| 43b284a0f4 | |||
| f54795f34f | |||
| be75ff55d4 | |||
| 25a093c131 | |||
| ed9afd02d6 | |||
| 2dabb1c731 | |||
| 8941f9ac16 | |||
| 4810893440 | |||
| e37904a377 | |||
| e16776d5f1 | |||
| 2ad61e90cc | |||
| dd330f1c14 |
@@ -0,0 +1,3 @@
|
|||||||
|
module.exports = {
|
||||||
|
extends: ['@headlamp-k8s/eslint-config'],
|
||||||
|
};
|
||||||
@@ -0,0 +1,27 @@
|
|||||||
|
name: CI
|
||||||
|
|
||||||
|
on:
|
||||||
|
push:
|
||||||
|
branches:
|
||||||
|
- main
|
||||||
|
pull_request:
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
lint:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
container: node:20
|
||||||
|
steps:
|
||||||
|
- name: Checkout
|
||||||
|
uses: actions/checkout@v4
|
||||||
|
|
||||||
|
- name: Install dependencies
|
||||||
|
run: npm ci
|
||||||
|
|
||||||
|
- name: Lint
|
||||||
|
run: npx eslint --ext .ts,.tsx src/
|
||||||
|
|
||||||
|
- name: Type-check
|
||||||
|
run: npx tsc --noEmit
|
||||||
|
|
||||||
|
- name: Format check
|
||||||
|
run: npx prettier --check src/
|
||||||
+157
-15
@@ -12,31 +12,173 @@ jobs:
|
|||||||
steps:
|
steps:
|
||||||
- name: Checkout
|
- name: Checkout
|
||||||
uses: actions/checkout@v4
|
uses: actions/checkout@v4
|
||||||
|
with:
|
||||||
|
fetch-depth: 0
|
||||||
|
|
||||||
|
- name: Check if release is already finalized
|
||||||
|
run: |
|
||||||
|
VERSION=${GITHUB_REF_NAME#v}
|
||||||
|
TARBALL_URL="https://github.com/cpfarhood/polaris-headlamp-plugin/releases/download/${GITHUB_REF_NAME}/polaris-headlamp-plugin-${VERSION}.tar.gz"
|
||||||
|
HTTP_CODE=$(curl -sL -o /tmp/release.tar.gz -w "%{http_code}" "$TARBALL_URL" 2>/dev/null)
|
||||||
|
if [ "$HTTP_CODE" = "200" ]; then
|
||||||
|
ACTUAL="sha256:$(sha256sum /tmp/release.tar.gz | awk '{print $1}')"
|
||||||
|
EXPECTED=$(grep 'archive-checksum' artifacthub-pkg.yml | awk '{print $2}')
|
||||||
|
echo "Release tarball checksum: $ACTUAL"
|
||||||
|
echo "Metadata checksum: $EXPECTED"
|
||||||
|
if [ "$ACTUAL" = "$EXPECTED" ]; then
|
||||||
|
echo "SKIP_BUILD=true" >> $GITHUB_ENV
|
||||||
|
echo "Checksums match - release is finalized, nothing to do"
|
||||||
|
fi
|
||||||
|
else
|
||||||
|
echo "No existing release (HTTP $HTTP_CODE) - will build"
|
||||||
|
fi
|
||||||
|
rm -f /tmp/release.tar.gz
|
||||||
|
|
||||||
- name: Install dependencies
|
- name: Install dependencies
|
||||||
run: npm ci
|
run: |
|
||||||
|
[ "$SKIP_BUILD" = "true" ] && exit 0
|
||||||
|
npm ci
|
||||||
|
|
||||||
- name: Build plugin
|
- name: Build plugin
|
||||||
run: npx @kinvolk/headlamp-plugin build
|
run: |
|
||||||
|
[ "$SKIP_BUILD" = "true" ] && exit 0
|
||||||
|
npx @kinvolk/headlamp-plugin build
|
||||||
|
|
||||||
- name: Package tarball
|
- name: Package tarball
|
||||||
run: npx @kinvolk/headlamp-plugin package
|
run: |
|
||||||
|
[ "$SKIP_BUILD" = "true" ] && exit 0
|
||||||
|
npx @kinvolk/headlamp-plugin package
|
||||||
|
|
||||||
|
- name: Compute tarball checksum
|
||||||
|
run: |
|
||||||
|
[ "$SKIP_BUILD" = "true" ] && exit 0
|
||||||
|
TARBALL=$(ls *.tar.gz)
|
||||||
|
CHECKSUM=$(sha256sum "$TARBALL" | awk '{print $1}')
|
||||||
|
echo "TARBALL=$TARBALL" >> $GITHUB_ENV
|
||||||
|
echo "CHECKSUM=$CHECKSUM" >> $GITHUB_ENV
|
||||||
|
echo "Tarball: $TARBALL"
|
||||||
|
echo "Checksum: sha256:$CHECKSUM"
|
||||||
|
|
||||||
- name: Install Docker CLI
|
- name: Install Docker CLI
|
||||||
run: apt-get update && apt-get install -y docker.io
|
|
||||||
|
|
||||||
- name: Build Docker image
|
|
||||||
run: docker build -t git.farh.net/${{ github.repository }}:${{ github.ref_name }} -t git.farh.net/${{ github.repository }}:latest .
