Spire injection client

pkg/spire/controller.go

@@ -21,6 +21,7 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/pkg/errors"
 	"github.com/spiffe/go-spiffe/v2/spiffetls/tlsconfig"
 	"github.com/spiffe/go-spiffe/v2/workloadapi"
 	entryv1 "github.com/spiffe/spire-api-sdk/proto/spire/api/server/entry/v1"
@@ -31,17 +32,44 @@ import (
 	"google.golang.org/grpc/codes"
 	"google.golang.org/grpc/credentials"
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/client-go/rest"
+	"knative.dev/pkg/injection"
+	"knative.dev/pkg/logging"
 )
 
+func init() {
+	injection.Default.RegisterClient(withControllerClient)
+}
+
+// controllerKey is a way to associate the ControllerAPIClient from inside the context.Context
+type controllerKey struct{}
+
+// GetControllerAPIClient extracts the ControllerAPIClient from the context.
+func GetControllerAPIClient(ctx context.Context) ControllerAPIClient {
+	untyped := ctx.Value(controllerKey{})
+	if untyped == nil {
+		logging.FromContext(ctx).Errorf("Unable to fetch client from context.")
+		return nil
+	}
+	return untyped.(*spireControllerAPIClient)
+}
+
+func withControllerClient(ctx context.Context, cfg *rest.Config) context.Context {
+	return context.WithValue(ctx, controllerKey{}, &spireEntrypointerAPIClient{})
+}
+
 type spireControllerAPIClient struct {
-	config       spireconfig.SpireConfig
+	config       *spireconfig.SpireConfig
 	serverConn   *grpc.ClientConn
 	workloadConn *workloadapi.X509Source
 	entryClient  entryv1.EntryClient
 	workloadAPI  *workloadapi.Client
 }
 
 func (sc *spireControllerAPIClient) setupClient(ctx context.Context) error {
+	if sc.config == nil {
+		return errors.New("config has not been set yet")
+	}
 	if sc.entryClient == nil || sc.workloadConn == nil || sc.workloadAPI == nil || sc.serverConn == nil {
 		return sc.dial(ctx)
 	}
@@ -85,14 +113,8 @@ func (sc *spireControllerAPIClient) dial(ctx context.Context) error {
 	return nil
 }
 
-// NewSpireControllerAPIClient creates a new NewSpireControllerAPIClient for the pipeline controller
-func NewSpireControllerAPIClient(c spireconfig.SpireConfig) ControllerAPIClient {
-	if c.MockSpire {
-		return &MockClient{}
-	}
-	return &spireControllerAPIClient{
-		config: c,
-	}
+func (sc *spireControllerAPIClient) SetConfig(c spireconfig.SpireConfig) {
+	sc.config = &c
 }
 
 func (sc *spireControllerAPIClient) nodeEntry(nodeName string) *spiffetypes.Entry {

pkg/spire/entrypointer.go

@@ -24,14 +24,41 @@ import (
 	"github.com/spiffe/go-spiffe/v2/svid/x509svid"
 	"github.com/spiffe/go-spiffe/v2/workloadapi"
 	spireconfig "github.com/tektoncd/pipeline/pkg/spire/config"
+	"k8s.io/client-go/rest"
+	"knative.dev/pkg/injection"
+	"knative.dev/pkg/logging"
 )
 
+func init() {
+	injection.Default.RegisterClient(withEntrypointerClient)
+}
+
+// entrypointerKey is a way to associate the EntrypointerAPIClient from inside the context.Context
+type entrypointerKey struct{}
+
+// GetEntrypointerAPIClient extracts the EntrypointerAPIClient from the context.
+func GetEntrypointerAPIClient(ctx context.Context) EntrypointerAPIClient {
+	untyped := ctx.Value(entrypointerKey{})
+	if untyped == nil {
+		logging.FromContext(ctx).Errorf("Unable to fetch client from context.")
+		return nil
+	}
+	return untyped.(*spireEntrypointerAPIClient)
+}
+
+func withEntrypointerClient(ctx context.Context, cfg *rest.Config) context.Context {
+	return context.WithValue(ctx, entrypointerKey{}, &spireEntrypointerAPIClient{})
+}
+
 type spireEntrypointerAPIClient struct {
-	config spireconfig.SpireConfig
+	config *spireconfig.SpireConfig
 	client *workloadapi.Client
 }
 
