# Declarative GitFlow: restrict kustomize to master branch

- Link: https://www.agilicus.com/declarative-gitflow-restrict-kustomize-to-master-branch/
- Published: 2019-06-30T15:42:20+00:00
- Author: Don Bowman

You believe in [declarative](https://www.agilicus.com/i-declare-make-it-so/), in
GitFlow, in small feature branches. Perfect. Your team is now making small changes
on a branch and Merge Requests are happening, the CI is happening, all is good in
the world.

Except sometimes people forget and do a `[kustomize](https://github.com/kubernetes-sigs/kustomize)
build . | kubectl apply -f -` from the wrong branch (e.g. not master, prior to merge).
You know that someday the CD will fix this. But someday is not here.

Enter this small ~hack~ piece of brilliance.

    ```wp-block-preformatted
    $ cat agilicus/v1/branchrestrict/BranchRestrict 
     #!/usr/bin/env /usr/bin/python3
     import subprocess
     import sys
     import fnmatch
     import yaml
     with open(sys.argv[1], 'r') as stream:
         try:
             data = yaml.safe_load(stream)
         except yaml.YAMLError as exc:
             print("Error parsing BranchRestrict generator input (%s)",
                   file=sys.stderr)
     branch = subprocess.check_output(['/usr/bin/git',
                                       'rev-parse',
                                       '--abbrev-ref',
                                       'HEAD']).strip().decode('ascii')
     def allow(branch, target):
         print("---")
         sys.exit(0)
     def denied(branch, target):
         print(f"Error: branch '{branch}', denied by rule '{target}'",
                file=sys.stderr)
         sys.exit(1)
     for target in data['allowed_branches']:
         if fnmatch.filter([branch], target):
             allow(branch, target)

     for target in data['denied_branches']:
         if fnmatch.filter([branch], target):
             denied(branch, target)
    ```

OK, a plugin generator. We’ll use that like:

    ```wp-block-preformatted
    $ cat master-only.yaml 
    --- 
    apiVersion: agilicus/v1
    kind: BranchRestrict
    metadata:
      name: not-used-br
    name: branch-restrict
    allowed_branches:
    master
    denied_branches:
    '*' 
    ```

Perfect. Now no-one will forget and accidentally apply from their not-yet-merged
feature branch. Beauty.