Merge pull request #101 from jeessy2/master

fix: Add a new parameter "create_namespace"

.github/ISSUE_TEMPLATE/bug_report.md

@@ -7,6 +7,9 @@ assignees: ''
 
 ---
 
+**My drone-helm3 and drone versions:**
+<!-- e.g. drone-helm3 0.9.0, drone 1.6.0-->
+
 **What I tried to do:**
 <!-- e.g. run a helm installation -->
 

.gitignore

@@ -4,6 +4,7 @@
 *.dll
 *.so
 *.dylib
+*.swp
 
 .idea
 
@@ -17,3 +18,5 @@
 # vendor/
 .env
 .secrets
+
+build/*

Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine/helm:3.0.2
+FROM alpine/helm:3.2.4
 MAINTAINER Erin Call <erin@liffft.com>
 
 COPY build/drone-helm /bin/drone-helm

cmd/drone-helm/main.go

@@ -5,11 +5,12 @@ import (
 	"os"
 
 	_ "github.com/joho/godotenv/autoload"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"github.com/pelotech/drone-helm3/internal/helm"
 )
 
 func main() {
-	cfg, err := helm.NewConfig(os.Stdout, os.Stderr, os.Args...)
+	cfg, err := env.NewConfig(os.Stdout, os.Stderr)
 
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "%s\n", err.Error())

docs/parameter_reference.md

@@ -1,13 +1,15 @@
 # Parameter reference
 
 ## Global
-| Param name          | Type            | Purpose |
+| Param name          | Type            | Alias        | Purpose |
-|---------------------|-----------------|---------|
+|---------------------|-----------------|--------------|---------|
-| mode                | string          | Indicates the operation to perform. Recommended, but not required. Valid options are `upgrade`, `uninstall`, `lint`, and `help`. |
+| mode                | string          | helm_command | Indicates the operation to perform. Recommended, but not required. Valid options are `upgrade`, `uninstall`, `lint`, and `help`. |
-| update_dependencies | boolean         | Calls `helm dependency update` before running the main command.|
+| update_dependencies | boolean         |              | Calls `helm dependency update` before running the main command.|
-| add_repos           | list\<string\>  | Calls `helm repo add $repo` before running the main command. Each string should be formatted as `repo_name=https://repo.url/`. |
+| add_repos           | list\<string\>  | helm_repos   | Calls `helm repo add $repo` before running the main command. Each string should be formatted as `repo_name=https://repo.url/`. |
-| namespace           | string          | Kubernetes namespace to use for this operation. |
+| repo_certificate    | string          |              | Base64 encoded TLS certificate for a chart repository. |
-| debug               | boolean         | Generate debug output within drone-helm3 and pass `--debug` to all helm commands. Use with care, since the debug output may include secrets. |
+| repo_ca_certificate | string          |              | Base64 encoded TLS certificate for a chart repository certificate authority. |
+| namespace           | string          |              | Kubernetes namespace to use for this operation. |
+| debug               | boolean         |              | Generate debug output within drone-helm3 and pass `--debug` to all helm commands. Use with care, since the debug output may include secrets. |
 
 ## Linting
 
@@ -25,43 +27,47 @@ Linting is only triggered when the `mode` setting is "lint".
 
 Installations are triggered when the `mode` setting is "upgrade." They can also be triggered when the build was triggered by a `push`, `tag`, `deployment`, `pull_request`, `promote`, or `rollback` Drone event.
 
-| Param name             | Type           | Required | Purpose |
+| Param name             | Type           | Required | Alias                  | Purpose |
-|------------------------|----------------|----------|---------|
+|------------------------|----------------|----------|------------------------|---------|
-| chart                  | string         | yes      | The chart to use for this installation. |
+| chart                  | string         | yes      |                        | The chart to use for this installation. |
-| release                | string         | yes      | The release name for helm to use. |
+| release                | string         | yes      |                        | The release name for helm to use. |
-| kube_api_server        | string         | yes      | API endpoint for the Kubernetes cluster. |
+| skip_kubeconfig        | boolean        |          |                        | Whether to skip kubeconfig file creation. |
-| kube_token             | string         | yes      | Token for authenticating to Kubernetes. |
+| kube_api_server        | string         | yes      | api_server             | API endpoint for the Kubernetes cluster. This is ignored if `skip_kubeconfig` is `true`. |
-| kube_service_account   | string         |          | Service account for authenticating to Kubernetes. Default is `helm`. |
+| kube_token             | string         | yes      | kubernetes_token       | Token for authenticating to Kubernetes. This is ignored if `skip_kubeconfig` is `true`. |
-| kube_certificate       | string         |          | Base64 encoded TLS certificate used by the Kubernetes cluster's certificate authority. |
+| kube_service_account   | string         |          | service_account        | Service account for authenticating to Kubernetes. Default is `helm`. This is ignored if `skip_kubeconfig` is `true`. |
-| chart_version          | string         |          | Specific chart version to install. |
+| kube_certificate       | string         |          | kubernetes_certificate | Base64 encoded TLS certificate used by the Kubernetes cluster's certificate authority. This is ignored if `skip_kubeconfig` is `true`. |
-| dry_run                | boolean        |          | Pass `--dry-run` to `helm upgrade`. |
+| chart_version          | string         |          |                        | Specific chart version to install. |
-| wait_for_upgrade       | boolean        |          | Wait until kubernetes resources are in a ready state before marking the installation successful. |
+| dry_run                | boolean        |          |                        | Pass `--dry-run` to `helm upgrade`. |
-| timeout                | duration       |          | Timeout for any *individual* Kubernetes operation. The installation's full runtime may exceed this duration. |
+| dependencies_action    | string         |          |                        | Calls `helm dependency build` OR `helm dependency update` before running the main command. Possible values: `build`, `update`. |
-| force_upgrade          | boolean        |          | Pass `--force` to `helm upgrade`. |
+| wait_for_upgrade       | boolean        |          | wait                   | Wait until kubernetes resources are in a ready state before marking the installation successful. |
-| atomic_upgrade         | boolean        |          | Pass `--atomic` to `helm upgrade`. |
+| timeout                | duration       |          |                        | Timeout for any *individual* Kubernetes operation. The installation's full runtime may exceed this duration. |
-| cleanup_failed_upgrade | boolean        |          | Pass `--cleanup-on-fail` to `helm upgrade`. |
+| force_upgrade          | boolean        |          | force                  | Pass `--force` to `helm upgrade`. |
-| values                 | list\<string\> |          | Chart values to use as the `--set` argument to `helm upgrade`. |
+| atomic_upgrade         | boolean        |          |                        | Pass `--atomic` to `helm upgrade`. |
-| string_values          | list\<string\> |          | Chart values to use as the `--set-string` argument to `helm upgrade`. |
+| cleanup_failed_upgrade | boolean        |          |                        | Pass `--cleanup-on-fail` to `helm upgrade`. |
-| values_files           | list\<string\> |          | Values to use as `--values` arguments to `helm upgrade`. |
+| values                 | list\<string\> |          |                        | Chart values to use as the `--set` argument to `helm upgrade`. |
-| reuse_values           | boolean        |          | Reuse the values from a previous release. |
+| string_values          | list\<string\> |          |                        | Chart values to use as the `--set-string` argument to `helm upgrade`. |
-| skip_tls_verify        | boolean        |          | Connect to the Kubernetes cluster without checking for a valid TLS certificate. Not recommended in production. |
+| values_files           | list\<string\> |          |                        | Values to use as `--values` arguments to `helm upgrade`. |
+| reuse_values           | boolean        |          |                        | Reuse the values from a previous release. |
+| skip_tls_verify        | boolean        |          |                        | Connect to the Kubernetes cluster without checking for a valid TLS certificate. Not recommended in production. This is ignored if `skip_kubeconfig` is `true`. |
+| create_namespace       | boolean        |          |                        | Pass --create-namespace to `helm upgrade`. |
 
 ## Uninstallation
 
 Uninstallations are triggered when the `mode` setting is "uninstall" or "delete." They can also be triggered when the build was triggered by a `delete` Drone event.
 
-| Param name             | Type     | Required | Purpose |
+| Param name             | Type     | Required | Alias                  | Purpose |
-|------------------------|----------|----------|---------|
+|------------------------|----------|----------|------------------------|---------|
-| release                | string   | yes      | The release name for helm to use. |
+| release                | string   | yes      |                        | The release name for helm to use. |
-| kube_api_server        | string   | yes      | API endpoint for the Kubernetes cluster. |
+| skip_kubeconfig        | boolean  |          |                        | Whether to skip kubeconfig file creation. |
-| kube_token             | string   | yes      | Token for authenticating to Kubernetes. |
+| kube_api_server        | string   | yes      | api_server             | API endpoint for the Kubernetes cluster. This is ignored if `skip_kubeconfig` is `true`. |
-| kube_service_account   | string   |          | Service account for authenticating to Kubernetes. Default is `helm`. |
+| kube_token             | string   | yes      | kubernetes_token       | Token for authenticating to Kubernetes. This is ignored if `skip_kubeconfig` is `true`. |
-| kube_certificate       | string   |          | Base64 encoded TLS certificate used by the Kubernetes cluster's certificate authority. |
+| kube_service_account   | string   |          | service_account        | Service account for authenticating to Kubernetes. Default is `helm`. This is ignored if `skip_kubeconfig` is `true`. |
-| keep_history           | boolean  |          | Pass `--keep-history` to `helm uninstall`, to retain the release history. |
+| kube_certificate       | string   |          | kubernetes_certificate | Base64 encoded TLS certificate used by the Kubernetes cluster's certificate authority. This is ignored if `skip_kubeconfig` is `true`. |
-| dry_run                | boolean  |          | Pass `--dry-run` to `helm uninstall`. |
+| keep_history           | boolean  |          |                        | Pass `--keep-history` to `helm uninstall`, to retain the release history. |
-| timeout                | duration |          | Timeout for any *individual* Kubernetes operation. The uninstallation's full runtime may exceed this duration. |
+| dry_run                | boolean  |          |                        | Pass `--dry-run` to `helm uninstall`. |
-| skip_tls_verify        | boolean  |          | Connect to the Kubernetes cluster without checking for a valid TLS certificate. Not recommended in production. |
+| timeout                | duration |          |                        | Timeout for any *individual* Kubernetes operation. The uninstallation's full runtime may exceed this duration. |
-| chart                  | string   |          | Required when the global `update_dependencies` parameter is true. No effect otherwise. |
+| skip_tls_verify        | boolean  |          |                        | Connect to the Kubernetes cluster without checking for a valid TLS certificate. Not recommended in production. This is ignored if `skip_kubeconfig` is `true`. |
+| chart                  | string   |          |                        | Required when the global `update_dependencies` parameter is true. No effect otherwise. |
 
