chore: import upstream snapshot with attribution

api/exec/common.go

@@ -0,0 +1,79 @@
+package exec
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/proxy/factory"
+	"github.com/portainer/portainer/api/internal/registryutils"
+
+	"github.com/docker/cli/cli/config/types"
+	"github.com/rs/zerolog/log"
+)
+
+var stackNameNormalizeRegex = regexp.MustCompile("[^-_a-z0-9]+")
+
+func normalizeStackName(name string) string {
+	return stackNameNormalizeRegex.ReplaceAllString(strings.ToLower(name), "")
+}
+
+// fetchEndpointProxy returns the Docker host URL for the given endpoint.
+// For remote endpoints it creates a local proxy that handles TLS termination and
+// Portainer agent header injection; for local unix/npipe sockets no proxy is needed.
+func fetchEndpointProxy(proxyManager *proxy.Manager, endpoint *portainer.Endpoint) (string, *factory.ProxyServer, error) {
+	if strings.HasPrefix(endpoint.URL, "unix://") || strings.HasPrefix(endpoint.URL, "npipe://") {
+		return "", nil, nil
+	}
+
+	proxy, err := proxyManager.CreateAgentProxyServer(endpoint)
+	if err != nil {
+		return "", nil, err
+	}
+
+	return fmt.Sprintf("tcp://127.0.0.1:%d", proxy.Port), proxy, nil
+}
+
+// portainerRegistriesToAuthConfigs converts registries to Docker auth configs.
+// Callers must ensure ECR tokens are valid before calling this function (e.g. via
+// registryutils.RefreshAndPersistECRTokens with a real DataStoreTx). This function
+// intentionally performs no DB writes to avoid write-lock contention when called inside
+// an active BoltDB write transaction.
+func portainerRegistriesToAuthConfigs(registries []portainer.Registry) []types.AuthConfig {
+	var authConfigs []types.AuthConfig
+
+	for _, r := range registries {
+		ac := types.AuthConfig{
+			Username:      r.Username,
+			Password:      r.Password,
+			ServerAddress: r.URL,
+		}
+
+		if r.Authentication {
+			var err error
+
+			ac.Username, ac.Password, err = getEffectiveRegUsernamePassword(&r)
+			if err != nil {
+				continue
+			}
+		}
+
+		authConfigs = append(authConfigs, ac)
+	}
+
+	return authConfigs
+}
+
+func getEffectiveRegUsernamePassword(registry *portainer.Registry) (string, string, error) {
+	username, password, err := registryutils.GetRegEffectiveCredential(registry)
+	if err != nil {
+		log.Warn().
+			Err(err).
+			Str("RegistryName", registry.Name).
+			Msg("Failed to get effective credential. Skip logging with this registry.")
+	}
+
+	return username, password, err
+}