|
|
||||||
|
|
||||||
- name: Push Docker image
|
|
||||||
run: |
|
run: |
|
||||||
|
[ "$SKIP_BUILD" = "true" ] && exit 0
|
||||||
|
apt-get update && apt-get install -y docker.io
|
||||||
|
|
||||||
|
- name: Build and push Docker image
|
||||||
|
run: |
|
||||||
|
[ "$SKIP_BUILD" = "true" ] && exit 0
|
||||||
|
docker build -t git.farh.net/${{ github.repository }}:${{ github.ref_name }} -t git.farh.net/${{ github.repository }}:latest .
|
||||||
echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
|
echo "${{ secrets.REGISTRY_TOKEN }}" | docker login git.farh.net -u ${{ github.actor }} --password-stdin
|
||||||
docker push git.farh.net/${{ github.repository }}:${{ github.ref_name }}
|
docker push git.farh.net/${{ github.repository }}:${{ github.ref_name }}
|
||||||
docker push git.farh.net/${{ github.repository }}:latest
|
docker push git.farh.net/${{ github.repository }}:latest
|
||||||
|
|
||||||
- name: Create release
|
- name: Create Gitea release
|
||||||
uses: akkuman/gitea-release-action@v1
|
run: |
|
||||||
with:
|
[ "$SKIP_BUILD" = "true" ] && exit 0
|
||||||
files: |
|
API_URL="${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}"
|
||||||
*.tar.gz
|
# Create release (or get existing)
|
||||||
token: ${{ github.token }}
|
RELEASE=$(curl -s -X POST \
|
||||||
|
-H "Authorization: token ${{ github.token }}" \
|
||||||
|
-H "Content-Type: application/json" \
|
||||||
|
"${API_URL}/releases" \
|
||||||
|
-d "{\"tag_name\":\"${GITHUB_REF_NAME}\",\"name\":\"${GITHUB_REF_NAME}\"}")
|
||||||
|
RELEASE_ID=$(echo "$RELEASE" | node -e "process.stdin.resume();let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.parse(d).id))")
|
||||||
|
if [ "$RELEASE_ID" = "undefined" ]; then
|
||||||
|
RELEASE=$(curl -sf \
|
||||||
|
-H "Authorization: token ${{ github.token }}" \
|
||||||
|
"${API_URL}/releases/tags/${GITHUB_REF_NAME}")
|
||||||
|
RELEASE_ID=$(echo "$RELEASE" | node -e "process.stdin.resume();let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.parse(d).id))")
|
||||||
|
fi
|
||||||
|
echo "Gitea Release ID: $RELEASE_ID"
|
||||||
|
# Delete existing assets
|
||||||
|
ASSETS=$(curl -sf \
|
||||||
|
-H "Authorization: token ${{ github.token }}" \
|
||||||
|
"${API_URL}/releases/${RELEASE_ID}/assets")
|
||||||
|
echo "$ASSETS" | node -e "
|
||||||
|
process.stdin.resume();let d='';
|
||||||
|
process.stdin.on('data',c=>d+=c);
|
||||||
|
process.stdin.on('end',()=>{
|
||||||
|
JSON.parse(d).forEach(a=>console.log(a.id));
|
||||||
|
})" | while read -r ASSET_ID; do
|
||||||
|
curl -sf -X DELETE \
|
||||||
|
-H "Authorization: token ${{ github.token }}" \
|
||||||
|
"${API_URL}/releases/${RELEASE_ID}/assets/${ASSET_ID}"
|
||||||
|
done
|
||||||
|
# Upload tarball
|
||||||
|
curl -sf -X POST \
|
||||||
|
-H "Authorization: token ${{ github.token }}" \
|
||||||
|
-F "attachment=@${TARBALL}" \
|
||||||
|
"${API_URL}/releases/${RELEASE_ID}/assets?name=${TARBALL}"
|
||||||
|
echo "Gitea release updated"
|
||||||
|
|
||||||
|
- name: Create GitHub release
|
||||||
|
continue-on-error: true
|
||||||
|
run: |
|
||||||
|
[ "$SKIP_BUILD" = "true" ] && exit 0
|
||||||
|
GH_API="https://api.github.com/repos/cpfarhood/polaris-headlamp-plugin"
|
||||||
|
# Create release or fetch existing one
|
||||||
|
BODY=$(curl -s -X POST \
|
||||||
|
-H "Authorization: token ${{ secrets.GH_PAT }}" \
|
||||||
|
-H "Accept: application/vnd.github+json" \
|
||||||
|
"${GH_API}/releases" \
|
||||||
|
-d "{\"tag_name\":\"${GITHUB_REF_NAME}\",\"name\":\"${GITHUB_REF_NAME}\",\"generate_release_notes\":true}")
|
||||||
|
RELEASE_ID=$(echo "$BODY" | node -e "process.stdin.resume();let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.parse(d).id))")
|
||||||
|
if [ "$RELEASE_ID" = "undefined" ]; then
|
||||||
|
echo "Release already exists, fetching it..."