 ### Where to put settings
 
@@ -92,3 +98,38 @@ Note that **list members must not contain commas**. Both of the following are eq
 values_files: [ "./over_9,000.yml" ]
 values_files: [ "./over_9", "000.yml" ]
 ```
+
+### Interpolating secrets into the `values`, `string_values` and `add_repos` settings
+
+If you want to send secrets to your charts, you can use syntax similar to shell variable interpolation--either `$VARNAME` or `$${VARNAME}`. The double dollar-sign is necessary when using curly brackets; using curly brackets with a single dollar-sign will trigger Drone's string substitution (which can't use arbitrary environment variables). If an environment variable is not set, it will be treated as if it were set to the empty string.
+
+```yaml
+environment:
+  DB_PASSWORD:
+    from_secret: db_password
+  SESSION_KEY:
+    from_secret: session_key
+settings:
+  values:
+    - db_password=$DB_PASSWORD    # db_password will be set to the contents of the db_password secret
+    - db_pass=$DB_PASS            # db_pass will be set to "" since $DB_PASS is not set
+    - session_key=$${SESSION_KEY} # session_key will be set to the contents of the session_key secret
+    - sess_key=${SESSION_KEY}     # sess_key will be set to "" by Drone's variable substitution
+```
+
+Variables intended for interpolation must be set in the `environment` section, not `settings`.
+
+### Backward-compatibility aliases
+
+Some settings have alternate names, for backward-compatibility with drone-helm. We recommend using the canonical name unless you require the backward-compatible form.
+
+| Canonical name       | Alias |
+|----------------------|-------|
+| mode                 | helm_command |
+| add_repos            | helm_repos |
+| kube_api_server      | api_server |
+| kube_service_account | service_account |
+| kube_token           | kubernetes_token |
+| kube_certificate     | kubernetes_certificate |
+| wait_for_upgrade     | wait |
+| force_upgrade        | force |

go.mod

@@ -5,7 +5,9 @@ go 1.13
 require (
 	github.com/golang/mock v1.3.1
 	github.com/joho/godotenv v1.3.0
+	github.com/kelseyhightower/envconfig v1.4.0
 	github.com/stretchr/testify v1.4.0
-	github.com/urfave/cli/v2 v2.1.1
+	golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f // indirect
+	golang.org/x/tools v0.0.0-20191209225234-22774f7dae43 // indirect
 	gopkg.in/yaml.v2 v2.2.2
 )

go.sum

@@ -1,30 +1,33 @@
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d h1:U+s90UTSYgptZMwQh2aRr3LuazLJIa+Pg3Kc1ylSYVY=
-github.com/cpuguy83/go-md2man/v2 v2.0.0-20190314233015-f79a8a8ca69d/go.mod h1:maD7wRr/U5Z6m/iR4s+kqSMx2CaBsrgA7czyZG/E6dU=
 github.com/davecgh/go-spew v1.1.0 h1:ZDRjVQ15GmhC3fiQ8ni8+OwkZQO4DARzQgrnXU1Liz8=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/golang/mock v1.3.1 h1:qGJ6qTW+x6xX/my+8YUVl4WNpX9B7+/l2tRsHGZ7f2s=
 github.com/golang/mock v1.3.1/go.mod h1:sBzyDLLjw3U8JLTeZvSv8jJB+tU5PVekmnlKIyFUx0Y=
 github.com/joho/godotenv v1.3.0 h1:Zjp+RcGpHhGlrMbJzXTrZZPrWj+1vfm90La1wgB6Bhc=
 github.com/joho/godotenv v1.3.0/go.mod h1:7hK45KPybAkOC6peb+G5yklZfMxEjkZhHbwpqxOKXbg=
+github.com/kelseyhightower/envconfig v1.4.0 h1:Im6hONhd3pLkfDFsbRgu68RDNkGF1r3dvMUtDTo2cv8=
+github.com/kelseyhightower/envconfig v1.4.0/go.mod h1:cccZRl6mQpaq41TPp5QxidR+Sa3axMbJDNb//FQX6Gg=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/russross/blackfriday/v2 v2.0.1 h1:lPqVAte+HuHNfhJ/0LC98ESWRz8afy9tM/0RK8m9o+Q=
-github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shurcooL/sanitized_anchor_name v1.0.0 h1:PdmoCO6wvbs+7yrJyMORt4/BmY5IYyJwS/kOiWx8mHo=
-github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
 github.com/stretchr/testify v1.4.0 h1:2E4SXV/wtOkTonXsotYi4li6zVWxYlZuYNCXe9XRJyk=
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
-github.com/urfave/cli/v2 v2.1.1 h1:Qt8FeAtxE/vfdrLmR3rxR6JRE0RoVmbXu8+6kZtYU4k=
-github.com/urfave/cli/v2 v2.1.1/go.mod h1:SE9GqnLQmjVa0iPEY0f1w3ygNIYcIJ0OKPMoW2caLfQ=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
+golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f h1:J5lckAjkw6qYlOZNj90mLYNTEKDvWeuc1yieZ8qUzUE=
+golang.org/x/lint v0.0.0-20191125180803-fdd1cda4f05f/go.mod h1:5qLYkcX4OjUUV8bRuDixDT3tpyyb+LUpUlRWLxfhWrs=
 golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262 h1:qsl9y/CJx34tuA7QCPNp86JNJe4spst6Ff8MjvPUdPg=
 golang.org/x/tools v0.0.0-20190425150028-36563e24a262/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
+golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f h1:kDxGY2VmgABOe55qheT/TFqUMtcTHnomIPS1iv3G4Ms=
+golang.org/x/tools v0.0.0-20191125144606-a911d9008d1f/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191206204035-259af5ff87bd h1:Zc7EU2PqpsNeIfOoVA7hvQX4cS3YDJEs5KlfatT3hLo=
+golang.org/x/tools v0.0.0-20191206204035-259af5ff87bd/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/tools v0.0.0-20191209225234-22774f7dae43 h1:NfPq5mgc5ArFgVLCpeS4z07IoxSAqVfV/gQ5vxdgaxI=
+golang.org/x/tools v0.0.0-20191209225234-22774f7dae43/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
+golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=

internal/env/config.go

@@ -0,0 +1,168 @@
+package env
+
+import (
+	"fmt"
+	"io"
+	"os"
+	"regexp"
+	"strings"
+
+	"github.com/kelseyhightower/envconfig"
+)
+
+var (
+	justNumbers    = regexp.MustCompile(`^\d+$`)
+	deprecatedVars = []string{"PURGE", "RECREATE_PODS", "TILLER_NS", "UPGRADE", "CANARY_IMAGE", "CLIENT_ONLY", "STABLE_REPO_URL"}
+)
+
+// The Config struct captures the `settings` and `environment` blocks in the application's drone
+// config. Configuration in drone's `settings` block arrives as uppercase env vars matching the
+// config key, prefixed with `PLUGIN_`. Config from the `environment` block is uppercased, but does
+// not have the `PLUGIN_` prefix.
+type Config struct {
+	// Configuration for drone-helm itself
+	Command            string   `envconfig:"mode"`                   // Helm command to run
+	DroneEvent         string   `envconfig:"drone_build_event"`      // Drone event that invoked this plugin.
+	UpdateDependencies bool     `split_words:"true"`                 // [Deprecated] Call `helm dependency update` before the main command (deprecated, use dependencies_action: update instead)
+	DependenciesAction string   `split_words:"true"`                 // Call `helm dependency build` or `helm dependency update` before the main command
+	AddRepos           []string `split_words:"true"`                 // Call `helm repo add` before the main command
+	RepoCertificate    string   `envconfig:"repo_certificate"`       // The Helm chart repository's self-signed certificate (must be base64-encoded)
+	RepoCACertificate  string   `envconfig:"repo_ca_certificate"`    // The Helm chart repository CA's self-signed certificate (must be base64-encoded)
+	Debug              bool     ``                                   // Generate debug output and pass --debug to all helm commands
+	Values             string   ``                                   // Argument to pass to --set in applicable helm commands
+	StringValues       string   `split_words:"true"`                 // Argument to pass to --set-string in applicable helm commands
+	ValuesFiles        []string `split_words:"true"`                 // Arguments to pass to --values in applicable helm commands
+	Namespace          string   ``                                   // Kubernetes namespace for all helm commands
+	CreateNamespace    bool     `split_words:"true"`                 // Pass --create-namespace to `helm upgrade`
+	KubeToken          string   `split_words:"true"`                 // Kubernetes authentication token to put in .kube/config
+	SkipKubeconfig     bool     `envconfig:"skip_kubeconfig"`        // Skip kubeconfig creation
+	SkipTLSVerify      bool     `envconfig:"skip_tls_verify"`        // Put insecure-skip-tls-verify in .kube/config
+	Certificate        string   `envconfig:"kube_certificate"`       // The Kubernetes cluster CA's self-signed certificate (must be base64-encoded)
+	APIServer          string   `envconfig:"kube_api_server"`        // The Kubernetes cluster's API endpoint
+	ServiceAccount     string   `envconfig:"kube_service_account"`   // Account to use for connecting to the Kubernetes cluster
+	ChartVersion       string   `split_words:"true"`                 // Specific chart version to use in `helm upgrade`
+	DryRun             bool     `split_words:"true"`                 // Pass --dry-run to applicable helm commands
+	Wait               bool     `envconfig:"wait_for_upgrade"`       // Pass --wait to applicable helm commands
+	ReuseValues        bool     `split_words:"true"`                 // Pass --reuse-values to `helm upgrade`
+	KeepHistory        bool     `split_words:"true"`                 // Pass --keep-history to `helm uninstall`
+	Timeout            string   ``                                   // Argument to pass to --timeout in applicable helm commands
+	Chart              string   ``                                   // Chart argument to use in applicable helm commands
+	Release            string   ``                                   // Release argument to use in applicable helm commands
+	Force              bool     `envconfig:"force_upgrade"`          // Pass --force to applicable helm commands
+	AtomicUpgrade      bool     `split_words:"true"`                 // Pass --atomic to `helm upgrade`
+	CleanupOnFail      bool     `envconfig:"cleanup_failed_upgrade"` // Pass --cleanup-on-fail to `helm upgrade`
+	LintStrictly       bool     `split_words:"true"`                 // Pass --strict to `helm lint`
+
+	Stdout io.Writer `ignored:"true"`
+	Stderr io.Writer `ignored:"true"`
+}
+
+// NewConfig creates a Config and reads environment variables into it, accounting for several possible formats.
+func NewConfig(stdout, stderr io.Writer) (*Config, error) {
+	var aliases settingAliases
+	if err := envconfig.Process("plugin", &aliases); err != nil {
+		return nil, err
+	}
+
+	if err := envconfig.Process("", &aliases); err != nil {
+		return nil, err
+	}
+
+	cfg := Config{
+		Command:        aliases.Command,
+		AddRepos:       aliases.AddRepos,
+		APIServer:      aliases.APIServer,
+		ServiceAccount: aliases.ServiceAccount,
+		Wait:           aliases.Wait,
+		Force:          aliases.Force,
+		KubeToken:      aliases.KubeToken,
+		Certificate:    aliases.Certificate,
+
+		Stdout: stdout,
+		Stderr: stderr,
+	}
+	if err := envconfig.Process("plugin", &cfg); err != nil {
+		return nil, err
+	}
+
+	if err := envconfig.Process("", &cfg); err != nil {
+		return nil, err
+	}
+
+	if cfg.SkipKubeconfig {
+		if cfg.KubeToken != "" || cfg.Certificate != "" || cfg.APIServer != "" || cfg.ServiceAccount != "" || cfg.SkipTLSVerify {
+			fmt.Fprintf(cfg.Stderr, "Warning: skip_kubeconfig is set. The following kubeconfig-related settings will be ignored: kube_config, kube_certificate, kube_api_server, kube_service_account, skip_tls_verify.")
+		}
+	}
+
+	if justNumbers.MatchString(cfg.Timeout) {
+		cfg.Timeout = fmt.Sprintf("%ss", cfg.Timeout)
+	}
+
+	cfg.loadValuesSecrets()
+
+	if cfg.Debug && cfg.Stderr != nil {
+		cfg.logDebug()
+	}
+
+	cfg.deprecationWarn()
+
+	return &cfg, nil
+}
+
+func (cfg *Config) loadValuesSecrets() {
+	findVar := regexp.MustCompile(`\$\{?(\w+)\}?`)
+
+	replacer := func(varName string) string {
+		sigils := regexp.MustCompile(`[${}]`)
+		varName = sigils.ReplaceAllString(varName, "")
+
+		if value, ok := os.LookupEnv(varName); ok {
+			return value
+		}
+
+		if cfg.Debug {
+			fmt.Fprintf(cfg.Stderr, "$%s not present in environment, replaced with \"\"\n", varName)
+		}
+		return ""
+	}
+
+	cfg.Values = findVar.ReplaceAllStringFunc(cfg.Values, replacer)
+	cfg.StringValues = findVar.ReplaceAllStringFunc(cfg.StringValues, replacer)
+
+	for i := 0; i < len(cfg.AddRepos); i++ {
+		cfg.AddRepos[i] = findVar.ReplaceAllStringFunc(cfg.AddRepos[i], replacer)
+	}
+}
+
+func (cfg Config) logDebug() {
+	if cfg.KubeToken != "" {
+		cfg.KubeToken = "(redacted)"
+	}
+	fmt.Fprintf(cfg.Stderr, "Generated config: %+v\n", cfg)
+}
+
+func (cfg *Config) deprecationWarn() {
+	for _, varname := range deprecatedVars {
+		_, barePresent := os.LookupEnv(varname)
+		_, prefixedPresent := os.LookupEnv("PLUGIN_" + varname)
+		if barePresent || prefixedPresent {
+			fmt.Fprintf(cfg.Stderr, "Warning: ignoring deprecated '%s' setting\n", strings.ToLower(varname))
+		}
+	}
+}
+
+// settingAliases provides alternate environment variable names for certain settings, either because
+// they were renamed during drone-helm3's lifetime or for backward-compatibility with the original
+// drone-helm. Most config options don't need to be included here; adding them to the main Config
+// struct is sufficient.
+type settingAliases struct {
+	Command        string   `envconfig:"helm_command"`
+	AddRepos       []string `envconfig:"helm_repos"`
+	APIServer      string   `envconfig:"api_server"`
+	ServiceAccount string   `split_words:"true"`
+	Wait           bool     ``
+	Force          bool     ``
+	KubeToken      string   `envconfig:"kubernetes_token"`
+	Certificate    string   `envconfig:"kubernetes_certificate"`
+}

internal/env/config_test.go

@@ -0,0 +1,252 @@
+package env
+
+import (
+	"fmt"
+	"os"
+	"strings"
+	"testing"
+
+	"github.com/stretchr/testify/suite"
+)
+
+type ConfigTestSuite struct {
+	suite.Suite
+	// These tests need to mutate the environment, so the suite.setenv and .unsetenv functions store the original contents of the
+	// relevant variable in this map. Its use of *string is so they can distinguish between "not set" and "set to empty string"
+	envBackup map[string]*string
+}
+
+func TestConfigTestSuite(t *testing.T) {
+	suite.Run(t, new(ConfigTestSuite))
+}
+
+func (suite *ConfigTestSuite) TestNewConfigWithPluginPrefix() {
+	suite.unsetenv("MODE")
+	suite.unsetenv("UPDATE_DEPENDENCIES")
+	suite.unsetenv("DEBUG")
+
+	suite.setenv("PLUGIN_MODE", "iambic")
+	suite.setenv("PLUGIN_UPDATE_DEPENDENCIES", "true")
+	suite.setenv("PLUGIN_DEBUG", "true")
+
+	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{})
+	suite.Require().NoError(err)
+
+	suite.Equal("iambic", cfg.Command)
+	suite.True(cfg.UpdateDependencies)
+	suite.True(cfg.Debug)
+}
+
+func (suite *ConfigTestSuite) TestNewConfigWithNoPrefix() {
+	suite.unsetenv("PLUGIN_MODE")
+	suite.unsetenv("PLUGIN_UPDATE_DEPENDENCIES")
+	suite.unsetenv("PLUGIN_DEBUG")
+
+	suite.setenv("MODE", "iambic")
+	suite.setenv("UPDATE_DEPENDENCIES", "true")
+	suite.setenv("DEBUG", "true")
+
+	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{})
+	suite.Require().NoError(err)
+
+	suite.Equal("iambic", cfg.Command)
+	suite.True(cfg.UpdateDependencies)
+	suite.True(cfg.Debug)
+}
+
+func (suite *ConfigTestSuite) TestNewConfigWithConflictingVariables() {
+	suite.setenv("PLUGIN_MODE", "iambic")
+	suite.setenv("MODE", "haiku") // values from the `environment` block override those from `settings`
+
+	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{})
+	suite.Require().NoError(err)
+
+	suite.Equal("haiku", cfg.Command)
+}
+
+func (suite *ConfigTestSuite) TestNewConfigInfersNumbersAreSeconds() {
+	suite.setenv("PLUGIN_TIMEOUT", "42")
+	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{})
+	suite.Require().NoError(err)
+	suite.Equal("42s", cfg.Timeout)
+}
+
+func (suite *ConfigTestSuite) TestNewConfigWithAliases() {
+	for _, varname := range []string{
+		"MODE",
+		"ADD_REPOS",
+		"KUBE_API_SERVER",
+		"KUBE_SERVICE_ACCOUNT",
+		"WAIT_FOR_UPGRADE",
+		"FORCE_UPGRADE",
+		"KUBE_TOKEN",
+		"KUBE_CERTIFICATE",
+	} {
+		suite.unsetenv(varname)
+		suite.unsetenv("PLUGIN_" + varname)
+	}
+	suite.setenv("PLUGIN_HELM_COMMAND", "beware the jabberwock")
+	suite.setenv("PLUGIN_HELM_REPOS", "chortle=http://calloo.callay/frabjous/day")
+	suite.setenv("PLUGIN_API_SERVER", "http://tumtum.tree")
+	suite.setenv("PLUGIN_SERVICE_ACCOUNT", "tulgey")
+	suite.setenv("PLUGIN_WAIT", "true")
+	suite.setenv("PLUGIN_FORCE", "true")
+	suite.setenv("PLUGIN_KUBERNETES_TOKEN", "Y29tZSB0byBteSBhcm1z")
+	suite.setenv("PLUGIN_KUBERNETES_CERTIFICATE", "d2l0aCBpdHMgaGVhZA==")
+
+	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{})
+	suite.Require().NoError(err)
+	suite.Equal("beware the jabberwock", cfg.Command)
+	suite.Equal([]string{"chortle=http://calloo.callay/frabjous/day"}, cfg.AddRepos)
+	suite.Equal("http://tumtum.tree", cfg.APIServer)
+	suite.Equal("tulgey", cfg.ServiceAccount)
+	suite.True(cfg.Wait, "Wait should be aliased")
+	suite.True(cfg.Force, "Force should be aliased")
+	suite.Equal("Y29tZSB0byBteSBhcm1z", cfg.KubeToken, "KubeToken should be aliased")
+	suite.Equal("d2l0aCBpdHMgaGVhZA==", cfg.Certificate, "Certificate should be aliased")
+}
+
+func (suite *ConfigTestSuite) TestAliasedSettingWithoutPluginPrefix() {
+	suite.unsetenv("FORCE_UPGRADE")
+	suite.unsetenv("PLUGIN_FORCE_UPGRADE")
+	suite.unsetenv("PLUGIN_FORCE")
+	suite.setenv("FORCE", "true")
+
+	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{})
+	suite.Require().NoError(err)
+	suite.True(cfg.Force)
+}
+
+func (suite *ConfigTestSuite) TestNewConfigWithAliasConflicts() {
+	suite.unsetenv("FORCE_UPGRADE")
+	suite.setenv("PLUGIN_FORCE", "true")
+	suite.setenv("PLUGIN_FORCE_UPGRADE", "false") // should override even when set to the zero value
+
+	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{})
+	suite.NoError(err)
+	suite.False(cfg.Force, "official names should override alias names")