api/exec/compose_stack.go

@@ -0,0 +1,215 @@
+package exec
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"os"
+	"path"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/logs"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/portainer/portainer/pkg/libstack"
+)
+
+// ComposeStackManager is a wrapper for docker-compose binary
+type ComposeStackManager struct {
+	deployer     libstack.Deployer
+	proxyManager *proxy.Manager
+}
+
+// NewComposeStackManager returns a Compose stack manager
+func NewComposeStackManager(deployer libstack.Deployer, proxyManager *proxy.Manager) *ComposeStackManager {
+	return &ComposeStackManager{
+		deployer:     deployer,
+		proxyManager: proxyManager,
+	}
+}
+
+// ComposeSyntaxMaxVersion returns the maximum supported version of the docker compose syntax
+func (manager *ComposeStackManager) ComposeSyntaxMaxVersion() string {
+	return portainer.ComposeSyntaxMaxVersion
+}
+
+// Up builds, (re)creates and starts containers in the background. Wraps `docker-compose up -d` command
+func (manager *ComposeStackManager) Up(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, options portainer.ComposeUpOptions) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	}
+
+	if proxy != nil {
+		defer proxy.Close()
+	}
+
+	envFilePath, err := createEnvFile(stack)
+	if err != nil {
+		return fmt.Errorf("failed to create env file: %w", err)
+	}
+
+	filePaths := stackutils.GetStackFilePaths(stack, true)
+	if err = manager.deployer.Deploy(ctx, filePaths, libstack.DeployOptions{
+		Options: libstack.Options{
+			WorkingDir:  stack.ProjectPath,
+			EnvFilePath: envFilePath,
+			Host:        url,
+			ProjectName: stack.Name,
+			Registries:  portainerRegistriesToAuthConfigs(options.Registries),
+		},
+		ForceRecreate:        options.ForceRecreate,
+		AbortOnContainerExit: options.AbortOnContainerExit,
+		RemoveOrphans:        options.Prune,
+	}); err != nil {
+		return fmt.Errorf("failed to deploy a stack: %w", err)
+	}
+	return nil
+}
+
+// Run runs a one-off command on a service. Wraps `docker-compose run` command
+func (manager *ComposeStackManager) Run(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, serviceName string, options portainer.ComposeRunOptions) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	}
+
+	if proxy != nil {
+		defer proxy.Close()
+	}
+
+	envFilePath, err := createEnvFile(stack)
+	if err != nil {
+		return fmt.Errorf("failed to create env file: %w", err)
+	}
+
+	filePaths := stackutils.GetStackFilePaths(stack, true)
+	if err = manager.deployer.Run(ctx, filePaths, serviceName, libstack.RunOptions{
+		Options: libstack.Options{
+			WorkingDir:  stack.ProjectPath,
+			EnvFilePath: envFilePath,
+			Host:        url,
+			ProjectName: stack.Name,
+			Registries:  portainerRegistriesToAuthConfigs(options.Registries),
+		},
+		Remove:   options.Remove,
+		Args:     options.Args,
+		Detached: options.Detached,
+	}); err != nil {
+		return fmt.Errorf("failed to deploy a stack: %w", err)
+	}
+	return nil
+}
+
+// Down stops and removes containers, networks, images, and volumes
+func (manager *ComposeStackManager) Down(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	} else if proxy != nil {
+		defer proxy.Close()
+	}
+
+	if err = manager.deployer.Remove(ctx, stack.Name, nil, libstack.RemoveOptions{