|
||||||
|
BODY=$(curl -sf \
|
||||||
|
-H "Authorization: token ${{ secrets.GH_PAT }}" \
|
||||||
|
-H "Accept: application/vnd.github+json" \
|
||||||
|
"${GH_API}/releases/tags/${GITHUB_REF_NAME}")
|
||||||
|
RELEASE_ID=$(echo "$BODY" | node -e "process.stdin.resume();let d='';process.stdin.on('data',c=>d+=c);process.stdin.on('end',()=>console.log(JSON.parse(d).id))")
|
||||||
|
fi
|
||||||
|
echo "GitHub Release ID: $RELEASE_ID"
|
||||||
|
# Delete existing assets with the same name
|
||||||
|
ASSETS=$(curl -sf \
|
||||||
|
-H "Authorization: token ${{ secrets.GH_PAT }}" \
|
||||||
|
-H "Accept: application/vnd.github+json" \
|
||||||
|
"${GH_API}/releases/${RELEASE_ID}/assets")
|
||||||
|
echo "$ASSETS" | node -e "
|
||||||
|
process.stdin.resume();let d='';
|
||||||
|
process.stdin.on('data',c=>d+=c);
|
||||||
|
process.stdin.on('end',()=>{
|
||||||
|
const assets=JSON.parse(d);
|
||||||
|
assets.filter(a=>a.name==='${TARBALL}').forEach(a=>console.log(a.id));
|
||||||
|
})" | while read -r ASSET_ID; do
|
||||||
|
echo "Deleting existing asset $ASSET_ID..."
|
||||||
|
curl -sf -X DELETE \
|
||||||
|
-H "Authorization: token ${{ secrets.GH_PAT }}" \
|
||||||
|
"${GH_API}/releases/assets/${ASSET_ID}"
|
||||||
|
done
|
||||||
|
# Upload tarball
|
||||||
|
curl -sf -X POST \
|
||||||
|
-H "Authorization: token ${{ secrets.GH_PAT }}" \
|
||||||
|
-H "Content-Type: application/gzip" \
|
||||||
|
"https://uploads.github.com/repos/cpfarhood/polaris-headlamp-plugin/releases/${RELEASE_ID}/assets?name=${TARBALL}" \
|
||||||
|
--data-binary "@${TARBALL}"
|
||||||
|
echo "GitHub release updated with same tarball"
|
||||||
|
|
||||||
|
- name: Update metadata and align tag
|
||||||
|
run: |
|
||||||
|
[ "$SKIP_BUILD" = "true" ] && exit 0
|
||||||
|
VERSION=${GITHUB_REF_NAME#v}
|
||||||
|
git checkout main
|
||||||
|
sed -i "s|headlamp/plugin/archive-checksum:.*|headlamp/plugin/archive-checksum: sha256:${CHECKSUM}|" artifacthub-pkg.yml
|
||||||
|
sed -i "s|headlamp/plugin/archive-url:.*|headlamp/plugin/archive-url: \"https://github.com/cpfarhood/polaris-headlamp-plugin/releases/download/${GITHUB_REF_NAME}/polaris-headlamp-plugin-${VERSION}.tar.gz\"|" artifacthub-pkg.yml
|
||||||
|
sed -i "s|^version:.*|version: ${VERSION}|" artifacthub-pkg.yml
|
||||||
|
git config user.name "gitea-actions[bot]"
|
||||||
|
git config user.email "gitea-actions[bot]@git.farh.net"
|
||||||
|
git add artifacthub-pkg.yml
|
||||||
|
git diff --cached --quiet || {
|
||||||
|
git commit -m "ci: update artifact hub metadata for ${GITHUB_REF_NAME}"
