Skip to content

Commit

Permalink
Remove file reading from bootstrap package
Browse files Browse the repository at this point in the history 
Signed-off-by: Philip Laine <philip.laine@gmail.com>
  • Loading branch information
@phillebaba
phillebaba committed Oct 25, 2022
1 parent c7e158a commit 116f6de
Show file tree
Hide file tree
Showing 17 changed files with 293 additions and 141 deletions.
32 changes: 26 additions & 6 deletions cmd/flux/bootstrap_bitbucket_server.go
View file
Expand Up @@ -22,6 +22,7 @@ import (
"os"
"time"

"github.com/ProtonMail/go-crypto/openpgp"
"github.com/go-git/go-git/v5/plumbing/transport/http"
"github.com/spf13/cobra"

Expand Down Expand Up @@ -212,18 +213,23 @@ func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
secretOpts.Username = bServerArgs.username
}
secretOpts.Password = bitbucketToken

if bootstrapArgs.caFile != "" {
secretOpts.CAFilePath = bootstrapArgs.caFile
}
secretOpts.CAFile = caBundle
} else {
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
secretOpts.SSHHostname = bServerArgs.hostname

if bootstrapArgs.privateKeyFile != "" {
secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
b, err := os.ReadFile(bootstrapArgs.privateKeyFile)
if err != nil {
return fmt.Errorf("failed to open private key file: %w", err)
}
keypair, err := sourcesecret.LoadKeyPair(b, gitArgs.password)
if err != nil {
return err
}
secretOpts.Keypair = keypair
}
if bootstrapArgs.sshHostname != "" {
secretOpts.SSHHostname = bootstrapArgs.sshHostname
Expand All @@ -243,7 +249,21 @@ func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
}

// Read PGP Key
var entityList openpgp.EntityList
if bootstrapArgs.gpgKeyRingPath != "" {
r, err := os.Open(bootstrapArgs.gpgKeyRingPath)
if err != nil {
return fmt.Errorf("unable to open GPG key ring: %w", err)
}
entityList, err = openpgp.ReadKeyRing(r)
if err != nil {
return err
}
}

// Bootstrap config

bootstrapOpts := []bootstrap.GitProviderOption{
bootstrap.WithProviderRepository(bServerArgs.owner, bServerArgs.repository, bServerArgs.personal),
bootstrap.WithBranch(bootstrapArgs.branch),
Expand All @@ -255,7 +275,7 @@ func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
bootstrap.WithLogger(logger),
bootstrap.WithCABundle(caBundle),
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
}
if bootstrapArgs.sshHostname != "" {
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))
Expand Down
46 changes: 33 additions & 13 deletions cmd/flux/bootstrap_git.go
View file
Expand Up @@ -24,9 +24,10 @@ import (
"strings"
"time"

"github.com/ProtonMail/go-crypto/openpgp"
"github.com/go-git/go-git/v5/plumbing/transport"
"github.com/go-git/go-git/v5/plumbing/transport/http"
"github.com/go-git/go-git/v5/plumbing/transport/ssh"
gitssh "github.com/go-git/go-git/v5/plumbing/transport/ssh"
"github.com/manifoldco/promptui"
"github.com/spf13/cobra"
corev1 "k8s.io/api/core/v1"
Expand Down Expand Up @@ -169,6 +170,15 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
installOptions.BaseURL = customBaseURL
}

var caBundle []byte
if bootstrapArgs.caFile != "" {
var err error
caBundle, err = os.ReadFile(bootstrapArgs.caFile)
if err != nil {
return fmt.Errorf("unable to read TLS CA file: %w", err)
}
}

// Source generation and secret config
secretOpts := sourcesecret.Options{
Name: bootstrapArgs.secretName,
Expand All @@ -179,10 +189,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
if bootstrapArgs.tokenAuth {
secretOpts.Username = gitArgs.username
secretOpts.Password = gitArgs.password

if bootstrapArgs.caFile != "" {
secretOpts.CAFilePath = bootstrapArgs.caFile
}
secretOpts.CAFile = caBundle

