Skip to content

ROX-35667: configurable user config path via ROXIE_USER_CONFIG_PATH#233

Merged
mclasmeier merged 3 commits into
mainfrom
configurable-user-config-path
Jul 10, 2026
Merged

ROX-35667: configurable user config path via ROXIE_USER_CONFIG_PATH#233
mclasmeier merged 3 commits into
mainfrom
configurable-user-config-path

Conversation

@mclasmeier

@mclasmeier mclasmeier commented Jul 8, 2026

Copy link
Copy Markdown
Collaborator

Add configurable user config path via ROXIE_USER_CONFIG_PATH

Set ROXIE_USER_CONFIG_PATH to override the default user config file location ($CONFIG_DIR/roxie/config.yaml). When unset or empty, existing behavior is preserved.

Changes:

  • internal/paths/paths.go — check env var at top of UserConfigPath()
  • internal/paths/paths_test.go — new, 5 test cases

Summary by CodeRabbit

  • New Features

    • Added support for overriding the user config file location via an environment variable.
    • When the override is provided, the app now verifies the file is readable before using it; otherwise it falls back to the default location.
  • Tests

    • Expanded coverage for env override scenarios, including empty values and readable/unreadable or missing config files.
  • Bug Fixes

    • Improved safety when applying user defaults by enforcing readability checks for the active user config location.

Allow overriding the default user config file path by setting the
ROXIE_USER_CONFIG_PATH environment variable. When set to a non-empty
value, UserConfigPath() returns it directly instead of the default
$CONFIG_DIR/roxie/config.yaml path.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
@coderabbitai

coderabbitai Bot commented Jul 8, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Enterprise

Run ID: de71afec-2046-47a6-b4b5-b10cbb8480be

📥 Commits

Reviewing files that changed from the base of the PR and between 9e28369 and e03f7ad.

📒 Files selected for processing (4)
  • cmd/deploy_test.go
  • cmd/main.go
  • internal/paths/paths.go
  • internal/paths/paths_test.go

📝 Walkthrough

Walkthrough

UserConfigPath now accepts a validation flag, reads ROXIE_USER_CONFIG_PATH when set, validates readability on demand, and falls back to the derived default path. Call sites and tests were updated for the new signature and behavior.

Changes

User config path env override

Layer / File(s) Summary
Path lookup and validation
internal/paths/paths.go, cmd/main.go
Adds the environment override constant, the validation-aware UserConfigPath flow, the readable-file helper, and the extracted default-path helper; tryApplyUserDefaults now opts into validation.
Call-site updates and tests
cmd/deploy_test.go, internal/paths/paths_test.go
Updates test call sites for the new UserConfigPath(false) signature and adds coverage for override, validation failure, default fallback, and UserConfigPathString behavior.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

  • stackrox/roxie#203: Also changes internal/paths/UserConfigPath() in internal/paths/paths.go; that PR adds config path resolution, while this one adds an environment-variable override and tests.

Suggested reviewers: AlexVulaj, porridge

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly summarizes the main change: making the user config path configurable via ROXIE_USER_CONFIG_PATH.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
📝 Generate docstrings
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch configurable-user-config-path

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/paths/paths_test.go`:
- Around line 21-24: The "returns default path when env var is not set" subtest
in paths_test.go currently leaves ROXIE_USER_CONFIG_PATH uncontrolled when
setEnv is false, so the test can depend on ambient environment state. Update the
test setup around the UserConfigPath subtests to always call t.Setenv explicitly
for ROXIE_USER_CONFIG_PATH, using an empty string for the default-path case and
a real value for the override case, so the fallback behavior is exercised
deterministically.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Enterprise

Run ID: e18a3831-9bb1-45a1-90de-8f4b85514d12

📥 Commits

Reviewing files that changed from the base of the PR and between 9e28369 and 169d048.

📒 Files selected for processing (2)
  • internal/paths/paths.go
  • internal/paths/paths_test.go

Comment thread internal/paths/paths_test.go

@vikin91 vikin91 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

From the code perspective: this looks good!