|
||||||
|
git push origin main
|
||||||
|
}
|
||||||
|
# Force-move tag to the commit with correct checksum.
|
||||||
|
# This triggers a new CI run, but the guard step will detect
|
||||||
|
# that the release checksum already matches and skip the build.
|
||||||
|
git tag -f ${GITHUB_REF_NAME}
|
||||||
|
git push -f origin ${GITHUB_REF_NAME}
|
||||||
|
# Also push to GitHub directly to avoid waiting for mirror sync
|
||||||
|
git remote add github https://x-access-token:${{ secrets.GH_PAT }}@github.com/cpfarhood/polaris-headlamp-plugin.git 2>/dev/null || true
|
||||||
|
git push github main 2>/dev/null || true
|
||||||
|
git push -f github ${GITHUB_REF_NAME} 2>/dev/null || true
|
||||||
|
echo "Tag ${GITHUB_REF_NAME} aligned with updated metadata"
|
||||||
|
|||||||
@@ -0,0 +1 @@
|
|||||||
|
module.exports = require('@headlamp-k8s/eslint-config/prettier-config');
|
||||||
@@ -7,3 +7,4 @@ RUN npx @kinvolk/headlamp-plugin build
|
|||||||
|
|
||||||
FROM alpine:3.20
|
FROM alpine:3.20
|
||||||
COPY --from=build /app/dist/ /plugins/polaris-headlamp-plugin/
|
COPY --from=build /app/dist/ /plugins/polaris-headlamp-plugin/
|
||||||
|
COPY --from=build /app/package.json /plugins/polaris-headlamp-plugin/
|
||||||
|
|||||||
@@ -0,0 +1,230 @@
|
|||||||
|
# polaris-headlamp-plugin
|
||||||
|
|
||||||
|
[](https://artifacthub.io/packages/headlamp/polaris-headlamp-plugin/polaris-headlamp-plugin)
|
||||||
|
|
||||||
|
A [Headlamp](https://headlamp.dev/) plugin that surfaces [Fairwinds Polaris](https://polaris.docs.fairwinds.com/) audit results directly in the Headlamp UI.
|
||||||
|
|
||||||
|
## What It Does
|
||||||
|
|
||||||
|
Adds a **Polaris** sidebar entry to Headlamp that displays:
|
||||||
|
|
||||||
|
- **Cluster Score** -- overall Polaris score as a percentage (color-coded green/amber/red)
|
||||||
|
- **Check Summary** -- total, pass, warning, and danger counts across all workloads
|
||||||
|
- **Cluster Info** -- node, pod, namespace, and controller counts
|
||||||
|
|
||||||
|
Data is read from the `ConfigMap/polaris-dashboard` in the `polaris` namespace (key: `dashboard.json`), which is created by the standard Polaris Helm chart. The plugin is read-only -- it never writes to the cluster.
|
||||||
|
|
||||||
|
Results are cached and refreshed on a user-configurable interval (1 / 5 / 10 / 30 minutes, default 5). The setting persists in the browser's localStorage.
|
||||||
|
|
||||||
|
Error states are handled explicitly: RBAC denied (403), Polaris not installed (404), malformed JSON, and loading.
|
||||||
|
|
||||||
|
## Prerequisites
|
||||||
|
|
||||||
|
- **Headlamp** >= v0.26 deployed in your cluster
|
||||||
|
- **Polaris** installed via the [official Helm chart](https://github.com/FairwindsOps/polaris) with the dashboard component enabled
|
||||||
|
- The Headlamp service account must have RBAC permission to `get` ConfigMaps in the `polaris` namespace
|
||||||
|
|
||||||
|
## Installing
|
||||||
|
|
||||||
|
### Option 1: Artifact Hub + Headlamp plugin manager (recommended)
|
||||||
|
|
||||||
|
The plugin is published on [Artifact Hub](https://artifacthub.io/packages/headlamp/polaris-headlamp-plugin/polaris-headlamp-plugin). Configure Headlamp's `pluginsManager` in your Helm values to install it automatically:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
pluginsManager:
|
||||||
|
sources:
|
||||||
|
- url: https://artifacthub.io/packages/headlamp/polaris-headlamp-plugin/polaris-headlamp-plugin
|
||||||
|
```
|
||||||
|
|
||||||
|
Headlamp will fetch and install the plugin on startup.
|
||||||
|
|
||||||
|
### Option 2: Docker init container
|
||||||
|
|
||||||
|
The plugin ships as a container image at `git.farh.net/farhoodliquor/polaris-headlamp-plugin`.
