KOTS upgrader

.github/actions/copy-assets/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21 as builder
+FROM golang:1.22 as builder
 WORKDIR /action
 COPY . /action
 

Makefile

@@ -51,6 +51,8 @@ kots: capture-start-time kots-real report-metric
 
 .PHONY: kots-real
 kots-real:
+	mkdir -p web/dist
+	touch web/dist/README.md
 	go build ${LDFLAGS} -o bin/kots $(BUILDFLAGS) github.com/replicatedhq/kots/cmd/kots
 
 .PHONY: fmt
@@ -80,7 +82,7 @@ build: capture-start-time build-real report-metric
 .PHONY: build-real
 build-real:
 	mkdir -p web/dist
-	touch web/dist/THIS_IS_OKTETO  # we need this for go:embed, but it's not actually used in dev
+	touch web/dist/README.md
 	go build ${LDFLAGS} ${GCFLAGS} -v -o bin/kotsadm $(BUILDFLAGS) ./cmd/kotsadm
 
 .PHONY: tidy
@@ -112,9 +114,12 @@ debug-build:
 debug: debug-build
 	LOG_LEVEL=$(LOG_LEVEL) dlv --listen=:2345 --headless=true --api-version=2 exec ./bin/kotsadm-debug api
 
-.PHONY: build-ttl.sh
-build-ttl.sh: kots build
+.PHONY: web
+web:
 	source .image.env && ${MAKE} -C web build-kotsadm
+
+.PHONY: build-ttl.sh
+build-ttl.sh: web kots build
 	docker build -f deploy/Dockerfile -t ttl.sh/${CURRENT_USER}/kotsadm:24h .
 	docker push ttl.sh/${CURRENT_USER}/kotsadm:24h
 

cmd/kots/cli/install.go

@@ -37,8 +37,8 @@ import (
 	"github.com/replicatedhq/kots/pkg/print"
 	"github.com/replicatedhq/kots/pkg/pull"
 	"github.com/replicatedhq/kots/pkg/replicatedapp"
-	"github.com/replicatedhq/kots/pkg/store/kotsstore"
 	storetypes "github.com/replicatedhq/kots/pkg/store/types"
+	"github.com/replicatedhq/kots/pkg/tasks"
 	kotsv1beta1 "github.com/replicatedhq/kotskinds/apis/kots/v1beta1"
 	"github.com/replicatedhq/troubleshoot/pkg/preflight"
 	"github.com/spf13/cobra"
@@ -887,7 +887,7 @@ func ValidateAutomatedInstall(deployOptions kotsadmtypes.DeployOptions, authSlug
 	return "", errors.New("timeout waiting for automated install. Use the --wait-duration flag to increase timeout.")
 }
 
-func getAutomatedInstallStatus(url string, authSlug string) (*kotsstore.TaskStatus, error) {
+func getAutomatedInstallStatus(url string, authSlug string) (*tasks.TaskStatus, error) {
 	newReq, err := http.NewRequest("GET", url, nil)
 	if err != nil {
 		return nil, errors.Wrap(err, "failed to create request")
@@ -910,7 +910,7 @@ func getAutomatedInstallStatus(url string, authSlug string) (*kotsstore.TaskStat
 		return nil, errors.Wrap(err, "failed to read response body")
 	}
 
-	taskStatus := kotsstore.TaskStatus{}
+	taskStatus := tasks.TaskStatus{}
 	if err := json.Unmarshal(b, &taskStatus); err != nil {
 		return nil, errors.Wrap(err, "failed to unmarshal task status")
 	}

cmd/kots/cli/root.go

@@ -55,6 +55,7 @@ func RootCmd() *cobra.Command {
 	cmd.AddCommand(CompletionCmd())
 	cmd.AddCommand(DockerRegistryCmd())
 	cmd.AddCommand(EnableHACmd())
+	cmd.AddCommand(UpgradeServiceCmd())
 
 	viper.BindPFlags(cmd.Flags())
 