+		Options: libstack.Options{
+			WorkingDir: "",
+			Host:       url,
+		},
+	}); err != nil {
+		return fmt.Errorf("failed to remove a stack: %w", err)
+	}
+	return nil
+}
+
+// Pull an image associated with a service defined in a docker-compose.yml or docker-stack.yml file,
+// but does not start containers based on those images.
+func (manager *ComposeStackManager) Pull(ctx context.Context, stack *portainer.Stack, endpoint *portainer.Endpoint, options portainer.ComposeOptions) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	} else if proxy != nil {
+		defer proxy.Close()
+	}
+
+	envFilePath, err := createEnvFile(stack)
+	if err != nil {
+		return fmt.Errorf("failed to create env file: %w", err)
+	}
+
+	filePaths := stackutils.GetStackFilePaths(stack, true)
+	if err = manager.deployer.Pull(ctx, filePaths, libstack.Options{
+		WorkingDir:  stack.ProjectPath,
+		EnvFilePath: envFilePath,
+		Host:        url,
+		ProjectName: stack.Name,
+		Registries:  portainerRegistriesToAuthConfigs(options.Registries),
+	}); err != nil {
+		return fmt.Errorf("failed to pull images of the stack: %w", err)
+	}
+	return nil
+}
+
+// NormalizeStackName returns a new stack name with unsupported characters replaced
+func (manager *ComposeStackManager) NormalizeStackName(name string) string {
+	return normalizeStackName(name)
+}
+
+// createEnvFile creates a file that would hold both "in-place" and default environment variables.
+// It will return the name of the file if the stack has "in-place" env vars, otherwise empty string.
+func createEnvFile(stack *portainer.Stack) (string, error) {
+	if len(stack.Env) == 0 {
+		return "", nil
+	}
+
+	envFilePath := path.Join(stack.ProjectPath, "stack.env")
+	envfile, err := os.OpenFile(envFilePath, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0o600)
+	if err != nil {
+		return "", err
+	}
+	defer logs.CloseAndLogErr(envfile)
+
+	// Copy from default .env file
+	defaultEnvPath := path.Join(stack.ProjectPath, path.Dir(stack.EntryPoint), ".env")
+	if err := copyDefaultEnvFile(envfile, defaultEnvPath); err != nil {
+		return "", err
+	}
+
+	// Copy from stack env vars
+	if err := copyConfigEnvVars(envfile, stack.Env); err != nil {
+		return "", err
+	}
+
+	return envFilePath, nil
+}
+
+// copyDefaultEnvFile copies the default .env file if it exists to the provided writer
+func copyDefaultEnvFile(w io.Writer, defaultEnvFilePath string) error {
+	defaultEnvFile, err := os.Open(defaultEnvFilePath)
+	if err != nil {
+		// If cannot open a default file, then don't need to copy it.
+		// We could as well stat it and check if it exists, but this is more efficient.
+		return nil
+	}
+
+	defer logs.CloseAndLogErr(defaultEnvFile)
+
+	if _, err = io.Copy(w, defaultEnvFile); err == nil {
+		if _, err = fmt.Fprintf(w, "\n"); err != nil {
+			return fmt.Errorf("failed to copy default env file: %w", err)
+		}
+	}
+
+	return nil
+	// If couldn't copy the .env file, then ignore the error and try to continue
+}
+
+// copyConfigEnvVars write the environment variables from stack configuration to the writer
+func copyConfigEnvVars(w io.Writer, envs []portainer.Pair) error {
+	for _, v := range envs {
+		if _, err := fmt.Fprintf(w, "%s=%s\n", v.Name, v.Value); err != nil {
+			return fmt.Errorf("failed to copy config env vars: %w", err)
+		}
+	}
+
+	return nil
+}