|
||||||
|
|
||||||
|
Add it as an init container in your Headlamp Helm values:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
initContainers:
|
||||||
|
- name: polaris-plugin
|
||||||
|
image: git.farh.net/farhoodliquor/polaris-headlamp-plugin:v0.0.1
|
||||||
|
command: ["sh", "-c", "cp -r /plugins/* /headlamp/plugins/"]
|
||||||
|
volumeMounts:
|
||||||
|
- name: plugins
|
||||||
|
mountPath: /headlamp/plugins
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
- name: plugins
|
||||||
|
emptyDir: {}
|
||||||
|
|
||||||
|
volumeMounts:
|
||||||
|
- name: plugins
|
||||||
|
mountPath: /headlamp/plugins
|
||||||
|
```
|
||||||
|
|
||||||
|
### Option 3: Manual tarball install
|
||||||
|
|
||||||
|
Download the `.tar.gz` from the [GitHub releases page](https://github.com/cpfarhood/polaris-headlamp-plugin/releases) or the [Gitea releases page](https://git.farh.net/farhoodliquor/polaris-headlamp-plugin/releases), then extract into Headlamp's plugin directory:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
tar xzf polaris-headlamp-plugin-0.0.1.tar.gz -C /headlamp/plugins/
|
||||||
|
```
|
||||||
|
|
||||||
|
### Option 4: Build from source
|
||||||
|
|
||||||
|
```bash
|
||||||
|
npm install
|
||||||
|
npm run build
|
||||||
|
npx @kinvolk/headlamp-plugin extract . /headlamp/plugins
|
||||||
|
```
|
||||||
|
|
||||||
|
## RBAC
|
||||||
|
|
||||||
|
The plugin reads a single ConfigMap. Minimum RBAC required for the Headlamp service account:
|
||||||
|
|
||||||
|
```yaml
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRole
|
||||||
|
metadata:
|
||||||
|
name: headlamp-polaris-reader
|
||||||
|
rules:
|
||||||
|
- apiGroups: [""]
|
||||||
|
resources: ["configmaps"]
|
||||||
|
resourceNames: ["polaris-dashboard"]
|
||||||
|
verbs: ["get"]
|
||||||
|
---
|
||||||
|
apiVersion: rbac.authorization.k8s.io/v1
|
||||||
|
kind: ClusterRoleBinding
|
||||||
|
metadata:
|
||||||
|
name: headlamp-polaris-reader
|
||||||
|
roleRef:
|
||||||
|
apiGroup: rbac.authorization.k8s.io
|
||||||
|
kind: ClusterRole
|
||||||
|
name: headlamp-polaris-reader
|
||||||
|
subjects:
|
||||||
|
- kind: ServiceAccount
|
||||||
|
name: headlamp
|
||||||
|
namespace: headlamp
|
||||||
|
```
|
||||||
|
|
||||||
|
## Development
|
||||||
|
|
||||||
|
### Setup
|
||||||
|
|
||||||
|
```bash
|
||||||
|
git clone https://github.com/cpfarhood/polaris-headlamp-plugin.git
|
||||||
|
cd polaris-headlamp-plugin
|
||||||
|
npm install
|
||||||
|
```
|
||||||
|
|
||||||
|
### Run locally (hot reload)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
npm start
|
||||||
|
```
|
||||||
|
|
||||||
|
This starts the Headlamp plugin dev server. Point a running Headlamp instance at the dev server to see changes live.
|
||||||
|
|
||||||
|
### Build for production
|
||||||
|
|
||||||
|
```bash
|
||||||
|
npm run build # outputs dist/main.js
|
||||||
|
npm run package # creates polaris-headlamp-plugin-<version>.tar.gz
|
||||||
|
```
|
||||||
|
|
||||||
|
### Type-check
|
||||||
|
|
||||||
|
```bash
|
||||||
|
npm run tsc
|
||||||
|
```
|
||||||
|
|
||||||
|
## Project Structure
|
||||||
|
|
||||||
|
```
|
||||||
|
src/
|
||||||
|
index.tsx -- Entry point. Registers sidebar entry and route at /polaris.
|
||||||
|
api/
|
||||||
|
polaris.ts -- TypeScript types matching the Polaris AuditData schema,
|
||||||
|
usePolarisData() hook with caching, countResults() utility,
|
||||||
|
and refresh interval settings (localStorage).
|
||||||
|
components/
|
||||||
|
PolarisView.tsx -- Main page component. Score badge, check summary cards,
|
||||||
|
cluster info, error states, refresh interval selector.
|
||||||
|
```
|
||||||
|
|
||||||
|
## Data Source
|
||||||
|
|
||||||
|
The plugin reads from:
|
||||||
|
|
||||||
|
- **ConfigMap**: `polaris-dashboard`
|
||||||
|
- **Namespace**: `polaris`
|
||||||
|
- **Key**: `dashboard.json`
|
||||||
|
|
||||||
|
This ConfigMap is created automatically when Polaris is installed with the dashboard enabled. The JSON structure matches Polaris's `AuditData` schema (`pkg/validator/output.go`):
|
||||||
|
|
||||||
|
```
|
||||||
|
AuditData
|
||||||
|
Score -- cluster score (0-100)
|
||||||
|
ClusterInfo -- nodes, pods, namespaces, controllers
|
||||||
|
Results[] -- per-workload results
|
||||||
|
Results{} -- top-level check results (ResultSet)
|
||||||
|
PodResult
|
||||||
|
Results{} -- pod-level check results
|
||||||
|
ContainerResults[]
|
||||||
|
Results{} -- container-level check results
|
||||||
|
```
|
||||||
|
|
||||||
|
Each check in a `ResultSet` has `Success` (bool) and `Severity` (`"warning"` or `"danger"`).
