Signed-off-by: Sunny <darkowlzz@protonmail.com>

docs/spec/v1beta2: fix recommended settings typo

Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>

Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>

Some tests requires the sops CLI to be installed,
by adding it as a requirement of the Makefile tests
target we make it easier for new contributors to
engage with the codebase.

Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>

Two new flags were added to allow users to enable the
use of user.Exec and InsecureTLS in the kubeconfigs
provided remote apply reconciliations.

Breaking change: both functionalities are no longer
enabled by default.

Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>

Add kubeconfig flags

Signed-off-by: Sanskar Jaiswal <sanskar.jaiswal@weave.works>

Implement health check for Kubernetes jobs

When the flag --default-service-account was added it changed
slightly the behaviour of the spec.KubeConfig field. It forces
the impersonation to always take place, either via the contents
of spec.ServiceAccountName or its fallback at controller level.

Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>

Update KubeConfig documentation

The original keyservice implementation was forked from SOPS, keeping
the prompt capabilities intact. However, since the implementations have
started to grow, it is better to remove this capability and resort to
a hardcoded `false` default for the fallback server. As the controller
is never expected to have an interactive TTY/shell.

Signed-off-by: Hidde Beydals <hello@hidde.co>

These bits of code have a history of accidents around the fallback
behavior. By simplifying it, the fallback should generally always work,
unless you put in instructions to take another route.

Signed-off-by: Hidde Beydals <hello@hidde.co>

This ensures data used for decryption is not exposed widely after
constructing the Server, and prevents a bypass to the default server
fallback.

Signed-off-by: Hidde Beydals <hello@hidde.co>

Signed-off-by: Hidde Beydals <hello@hidde.co>

Signed-off-by: Hidde Beydals <hello@hidde.co>

This ensures we signal early that we will be unable to fulfill the
request, instead of letting the underlying keysource implementation
run into mayhem. Which can be problematic for e.g. PGP, which has
assumptions about things being located relative to the given home
directory, resulting in possible unexpected behavior if an empty path
is given.

Signed-off-by: Hidde Beydals <hello@hidde.co>

Signed-off-by: Hidde Beydals <hello@hidde.co>

This revises the PGP keysource implementation, removing bits of code
that were not actually in use, or not viable in combination with how we
work with keys. In short:

- crypto/openpgp implementation has been removed. As it is unable to read
  the keystore created by newer versions of GnuPG. Given we import user
  provided keys _with_ GnuPG, this was basically dead code.
- All capabilities around fetching public keys from a server have been
  removed.
- "Jailing" of GnuPG shell-out is now handled in `gpgExec`, in addition,
  arguments for encrypt and decrypt execs have been revised to ensure
  they e.g. do not instruct to use the agent.

Signed-off-by: Hidde Beydals <hello@hidde.co>

Signed-off-by: Hidde Beydals <hello@hidde.co>

This adds a new GnuPGHome type which can be used to create a new
contained GnuPG home directory. The type is self-validating, ensuring
it adheres to e.g. permission rules set out by GnuPG, and allows for
importing keys from armored bytes and files.

Because of this introduction, the decryptor service no longer has to
write data from a Secret to a temporary file, but is instead able to
directly import them into the keyring from the Secret entry's bytes.

Signed-off-by: Hidde Beydals <hello@hidde.co>

This adds a new ParsedIdentities type which can be used to parse a set
of age identities just once, instead of parsing them for every Decrypt
request.

Signed-off-by: Hidde Beydals <hello@hidde.co>

This adds a new Token type which can be used to configure an
azcore.TokenCredential on a master key. Due to this introduction, the
server only has to go through the AADConfig once.

Signed-off-by: Hidde Beydals <hello@hidde.co>

Signed-off-by: Hidde Beydals <hello@hidde.co>

Signed-off-by: Hidde Beydals <hello@hidde.co>

Signed-off-by: Hidde Beydals <hello@hidde.co>

Signed-off-by: Paulo Gomes <paulo.gomes@weave.works>