mirror of
https://github.com/pomerium/pomerium.git
synced 2025-05-02 20:06:03 +02:00
de603f87de
* Add new configurable bootstrap writers (#2405) This PR adds the ability to configure different backends to use for storing modifications to the zero bootstrap config. The two currently implemented backends allow writing changes to a file or to a Kubernetes secret. Backend selection is determined by the scheme in a URI passed to the flag '--config-writeback-uri'. In a Kubernetes environment, where the bootstrap config is mounted into the pod from a secret, this option allows Pomerium to write changes back to the secret, as writes to the mounted secret file on disk are not persisted. * Use env vars for bootstrap config filepath/writeback uri * linter pass and code cleanup * Add new config writer options mechanism This moves the encryption cipher parameter out of the WriteConfig() method in the ConfigWriter interface and into a new ConfigWriterOptions struct. Options (e.g. cipher) can be applied to an existing ConfigWriter to allow customizing implementation-specific behavior. * Code cleanup/lint fixes * Move vendored k8s code into separate package, and add license header and package comment
58 lines
1.4 KiB
Go
58 lines
1.4 KiB
Go
package filesystem
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"net/url"
|
|
"os"
|
|
|
|
"github.com/pomerium/pomerium/internal/zero/bootstrap/writers"
|
|
"github.com/pomerium/pomerium/pkg/cryptutil"
|
|
cluster_api "github.com/pomerium/pomerium/pkg/zero/cluster"
|
|
)
|
|
|
|
func init() {
|
|
writers.RegisterBuilder("file", newFileWriter)
|
|
}
|
|
|
|
func newFileWriter(uri *url.URL) (writers.ConfigWriter, error) {
|
|
if uri.Host != "" {
|
|
// prevent the common mistake of "file://path/to/file"
|
|
return nil, fmt.Errorf(`invalid file uri %q (did you mean "file:///%s%s"?)`, uri.String(), uri.Host, uri.Path)
|
|
}
|
|
return &fileWriter{
|
|
filePath: uri.Path,
|
|
}, nil
|
|
}
|
|
|
|
type fileWriter struct {
|
|
opts writers.ConfigWriterOptions
|
|
filePath string
|
|
}
|
|
|
|
// WithOptions implements writers.ConfigWriter.
|
|
func (w *fileWriter) WithOptions(opts writers.ConfigWriterOptions) writers.ConfigWriter {
|
|
clone := *w
|
|
clone.opts = opts
|
|
return &clone
|
|
}
|
|
|
|
// WriteConfig implements ConfigWriter.
|
|
func (w *fileWriter) WriteConfig(_ context.Context, src *cluster_api.BootstrapConfig) error {
|
|
data, err := json.Marshal(src)
|
|
if err != nil {
|
|
return fmt.Errorf("marshal file config: %w", err)
|
|
}
|
|
|
|
if w.opts.Cipher != nil {
|
|
data = cryptutil.Encrypt(w.opts.Cipher, data, nil)
|
|
}
|
|
err = os.WriteFile(w.filePath, data, 0o600)
|
|
if err != nil {
|
|
return fmt.Errorf("write bootstrap config: %w", err)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
var _ writers.ConfigWriter = (*fileWriter)(nil)
|