From how this works perspective:

Is the path given by the user being validated?

⚠️ Edit: the issues below were obtained using an incorrect version of roxie. Only selected of them are true.

I tried:

➜ ROXIE_USER_CONFIG_PATH='fckgw-rhqq2 $$!~!!!' roxie deploy --dry-run

00:00 Running with a controlling terminal.
00:00 Looking up main image tag
00:00 No MAIN_IMAGE_TAG found in the environment, using default main image tag 4.9.2 for deployment
00:00 To use a different tag, set the MAIN_IMAGE_TAG environment variable
00:00 Alternatively, execute roxie from within the stackrox repository, in which case the currently checked out stackrox tag will be used
00:00 Detected cluster type: Unknown
00:00 Detected container runtime socket: unix:///var/run/docker.sock
00:00 🚀 ACS Deployer initialized
00:00 Exiting because of enabled dry run mode.

but maybe the dry-run mode is not covering this?

Also help text is not being updated:

➜ ROXIE_USER_CONFIG_PATH="~/.roxie.yaml" roxie deploy -h
Deploy ACS components (central, secured-cluster, operator).
(...)
Global Flags:
      --dry-run            Do not actually modify cluster
      --skip-user-config   Skips reading of user's configuration (/Users/prygiels/Library/Application Support/roxie/config.yaml)
...

Putting here a bogus value without dry-run started tearing down @porridge 's cluster without any checks or warnings (sorry):

➜ ROXIE_USER_CONFIG_PATH='fckgw-rhqq2 $$!~!!!' roxie deploy both
00:00 Using kubeconfig ~/.cluster2/kubeconfig
00:02 Running with a controlling terminal.
00:02 Looking up main image tag
00:02 No MAIN_IMAGE_TAG found in the environment, using default main image tag 4.9.2 for deployment
00:02 To use a different tag, set the MAIN_IMAGE_TAG environment variable
00:02 Alternatively, execute roxie from within the stackrox repository, in which case the currently checked out stackrox tag will be used
00:02 Detected cluster type: GKE (infra)
00:02 Detected container runtime socket: unix:///var/run/docker.sock
00:02 🚀 ACS Deployer initialized
00:02
00:02 ┌────────────────────────────────────────────────────────────┐
00:02 │ Deployment Configuration                                   │
00:02 ├────────────────────────────────────────────────────────────┤
00:02 │              Component: Central                            │
00:02 │           Cluster Type: GKE (infra)                        │
00:02 │               Main Tag: 4.9.2                              │
00:02 │     Kubernetes Context: gke_acs-team-temp-dev_us-centra... │
00:02 │               Exposure: loadbalancer                       │
00:02 └────────────────────────────────────────────────────────────┘
00:02
00:02
00:02 ┌────────────────────────────────────────────────────────────┐
00:02 │ Deployment Configuration                                   │
00:02 ├────────────────────────────────────────────────────────────┤
00:02 │              Component: Secured Cluster                    │
00:02 │           Cluster Type: GKE (infra)                        │
00:02 │               Main Tag: 4.9.2                              │
00:02 │     Kubernetes Context: gke_acs-team-temp-dev_us-centra... │
00:02 └────────────────────────────────────────────────────────────┘
00:02
00:02 Preparing and verifying Docker credentials...
00:02 Successfully verified credentials for quay.io (repository: rhacs-eng/main)
00:02 Docker credentials verified successfully
00:02 Initiating deployment of Central and Secured Cluster
00:06 Operator version mismatch detected:
00:06   Current: 4.11.0
00:06   Desired: 4.9.2
00:06 🔄 Operator version mismatch, redeploying...
00:06 🧹 Tearing down operator deployed without OLM...
^C%

@mclasmeier

Copy link
Copy Markdown
Collaborator Author

@vikin91 Are you sure that you have the correct roxie in PATH? 🤔

❯ ROXIE_USER_CONFIG_PATH='fckgw-rhqq2 $$!~!!!' ./roxie --help
roxie is a fast, developer-friendly CLI to deploy and manage
Red Hat Advanced Cluster Security (ACS) on any Kubernetes/OpenShift cluster.

