mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-30 10:56:28 +02:00
de603f87de
* Add new configurable bootstrap writers (#2405) This PR adds the ability to configure different backends to use for storing modifications to the zero bootstrap config. The two currently implemented backends allow writing changes to a file or to a Kubernetes secret. Backend selection is determined by the scheme in a URI passed to the flag '--config-writeback-uri'. In a Kubernetes environment, where the bootstrap config is mounted into the pod from a secret, this option allows Pomerium to write changes back to the secret, as writes to the mounted secret file on disk are not persisted. * Use env vars for bootstrap config filepath/writeback uri * linter pass and code cleanup * Add new config writer options mechanism This moves the encryption cipher parameter out of the WriteConfig() method in the ConfigWriter interface and into a new ConfigWriterOptions struct. Options (e.g. cipher) can be applied to an existing ConfigWriter to allow customizing implementation-specific behavior. * Code cleanup/lint fixes * Move vendored k8s code into separate package, and add license header and package comment
53 lines
1.6 KiB
Go
53 lines
1.6 KiB
Go
package bootstrap
|
|
|
|
/*
|
|
* in order to be able to start up pomerium in case cloud is unreachable,
|
|
* we store the minimum bootstrap configuration (essentially, the data broker connection)
|
|
* in a file. this file is encrypted with a key that is derived from the cluster token.
|
|
*
|
|
* this information should be sufficient for pomerium to locate the database and start up.
|
|
*
|
|
*/
|
|
import (
|
|
"context"
|
|
"crypto/cipher"
|
|
"encoding/json"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/pomerium/pomerium/internal/zero/bootstrap/writers"
|
|
"github.com/pomerium/pomerium/pkg/cryptutil"
|
|
"github.com/pomerium/pomerium/pkg/health"
|
|
cluster_api "github.com/pomerium/pomerium/pkg/zero/cluster"
|
|
)
|
|
|
|
// LoadBootstrapConfigFromFile loads the bootstrap configuration from a file.
|
|
func LoadBootstrapConfigFromFile(fp string, cipher cipher.AEAD) (*cluster_api.BootstrapConfig, error) {
|
|
ciphertext, err := os.ReadFile(fp)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("read bootstrap config: %w", err)
|
|
}
|
|
plaintext, err := cryptutil.Decrypt(cipher, ciphertext, nil)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("decrypt bootstrap config: %w", err)
|
|
}
|
|
|
|
var dst cluster_api.BootstrapConfig
|
|
err = json.Unmarshal(plaintext, &dst)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("unmarshal bootstrap config: %w", err)
|
|
}
|
|
|
|
return &dst, nil
|
|
}
|
|
|
|
// SaveBootstrapConfig saves the bootstrap configuration to a file.
|
|
func SaveBootstrapConfig(ctx context.Context, writer writers.ConfigWriter, src *cluster_api.BootstrapConfig) error {
|
|
err := writer.WriteConfig(ctx, src)
|
|
if err != nil {
|
|
health.ReportError(health.ZeroBootstrapConfigSave, err)
|
|
} else {
|
|
health.ReportOK(health.ZeroBootstrapConfigSave)
|
|
}
|
|
return err
|
|
}
|