Squashed commit of adding support for cli plugin validation reporting.

cmd/spire-server/cli/cli.go

@@ -125,7 +125,7 @@ func (cc *CLI) Run(ctx context.Context, args []string) int {
 			return jwt.NewMintCommand(), nil
 		},
 		"validate": func() (cli.Command, error) {
-			return validate.NewValidateCommand(), nil
+			return validate.NewValidateCommand(ctx, cc.LogOptions), nil
 		},
 		"localauthority x509 show": func() (cli.Command, error) {
 			return localauthority_x509.NewX509ShowCommand(), nil

cmd/spire-server/cli/run/run.go

@@ -224,16 +224,16 @@ func (cmd *Command) Help() string {
 
 // Help is a standalone function that prints a help message to writer.
 // It is used by both the run and validate commands, so they can share flag usage messages.
-func Help(name string, writer io.Writer) string {
-	_, err := parseFlags(name, []string{"-h"}, writer)
+func Help(name string, writer io.Writer, options ...func(fs *flag.FlagSet)) string {
+	_, err := parseFlags(name, []string{"-h"}, writer, options...)
 	// Error is always present because -h is passed
 	return err.Error()
 }
 
-func LoadConfig(name string, args []string, logOptions []log.Option, output io.Writer, allowUnknownConfig bool) (*server.Config, error) {
+func LoadConfig(name string, args []string, logOptions []log.Option, output io.Writer, allowUnknownConfig bool, options ...func(*flag.FlagSet)) (*server.Config, error) {
 	// First parse the CLI flags so we can get the config
 	// file path, if set
-	cliInput, err := parseFlags(name, args, output)
+	cliInput, err := parseFlags(name, args, output, options...)
 	if err != nil {
 		return nil, err
 	}
@@ -269,7 +269,7 @@ func (cmd *Command) Run(args []string) int {
 	// Set umask before starting up the server
 	common_cli.SetUmask(c.Log)
 
-	s := server.New(*c)
+	s := server.New(c)
 
 	ctx := cmd.ctx
 	if ctx == nil {
@@ -329,7 +329,7 @@ func ParseFile(path string, expandEnv bool) (*Config, error) {
 	return c, nil
 }
 
-func parseFlags(name string, args []string, output io.Writer) (*serverConfig, error) {
+func parseFlags(name string, args []string, output io.Writer, options ...func(*flag.FlagSet)) (*serverConfig, error) {
 	flags := flag.NewFlagSet(name, flag.ContinueOnError)
 	flags.SetOutput(output)
 	c := &serverConfig{}
@@ -344,6 +344,9 @@ func parseFlags(name string, args []string, output io.Writer) (*serverConfig, er
 	flags.StringVar(&c.LogLevel, "logLevel", "", "'debug', 'info', 'warn', or 'error'")
 	flags.StringVar(&c.TrustDomain, "trustDomain", "", "The trust domain that this server belongs to")
 	flags.BoolVar(&c.ExpandEnv, "expandEnv", false, "Expand environment variables in SPIRE config file")
+	for _, option := range options {
+		option(flags)
+	}
 	c.addOSFlags(flags)
 
 	err := flags.Parse(args)

cmd/spire-server/cli/validate/validate.go

@@ -1,42 +1,124 @@
 package validate
 
 import (
+	"context"
+	"errors"
+	"flag"
+	"fmt"
+
 	"github.com/mitchellh/cli"
 	"github.com/spiffe/spire/cmd/spire-server/cli/run"
 	commoncli "github.com/spiffe/spire/pkg/common/cli"
+	"github.com/spiffe/spire/pkg/common/cliprinter"
+	"github.com/spiffe/spire/pkg/common/log"
+	"github.com/spiffe/spire/pkg/server"
 )
 
 const commandName = "validate"
 
-func NewValidateCommand() cli.Command {
-	return newValidateCommand(commoncli.DefaultEnv)
+func NewValidateCommand(ctx context.Context, logOptions []log.Option) cli.Command {
+	return newValidateCommand(ctx, commoncli.DefaultEnv, logOptions)
 }
 