 func (w *spireEntrypointerAPIClient) setupClient(ctx context.Context) error {
+	if w.config == nil {
+		return errors.New("config has not been set yet")
+	}
 	if w.client == nil {
 		return w.dial(ctx)
 	}
@@ -64,11 +91,8 @@ func (w *spireEntrypointerAPIClient) getxsvid(ctx context.Context) (*x509svid.SV
 	return nil, errors.Wrap(err, "requested SVID failed to get fetched and timed out")
 }
 
-// NewSpireEntrypointerAPIClient creates a new spireEntrypointerApiClient for the entrypointer
-func NewSpireEntrypointerAPIClient(c spireconfig.SpireConfig) EntrypointerAPIClient {
-	return &spireEntrypointerAPIClient{
-		config: c,
-	}
+func (w *spireEntrypointerAPIClient) SetConfig(c spireconfig.SpireConfig) {
+	w.config = &c
 }
 
 func (w *spireEntrypointerAPIClient) Close() error {

pkg/spire/spire.go

@@ -28,6 +28,7 @@ import (
 	"context"
 
 	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
+	spireconfig "github.com/tektoncd/pipeline/pkg/spire/config"
 	corev1 "k8s.io/api/core/v1"
 )
 
@@ -50,11 +51,13 @@ type ControllerAPIClient interface {
 	CreateEntries(ctx context.Context, tr *v1beta1.TaskRun, pod *corev1.Pod, ttl int) error
 	DeleteEntry(ctx context.Context, tr *v1beta1.TaskRun, pod *corev1.Pod) error
 	VerifyTaskRunResults(ctx context.Context, prs []v1beta1.PipelineResourceResult, tr *v1beta1.TaskRun) error
+	SetConfig(c spireconfig.SpireConfig)
 }
 
 // EntrypointerAPIClient interface maps to the spire entrypointer API to interact with spire
 type EntrypointerAPIClient interface {
 	Close() error
 	// Sign returns the signature material to be put in the PipelineResourceResult to append to the output results
 	Sign(ctx context.Context, results []v1beta1.PipelineResourceResult) ([]v1beta1.PipelineResourceResult, error)
+	SetConfig(c spireconfig.SpireConfig)
 }

pkg/spire/spire_mock.go

@@ -24,9 +24,25 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/tektoncd/pipeline/pkg/apis/pipeline/v1beta1"
+	spireconfig "github.com/tektoncd/pipeline/pkg/spire/config"
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/client-go/rest"
+	"knative.dev/pkg/injection"
 )
 
+func init() {
+	injection.Fake.RegisterClient(withFakeControllerClient)
+	injection.Fake.RegisterClient(withFakeEntrypointerClient)
+}
+
+func withFakeControllerClient(ctx context.Context, cfg *rest.Config) context.Context {
+	return context.WithValue(ctx, controllerKey{}, &MockClient{})
+}
+
+func withFakeEntrypointerClient(ctx context.Context, cfg *rest.Config) context.Context {
+	return context.WithValue(ctx, entrypointerKey{}, &MockClient{})
+}
+
 // MockClient is a client used for mocking the this package for unit testing
 // other tekton components that use the spire entrypointer or controller client.
 //
@@ -207,3 +223,7 @@ func (sc *MockClient) Sign(ctx context.Context, results []v1beta1.PipelineResour
 func (sc *MockClient) Close() error {
 	return nil
 }
+
+func (sc *MockClient) SetConfig(c spireconfig.SpireConfig) {
+	return
+}