+}
+
+func (suite *ConfigTestSuite) TestNewConfigSetsWriters() {
+	stdout := &strings.Builder{}
+	stderr := &strings.Builder{}
+	cfg, err := NewConfig(stdout, stderr)
+	suite.Require().NoError(err)
+
+	suite.Equal(stdout, cfg.Stdout)
+	suite.Equal(stderr, cfg.Stderr)
+}
+
+func (suite *ConfigTestSuite) TestDeprecatedSettingWarnings() {
+	for _, varname := range deprecatedVars {
+		suite.setenv(varname, "deprecoat") // environment-block entries should cause warnings
+	}
+
+	suite.unsetenv("PURGE")
+	suite.setenv("PLUGIN_PURGE", "true") // settings-block entries should cause warnings
+	suite.setenv("UPGRADE", "")          // entries should cause warnings even when set to empty string
+
+	stderr := &strings.Builder{}
+	_, err := NewConfig(&strings.Builder{}, stderr)
+	suite.NoError(err)
+
+	for _, varname := range deprecatedVars {
+		suite.Contains(stderr.String(), fmt.Sprintf("Warning: ignoring deprecated '%s' setting\n", strings.ToLower(varname)))
+	}
+}
+
+func (suite *ConfigTestSuite) TestLogDebug() {
+	suite.setenv("DEBUG", "true")
+	suite.setenv("MODE", "upgrade")
+
+	stderr := strings.Builder{}
+	stdout := strings.Builder{}
+	_, err := NewConfig(&stdout, &stderr)
+	suite.Require().NoError(err)
+
+	suite.Equal("", stdout.String())
+
+	suite.Regexp(`^Generated config: \{Command:upgrade.*\}`, stderr.String())
+}
+
+func (suite *ConfigTestSuite) TestLogDebugCensorsKubeToken() {
+	stderr := &strings.Builder{}
+	kubeToken := "I'm shy! Don't put me in your build logs!"
+	cfg := Config{
+		Debug:     true,
+		KubeToken: kubeToken,
+		Stderr:    stderr,
+	}
+
+	cfg.logDebug()
+
+	suite.Contains(stderr.String(), "KubeToken:(redacted)")
+	suite.Equal(kubeToken, cfg.KubeToken) // The actual config value should be left unchanged
+}
+
+func (suite *ConfigTestSuite) TestNewConfigWithValuesSecrets() {
+	suite.unsetenv("VALUES")
+	suite.unsetenv("STRING_VALUES")
+	suite.unsetenv("SECRET_WATER")
+	suite.setenv("SECRET_FIRE", "Eru_Ilúvatar")
+	suite.setenv("SECRET_RINGS", "1")
+	suite.setenv("PLUGIN_VALUES", "fire=$SECRET_FIRE,water=${SECRET_WATER}")
+	suite.setenv("PLUGIN_STRING_VALUES", "rings=${SECRET_RINGS}")
+	suite.setenv("PLUGIN_ADD_REPOS", "testrepo=https://user:${SECRET_FIRE}@testrepo.test")
+
+	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{})
+	suite.Require().NoError(err)
+
+	suite.Equal("fire=Eru_Ilúvatar,water=", cfg.Values)
+	suite.Equal("rings=1", cfg.StringValues)
+	suite.Equal(fmt.Sprintf("testrepo=https://user:%s@testrepo.test", os.Getenv("SECRET_FIRE")), cfg.AddRepos[0])
+}
+
+func (suite *ConfigTestSuite) TestValuesSecretsWithDebugLogging() {
+	suite.unsetenv("VALUES")
+	suite.unsetenv("SECRET_WATER")
+	suite.setenv("SECRET_FIRE", "Eru_Ilúvatar")
+	suite.setenv("PLUGIN_DEBUG", "true")
+	suite.setenv("PLUGIN_STRING_VALUES", "fire=$SECRET_FIRE")
+	suite.setenv("PLUGIN_VALUES", "fire=$SECRET_FIRE,water=$SECRET_WATER")
+	stderr := strings.Builder{}
+	_, err := NewConfig(&strings.Builder{}, &stderr)
+	suite.Require().NoError(err)
+
+	suite.Contains(stderr.String(), "Values:fire=Eru_Ilúvatar,water=")
+	suite.Contains(stderr.String(), `$SECRET_WATER not present in environment, replaced with ""`)
+}
+
+func (suite *ConfigTestSuite) setenv(key, val string) {
+	orig, ok := os.LookupEnv(key)
+	if ok {
+		suite.envBackup[key] = &orig
+	} else {
+		suite.envBackup[key] = nil
+	}
+	os.Setenv(key, val)
+}
+
+func (suite *ConfigTestSuite) unsetenv(key string) {
+	orig, ok := os.LookupEnv(key)
+	if ok {
+		suite.envBackup[key] = &orig
+	} else {
+		suite.envBackup[key] = nil
+	}
+	os.Unsetenv(key)
+}
+
+func (suite *ConfigTestSuite) BeforeTest(_, _ string) {
+	suite.envBackup = make(map[string]*string)
+}
+
+func (suite *ConfigTestSuite) AfterTest(_, _ string) {
+	for key, val := range suite.envBackup {
+		if val == nil {
+			os.Unsetenv(key)
+		} else {
+			os.Setenv(key, *val)
+		}
+	}
+}

internal/helm/config.go

@@ -1,237 +0,0 @@
-package helm
-
-import (
-	"fmt"
-	"github.com/urfave/cli/v2"
-	"io"
-	"os"
-	"regexp"
-	"strings"
-)
-
-var (
-	justNumbers    = regexp.MustCompile(`^\d+$`)
-	deprecatedVars = []string{"PURGE", "RECREATE_PODS", "TILLER_NS", "UPGRADE", "CANARY_IMAGE", "CLIENT_ONLY", "STABLE_REPO_URL"}
-)
-
-// The Config struct captures the `settings` and `environment` blocks in the application's drone
-// config. Configuration in drone's `settings` block arrives as uppercase env vars matching the
-// config key, prefixed with `PLUGIN_`. Config from the `environment` block is uppercased, but does
-// not have the `PLUGIN_` prefix.
-type Config struct {
-	// Configuration for drone-helm itself
-	Command            string   // Helm command to run
-	DroneEvent         string   // Drone event that invoked this plugin.
-	UpdateDependencies bool     // Call `helm dependency update` before the main command
-	AddRepos           []string // Call `helm repo add` before the main command
-	Debug              bool     // Generate debug output and pass --debug to all helm commands
-	Values             string   // Argument to pass to --set in applicable helm commands
-	StringValues       string   // Argument to pass to --set-string in applicable helm commands
-	ValuesFiles        []string // Arguments to pass to --values in applicable helm commands
-	Namespace          string   // Kubernetes namespace for all helm commands
-	KubeToken          string   // Kubernetes authentication token to put in .kube/config
-	SkipTLSVerify      bool     // Put insecure-skip-tls-verify in .kube/config
-	Certificate        string   // The Kubernetes cluster CA's self-signed certificate (must be base64-encoded)
-	APIServer          string   // The Kubernetes cluster's API endpoint
-	ServiceAccount     string   // Account to use for connecting to the Kubernetes cluster
-	ChartVersion       string   // Specific chart version to use in `helm upgrade`
-	DryRun             bool     // Pass --dry-run to applicable helm commands
-	Wait               bool     // Pass --wait to applicable helm commands
-	ReuseValues        bool     // Pass --reuse-values to `helm upgrade`
-	KeepHistory        bool     // Pass --keep-history to `helm uninstall`
-	Timeout            string   // Argument to pass to --timeout in applicable helm commands
-	Chart              string   // Chart argument to use in applicable helm commands
-	Release            string   // Release argument to use in applicable helm commands
-	Force              bool     // Pass --force to applicable helm commands
-	AtomicUpgrade      bool     // Pass --atomic to `helm upgrade`
-	CleanupOnFail      bool     // Pass --cleanup-on-fail to `helm upgrade`
-	LintStrictly       bool     // Pass --strict to `helm lint`
-
-	Stdout io.Writer
-	Stderr io.Writer
-}
-
-// NewConfig creates a Config and reads environment variables into it, accounting for several possible formats.
-func NewConfig(stdout, stderr io.Writer, argv ...string) (*Config, error) {
-	cfg := Config{
-		Stdout: stdout,
-		Stderr: stderr,
-	}
-	// cli doesn't support Destination for string slices, so we'll use bare
-	// strings as an intermediate value and split them on commas ourselves.
-	var addRepos, valuesFiles string
-	app := &cli.App{
-		Name:   "drone-helm3",
-		Action: func(*cli.Context) error { return nil },
-		Flags: []cli.Flag{
-			&cli.StringFlag{
-				Name:        "mode",
-				Destination: &cfg.Command,
-				EnvVars:     []string{"MODE", "PLUGIN_MODE", "HELM_COMMAND", "PLUGIN_HELM_COMMAND"},
-			},
-			&cli.StringFlag{
-				Name:        "drone-event",
-				Destination: &cfg.DroneEvent,
-				EnvVars:     []string{"DRONE_BUILD_EVENT"},
-			},
-			&cli.BoolFlag{
-				Name:        "update-dependencies",
-				Destination: &cfg.UpdateDependencies,
-				EnvVars:     []string{"UPDATE_DEPENDENCIES", "PLUGIN_UPDATE_DEPENDENCIES"},
-			},
-			&cli.StringFlag{
-				Name:        "add-repos",
-				Destination: &addRepos,
-				EnvVars:     []string{"ADD_REPOS", "PLUGIN_ADD_REPOS", "HELM_REPOS", "PLUGIN_HELM_REPOS"},
-			},
-			&cli.BoolFlag{
-				Name:        "debug",
-				Destination: &cfg.Debug,
-				EnvVars:     []string{"DEBUG", "PLUGIN_DEBUG"},
-			},
-			&cli.StringFlag{
-				Name:        "values",
-				Destination: &cfg.Values,
-				EnvVars:     []string{"VALUES", "PLUGIN_VALUES"},
-			},
-			&cli.StringFlag{
-				Name:        "string-values",
-				Destination: &cfg.StringValues,
-				EnvVars:     []string{"STRING_VALUES", "PLUGIN_STRING_VALUES"},
-			},
-			&cli.StringFlag{
-				Name:        "values-files",
-				Destination: &valuesFiles,
-				EnvVars:     []string{"VALUES_FILES", "PLUGIN_VALUES_FILES"},
-			},
-			&cli.StringFlag{
-				Name:        "namespace",
-				Destination: &cfg.Namespace,
-				EnvVars:     []string{"NAMESPACE", "PLUGIN_NAMESPACE"},
-			},
-			&cli.StringFlag{
-				Name:        "kube-token",
-				Destination: &cfg.KubeToken,
-				EnvVars:     []string{"KUBE_TOKEN", "PLUGIN_KUBE_TOKEN", "KUBERNETES_TOKEN", "PLUGIN_KUBERNETES_TOKEN"},
-			},
-			&cli.BoolFlag{
-				Name:        "skip-tls-verify",
-				Destination: &cfg.SkipTLSVerify,
-				EnvVars:     []string{"SKIP_TLS_VERIFY", "PLUGIN_SKIP_TLS_VERIFY"},
-			},
-			&cli.StringFlag{
-				Name:        "kube-certificate",
-				Destination: &cfg.Certificate,
-				EnvVars:     []string{"KUBE_CERTIFICATE", "PLUGIN_KUBE_CERTIFICATE", "KUBERNETES_CERTIFICATE", "PLUGIN_KUBERNETES_CERTIFICATE"},
-			},
-			&cli.StringFlag{
-				Name:        "kube-api-server",
-				Destination: &cfg.APIServer,
-				EnvVars:     []string{"KUBE_API_SERVER", "PLUGIN_KUBE_API_SERVER", "API_SERVER", "PLUGIN_API_SERVER"},
-			},
-			&cli.StringFlag{
-				Name:        "service-account",
-				Destination: &cfg.ServiceAccount,
-				EnvVars:     []string{"KUBE_SERVICE_ACCOUNT", "PLUGIN_KUBE_SERVICE_ACCOUNT", "SERVICE_ACCOUNT", "PLUGIN_SERVICE_ACCOUNT"},
-			},
-			&cli.StringFlag{
-				Name:        "chart-version",
-				Destination: &cfg.ChartVersion,
-				EnvVars:     []string{"CHART_VERSION", "PLUGIN_CHART_VERSION"},
-			},
-			&cli.BoolFlag{
-				Name:        "dry-run",
-				Destination: &cfg.DryRun,
-				EnvVars:     []string{"DRY_RUN", "PLUGIN_DRY_RUN"},
-			},
-			&cli.BoolFlag{
-				Name:        "wait-for-upgrade",
-				Destination: &cfg.Wait,
-				EnvVars:     []string{"WAIT_FOR_UPGRADE", "PLUGIN_WAIT_FOR_UPGRADE", "WAIT", "PLUGIN_WAIT"},
-			},
-			&cli.BoolFlag{
-				Name:        "reuse-values",
-				Destination: &cfg.ReuseValues,
-				EnvVars:     []string{"REUSE_VALUES", "PLUGIN_REUSE_VALUES"},
-			},
-			&cli.BoolFlag{
-				Name:        "keep-history",
-				Destination: &cfg.KeepHistory,
-				EnvVars:     []string{"KEEP_HISTORY", "PLUGIN_KEEP_HISTORY"},
-			},
-			&cli.StringFlag{
-				Name:        "timeout",
-				Destination: &cfg.Timeout,
-				EnvVars:     []string{"TIMEOUT", "PLUGIN_TIMEOUT"},
-			},
-			&cli.StringFlag{
-				Name:        "chart",
-				Destination: &cfg.Chart,
-				EnvVars:     []string{"CHART", "PLUGIN_CHART"},
-			},
-			&cli.StringFlag{
-				Name:        "release",
-				Destination: &cfg.Release,
-				EnvVars:     []string{"RELEASE", "PLUGIN_RELEASE"},
-			},
-			&cli.BoolFlag{
-				Name:        "force-upgrade",
-				Destination: &cfg.Force,
-				EnvVars:     []string{"FORCE_UPGRADE", "PLUGIN_FORCE_UPGRADE", "FORCE", "PLUGIN_FORCE"},
-			},
-			&cli.BoolFlag{
-				Name:        "atomic-upgrade",
-				Destination: &cfg.AtomicUpgrade,
-				EnvVars:     []string{"ATOMIC_UPGRADE", "PLUGIN_ATOMIC_UPGRADE"},
-			},
-			&cli.BoolFlag{
-				Name:        "cleanup-failed-upgrade",
-				Destination: &cfg.CleanupOnFail,
-				EnvVars:     []string{"CLEANUP_FAILED_UPGRADE", "PLUGIN_CLEANUP_FAILED_UPGRADE"},
-			},
-			&cli.BoolFlag{
-				Name:        "lint-strictly",
-				Destination: &cfg.LintStrictly,
-				EnvVars:     []string{"LINT_STRICTLY", "PLUGIN_LINT_STRICTLY"},
-			},
-		},
-	}
-	if err := app.Run(argv); err != nil {
-		return nil, err
-	}
-	if addRepos != "" {
-		cfg.AddRepos = strings.Split(addRepos, ",")
-	}
-	if valuesFiles != "" {
-		cfg.ValuesFiles = strings.Split(valuesFiles, ",")
-	}
-
-	if justNumbers.MatchString(cfg.Timeout) {
-		cfg.Timeout = fmt.Sprintf("%ss", cfg.Timeout)
-	}
-
-	if cfg.Debug && cfg.Stderr != nil {
-		cfg.logDebug()
-	}
-
-	cfg.deprecationWarn()
-
-	return &cfg, nil
-}
-
-func (cfg Config) logDebug() {
-	if cfg.KubeToken != "" {
-		cfg.KubeToken = "(redacted)"
-	}
-	fmt.Fprintf(cfg.Stderr, "Generated config: %+v\n", cfg)
-}
-
-func (cfg *Config) deprecationWarn() {
-	for _, varname := range deprecatedVars {
-		_, barePresent := os.LookupEnv(varname)
-		_, prefixedPresent := os.LookupEnv("PLUGIN_" + varname)
-		if barePresent || prefixedPresent {
-			fmt.Fprintf(cfg.Stderr, "Warning: ignoring deprecated '%s' setting\n", strings.ToLower(varname))
-		}
-	}
-}

internal/helm/config_test.go

@@ -1,410 +0,0 @@
-package helm
-
-import (
-	"fmt"
-	"github.com/stretchr/testify/suite"
-	"os"
-	"strings"
-	"testing"
-)
-
-type ConfigTestSuite struct {
-	suite.Suite
-	// These tests need to mutate the environment, so the suite.setenv and .unsetenv functions store the original contents of the
-	// relevant variable in this map. Its use of *string is so they can distinguish between "not set" and "set to empty string"
-	envBackup map[string]*string
-}
-
-func TestConfigTestSuite(t *testing.T) {
-	suite.Run(t, new(ConfigTestSuite))
-}
-
-func (suite *ConfigTestSuite) TestNewConfigWithPluginPrefix() {
-	stdout := strings.Builder{}
-	stderr := strings.Builder{}
-	for _, varname := range []string{
-		"MODE",
-		"DRONE_BUILD_EVENT",
-		"HELM_COMMAND",
-		"PLUGIN_HELM_COMMAND",
-		"UPDATE_DEPENDENCIES",
-		"ADD_REPOS",
-		"HELM_REPOS",
-		"PLUGIN_HELM_REPOS",
-		"DEBUG",
-		"VALUES",
-		"STRING_VALUES",
-		"VALUES_FILES",
-		"NAMESPACE",
-		"KUBE_TOKEN",
-		"KUBERNETES_TOKEN",
-		"PLUGIN_KUBERNETES_TOKEN",
-		"SKIP_TLS_VERIFY",
-		"KUBE_CERTIFICATE",
-		"KUBERNETES_CERTIFICATE",
-		"PLUGIN_KUBERNETES_CERTIFICATE",
-		"KUBE_API_SERVER",
-		"API_SERVER",
-		"PLUGIN_API_SERVER",
-		"KUBE_SERVICE_ACCOUNT",
-		"SERVICE_ACCOUNT",
-		"PLUGIN_SERVICE_ACCOUNT",
-		"CHART_VERSION",
-		"DRY_RUN",
-		"WAIT_FOR_UPGRADE",
-		"WAIT",
-		"PLUGIN_WAIT",
-		"REUSE_VALUES",
-		"KEEP_HISTORY",
-		"TIMEOUT",
-		"CHART",
-		"RELEASE",
-		"FORCE",
-		"FORCE_UPGRADE",
-		"PLUGIN_FORCE_UPGRADE",
-		"ATOMIC_UPGRADE",
-		"CLEANUP_FAILED_UPGRADE",
-		"LINT_STRICTLY",
-	} {
-		suite.unsetenv(varname)
-	}
-
-	suite.setenv("PLUGIN_MODE", "upgrade")
-	suite.setenv("PLUGIN_UPDATE_DEPENDENCIES", "true")
-	suite.setenv("PLUGIN_ADD_REPOS", "foo=http://bar,goo=http://baz")
-	suite.setenv("PLUGIN_DEBUG", "true")
-	suite.setenv("PLUGIN_VALUES", "dog=husky")
-	suite.setenv("PLUGIN_STRING_VALUES", "version=1.0")
-	suite.setenv("PLUGIN_VALUES_FILES", "underrides.yml,overrides.yml")
-	suite.setenv("PLUGIN_NAMESPACE", "myapp")
-	suite.setenv("PLUGIN_KUBE_TOKEN", "cGxlYXNlIHNpciwgbGV0IG1lIGlu")
-	suite.setenv("PLUGIN_SKIP_TLS_VERIFY", "true")
-	suite.setenv("PLUGIN_KUBE_CERTIFICATE", "SSBhbSB0b3RhbGx5IHRoZSBzZXJ2ZXIgeW91IHdhbnQ=")
-	suite.setenv("PLUGIN_KUBE_API_SERVER", "http://my.kube/cluster")
-	suite.setenv("PLUGIN_KUBE_SERVICE_ACCOUNT", "deploybot")
-	suite.setenv("PLUGIN_CHART_VERSION", "six")
-	suite.setenv("PLUGIN_DRY_RUN", "true")
-	suite.setenv("PLUGIN_WAIT_FOR_UPGRADE", "true")
-	suite.setenv("PLUGIN_REUSE_VALUES", "true")
-	suite.setenv("PLUGIN_KEEP_HISTORY", "true")
-	suite.setenv("PLUGIN_TIMEOUT", "5m20s")
-	suite.setenv("PLUGIN_CHART", "./helm/myapp/")
-	suite.setenv("PLUGIN_RELEASE", "my_app")
-	suite.setenv("PLUGIN_FORCE_UPGRADE", "true")
-	suite.setenv("PLUGIN_ATOMIC_UPGRADE", "true")
-	suite.setenv("PLUGIN_CLEANUP_FAILED_UPGRADE", "true")
-	suite.setenv("PLUGIN_LINT_STRICTLY", "true")
-
-	cfg, err := NewConfig(&stdout, &stderr, "test")
-	suite.Require().NoError(err)
-
-	want := Config{
-		Command:            "upgrade",
-		DroneEvent:         "",
-		UpdateDependencies: true,
-		AddRepos:           []string{"foo=http://bar", "goo=http://baz"},
-		Debug:              true,
-		Values:             "dog=husky",
-		StringValues:       "version=1.0",
-		ValuesFiles:        []string{"underrides.yml", "overrides.yml"},
-		Namespace:          "myapp",
-		KubeToken:          "cGxlYXNlIHNpciwgbGV0IG1lIGlu",
-		SkipTLSVerify:      true,
-		Certificate:        "SSBhbSB0b3RhbGx5IHRoZSBzZXJ2ZXIgeW91IHdhbnQ=",
-		APIServer:          "http://my.kube/cluster",
-		ServiceAccount:     "deploybot",
-		ChartVersion:       "six",
-		DryRun:             true,
-		Wait:               true,
-		ReuseValues:        true,
-		KeepHistory:        true,
-		Timeout:            "5m20s",
-		Chart:              "./helm/myapp/",
-		Release:            "my_app",
-		Force:              true,
-		AtomicUpgrade:      true,
-		CleanupOnFail:      true,
-		LintStrictly:       true,
-		Stdout:             &stdout,
-		Stderr:             &stderr,
-	}
-
-	suite.Equal(&want, cfg)
-}
-
-func (suite *ConfigTestSuite) TestNewConfigWithNoPrefix() {
-	stdout := strings.Builder{}
-	stderr := strings.Builder{}
-	for _, varname := range []string{
-		"PLUGIN_MODE",
-		"PLUGIN_HELM_COMMAND",
-		"HELM_COMMAND",
-		"PLUGIN_UPDATE_DEPENDENCIES",
-		"PLUGIN_ADD_REPOS",
-		"PLUGIN_HELM_REPOS",
-		"HELM_REPOS",
-		"PLUGIN_DEBUG",
-		"PLUGIN_VALUES",
-		"PLUGIN_STRING_VALUES",
-		"PLUGIN_VALUES_FILES",
-		"PLUGIN_NAMESPACE",
-		"PLUGIN_KUBE_TOKEN",
-		"PLUGIN_KUBERNETES_TOKEN",
-		"KUBERNETES_TOKEN",
-		"PLUGIN_SKIP_TLS_VERIFY",
-		"PLUGIN_KUBE_CERTIFICATE",