-func newValidateCommand(env *commoncli.Env) *validateCommand {
+func newValidateCommand(ctx context.Context, env *commoncli.Env, logOptions []log.Option) *validateCommand {
 	return &validateCommand{
-		env: env,
+		ctx:        ctx,
+		env:        env,
+		logOptions: logOptions,
 	}
 }
 
 type validateCommand struct {
-	env *commoncli.Env
+	ctx        context.Context
+	logOptions []log.Option
+	env        *commoncli.Env
+	printer    cliprinter.Printer
 }
 
 // Help prints the server cmd usage
 func (c *validateCommand) Help() string {
-	return run.Help(commandName, c.env.Stderr)
+	return run.Help(commandName, c.env.Stderr, c.SetupPrinter)
 }
 
 func (c *validateCommand) Synopsis() string {
 	return "Validates a SPIRE server configuration file"
 }
 
+func (c *validateCommand) SetupPrinter(flags *flag.FlagSet) {
+	cliprinter.AppendFlagWithCustomPretty(&c.printer, flags, c.env, c.prettyPrintValidate)
+}
+
 func (c *validateCommand) Run(args []string) int {
-	if _, err := run.LoadConfig(commandName, args, nil, c.env.Stderr, false); err != nil {
-		// Ignore error since a failure to write to stderr cannot very well be reported
-		_ = c.env.ErrPrintf("SPIRE server configuration file is invalid: %v\n", err)
+	config, err := run.LoadConfig(commandName, args, c.logOptions, c.env.Stderr, false, c.SetupPrinter)
+	if err != nil {
+		_, _ = fmt.Fprintln(c.env.Stderr, err)
+		return 1
+	}
+	config.ValidateOnly = true
+
+	// Set umask before starting up the server
+	commoncli.SetUmask(config.Log)
+
+	s := server.New(config)
+
+	ctx := c.ctx
+	if ctx == nil {
+		ctx = context.Background()
+	}
+
+	err = s.Run(ctx)
+	if err != nil {
+		config.Log.WithError(err).Error("Validation failed: validation server crashed")
+		return 1
+	}
+
+	err = c.printer.PrintStruct(&validateResult{
+		Valid: config.ValidationError == "",
+		Error: config.ValidationError,
+		Notes: config.ValidationNotes,
+	})
+	if err != nil {
 		return 1
 	}
-	_ = c.env.Println("SPIRE server configuration file is valid.")
 	return 0
 }
+
+type validateResult struct {
+	Valid bool     `json:"valid"`
+	Error string   `json:"error"`
+	Notes []string `json:"notes"`
+}
+
+func (c *validateCommand) prettyPrintValidate(env *commoncli.Env, results ...any) error {
+	if resultInterface, ok := results[0].([]any); ok {
+		result, ok := resultInterface[0].(*validateResult)
+		if !ok {
+			return errors.New("unexpected type")
+		}
+		// pretty print error section
+		if !result.Valid {
+			if err := env.Printf("Validation error:\n"); err != nil {
+				return err
+			}
+			if err := env.Printf("  %s\n", result.Error); err != nil {
+				return err
+			}
+		}
+		// pretty print notes section
+		if len(result.Notes) < 1 {
+			if err := env.Printf("No validation notes\n"); err != nil {
+				return err
+			}
+			return nil
+		}
+		if err := env.Printf("Validation notes:\n"); err != nil {
+			return err
+		}
+		for _, note := range result.Notes {
+			if err := env.Printf("  %s\n", note); err != nil {
+				return err
+			}
+		}
+	}
+	return cliprinter.ErrInternalCustomPrettyFunc
+}

cmd/spire-server/cli/validate/validate_test.go

@@ -2,6 +2,7 @@ package validate
 
 import (
 	"bytes"
+	"context"
 	"testing"
 
 	"github.com/mitchellh/cli"
@@ -31,11 +32,11 @@ func (s *ValidateSuite) SetupTest() {
 	s.stdout = new(bytes.Buffer)
 	s.stderr = new(bytes.Buffer)
 