|
||||||
|
|
||||||
|
## Releasing
|
||||||
|
|
||||||
|
Releases are automated via CI. To cut a release:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Bump version in package.json and artifacthub-pkg.yml, then:
|
||||||
|
git add package.json package-lock.json artifacthub-pkg.yml
|
||||||
|
git commit -m "chore: bump version to 0.0.2"
|
||||||
|
git tag v0.0.2
|
||||||
|
git push origin main v0.0.2
|
||||||
|
```
|
||||||
|
|
||||||
|
This triggers two CI pipelines:
|
||||||
|
|
||||||
|
**Gitea Actions** (`.gitea/workflows/release.yaml`):
|
||||||
|
1. Build the plugin in a `node:20` container
|
||||||
|
2. Package a `.tar.gz` tarball
|
||||||
|
3. Build and push a Docker image to `git.farh.net/farhoodliquor/polaris-headlamp-plugin:{tag}` and `:latest`
|
||||||
|
4. Create a Gitea release with the tarball attached
|
||||||
|
|
||||||
|
**GitHub Actions** (`.github/workflows/release.yml`):
|
||||||
|
1. Build and package the plugin
|
||||||
|
2. Create a GitHub release with the tarball attached (required for Artifact Hub)
|
||||||
|
|
||||||
|
The Gitea repo push-mirrors to GitHub automatically, so both pipelines trigger from a single `git push`.
|
||||||
|
|
||||||
|
### CI secrets
|
||||||
|
|
||||||
|
| Secret | Where | Purpose |
|
||||||
|
|---|---|---|
|
||||||
|
| `REGISTRY_TOKEN` | Gitea | Personal access token with `package:write` scope for Docker image push |
|
||||||
|
|
||||||
|
The Gitea release uses the built-in `github.token`. The GitHub release uses the default `GITHUB_TOKEN` with `contents: write` permission.
|
||||||
|
|
||||||
|
### Updating Artifact Hub
|
||||||
|
|
||||||
|
When releasing a new version, update `artifacthub-pkg.yml`:
|
||||||
|
- `version` field
|
||||||
|
- `headlamp/plugin/archive-url` annotation (update the version in the download URL)
|
||||||
|
- `headlamp/plugin/archive-checksum` annotation (SHA256 of the new tarball, printed by the CI build)
|
||||||
|
|
||||||
|
## Links
|
||||||
|
|
||||||
|
- [Artifact Hub](https://artifacthub.io/packages/headlamp/polaris-headlamp-plugin/polaris-headlamp-plugin)
|
||||||
|
- [GitHub (mirror)](https://github.com/cpfarhood/polaris-headlamp-plugin)
|
||||||
|
- [Gitea (source of truth)](https://git.farh.net/farhoodliquor/polaris-headlamp-plugin)
|
||||||
|
- [Headlamp](https://headlamp.dev/)
|
||||||
|
- [Fairwinds Polaris](https://polaris.docs.fairwinds.com/)
|
||||||
|
|
||||||
|
## License
|
||||||
|
|
||||||
|
MIT
|
||||||
@@ -0,0 +1,28 @@
|
|||||||
|
version: 0.0.4
|
||||||
|
name: polaris-headlamp-plugin
|
||||||
|
displayName: Polaris
|
||||||
|
createdAt: "2026-02-05T19:00:00Z"
|
||||||
|
description: Surfaces Fairwinds Polaris audit results inside the Headlamp UI.