-		"PLUGIN_KUBERNETES_CERTIFICATE",
-		"KUBERNETES_CERTIFICATE",
-		"PLUGIN_KUBE_API_SERVER",
-		"PLUGIN_API_SERVER",
-		"API_SERVER",
-		"PLUGIN_KUBE_SERVICE_ACCOUNT",
-		"PLUGIN_SERVICE_ACCOUNT",
-		"SERVICE_ACCOUNT",
-		"PLUGIN_CHART_VERSION",
-		"PLUGIN_DRY_RUN",
-		"PLUGIN_WAIT_FOR_UPGRADE",
-		"PLUGIN_WAIT",
-		"WAIT",
-		"PLUGIN_REUSE_VALUES",
-		"PLUGIN_KEEP_HISTORY",
-		"PLUGIN_TIMEOUT",
-		"PLUGIN_CHART",
-		"PLUGIN_RELEASE",
-		"PLUGIN_FORCE",
-		"PLUGIN_FORCE_UPGRADE",
-		"FORCE_UPGRADE",
-		"PLUGIN_ATOMIC_UPGRADE",
-		"PLUGIN_CLEANUP_FAILED_UPGRADE",
-		"PLUGIN_LINT_STRICTLY",
-	} {
-		suite.unsetenv(varname)
-	}
-
-	suite.setenv("MODE", "upgrade")
-	suite.setenv("DRONE_BUILD_EVENT", "tag")
-	suite.setenv("UPDATE_DEPENDENCIES", "true")
-	suite.setenv("ADD_REPOS", "foo=http://bar,goo=http://baz")
-	suite.setenv("DEBUG", "true")
-	suite.setenv("VALUES", "dog=husky")
-	suite.setenv("STRING_VALUES", "version=1.0")
-	suite.setenv("VALUES_FILES", "underrides.yml,overrides.yml")
-	suite.setenv("NAMESPACE", "myapp")
-	suite.setenv("KUBE_TOKEN", "cGxlYXNlIHNpciwgbGV0IG1lIGlu")
-	suite.setenv("SKIP_TLS_VERIFY", "true")
-	suite.setenv("KUBE_CERTIFICATE", "SSBhbSB0b3RhbGx5IHRoZSBzZXJ2ZXIgeW91IHdhbnQ=")
-	suite.setenv("KUBE_API_SERVER", "http://my.kube/cluster")
-	suite.setenv("KUBE_SERVICE_ACCOUNT", "deploybot")
-	suite.setenv("CHART_VERSION", "six")
-	suite.setenv("DRY_RUN", "true")
-	suite.setenv("WAIT_FOR_UPGRADE", "true")
-	suite.setenv("REUSE_VALUES", "true")
-	suite.setenv("KEEP_HISTORY", "true")
-	suite.setenv("TIMEOUT", "5m20s")
-	suite.setenv("CHART", "./helm/myapp/")
-	suite.setenv("RELEASE", "my_app")
-	suite.setenv("FORCE_UPGRADE", "true")
-	suite.setenv("ATOMIC_UPGRADE", "true")
-	suite.setenv("CLEANUP_FAILED_UPGRADE", "true")
-	suite.setenv("LINT_STRICTLY", "true")
-
-	cfg, err := NewConfig(&stdout, &stderr, "test")
-	suite.Require().NoError(err)
-
-	want := Config{
-		Command:            "upgrade",
-		DroneEvent:         "tag",
-		UpdateDependencies: true,
-		AddRepos:           []string{"foo=http://bar", "goo=http://baz"},
-		Debug:              true,
-		Values:             "dog=husky",
-		StringValues:       "version=1.0",
-		ValuesFiles:        []string{"underrides.yml", "overrides.yml"},
-		Namespace:          "myapp",
-		KubeToken:          "cGxlYXNlIHNpciwgbGV0IG1lIGlu",
-		SkipTLSVerify:      true,
-		Certificate:        "SSBhbSB0b3RhbGx5IHRoZSBzZXJ2ZXIgeW91IHdhbnQ=",
-		APIServer:          "http://my.kube/cluster",
-		ServiceAccount:     "deploybot",
-		ChartVersion:       "six",
-		DryRun:             true,
-		Wait:               true,
-		ReuseValues:        true,
-		KeepHistory:        true,
-		Timeout:            "5m20s",
-		Chart:              "./helm/myapp/",
-		Release:            "my_app",
-		Force:              true,
-		AtomicUpgrade:      true,
-		CleanupOnFail:      true,
-		LintStrictly:       true,
-		Stdout:             &stdout,
-		Stderr:             &stderr,
-	}
-
-	suite.Equal(&want, cfg)
-}
-
-func (suite *ConfigTestSuite) TestNewConfigWithConflictingVariables() {
-	suite.setenv("PLUGIN_MODE", "iambic")
-	suite.setenv("MODE", "haiku") // values from the `environment` block override those from `settings`
-
-	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{}, "test")
-	suite.Require().NoError(err)
-
-	suite.Equal("haiku", cfg.Command)
-}
-
-func (suite *ConfigTestSuite) TestNewConfigInfersNumbersAreSeconds() {
-	suite.setenv("PLUGIN_TIMEOUT", "42")
-	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{}, "test")
-	suite.Require().NoError(err)
-	suite.Equal("42s", cfg.Timeout)
-}
-
-func (suite *ConfigTestSuite) TestNewConfigWithAliases() {
-	for _, varname := range []string{
-		"MODE",
-		"ADD_REPOS",
-		"KUBE_API_SERVER",
-		"KUBE_SERVICE_ACCOUNT",
-		"WAIT_FOR_UPGRADE",
-		"FORCE_UPGRADE",
-		"KUBE_TOKEN",
-		"KUBE_CERTIFICATE",
-	} {
-		suite.unsetenv(varname)
-		suite.unsetenv("PLUGIN_" + varname)
-	}
-	suite.setenv("PLUGIN_HELM_COMMAND", "beware the jabberwock")
-	suite.setenv("PLUGIN_HELM_REPOS", "chortle=http://calloo.callay/frabjous/day")
-	suite.setenv("PLUGIN_API_SERVER", "http://tumtum.tree")
-	suite.setenv("PLUGIN_SERVICE_ACCOUNT", "tulgey")
-	suite.setenv("PLUGIN_WAIT", "true")
-	suite.setenv("PLUGIN_FORCE", "true")
-	suite.setenv("PLUGIN_KUBERNETES_TOKEN", "Y29tZSB0byBteSBhcm1z")
-	suite.setenv("PLUGIN_KUBERNETES_CERTIFICATE", "d2l0aCBpdHMgaGVhZA==")
-
-	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{}, "test")
-	suite.Require().NoError(err)
-	suite.Equal("beware the jabberwock", cfg.Command)
-	suite.Equal([]string{"chortle=http://calloo.callay/frabjous/day"}, cfg.AddRepos)
-	suite.Equal("http://tumtum.tree", cfg.APIServer)
-	suite.Equal("tulgey", cfg.ServiceAccount)
-	suite.True(cfg.Wait, "Wait should be aliased")
-	suite.True(cfg.Force, "Force should be aliased")
-	suite.Equal("Y29tZSB0byBteSBhcm1z", cfg.KubeToken, "KubeToken should be aliased")
-	suite.Equal("d2l0aCBpdHMgaGVhZA==", cfg.Certificate, "Certificate should be aliased")
-}
-
-func (suite *ConfigTestSuite) TestAliasedSettingWithoutPluginPrefix() {
-	suite.unsetenv("FORCE_UPGRADE")
-	suite.unsetenv("PLUGIN_FORCE_UPGRADE")
-	suite.unsetenv("PLUGIN_FORCE")
-	suite.setenv("FORCE", "true")
-
-	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{}, "test")
-	suite.Require().NoError(err)
-	suite.True(cfg.Force)
-}
-
-func (suite *ConfigTestSuite) TestNewConfigWithAliasConflicts() {
-	suite.unsetenv("FORCE_UPGRADE")
-	suite.setenv("PLUGIN_FORCE", "true")
-	suite.setenv("PLUGIN_FORCE_UPGRADE", "false") // should override even when set to the zero value
-
-	cfg, err := NewConfig(&strings.Builder{}, &strings.Builder{}, "test")
-	suite.NoError(err)
-	suite.False(cfg.Force, "official names should override alias names")
-}
-
-func (suite *ConfigTestSuite) TestNewConfigSetsWriters() {
-	stdout := &strings.Builder{}
-	stderr := &strings.Builder{}
-	cfg, err := NewConfig(stdout, stderr, "test")
-	suite.Require().NoError(err)
-
-	suite.Equal(stdout, cfg.Stdout)
-	suite.Equal(stderr, cfg.Stderr)
-}
-
-func (suite *ConfigTestSuite) TestDeprecatedSettingWarnings() {
-	for _, varname := range deprecatedVars {
-		suite.setenv(varname, "deprecoat") // environment-block entries should cause warnings
-	}
-
-	suite.unsetenv("PURGE")
-	suite.setenv("PLUGIN_PURGE", "true") // settings-block entries should cause warnings
-	suite.setenv("UPGRADE", "")          // entries should cause warnings even when set to empty string
-
-	stderr := &strings.Builder{}
-	_, err := NewConfig(&strings.Builder{}, stderr, "test")
-	suite.NoError(err)
-
-	for _, varname := range deprecatedVars {
-		suite.Contains(stderr.String(), fmt.Sprintf("Warning: ignoring deprecated '%s' setting\n", strings.ToLower(varname)))
-	}
-}
-
-func (suite *ConfigTestSuite) TestLogDebug() {
-	suite.setenv("DEBUG", "true")
-	suite.setenv("MODE", "upgrade")
-
-	stderr := strings.Builder{}
-	stdout := strings.Builder{}
-	_, err := NewConfig(&stdout, &stderr, "test")
-	suite.Require().NoError(err)
-
-	suite.Equal("", stdout.String())
-
-	suite.Regexp(`^Generated config: \{Command:upgrade.*\}`, stderr.String())
-}
-
-func (suite *ConfigTestSuite) TestLogDebugCensorsKubeToken() {
-	stderr := &strings.Builder{}
-	kubeToken := "I'm shy! Don't put me in your build logs!"
-	cfg := Config{
-		Debug:     true,
-		KubeToken: kubeToken,
-		Stderr:    stderr,
-	}
-
-	cfg.logDebug()
-
-	suite.Contains(stderr.String(), "KubeToken:(redacted)")
-	suite.Equal(kubeToken, cfg.KubeToken) // The actual config value should be left unchanged
-}
-
-func (suite *ConfigTestSuite) setenv(key, val string) {
-	orig, ok := os.LookupEnv(key)
-	if ok {
-		suite.envBackup[key] = &orig
-	} else {
-		suite.envBackup[key] = nil
-	}
-	os.Setenv(key, val)
-}
-
-func (suite *ConfigTestSuite) unsetenv(key string) {
-	orig, ok := os.LookupEnv(key)
-	if ok {
-		suite.envBackup[key] = &orig
-	} else {
-		suite.envBackup[key] = nil
-	}
-	os.Unsetenv(key)
-}
-
-func (suite *ConfigTestSuite) BeforeTest(_, _ string) {
-	suite.envBackup = make(map[string]*string)
-}
-
-func (suite *ConfigTestSuite) AfterTest(_, _ string) {
-	for key, val := range suite.envBackup {
-		if val == nil {
-			os.Unsetenv(key)
-		} else {
-			os.Setenv(key, *val)
-		}
-	}
-}

internal/helm/mock_step_test.go

@@ -6,7 +6,6 @@ package helm
 
 import (
 	gomock "github.com/golang/mock/gomock"
-	run "github.com/pelotech/drone-helm3/internal/run"
 	reflect "reflect"
 )
 
@@ -34,29 +33,29 @@ func (m *MockStep) EXPECT() *MockStepMockRecorder {
 }
 
 // Prepare mocks base method
-func (m *MockStep) Prepare(arg0 run.Config) error {
+func (m *MockStep) Prepare() error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Prepare", arg0)
+	ret := m.ctrl.Call(m, "Prepare")
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // Prepare indicates an expected call of Prepare
-func (mr *MockStepMockRecorder) Prepare(arg0 interface{}) *gomock.Call {
+func (mr *MockStepMockRecorder) Prepare() *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Prepare", reflect.TypeOf((*MockStep)(nil).Prepare), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Prepare", reflect.TypeOf((*MockStep)(nil).Prepare))
 }
 
 // Execute mocks base method
-func (m *MockStep) Execute(arg0 run.Config) error {
+func (m *MockStep) Execute() error {
 	m.ctrl.T.Helper()
-	ret := m.ctrl.Call(m, "Execute", arg0)
+	ret := m.ctrl.Call(m, "Execute")
 	ret0, _ := ret[0].(error)
 	return ret0
 }
 
 // Execute indicates an expected call of Execute
-func (mr *MockStepMockRecorder) Execute(arg0 interface{}) *gomock.Call {
+func (mr *MockStepMockRecorder) Execute() *gomock.Call {
 	mr.mock.ctrl.T.Helper()
-	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Execute", reflect.TypeOf((*MockStep)(nil).Execute), arg0)
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "Execute", reflect.TypeOf((*MockStep)(nil).Execute))
 }

internal/helm/plan.go

@@ -1,7 +1,9 @@
 package helm
 
 import (
+	"errors"
 	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"github.com/pelotech/drone-helm3/internal/run"
 	"os"
 )
@@ -13,27 +15,24 @@ const (
 
 // A Step is one step in the plan.
 type Step interface {
-	Prepare(run.Config) error
+	Prepare() error
-	Execute(run.Config) error
+	Execute() error
 }
 
 // A Plan is a series of steps to perform.
 type Plan struct {
-	steps  []Step
+	steps []Step
-	cfg    Config
+	cfg   env.Config
-	runCfg run.Config
 }
 
 // NewPlan makes a plan for running a helm operation.
-func NewPlan(cfg Config) (*Plan, error) {
+func NewPlan(cfg env.Config) (*Plan, error) {
 	p := Plan{
 		cfg: cfg,
-		runCfg: run.Config{
+	}
-			Debug:     cfg.Debug,
+
-			Namespace: cfg.Namespace,
+	if cfg.UpdateDependencies && cfg.DependenciesAction != "" {
-			Stdout:    cfg.Stdout,
+		return nil, errors.New("update_dependencies is deprecated and cannot be provided together with dependencies_action")
-			Stderr:    cfg.Stderr,
-		},
 	}
 
 	p.steps = (*determineSteps(cfg))(cfg)
@@ -43,7 +42,7 @@ func NewPlan(cfg Config) (*Plan, error) {
 			fmt.Fprintf(os.Stderr, "calling %T.Prepare (step %d)\n", step, i)
 		}
 
-		if err := step.Prepare(p.runCfg); err != nil {
+		if err := step.Prepare(); err != nil {
 			err = fmt.Errorf("while preparing %T step: %w", step, err)
 			return nil, err
 		}
@@ -54,7 +53,7 @@ func NewPlan(cfg Config) (*Plan, error) {
 
 // determineSteps is primarily for the tests' convenience: it allows testing the "which stuff should
 // we do" logic without building a config that meets all the steps' requirements.
-func determineSteps(cfg Config) *func(Config) []Step {
+func determineSteps(cfg env.Config) *func(env.Config) []Step {
 	switch cfg.Command {
 	case "upgrade":
 		return &upgrade
@@ -83,7 +82,7 @@ func (p *Plan) Execute() error {
 			fmt.Fprintf(p.cfg.Stderr, "calling %T.Execute (step %d)\n", step, i)
 		}
 
-		if err := step.Execute(p.runCfg); err != nil {
+		if err := step.Execute(); err != nil {
 			return fmt.Errorf("while executing %T step: %w", step, err)
 		}
 	}
@@ -91,97 +90,53 @@ func (p *Plan) Execute() error {
 	return nil
 }
 
-var upgrade = func(cfg Config) []Step {
+var upgrade = func(cfg env.Config) []Step {
-	steps := initKube(cfg)
+	var steps []Step
-	steps = append(steps, addRepos(cfg)...)
+	if !cfg.SkipKubeconfig {
-	if cfg.UpdateDependencies {
+		steps = append(steps, run.NewInitKube(cfg, kubeConfigTemplate, kubeConfigFile))
-		steps = append(steps, depUpdate(cfg)...)
 	}
-	steps = append(steps, &run.Upgrade{
-		Chart:         cfg.Chart,
-		Release:       cfg.Release,
-		ChartVersion:  cfg.ChartVersion,
-		DryRun:        cfg.DryRun,
-		Wait:          cfg.Wait,
-		Values:        cfg.Values,
-		StringValues:  cfg.StringValues,
-		ValuesFiles:   cfg.ValuesFiles,
-		ReuseValues:   cfg.ReuseValues,
-		Timeout:       cfg.Timeout,
-		Force:         cfg.Force,
-		Atomic:        cfg.AtomicUpgrade,
-		CleanupOnFail: cfg.CleanupOnFail,
-	})
-
-	return steps
-}
-
-var uninstall = func(cfg Config) []Step {
-	steps := initKube(cfg)
-	if cfg.UpdateDependencies {
-		steps = append(steps, depUpdate(cfg)...)
-	}
-	steps = append(steps, &run.Uninstall{
-		Release:     cfg.Release,
-		DryRun:      cfg.DryRun,
-		KeepHistory: cfg.KeepHistory,
-	})
-
-	return steps
-}
-
-var lint = func(cfg Config) []Step {
-	steps := addRepos(cfg)
-	if cfg.UpdateDependencies {
-		steps = append(steps, depUpdate(cfg)...)
-	}
-	steps = append(steps, &run.Lint{
-		Chart:        cfg.Chart,
-		Values:       cfg.Values,
-		StringValues: cfg.StringValues,
-		ValuesFiles:  cfg.ValuesFiles,
-		Strict:       cfg.LintStrictly,
-	})
-
-	return steps
-}
-
-var help = func(cfg Config) []Step {
-	help := &run.Help{
-		HelmCommand: cfg.Command,
-	}
-	return []Step{help}
-}
-
-func initKube(cfg Config) []Step {
-	return []Step{
-		&run.InitKube{
-			SkipTLSVerify:  cfg.SkipTLSVerify,
-			Certificate:    cfg.Certificate,
-			APIServer:      cfg.APIServer,
-			ServiceAccount: cfg.ServiceAccount,
-			Token:          cfg.KubeToken,
-			TemplateFile:   kubeConfigTemplate,
-			ConfigFile:     kubeConfigFile,
-		},
-	}
-}
-
-func addRepos(cfg Config) []Step {
-	steps := make([]Step, 0)
 	for _, repo := range cfg.AddRepos {
-		steps = append(steps, &run.AddRepo{
+		steps = append(steps, run.NewAddRepo(cfg, repo))
-			Repo: repo,
-		})
 	}
 
+	if cfg.DependenciesAction != "" {
+		steps = append(steps, run.NewDepAction(cfg))
+	}
+
+	if cfg.UpdateDependencies {
+		steps = append(steps, run.NewDepUpdate(cfg))
+	}
+
+	steps = append(steps, run.NewUpgrade(cfg))
+
 	return steps
 }
 
-func depUpdate(cfg Config) []Step {
+var uninstall = func(cfg env.Config) []Step {
-	return []Step{
+	var steps []Step
-		&run.DepUpdate{
+	if !cfg.SkipKubeconfig {
-			Chart: cfg.Chart,
+		steps = append(steps, run.NewInitKube(cfg, kubeConfigTemplate, kubeConfigFile))
-		},
 	}
+	if cfg.UpdateDependencies {
+		steps = append(steps, run.NewDepUpdate(cfg))
+	}
+	steps = append(steps, run.NewUninstall(cfg))
+
+	return steps
+}
+
+var lint = func(cfg env.Config) []Step {
+	var steps []Step
+	for _, repo := range cfg.AddRepos {
+		steps = append(steps, run.NewAddRepo(cfg, repo))
+	}
+	if cfg.UpdateDependencies {
+		steps = append(steps, run.NewDepUpdate(cfg))
+	}
+	steps = append(steps, run.NewLint(cfg))
+	return steps
+}
+
+var help = func(cfg env.Config) []Step {
+	return []Step{run.NewHelp(cfg)}
 }

internal/helm/plan_test.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/pelotech/drone-helm3/internal/env"
 	"github.com/pelotech/drone-helm3/internal/run"
 )
 
@@ -25,14 +26,14 @@ func (suite *PlanTestSuite) TestNewPlan() {
 	stepTwo := NewMockStep(ctrl)
 
 	origHelp := help
-	help = func(cfg Config) []Step {
+	help = func(cfg env.Config) []Step {
 		return []Step{stepOne, stepTwo}
 	}
 	defer func() { help = origHelp }()
 
 	stdout := strings.Builder{}
 	stderr := strings.Builder{}
-	cfg := Config{
+	cfg := env.Config{
 		Command:   "help",
 		Debug:     false,
 		Namespace: "outer",
@@ -40,22 +41,14 @@ func (suite *PlanTestSuite) TestNewPlan() {
 		Stderr:    &stderr,
 	}
 
-	runCfg := run.Config{
-		Debug:     false,
-		Namespace: "outer",
-		Stdout:    &stdout,
-		Stderr:    &stderr,
-	}
-
 	stepOne.EXPECT().
-		Prepare(runCfg)
+		Prepare()
 	stepTwo.EXPECT().
-		Prepare(runCfg)
+		Prepare()
 
 	plan, err := NewPlan(cfg)
 	suite.Require().Nil(err)
 	suite.Equal(cfg, plan.cfg)
-	suite.Equal(runCfg, plan.runCfg)
 }
 
 func (suite *PlanTestSuite) TestNewPlanAbortsOnError() {
@@ -65,17 +58,17 @@ func (suite *PlanTestSuite) TestNewPlanAbortsOnError() {
 	stepTwo := NewMockStep(ctrl)
 
 	origHelp := help
-	help = func(cfg Config) []Step {
+	help = func(cfg env.Config) []Step {
 		return []Step{stepOne, stepTwo}
 	}
 	defer func() { help = origHelp }()
 
-	cfg := Config{
+	cfg := env.Config{
 		Command: "help",
 	}
 
 	stepOne.EXPECT().
-		Prepare(gomock.Any()).
+		Prepare().
 		Return(fmt.Errorf("I'm starry Dave, aye, cat blew that"))
 
 	_, err := NewPlan(cfg)
@@ -89,18 +82,15 @@ func (suite *PlanTestSuite) TestExecute() {
 	stepOne := NewMockStep(ctrl)
 	stepTwo := NewMockStep(ctrl)
 
-	runCfg := run.Config{}
-
 	plan := Plan{
-		steps:  []Step{stepOne, stepTwo},
+		steps: []Step{stepOne, stepTwo},
-		runCfg: runCfg,
 	}
 
 	stepOne.EXPECT().
-		Execute(runCfg).
+		Execute().
 		Times(1)
 	stepTwo.EXPECT().
-		Execute(runCfg).
+		Execute().
 		Times(1)
 
 	suite.NoError(plan.Execute())
@@ -112,15 +102,12 @@ func (suite *PlanTestSuite) TestExecuteAbortsOnError() {