api/exec/compose_stack_integration_test.go

@@ -0,0 +1,79 @@
+package exec
+
+import (
+	"os"
+	"os/exec"
+	"strings"
+	"testing"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+	"github.com/portainer/portainer/pkg/libstack/compose"
+	"github.com/portainer/portainer/pkg/testhelpers"
+	"github.com/stretchr/testify/require"
+
+	"github.com/rs/zerolog/log"
+)
+
+const composeFile = `version: "3.9"
+services:
+  busybox:
+    image: "alpine:latest"
+    container_name: "compose_wrapper_test"`
+const composedContainerName = "compose_wrapper_test"
+
+func setup(t *testing.T) (*portainer.Stack, *portainer.Endpoint) {
+	dir := t.TempDir()
+	composeFileName := "compose_wrapper_test.yml"
+	f, err := os.Create(filesystem.JoinPaths(dir, composeFileName))
+	require.NoError(t, err)
+
+	_, err = f.WriteString(composeFile)
+	require.NoError(t, err)
+
+	stack := &portainer.Stack{
+		ProjectPath: dir,
+		EntryPoint:  composeFileName,
+		Name:        "project-name",
+	}
+
+	return stack, &portainer.Endpoint{URL: "unix://"}
+}
+
+func Test_UpAndDown(t *testing.T) {
+	t.Parallel()
+	testhelpers.IntegrationTest(t)
+
+	stack, endpoint := setup(t)
+
+	deployer := compose.NewComposeDeployer()
+
+	w := NewComposeStackManager(deployer, nil)
+
+	if err := w.Up(t.Context(), stack, endpoint, portainer.ComposeUpOptions{}); err != nil {
+		t.Fatalf("Error calling docker-compose up: %s", err)
+	}
+
+	if !containerExists(composedContainerName) {
+		t.Fatal("container should exist")
+	}
+
+	if err := w.Down(t.Context(), stack, endpoint); err != nil {
+		t.Fatalf("Error calling docker-compose down: %s", err)
+	}
+
+	if containerExists(composedContainerName) {
+		t.Fatal("container should be removed")
+	}
+}
+
+func containerExists(containerName string) bool {
+	cmd := exec.Command("docker", "ps", "-a", "-f", "name="+containerName)
+
+	out, err := cmd.Output()
+	if err != nil {
+		log.Fatal().Err(err).Msg("failed to list containers")
+	}
+
+	return strings.Contains(string(out), containerName)
+}