-	s.cmd = newValidateCommand(&common_cli.Env{
+	s.cmd = newValidateCommand(context.Background(), &common_cli.Env{
 		Stdin:  s.stdin,
 		Stdout: s.stdout,
 		Stderr: s.stderr,
-	})
+	}, nil)
 }
 
 func (s *ValidateSuite) TestSynopsis() {

pkg/agent/catalog/catalog.go

@@ -91,7 +91,7 @@ func Load(ctx context.Context, config Config) (_ *Repository, err error) {
 	repo := &Repository{
 		log: config.Log,
 	}
-	repo.catalog, err = catalog.Load(ctx, catalog.Config{
+	repo.catalog, err = catalog.Load(ctx, &catalog.Config{
 		Log: config.Log,
 		CoreConfig: catalog.CoreConfig{
 			TrustDomain: config.TrustDomain,

pkg/common/catalog/catalog.go

@@ -107,6 +107,34 @@ type Config struct {
 
 	// CoreConfig is the core configuration provided to each plugin.
 	CoreConfig CoreConfig
+
+	// Validate plugins only
+	ValidateOnly bool
+
+	// Validation findings
+	ValidationNotes []string
+
+	// First validation error
+	ValidationError string
+}
+
+func (c *Config) ReportInfo(message string) {
+	c.ValidationNotes = append(c.ValidationNotes, message)
+}
+
+func (c *Config) ReportInfof(message string, args ...any) {
+	c.ReportInfo(fmt.Sprintf(message, args...))
+}
+
+func (c *Config) ReportError(message string) {
+	if c.ValidationError == "" {
+		c.ValidationError = message
+	}
+	c.ValidationNotes = append(c.ValidationNotes, message)
+}
+
+func (c *Config) ReportErrorf(message string, args ...any) {
+	c.ReportError(fmt.Sprintf(message, args...))
 }
 
 type Catalog struct {
@@ -129,7 +157,7 @@ func (c *Catalog) Close() error {
 // given catalog are considered invalidated. If any plugin fails to load or
 // configure, all plugins are unloaded, the catalog is cleared, and the
 // function returns an error.
-func Load(ctx context.Context, config Config, repo Repository) (_ *Catalog, err error) {
+func Load(ctx context.Context, config *Config, repo Repository) (_ *Catalog, err error) {
 	closers := make(closerGroup, 0)
 	defer func() {
 		// If loading fails, clear out the catalog and close down all plugins
@@ -145,26 +173,39 @@ func Load(ctx context.Context, config Config, repo Repository) (_ *Catalog, err
 		}
 	}()
 
+	log := config.Log.WithFields(logrus.Fields{
+		telemetry.SubsystemName: "common_catalog",
+	})
+
 	pluginRepos, err := makeBindablePluginRepos(repo.Plugins())
 	if err != nil {
 		return nil, err
 	}
+	log.Infof("bindablePluginRepos: %+v", pluginRepos)
+
 	serviceRepos, err := makeBindableServiceRepos(repo.Services())
 	if err != nil {
 		return nil, err
 	}
+	log.Infof("bindableServiceRepos: %+v", serviceRepos)
 
 	pluginCounts := make(map[string]int)
 	var reconfigurers Reconfigurers
 
 	for _, pluginConfig := range config.PluginConfigs {
+		log.Infof("plugin(%s): processing", pluginConfig.Name)
+
 		pluginLog := makePluginLog(config.Log, pluginConfig)
 
 		pluginRepo, ok := pluginRepos[pluginConfig.Type]
 		if !ok {
-			pluginLog.Error("Unsupported plugin type")
-			return nil, fmt.Errorf("unsupported plugin type %q", pluginConfig.Type)
+			config.ReportErrorf("common catalog: Unsupported plugin %q of type %q", pluginConfig.Name, pluginConfig.Type)
+			if !config.ValidateOnly {
+				return nil, fmt.Errorf("unsupported plugin type %q", pluginConfig.Type)
+			}
+			continue
 		}
+		log.Infof("plugin(%s): supported", pluginConfig.Name)
 
 		if pluginConfig.Disabled {
 			pluginLog.Debug("Not loading plugin; disabled")
@@ -173,29 +214,49 @@ func Load(ctx context.Context, config Config, repo Repository) (_ *Catalog, err
 
 		plugin, err := loadPlugin(ctx, pluginRepo.BuiltIns(), pluginConfig, pluginLog, config.HostServices)
 		if err != nil {
+			config.ReportErrorf("commmon catalog: plugin %q failed to load", pluginConfig.Name)
 			pluginLog.WithError(err).Error("Failed to load plugin")
-			return nil, fmt.Errorf("failed to load plugin %q: %w", pluginConfig.Name, err)
+			if !config.ValidateOnly {
+				return nil, fmt.Errorf("failed to load plugin %q: %w", pluginConfig.Name, err)
+			}
+			continue
 		}
 