 	stepOne := NewMockStep(ctrl)
 	stepTwo := NewMockStep(ctrl)
 
-	runCfg := run.Config{}
-
 	plan := Plan{
-		steps:  []Step{stepOne, stepTwo},
+		steps: []Step{stepOne, stepTwo},
-		runCfg: runCfg,
 	}
 
 	stepOne.EXPECT().
-		Execute(runCfg).
+		Execute().
 		Times(1).
 		Return(fmt.Errorf("oh, he'll gnaw"))
 
@@ -129,50 +116,20 @@ func (suite *PlanTestSuite) TestExecuteAbortsOnError() {
 }
 
 func (suite *PlanTestSuite) TestUpgrade() {
-	cfg := Config{
+	steps := upgrade(env.Config{})
-		ChartVersion:  "seventeen",
-		DryRun:        true,
-		Wait:          true,
-		Values:        "steadfastness,forthrightness",
-		StringValues:  "tensile_strength,flexibility",
-		ValuesFiles:   []string{"/root/price_inventory.yml"},
-		ReuseValues:   true,
-		Timeout:       "go sit in the corner",
-		Chart:         "billboard_top_100",
-		Release:       "post_malone_circles",
-		Force:         true,
-		AtomicUpgrade: true,
-		CleanupOnFail: true,
-	}
-
-	steps := upgrade(cfg)
 	suite.Require().Equal(2, len(steps), "upgrade should return 2 steps")
-	suite.Require().IsType(&run.InitKube{}, steps[0])
+	suite.IsType(&run.InitKube{}, steps[0])
+	suite.IsType(&run.Upgrade{}, steps[1])
+}
 
-	suite.Require().IsType(&run.Upgrade{}, steps[1])
+func (suite *PlanTestSuite) TestUpgradeWithSkipKubeconfig() {
-	upgrade, _ := steps[1].(*run.Upgrade)
+	steps := upgrade(env.Config{SkipKubeconfig: true})
-
+	suite.Require().Equal(1, len(steps), "upgrade should return 1 step")
-	expected := &run.Upgrade{
+	suite.IsType(&run.Upgrade{}, steps[0])
-		Chart:         cfg.Chart,
-		Release:       cfg.Release,
-		ChartVersion:  cfg.ChartVersion,
-		DryRun:        true,
-		Wait:          cfg.Wait,
-		Values:        "steadfastness,forthrightness",
-		StringValues:  "tensile_strength,flexibility",
-		ValuesFiles:   []string{"/root/price_inventory.yml"},
-		ReuseValues:   cfg.ReuseValues,
-		Timeout:       cfg.Timeout,
-		Force:         cfg.Force,
-		Atomic:        true,
-		CleanupOnFail: true,
-	}
-
-	suite.Equal(expected, upgrade)
 }
 
 func (suite *PlanTestSuite) TestUpgradeWithUpdateDependencies() {
-	cfg := Config{
+	cfg := env.Config{
 		UpdateDependencies: true,
 	}
 	steps := upgrade(cfg)
@@ -182,7 +139,7 @@ func (suite *PlanTestSuite) TestUpgradeWithUpdateDependencies() {
 }
 
 func (suite *PlanTestSuite) TestUpgradeWithAddRepos() {
-	cfg := Config{
+	cfg := env.Config{
 		AddRepos: []string{
 			"machine=https://github.com/harold_finch/themachine",
 		},
@@ -193,47 +150,15 @@ func (suite *PlanTestSuite) TestUpgradeWithAddRepos() {
 }
 
 func (suite *PlanTestSuite) TestUninstall() {
-	cfg := Config{
+	steps := uninstall(env.Config{})
-		KubeToken:      "b2YgbXkgYWZmZWN0aW9u",
-		SkipTLSVerify:  true,
-		Certificate:    "cHJvY2xhaW1zIHdvbmRlcmZ1bCBmcmllbmRzaGlw",
-		APIServer:      "98.765.43.21",
-		ServiceAccount: "greathelm",
-		DryRun:         true,
-		Timeout:        "think about what you did",
-		Release:        "jetta_id_love_to_change_the_world",
-		KeepHistory:    true,
-	}
-
-	steps := uninstall(cfg)
 	suite.Require().Equal(2, len(steps), "uninstall should return 2 steps")
 
-	suite.Require().IsType(&run.InitKube{}, steps[0])
+	suite.IsType(&run.InitKube{}, steps[0])
-	init, _ := steps[0].(*run.InitKube)
+	suite.IsType(&run.Uninstall{}, steps[1])
-	var expected Step = &run.InitKube{
-		SkipTLSVerify:  true,
-		Certificate:    "cHJvY2xhaW1zIHdvbmRlcmZ1bCBmcmllbmRzaGlw",
-		APIServer:      "98.765.43.21",
-		ServiceAccount: "greathelm",
-		Token:          "b2YgbXkgYWZmZWN0aW9u",
-		TemplateFile:   kubeConfigTemplate,
-		ConfigFile:     kubeConfigFile,
-	}
-
-	suite.Equal(expected, init)
-
-	suite.Require().IsType(&run.Uninstall{}, steps[1])
-	actual, _ := steps[1].(*run.Uninstall)
-	expected = &run.Uninstall{
-		Release:     "jetta_id_love_to_change_the_world",
-		DryRun:      true,
-		KeepHistory: true,
-	}
-	suite.Equal(expected, actual)
 }
 
 func (suite *PlanTestSuite) TestUninstallWithUpdateDependencies() {
-	cfg := Config{
+	cfg := env.Config{
 		UpdateDependencies: true,
 	}
 	steps := uninstall(cfg)
@@ -242,91 +167,14 @@ func (suite *PlanTestSuite) TestUninstallWithUpdateDependencies() {
 	suite.IsType(&run.DepUpdate{}, steps[1])
 }
 
-func (suite *PlanTestSuite) TestInitKube() {
-	cfg := Config{
-		KubeToken:      "cXVlZXIgY2hhcmFjdGVyCg==",
-		SkipTLSVerify:  true,
-		Certificate:    "b2Ygd29rZW5lc3MK",
-		APIServer:      "123.456.78.9",
-		ServiceAccount: "helmet",
-	}
-
-	steps := initKube(cfg)
-	suite.Require().Equal(1, len(steps), "initKube should return one step")
-	suite.Require().IsType(&run.InitKube{}, steps[0])
-	init, _ := steps[0].(*run.InitKube)
-
-	expected := &run.InitKube{
-		SkipTLSVerify:  true,
-		Certificate:    "b2Ygd29rZW5lc3MK",
-		APIServer:      "123.456.78.9",
-		ServiceAccount: "helmet",
-		Token:          "cXVlZXIgY2hhcmFjdGVyCg==",
-		TemplateFile:   kubeConfigTemplate,
-		ConfigFile:     kubeConfigFile,
-	}
-	suite.Equal(expected, init)
-}
-
-func (suite *PlanTestSuite) TestDepUpdate() {
-	cfg := Config{
-		UpdateDependencies: true,
-		Chart:              "scatterplot",
-	}
-
-	steps := depUpdate(cfg)
-	suite.Require().Equal(1, len(steps), "depUpdate should return one step")
-	suite.Require().IsType(&run.DepUpdate{}, steps[0])
-	update, _ := steps[0].(*run.DepUpdate)
-
-	expected := &run.DepUpdate{
-		Chart: "scatterplot",
-	}
-	suite.Equal(expected, update)
-}
-
-func (suite *PlanTestSuite) TestAddRepos() {
-	cfg := Config{
-		AddRepos: []string{
-			"first=https://add.repos/one",
-			"second=https://add.repos/two",
-		},
-	}
-	steps := addRepos(cfg)
-	suite.Require().Equal(2, len(steps), "addRepos should add one step per repo")
-	suite.Require().IsType(&run.AddRepo{}, steps[0])
-	suite.Require().IsType(&run.AddRepo{}, steps[1])
-	first := steps[0].(*run.AddRepo)
-	second := steps[1].(*run.AddRepo)
-
-	suite.Equal(first.Repo, "first=https://add.repos/one")
-	suite.Equal(second.Repo, "second=https://add.repos/two")
-}
-
 func (suite *PlanTestSuite) TestLint() {
-	cfg := Config{
+	steps := lint(env.Config{})
-		Chart:        "./flow",
+	suite.Require().Equal(1, len(steps))
-		Values:       "steadfastness,forthrightness",
+	suite.IsType(&run.Lint{}, steps[0])
-		StringValues: "tensile_strength,flexibility",
-		ValuesFiles:  []string{"/root/price_inventory.yml"},
-		LintStrictly: true,
-	}
-
-	steps := lint(cfg)
-	suite.Equal(1, len(steps))
-
-	want := &run.Lint{
-		Chart:        "./flow",
-		Values:       "steadfastness,forthrightness",
-		StringValues: "tensile_strength,flexibility",
-		ValuesFiles:  []string{"/root/price_inventory.yml"},
-		Strict:       true,
-	}
-	suite.Equal(want, steps[0])
 }
 
 func (suite *PlanTestSuite) TestLintWithUpdateDependencies() {
-	cfg := Config{
+	cfg := env.Config{
 		UpdateDependencies: true,
 	}
 	steps := lint(cfg)
@@ -335,7 +183,7 @@ func (suite *PlanTestSuite) TestLintWithUpdateDependencies() {
 }
 
 func (suite *PlanTestSuite) TestLintWithAddRepos() {
-	cfg := Config{
+	cfg := env.Config{
 		AddRepos: []string{"friendczar=https://github.com/logan_pierce/friendczar"},
 	}
 	steps := lint(cfg)
@@ -344,7 +192,7 @@ func (suite *PlanTestSuite) TestLintWithAddRepos() {
 }
 
 func (suite *PlanTestSuite) TestDeterminePlanUpgradeCommand() {
-	cfg := Config{
+	cfg := env.Config{
 		Command: "upgrade",
 	}
 	stepsMaker := determineSteps(cfg)
@@ -352,7 +200,7 @@ func (suite *PlanTestSuite) TestDeterminePlanUpgradeCommand() {
 }
 
 func (suite *PlanTestSuite) TestDeterminePlanUpgradeFromDroneEvent() {
-	cfg := Config{}
+	cfg := env.Config{}
 
 	upgradeEvents := []string{"push", "tag", "deployment", "pull_request", "promote", "rollback"}
 	for _, event := range upgradeEvents {
@@ -363,7 +211,7 @@ func (suite *PlanTestSuite) TestDeterminePlanUpgradeFromDroneEvent() {
 }
 
 func (suite *PlanTestSuite) TestDeterminePlanUninstallCommand() {
-	cfg := Config{
+	cfg := env.Config{
 		Command: "uninstall",
 	}
 	stepsMaker := determineSteps(cfg)
@@ -372,7 +220,7 @@ func (suite *PlanTestSuite) TestDeterminePlanUninstallCommand() {
 
 // helm_command = delete is provided as an alias for backward-compatibility with drone-helm
 func (suite *PlanTestSuite) TestDeterminePlanDeleteCommand() {
-	cfg := Config{
+	cfg := env.Config{
 		Command: "delete",
 	}
 	stepsMaker := determineSteps(cfg)
@@ -380,7 +228,7 @@ func (suite *PlanTestSuite) TestDeterminePlanDeleteCommand() {
 }
 
 func (suite *PlanTestSuite) TestDeterminePlanDeleteFromDroneEvent() {
-	cfg := Config{
+	cfg := env.Config{
 		DroneEvent: "delete",
 	}
 	stepsMaker := determineSteps(cfg)
@@ -388,7 +236,7 @@ func (suite *PlanTestSuite) TestDeterminePlanDeleteFromDroneEvent() {
 }
 
 func (suite *PlanTestSuite) TestDeterminePlanLintCommand() {
-	cfg := Config{
+	cfg := env.Config{
 		Command: "lint",
 	}
 
@@ -397,7 +245,7 @@ func (suite *PlanTestSuite) TestDeterminePlanLintCommand() {
 }
 
 func (suite *PlanTestSuite) TestDeterminePlanHelpCommand() {
-	cfg := Config{
+	cfg := env.Config{
 		Command: "help",
 	}
 

internal/run/addrepo.go

@@ -2,50 +2,60 @@ package run
 
 import (
 	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"strings"
 )
 
 // AddRepo is an execution step that calls `helm repo add` when executed.
 type AddRepo struct {
-	Repo string
+	*config
-	cmd  cmd
+	repo  string
+	certs *repoCerts
+	cmd   cmd
+}
+
+// NewAddRepo creates an AddRepo for the given repo-spec. No validation is performed at this time.
+func NewAddRepo(cfg env.Config, repo string) *AddRepo {
+	return &AddRepo{
+		config: newConfig(cfg),
+		repo:   repo,
+		certs:  newRepoCerts(cfg),
+	}
 }
 
 // Execute executes the `helm repo add` command.
-func (a *AddRepo) Execute(_ Config) error {
+func (a *AddRepo) Execute() error {
 	return a.cmd.Run()
 }
 
 // Prepare gets the AddRepo ready to execute.
-func (a *AddRepo) Prepare(cfg Config) error {
+func (a *AddRepo) Prepare() error {
-	if a.Repo == "" {
+	if a.repo == "" {
 		return fmt.Errorf("repo is required")
 	}
-	split := strings.SplitN(a.Repo, "=", 2)
+	split := strings.SplitN(a.repo, "=", 2)
 	if len(split) != 2 {
-		return fmt.Errorf("bad repo spec '%s'", a.Repo)
+		return fmt.Errorf("bad repo spec '%s'", a.repo)
+	}
+
+	if err := a.certs.write(); err != nil {
+		return err
 	}
 
 	name := split[0]
 	url := split[1]
 
-	args := make([]string, 0)
+	args := a.globalFlags()
-
+	args = append(args, "repo", "add")
-	if cfg.Namespace != "" {
+	args = append(args, a.certs.flags()...)
-		args = append(args, "--namespace", cfg.Namespace)
+	args = append(args, name, url)
-	}
-	if cfg.Debug {
-		args = append(args, "--debug")
-	}
-
-	args = append(args, "repo", "add", name, url)
 
 	a.cmd = command(helmBin, args...)
-	a.cmd.Stdout(cfg.Stdout)
+	a.cmd.Stdout(a.stdout)
-	a.cmd.Stderr(cfg.Stderr)
+	a.cmd.Stderr(a.stderr)
 
-	if cfg.Debug {
+	if a.debug {
-		fmt.Fprintf(cfg.Stderr, "Generated command: '%s'\n", a.cmd.String())
+		fmt.Fprintf(a.stderr, "Generated command: '%s'\n", a.cmd.String())
 	}
 
 	return nil

internal/run/addrepo_test.go

@@ -1,8 +1,8 @@
 package run
 
 import (
-	"fmt"
 	"github.com/golang/mock/gomock"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"github.com/stretchr/testify/suite"
 	"strings"
 	"testing"
@@ -38,16 +38,22 @@ func TestAddRepoTestSuite(t *testing.T) {
 	suite.Run(t, new(AddRepoTestSuite))
 }
 
+func (suite *AddRepoTestSuite) TestNewAddRepo() {
+	repo := NewAddRepo(env.Config{}, "picompress=https://github.com/caleb_phipps/picompress")
+	suite.Require().NotNil(repo)
+	suite.Equal("picompress=https://github.com/caleb_phipps/picompress", repo.repo)
+	suite.NotNil(repo.config)
+	suite.NotNil(repo.certs)
+}
+
 func (suite *AddRepoTestSuite) TestPrepareAndExecute() {
 	stdout := strings.Builder{}
 	stderr := strings.Builder{}
-	cfg := Config{
+	cfg := env.Config{
 		Stdout: &stdout,
 		Stderr: &stderr,
 	}
-	a := AddRepo{
+	a := NewAddRepo(cfg, "edeath=https://github.com/n_marks/e-death")
-		Repo: "edeath=https://github.com/n_marks/e-death",
-	}
 
 	suite.mockCmd.EXPECT().
 		Stdout(&stdout).
@@ -56,7 +62,7 @@ func (suite *AddRepoTestSuite) TestPrepareAndExecute() {
 		Stderr(&stderr).
 		Times(1)
 
-	suite.Require().NoError(a.Prepare(cfg))
+	suite.Require().NoError(a.Prepare())
 	suite.Equal(helmBin, suite.commandPath)
 	suite.Equal([]string{"repo", "add", "edeath", "https://github.com/n_marks/e-death"}, suite.commandArgs)
 
@@ -64,7 +70,7 @@ func (suite *AddRepoTestSuite) TestPrepareAndExecute() {
 		Run().
 		Times(1)
 
-	suite.Require().NoError(a.Execute(cfg))
+	suite.Require().NoError(a.Execute())
 
 }
 
@@ -72,70 +78,35 @@ func (suite *AddRepoTestSuite) TestPrepareRepoIsRequired() {
 	// These aren't really expected, but allowing them gives clearer test-failure messages
 	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
 	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
-	cfg := Config{}
+	a := NewAddRepo(env.Config{}, "")
-	a := AddRepo{}
 
-	err := a.Prepare(cfg)
+	err := a.Prepare()
 	suite.EqualError(err, "repo is required")
 }
 
 func (suite *AddRepoTestSuite) TestPrepareMalformedRepo() {
-	a := AddRepo{
+	a := NewAddRepo(env.Config{}, "dwim")
-		Repo: "dwim",
+	err := a.Prepare()
-	}
-	err := a.Prepare(Config{})
 	suite.EqualError(err, "bad repo spec 'dwim'")
 }
 
 func (suite *AddRepoTestSuite) TestPrepareWithEqualSignInURL() {
 	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
 	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
-	a := AddRepo{
+	a := NewAddRepo(env.Config{}, "samaritan=https://github.com/arthur_claypool/samaritan?version=2.1")
-		Repo: "samaritan=https://github.com/arthur_claypool/samaritan?version=2.1",
+	suite.NoError(a.Prepare())
-	}
-	suite.NoError(a.Prepare(Config{}))
 	suite.Contains(suite.commandArgs, "https://github.com/arthur_claypool/samaritan?version=2.1")
 }
 
-func (suite *AddRepoTestSuite) TestNamespaceFlag() {
+func (suite *AddRepoTestSuite) TestRepoAddFlags() {
 	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
 	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
-	cfg := Config{
+	cfg := env.Config{}
-		Namespace: "alliteration",
+	a := NewAddRepo(cfg, "machine=https://github.com/harold_finch/themachine")
-	}
-	a := AddRepo{
-		Repo: "edeath=https://github.com/theater_guy/e-death",
-	}
 
-	suite.NoError(a.Prepare(cfg))
+	// inject a ca cert filename so repoCerts won't create any files that we'd have to clean up
-	suite.Equal(suite.commandPath, helmBin)
+	a.certs.caCertFilename = "./helm/reporepo.cert"
-	suite.Equal(suite.commandArgs, []string{"--namespace", "alliteration",
+	suite.NoError(a.Prepare())
-		"repo", "add", "edeath", "https://github.com/theater_guy/e-death"})
+	suite.Equal([]string{"repo", "add", "--ca-file", "./helm/reporepo.cert",
-}
+		"machine", "https://github.com/harold_finch/themachine"}, suite.commandArgs)
-
-func (suite *AddRepoTestSuite) TestDebugFlag() {
-	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
-	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
-
-	stderr := strings.Builder{}
-
-	command = func(path string, args ...string) cmd {
-		suite.mockCmd.EXPECT().
-			String().
-			Return(fmt.Sprintf("%s %s", path, strings.Join(args, " ")))
-
-		return suite.mockCmd
-	}
-
-	cfg := Config{
-		Debug:  true,
-		Stderr: &stderr,
-	}
-	a := AddRepo{
-		Repo: "edeath=https://github.com/the_bug/e-death",
-	}
-
-	suite.Require().NoError(a.Prepare(cfg))
-	suite.Equal(fmt.Sprintf("Generated command: '%s --debug "+
-		"repo add edeath https://github.com/the_bug/e-death'\n", helmBin), stderr.String())
 }

internal/run/config.go

@@ -1,13 +1,33 @@
 package run
 
 import (
+	"github.com/pelotech/drone-helm3/internal/env"
 	"io"
 )
 
-// Config contains configuration applicable to all helm commands
+type config struct {
-type Config struct {
+	debug     bool
-	Debug     bool
+	namespace string
-	Namespace string
+	stdout    io.Writer
-	Stdout    io.Writer
+	stderr    io.Writer
-	Stderr    io.Writer
+}
+
+func newConfig(cfg env.Config) *config {
+	return &config{
+		debug:     cfg.Debug,
+		namespace: cfg.Namespace,
+		stdout:    cfg.Stdout,
+		stderr:    cfg.Stderr,
+	}
+}
+
+func (cfg *config) globalFlags() []string {
+	flags := []string{}
+	if cfg.debug {
+		flags = append(flags, "--debug")
+	}
+	if cfg.namespace != "" {
+		flags = append(flags, "--namespace", cfg.namespace)
+	}
+	return flags
 }

internal/run/config_test.go

@@ -0,0 +1,48 @@
+package run
+
+import (
+	"github.com/pelotech/drone-helm3/internal/env"
+	"github.com/stretchr/testify/suite"
+	"strings"
+	"testing"
+)
+
+type ConfigTestSuite struct {
+	suite.Suite
+}
+
+func TestConfigTestSuite(t *testing.T) {
+	suite.Run(t, new(ConfigTestSuite))
+}
+
+func (suite *ConfigTestSuite) TestNewConfig() {
+	stdout := &strings.Builder{}
+	stderr := &strings.Builder{}
+	envCfg := env.Config{
+		Namespace: "private",
+		Debug:     true,
+		Stdout:    stdout,
+		Stderr:    stderr,
+	}
+	cfg := newConfig(envCfg)
+	suite.Require().NotNil(cfg)
+	suite.Equal(&config{
+		namespace: "private",
+		debug:     true,
+		stdout:    stdout,
+		stderr:    stderr,
+	}, cfg)
+}
+
+func (suite *ConfigTestSuite) TestGlobalFlags() {
+	cfg := config{
+		debug:     true,
+		namespace: "public",
+	}
+	flags := cfg.globalFlags()
+	suite.Equal([]string{"--debug", "--namespace", "public"}, flags)
+
+	cfg = config{}
+	flags = cfg.globalFlags()
+	suite.Equal([]string{}, flags)
+}

internal/run/depaction.go

@@ -0,0 +1,59 @@
+package run
+
+import (