api/exec/compose_stack_test.go

@@ -0,0 +1,169 @@
+package exec
+
+import (
+	"io"
+	"os"
+	"testing"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/filesystem"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_createEnvFile(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+
+	tests := []struct {
+		name         string
+		stack        *portainer.Stack
+		expected     string
+		expectedFile bool
+	}{
+		{
+			name: "should not add env file option if stack doesn't have env variables",
+			stack: &portainer.Stack{
+				ProjectPath: dir,
+				Env:         nil,
+			},
+			expected: "",
+		},
+		{
+			name: "should not add env file option if stack's env variables are empty",
+			stack: &portainer.Stack{
+				ProjectPath: dir,
+				Env:         []portainer.Pair{},
+			},
+			expected: "",
+		},
+		{
+			name: "should add env file option if stack has env variables",
+			stack: &portainer.Stack{
+				ProjectPath: dir,
+				Env: []portainer.Pair{
+					{Name: "var1", Value: "value1"},
+					{Name: "var2", Value: "value2"},
+				},
+			},
+			expected: "var1=value1\nvar2=value2\n",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result, _ := createEnvFile(tt.stack)
+
+			if tt.expected != "" {
+				assert.Equal(t, filesystem.JoinPaths(tt.stack.ProjectPath, "stack.env"), result)
+
+				f, _ := os.Open(filesystem.JoinPaths(dir, "stack.env"))
+				content, _ := io.ReadAll(f)
+
+				assert.Equal(t, tt.expected, string(content))
+			} else {
+				assert.Empty(t, result)
+			}
+		})
+	}
+}
+
+func Test_createEnvFile_mergesDefultAndInplaceEnvVars(t *testing.T) {
+	t.Parallel()
+	dir := t.TempDir()
+	err := os.WriteFile(filesystem.JoinPaths(dir, ".env"), []byte("VAR1=VAL1\nVAR2=VAL2\n"), 0600)
+	require.NoError(t, err)
+
+	stack := &portainer.Stack{
+		ProjectPath: dir,
+		Env: []portainer.Pair{
+			{Name: "VAR1", Value: "NEW_VAL1"},
+			{Name: "VAR3", Value: "VAL3"},
+		},
+	}
+	result, err := createEnvFile(stack)
+	assert.Equal(t, filesystem.JoinPaths(stack.ProjectPath, "stack.env"), result)
+	require.NoError(t, err)
+	assert.FileExists(t, filesystem.JoinPaths(dir, "stack.env"))
+
+	f, err := os.Open(filesystem.JoinPaths(dir, "stack.env"))
+	require.NoError(t, err)
+
+	content, err := io.ReadAll(f)
+	require.NoError(t, err)
+
+	assert.Equal(t, []byte("VAR1=VAL1\nVAR2=VAL2\n\nVAR1=NEW_VAL1\nVAR3=VAL3\n"), content)
+}
+
+func Test_portainerRegistriesToAuthConfigs(t *testing.T) {
+	t.Parallel()
+
+	t.Run("returns empty slice for empty input", func(t *testing.T) {
+		t.Parallel()
+		result := portainerRegistriesToAuthConfigs([]portainer.Registry{})
+		require.Nil(t, result)
+	})
+
+	t.Run("uses registry URL, username and password for non-authenticated registry", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{URL: "registry.example.com", Username: "user", Password: "pass", Authentication: false},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "registry.example.com", result[0].ServerAddress)
+		require.Equal(t, "user", result[0].Username)
+		require.Equal(t, "pass", result[0].Password)
+	})
+
+	t.Run("uses username and password for authenticated non-ECR registry", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{URL: "registry.example.com", Username: "user", Password: "pass", Authentication: true, Type: portainer.CustomRegistry},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "user", result[0].Username)
+		require.Equal(t, "pass", result[0].Password)
+	})
+
+	t.Run("parses ECR access token for authenticated ECR registry with valid token", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{
+				URL:               "123456789.dkr.ecr.us-east-1.amazonaws.com",
+				Username:          "AKIAIOSFODNN7EXAMPLE",
+				Password:          "secretkey",
+				Authentication:    true,
+				Type:              portainer.EcrRegistry,
+				Ecr:               portainer.EcrData{Region: "us-east-1"},
+				AccessToken:       "AWS:ecr-password",
+				AccessTokenExpiry: time.Now().Add(time.Hour).Unix(),
+			},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "AWS", result[0].Username)
+		require.Equal(t, "ecr-password", result[0].Password)
+	})
+
+	t.Run("includes valid registries and skips ones with credential errors", func(t *testing.T) {
+		t.Parallel()
+		registries := []portainer.Registry{
+			{URL: "valid.example.com", Username: "user", Password: "pass", Authentication: false},
+			{
+				URL:               "123456789.dkr.ecr.us-east-1.amazonaws.com",
+				Authentication:    true,
+				Type:              portainer.EcrRegistry,
+				Ecr:               portainer.EcrData{Region: "us-east-1"},
+				AccessToken:       "no-colon-token",
+				AccessTokenExpiry: time.Now().Add(time.Hour).Unix(),
+			},
+		}
+		result := portainerRegistriesToAuthConfigs(registries)
+		require.Len(t, result, 1)
+		require.Equal(t, "valid.example.com", result[0].ServerAddress)
+	})
+}

