Add new configurable bootstrap writers (#2405) (#5114)

* Add new configurable bootstrap writers (#2405)

This PR adds the ability to configure different backends to use for
storing modifications to the zero bootstrap config. The two currently
implemented backends allow writing changes to a file or to a Kubernetes
secret. Backend selection is determined by the scheme in a URI passed to
the flag '--config-writeback-uri'.

In a Kubernetes environment, where the bootstrap config is mounted into
the pod from a secret, this option allows Pomerium to write changes back
to the secret, as writes to the mounted secret file on disk are not
persisted.

* Use env vars for bootstrap config filepath/writeback uri

* linter pass and code cleanup

* Add new config writer options mechanism

This moves the encryption cipher parameter out of the WriteConfig()
method in the ConfigWriter interface and into a new ConfigWriterOptions
struct. Options (e.g. cipher) can be applied to an existing ConfigWriter
to allow customizing implementation-specific behavior.

* Code cleanup/lint fixes

* Move vendored k8s code into separate package, and add license header and package comment

internal/zero/controller/config.go

@@ -11,8 +11,9 @@ type controllerConfig struct {
 	connectAPIEndpoint string
 	otelEndpoint       string
 
-	tmpDir                  string
-	bootstrapConfigFileName *string
+	tmpDir                      string
+	bootstrapConfigFileName     *string
+	bootstrapConfigWritebackURI *string
 
 	reconcilerLeaseDuration  time.Duration
 	databrokerRequestTimeout time.Duration
@@ -60,6 +61,41 @@ func WithBootstrapConfigFileName(name string) Option {
 	}
 }
 
+// WithBootstrapConfigWritebackURI sets the URI to use for persisting changes made to the
+// bootstrap config read from a filename specified by WithBootstrapConfigFileName.
+// Accepts a URI with a non-empty scheme and path.
+//
+// The following schemes are supported:
+//
+// # file
+//
+// Writes the config to a file on disk.
+//
+// Example: "file:///path/to/file" would write the config to "/path/to/file"
+// on disk.
+//
+// # secret
+//
+// Writes the config to a Kubernetes Secret. Uses the format
+// "secret://namespace/name/key".
+//
+// Example: "secret://pomerium/bootstrap/bootstrap.dat" would
+// write the config to a secret named "bootstrap" in the "pomerium" namespace,
+// under the key "bootstrap.dat", as if created with the following YAML:
+//
+//	apiVersion: v1
+//	kind: Secret
+//	metadata:
+//	  name: bootstrap
+//	  namespace: pomerium
+//	data:
+//	  bootstrap.dat: <base64 encoded config>
+func WithBootstrapConfigWritebackURI(uri string) Option {
+	return func(c *controllerConfig) {
+		c.bootstrapConfigWritebackURI = &uri
+	}
+}
+
 // WithDatabrokerLeaseDuration sets the lease duration for the
 func WithDatabrokerLeaseDuration(duration time.Duration) Option {
 	return func(c *controllerConfig) {