 		// Add the plugin to the closers even though it has not been completely
 		// configured. If anything goes wrong (i.e. failure to configure,
 		// panic, etc.) we want the defer above to close the plugin. Failure to
 		// do so can orphan external plugin processes.
 		closers = append(closers, pluginCloser{plugin: plugin, log: pluginLog})
+		log.Infof("plugin(%s): loaded", pluginConfig.Name)
 
 		configurer, err := plugin.bindRepos(pluginRepo, serviceRepos)
 		if err != nil {
+			config.ReportErrorf("commmon catalog: failed to bind plugin %q", pluginConfig.Name)
 			pluginLog.WithError(err).Error("Failed to bind plugin")
-			return nil, fmt.Errorf("failed to bind plugin %q: %w", pluginConfig.Name, err)
+			if !config.ValidateOnly {
+				return nil, fmt.Errorf("failed to bind plugin %q: %w", pluginConfig.Name, err)
+			}
 		}
+		log.Infof("plugin(%s): bound, configurer %+v", pluginConfig.Name, configurer)
 
-		reconfigurer, err := configurePlugin(ctx, pluginLog, config.CoreConfig, configurer, pluginConfig.DataSource)
-		if err != nil {
-			pluginLog.WithError(err).Error("Failed to configure plugin")
-			return nil, fmt.Errorf("failed to configure plugin %q: %w", pluginConfig.Name, err)
-		}
-		if reconfigurer != nil {
-			reconfigurers = append(reconfigurers, reconfigurer)
+		if !config.ValidateOnly {
+			reconfigurer, err := configurePlugin(ctx, pluginLog, config.CoreConfig, configurer, pluginConfig.DataSource)
+			if err != nil {
+				pluginLog.WithError(err).Error("Failed to configure plugin")
+				return nil, fmt.Errorf("failed to configure plugin %q: %w", pluginConfig.Name, err)
+			}
+			if reconfigurer != nil {
+				reconfigurers = append(reconfigurers, reconfigurer)
+			}
+		} else {
+			result, _ := validatePlugin(ctx, pluginLog, config.CoreConfig, configurer, pluginConfig.DataSource)
+			for _, note := range result.Notes {
+				if note == result.Error {
+					config.ReportErrorf("plugin %s(%q): %s", pluginConfig.Type, pluginConfig.Name, note)
+				} else {
+					config.ReportInfof("plugin %s(%q): %s", pluginConfig.Type, pluginConfig.Name, note)
+				}
+			}
 		}
 
 		pluginLog.Info("Plugin loaded")
@@ -205,7 +266,11 @@ func Load(ctx context.Context, config Config, repo Repository) (_ *Catalog, err
 	// Make sure all plugin constraints are satisfied
 	for pluginType, pluginRepo := range pluginRepos {
 		if err := pluginRepo.Constraints().Check(pluginCounts[pluginType]); err != nil {
-			return nil, fmt.Errorf("plugin type %q constraint not satisfied: %w", pluginType, err)
+			config.ReportErrorf("commmon catalog: plugin type %q constraint violation: %s", pluginType, err.Error())
+			if !config.ValidateOnly {
+				return nil, fmt.Errorf("plugin type %q constraint not satisfied: %w", pluginType, err)
+			}
+			continue
 		}
 	}
 

pkg/common/catalog/catalog_test.go

@@ -391,7 +391,7 @@ func testLoad(t *testing.T, pluginPath string, tt loadTest) {
 		tt.mutateServiceRepo(serviceRepo)
 	}
 
-	cat, err := catalog.Load(context.Background(), config, repo)
+	cat, err := catalog.Load(context.Background(), &config, repo)
 	if cat != nil {
 		defer func() {
 			cat.Close()