Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Adopt Kubernetes style TLS Secrets and add relevant flags #4147

Merged
merged 5 commits into from
Aug 23, 2023
Merged

Adopt Kubernetes style TLS Secrets and add relevant flags #4147

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
bf36a29
add support for Kubernetes TLS keys for `flux create secret tls`
aryan9600 Aug 9, 2023
b32051d
deprecate TLS flags for flux create secret helm
aryan9600 Aug 9, 2023
2fc9d73
add flag `--ca-crt-file` to `flux create secret git`
aryan9600 Aug 9, 2023
6464d6c
add deprecation warning per secret key field and constant
aryan9600 Aug 10, 2023
8df27d8
modify `flux create secret tls` to create secrets of type TLS
aryan9600 Aug 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
add deprecation warning per secret key field and constant 
Signed-off-by: Sanskar Jaiswal <jaiswalsanskar078@gmail.com>
  • Loading branch information
@aryan9600
aryan9600 committed Aug 23, 2023
commit 6464d6c7b474c1891fb35ccf86ea24083b4c22fe
4 changes: 2 additions & 2 deletions cmd/flux/create_secret_tls.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -110,10 +110,10 @@ func createSecretTLSCmdRun(cmd *cobra.Command, args []string) error {
}

if secretTLSArgs.tlsCrtFile != "" && secretTLSArgs.tlsKeyFile != "" {
if opts.TlsCrt, err = os.ReadFile(secretTLSArgs.tlsCrtFile); err != nil {
if opts.TLSCrt, err = os.ReadFile(secretTLSArgs.tlsCrtFile); err != nil {
return fmt.Errorf("failed to read cert file: %w", err)
}
if opts.TlsKey, err = os.ReadFile(secretTLSArgs.tlsKeyFile); err != nil {
if opts.TLSKey, err = os.ReadFile(secretTLSArgs.tlsKeyFile); err != nil {
return fmt.Errorf("failed to read key file: %w", err)
}
} else if secretTLSArgs.certFile != "" && secretTLSArgs.keyFile != "" {
Expand Down
32 changes: 20 additions & 12 deletions pkg/manifestgen/sourcesecret/options.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,18 +34,22 @@ const (
UsernameSecretKey = "username"
PasswordSecretKey = "password"
CACrtSecretKey = "ca.crt"

Check failure

Code scanning / CodeQL

Hard-coded credentials

Hard-coded [secret](1).
TlsCrtSecretKey = "tls.crt"
TlsKeySecretKey = "tls.key"
TLSCrtSecretKey = "tls.crt"

Check failure

Code scanning / CodeQL

Hard-coded credentials

Hard-coded [secret](1).
TLSKeySecretKey = "tls.key"

Check failure

Code scanning / CodeQL

Hard-coded credentials

Hard-coded [secret](1).
PrivateKeySecretKey = "identity"
PublicKeySecretKey = "identity.pub"
KnownHostsSecretKey = "known_hosts"
BearerTokenKey = "bearerToken"

// Depreacted: These keys are used in the generated secrets if the
// command was invoked with the deprecated TLS flags.
CAFileSecretKey = "caFile"
// Deprecated: Replaced by CACrtSecretKey, but kept for backwards
// compatibility with deprecated TLS flags.
CAFileSecretKey = "caFile"

Check failure

Code scanning / CodeQL

Hard-coded credentials

Hard-coded [secret](1).
// Deprecated: Replaced by TLSCrtSecretKey, but kept for backwards
// compatibility with deprecated TLS flags.
CertFileSecretKey = "certFile"

Check failure

Code scanning / CodeQL

Hard-coded credentials

Hard-coded [secret](1).
KeyFileSecretKey = "keyFile"
// Deprecated: Replaced by TLSKeySecretKey, but kept for backwards
// compatibility with deprecated TLS flags.
KeyFileSecretKey = "keyFile"

Check failure

Code scanning / CodeQL

Hard-coded credentials

Hard-coded [secret](1).
)

type Options struct {
Expand All @@ -61,17 +65,21 @@ type Options struct {
Username string
Password string
CACrt []byte
TlsCrt []byte
TlsKey []byte
TLSCrt []byte
TLSKey []byte
TargetPath string
ManifestFile string
BearerToken string

// Depreacted: These fields are used to store TLS data that
// specified by the deprecated TLS flags.
CAFile []byte
// Deprecated: Replaced by CACrt, but kept for backwards compatibility
// with deprecated TLS flags.
CAFile []byte
// Deprecated: Replaced by TLSCrt, but kept for backwards compatibility
// with deprecated TLS flags.
CertFile []byte
KeyFile []byte
// Deprecated: Replaced by TLSKey, but kept for backwards compatibility
// with deprecated TLS flags.
KeyFile []byte
}

func MakeDefaultOptions() Options {
Expand Down
6 changes: 3 additions & 3 deletions pkg/manifestgen/sourcesecret/sourcesecret.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -162,9 +162,9 @@ func buildSecret(keypair *ssh.KeyPair, hostKey, dockerCfg []byte, options Option
secret.StringData[CAFileSecretKey] = string(options.CAFile)
}

if len(options.TlsCrt) != 0 && len(options.TlsKey) != 0 {
secret.StringData[TlsCrtSecretKey] = string(options.TlsCrt)
secret.StringData[TlsKeySecretKey] = string(options.TlsKey)
if len(options.TLSCrt) != 0 && len(options.TLSKey) != 0 {
secret.StringData[TLSCrtSecretKey] = string(options.TLSCrt)
secret.StringData[TLSKeySecretKey] = string(options.TLSKey)
} else if len(options.CertFile) != 0 && len(options.KeyFile) != 0 {
secret.StringData[CertFileSecretKey] = string(options.CertFile)
secret.StringData[KeyFileSecretKey] = string(options.KeyFile)
Expand Down