+  "errors"
+  "fmt"
+  "github.com/pelotech/drone-helm3/internal/env"
+)
+
+const (
+  actionBuild  = "build"
+  actionUpdate = "update"
+)
+
+// DepAction is an execution step that calls `helm dependency update` or `helm dependency build` when executed.
+type DepAction struct {
+  *config
+  chart  string
+  cmd    cmd
+  action string
+}
+
+// NewDepAction creates a DepAction using fields from the given Config. No validation is performed at this time.
+func NewDepAction(cfg env.Config) *DepAction {
+  return &DepAction{
+    config: newConfig(cfg),
+    chart:  cfg.Chart,
+    action: cfg.DependenciesAction,
+  }
+}
+
+// Execute executes the `helm upgrade` command.
+func (d *DepAction) Execute() error {
+  return d.cmd.Run()
+}
+
+// Prepare gets the DepAction ready to execute.
+func (d *DepAction) Prepare() error {
+  if d.chart == "" {
+    return fmt.Errorf("chart is required")
+  }
+
+  args := d.globalFlags()
+
+  if d.action != actionBuild && d.action != actionUpdate {
+    return errors.New("unknown dependency_action: " + d.action)
+  }
+
+  args = append(args, "dependency", d.action, d.chart)
+
+  d.cmd = command(helmBin, args...)
+  d.cmd.Stdout(d.stdout)
+  d.cmd.Stderr(d.stderr)
+
+  if d.debug {
+    fmt.Fprintf(d.stderr, "Generated command: '%s'\n", d.cmd.String())
+  }
+
+  return nil
+}

internal/run/depaction_test.go

@@ -0,0 +1,131 @@
+package run
+
+import (
+  "errors"
+  "github.com/golang/mock/gomock"
+  "github.com/pelotech/drone-helm3/internal/env"
+  "github.com/stretchr/testify/suite"
+  "strings"
+  "testing"
+)
+
+type DepActionTestSuite struct {
+  suite.Suite
+  ctrl            *gomock.Controller
+  mockCmd         *Mockcmd
+  originalCommand func(string, ...string) cmd
+}
+
+func (suite *DepActionTestSuite) BeforeTest(_, _ string) {
+  suite.ctrl = gomock.NewController(suite.T())
+  suite.mockCmd = NewMockcmd(suite.ctrl)
+
+  suite.originalCommand = command
+  command = func(path string, args ...string) cmd { return suite.mockCmd }
+}
+
+func (suite *DepActionTestSuite) AfterTest(_, _ string) {
+  command = suite.originalCommand
+}
+
+func TestDepActionTestSuite(t *testing.T) {
+  suite.Run(t, new(DepActionTestSuite))
+}
+
+func (suite *DepActionTestSuite) TestNewDepAction() {
+  cfg := env.Config{
+    Chart: "scatterplot",
+  }
+  d := NewDepAction(cfg)
+  suite.Equal("scatterplot", d.chart)
+}
+
+func (suite *DepActionTestSuite) TestPrepareAndExecuteBuild() {
+  defer suite.ctrl.Finish()
+
+  stdout := strings.Builder{}
+  stderr := strings.Builder{}
+  cfg := env.Config{
+    Chart:              "your_top_songs_2019",
+    Stdout:             &stdout,
+    Stderr:             &stderr,
+    DependenciesAction: "build",
+  }
+
+  command = func(path string, args ...string) cmd {
+    suite.Equal(helmBin, path)
+    suite.Equal([]string{"dependency", "build", "your_top_songs_2019"}, args)
+
+    return suite.mockCmd
+  }
+  suite.mockCmd.EXPECT().
+    Stdout(&stdout)
+  suite.mockCmd.EXPECT().
+    Stderr(&stderr)
+  suite.mockCmd.EXPECT().
+    Run().
+    Times(1)
+
+  d := NewDepAction(cfg)
+
+  suite.Require().NoError(d.Prepare())
+  suite.NoError(d.Execute())
+}
+
+func (suite *DepActionTestSuite) TestPrepareAndExecuteUpdate() {
+  defer suite.ctrl.Finish()
+
+  stdout := strings.Builder{}
+  stderr := strings.Builder{}
+  cfg := env.Config{
+    Chart:              "your_top_songs_2019",
+    Stdout:             &stdout,
+    Stderr:             &stderr,
+    DependenciesAction: "update",
+  }
+
+  command = func(path string, args ...string) cmd {
+    suite.Equal(helmBin, path)
+    suite.Equal([]string{"dependency", "update", "your_top_songs_2019"}, args)
+
+    return suite.mockCmd
+  }
+  suite.mockCmd.EXPECT().
+    Stdout(&stdout)
+  suite.mockCmd.EXPECT().
+    Stderr(&stderr)
+  suite.mockCmd.EXPECT().
+    Run().
+    Times(1)
+
+  d := NewDepAction(cfg)
+
+  suite.Require().NoError(d.Prepare())
+  suite.NoError(d.Execute())
+}
+
+func (suite *DepActionTestSuite) TestPrepareAndExecuteUnknown() {
+  defer suite.ctrl.Finish()
+
+  stdout := strings.Builder{}
+  stderr := strings.Builder{}
+  cfg := env.Config{
+    Chart:              "your_top_songs_2019",
+    Stdout:             &stdout,
+    Stderr:             &stderr,
+    DependenciesAction: "downgrade",
+  }
+
+  d := NewDepAction(cfg)
+  suite.Require().Equal(errors.New("unknown dependency_action: downgrade"), d.Prepare())
+}
+
+func (suite *DepActionTestSuite) TestPrepareChartRequired() {
+  d := NewDepAction(env.Config{})
+
+  suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
+  suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
+
+  err := d.Prepare()
+  suite.EqualError(err, "chart is required")
+}

internal/run/depupdate.go

@@ -2,42 +2,44 @@ package run
 
 import (
 	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
 )
 
 // DepUpdate is an execution step that calls `helm dependency update` when executed.
 type DepUpdate struct {
-	Chart string
+	*config
+	chart string
 	cmd   cmd
 }
 
+// NewDepUpdate creates a DepUpdate using fields from the given Config. No validation is performed at this time.
+func NewDepUpdate(cfg env.Config) *DepUpdate {
+	return &DepUpdate{
+		config: newConfig(cfg),
+		chart:  cfg.Chart,
+	}
+}
+
 // Execute executes the `helm upgrade` command.
-func (d *DepUpdate) Execute(_ Config) error {
+func (d *DepUpdate) Execute() error {
 	return d.cmd.Run()
 }
 
 // Prepare gets the DepUpdate ready to execute.
-func (d *DepUpdate) Prepare(cfg Config) error {
+func (d *DepUpdate) Prepare() error {
-	if d.Chart == "" {
+	if d.chart == "" {
 		return fmt.Errorf("chart is required")
 	}
 
-	args := make([]string, 0)
+	args := d.globalFlags()
-
+	args = append(args, "dependency", "update", d.chart)
-	if cfg.Namespace != "" {
-		args = append(args, "--namespace", cfg.Namespace)
-	}
-	if cfg.Debug {
-		args = append(args, "--debug")
-	}
-
-	args = append(args, "dependency", "update", d.Chart)
 
 	d.cmd = command(helmBin, args...)
-	d.cmd.Stdout(cfg.Stdout)
+	d.cmd.Stdout(d.stdout)
-	d.cmd.Stderr(cfg.Stderr)
+	d.cmd.Stderr(d.stderr)
 
-	if cfg.Debug {
+	if d.debug {
-		fmt.Fprintf(cfg.Stderr, "Generated command: '%s'\n", d.cmd.String())
+		fmt.Fprintf(d.stderr, "Generated command: '%s'\n", d.cmd.String())
 	}
 
 	return nil

internal/run/depupdate_test.go

@@ -1,8 +1,8 @@
 package run
 
 import (
-	"fmt"
 	"github.com/golang/mock/gomock"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"github.com/stretchr/testify/suite"
 	"strings"
 	"testing"
@@ -31,12 +31,21 @@ func TestDepUpdateTestSuite(t *testing.T) {
 	suite.Run(t, new(DepUpdateTestSuite))
 }
 
+func (suite *DepUpdateTestSuite) TestNewDepUpdate() {
+	cfg := env.Config{
+		Chart: "scatterplot",
+	}
+	d := NewDepUpdate(cfg)
+	suite.Equal("scatterplot", d.chart)
+}
+
 func (suite *DepUpdateTestSuite) TestPrepareAndExecute() {
 	defer suite.ctrl.Finish()
 
 	stdout := strings.Builder{}
 	stderr := strings.Builder{}
-	cfg := Config{
+	cfg := env.Config{
+		Chart:  "your_top_songs_2019",
 		Stdout: &stdout,
 		Stderr: &stderr,
 	}
@@ -55,74 +64,18 @@ func (suite *DepUpdateTestSuite) TestPrepareAndExecute() {
 		Run().
 		Times(1)
 
-	d := DepUpdate{
+	d := NewDepUpdate(cfg)
-		Chart: "your_top_songs_2019",
-	}
 
-	suite.Require().NoError(d.Prepare(cfg))
+	suite.Require().NoError(d.Prepare())
-	suite.NoError(d.Execute(cfg))
+	suite.NoError(d.Execute())
-}
-
-func (suite *DepUpdateTestSuite) TestPrepareNamespaceFlag() {
-	defer suite.ctrl.Finish()
-
-	cfg := Config{
-		Namespace: "spotify",
-	}
-
-	command = func(path string, args ...string) cmd {
-		suite.Equal([]string{"--namespace", "spotify", "dependency", "update", "your_top_songs_2019"}, args)
-
-		return suite.mockCmd
-	}
-	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
-	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
-
-	d := DepUpdate{
-		Chart: "your_top_songs_2019",
-	}
-
-	suite.Require().NoError(d.Prepare(cfg))
-}
-
-func (suite *DepUpdateTestSuite) TestPrepareDebugFlag() {
-	defer suite.ctrl.Finish()
-
-	stdout := strings.Builder{}
-	stderr := strings.Builder{}
-	cfg := Config{
-		Debug:  true,
-		Stdout: &stdout,
-		Stderr: &stderr,
-	}
-
-	command = func(path string, args ...string) cmd {
-		suite.mockCmd.EXPECT().
-			String().
-			Return(fmt.Sprintf("%s %s", path, strings.Join(args, " ")))
-
-		return suite.mockCmd
-	}
-	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
-	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
-
-	d := DepUpdate{
-		Chart: "your_top_songs_2019",
-	}
-
-	suite.Require().NoError(d.Prepare(cfg))
-
-	want := fmt.Sprintf("Generated command: '%s --debug dependency update your_top_songs_2019'\n", helmBin)
-	suite.Equal(want, stderr.String())
-	suite.Equal("", stdout.String())
 }
 
 func (suite *DepUpdateTestSuite) TestPrepareChartRequired() {
-	d := DepUpdate{}
+	d := NewDepUpdate(env.Config{})
 
 	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
 	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
 
-	err := d.Prepare(Config{})
+	err := d.Prepare()
 	suite.EqualError(err, "chart is required")
 }

internal/run/help.go

@@ -2,39 +2,47 @@ package run
 
 import (
 	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
 )
 
 // Help is a step in a helm Plan that calls `helm help`.
 type Help struct {
-	HelmCommand string
+	*config
+	helmCommand string
 	cmd         cmd
 }
 
+// NewHelp creates a Help using fields from the given Config. No validation is performed at this time.
+func NewHelp(cfg env.Config) *Help {
+	return &Help{
+		config:      newConfig(cfg),
+		helmCommand: cfg.Command,
+	}
+}
+
 // Execute executes the `helm help` command.
-func (h *Help) Execute(cfg Config) error {
+func (h *Help) Execute() error {
 	if err := h.cmd.Run(); err != nil {
 		return fmt.Errorf("while running '%s': %w", h.cmd.String(), err)
 	}
 
-	if h.HelmCommand == "help" {
+	if h.helmCommand == "help" {
 		return nil
 	}
-	return fmt.Errorf("unknown command '%s'", h.HelmCommand)
+	return fmt.Errorf("unknown command '%s'", h.helmCommand)
 }
 
 // Prepare gets the Help ready to execute.
-func (h *Help) Prepare(cfg Config) error {
+func (h *Help) Prepare() error {
-	args := []string{"help"}
+	args := h.globalFlags()
-	if cfg.Debug {
+	args = append(args, "help")
-		args = append([]string{"--debug"}, args...)
-	}
 
 	h.cmd = command(helmBin, args...)
-	h.cmd.Stdout(cfg.Stdout)
+	h.cmd.Stdout(h.stdout)
-	h.cmd.Stderr(cfg.Stderr)
+	h.cmd.Stderr(h.stderr)
 
-	if cfg.Debug {
+	if h.debug {
-		fmt.Fprintf(cfg.Stderr, "Generated command: '%s'\n", h.cmd.String())
+		fmt.Fprintf(h.stderr, "Generated command: '%s'\n", h.cmd.String())
 	}
 
 	return nil

internal/run/help_test.go

@@ -1,8 +1,8 @@
 package run
 
 import (
-	"fmt"
 	"github.com/golang/mock/gomock"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/suite"
 	"strings"
@@ -17,6 +17,15 @@ func TestHelpTestSuite(t *testing.T) {
 	suite.Run(t, new(HelpTestSuite))
 }
 
+func (suite *HelpTestSuite) TestNewHelp() {
+	cfg := env.Config{
+		Command: "everybody dance NOW!!",
+	}
+	help := NewHelp(cfg)
+	suite.Require().NotNil(help)
+	suite.Equal("everybody dance NOW!!", help.helmCommand)
+}
+
 func (suite *HelpTestSuite) TestPrepare() {
 	ctrl := gomock.NewController(suite.T())
 	defer ctrl.Finish()
@@ -39,13 +48,13 @@ func (suite *HelpTestSuite) TestPrepare() {
 	mCmd.EXPECT().
 		Stderr(&stderr)
 
-	cfg := Config{
+	cfg := env.Config{
 		Stdout: &stdout,
 		Stderr: &stderr,
 	}
 
-	h := Help{}
+	h := NewHelp(cfg)
-	err := h.Prepare(cfg)
+	err := h.Prepare()
 	suite.NoError(err)
 }
 
@@ -53,41 +62,15 @@ func (suite *HelpTestSuite) TestExecute() {
 	ctrl := gomock.NewController(suite.T())
 	defer ctrl.Finish()
 	mCmd := NewMockcmd(ctrl)
-	originalCommand := command
-	command = func(_ string, _ ...string) cmd {
-		return mCmd
-	}
-	defer func() { command = originalCommand }()
 
 	mCmd.EXPECT().
 		Run().
 		Times(2)
 
-	cfg := Config{}
+	help := NewHelp(env.Config{Command: "help"})
-	help := Help{
+	help.cmd = mCmd
-		HelmCommand: "help",
+	suite.NoError(help.Execute())
-		cmd:         mCmd,
-	}
-	suite.NoError(help.Execute(cfg))
 
-	help.HelmCommand = "get down on friday"
+	help.helmCommand = "get down on friday"
-	suite.EqualError(help.Execute(cfg), "unknown command 'get down on friday'")
+	suite.EqualError(help.Execute(), "unknown command 'get down on friday'")
-}
-
-func (suite *HelpTestSuite) TestPrepareDebugFlag() {
-	help := Help{}
-
-	stdout := strings.Builder{}
-	stderr := strings.Builder{}
-	cfg := Config{
-		Debug:  true,
-		Stdout: &stdout,
-		Stderr: &stderr,
-	}
-
-	help.Prepare(cfg)
-
-	want := fmt.Sprintf("Generated command: '%s --debug help'\n", helmBin)
-	suite.Equal(want, stderr.String())
-	suite.Equal("", stdout.String())
 }

internal/run/initkube.go

@@ -3,6 +3,7 @@ package run
 import (
 	"errors"
 	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"io"
 	"os"
 	"text/template"
@@ -10,17 +11,12 @@ import (
 
 // InitKube is a step in a helm Plan that initializes the kubernetes config file.
 type InitKube struct {
-	SkipTLSVerify  bool
+	*config
-	Certificate    string
+	templateFilename string
-	APIServer      string
+	configFilename   string
-	ServiceAccount string
+	template         *template.Template
-	Token          string
+	configFile       io.WriteCloser
-	TemplateFile   string
+	values           kubeValues
-	ConfigFile     string
-
-	template   *template.Template
-	configFile io.WriteCloser
-	values     kubeValues
 }
 
 type kubeValues struct {
@@ -32,58 +28,66 @@ type kubeValues struct {
 	Token          string
 }
 
+// NewInitKube creates a InitKube using the given Config and filepaths. No validation is performed at this time.
+func NewInitKube(cfg env.Config, templateFile, configFile string) *InitKube {
+	return &InitKube{
+		config: newConfig(cfg),
+		values: kubeValues{
+			SkipTLSVerify:  cfg.SkipTLSVerify,
+			Certificate:    cfg.Certificate,
+			APIServer:      cfg.APIServer,
+			Namespace:      cfg.Namespace,
+			ServiceAccount: cfg.ServiceAccount,
+			Token:          cfg.KubeToken,
+		},
+		templateFilename: templateFile,
+		configFilename:   configFile,
+	}
+}
+
 // Execute generates a kubernetes config file from drone-helm3's template.
-func (i *InitKube) Execute(cfg Config) error {
+func (i *InitKube) Execute() error {
-	if cfg.Debug {
+	if i.debug {
-		fmt.Fprintf(cfg.Stderr, "writing kubeconfig file to %s\n", i.ConfigFile)
+		fmt.Fprintf(i.stderr, "writing kubeconfig file to %s\n", i.configFilename)
 	}
 	defer i.configFile.Close()
 	return i.template.Execute(i.configFile, i.values)
 }
 
 // Prepare ensures all required configuration is present and that the config file is writable.
-func (i *InitKube) Prepare(cfg Config) error {
+func (i *InitKube) Prepare() error {
 	var err error
 
-	if i.APIServer == "" {
+	if i.values.APIServer == "" {
 		return errors.New("an API Server is needed to deploy")
 	}
-	if i.Token == "" {
+	if i.values.Token == "" {
 		return errors.New("token is needed to deploy")
 	}
 
-	if i.ServiceAccount == "" {
+	if i.values.ServiceAccount == "" {
-		i.ServiceAccount = "helm"
+		i.values.ServiceAccount = "helm"
 	}
 
-	if cfg.Debug {
+	if i.debug {
-		fmt.Fprintf(cfg.Stderr, "loading kubeconfig template from %s\n", i.TemplateFile)
+		fmt.Fprintf(i.stderr, "loading kubeconfig template from %s\n", i.templateFilename)
 	}
-	i.template, err = template.ParseFiles(i.TemplateFile)
+	i.template, err = template.ParseFiles(i.templateFilename)
 	if err != nil {
 		return fmt.Errorf("could not load kubeconfig template: %w", err)
 	}
 
-	i.values = kubeValues{
+	if i.debug {
-		SkipTLSVerify:  i.SkipTLSVerify,
+		if _, err := os.Stat(i.configFilename); err != nil {
-		Certificate:    i.Certificate,
-		APIServer:      i.APIServer,
-		ServiceAccount: i.ServiceAccount,
-		Token:          i.Token,
-		Namespace:      cfg.Namespace,
-	}
-
-	if cfg.Debug {
-		if _, err := os.Stat(i.ConfigFile); err != nil {
 			// non-nil err here isn't an actual error state; the kubeconfig just doesn't exist
-			fmt.Fprint(cfg.Stderr, "creating ")
+			fmt.Fprint(i.stderr, "creating ")
 		} else {
-			fmt.Fprint(cfg.Stderr, "truncating ")
+			fmt.Fprint(i.stderr, "truncating ")
 		}
-		fmt.Fprintf(cfg.Stderr, "kubeconfig file at %s\n", i.ConfigFile)
+		fmt.Fprintf(i.stderr, "kubeconfig file at %s\n", i.configFilename)
 	}
 
-	i.configFile, err = os.Create(i.ConfigFile)
+	i.configFile, err = os.Create(i.configFilename)
 	if err != nil {
 		return fmt.Errorf("could not open kubeconfig file for writing: %w", err)
 	}

internal/run/initkube_test.go

@@ -1,10 +1,13 @@
 package run
 
 import (
+	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"github.com/stretchr/testify/suite"
 	yaml "gopkg.in/yaml.v2"
 	"io/ioutil"
 	"os"
+	"strings"
 	"testing"
 	"text/template"
 )
@@ -17,6 +20,30 @@ func TestInitKubeTestSuite(t *testing.T) {
 	suite.Run(t, new(InitKubeTestSuite))
 }
 
+func (suite *InitKubeTestSuite) TestNewInitKube() {
+	cfg := env.Config{
+		SkipTLSVerify:  true,
+		Certificate:    "cHJvY2xhaW1zIHdvbmRlcmZ1bCBmcmllbmRzaGlw",
+		APIServer:      "98.765.43.21",
+		ServiceAccount: "greathelm",
+		KubeToken:      "b2YgbXkgYWZmZWN0aW9u",
+		Stderr:         &strings.Builder{},
+		Debug:          true,
+	}
+
+	init := NewInitKube(cfg, "conf.tpl", "conf.yml")
+	suite.Equal(kubeValues{
+		SkipTLSVerify:  true,
+		Certificate:    "cHJvY2xhaW1zIHdvbmRlcmZ1bCBmcmllbmRzaGlw",
