3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-05-09 23:27:43 +02:00
Code Issues Projects Releases Packages Wiki Activity

Add new configurable bootstrap writers (#2405) (#5114)

Browse source 
* Add new configurable bootstrap writers (#2405)

This PR adds the ability to configure different backends to use for
storing modifications to the zero bootstrap config. The two currently
implemented backends allow writing changes to a file or to a Kubernetes
secret. Backend selection is determined by the scheme in a URI passed to
the flag '--config-writeback-uri'.

In a Kubernetes environment, where the bootstrap config is mounted into
the pod from a secret, this option allows Pomerium to write changes back
to the secret, as writes to the mounted secret file on disk are not
persisted.

* Use env vars for bootstrap config filepath/writeback uri

* linter pass and code cleanup

* Add new config writer options mechanism

This moves the encryption cipher parameter out of the WriteConfig()
method in the ConfigWriter interface and into a new ConfigWriterOptions
struct. Options (e.g. cipher) can be applied to an existing ConfigWriter
to allow customizing implementation-specific behavior.

* Code cleanup/lint fixes

* Move vendored k8s code into separate package, and add license header and package comment
This commit is contained in:
Joe Kralicky 2024-05-31 12:26:17 -04:00 • committed by GitHub
parent 927f24e1ff
commit de603f87de
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
18 changed files with 726 additions and 74 deletions
Download patch file Download diff file Expand all files Collapse all files

20
internal/zero/controller/controller.go
View file

@ -15,6 +15,7 @@ import (
"github.com/pomerium/pomerium/internal/zero/analytics"
sdk "github.com/pomerium/pomerium/internal/zero/api"
"github.com/pomerium/pomerium/internal/zero/bootstrap"
"github.com/pomerium/pomerium/internal/zero/bootstrap/writers"
"github.com/pomerium/pomerium/internal/zero/healthcheck"
"github.com/pomerium/pomerium/internal/zero/leaser"
"github.com/pomerium/pomerium/internal/zero/reconciler"
@ -33,7 +34,24 @@ func Run(ctx context.Context, opts ...Option) error {
return fmt.Errorf("init api: %w", err)
}
src, err := bootstrap.New([]byte(c.cfg.apiToken), c.cfg.bootstrapConfigFileName, c.api)
var writer writers.ConfigWriter
if c.cfg.bootstrapConfigFileName != nil {
var err error
var uri string
if c.cfg.bootstrapConfigWritebackURI != nil {
// if there is an explicitly configured writeback URI, use it
uri = *c.cfg.bootstrapConfigWritebackURI
} else {
// otherwise, default to "file://<filename>"
uri = "file://" + *c.cfg.bootstrapConfigFileName
}
writer, err = writers.NewForURI(uri)
if err != nil {
return fmt.Errorf("error creating bootstrap config writer: %w", err)
}
}
src, err := bootstrap.New([]byte(c.cfg.apiToken), c.cfg.bootstrapConfigFileName, writer, c.api)
if err != nil {
return fmt.Errorf("error creating bootstrap config: %w", err)
}