/
cred.go
109 lines (92 loc) · 2.96 KB
/
cred.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
// This file is part of MinIO DirectPV
// Copyright (c) 2022 MinIO, Inc.
//
// This program is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// This program is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with this program. If not, see <http://www.gnu.org/licenses/>.
package admin
import (
"context"
"encoding/json"
"fmt"
"os"
"github.com/minio/directpv/pkg/consts"
"github.com/minio/directpv/pkg/k8s"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)
const (
accessKeyEnv = consts.AppCapsName + "_ACCESS_KEY"
secretKeyEnv = consts.AppCapsName + "_SECRET_KEY"
)
// Credential represents access and secret key pairs for authentication.
type Credential struct {
AccessKey string `json:"accessKey"`
SecretKey string `json:"secretKey"`
}
// ToSecretData converts to kubernetes secret data.
func (cred Credential) ToSecretData() map[string][]byte {
return map[string][]byte{
"accessKey": []byte(cred.AccessKey),
"secretKey": []byte(cred.SecretKey),
}
}
func getCredentialFromEnv() (cred *Credential, err error) {
if accessKey, found := os.LookupEnv(accessKeyEnv); found {
if secretKey, found := os.LookupEnv(secretKeyEnv); found {
return &Credential{
AccessKey: accessKey,
SecretKey: secretKey,
}, nil
}
}
return nil, fmt.Errorf("credential not set in env vars")
}
func getCredentialFromConfig(configFile string) (*Credential, error) {
file, err := os.Open(configFile)
if err != nil {
return nil, err
}
defer file.Close()
var cred Credential
if err = json.NewDecoder(file).Decode(&cred); err != nil {
return nil, err
}
return &cred, nil
}
func getCredentialFromSecrets(ctx context.Context) (*Credential, error) {
secrets, err := k8s.KubeClient().CoreV1().Secrets(consts.AppName).Get(ctx, consts.CredentialsSecretName, metav1.GetOptions{})
if err != nil {
return nil, err
}
accessKey, found := secrets.Data["accessKey"]
if !found {
return nil, fmt.Errorf("access key not found in secrets")
}
secretKey, found := secrets.Data["secretKey"]
if !found {
return nil, fmt.Errorf("secret key not found in secrets")
}
return &Credential{
AccessKey: string(accessKey),
SecretKey: string(secretKey),
}, nil
}
// GetCredential fetches from environment variable, configFile or kubernetes secrets.
func GetCredential(ctx context.Context, configFile string) (*Credential, error) {
if cred, err := getCredentialFromEnv(); err == nil {
return cred, nil
}
if cred, err := getCredentialFromConfig(configFile); err == nil {
return cred, nil
}
return getCredentialFromSecrets(ctx)
}