// Remove port of the given host when not syncing over HTTP/S to not assume port for protocol
// This _might_ be overwritten later on by e.g. --ssh-hostname
Expand Down Expand Up @@ -213,8 +220,17 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
if bootstrapArgs.sshHostname != "" {
repositoryURL.Host = bootstrapArgs.sshHostname
}
// TODO: Share code with other bootstrap commands
if bootstrapArgs.privateKeyFile != "" {
secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
b, err := os.ReadFile(bootstrapArgs.privateKeyFile)
if err != nil {
return fmt.Errorf("failed to open private key file: %w", err)
}
keypair, err := sourcesecret.LoadKeyPair(b, gitArgs.password)
if err != nil {
return err
}
secretOpts.Keypair = keypair
}

// Configure last as it depends on the config above.
Expand All @@ -235,12 +251,16 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
}

var caBundle []byte
if bootstrapArgs.caFile != "" {
var err error
caBundle, err = os.ReadFile(bootstrapArgs.caFile)
// Read PGP Key
var entityList openpgp.EntityList
if bootstrapArgs.gpgKeyRingPath != "" {
r, err := os.Open(bootstrapArgs.gpgKeyRingPath)
if err != nil {
return fmt.Errorf("unable to read TLS CA file: %w", err)
return fmt.Errorf("unable to open GPG key ring: %w", err)
}
entityList, err = openpgp.ReadKeyRing(r)
if err != nil {
return err
}
}

Expand All @@ -254,7 +274,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
bootstrap.WithPostGenerateSecretFunc(promptPublicKey),
bootstrap.WithLogger(logger),
bootstrap.WithCABundle(caBundle),
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
}

// Setup bootstrapper with constructed configs
Expand Down Expand Up @@ -288,7 +308,7 @@ func transportForURL(u *url.URL) (transport.AuthMethod, error) {
}, nil
case "ssh":
if bootstrapArgs.privateKeyFile != "" {
return ssh.NewPublicKeysFromFile(u.User.Username(), bootstrapArgs.privateKeyFile, gitArgs.password)
return gitssh.NewPublicKeysFromFile(u.User.Username(), bootstrapArgs.privateKeyFile, gitArgs.password)
}
return nil, nil
default:
Expand Down
18 changes: 16 additions & 2 deletions cmd/flux/bootstrap_github.go
View file
Expand Up @@ -22,6 +22,7 @@ import (
"os"
"time"

"github.com/ProtonMail/go-crypto/openpgp"
"github.com/go-git/go-git/v5/plumbing/transport/http"
"github.com/spf13/cobra"

Expand Down Expand Up @@ -206,7 +207,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
secretOpts.Password = ghToken

if bootstrapArgs.caFile != "" {
secretOpts.CAFilePath = bootstrapArgs.caFile
secretOpts.CAFile = caBundle
}
} else {
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
Expand All @@ -232,6 +233,19 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
}

// Read PGP Key
var entityList openpgp.EntityList
if bootstrapArgs.gpgKeyRingPath != "" {
r, err := os.Open(bootstrapArgs.gpgKeyRingPath)
if err != nil {
return fmt.Errorf("unable to open GPG key ring: %w", err)
}
entityList, err = openpgp.ReadKeyRing(r)
if err != nil {
return err
}
}

// Bootstrap config
bootstrapOpts := []bootstrap.GitProviderOption{
bootstrap.WithProviderRepository(githubArgs.owner, githubArgs.repository, githubArgs.personal),
Expand All @@ -244,7 +258,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
bootstrap.WithLogger(logger),
bootstrap.WithCABundle(caBundle),
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
}
if bootstrapArgs.sshHostname != "" {
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))
Expand Down
28 changes: 25 additions & 3 deletions cmd/flux/bootstrap_gitlab.go
View file
Expand Up @@ -24,6 +24,7 @@ import (
"strings"
"time"

"github.com/ProtonMail/go-crypto/openpgp"
"github.com/go-git/go-git/v5/plumbing/transport/http"
"github.com/spf13/cobra"

Expand Down Expand Up @@ -217,7 +218,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
secretOpts.Password = glToken

if bootstrapArgs.caFile != "" {
secretOpts.CAFilePath = bootstrapArgs.caFile
secretOpts.CAFile = caBundle
}
} else {
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
Expand All @@ -226,7 +227,15 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
secretOpts.SSHHostname = gitlabArgs.hostname

if bootstrapArgs.privateKeyFile != "" {
secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
b, err := os.ReadFile(bootstrapArgs.privateKeyFile)
if err != nil {
return err
}
keypair, err := sourcesecret.LoadKeyPair(b, gitArgs.password)
if err != nil {
return err
}
secretOpts.Keypair = keypair
}
if bootstrapArgs.sshHostname != "" {
secretOpts.SSHHostname = bootstrapArgs.sshHostname
Expand All @@ -246,6 +255,19 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
}

