Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .dockerignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
bin/
.git/
.gitignore
*.md
Dockerfile
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The Dockerfile itself is listed in the .dockerignore file. This will cause the Docker build to fail because the Docker daemon's context will not include the Dockerfile. Please remove this line.

k8s/
sdk/
api-spec/
scripts/
config.example.yaml
.vscode/
.idea/
*.swp
*.swo

52 changes: 52 additions & 0 deletions .gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
# Binaries
bin/
*.exe
*.exe~
*.dll
*.so
*.dylib

# Test binaries
*.test
test-integration/ssh-key-test

# Output of the go coverage tool
*.out

# Dependency directories
vendor/

# Go workspace file
go.work

# IDE files
.vscode/
.idea/
*.swp
*.swo
*~

# OS files
.DS_Store
Thumbs.db

# Build artifacts
dist/
build/

# Logs
*.log

# Kubernetes config
kubeconfig
*.kubeconfig

# Secrets
*.pem
*.key
!**/tls.key
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The pattern !**/tls.key negates the previous *.key pattern, causing files named tls.key to be tracked by Git. Committing private key files to the repository is a major security risk. Unless these are non-sensitive test keys, this line should be removed to ensure all *.key files are ignored.

*.crt

# Temporary files
tmp/
temp/
35 changes: 35 additions & 0 deletions Dockerfile
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
# Multi-stage build for pico-apiserver
FROM golang:1.24.9-alpine AS builder

WORKDIR /workspace

# Copy go mod files
COPY go.mod go.sum ./
RUN go mod download

# Copy source code
COPY cmd/ cmd/
COPY pkg/ pkg/

# Build
RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o pico-apiserver ./cmd/pico-apiserver

# Runtime image
FROM alpine:3.19

RUN apk --no-cache add ca-certificates

WORKDIR /app

# Copy binary from builder
COPY --from=builder /workspace/pico-apiserver .

# Run as non-root user
RUN adduser -D -u 1000 apiserver
USER apiserver
Comment on lines +28 to +29
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Running the container as a non-root user is a good security practice. However, the user apiserver is created without a specific group, which might lead to it being in the root group (GID 0) on some base images. It's better to explicitly create and use a non-root group.

RUN addgroup -S -g 1000 apiserver && adduser -S -u 1000 -G apiserver apiserver
USER apiserver


EXPOSE 8080

ENTRYPOINT ["/app/pico-apiserver"]
CMD ["--port=8080", "--namespace=default"]

188 changes: 188 additions & 0 deletions Makefile
Original file line number Diff line number Diff line change
@@ -0,0 +1,188 @@
.PHONY: build run clean test deps

# Build targets
build:
@echo "Building pico-apiserver..."
go build -o bin/pico-apiserver ./cmd/pico-apiserver

build-test-tunnel:
@echo "Building test-tunnel..."
go build -o bin/test-tunnel ./cmd/test-tunnel

build-all: build build-test-tunnel

# Run server (development mode)
run:
@echo "Running pico-apiserver..."
go run ./cmd/pico-apiserver/main.go \
--port=8080 \
--namespace=default \
--ssh-username=sandbox \
--ssh-port=22

# Run server (with kubeconfig)
run-local:
@echo "Running pico-apiserver with local kubeconfig..."
go run ./cmd/pico-apiserver/main.go \
--port=8080 \
--kubeconfig=${HOME}/.kube/config \
--namespace=default \
--ssh-username=sandbox \
--ssh-port=22

# Clean build artifacts
clean:
@echo "Cleaning..."
rm -rf bin/
rm -f pico-apiserver

# Install dependencies
deps:
@echo "Downloading dependencies..."
go mod download
go mod tidy

# Update dependencies
update-deps:
@echo "Updating dependencies..."
go get -u ./...
go mod tidy

# Run tests
test:
@echo "Running tests..."
go test -v ./...

# Format code
fmt:
@echo "Formatting code..."
go fmt ./...

# Run linter
lint:
@echo "Running linter..."
golangci-lint run ./...

# Build Docker image
docker-build:
@echo "Building Docker image..."
docker build -t pico-apiserver:latest .

# Install to system
install: build
@echo "Installing pico-apiserver..."
sudo cp bin/pico-apiserver /usr/local/bin/
Comment on lines +72 to +74
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The install target uses sudo, which can be problematic as it requires the user to have sudo privileges and can have unintended side effects. It's better to let the user decide when to use sudo. The common practice is to instruct users to run sudo make install if they need to install system-wide.

install: build
	@echo "Installing pico-apiserver to /usr/local/bin..."
	cp bin/pico-apiserver /usr/local/bin/


# Docker and Kubernetes targets
docker-build:
@echo "Building Docker image..."
docker build -t pico-apiserver:latest .
Comment on lines +67 to +79
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