api/exec/exectest/kubernetes_mocks.go

@@ -0,0 +1,28 @@
+package exectest
+
+import (
+	"context"
+
+	portainer "github.com/portainer/portainer/api"
+)
+
+type kubernetesMockDeployer struct {
+	portainer.KubernetesDeployer
+}
+
+// NewKubernetesDeployer creates a mock kubernetes deployer
+func NewKubernetesDeployer() *kubernetesMockDeployer {
+	return &kubernetesMockDeployer{}
+}
+
+func (deployer *kubernetesMockDeployer) Deploy(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+	return "", nil
+}
+
+func (deployer *kubernetesMockDeployer) Remove(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+	return "", nil
+}
+
+func (deployer *kubernetesMockDeployer) Restart(_ context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, manifestFiles []string, namespace string) (string, error) {
+	return "", nil
+}

api/exec/kubernetes_deploy.go

@@ -0,0 +1,138 @@
+package exec
+
+import (
+	"context"
+	"fmt"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/dataservices"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/http/proxy/factory"
+	"github.com/portainer/portainer/api/http/proxy/factory/kubernetes"
+	"github.com/portainer/portainer/api/kubernetes/cli"
+	"github.com/portainer/portainer/pkg/libkubectl"
+
+	"github.com/pkg/errors"
+)
+
+const (
+	defaultServerURL = "https://kubernetes.default.svc"
+)
+
+// KubernetesDeployer represents a service to deploy resources inside a Kubernetes environment(endpoint).
+type KubernetesDeployer struct {
+	dataStore                   dataservices.DataStore
+	reverseTunnelService        portainer.ReverseTunnelService
+	signatureService            portainer.DigitalSignatureService
+	kubernetesClientFactory     *cli.ClientFactory
+	kubernetesTokenCacheManager *kubernetes.TokenCacheManager
+	proxyManager                *proxy.Manager
+}
+
+// NewKubernetesDeployer initializes a new KubernetesDeployer service.
+func NewKubernetesDeployer(kubernetesTokenCacheManager *kubernetes.TokenCacheManager, kubernetesClientFactory *cli.ClientFactory, datastore dataservices.DataStore, reverseTunnelService portainer.ReverseTunnelService, signatureService portainer.DigitalSignatureService, proxyManager *proxy.Manager) *KubernetesDeployer {
+	return &KubernetesDeployer{
+		dataStore:                   datastore,
+		reverseTunnelService:        reverseTunnelService,
+		signatureService:            signatureService,
+		kubernetesClientFactory:     kubernetesClientFactory,
+		kubernetesTokenCacheManager: kubernetesTokenCacheManager,
+		proxyManager:                proxyManager,
+	}
+}
+
+func (deployer *KubernetesDeployer) getToken(userID portainer.UserID, endpoint *portainer.Endpoint, setLocalAdminToken bool) (string, error) {
+	kubeCLI, err := deployer.kubernetesClientFactory.GetPrivilegedKubeClient(endpoint)
+	if err != nil {
+		return "", err
+	}
+
+	tokenCache := deployer.kubernetesTokenCacheManager.GetOrCreateTokenCache(endpoint.ID)
+
+	tokenManager, err := kubernetes.NewTokenManager(kubeCLI, deployer.dataStore, tokenCache, setLocalAdminToken)
+	if err != nil {
+		return "", err
+	}
+
+	user, err := deployer.dataStore.User().Read(userID)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to fetch the user")
+	}
+
+	if user.Role == portainer.AdministratorRole {
+		return tokenManager.GetAdminServiceAccountToken(), nil
+	}
+
+	token, err := tokenManager.GetUserServiceAccountToken(int(user.ID), endpoint.ID)
+	if err != nil {
+		return "", err
+	}
+
+	if token == "" {
+		return "", errors.New("can not get a valid user service account token")
+	}
+
+	return token, nil
+}
+
+// Deploy upserts Kubernetes resources defined in manifest(s)
+func (deployer *KubernetesDeployer) Deploy(ctx context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	return deployer.command(ctx, "apply", userID, endpoint, resources, namespace)
+}
+
+// Remove deletes Kubernetes resources defined in manifest(s)
+func (deployer *KubernetesDeployer) Remove(ctx context.Context, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	return deployer.command(ctx, "delete", userID, endpoint, resources, namespace)
+}
+
+func (deployer *KubernetesDeployer) command(ctx context.Context, operation string, userID portainer.UserID, endpoint *portainer.Endpoint, resources []string, namespace string) (string, error) {
+	token, err := deployer.getToken(userID, endpoint, endpoint.Type == portainer.KubernetesLocalEnvironment)
+	if err != nil {
+		return "", errors.Wrap(err, "failed generating a user token")
+	}
+
+	serverURL := defaultServerURL
+	if endpoint.Type == portainer.AgentOnKubernetesEnvironment || endpoint.Type == portainer.EdgeAgentOnKubernetesEnvironment {
+		url, proxy, err := deployer.getAgentURL(endpoint)
+		if err != nil {
+			return "", errors.WithMessage(err, "failed generating endpoint URL")
+		}
+		defer proxy.Close()
+
+		serverURL = url
+	}
+
+	client, err := libkubectl.NewClient(&libkubectl.ClientAccess{
+		Token:     token,
+		ServerUrl: serverURL,
+	}, namespace, "", true)
+	if err != nil {
+		return "", errors.Wrap(err, "failed to create kubectl client")
+	}
+
+	operations := map[string]func(context.Context, []string) (string, error){
+		"apply":  client.ApplyDynamic,
+		"delete": client.DeleteDynamic,
+	}
+
+	operationFunc, ok := operations[operation]
+	if !ok {
+		return "", errors.Errorf("unsupported operation: %s", operation)
+	}
+
+	output, err := operationFunc(ctx, resources)
+	if err != nil {
+		return "", errors.Wrapf(err, "failed to execute kubectl %s command", operation)
+	}
+
+	return output, nil
+}
+
+func (deployer *KubernetesDeployer) getAgentURL(endpoint *portainer.Endpoint) (string, *factory.ProxyServer, error) {
+	proxy, err := deployer.proxyManager.CreateAgentProxyServer(endpoint)
+	if err != nil {
+		return "", nil, err
+	}
+
+	return fmt.Sprintf("http://127.0.0.1:%d/kubernetes", proxy.Port), proxy, nil
+}