// Read PGP Key
var entityList openpgp.EntityList
if bootstrapArgs.gpgKeyRingPath != "" {
r, err := os.Open(bootstrapArgs.gpgKeyRingPath)
if err != nil {
return fmt.Errorf("unable to open GPG key ring: %w", err)
}
entityList, err = openpgp.ReadKeyRing(r)
if err != nil {
return err
}
}

// Bootstrap config
bootstrapOpts := []bootstrap.GitProviderOption{
bootstrap.WithProviderRepository(gitlabArgs.owner, gitlabArgs.repository, gitlabArgs.personal),
Expand All @@ -258,7 +280,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
bootstrap.WithLogger(logger),
bootstrap.WithCABundle(caBundle),
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
}
if bootstrapArgs.sshHostname != "" {
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))
Expand Down
19 changes: 17 additions & 2 deletions cmd/flux/create_secret_git.go
View file
Expand Up @@ -21,6 +21,7 @@ import (
"crypto/elliptic"
"fmt"
"net/url"
"os"

"github.com/spf13/cobra"
corev1 "k8s.io/api/core/v1"
Expand Down Expand Up @@ -136,7 +137,15 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {
switch u.Scheme {
case "ssh":
opts.SSHHostname = u.Host
opts.PrivateKeyPath = secretGitArgs.privateKeyFile
b, err := os.ReadFile(secretGitArgs.privateKeyFile)
if err != nil {
return fmt.Errorf("failed to open private key file: %w", err)
}
keypair, err := sourcesecret.LoadKeyPair(b, secretGitArgs.password)
if err != nil {
return nil
}
opts.Keypair = keypair
opts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(secretGitArgs.keyAlgorithm)
opts.RSAKeyBits = int(secretGitArgs.rsaBits)
opts.ECDSACurve = secretGitArgs.ecdsaCurve.Curve
Expand All @@ -147,7 +156,13 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {
}
opts.Username = secretGitArgs.username
opts.Password = secretGitArgs.password
opts.CAFilePath = secretGitArgs.caFile
if secretGitArgs.caFile != "" {
caBundle, err := os.ReadFile(bootstrapArgs.caFile)
if err != nil {
return fmt.Errorf("unable to read TLS CA file: %w", err)
}
opts.CAFile = caBundle
}
default:
return fmt.Errorf("git URL scheme '%s' not supported, can be: ssh, http and https", u.Scheme)
}
Expand Down
37 changes: 29 additions & 8 deletions cmd/flux/create_secret_helm.go
View file
Expand Up @@ -18,6 +18,8 @@ package main

import (
"context"
"fmt"
"os"

"github.com/spf13/cobra"
corev1 "k8s.io/api/core/v1"
Expand Down Expand Up @@ -74,15 +76,34 @@ func createSecretHelmCmdRun(cmd *cobra.Command, args []string) error {
return err
}

caBundle := []byte{}
if secretHelmArgs.caFile != "" {
var err error
caBundle, err = os.ReadFile(bootstrapArgs.caFile)
if err != nil {
return fmt.Errorf("unable to read TLS CA file: %w", err)
}
}

var certFile, keyFile []byte
if secretHelmArgs.certFile != "" && secretHelmArgs.keyFile != "" {
if certFile, err = os.ReadFile(secretHelmArgs.certFile); err != nil {
return fmt.Errorf("failed to read cert file: %w", err)
}
if keyFile, err = os.ReadFile(secretHelmArgs.keyFile); err != nil {
return fmt.Errorf("failed to read key file: %w", err)
}
}

opts := sourcesecret.Options{
Name: name,
Namespace: *kubeconfigArgs.Namespace,
Labels: labels,
Username: secretHelmArgs.username,
Password: secretHelmArgs.password,
CAFilePath: secretHelmArgs.caFile,
CertFilePath: secretHelmArgs.certFile,
KeyFilePath: secretHelmArgs.keyFile,
Name: name,
Namespace: *kubeconfigArgs.Namespace,
Labels: labels,
Username: secretHelmArgs.username,
Password: secretHelmArgs.password,
CAFile: caBundle,
CertFile: certFile,
KeyFile: keyFile,
}
secret, err := sourcesecret.Generate(opts)
if err != nil {
Expand Down

0 comments on commit 116f6de

Please sign in to comment.