+		APIServer:      "98.765.43.21",
+		ServiceAccount: "greathelm",
+		Token:          "b2YgbXkgYWZmZWN0aW9u",
+	}, init.values)
+	suite.Equal("conf.tpl", init.templateFilename)
+	suite.Equal("conf.yml", init.configFilename)
+	suite.NotNil(init.config)
+}
+
 func (suite *InitKubeTestSuite) TestPrepareExecute() {
 	templateFile, err := tempfile("kubeconfig********.yml.tpl", `
 certificate: {{ .Certificate }}
@@ -29,23 +56,20 @@ namespace: {{ .Namespace }}
 	defer os.Remove(configFile.Name())
 	suite.Require().Nil(err)
 
-	init := InitKube{
+	cfg := env.Config{
-		APIServer:    "Sysadmin",
+		APIServer:   "Sysadmin",
-		Certificate:  "CCNA",
+		Certificate: "CCNA",
-		Token:        "Aspire virtual currency",
+		KubeToken:   "Aspire virtual currency",
-		TemplateFile: templateFile.Name(),
+		Namespace:   "Cisco",
-		ConfigFile:   configFile.Name(),
 	}
-	cfg := Config{
+	init := NewInitKube(cfg, templateFile.Name(), configFile.Name())
-		Namespace: "Cisco",
+	err = init.Prepare()
-	}
-	err = init.Prepare(cfg)
 	suite.Require().Nil(err)
 
 	suite.IsType(&template.Template{}, init.template)
 	suite.NotNil(init.configFile)
 
-	err = init.Execute(cfg)
+	err = init.Execute()
 	suite.Require().Nil(err)
 
 	conf, err := ioutil.ReadFile(configFile.Name())
@@ -63,19 +87,16 @@ func (suite *InitKubeTestSuite) TestExecuteGeneratesConfig() {
 	defer os.Remove(configFile.Name())
 	suite.Require().NoError(err)
 
-	cfg := Config{
+	cfg := env.Config{
-		Namespace: "marshmallow",
-	}
-	init := InitKube{
-		ConfigFile:     configFile.Name(),
-		TemplateFile:   "../../assets/kubeconfig.tpl", // the actual kubeconfig template
 		APIServer:      "https://kube.cluster/peanut",
 		ServiceAccount: "chef",
-		Token:          "eWVhaCB3ZSB0b2tpbic=",
+		KubeToken:      "eWVhaCB3ZSB0b2tpbic=",
 		Certificate:    "d293LCB5b3UgYXJlIHNvIGNvb2wgZm9yIHNtb2tpbmcgd2VlZCDwn5mE",
+		Namespace:      "marshmallow",
 	}
-	suite.Require().NoError(init.Prepare(cfg))
+	init := NewInitKube(cfg, "../../assets/kubeconfig.tpl", configFile.Name()) // the actual kubeconfig template
-	suite.Require().NoError(init.Execute(cfg))
+	suite.Require().NoError(init.Prepare())
+	suite.Require().NoError(init.Execute())
 
 	contents, err := ioutil.ReadFile(configFile.Name())
 	suite.Require().NoError(err)
@@ -98,11 +119,11 @@ func (suite *InitKubeTestSuite) TestExecuteGeneratesConfig() {
 	suite.NoError(yaml.UnmarshalStrict(contents, &conf))
 
 	// test the other branch of the certificate/SkipTLSVerify conditional
-	init.SkipTLSVerify = true
+	init.values.SkipTLSVerify = true
-	init.Certificate = ""
+	init.values.Certificate = ""
 
-	suite.Require().NoError(init.Prepare(cfg))
+	suite.Require().NoError(init.Prepare())
-	suite.Require().NoError(init.Execute(cfg))
+	suite.Require().NoError(init.Execute())
 	contents, err = ioutil.ReadFile(configFile.Name())
 	suite.Require().NoError(err)
 	suite.Contains(string(contents), "insecure-skip-tls-verify: true")
@@ -116,25 +137,25 @@ func (suite *InitKubeTestSuite) TestPrepareParseError() {
 	defer os.Remove(templateFile.Name())
 	suite.Require().Nil(err)
 
-	init := InitKube{
+	cfg := env.Config{
-		APIServer:    "Sysadmin",
+		APIServer:   "Sysadmin",
-		Certificate:  "CCNA",
+		Certificate: "CCNA",
-		Token:        "Aspire virtual currency",
+		KubeToken:   "Aspire virtual currency",
-		TemplateFile: templateFile.Name(),
 	}
-	err = init.Prepare(Config{})
+	init := NewInitKube(cfg, templateFile.Name(), "")
+	err = init.Prepare()
 	suite.Error(err)
 	suite.Regexp("could not load kubeconfig .* function .* not defined", err)
 }
 
 func (suite *InitKubeTestSuite) TestPrepareNonexistentTemplateFile() {
-	init := InitKube{
+	cfg := env.Config{
-		APIServer:    "Sysadmin",
+		APIServer:   "Sysadmin",
-		Certificate:  "CCNA",
+		Certificate: "CCNA",
-		Token:        "Aspire virtual currency",
+		KubeToken:   "Aspire virtual currency",
-		TemplateFile: "/usr/foreign/exclude/kubeprofig.tpl",
 	}
-	err := init.Prepare(Config{})
+	init := NewInitKube(cfg, "/usr/foreign/exclude/kubeprofig.tpl", "")
+	err := init.Prepare()
 	suite.Error(err)
 	suite.Regexp("could not load kubeconfig .* no such file or directory", err)
 }
@@ -143,16 +164,14 @@ func (suite *InitKubeTestSuite) TestPrepareCannotOpenDestinationFile() {
 	templateFile, err := tempfile("kubeconfig********.yml.tpl", "hurgity burgity")
 	defer os.Remove(templateFile.Name())
 	suite.Require().Nil(err)
-	init := InitKube{
+	cfg := env.Config{
-		APIServer:    "Sysadmin",
+		APIServer:   "Sysadmin",
-		Certificate:  "CCNA",
+		Certificate: "CCNA",
-		Token:        "Aspire virtual currency",
+		KubeToken:   "Aspire virtual currency",
-		TemplateFile: templateFile.Name(),
-		ConfigFile:   "/usr/foreign/exclude/kubeprofig",
 	}
+	init := NewInitKube(cfg, templateFile.Name(), "/usr/foreign/exclude/kubeprofig")
 
-	cfg := Config{}
+	err = init.Prepare()
-	err = init.Prepare(cfg)
 	suite.Error(err)
 	suite.Regexp("could not open .* for writing: .* no such file or directory", err)
 }
@@ -167,24 +186,21 @@ func (suite *InitKubeTestSuite) TestPrepareRequiredConfig() {
 	suite.Require().Nil(err)
 
 	// initial config with all required fields present
-	init := InitKube{
+	cfg := env.Config{
-		APIServer:    "Sysadmin",
+		APIServer:   "Sysadmin",
-		Certificate:  "CCNA",
+		Certificate: "CCNA",
-		Token:        "Aspire virtual currency",
+		KubeToken:   "Aspire virtual currency",
-		TemplateFile: templateFile.Name(),
-		ConfigFile:   configFile.Name(),
 	}
 
-	cfg := Config{}
+	init := NewInitKube(cfg, templateFile.Name(), configFile.Name())
+	suite.NoError(init.Prepare()) // consistency check; we should be starting in a happy state
 
-	suite.NoError(init.Prepare(cfg)) // consistency check; we should be starting in a happy state
+	init.values.APIServer = ""
+	suite.Error(init.Prepare(), "APIServer should be required.")
 
-	init.APIServer = ""
+	init.values.APIServer = "Sysadmin"
-	suite.Error(init.Prepare(cfg), "APIServer should be required.")
+	init.values.Token = ""
-
+	suite.Error(init.Prepare(), "Token should be required.")
-	init.APIServer = "Sysadmin"
-	init.Token = ""
-	suite.Error(init.Prepare(cfg), "Token should be required.")
 }
 
 func (suite *InitKubeTestSuite) TestPrepareDefaultsServiceAccount() {
@@ -196,18 +212,43 @@ func (suite *InitKubeTestSuite) TestPrepareDefaultsServiceAccount() {
 	defer os.Remove(configFile.Name())
 	suite.Require().Nil(err)
 
-	init := InitKube{
+	cfg := env.Config{
-		APIServer:    "Sysadmin",
+		APIServer:   "Sysadmin",
-		Certificate:  "CCNA",
+		Certificate: "CCNA",
-		Token:        "Aspire virtual currency",
+		KubeToken:   "Aspire virtual currency",
-		TemplateFile: templateFile.Name(),
-		ConfigFile:   configFile.Name(),
 	}
+	init := NewInitKube(cfg, templateFile.Name(), configFile.Name())
 
-	cfg := Config{}
+	init.Prepare()
+	suite.Equal("helm", init.values.ServiceAccount)
+}
 
-	init.Prepare(cfg)
+func (suite *InitKubeTestSuite) TestDebugOutput() {
-	suite.Equal("helm", init.ServiceAccount)
+	templateFile, err := tempfile("kubeconfig********.yml.tpl", "hurgity burgity")
+	defer os.Remove(templateFile.Name())
+	suite.Require().Nil(err)
+
+	configFile, err := tempfile("kubeconfig********.yml", "")
+	defer os.Remove(configFile.Name())
+	suite.Require().Nil(err)
+
+	stdout := &strings.Builder{}
+	stderr := &strings.Builder{}
+	cfg := env.Config{
+		APIServer: "http://my.kube.server/",
+		KubeToken: "QSBzaW5nbGUgcm9zZQ==",
+		Debug:     true,
+		Stdout:    stdout,
+		Stderr:    stderr,
+	}
+	init := NewInitKube(cfg, templateFile.Name(), configFile.Name())
+	suite.NoError(init.Prepare())
+
+	suite.Contains(stderr.String(), fmt.Sprintf("loading kubeconfig template from %s\n", templateFile.Name()))
+	suite.Contains(stderr.String(), fmt.Sprintf("truncating kubeconfig file at %s\n", configFile.Name()))
+
+	suite.NoError(init.Execute())
+	suite.Contains(stderr.String(), fmt.Sprintf("writing kubeconfig file to %s\n", configFile.Name()))
 }
 
 func tempfile(name, contents string) (*os.File, error) {

internal/run/lint.go

@@ -2,61 +2,67 @@ package run
 
 import (
 	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
 )
 
 // Lint is an execution step that calls `helm lint` when executed.
 type Lint struct {
-	Chart        string
+	*config
-	Values       string
+	chart        string
-	StringValues string
+	values       string
-	ValuesFiles  []string
+	stringValues string
-	Strict       bool
+	valuesFiles  []string
+	strict       bool
 	cmd          cmd
 }
 
+// NewLint creates a Lint using fields from the given Config. No validation is performed at this time.
+func NewLint(cfg env.Config) *Lint {
+	return &Lint{
+		config:       newConfig(cfg),
+		chart:        cfg.Chart,
+		values:       cfg.Values,
+		stringValues: cfg.StringValues,
+		valuesFiles:  cfg.ValuesFiles,
+		strict:       cfg.LintStrictly,
+	}
+}
+
 // Execute executes the `helm lint` command.
-func (l *Lint) Execute(_ Config) error {
+func (l *Lint) Execute() error {
 	return l.cmd.Run()
 }
 
 // Prepare gets the Lint ready to execute.
-func (l *Lint) Prepare(cfg Config) error {
+func (l *Lint) Prepare() error {
-	if l.Chart == "" {
+	if l.chart == "" {
 		return fmt.Errorf("chart is required")
 	}
 
-	args := make([]string, 0)
+	args := l.globalFlags()
-
-	if cfg.Namespace != "" {
-		args = append(args, "--namespace", cfg.Namespace)
-	}
-	if cfg.Debug {
-		args = append(args, "--debug")
-	}
-
 	args = append(args, "lint")
 
-	if l.Values != "" {
+	if l.values != "" {
-		args = append(args, "--set", l.Values)
+		args = append(args, "--set", l.values)
 	}
-	if l.StringValues != "" {
+	if l.stringValues != "" {
-		args = append(args, "--set-string", l.StringValues)
+		args = append(args, "--set-string", l.stringValues)
 	}
-	for _, vFile := range l.ValuesFiles {
+	for _, vFile := range l.valuesFiles {
 		args = append(args, "--values", vFile)
 	}
-	if l.Strict {
+	if l.strict {
 		args = append(args, "--strict")
 	}
 
-	args = append(args, l.Chart)
+	args = append(args, l.chart)
 
 	l.cmd = command(helmBin, args...)
-	l.cmd.Stdout(cfg.Stdout)
+	l.cmd.Stdout(l.stdout)
-	l.cmd.Stderr(cfg.Stderr)
+	l.cmd.Stderr(l.stderr)
 
-	if cfg.Debug {
+	if l.debug {
-		fmt.Fprintf(cfg.Stderr, "Generated command: '%s'\n", l.cmd.String())
+		fmt.Fprintf(l.stderr, "Generated command: '%s'\n", l.cmd.String())
 	}
 
 	return nil

internal/run/lint_test.go

@@ -1,8 +1,8 @@
 package run
 
 import (
-	"fmt"
 	"github.com/golang/mock/gomock"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"github.com/stretchr/testify/suite"
 	"strings"
 	"testing"
@@ -31,19 +31,36 @@ func TestLintTestSuite(t *testing.T) {
 	suite.Run(t, new(LintTestSuite))
 }
 
+func (suite *LintTestSuite) TestNewLint() {
+	cfg := env.Config{
+		Chart:        "./flow",
+		Values:       "steadfastness,forthrightness",
+		StringValues: "tensile_strength,flexibility",
+		ValuesFiles:  []string{"/root/price_inventory.yml"},
+		LintStrictly: true,
+	}
+	lint := NewLint(cfg)
+	suite.Require().NotNil(lint)
+	suite.Equal("./flow", lint.chart)
+	suite.Equal("steadfastness,forthrightness", lint.values)
+	suite.Equal("tensile_strength,flexibility", lint.stringValues)
+	suite.Equal([]string{"/root/price_inventory.yml"}, lint.valuesFiles)
+	suite.Equal(true, lint.strict)
+	suite.NotNil(lint.config)
+}
+
 func (suite *LintTestSuite) TestPrepareAndExecute() {
 	defer suite.ctrl.Finish()
 
 	stdout := strings.Builder{}
 	stderr := strings.Builder{}
 
-	l := Lint{
+	cfg := env.Config{
-		Chart: "./epic/mychart",
+		Chart:  "./epic/mychart",
-	}
-	cfg := Config{
 		Stdout: &stdout,
 		Stderr: &stderr,
 	}
+	l := NewLint(cfg)
 
 	command = func(path string, args ...string) cmd {
 		suite.Equal(helmBin, path)
@@ -52,6 +69,7 @@ func (suite *LintTestSuite) TestPrepareAndExecute() {
 		return suite.mockCmd
 	}
 
+	suite.mockCmd.EXPECT().String().AnyTimes()
 	suite.mockCmd.EXPECT().
 		Stdout(&stdout)
 	suite.mockCmd.EXPECT().
@@ -60,9 +78,9 @@ func (suite *LintTestSuite) TestPrepareAndExecute() {
 		Run().
 		Times(1)
 
-	err := l.Prepare(cfg)
+	err := l.Prepare()
 	suite.Require().Nil(err)
-	l.Execute(cfg)
+	l.Execute()
 }
 
 func (suite *LintTestSuite) TestPrepareRequiresChart() {
@@ -70,25 +88,22 @@ func (suite *LintTestSuite) TestPrepareRequiresChart() {
 	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
 	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
 
-	cfg := Config{}
+	l := NewLint(env.Config{})
-	l := Lint{}
+	err := l.Prepare()
-
-	err := l.Prepare(cfg)
 	suite.EqualError(err, "chart is required", "Chart should be mandatory")
 }
 
 func (suite *LintTestSuite) TestPrepareWithLintFlags() {
 	defer suite.ctrl.Finish()
 
-	cfg := Config{}
+	cfg := env.Config{
-
-	l := Lint{
 		Chart:        "./uk/top_40",
 		Values:       "width=5",
 		StringValues: "version=2.0",
 		ValuesFiles:  []string{"/usr/local/underrides", "/usr/local/overrides"},
-		Strict:       true,
+		LintStrictly: true,
 	}
+	l := NewLint(cfg)
 
 	command = func(path string, args ...string) cmd {
 		suite.Equal(helmBin, path)
@@ -105,66 +120,8 @@ func (suite *LintTestSuite) TestPrepareWithLintFlags() {
 
 	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
 	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
+	suite.mockCmd.EXPECT().String().AnyTimes()
 
-	err := l.Prepare(cfg)
+	err := l.Prepare()
 	suite.Require().Nil(err)
 }
-
-func (suite *LintTestSuite) TestPrepareWithDebugFlag() {
-	defer suite.ctrl.Finish()
-
-	stderr := strings.Builder{}
-
-	cfg := Config{
-		Debug:  true,
-		Stderr: &stderr,
-	}
-
-	l := Lint{
-		Chart: "./scotland/top_40",
-	}
-
-	command = func(path string, args ...string) cmd {
-		suite.mockCmd.EXPECT().
-			String().
-			Return(fmt.Sprintf("%s %s", path, strings.Join(args, " ")))
-
-		return suite.mockCmd
-	}
-
-	suite.mockCmd.EXPECT().Stdout(gomock.Any())
-	suite.mockCmd.EXPECT().Stderr(&stderr)
-
-	err := l.Prepare(cfg)
-	suite.Require().Nil(err)
-
-	want := fmt.Sprintf("Generated command: '%s --debug lint ./scotland/top_40'\n", helmBin)
-	suite.Equal(want, stderr.String())
-}
-
-func (suite *LintTestSuite) TestPrepareWithNamespaceFlag() {
-	defer suite.ctrl.Finish()
-
-	cfg := Config{
-		Namespace: "table-service",
-	}
-
-	l := Lint{
-		Chart: "./wales/top_40",
-	}
-
-	actual := []string{}
-	command = func(path string, args ...string) cmd {
-		actual = args
-		return suite.mockCmd
-	}
-
-	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
-	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
-
-	err := l.Prepare(cfg)
-	suite.Require().Nil(err)
-
-	expected := []string{"--namespace", "table-service", "lint", "./wales/top_40"}
-	suite.Equal(expected, actual)
-}

internal/run/repocerts.go

@@ -0,0 +1,77 @@
+package run
+
+import (
+	"encoding/base64"
+	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
+	"io/ioutil"
+)
+
+type repoCerts struct {
+	*config
+	cert           string
+	certFilename   string
+	caCert         string
+	caCertFilename string
+}
+
+func newRepoCerts(cfg env.Config) *repoCerts {
+	return &repoCerts{
+		config: newConfig(cfg),
+		cert:   cfg.RepoCertificate,
+		caCert: cfg.RepoCACertificate,
+	}
+}
+
+func (rc *repoCerts) write() error {
+	if rc.cert != "" {
+		file, err := ioutil.TempFile("", "repo********.cert")
+		defer file.Close()
+		if err != nil {
+			return fmt.Errorf("failed to create certificate file: %w", err)
+		}
+		rc.certFilename = file.Name()
+		rawCert, err := base64.StdEncoding.DecodeString(rc.cert)
+		if err != nil {
+			return fmt.Errorf("failed to base64-decode certificate string: %w", err)
+		}
+		if rc.debug {
+			fmt.Fprintf(rc.stderr, "writing repo certificate to %s\n", rc.certFilename)
+		}
+		if _, err := file.Write(rawCert); err != nil {
+			return fmt.Errorf("failed to write certificate file: %w", err)
+		}
+	}
+
+	if rc.caCert != "" {
+		file, err := ioutil.TempFile("", "repo********.ca.cert")
+		defer file.Close()
+		if err != nil {
+			return fmt.Errorf("failed to create CA certificate file: %w", err)
+		}
+		rc.caCertFilename = file.Name()
+		rawCert, err := base64.StdEncoding.DecodeString(rc.caCert)
+		if err != nil {
+			return fmt.Errorf("failed to base64-decode CA certificate string: %w", err)
+		}
+		if rc.debug {
+			fmt.Fprintf(rc.stderr, "writing repo ca certificate to %s\n", rc.caCertFilename)
+		}
+		if _, err := file.Write(rawCert); err != nil {
+			return fmt.Errorf("failed to write CA certificate file: %w", err)
+		}
+	}
+	return nil
+}
+
+func (rc *repoCerts) flags() []string {
+	flags := make([]string, 0)
+	if rc.certFilename != "" {
+		flags = append(flags, "--cert-file", rc.certFilename)
+	}
+	if rc.caCertFilename != "" {
+		flags = append(flags, "--ca-file", rc.caCertFilename)
+	}
+
+	return flags
+}

internal/run/repocerts_test.go

@@ -0,0 +1,80 @@
+package run
+
+import (
+	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
+	"github.com/stretchr/testify/suite"
+	"io/ioutil"
+	"os"
+	"strings"
+	"testing"
+)
+
+type RepoCertsTestSuite struct {
+	suite.Suite
+}
+
+func TestRepoCertsTestSuite(t *testing.T) {
+	suite.Run(t, new(RepoCertsTestSuite))
+}
+
+func (suite *RepoCertsTestSuite) TestNewRepoCerts() {
+	cfg := env.Config{
+		RepoCertificate:   "bGljZW5zZWQgYnkgdGhlIFN0YXRlIG9mIE9yZWdvbiB0byBwZXJmb3JtIHJlcG9zc2Vzc2lvbnM=",
+		RepoCACertificate: "T3JlZ29uIFN0YXRlIExpY2Vuc3VyZSBib2FyZA==",
+	}
+	rc := newRepoCerts(cfg)
+	suite.Require().NotNil(rc)
+	suite.Equal("bGljZW5zZWQgYnkgdGhlIFN0YXRlIG9mIE9yZWdvbiB0byBwZXJmb3JtIHJlcG9zc2Vzc2lvbnM=", rc.cert)