|
||||||
|
license: MIT
|
||||||
|
homeURL: "https://github.com/cpfarhood/polaris-headlamp-plugin"
|
||||||
|
category: security
|
||||||
|
keywords:
|
||||||
|
- polaris
|
||||||
|
- fairwinds
|
||||||
|
- security
|
||||||
|
- audit
|
||||||
|
- headlamp
|
||||||
|
- kubernetes
|
||||||
|
links:
|
||||||
|
- name: Source
|
||||||
|
url: "https://github.com/cpfarhood/polaris-headlamp-plugin"
|
||||||
|
- name: Polaris
|
||||||
|
url: "https://polaris.docs.fairwinds.com/"
|
||||||
|
maintainers:
|
||||||
|
- name: cpfarhood
|
||||||
|
email: "chris@farhood.org"
|
||||||
|
annotations:
|
||||||
|
headlamp/plugin/archive-url: "https://github.com/cpfarhood/polaris-headlamp-plugin/releases/download/v0.0.4/polaris-headlamp-plugin-0.0.4.tar.gz"
|
||||||
|
headlamp/plugin/version-compat: ">=0.26"
|
||||||
|
headlamp/plugin/archive-checksum: sha256:4c460681d389c8977d7e7ae57ac6aedd64281de4b58284b0bcc9fb34525432f2
|
||||||
|
headlamp/plugin/distro-compat: in-cluster
|
||||||
@@ -1,4 +1,4 @@
|
|||||||
repositoryID: polaris-headlamp-plugin
|
repositoryID: fb4c3789-de2b-4667-8fff-34f22e5648da
|
||||||
owners:
|
owners:
|
||||||
- name: farhoodliquor
|
- name: cpfarhood
|
||||||
email: ""
|
email: "chris@farhood.org"
|
||||||
|
|||||||
Generated
+2
-2
@@ -1,12 +1,12 @@
|
|||||||
{
|
{
|
||||||
"name": "polaris-headlamp-plugin",
|
"name": "polaris-headlamp-plugin",
|
||||||
"version": "0.0.1",
|
"version": "0.0.3",
|
||||||
"lockfileVersion": 3,
|
"lockfileVersion": 3,
|
||||||
"requires": true,
|
"requires": true,
|
||||||
"packages": {
|
"packages": {
|
||||||
"": {
|
"": {
|
||||||
"name": "polaris-headlamp-plugin",
|
"name": "polaris-headlamp-plugin",
|
||||||
"version": "0.0.1",
|
"version": "0.0.3",
|
||||||
"devDependencies": {
|
"devDependencies": {
|
||||||
"@kinvolk/headlamp-plugin": "^0.13.0"
|
"@kinvolk/headlamp-plugin": "^0.13.0"
|
||||||
}
|
}
|
||||||
|
|||||||
+6
-2
@@ -1,12 +1,16 @@
|
|||||||
{
|
{
|
||||||
"name": "polaris-headlamp-plugin",
|
"name": "polaris-headlamp-plugin",
|
||||||
"version": "0.0.1",
|
"version": "0.0.4",
|
||||||
"description": "Headlamp plugin for Fairwinds Polaris audit results",
|
"description": "Headlamp plugin for Fairwinds Polaris audit results",
|
||||||
"scripts": {
|
"scripts": {
|
||||||
"start": "headlamp-plugin start",
|
"start": "headlamp-plugin start",
|
||||||
"build": "headlamp-plugin build",
|
"build": "headlamp-plugin build",
|
||||||
"package": "headlamp-plugin package",
|
"package": "headlamp-plugin package",
|
||||||
"tsc": "tsc --noEmit"
|
"tsc": "tsc --noEmit",
|
||||||
|
"lint": "eslint --ext .ts,.tsx src/",
|
||||||
|
"lint:fix": "eslint --ext .ts,.tsx --fix src/",
|
||||||
|
"format": "prettier --write src/",
|
||||||
|
"format:check": "prettier --check src/"
|
||||||
},
|
},
|
||||||
"devDependencies": {
|
"devDependencies": {
|
||||||
"@kinvolk/headlamp-plugin": "^0.13.0"
|
"@kinvolk/headlamp-plugin": "^0.13.0"
|
||||||
|
|||||||
+1
-1
@@ -157,7 +157,7 @@ export function usePolarisData(refreshIntervalSeconds: number): PolarisDataState
|
|||||||
return;
|
return;
|
||||||
}
|
}
|
||||||
const intervalId = window.setInterval(() => {
|
const intervalId = window.setInterval(() => {
|
||||||
setTick((t) => t + 1);
|
setTick(t => t + 1);
|
||||||
}, refreshIntervalSeconds * 1000);
|
}, refreshIntervalSeconds * 1000);
|
||||||
return () => window.clearInterval(intervalId);
|
return () => window.clearInterval(intervalId);
|
||||||
}, [refreshIntervalSeconds]);
|
}, [refreshIntervalSeconds]);
|
||||||
|
|||||||
@@ -1,8 +1,4 @@
|
|||||||
import {
|
import { Loader, SectionBox, SectionHeader } from '@kinvolk/headlamp-plugin/lib/CommonComponents';
|
||||||
Loader,
|
|
||||||
SectionBox,
|
|
||||||
SectionHeader,
|
|
||||||
} from '@kinvolk/headlamp-plugin/lib/CommonComponents';
|
|
||||||
import React from 'react';
|
import React from 'react';
