Add new configurable bootstrap writers (#2405) (#5114)

* Add new configurable bootstrap writers (#2405)

This PR adds the ability to configure different backends to use for
storing modifications to the zero bootstrap config. The two currently
implemented backends allow writing changes to a file or to a Kubernetes
secret. Backend selection is determined by the scheme in a URI passed to
the flag '--config-writeback-uri'.

In a Kubernetes environment, where the bootstrap config is mounted into
the pod from a secret, this option allows Pomerium to write changes back
to the secret, as writes to the mounted secret file on disk are not
persisted.

* Use env vars for bootstrap config filepath/writeback uri

* linter pass and code cleanup

* Add new config writer options mechanism

This moves the encryption cipher parameter out of the WriteConfig()
method in the ConfigWriter interface and into a new ConfigWriterOptions
struct. Options (e.g. cipher) can be applied to an existing ConfigWriter
to allow customizing implementation-specific behavior.

* Code cleanup/lint fixes

* Move vendored k8s code into separate package, and add license header and package comment

internal/zero/cmd/command.go

@@ -7,7 +7,6 @@ import (
 	"fmt"
 	"os"
 	"os/signal"
-	"path/filepath"
 	"syscall"
 
 	"github.com/rs/zerolog"
@@ -41,6 +40,11 @@ func Run(ctx context.Context, configFile string) error {
 	} else {
 		log.Ctx(ctx).Info().Str("file", bootstrapConfigFileName).Msg("cluster bootstrap config path")
 		opts = append(opts, controller.WithBootstrapConfigFileName(bootstrapConfigFileName))
+
+		if uri := getBootstrapConfigWritebackURI(); uri != "" {
+			log.Ctx(ctx).Debug().Str("uri", uri).Msg("cluster bootstrap config writeback URI")
+			opts = append(opts, controller.WithBootstrapConfigWritebackURI(uri))
+		}
 	}
 
 	return controller.Run(withInterrupt(ctx), opts...)
@@ -81,17 +85,3 @@ func setupLogger() error {
 
 	return nil
 }
-
-func getBootstrapConfigFileName() (string, error) {
-	cacheDir, err := os.UserCacheDir()
-	if err != nil {
-		return "", err
-	}
-
-	dir := filepath.Join(cacheDir, "pomerium")
-	if err := os.MkdirAll(dir, 0o700); err != nil {
-		return "", fmt.Errorf("error creating cache directory: %w", err)
-	}
-
-	return filepath.Join(dir, "bootstrap.dat"), nil
-}

internal/zero/cmd/env.go

@@ -1,7 +1,9 @@
 package cmd
 
 import (
+	"fmt"
 	"os"
+	"path/filepath"
 
 	"github.com/spf13/viper"
 )
@@ -10,6 +12,12 @@ const (
 	// PomeriumZeroTokenEnv is the environment variable name for the API token.
 	//nolint: gosec
 	PomeriumZeroTokenEnv = "POMERIUM_ZERO_TOKEN"
+
+	// BootstrapConfigFileName can be set to override the default location of the bootstrap config file.
+	BootstrapConfigFileName = "BOOTSTRAP_CONFIG_FILE"
+	// BootstrapConfigWritebackURI controls how changes to the bootstrap config are persisted.
+	// See controller.WithBootstrapConfigWritebackURI for details.
+	BootstrapConfigWritebackURI = "BOOTSTRAP_CONFIG_WRITEBACK_URI"
 )
 
 func getToken(configFile string) string {
@@ -50,3 +58,23 @@ func getOTELAPIEndpoint() string {
 	}
 	return "https://telemetry.pomerium.app"
 }
+
+func getBootstrapConfigFileName() (string, error) {
+	if filename := os.Getenv(BootstrapConfigFileName); filename != "" {
+		return filename, nil
+	}
+	cacheDir, err := os.UserCacheDir()
+	if err != nil {
+		return "", err
+	}
+	dir := filepath.Join(cacheDir, "pomerium")
+	if err := os.MkdirAll(dir, 0o700); err != nil {
+		return "", fmt.Errorf("error creating cache directory: %w", err)
+	}
+
+	return filepath.Join(dir, "bootstrap.dat"), nil
+}
+
+func getBootstrapConfigWritebackURI() string {
+	return os.Getenv(BootstrapConfigWritebackURI)
+}