cmd/kots/cli/upgrade-service.go

@@ -0,0 +1,78 @@
+package cli
+
+import (
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/replicatedhq/kots/pkg/upgradeservice"
+	"github.com/replicatedhq/kots/pkg/upgradeservice/types"
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+	"gopkg.in/yaml.v3"
+)
+
+func UpgradeServiceCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:    "upgrade-service",
+		Short:  "KOTS Upgrade Service",
+		Hidden: true,
+	}
+
+	cmd.AddCommand(UpgradeServiceStartCmd())
+
+	return cmd
+}
+
+func UpgradeServiceStartCmd() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:           "start [params-file]",
+		Short:         "Starts a KOTS upgrade service using the provided params file",
+		Long:          ``,
+		SilenceUsage:  true,
+		SilenceErrors: false,
+		PreRun: func(cmd *cobra.Command, args []string) {
+			viper.BindPFlags(cmd.Flags())
+			os.Setenv("IS_UPGRADE_SERVICE", "true")
+		},
+		RunE: func(cmd *cobra.Command, args []string) error {
+			if len(args) != 1 {
+				cmd.Help()
+				os.Exit(1)
+			}
+
+			paramsYAML, err := readUpgradeServiceParams(args[0])
+			if err != nil {
+				return fmt.Errorf("failed to read config file: %v", err)
+			}
+
+			var params types.UpgradeServiceParams
+			if err := yaml.Unmarshal(paramsYAML, &params); err != nil {
+				return fmt.Errorf("failed to unmarshal config file: %v", err)
+			}
+
+			if err := upgradeservice.Serve(params); err != nil {
+				return err
+			}
+
+			return nil
+		},
+	}
+
+	return cmd
+}
+
+func readUpgradeServiceParams(path string) ([]byte, error) {
+	if path == "-" {
+		b, err := io.ReadAll(os.Stdin)
+		if err != nil {
+			return nil, fmt.Errorf("read stdin: %w", err)
+		}
+		return b, nil
+	}
+	b, err := os.ReadFile(path)
+	if err != nil {
+		return nil, fmt.Errorf("read file: %w", err)
+	}
+	return b, nil
+}

cmd/kots/cli/version.go

@@ -1,11 +1,12 @@
 package cli
 
 import (
-	"encoding/json"
 	"fmt"
+	"log"
+	"net/http"
 
-	"github.com/pkg/errors"
-	"github.com/replicatedhq/kots/pkg/buildversion"
+	"github.com/gorilla/mux"
+	"github.com/replicatedhq/kots/pkg/handlers"
 	"github.com/spf13/cobra"
 	"github.com/spf13/viper"
 )
@@ -25,37 +26,19 @@ func VersionCmd() *cobra.Command {
 			viper.BindPFlags(cmd.Flags())
 		},
 		RunE: func(cmd *cobra.Command, args []string) error {
-			v := viper.GetViper()
+			r := mux.NewRouter()
 
-			output := v.GetString("output")
+			spa := handlers.SPAHandler{}
+			r.PathPrefix("/").Handler(spa)
 
-			isLatest, latestVer, err := buildversion.IsLatestRelease()
-			versionOutput := VersionOutput{
-				Version: buildversion.Version(),
-			}
-			if err == nil && !isLatest {
-				versionOutput.LatestVersion = latestVer
-				versionOutput.InstallLatest = "curl https://kots.io/install | bash"
+			srv := &http.Server{
+				Handler: r,
+				Addr:    ":30888",
 			}
 
-			if output != "json" && output != "" {
-				return errors.Errorf("output format %s not supported (allowed formats are: json)", output)
-			} else if output == "json" {
-				// marshal JSON
-				outputJSON, err := json.Marshal(versionOutput)
-				if err != nil {
-					return errors.Wrap(err, "error marshaling JSON")
-				}
-				fmt.Println(string(outputJSON))
-			} else {
-				// print basic version info
-				fmt.Printf("Replicated KOTS %s\n", buildversion.Version())
+			fmt.Printf("Starting KOTS SPA handler on port %d...\n", 30888)
 
