3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-06-26 06:28:18 +02:00
Code Issues Projects Releases Packages Wiki Activity

Add new configurable bootstrap writers (#2405) (#5114)

Browse source 
* Add new configurable bootstrap writers (#2405)

This PR adds the ability to configure different backends to use for
storing modifications to the zero bootstrap config. The two currently
implemented backends allow writing changes to a file or to a Kubernetes
secret. Backend selection is determined by the scheme in a URI passed to
the flag '--config-writeback-uri'.

In a Kubernetes environment, where the bootstrap config is mounted into
the pod from a secret, this option allows Pomerium to write changes back
to the secret, as writes to the mounted secret file on disk are not
persisted.

* Use env vars for bootstrap config filepath/writeback uri

* linter pass and code cleanup

* Add new config writer options mechanism

This moves the encryption cipher parameter out of the WriteConfig()
method in the ConfigWriter interface and into a new ConfigWriterOptions
struct. Options (e.g. cipher) can be applied to an existing ConfigWriter
to allow customizing implementation-specific behavior.

* Code cleanup/lint fixes

* Move vendored k8s code into separate package, and add license header and package comment
This commit is contained in:
Joe Kralicky 2024-05-31 12:26:17 -04:00 • committed by GitHub
parent 927f24e1ff
commit de603f87de
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
18 changed files with 726 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

22
internal/zero/bootstrap/file.go
View file

@ -9,11 +9,13 @@ package bootstrap
*
*/
import (
"context"
"crypto/cipher"
"encoding/json"
"fmt"
"os"
"github.com/pomerium/pomerium/internal/zero/bootstrap/writers"
"github.com/pomerium/pomerium/pkg/cryptutil"
"github.com/pomerium/pomerium/pkg/health"
cluster_api "github.com/pomerium/pomerium/pkg/zero/cluster"
@ -39,9 +41,9 @@ func LoadBootstrapConfigFromFile(fp string, cipher cipher.AEAD) (*cluster_api.Bo
return &dst, nil
}
// SaveBootstrapConfigToFile saves the bootstrap configuration to a file.
func SaveBootstrapConfigToFile(src *cluster_api.BootstrapConfig, fp string, cipher cipher.AEAD) error {
err := saveBootstrapConfigToFile(src, fp, cipher)
// SaveBootstrapConfig saves the bootstrap configuration to a file.
func SaveBootstrapConfig(ctx context.Context, writer writers.ConfigWriter, src *cluster_api.BootstrapConfig) error {
err := writer.WriteConfig(ctx, src)
if err != nil {
health.ReportError(health.ZeroBootstrapConfigSave, err)
} else {
@ -49,17 +51,3 @@ func SaveBootstrapConfigToFile(src *cluster_api.BootstrapConfig, fp string, ciph
}
return err
}
func saveBootstrapConfigToFile(src *cluster_api.BootstrapConfig, fp string, cipher cipher.AEAD) error {
plaintext, err := json.Marshal(src)
if err != nil {
return fmt.Errorf("marshal file config: %w", err)
}
ciphertext := cryptutil.Encrypt(cipher, plaintext, nil)
err = os.WriteFile(fp, ciphertext, 0o600)
if err != nil {
return fmt.Errorf("write bootstrap config: %w", err)
}
return nil
}