api/exec/kubernetes_deploy_test.go

@@ -0,0 +1,181 @@
+package exec
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+type mockKubectlClient struct {
+	applyFunc          func(ctx context.Context, files []string) error
+	deleteFunc         func(ctx context.Context, files []string) error
+	rolloutRestartFunc func(ctx context.Context, resources []string) error
+}
+
+func (m *mockKubectlClient) Apply(ctx context.Context, files []string) error {
+	if m.applyFunc != nil {
+		return m.applyFunc(ctx, files)
+	}
+	return nil
+}
+
+func (m *mockKubectlClient) Delete(ctx context.Context, files []string) error {
+	if m.deleteFunc != nil {
+		return m.deleteFunc(ctx, files)
+	}
+	return nil
+}
+
+func (m *mockKubectlClient) RolloutRestart(ctx context.Context, resources []string) error {
+	if m.rolloutRestartFunc != nil {
+		return m.rolloutRestartFunc(ctx, resources)
+	}
+	return nil
+}
+
+func testExecuteKubectlOperation(client *mockKubectlClient, operation string, manifestFiles []string) error {
+	operations := map[string]func(context.Context, []string) error{
+		"apply":           client.Apply,
+		"delete":          client.Delete,
+		"rollout-restart": client.RolloutRestart,
+	}
+
+	operationFunc, ok := operations[operation]
+	if !ok {
+		return fmt.Errorf("unsupported operation: %s", operation)
+	}
+
+	if err := operationFunc(context.Background(), manifestFiles); err != nil {
+		return fmt.Errorf("failed to execute kubectl %s command: %w", operation, err)
+	}
+
+	return nil
+}
+
+func TestExecuteKubectlOperation_Apply_Success(t *testing.T) {
+	t.Parallel()
+	called := false
+	mockClient := &mockKubectlClient{
+		applyFunc: func(ctx context.Context, files []string) error {
+			called = true
+			assert.Equal(t, []string{"manifest1.yaml", "manifest2.yaml"}, files)
+			return nil
+		},
+	}
+
+	manifests := []string{"manifest1.yaml", "manifest2.yaml"}
+	err := testExecuteKubectlOperation(mockClient, "apply", manifests)
+
+	require.NoError(t, err)
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_Apply_Error(t *testing.T) {
+	t.Parallel()
+	expectedErr := errors.New("kubectl apply failed")
+	called := false
+	mockClient := &mockKubectlClient{
+		applyFunc: func(ctx context.Context, files []string) error {
+			called = true
+			assert.Equal(t, []string{"error.yaml"}, files)
+			return expectedErr
+		},
+	}
+
+	manifests := []string{"error.yaml"}
+	err := testExecuteKubectlOperation(mockClient, "apply", manifests)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), expectedErr.Error())
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_Delete_Success(t *testing.T) {
+	t.Parallel()
+	called := false
+	mockClient := &mockKubectlClient{
+		deleteFunc: func(ctx context.Context, files []string) error {
+			called = true
+			assert.Equal(t, []string{"manifest1.yaml"}, files)
+			return nil
+		},
+	}
+
+	manifests := []string{"manifest1.yaml"}
+	err := testExecuteKubectlOperation(mockClient, "delete", manifests)
+
+	require.NoError(t, err)
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_Delete_Error(t *testing.T) {
+	t.Parallel()
+	expectedErr := errors.New("kubectl delete failed")
+	called := false
+	mockClient := &mockKubectlClient{
+		deleteFunc: func(ctx context.Context, files []string) error {
+			called = true
+			assert.Equal(t, []string{"error.yaml"}, files)
+			return expectedErr
+		},
+	}
+
+	manifests := []string{"error.yaml"}
+	err := testExecuteKubectlOperation(mockClient, "delete", manifests)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), expectedErr.Error())
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_RolloutRestart_Success(t *testing.T) {
+	t.Parallel()
+	called := false
+	mockClient := &mockKubectlClient{
+		rolloutRestartFunc: func(ctx context.Context, resources []string) error {
+			called = true
+			assert.Equal(t, []string{"deployment/nginx"}, resources)
+			return nil
+		},
+	}
+
+	resources := []string{"deployment/nginx"}
+	err := testExecuteKubectlOperation(mockClient, "rollout-restart", resources)
+
+	require.NoError(t, err)
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_RolloutRestart_Error(t *testing.T) {
+	t.Parallel()
+	expectedErr := errors.New("kubectl rollout restart failed")
+	called := false
+	mockClient := &mockKubectlClient{
+		rolloutRestartFunc: func(ctx context.Context, resources []string) error {
+			called = true
+			assert.Equal(t, []string{"deployment/error"}, resources)
+			return expectedErr
+		},
+	}
+
+	resources := []string{"deployment/error"}
+	err := testExecuteKubectlOperation(mockClient, "rollout-restart", resources)
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), expectedErr.Error())
+	assert.True(t, called)
+}
+
+func TestExecuteKubectlOperation_UnsupportedOperation(t *testing.T) {
+	t.Parallel()
+	mockClient := &mockKubectlClient{}
+
+	err := testExecuteKubectlOperation(mockClient, "unsupported", []string{})
+
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "unsupported operation")
+}

