mirror of
https://github.com/TECHNOFAB11/kubenix.git
synced 2025-12-12 08:00:06 +01:00
a04066c455
Fixes #66 Setting the `PATH` to `$out/bin` is causing programs from the original `PATH` (such as `gpg`) to be inaccessible to `vals` - causing decryption of sops secrets with `gpg` to fail.
45 lines
1.2 KiB
Nix
45 lines
1.2 KiB
Nix
{ kubectl
|
|
, vals
|
|
, colordiff
|
|
, evalModules
|
|
, writeShellScript
|
|
, writeScriptBin
|
|
, makeWrapper
|
|
, symlinkJoin
|
|
, lib
|
|
, module ? { }
|
|
, specialArgs ? { }
|
|
}:
|
|
let
|
|
kubernetes = (evalModules {
|
|
inherit module specialArgs;
|
|
}).config.kubernetes or { };
|
|
|
|
kubeconfig = kubernetes.kubeconfig or "";
|
|
result = kubernetes.result or "";
|
|
|
|
# kubectl does some parsing which removes the -I flag so
|
|
# as workaround, we write to a script and call that
|
|
# https://github.com/kubernetes/kubernetes/pull/108199#issuecomment-1058405404
|
|
diff = writeShellScript "kubenix-diff" ''
|
|
${lib.getExe colordiff} --nobanner -N -u -I ' kubenix/hash: ' -I ' generation: ' $@
|
|
'';
|
|
|
|
script = (writeScriptBin "kubenix" (builtins.readFile ./kubenix.sh)).overrideAttrs (old: {
|
|
buildCommand = "${old.buildCommand}\npatchShebangs $out";
|
|
});
|
|
in
|
|
symlinkJoin {
|
|
name = "kubenix";
|
|
paths = [ script vals kubectl ];
|
|
buildInputs = [ makeWrapper ];
|
|
passthru.manifest = result;
|
|
|
|
postBuild = ''
|
|
wrapProgram $out/bin/kubenix \
|
|
--suffix PATH : "$out/bin" \
|
|
--run 'export KUBECONFIG=''${KUBECONFIG:-${toString kubeconfig}}' \
|
|
--set KUBECTL_EXTERNAL_DIFF '${diff}' \
|
|
--set MANIFEST '${result}'
|
|
'';
|
|
}
|