Usage:
  roxie [command]

Available Commands:
  completion  Generate the autocompletion script for the specified shell
  deploy      Deploy ACS components
  help        Help about any command
  logs        View logs for ACS components
  shell       Open a subshell for an existing ACS Central deployment
  teardown    Teardown ACS components
  version     Print version information

Flags:
      --dry-run            Do not actually modify cluster
  -h, --help               help for roxie
      --skip-user-config   Skips reading of user's configuration (fckgw-rhqq2 $$!~!!!)
  -v, --verbose            Enable verbose output (show CRs)

Use "roxie [command] --help" for more information about a command.

@mclasmeier

Copy link
Copy Markdown
Collaborator Author

And for your other question, @vikin91 , this is NOT being validated.
This environment variable only influences which path is to be considered the path of the user config. At the same time, this user config is entirely optional, doesn't have to exist, etc.
For example, ROXIE_USER_CONFIG_PATH=/dev/null roxie ... would be equivalent to roxie --skip-user-config.

@mclasmeier

mclasmeier commented Jul 9, 2026

Copy link
Copy Markdown
Collaborator Author

@vikin91, as for this example from you:

➜ ROXIE_USER_CONFIG_PATH="~/.roxie.yaml" roxie deploy -h
Deploy ACS components (central, secured-cluster, operator).
(...)
Global Flags:
      --dry-run            Do not actually modify cluster
      --skip-user-config   Skips reading of user's configuration (/Users/prygiels/Library/Application Support/roxie/config.yaml)
...

This PR is relying on the shell doing the resolving of home directories, etc.

Compare

❮ ROXIE_USER_CONFIG_PATH=~/.roxie.yaml ./roxie --help | rg configuration
--skip-user-config Skips reading of user's configuration (/Users/mclasmeier/.roxie.yaml)


vs.

❯ ROXIE_USER_CONFIG_PATH="~/.roxie.yaml" ./roxie --help | rg configuration
--skip-user-config Skips reading of user's configuration (~/.roxie.yaml)

@mclasmeier mclasmeier changed the title Add configurable user config path via ROXIE_USER_CONFIG_PATH ROX-35667: configurable user config path via ROXIE_USER_CONFIG_PATH Jul 9, 2026

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🧹 Nitpick comments (1)
internal/paths/paths.go (1)

15-15: 🚀 Performance & Scalability | 🔵 Trivial | 💤 Low value

Prefer os.Open over os.ReadFile for readability checks.

os.ReadFile reads the entire file contents into memory only to discard them. If the intent is to verify existence and read permission, os.Open followed by an immediate Close is more appropriate and avoids unnecessary I/O for large files.

♻️ Proposed refactor
-		if _, err := os.ReadFile(overwrittenPath); err != nil {
+		f, err := os.Open(overwrittenPath)
+		if err != nil {
 			return "", fmt.Errorf("config file %q specified in environment variable %s cannot be read: %w",
 				overwrittenPath, envUserConfigPath, err)
 		}
+		_ = f.Close()
 		return overwrittenPath, nil
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@internal/paths/paths.go` at line 15, The readability check in the overwritten
path handling is using os.ReadFile just to confirm the file can be accessed,
which unnecessarily loads the file contents. Update the logic around the
overwrittenPath check to use os.Open followed by an immediate Close instead,
keeping the same error handling in the relevant path helper that performs the
existence/read-permission check.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@internal/paths/paths.go`:
- Around line 14-19: The new readability check in the env override branch of
user config path resolution will break existing tests because they set
ROXIE_USER_CONFIG_PATH to a nonexistent file and still expect success. Update
the tests around user config path handling, especially the env-override cases in
paths_test.go and the UserConfigPathString path, to use a real temporary file
created with t.TempDir() when asserting success, and add a separate test that
explicitly covers the unreadable/nonexistent-path error returned by the
UserConfigPath logic.