There are duplicate docker-build targets defined in the Makefile (lines 67 and 77). The second definition will override the first, making the first one redundant and potentially causing confusion. Please remove one of the definitions.


docker-push:
@echo "Pushing Docker image..."
docker push pico-apiserver:latest

k8s-deploy:
@echo "Deploying to Kubernetes..."
kubectl apply -f k8s/pico-apiserver.yaml

k8s-delete:
@echo "Deleting from Kubernetes..."
kubectl delete -f k8s/pico-apiserver.yaml

k8s-logs:
@echo "Showing logs..."
kubectl logs -n pico -l app=pico-apiserver -f

# Load image to kind cluster
kind-load:
@echo "Loading image to kind..."
kind load docker-image pico-apiserver:latest

# Sandbox image targets
SANDBOX_IMAGE ?= sandbox:latest
IMAGE_REGISTRY ?= ""

sandbox-build:
@echo "Building sandbox image..."
docker build -t $(SANDBOX_IMAGE) images/sandbox/

sandbox-push: sandbox-build
@if [ -z "$(IMAGE_REGISTRY)" ]; then \
echo "Error: IMAGE_REGISTRY not set. Usage: make sandbox-push IMAGE_REGISTRY=your-registry.com"; \
exit 1; \
fi
@echo "Tagging and pushing sandbox image to $(IMAGE_REGISTRY)/$(SANDBOX_IMAGE)..."
docker tag $(SANDBOX_IMAGE) $(IMAGE_REGISTRY)/$(SANDBOX_IMAGE)
docker push $(IMAGE_REGISTRY)/$(SANDBOX_IMAGE)

sandbox-test:
@echo "Testing sandbox image locally..."
docker run -d -p 2222:22 --name sandbox-test $(SANDBOX_IMAGE)
@echo "Sandbox running on port 2222. Test with: ssh -p 2222 sandbox@localhost"
@echo "Password: sandbox"
@echo "Stop with: make sandbox-test-stop"

sandbox-test-stop:
@echo "Stopping and removing sandbox test container..."
docker stop sandbox-test || true
docker rm sandbox-test || true

sandbox-kind-load:
@echo "Loading sandbox image to kind..."
kind load docker-image $(SANDBOX_IMAGE)

# Test targets
test-tunnel:
@if [ -z "$(SESSION_ID)" ]; then \
echo "Error: SESSION_ID not set. Usage: make test-tunnel SESSION_ID=<session-id>"; \
exit 1; \
fi
@echo "Testing tunnel for session $(SESSION_ID)..."
@go run ./cmd/test-tunnel/main.go -session $(SESSION_ID) -api $(API_URL) -token $(TOKEN)

test-tunnel-build:
@echo "Building and running tunnel test..."
@make build-test-tunnel
@if [ -z "$(SESSION_ID)" ]; then \
echo "Error: SESSION_ID not set. Usage: make test-tunnel-build SESSION_ID=<session-id>"; \
exit 1; \
fi
./bin/test-tunnel -session $(SESSION_ID) -api $(API_URL) -token $(TOKEN)

# Variables for test-tunnel
API_URL ?= http://localhost:8080
TOKEN ?= ""
SESSION_ID ?= ""

# Show help message
help:
@echo "Available targets:"
@echo " build - Build the binary"
@echo " run - Run in development mode"
@echo " run-local - Run with local kubeconfig"
@echo " clean - Clean build artifacts"
@echo " deps - Download dependencies"
@echo " update-deps - Update dependencies"
@echo " test - Run tests"
@echo " fmt - Format code"
@echo " lint - Run linter"
@echo " docker-build - Build Docker image"
@echo " docker-push - Push Docker image"
@echo " k8s-deploy - Deploy to Kubernetes"
@echo " k8s-delete - Delete from Kubernetes"
@echo " k8s-logs - Show pod logs"
@echo " k8s-restart - Restart deployment"
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

The help target lists a k8s-restart command, but this target is not defined anywhere in the Makefile. This should be removed to avoid confusion.

@echo " kind-load - Load image to kind cluster"
@echo " sandbox-build - Build sandbox image"
@echo " sandbox-push - Push sandbox image to registry"
@echo " sandbox-test - Test sandbox image locally"
@echo " sandbox-test-stop - Stop sandbox test container"
@echo " sandbox-kind-load - Load sandbox image to kind"
@echo " test-tunnel - Test tunnel connection (requires SESSION_ID)"
@echo " test-tunnel-build - Build and test tunnel connection"
@echo " build-test-tunnel - Build test-tunnel tool"
@echo " build-all - Build all binaries"
@echo " install - Install to /usr/local/bin"
@echo " help - Show this help message"

Loading