-				// check if this is the latest release, and display possible upgrade instructions
-				if versionOutput.LatestVersion != "" {
-					fmt.Printf("\nVersion %s is available for kots. To install updates, run\n  $ %s\n", versionOutput.LatestVersion, versionOutput.InstallLatest)
-				}
-			}
+			log.Fatal(srv.ListenAndServe())
 
 			return nil
 		},

hack/dev/skaffold.Dockerfile

@@ -2,7 +2,6 @@ FROM kotsadm:cache AS builder
 
 ENV PROJECTPATH=/go/src/github.com/replicatedhq/kots
 WORKDIR $PROJECTPATH
-RUN mkdir -p web/dist && touch web/dist/README.md
 COPY Makefile ./
 COPY Makefile.build.mk ./
 COPY go.mod go.sum ./

hack/dev/skaffoldcache.Dockerfile

@@ -4,7 +4,6 @@ RUN go install github.com/go-delve/delve/cmd/[email protected]
 
 ENV PROJECTPATH=/go/src/github.com/replicatedhq/kots
 WORKDIR $PROJECTPATH
-RUN mkdir -p web/dist && touch web/dist/README.md
 COPY Makefile ./
 COPY Makefile.build.mk ./
 COPY go.mod go.sum ./

kurl_proxy/cmd/main.go

@@ -472,8 +472,8 @@ func getHttpsServer(upstream, dexUpstream *url.URL, tlsSecretName string, secret
 
 // CSPMiddleware adds Content-Security-Policy and X-Frame-Options headers to the response.
 func CSPMiddleware(c *gin.Context) {
-	c.Writer.Header().Set("Content-Security-Policy", "frame-ancestors 'none';")
-	c.Writer.Header().Set("X-Frame-Options", "DENY")
+	c.Writer.Header().Set("Content-Security-Policy", "frame-ancestors 'self';")
+	c.Writer.Header().Set("X-Frame-Options", "SAMEORIGIN")
 	c.Next()
 }
 

kurl_proxy/cmd/main_test.go

@@ -181,8 +181,8 @@ func Test_httpServerCSPHeaders(t *testing.T) {
 			httpServer: getHttpServer("some-fingerprint", true, tmpDir),
 			path:       "/assets/index.html",
 			wantHeaders: map[string]string{
-				"Content-Security-Policy": "frame-ancestors 'none';",
-				"X-Frame-Options":         "DENY",
+				"Content-Security-Policy": "frame-ancestors 'self';",
+				"X-Frame-Options":         "SAMEORIGIN",
 			},
 		},
 		{
@@ -191,8 +191,8 @@ func Test_httpServerCSPHeaders(t *testing.T) {
 			isHttps:    true,
 			path:       "/tls/assets/index.html",
 			wantHeaders: map[string]string{
-				"Content-Security-Policy": "frame-ancestors 'none';",
-				"X-Frame-Options":         "DENY",
+				"Content-Security-Policy": "frame-ancestors 'self';",
+				"X-Frame-Options":         "SAMEORIGIN",
 			},
 		},
 	}
@@ -275,15 +275,15 @@ func Test_generateDefaultCertSecret(t *testing.T) {
 
 func Test_generateCertHostnames(t *testing.T) {
 	tests := []struct {
-		name  string
+		name      string
 		namespace string
 		hostname  string
-		altNames []string
+		altNames  []string
 	}{
 		{
-			name:  "with no namespace",
-			hostname:  "kotsadm.default.svc.cluster.local",
-			altNames : []string{
+			name:     "with no namespace",
+			hostname: "kotsadm.default.svc.cluster.local",
+			altNames: []string{
 				"kotsadm",
 				"kotsadm.default",
 				"kotsadm.default.svc",
@@ -292,10 +292,10 @@ func Test_generateCertHostnames(t *testing.T) {
 			},
 		},
 		{
-			name:  "with some other namespace",
+			name:      "with some other namespace",
 			namespace: "somecluster",
 			hostname:  "kotsadm.default.svc.cluster.local",
-			altNames : []string{
+			altNames: []string{
 				"kotsadm",
 				"kotsadm.default",
 				"kotsadm.default.svc",

kurl_proxy/skaffold.Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21-bookworm
+FROM golang:1.22-bookworm
 
 ENV PROJECTPATH=/go/src/github.com/replicatedhq/kots/kurl_proxy
 WORKDIR $PROJECTPATH