---

Nitpick comments:
In `@internal/paths/paths.go`:
- Line 15: The readability check in the overwritten path handling is using
os.ReadFile just to confirm the file can be accessed, which unnecessarily loads
the file contents. Update the logic around the overwrittenPath check to use
os.Open followed by an immediate Close instead, keeping the same error handling
in the relevant path helper that performs the existence/read-permission check.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yml

Review profile: CHILL

Plan: Enterprise

Run ID: d3c3e13a-0130-4ba3-8783-2c744213cc09

📥 Commits

Reviewing files that changed from the base of the PR and between 169d048 and de08631.

📒 Files selected for processing (1)
  • internal/paths/paths.go

Comment thread internal/paths/paths.go

@vikin91 vikin91 left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM provided that the unit-tests are fixed (and they don't change behavior).

Excerpt from manual tests:

$ ROXIE_USER_CONFIG_PATH='fckgw-rhqq2 $$!~!!!' ./roxie deploy both

00:00 Using kubeconfig /Users/prygiels/.cluster2/kubeconfig
00:02 Running with a controlling terminal.
Error: applying user config: config file "fckgw-rhqq2 $$!~!!!" specified in environment variable ROXIE_USER_CONFIG_PATH cannot be read: open fckgw-rhqq2 $$!~!!!: no such file or directory


$  ROXIE_USER_CONFIG_PATH='/tmp/not-there' ./roxie deploy both -c "/tmp/not-there-2"

Error: invalid argument "/tmp/not-there-2" for "-c, --config" flag: failed to read config file "/tmp/not-there-2": open /tmp/not-there-2: no such file or directory


$  ROXIE_USER_CONFIG_PATH='/tmp/not-there' ./roxie deploy both

00:00 Using kubeconfig /Users/prygiels/.cluster2/kubeconfig
00:00 Running with a controlling terminal.
Error: applying user config: config file "/tmp/not-there" specified in environment variable ROXIE_USER_CONFIG_PATH cannot be read: open /tmp/not-there: no such file or directory


$  ROXIE_USER_CONFIG_PATH='/tmp/not-there' ./roxie deploy both --dry-run

00:00 Running with a controlling terminal.
Error: applying user config: config file "/tmp/not-there" specified in environment variable ROXIE_USER_CONFIG_PATH cannot be read: open /tmp/not-there: no such file or directory

…ould still the path in --help, even if it doesn't exist. Updated tests and small refactoring
@mclasmeier mclasmeier force-pushed the configurable-user-config-path branch from 7b0b383 to e03f7ad Compare July 9, 2026 13:30
@mclasmeier

Copy link
Copy Markdown
Collaborator Author

@coderabbitai, fresh review please.

@coderabbitai

coderabbitai Bot commented Jul 9, 2026

Copy link
Copy Markdown

@mclasmeier Got it, kicking off a fresh review of the PR now.

✅ Action performed

Full review finished.

@mclasmeier

Copy link
Copy Markdown
Collaborator Author

@vikin91 There was a small issue left in the version you have approved:
It would have had the side effect that, when your ROXIE_USER_CONFIG_PATH does not exist, it would show (UNAVAILABLE) in the --help output instead of the actual path. I think, the failure should only manifest during actions, not during --help output in the form of hiding what roxie actually tries to lookup and rendering (UNAVAILABLE) instead.

So, what I had to do is, smuggle a validate bool into the function which returns the path. For the action-flow we have validate=true, for the --help flow we use validate=false.

Accompanied with that are some minor refactoring in paths.go, in particular to assist the tests.
Tests are updated and passing.

@vikin91

vikin91 commented Jul 10, 2026

Copy link
Copy Markdown

Got it! Still green for me!

Passing a bool into a function may suggest that the function might need splitting into two functions 😉

@mclasmeier mclasmeier merged commit 30a0b90 into main Jul 10, 2026
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants