Skip to content

Commit a4734d7

Browse files
phillebabaphillebaba
committed
Remove file reading from bootstrap package
Signed-off-by: Philip Laine <[email protected]>
1 parent 2c267c9 commit a4734d7

17 files changed

+270
-168
lines changed

‎cmd/flux/bootstrap_bitbucket_server.go‎

Lines changed: 14 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -212,19 +212,18 @@ func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
212212
secretOpts.Username = bServerArgs.username
213213
}
214214
secretOpts.Password = bitbucketToken
215-
216-
if bootstrapArgs.caFile != "" {
217-
secretOpts.CAFilePath = bootstrapArgs.caFile
218-
}
215+
secretOpts.CAFile = caBundle
219216
} else {
217+
keypair, err := sourcesecret.LoadKeyPairFromPath(bootstrapArgs.privateKeyFile, gitArgs.password)
218+
if err != nil {
219+
return err
220+
}
221+
secretOpts.Keypair = keypair
220222
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
221223
secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
222224
secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
223-
secretOpts.SSHHostname = bServerArgs.hostname
224225

225-
if bootstrapArgs.privateKeyFile != "" {
226-
secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
227-
}
226+
secretOpts.SSHHostname = bServerArgs.hostname
228227
if bootstrapArgs.sshHostname != "" {
229228
secretOpts.SSHHostname = bootstrapArgs.sshHostname
230229
}
@@ -243,7 +242,13 @@ func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
243242
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
244243
}
245244

245+
entityList, err := bootstrap.LoadEntityListFromPath(bootstrapArgs.gpgKeyRingPath)
246+
if err != nil {
247+
return err
248+
}
249+
246250
// Bootstrap config
251+
247252
bootstrapOpts := []bootstrap.GitProviderOption{
248253
bootstrap.WithProviderRepository(bServerArgs.owner, bServerArgs.repository, bServerArgs.personal),
249254
bootstrap.WithBranch(bootstrapArgs.branch),
@@ -255,7 +260,7 @@ func bootstrapBServerCmdRun(cmd *cobra.Command, args []string) error {
255260
bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
256261
bootstrap.WithLogger(logger),
257262
bootstrap.WithCABundle(caBundle),
258-
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
263+
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
259264
}
260265
if bootstrapArgs.sshHostname != "" {
261266
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))

‎cmd/flux/bootstrap_git.go‎

Lines changed: 19 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,15 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
169169
installOptions.BaseURL = customBaseURL
170170
}
171171

172+
var caBundle []byte
173+
if bootstrapArgs.caFile != "" {
174+
var err error
175+
caBundle, err = os.ReadFile(bootstrapArgs.caFile)
176+
if err != nil {
177+
return fmt.Errorf("unable to read TLS CA file: %w", err)
178+
}
179+
}
180+
172181
// Source generation and secret config
173182
secretOpts := sourcesecret.Options{
174183
Name: bootstrapArgs.secretName,
@@ -179,10 +188,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
179188
if bootstrapArgs.tokenAuth {
180189
secretOpts.Username = gitArgs.username
181190
secretOpts.Password = gitArgs.password
182-
183-
if bootstrapArgs.caFile != "" {
184-
secretOpts.CAFilePath = bootstrapArgs.caFile
185-
}
191+
secretOpts.CAFile = caBundle
186192

187193
// Remove port of the given host when not syncing over HTTP/S to not assume port for protocol
188194
// This _might_ be overwritten later on by e.g. --ssh-hostname
@@ -213,9 +219,12 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
213219
if bootstrapArgs.sshHostname != "" {
214220
repositoryURL.Host = bootstrapArgs.sshHostname
215221
}
216-
if bootstrapArgs.privateKeyFile != "" {
217-
secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
222+
223+
keypair, err := sourcesecret.LoadKeyPairFromPath(bootstrapArgs.privateKeyFile, gitArgs.password)
224+
if err != nil {
225+
return err
218226
}
227+
secretOpts.Keypair = keypair
219228

220229
// Configure last as it depends on the config above.
221230
secretOpts.SSHHostname = repositoryURL.Host
@@ -235,13 +244,9 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
235244
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
236245
}
237246

238-
var caBundle []byte
239-
if bootstrapArgs.caFile != "" {
240-
var err error
241-
caBundle, err = os.ReadFile(bootstrapArgs.caFile)
242-
if err != nil {
243-
return fmt.Errorf("unable to read TLS CA file: %w", err)
244-
}
247+
entityList, err := bootstrap.LoadEntityListFromPath(bootstrapArgs.gpgKeyRingPath)
248+
if err != nil {
249+
return err
245250
}
246251

247252
// Bootstrap config
@@ -254,7 +259,7 @@ func bootstrapGitCmdRun(cmd *cobra.Command, args []string) error {
254259
bootstrap.WithPostGenerateSecretFunc(promptPublicKey),
255260
bootstrap.WithLogger(logger),
256261
bootstrap.WithCABundle(caBundle),
257-
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
262+
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
258263
}
259264

260265
// Setup bootstrapper with constructed configs

‎cmd/flux/bootstrap_github.go‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -204,16 +204,13 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
204204
if bootstrapArgs.tokenAuth {
205205
secretOpts.Username = "git"
206206
secretOpts.Password = ghToken
207-
208-
if bootstrapArgs.caFile != "" {
209-
secretOpts.CAFilePath = bootstrapArgs.caFile
210-
}
207+
secretOpts.CAFile = caBundle
211208
} else {
212209
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
213210
secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
214211
secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
215-
secretOpts.SSHHostname = githubArgs.hostname
216212

213+
secretOpts.SSHHostname = githubArgs.hostname
217214
if bootstrapArgs.sshHostname != "" {
218215
secretOpts.SSHHostname = bootstrapArgs.sshHostname
219216
}
@@ -232,6 +229,11 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
232229
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
233230
}
234231

232+
entityList, err := bootstrap.LoadEntityListFromPath(bootstrapArgs.gpgKeyRingPath)
233+
if err != nil {
234+
return err
235+
}
236+
235237
// Bootstrap config
236238
bootstrapOpts := []bootstrap.GitProviderOption{
237239
bootstrap.WithProviderRepository(githubArgs.owner, githubArgs.repository, githubArgs.personal),
@@ -244,7 +246,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error {
244246
bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
245247
bootstrap.WithLogger(logger),
246248
bootstrap.WithCABundle(caBundle),
247-
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
249+
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
248250
}
249251
if bootstrapArgs.sshHostname != "" {
250252
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))

‎cmd/flux/bootstrap_gitlab.go‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -215,19 +215,18 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
215215
if bootstrapArgs.tokenAuth {
216216
secretOpts.Username = "git"
217217
secretOpts.Password = glToken
218-
219-
if bootstrapArgs.caFile != "" {
220-
secretOpts.CAFilePath = bootstrapArgs.caFile
221-
}
218+
secretOpts.CAFile = caBundle
222219
} else {
220+
keypair, err := sourcesecret.LoadKeyPairFromPath(bootstrapArgs.privateKeyFile, gitArgs.password)
221+
if err != nil {
222+
return err
223+
}
224+
secretOpts.Keypair = keypair
223225
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(bootstrapArgs.keyAlgorithm)
224226
secretOpts.RSAKeyBits = int(bootstrapArgs.keyRSABits)
225227
secretOpts.ECDSACurve = bootstrapArgs.keyECDSACurve.Curve
226-
secretOpts.SSHHostname = gitlabArgs.hostname
227228

228-
if bootstrapArgs.privateKeyFile != "" {
229-
secretOpts.PrivateKeyPath = bootstrapArgs.privateKeyFile
230-
}
229+
secretOpts.SSHHostname = gitlabArgs.hostname
231230
if bootstrapArgs.sshHostname != "" {
232231
secretOpts.SSHHostname = bootstrapArgs.sshHostname
233232
}
@@ -246,6 +245,11 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
246245
RecurseSubmodules: bootstrapArgs.recurseSubmodules,
247246
}
248247

248+
entityList, err := bootstrap.LoadEntityListFromPath(bootstrapArgs.gpgKeyRingPath)
249+
if err != nil {
250+
return err
251+
}
252+
249253
// Bootstrap config
250254
bootstrapOpts := []bootstrap.GitProviderOption{
251255
bootstrap.WithProviderRepository(gitlabArgs.owner, gitlabArgs.repository, gitlabArgs.personal),
@@ -258,7 +262,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error {
258262
bootstrap.WithKubeconfig(kubeconfigArgs, kubeclientOptions),
259263
bootstrap.WithLogger(logger),
260264
bootstrap.WithCABundle(caBundle),
261-
bootstrap.WithGitCommitSigning(bootstrapArgs.gpgKeyRingPath, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
265+
bootstrap.WithGitCommitSigning(entityList, bootstrapArgs.gpgPassphrase, bootstrapArgs.gpgKeyID),
262266
}
263267
if bootstrapArgs.sshHostname != "" {
264268
bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname))

‎cmd/flux/create_secret_git.go‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ import (
2121
"crypto/elliptic"
2222
"fmt"
2323
"net/url"
24+
"os"
2425

2526
"github.com/spf13/cobra"
2627
corev1 "k8s.io/api/core/v1"
@@ -135,8 +136,12 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {
135136
}
136137
switch u.Scheme {
137138
case "ssh":
139+
keypair, err := sourcesecret.LoadKeyPairFromPath(secretGitArgs.privateKeyFile, secretGitArgs.password)
140+
if err != nil {
141+
return err
142+
}
143+
opts.Keypair = keypair
138144
opts.SSHHostname = u.Host
139-
opts.PrivateKeyPath = secretGitArgs.privateKeyFile
140145
opts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(secretGitArgs.keyAlgorithm)
141146
opts.RSAKeyBits = int(secretGitArgs.rsaBits)
142147
opts.ECDSACurve = secretGitArgs.ecdsaCurve.Curve
@@ -147,7 +152,13 @@ func createSecretGitCmdRun(cmd *cobra.Command, args []string) error {
147152
}
148153
opts.Username = secretGitArgs.username
149154
opts.Password = secretGitArgs.password
150-
opts.CAFilePath = secretGitArgs.caFile
155+
if secretGitArgs.caFile != "" {
156+
caBundle, err := os.ReadFile(secretGitArgs.caFile)
157+
if err != nil {
158+
return fmt.Errorf("unable to read TLS CA file: %w", err)
159+
}
160+
opts.CAFile = caBundle
161+
}
151162
default:
152163
return fmt.Errorf("git URL scheme '%s' not supported, can be: ssh, http and https", u.Scheme)
153164
}

‎cmd/flux/create_secret_helm.go‎

Lines changed: 29 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ package main
1818

1919
import (
2020
"context"
21+
"fmt"
22+
"os"
2123

2224
"github.com/spf13/cobra"
2325
corev1 "k8s.io/api/core/v1"
@@ -74,15 +76,34 @@ func createSecretHelmCmdRun(cmd *cobra.Command, args []string) error {
7476
return err
7577
}
7678

79+
caBundle := []byte{}
80+
if secretHelmArgs.caFile != "" {
81+
var err error
82+
caBundle, err = os.ReadFile(secretHelmArgs.caFile)
83+
if err != nil {
84+
return fmt.Errorf("unable to read TLS CA file: %w", err)
85+
}
86+
}
87+
88+
var certFile, keyFile []byte
89+
if secretHelmArgs.certFile != "" && secretHelmArgs.keyFile != "" {
90+
if certFile, err = os.ReadFile(secretHelmArgs.certFile); err != nil {
91+
return fmt.Errorf("failed to read cert file: %w", err)
92+
}
93+
if keyFile, err = os.ReadFile(secretHelmArgs.keyFile); err != nil {
94+
return fmt.Errorf("failed to read key file: %w", err)
95+
}
96+
}
97+
7798
opts := sourcesecret.Options{
78-
Name: name,
79-
Namespace: *kubeconfigArgs.Namespace,
80-
Labels: labels,
81-
Username: secretHelmArgs.username,
82-
Password: secretHelmArgs.password,
83-
CAFilePath: secretHelmArgs.caFile,
84-
CertFilePath: secretHelmArgs.certFile,
85-
KeyFilePath: secretHelmArgs.keyFile,
99+
Name: name,
100+
Namespace: *kubeconfigArgs.Namespace,
101+
Labels: labels,
102+
Username: secretHelmArgs.username,
103+
Password: secretHelmArgs.password,
104+
CAFile: caBundle,
105+
CertFile: certFile,
106+
KeyFile: keyFile,
86107
}
87108
secret, err := sourcesecret.Generate(opts)
88109
if err != nil {