|
||||||
import {
|
import {
|
||||||
AuditData,
|
AuditData,
|
||||||
@@ -20,19 +16,16 @@ const INTERVAL_OPTIONS = [
|
|||||||
{ label: '30 minutes', value: 1800 },
|
{ label: '30 minutes', value: 1800 },
|
||||||
];
|
];
|
||||||
|
|
||||||
function RefreshSettings(props: {
|
function RefreshSettings(props: { interval: number; onChange: (seconds: number) => void }) {
|
||||||
interval: number;
|
|
||||||
onChange: (seconds: number) => void;
|
|
||||||
}) {
|
|
||||||
return (
|
return (
|
||||||
<div style={{ display: 'flex', alignItems: 'center', gap: '8px' }}>
|
<div style={{ display: 'flex', alignItems: 'center', gap: '8px' }}>
|
||||||
<label htmlFor="polaris-refresh-interval">Refresh interval:</label>
|
<label htmlFor="polaris-refresh-interval">Refresh interval:</label>
|
||||||
<select
|
<select
|
||||||
id="polaris-refresh-interval"
|
id="polaris-refresh-interval"
|
||||||
value={props.interval}
|
value={props.interval}
|
||||||
onChange={(e) => props.onChange(Number(e.target.value))}
|
onChange={e => props.onChange(Number(e.target.value))}
|
||||||
>
|
>
|
||||||
{INTERVAL_OPTIONS.map((opt) => (
|
{INTERVAL_OPTIONS.map(opt => (
|
||||||
<option key={opt.value} value={opt.value}>
|
<option key={opt.value} value={opt.value}>
|
||||||
{opt.label}
|
{opt.label}
|
||||||
</option>
|
</option>
|
||||||
@@ -69,9 +62,7 @@ function ScoreBadge(props: { score: number }) {
|
|||||||
const color = props.score >= 80 ? '#4caf50' : props.score >= 50 ? '#ff9800' : '#f44336';
|
const color = props.score >= 80 ? '#4caf50' : props.score >= 50 ? '#ff9800' : '#f44336';
|
||||||
return (
|
return (
|
||||||
<div style={{ textAlign: 'center', marginBottom: '16px' }}>
|
<div style={{ textAlign: 'center', marginBottom: '16px' }}>
|
||||||
<div style={{ fontSize: '3rem', fontWeight: 'bold', color }}>
|
<div style={{ fontSize: '3rem', fontWeight: 'bold', color }}>{props.score}%</div>
|
||||||
{props.score}%
|
|
||||||
</div>
|
|
||||||
<div style={{ fontSize: '0.875rem', opacity: 0.8 }}>Cluster Score</div>
|
<div style={{ fontSize: '0.875rem', opacity: 0.8 }}>Cluster Score</div>
|
||||||
</div>
|
</div>
|
||||||
);
|
);
|
||||||
@@ -135,13 +126,12 @@ export default function PolarisView() {
|
|||||||
|
|
||||||
return (
|
return (
|
||||||
<>
|
<>
|
||||||
<SectionHeader title="Polaris" actions={[
|
<SectionHeader
|
||||||
<RefreshSettings
|
title="Polaris"
|
||||||
key="refresh"
|
actions={[
|
||||||
interval={interval}
|
<RefreshSettings key="refresh" interval={interval} onChange={handleIntervalChange} />,
|
||||||
onChange={handleIntervalChange}
|
]}
|
||||||
/>,
|
/>
|
||||||
]} />
|
|
||||||
|
|
||||||
{error && (
|
{error && (
|
||||||
<SectionBox title="Error">
|
<SectionBox title="Error">
|
||||||
@@ -153,9 +143,7 @@ export default function PolarisView() {
|
|||||||
|
|
||||||
{!data && !error && (
|
{!data && !error && (
|
||||||
<SectionBox title="No Data">
|
<SectionBox title="No Data">
|
||||||
<div style={{ padding: '16px' }}>
|
<div style={{ padding: '16px' }}>No Polaris audit results found.</div>
|
||||||
No Polaris audit results found.
|
|
||||||
</div>
|
|
||||||
</SectionBox>
|
</SectionBox>
|
||||||
)}
|
)}
|
||||||
</>
|
</>
|
||||||
|
|||||||
+1
-4
@@ -1,7 +1,4 @@
|
|||||||
import {
|
import { registerRoute, registerSidebarEntry } from '@kinvolk/headlamp-plugin/lib';
|
||||||
registerRoute,
|
|
||||||
registerSidebarEntry,
|
|
||||||
} from '@kinvolk/headlamp-plugin/lib';
|
|
||||||
import React from 'react';
|
import React from 'react';
|
||||||
import PolarisView from './components/PolarisView';
|
import PolarisView from './components/PolarisView';
|
||||||
|
|
||||||
|
|||||||
@@ -0,0 +1,4 @@
|
|||||||
|
{
|
||||||
|
"extends": "@kinvolk/headlamp-plugin/config/plugins-tsconfig.json",
|
||||||
|
"include": ["src"]
|
||||||
|
}
|
||||||
Reference in New Issue
Block a user