+	suite.Equal("T3JlZ29uIFN0YXRlIExpY2Vuc3VyZSBib2FyZA==", rc.caCert)
+}
+
+func (suite *RepoCertsTestSuite) TestWrite() {
+	cfg := env.Config{
+		RepoCertificate:   "bGljZW5zZWQgYnkgdGhlIFN0YXRlIG9mIE9yZWdvbiB0byBwZXJmb3JtIHJlcG9zc2Vzc2lvbnM=",
+		RepoCACertificate: "T3JlZ29uIFN0YXRlIExpY2Vuc3VyZSBib2FyZA==",
+	}
+	rc := newRepoCerts(cfg)
+	suite.Require().NotNil(rc)
+
+	suite.NoError(rc.write())
+	defer os.Remove(rc.certFilename)
+	defer os.Remove(rc.caCertFilename)
+	suite.NotEqual("", rc.certFilename)
+	suite.NotEqual("", rc.caCertFilename)
+
+	cert, err := ioutil.ReadFile(rc.certFilename)
+	suite.Require().NoError(err)
+	caCert, err := ioutil.ReadFile(rc.caCertFilename)
+	suite.Require().NoError(err)
+	suite.Equal("licensed by the State of Oregon to perform repossessions", string(cert))
+	suite.Equal("Oregon State Licensure board", string(caCert))
+}
+
+func (suite *RepoCertsTestSuite) TestFlags() {
+	rc := newRepoCerts(env.Config{})
+	suite.Equal([]string{}, rc.flags())
+	rc.certFilename = "hurgityburgity"
+	suite.Equal([]string{"--cert-file", "hurgityburgity"}, rc.flags())
+	rc.caCertFilename = "honglydongly"
+	suite.Equal([]string{"--cert-file", "hurgityburgity", "--ca-file", "honglydongly"}, rc.flags())
+}
+
+func (suite *RepoCertsTestSuite) TestDebug() {
+	stderr := strings.Builder{}
+	cfg := env.Config{
+		RepoCertificate:   "bGljZW5zZWQgYnkgdGhlIFN0YXRlIG9mIE9yZWdvbiB0byBwZXJmb3JtIHJlcG9zc2Vzc2lvbnM=",
+		RepoCACertificate: "T3JlZ29uIFN0YXRlIExpY2Vuc3VyZSBib2FyZA==",
+		Stderr:            &stderr,
+		Debug:             true,
+	}
+	rc := newRepoCerts(cfg)
+	suite.Require().NotNil(rc)
+
+	suite.NoError(rc.write())
+	defer os.Remove(rc.certFilename)
+	defer os.Remove(rc.caCertFilename)
+
+	suite.Contains(stderr.String(), fmt.Sprintf("writing repo certificate to %s", rc.certFilename))
+	suite.Contains(stderr.String(), fmt.Sprintf("writing repo ca certificate to %s", rc.caCertFilename))
+}

internal/run/uninstall.go

@@ -2,53 +2,57 @@ package run
 
 import (
 	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
 )
 
 // Uninstall is an execution step that calls `helm uninstall` when executed.
 type Uninstall struct {
-	Release     string
+	*config
-	DryRun      bool
+	release     string
-	KeepHistory bool
+	dryRun      bool
+	keepHistory bool
 	cmd         cmd
 }
 
+// NewUninstall creates an Uninstall using fields from the given Config. No validation is performed at this time.
+func NewUninstall(cfg env.Config) *Uninstall {
+	return &Uninstall{
+		config:      newConfig(cfg),
+		release:     cfg.Release,
+		dryRun:      cfg.DryRun,
+		keepHistory: cfg.KeepHistory,
+	}
+}
+
 // Execute executes the `helm uninstall` command.
-func (u *Uninstall) Execute(_ Config) error {
+func (u *Uninstall) Execute() error {
 	return u.cmd.Run()
 }
 
 // Prepare gets the Uninstall ready to execute.
-func (u *Uninstall) Prepare(cfg Config) error {
+func (u *Uninstall) Prepare() error {
-	if u.Release == "" {
+	if u.release == "" {
 		return fmt.Errorf("release is required")
 	}
 
-	args := make([]string, 0)
+	args := u.globalFlags()
-
-	if cfg.Namespace != "" {
-		args = append(args, "--namespace", cfg.Namespace)
-	}
-	if cfg.Debug {
-		args = append(args, "--debug")
-	}
-
 	args = append(args, "uninstall")
 
-	if u.DryRun {
+	if u.dryRun {
 		args = append(args, "--dry-run")
 	}
-	if u.KeepHistory {
+	if u.keepHistory {
 		args = append(args, "--keep-history")
 	}
 
-	args = append(args, u.Release)
+	args = append(args, u.release)
 
 	u.cmd = command(helmBin, args...)
-	u.cmd.Stdout(cfg.Stdout)
+	u.cmd.Stdout(u.stdout)
-	u.cmd.Stderr(cfg.Stderr)
+	u.cmd.Stderr(u.stderr)
 
-	if cfg.Debug {
+	if u.debug {
-		fmt.Fprintf(cfg.Stderr, "Generated command: '%s'\n", u.cmd.String())
+		fmt.Fprintf(u.stderr, "Generated command: '%s'\n", u.cmd.String())
 	}
 
 	return nil

internal/run/uninstall_test.go

@@ -1,10 +1,9 @@
 package run
 
 import (
-	"fmt"
 	"github.com/golang/mock/gomock"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"github.com/stretchr/testify/suite"
-	"strings"
 	"testing"
 )
 
@@ -35,12 +34,26 @@ func TestUninstallTestSuite(t *testing.T) {
 	suite.Run(t, new(UninstallTestSuite))
 }
 
+func (suite *UninstallTestSuite) TestNewUninstall() {
+	cfg := env.Config{
+		DryRun:      true,
+		Release:     "jetta_id_love_to_change_the_world",
+		KeepHistory: true,
+	}
+	u := NewUninstall(cfg)
+	suite.Equal("jetta_id_love_to_change_the_world", u.release)
+	suite.Equal(true, u.dryRun)
+	suite.Equal(true, u.keepHistory)
+	suite.NotNil(u.config)
+}
+
 func (suite *UninstallTestSuite) TestPrepareAndExecute() {
 	defer suite.ctrl.Finish()
 
-	u := Uninstall{
+	cfg := env.Config{
 		Release: "zayde_wølf_king",
 	}
+	u := NewUninstall(cfg)
 
 	actual := []string{}
 	command = func(path string, args ...string) cmd {
@@ -58,92 +71,49 @@ func (suite *UninstallTestSuite) TestPrepareAndExecute() {
 		Run().
 		Times(1)
 
-	cfg := Config{}
+	suite.NoError(u.Prepare())
-	suite.NoError(u.Prepare(cfg))
 	expected := []string{"uninstall", "zayde_wølf_king"}
 	suite.Equal(expected, actual)
 
-	u.Execute(cfg)
+	u.Execute()
 }
 
 func (suite *UninstallTestSuite) TestPrepareDryRunFlag() {
-	u := Uninstall{
+	cfg := env.Config{
 		Release: "firefox_ak_wildfire",
 		DryRun:  true,
 	}
-	cfg := Config{}
+	u := NewUninstall(cfg)
 
 	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
 	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
 
-	suite.NoError(u.Prepare(cfg))
+	suite.NoError(u.Prepare())
 	expected := []string{"uninstall", "--dry-run", "firefox_ak_wildfire"}
 	suite.Equal(expected, suite.actualArgs)
 }
 
 func (suite *UninstallTestSuite) TestPrepareKeepHistoryFlag() {
-	u := Uninstall{
+	cfg := env.Config{
 		Release:     "perturbator_sentient",
 		KeepHistory: true,
 	}
-	cfg := Config{}
+	u := NewUninstall(cfg)
 
 	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
 	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
 
-	suite.NoError(u.Prepare(cfg))
+	suite.NoError(u.Prepare())
 	expected := []string{"uninstall", "--keep-history", "perturbator_sentient"}
 	suite.Equal(expected, suite.actualArgs)
 }
 
-func (suite *UninstallTestSuite) TestPrepareNamespaceFlag() {
-	u := Uninstall{
-		Release: "carly_simon_run_away_with_me",
-	}
-	cfg := Config{
-		Namespace: "emotion",
-	}
-
-	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
-	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
-
-	suite.NoError(u.Prepare(cfg))
-	expected := []string{"--namespace", "emotion", "uninstall", "carly_simon_run_away_with_me"}
-	suite.Equal(expected, suite.actualArgs)
-}
-
-func (suite *UninstallTestSuite) TestPrepareDebugFlag() {
-	u := Uninstall{
-		Release: "just_a_band_huff_and_puff",
-	}
-	stderr := strings.Builder{}
-	cfg := Config{
-		Debug:  true,
-		Stderr: &stderr,
-	}
-
-	command = func(path string, args ...string) cmd {
-		suite.mockCmd.EXPECT().
-			String().
-			Return(fmt.Sprintf("%s %s", path, strings.Join(args, " ")))
-
-		return suite.mockCmd
-	}
-
-	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
-	suite.mockCmd.EXPECT().Stderr(&stderr).AnyTimes()
-
-	suite.NoError(u.Prepare(cfg))
-	suite.Equal(fmt.Sprintf("Generated command: '%s --debug "+
-		"uninstall just_a_band_huff_and_puff'\n", helmBin), stderr.String())
-}
-
 func (suite *UninstallTestSuite) TestPrepareRequiresRelease() {
 	// These aren't really expected, but allowing them gives clearer test-failure messages
 	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
 	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
 
-	u := Uninstall{}
+	u := NewUninstall(env.Config{})
-	err := u.Prepare(Config{})
+	err := u.Prepare()
 	suite.EqualError(err, "release is required", "Uninstall.Release should be mandatory")
 }

internal/run/upgrade.go

@@ -2,94 +2,116 @@ package run
 
 import (
 	"fmt"
+	"github.com/pelotech/drone-helm3/internal/env"
 )
 
 // Upgrade is an execution step that calls `helm upgrade` when executed.
 type Upgrade struct {
-	Chart   string
+	*config
-	Release string
+	chart   string
+	release string
 
-	ChartVersion  string
+	chartVersion    string
-	DryRun        bool
+	dryRun          bool
-	Wait          bool
+	wait            bool
-	Values        string
+	values          string
-	StringValues  string
+	stringValues    string
-	ValuesFiles   []string
+	valuesFiles     []string
-	ReuseValues   bool
+	reuseValues     bool
-	Timeout       string
+	timeout         string
-	Force         bool
+	force           bool
-	Atomic        bool
+	atomic          bool
-	CleanupOnFail bool
+	cleanupOnFail   bool
+	certs           *repoCerts
+	createNamespace bool
 
 	cmd cmd
 }
 
+// NewUpgrade creates an Upgrade using fields from the given Config. No validation is performed at this time.
+func NewUpgrade(cfg env.Config) *Upgrade {
+	return &Upgrade{
+		config:          newConfig(cfg),
+		chart:           cfg.Chart,
+		release:         cfg.Release,
+		chartVersion:    cfg.ChartVersion,
+		dryRun:          cfg.DryRun,
+		wait:            cfg.Wait,
+		values:          cfg.Values,
+		stringValues:    cfg.StringValues,
+		valuesFiles:     cfg.ValuesFiles,
+		reuseValues:     cfg.ReuseValues,
+		timeout:         cfg.Timeout,
+		force:           cfg.Force,
+		atomic:          cfg.AtomicUpgrade,
+		cleanupOnFail:   cfg.CleanupOnFail,
+		certs:           newRepoCerts(cfg),
+		createNamespace: cfg.CreateNamespace,
+	}
+}
+
 // Execute executes the `helm upgrade` command.
-func (u *Upgrade) Execute(_ Config) error {
+func (u *Upgrade) Execute() error {
 	return u.cmd.Run()
 }
 
 // Prepare gets the Upgrade ready to execute.
-func (u *Upgrade) Prepare(cfg Config) error {
+func (u *Upgrade) Prepare() error {
-	if u.Chart == "" {
+	if u.chart == "" {
 		return fmt.Errorf("chart is required")
 	}
-	if u.Release == "" {
+	if u.release == "" {
 		return fmt.Errorf("release is required")
 	}
 
-	args := make([]string, 0)
+	args := u.globalFlags()
-
-	if cfg.Namespace != "" {
-		args = append(args, "--namespace", cfg.Namespace)
-	}
-	if cfg.Debug {
-		args = append(args, "--debug")
-	}
-
 	args = append(args, "upgrade", "--install")
 
-	if u.ChartVersion != "" {
+	if u.chartVersion != "" {
-		args = append(args, "--version", u.ChartVersion)
+		args = append(args, "--version", u.chartVersion)
 	}
-	if u.DryRun {
+	if u.dryRun {
 		args = append(args, "--dry-run")
 	}
-	if u.Wait {
+	if u.wait {
 		args = append(args, "--wait")
 	}
-	if u.ReuseValues {
+	if u.reuseValues {
 		args = append(args, "--reuse-values")
 	}
-	if u.Timeout != "" {
+	if u.timeout != "" {
-		args = append(args, "--timeout", u.Timeout)
+		args = append(args, "--timeout", u.timeout)
 	}
-	if u.Force {
+	if u.force {
 		args = append(args, "--force")
 	}
-	if u.Atomic {
+	if u.atomic {
 		args = append(args, "--atomic")
 	}
-	if u.CleanupOnFail {
+	if u.cleanupOnFail {
 		args = append(args, "--cleanup-on-fail")
 	}
-	if u.Values != "" {
+	if u.values != "" {
-		args = append(args, "--set", u.Values)
+		args = append(args, "--set", u.values)
 	}
-	if u.StringValues != "" {
+	if u.stringValues != "" {
-		args = append(args, "--set-string", u.StringValues)
+		args = append(args, "--set-string", u.stringValues)
 	}
-	for _, vFile := range u.ValuesFiles {
+	if u.createNamespace {
+		args = append(args, "--create-namespace")
+	}
+	for _, vFile := range u.valuesFiles {
 		args = append(args, "--values", vFile)
 	}
+	args = append(args, u.certs.flags()...)
 
-	args = append(args, u.Release, u.Chart)
+	args = append(args, u.release, u.chart)
 	u.cmd = command(helmBin, args...)
-	u.cmd.Stdout(cfg.Stdout)
+	u.cmd.Stdout(u.stdout)
-	u.cmd.Stderr(cfg.Stderr)
+	u.cmd.Stderr(u.stderr)
 
-	if cfg.Debug {
+	if u.debug {
-		fmt.Fprintf(cfg.Stderr, "Generated command: '%s'\n", u.cmd.String())
+		fmt.Fprintf(u.stderr, "Generated command: '%s'\n", u.cmd.String())
 	}
 
 	return nil

internal/run/upgrade_test.go

@@ -3,6 +3,7 @@ package run
 import (
 	"fmt"
 	"github.com/golang/mock/gomock"
+	"github.com/pelotech/drone-helm3/internal/env"
 	"github.com/stretchr/testify/suite"
 	"strings"
 	"testing"
@@ -31,13 +32,49 @@ func TestUpgradeTestSuite(t *testing.T) {
 	suite.Run(t, new(UpgradeTestSuite))
 }
 
+func (suite *UpgradeTestSuite) TestNewUpgrade() {
+	cfg := env.Config{
+		ChartVersion:  "seventeen",
+		DryRun:        true,
+		Wait:          true,
+		Values:        "steadfastness,forthrightness",
+		StringValues:  "tensile_strength,flexibility",
+		ValuesFiles:   []string{"/root/price_inventory.yml"},
+		ReuseValues:   true,
+		Timeout:       "go sit in the corner",
+		Chart:         "billboard_top_100",
+		Release:       "post_malone_circles",
+		Force:         true,
+		AtomicUpgrade: true,
+		CleanupOnFail: true,
+	}
+
+	up := NewUpgrade(cfg)
+	suite.Equal(cfg.Chart, up.chart)
+	suite.Equal(cfg.Release, up.release)
+	suite.Equal(cfg.ChartVersion, up.chartVersion)
+	suite.Equal(true, up.dryRun)
+	suite.Equal(cfg.Wait, up.wait)
+	suite.Equal("steadfastness,forthrightness", up.values)
+	suite.Equal("tensile_strength,flexibility", up.stringValues)
+	suite.Equal([]string{"/root/price_inventory.yml"}, up.valuesFiles)
+	suite.Equal(cfg.ReuseValues, up.reuseValues)
+	suite.Equal(cfg.Timeout, up.timeout)
+	suite.Equal(cfg.Force, up.force)
+	suite.Equal(true, up.atomic)
+	suite.Equal(true, up.cleanupOnFail)
+	suite.NotNil(up.config)
+	suite.NotNil(up.certs)
+}
+
 func (suite *UpgradeTestSuite) TestPrepareAndExecute() {
 	defer suite.ctrl.Finish()
 
-	u := Upgrade{
+	cfg := env.Config{
 		Chart:   "at40",
 		Release: "jonas_brothers_only_human",
 	}
+	u := NewUpgrade(cfg)
 
 	command = func(path string, args ...string) cmd {
 		suite.Equal(helmBin, path)
@@ -54,19 +91,20 @@ func (suite *UpgradeTestSuite) TestPrepareAndExecute() {
 		Run().
 		Times(1)
 
-	cfg := Config{}
+	err := u.Prepare()
-	err := u.Prepare(cfg)
 	suite.Require().Nil(err)
-	u.Execute(cfg)
+	u.Execute()
 }
 
 func (suite *UpgradeTestSuite) TestPrepareNamespaceFlag() {
 	defer suite.ctrl.Finish()
 
-	u := Upgrade{
+	cfg := env.Config{
-		Chart:   "at40",
+		Namespace: "melt",
-		Release: "shaed_trampoline",
+		Chart:     "at40",
+		Release:   "shaed_trampoline",
 	}
+	u := NewUpgrade(cfg)
 
 	command = func(path string, args ...string) cmd {
 		suite.Equal(helmBin, path)
@@ -78,17 +116,14 @@ func (suite *UpgradeTestSuite) TestPrepareNamespaceFlag() {
 	suite.mockCmd.EXPECT().Stdout(gomock.Any())
 	suite.mockCmd.EXPECT().Stderr(gomock.Any())
 
-	cfg := Config{
+	err := u.Prepare()
-		Namespace: "melt",
-	}
-	err := u.Prepare(cfg)
 	suite.Require().Nil(err)
 }
 
 func (suite *UpgradeTestSuite) TestPrepareWithUpgradeFlags() {
 	defer suite.ctrl.Finish()
 
-	u := Upgrade{
+	cfg := env.Config{
 		Chart:         "hot_ac",
 		Release:       "maroon_5_memories",
 		ChartVersion:  "radio_edit",
@@ -100,11 +135,12 @@ func (suite *UpgradeTestSuite) TestPrepareWithUpgradeFlags() {
 		ReuseValues:   true,
 		Timeout:       "sit_in_the_corner",
 		Force:         true,
-		Atomic:        true,
+		AtomicUpgrade: true,
 		CleanupOnFail: true,
 	}
-
+	u := NewUpgrade(cfg)
-	cfg := Config{}
+	// inject a ca cert filename so repoCerts won't create any files that we'd have to clean up
+	u.certs.caCertFilename = "local_ca.cert"
 
 	command = func(path string, args ...string) cmd {
 		suite.Equal(helmBin, path)
@@ -121,6 +157,7 @@ func (suite *UpgradeTestSuite) TestPrepareWithUpgradeFlags() {
 			"--set-string", "height=5ft10in",
 			"--values", "/usr/local/stats",
 			"--values", "/usr/local/grades",
+			"--ca-file", "local_ca.cert",
 			"maroon_5_memories", "hot_ac"}, args)
 
 		return suite.mockCmd
@@ -129,7 +166,7 @@ func (suite *UpgradeTestSuite) TestPrepareWithUpgradeFlags() {
 	suite.mockCmd.EXPECT().Stdout(gomock.Any())
 	suite.mockCmd.EXPECT().Stderr(gomock.Any())
 
-	err := u.Prepare(cfg)
+	err := u.Prepare()
 	suite.Require().Nil(err)
 }
 
@@ -138,34 +175,30 @@ func (suite *UpgradeTestSuite) TestRequiresChartAndRelease() {
 	suite.mockCmd.EXPECT().Stdout(gomock.Any()).AnyTimes()
 	suite.mockCmd.EXPECT().Stderr(gomock.Any()).AnyTimes()
 
-	u := Upgrade{
+	u := NewUpgrade(env.Config{})
-		Release: "seth_everman_unskippable_cutscene",
+	u.release = "seth_everman_unskippable_cutscene"
-	}
 
-	err := u.Prepare(Config{})
+	err := u.Prepare()
 	suite.EqualError(err, "chart is required", "Chart should be mandatory")
 
-	u = Upgrade{
+	u.release = ""
-		Chart: "billboard_top_zero",
+	u.chart = "billboard_top_zero"
-	}
 
-	err = u.Prepare(Config{})
+	err = u.Prepare()
 	suite.EqualError(err, "release is required", "Release should be mandatory")
 }
 
 func (suite *UpgradeTestSuite) TestPrepareDebugFlag() {
-	u := Upgrade{
-		Chart:   "at40",
-		Release: "lewis_capaldi_someone_you_loved",
-	}
-
 	stdout := strings.Builder{}
 	stderr := strings.Builder{}
-	cfg := Config{
+	cfg := env.Config{
-		Debug:  true,
+		Chart:   "at40",
-		Stdout: &stdout,
+		Release: "lewis_capaldi_someone_you_loved",
-		Stderr: &stderr,
+		Debug:   true,
+		Stdout:  &stdout,
+		Stderr:  &stderr,
 	}
+	u := NewUpgrade(cfg)
 
 	command = func(path string, args ...string) cmd {
 		suite.mockCmd.EXPECT().
@@ -180,7 +213,7 @@ func (suite *UpgradeTestSuite) TestPrepareDebugFlag() {
 	suite.mockCmd.EXPECT().
 		Stderr(&stderr)
 
-	u.Prepare(cfg)
+	u.Prepare()
 
 	want := fmt.Sprintf("Generated command: '%s --debug upgrade "+
 		"--install lewis_capaldi_someone_you_loved at40'\n", helmBin)