‎cmd/flux/create_secret_tls.go‎

Lines changed: 27 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,8 @@ package main
1818

1919
import (
2020
"context"
21+
"fmt"
22+
"os"
2123

2224
"github.com/spf13/cobra"
2325
"github.com/spf13/pflag"
@@ -73,13 +75,32 @@ func createSecretTLSCmdRun(cmd *cobra.Command, args []string) error {
7375
return err
7476
}
7577

78+
caBundle := []byte{}
79+
if secretTLSArgs.caFile != "" {
80+
var err error
81+
caBundle, err = os.ReadFile(secretTLSArgs.caFile)
82+
if err != nil {
83+
return fmt.Errorf("unable to read TLS CA file: %w", err)
84+
}
85+
}
86+
87+
var certFile, keyFile []byte
88+
if secretTLSArgs.certFile != "" && secretTLSArgs.keyFile != "" {
89+
if certFile, err = os.ReadFile(secretTLSArgs.certFile); err != nil {
90+
return fmt.Errorf("failed to read cert file: %w", err)
91+
}
92+
if keyFile, err = os.ReadFile(secretTLSArgs.keyFile); err != nil {
93+
return fmt.Errorf("failed to read key file: %w", err)
94+
}
95+
}
96+
7697
opts := sourcesecret.Options{
77-
Name: name,
78-
Namespace: *kubeconfigArgs.Namespace,
79-
Labels: labels,
80-
CAFilePath: secretTLSArgs.caFile,
81-
CertFilePath: secretTLSArgs.certFile,
82-
KeyFilePath: secretTLSArgs.keyFile,
98+
Name: name,
99+
Namespace: *kubeconfigArgs.Namespace,
100+
Labels: labels,
101+
CAFile: caBundle,
102+
CertFile: certFile,
103+
KeyFile: keyFile,
83104
}
84105
secret, err := sourcesecret.Generate(opts)
85106
if err != nil {

‎cmd/flux/create_source_git.go‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -259,16 +259,26 @@ func createSourceGitCmdRun(cmd *cobra.Command, args []string) error {
259259
}
260260
switch u.Scheme {
261261
case "ssh":
262+
keypair, err := sourcesecret.LoadKeyPairFromPath(sourceGitArgs.privateKeyFile, sourceGitArgs.password)
263+
if err != nil {
264+
return err
265+
}
266+
secretOpts.Keypair = keypair
262267
secretOpts.SSHHostname = u.Host
263-
secretOpts.PrivateKeyPath = sourceGitArgs.privateKeyFile
264268
secretOpts.PrivateKeyAlgorithm = sourcesecret.PrivateKeyAlgorithm(sourceGitArgs.keyAlgorithm)
265269
secretOpts.RSAKeyBits = int(sourceGitArgs.keyRSABits)
266270
secretOpts.ECDSACurve = sourceGitArgs.keyECDSACurve.Curve
267271
secretOpts.Password = sourceGitArgs.password
268272
case "https":
273+
if sourceGitArgs.caFile != "" {
274+
caBundle, err := os.ReadFile(sourceGitArgs.caFile)
275+
if err != nil {
276+
return fmt.Errorf("unable to read TLS CA file: %w", err)
277+
}
278+
secretOpts.CAFile = caBundle
279+
}
269280
secretOpts.Username = sourceGitArgs.username
270281
secretOpts.Password = sourceGitArgs.password
271-
secretOpts.CAFilePath = sourceGitArgs.caFile
272282
case "http":
273283
logger.Warningf("insecure configuration: credentials configured for an HTTP URL")
274284
secretOpts.Username = sourceGitArgs.username

0 commit comments

Comments
 (0)