api/exec/swarm_stack.go

@@ -0,0 +1,112 @@
+package exec
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	portainer "github.com/portainer/portainer/api"
+	"github.com/portainer/portainer/api/http/proxy"
+	"github.com/portainer/portainer/api/stacks/stackutils"
+	"github.com/portainer/portainer/pkg/libstack"
+	"github.com/portainer/portainer/pkg/libstack/swarm"
+)
+
+// postDeployFailureCheckTimeout bounds how long Deploy waits for tasks to start or fail after being accepted by Swarm.
+const postDeployFailureCheckTimeout = 30 * time.Second
+
+// SwarmStackManager represents a service for managing stacks.
+type SwarmStackManager struct {
+	deployer     swarm.Deployer
+	proxyManager *proxy.Manager
+}
+
+// NewSwarmStackManager creates a new SwarmStackManager.
+func NewSwarmStackManager(
+	deployer swarm.Deployer,
+	proxyManager *proxy.Manager,
+) *SwarmStackManager {
+	return &SwarmStackManager{
+		deployer:     deployer,
+		proxyManager: proxyManager,
+	}
+}
+
+// Deploy creates or updates a Docker Swarm stack.
+func (manager *SwarmStackManager) Deploy(
+	ctx context.Context,
+	stack *portainer.Stack,
+	prune bool,
+	pullImage bool,
+	endpoint *portainer.Endpoint,
+	registries []portainer.Registry,
+) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	}
+
+	if proxy != nil {
+		defer proxy.Close()
+	}
+
+	filePaths := stackutils.GetStackFilePaths(stack, true)
+
+	env := make([]string, 0, len(stack.Env))
+	for _, ev := range stack.Env {
+		env = append(env, ev.Name+"="+ev.Value)
+	}
+
+	options := swarm.Options{
+		ProjectName: stack.Name,
+		Host:        url,
+		Env:         env,
+		Registries:  portainerRegistriesToAuthConfigs(registries),
+	}
+
+	if err := manager.deployer.Deploy(context.TODO(), filePaths, swarm.DeployOptions{
+		Options:       options,
+		RemoveOrphans: prune,
+		PullImage:     pullImage,
+	}); err != nil {
+		return err
+	}
+
+	// Swarm schedules and pulls images asynchronously, so check for early failures before reporting success.
+	waitCtx, cancel := context.WithTimeout(ctx, postDeployFailureCheckTimeout)
+	defer cancel()
+
+	result := manager.deployer.WaitForStatus(waitCtx, stack.Name, options, libstack.StatusRunning)
+	if result.Status == libstack.StatusError {
+		return fmt.Errorf("deployment failed: %s", result.ErrorMsg)
+	}
+
+	return nil
+}
+
+// Remove deletes all resources belonging to a Swarm stack.
+func (manager *SwarmStackManager) Remove(
+	ctx context.Context,
+	stack *portainer.Stack,
+	endpoint *portainer.Endpoint,
+) error {
+	url, proxy, err := fetchEndpointProxy(manager.proxyManager, endpoint)
+	if err != nil {
+		return fmt.Errorf("failed to fetch environment proxy: %w", err)
+	}
+
+	if proxy != nil {
+		defer proxy.Close()
+	}
+
+	return manager.deployer.Remove(context.TODO(), stack.Name, swarm.RemoveOptions{
+		Options: swarm.Options{
+			Host: url,
+		},
+	})
+}
+
+// NormalizeStackName returns a new stack name with unsupported characters replaced.
+func (manager *SwarmStackManager) NormalizeStackName(name string) string {
+	return normalizeStackName(name)
+}