mirror of
https://github.com/pomerium/pomerium.git
synced 2025-04-30 02:46:30 +02:00
de603f87de
* Add new configurable bootstrap writers (#2405) This PR adds the ability to configure different backends to use for storing modifications to the zero bootstrap config. The two currently implemented backends allow writing changes to a file or to a Kubernetes secret. Backend selection is determined by the scheme in a URI passed to the flag '--config-writeback-uri'. In a Kubernetes environment, where the bootstrap config is mounted into the pod from a secret, this option allows Pomerium to write changes back to the secret, as writes to the mounted secret file on disk are not persisted. * Use env vars for bootstrap config filepath/writeback uri * linter pass and code cleanup * Add new config writer options mechanism This moves the encryption cipher parameter out of the WriteConfig() method in the ConfigWriter interface and into a new ConfigWriterOptions struct. Options (e.g. cipher) can be applied to an existing ConfigWriter to allow customizing implementation-specific behavior. * Code cleanup/lint fixes * Move vendored k8s code into separate package, and add license header and package comment
129 lines
3.4 KiB
Go
129 lines
3.4 KiB
Go
package controller
|
|
|
|
import "time"
|
|
|
|
// Option configures a controller.
|
|
type Option func(*controllerConfig)
|
|
|
|
type controllerConfig struct {
|
|
apiToken string
|
|
clusterAPIEndpoint string
|
|
connectAPIEndpoint string
|
|
otelEndpoint string
|
|
|
|
tmpDir string
|
|
bootstrapConfigFileName *string
|
|
bootstrapConfigWritebackURI *string
|
|
|
|
reconcilerLeaseDuration time.Duration
|
|
databrokerRequestTimeout time.Duration
|
|
}
|
|
|
|
// WithTmpDir sets the temporary directory to use.
|
|
func WithTmpDir(dir string) Option {
|
|
return func(c *controllerConfig) {
|
|
c.tmpDir = dir
|
|
}
|
|
}
|
|
|
|
// WithClusterAPIEndpoint sets the endpoint to use for the cluster API
|
|
func WithClusterAPIEndpoint(endpoint string) Option {
|
|
return func(c *controllerConfig) {
|
|
c.clusterAPIEndpoint = endpoint
|
|
}
|
|
}
|
|
|
|
// WithConnectAPIEndpoint sets the endpoint to use for the connect API
|
|
func WithConnectAPIEndpoint(endpoint string) Option {
|
|
return func(c *controllerConfig) {
|
|
c.connectAPIEndpoint = endpoint
|
|
}
|
|
}
|
|
|
|
// WithOTELAPIEndpoint sets the endpoint to use for the OTEL API
|
|
func WithOTELAPIEndpoint(endpoint string) Option {
|
|
return func(c *controllerConfig) {
|
|
c.otelEndpoint = endpoint
|
|
}
|
|
}
|
|
|
|
// WithAPIToken sets the API token to use for authentication.
|
|
func WithAPIToken(token string) Option {
|
|
return func(c *controllerConfig) {
|
|
c.apiToken = token
|
|
}
|
|
}
|
|
|
|
// WithBootstrapConfigFileName sets the name of the file to store the bootstrap config in.
|
|
func WithBootstrapConfigFileName(name string) Option {
|
|
return func(c *controllerConfig) {
|
|
c.bootstrapConfigFileName = &name
|
|
}
|
|
}
|
|
|
|
// WithBootstrapConfigWritebackURI sets the URI to use for persisting changes made to the
|
|
// bootstrap config read from a filename specified by WithBootstrapConfigFileName.
|
|
// Accepts a URI with a non-empty scheme and path.
|
|
//
|
|
// The following schemes are supported:
|
|
//
|
|
// # file
|
|
//
|
|
// Writes the config to a file on disk.
|
|
//
|
|
// Example: "file:///path/to/file" would write the config to "/path/to/file"
|
|
// on disk.
|
|
//
|
|
// # secret
|
|
//
|
|
// Writes the config to a Kubernetes Secret. Uses the format
|
|
// "secret://namespace/name/key".
|
|
//
|
|
// Example: "secret://pomerium/bootstrap/bootstrap.dat" would
|
|
// write the config to a secret named "bootstrap" in the "pomerium" namespace,
|
|
// under the key "bootstrap.dat", as if created with the following YAML:
|
|
//
|
|
// apiVersion: v1
|
|
// kind: Secret
|
|
// metadata:
|
|
// name: bootstrap
|
|
// namespace: pomerium
|
|
// data:
|
|
// bootstrap.dat: <base64 encoded config>
|
|
func WithBootstrapConfigWritebackURI(uri string) Option {
|
|
return func(c *controllerConfig) {
|
|
c.bootstrapConfigWritebackURI = &uri
|
|
}
|
|
}
|
|
|
|
// WithDatabrokerLeaseDuration sets the lease duration for the
|
|
func WithDatabrokerLeaseDuration(duration time.Duration) Option {
|
|
return func(c *controllerConfig) {
|
|
c.reconcilerLeaseDuration = duration
|
|
}
|
|
}
|
|
|
|
// WithDatabrokerRequestTimeout sets the timeout for databroker requests.
|
|
func WithDatabrokerRequestTimeout(timeout time.Duration) Option {
|
|
return func(c *controllerConfig) {
|
|
c.databrokerRequestTimeout = timeout
|
|
}
|
|
}
|
|
|
|
func newControllerConfig(opts ...Option) *controllerConfig {
|
|
c := new(controllerConfig)
|
|
|
|
for _, opt := range []Option{
|
|
WithClusterAPIEndpoint("https://console.pomerium.com/cluster/v1"),
|
|
WithConnectAPIEndpoint("https://connect.pomerium.com"),
|
|
WithDatabrokerLeaseDuration(time.Second * 30),
|
|
WithDatabrokerRequestTimeout(time.Second * 30),
|
|
} {
|
|
opt(c)
|
|
}
|
|
|
|
for _, opt := range opts {
|
|
opt(c)
|
|
}
|
|
return c
|
|
}
|