Add new configurable bootstrap writers (#2405) (#5114)

* Add new configurable bootstrap writers (#2405)

This PR adds the ability to configure different backends to use for
storing modifications to the zero bootstrap config. The two currently
implemented backends allow writing changes to a file or to a Kubernetes
secret. Backend selection is determined by the scheme in a URI passed to
the flag '--config-writeback-uri'.

In a Kubernetes environment, where the bootstrap config is mounted into
the pod from a secret, this option allows Pomerium to write changes back
to the secret, as writes to the mounted secret file on disk are not
persisted.

* Use env vars for bootstrap config filepath/writeback uri

* linter pass and code cleanup

* Add new config writer options mechanism

This moves the encryption cipher parameter out of the WriteConfig()
method in the ConfigWriter interface and into a new ConfigWriterOptions
struct. Options (e.g. cipher) can be applied to an existing ConfigWriter
to allow customizing implementation-specific behavior.

* Code cleanup/lint fixes

* Move vendored k8s code into separate package, and add license header and package comment

internal/zero/controller/config.go

@@ -11,8 +11,9 @@ type controllerConfig struct {
 	connectAPIEndpoint string
 	otelEndpoint       string
 
-	tmpDir                  string
-	bootstrapConfigFileName *string
+	tmpDir                      string
+	bootstrapConfigFileName     *string
+	bootstrapConfigWritebackURI *string
 
 	reconcilerLeaseDuration  time.Duration
 	databrokerRequestTimeout time.Duration
@@ -60,6 +61,41 @@ func WithBootstrapConfigFileName(name string) Option {
 	}
 }
 
+// WithBootstrapConfigWritebackURI sets the URI to use for persisting changes made to the
+// bootstrap config read from a filename specified by WithBootstrapConfigFileName.
+// Accepts a URI with a non-empty scheme and path.
+//
+// The following schemes are supported:
+//
+// # file
+//
+// Writes the config to a file on disk.
+//
+// Example: "file:///path/to/file" would write the config to "/path/to/file"
+// on disk.
+//
+// # secret
+//
+// Writes the config to a Kubernetes Secret. Uses the format
+// "secret://namespace/name/key".
+//
+// Example: "secret://pomerium/bootstrap/bootstrap.dat" would
+// write the config to a secret named "bootstrap" in the "pomerium" namespace,
+// under the key "bootstrap.dat", as if created with the following YAML:
+//
+//	apiVersion: v1
+//	kind: Secret
+//	metadata:
+//	  name: bootstrap
+//	  namespace: pomerium
+//	data:
+//	  bootstrap.dat: <base64 encoded config>
+func WithBootstrapConfigWritebackURI(uri string) Option {
+	return func(c *controllerConfig) {
+		c.bootstrapConfigWritebackURI = &uri
+	}
+}
+
 // WithDatabrokerLeaseDuration sets the lease duration for the
 func WithDatabrokerLeaseDuration(duration time.Duration) Option {
 	return func(c *controllerConfig) {

internal/zero/controller/controller.go

@@ -15,6 +15,7 @@ import (
 	"github.com/pomerium/pomerium/internal/zero/analytics"
 	sdk "github.com/pomerium/pomerium/internal/zero/api"
 	"github.com/pomerium/pomerium/internal/zero/bootstrap"
+	"github.com/pomerium/pomerium/internal/zero/bootstrap/writers"
 	"github.com/pomerium/pomerium/internal/zero/healthcheck"
 	"github.com/pomerium/pomerium/internal/zero/leaser"
 	"github.com/pomerium/pomerium/internal/zero/reconciler"
@@ -33,7 +34,24 @@ func Run(ctx context.Context, opts ...Option) error {
 		return fmt.Errorf("init api: %w", err)
 	}
 
-	src, err := bootstrap.New([]byte(c.cfg.apiToken), c.cfg.bootstrapConfigFileName, c.api)
+	var writer writers.ConfigWriter
+	if c.cfg.bootstrapConfigFileName != nil {
+		var err error
+		var uri string
+		if c.cfg.bootstrapConfigWritebackURI != nil {
+			// if there is an explicitly configured writeback URI, use it
+			uri = *c.cfg.bootstrapConfigWritebackURI
+		} else {
+			// otherwise, default to "file://<filename>"
+			uri = "file://" + *c.cfg.bootstrapConfigFileName
+		}
+		writer, err = writers.NewForURI(uri)
+		if err != nil {
+			return fmt.Errorf("error creating bootstrap config writer: %w", err)
+		}
+	}
+
+	src, err := bootstrap.New([]byte(c.cfg.apiToken), c.cfg.bootstrapConfigFileName, writer, c.api)
 	if err != nil {
 		return fmt.Errorf("error creating bootstrap config: %w", err)
 	}