Add new configurable bootstrap writers (#2405) (#5114)

* Add new configurable bootstrap writers (#2405)

This PR adds the ability to configure different backends to use for
storing modifications to the zero bootstrap config. The two currently
implemented backends allow writing changes to a file or to a Kubernetes
secret. Backend selection is determined by the scheme in a URI passed to
the flag '--config-writeback-uri'.

In a Kubernetes environment, where the bootstrap config is mounted into
the pod from a secret, this option allows Pomerium to write changes back
to the secret, as writes to the mounted secret file on disk are not
persisted.

* Use env vars for bootstrap config filepath/writeback uri

* linter pass and code cleanup

* Add new config writer options mechanism

This moves the encryption cipher parameter out of the WriteConfig()
method in the ConfigWriter interface and into a new ConfigWriterOptions
struct. Options (e.g. cipher) can be applied to an existing ConfigWriter
to allow customizing implementation-specific behavior.

* Code cleanup/lint fixes

* Move vendored k8s code into separate package, and add license header and package comment

internal/zero/bootstrap/writers/filesystem/file.go

@@ -0,0 +1,58 @@
+package filesystem
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/url"
+	"os"
+
+	"github.com/pomerium/pomerium/internal/zero/bootstrap/writers"
+	"github.com/pomerium/pomerium/pkg/cryptutil"
+	cluster_api "github.com/pomerium/pomerium/pkg/zero/cluster"
+)
+
+func init() {
+	writers.RegisterBuilder("file", newFileWriter)
+}
+
+func newFileWriter(uri *url.URL) (writers.ConfigWriter, error) {
+	if uri.Host != "" {
+		// prevent the common mistake of "file://path/to/file"
+		return nil, fmt.Errorf(`invalid file uri %q (did you mean "file:///%s%s"?)`, uri.String(), uri.Host, uri.Path)
+	}
+	return &fileWriter{
+		filePath: uri.Path,
+	}, nil
+}
+
+type fileWriter struct {
+	opts     writers.ConfigWriterOptions
+	filePath string
+}
+
+// WithOptions implements writers.ConfigWriter.
+func (w *fileWriter) WithOptions(opts writers.ConfigWriterOptions) writers.ConfigWriter {
+	clone := *w
+	clone.opts = opts
+	return &clone
+}
+
+// WriteConfig implements ConfigWriter.
+func (w *fileWriter) WriteConfig(_ context.Context, src *cluster_api.BootstrapConfig) error {
+	data, err := json.Marshal(src)
+	if err != nil {
+		return fmt.Errorf("marshal file config: %w", err)
+	}
+
+	if w.opts.Cipher != nil {
+		data = cryptutil.Encrypt(w.opts.Cipher, data, nil)
+	}
+	err = os.WriteFile(w.filePath, data, 0o600)
+	if err != nil {
+		return fmt.Errorf("write bootstrap config: %w", err)
+	}
+	return nil
+}
+
+var _ writers.ConfigWriter = (*fileWriter)(nil)

internal/zero/bootstrap/writers/filesystem/file_test.go

@@ -0,0 +1,67 @@
+package filesystem_test
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/pomerium/pomerium/internal/zero/bootstrap"
+	"github.com/pomerium/pomerium/internal/zero/bootstrap/writers"
+	"github.com/pomerium/pomerium/pkg/cryptutil"
+	cluster_api "github.com/pomerium/pomerium/pkg/zero/cluster"
+)
+
+func TestFileWriter(t *testing.T) {
+	cipher, err := cryptutil.NewAEADCipher(cryptutil.NewKey())
+	require.NoError(t, err)
+
+	txt := "test"
+	src := cluster_api.BootstrapConfig{
+		DatabrokerStorageConnection: &txt,
+	}
+
+	fd, err := os.CreateTemp(t.TempDir(), "test.data")
+	require.NoError(t, err)
+	require.NoError(t, fd.Close())
+
+	writer, err := writers.NewForURI(fmt.Sprintf("file://%s", fd.Name()))
+	require.NoError(t, err)
+
+	writer = writer.WithOptions(writers.ConfigWriterOptions{
+		Cipher: cipher,
+	})
+	require.NoError(t, bootstrap.SaveBootstrapConfig(context.Background(), writer, &src))
+
+	dst, err := bootstrap.LoadBootstrapConfigFromFile(fd.Name(), cipher)
+	require.NoError(t, err)
+
+	require.Equal(t, src, *dst)
+}
+
+func TestNewForURI(t *testing.T) {
+	for _, tc := range []struct {
+		uri string
+		err string
+	}{
+		{
+			uri: "file:///path/to/file",
+		},
+		{
+			uri: "file://path/to/file",
+			err: `invalid file uri "file://path/to/file" (did you mean "file:///path/to/file"?)`,
+		},
+	} {
+		w, err := writers.NewForURI(tc.uri)
+		if tc.err == "" {
+			assert.NoError(t, err)
+			assert.NotNil(t, w)
+		} else {
+			assert.EqualError(t, err, tc.err)
+			assert.Nil(t, w)
+		}
+	}
+}