Skip to content

Commit 9e07a0f

Browse files
cappyzawacappyzawa
committed
Migrate secrets handling to pkg/runtime/secrets
Replace custom secret handling with pkg/runtime/secrets package: - Remove entire internal/secret package - Use secrets.TLSConfigFromSecret() for TLS certificates - Use secrets.ProxyURLFromSecret() for proxy configuration - Use secrets.PullSecretsFromServiceAccount() for ServiceAccount handling - Consolidate all pull secrets into single k8schain flow - Update tests to use pkg/runtime/secrets constants Signed-off-by: cappyzawa <[email protected]>
1 parent 51817d6 commit 9e07a0f

14 files changed

+52
-711
lines changed

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ require (
1515
github.com/fluxcd/pkg/apis/meta v1.12.0
1616
github.com/fluxcd/pkg/auth v0.18.0
1717
github.com/fluxcd/pkg/cache v0.9.0
18-
github.com/fluxcd/pkg/runtime v0.60.0
18+
github.com/fluxcd/pkg/runtime v0.63.0
1919
github.com/fluxcd/pkg/version v0.7.0
2020
github.com/go-logr/logr v1.4.2
2121
github.com/google/go-containerregistry v0.20.5

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -167,8 +167,8 @@ github.com/fluxcd/pkg/auth v0.18.0 h1:71pGdKe0PVKWQvM3hEuyd3FD9dEUHtMuKMbUeiMl4a
167167
github.com/fluxcd/pkg/auth v0.18.0/go.mod h1:4h6s8VBNuec3tWd4xIReLw8BYPOKaIegjNMEbA4ikTU=
168168
github.com/fluxcd/pkg/cache v0.9.0 h1:EGKfOLMG3fOwWnH/4Axl5xd425mxoQbZzlZoLfd8PDk=
169169
github.com/fluxcd/pkg/cache v0.9.0/go.mod h1:jMwabjWfsC5lW8hE7NM3wtGNwSJ38Javx6EKbEi7INU=
170-
github.com/fluxcd/pkg/runtime v0.60.0 h1:d++EkV3FlycB+bzakB5NumwY4J8xts8i7lbvD6jBLeU=
171-
github.com/fluxcd/pkg/runtime v0.60.0/go.mod h1:UeU0/eZLErYC/1bTmgzBfNXhiHy9fuQzjfLK0HxRgxY=
170+
github.com/fluxcd/pkg/runtime v0.63.0 h1:55J7ascGmXyTXWGwhD21N9fU7jC1l5rhdzjgNXs6aZg=
171+
github.com/fluxcd/pkg/runtime v0.63.0/go.mod h1:7pxGvaU0Yy1cDIUhiHAHhCx2yCLnkcVsplbYZG6j4JY=
172172
github.com/fluxcd/pkg/version v0.7.0 h1:jZT5I6WFy1KlM40nHCSqlHmjC1VT1/DfmbAdOkIVVJc=
173173
github.com/fluxcd/pkg/version v0.7.0/go.mod h1:3BjQDJXIZJmeJLXnfa2yG/sNAT1t5oeLAPfnSjOHNuA=
174174
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=

‎internal/controller/imagepolicy_controller_test.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -175,14 +175,14 @@ func TestImagePolicyReconciler_ignoresImageRepoNotReadyEvent(t *testing.T) {
175175
g.Eventually(func() bool {
176176
err := k8sClient.Get(ctx, client.ObjectKeyFromObject(imagePolicy), imagePolicy)
177177
return err == nil && conditions.IsReady(imagePolicy)
178-
}).Should(BeTrue())
178+
}, timeout, interval).Should(BeTrue())
179179

180180
// Wait a bit and check that the ImagePolicy remains ready.
181181
time.Sleep(time.Second)
182182
g.Eventually(func() bool {
183183
err := k8sClient.Get(ctx, client.ObjectKeyFromObject(imagePolicy), imagePolicy)
184184
return err == nil && conditions.IsReady(imagePolicy)
185-
}).Should(BeTrue())
185+
}, timeout, interval).Should(BeTrue())
186186
}
187187

188188
func TestImagePolicyReconciler_imageRepoRevisionLifeCycle(t *testing.T) {

‎internal/controller/imagerepository_controller_test.go‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -43,10 +43,10 @@ import (
4343
"github.com/fluxcd/pkg/apis/meta"
4444
"github.com/fluxcd/pkg/runtime/conditions"
4545
"github.com/fluxcd/pkg/runtime/patch"
46+
"github.com/fluxcd/pkg/runtime/secrets"
4647

4748
imagev1 "github.com/fluxcd/image-reflector-controller/api/v1beta2"
4849
"github.com/fluxcd/image-reflector-controller/internal/registry"
49-
"github.com/fluxcd/image-reflector-controller/internal/secret"
5050
"github.com/fluxcd/image-reflector-controller/internal/test"
5151
)
5252

@@ -688,9 +688,9 @@ func TestImageRepositoryReconciler_TLS(t *testing.T) {
688688
testTLSSecret.Namespace = testNamespace
689689
testTLSSecret.Type = corev1.SecretTypeTLS
690690
testTLSSecret.Data = map[string][]byte{
691-
secret.CACrtKey: rootCertPEM,
692-
corev1.TLSCertKey: clientCertPEM,
693-
corev1.TLSPrivateKeyKey: clientKeyPEM,
691+
secrets.CACertKey: rootCertPEM,
692+
secrets.TLSCertKey: clientCertPEM,
693+
secrets.TLSKeyKey: clientKeyPEM,
694694
}
695695

696696
// Construct ImageRepository.

‎internal/registry/options.go‎

Lines changed: 32 additions & 90 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,6 @@ package registry
1818

1919
import (
2020
"context"
21-
"fmt"
2221
"net/http"
2322
"net/url"
2423

@@ -27,15 +26,14 @@ import (
2726
"github.com/google/go-containerregistry/pkg/v1/remote"
2827
corev1 "k8s.io/api/core/v1"
2928
"k8s.io/apimachinery/pkg/types"
30-
ctrl "sigs.k8s.io/controller-runtime"
3129
"sigs.k8s.io/controller-runtime/pkg/client"
3230

3331
"github.com/fluxcd/pkg/auth"
3432
authutils "github.com/fluxcd/pkg/auth/utils"
3533
"github.com/fluxcd/pkg/cache"
34+
"github.com/fluxcd/pkg/runtime/secrets"
3635

3736
imagev1 "github.com/fluxcd/image-reflector-controller/api/v1beta2"
38-
"github.com/fluxcd/image-reflector-controller/internal/secret"
3937
)
4038

4139
// AuthOptionsGetter builds a slice of options from an ImageRepository by looking up references to Secrets etc.
@@ -65,7 +63,7 @@ func (r *AuthOptionsGetter) GetOptions(ctx context.Context, repo *imagev1.ImageR
6563
var proxyURL *url.URL
6664
var err error
6765
if repo.Spec.ProxySecretRef != nil {
68-
proxyURL, err = r.GetProxyURL(ctx, repo)
66+
proxyURL, err = secrets.ProxyURLFromSecret(ctx, r.Client, repo.Spec.ProxySecretRef.Name, repo.Namespace)
6967
if err != nil {
7068
return nil, err
7169
}
@@ -80,22 +78,8 @@ func (r *AuthOptionsGetter) GetOptions(ctx context.Context, repo *imagev1.ImageR
8078
var options []remote.Option
8179
var authSecret corev1.Secret
8280
var authenticator authn.Authenticator
83-
var authErr error
8481

85-
if repo.Spec.SecretRef != nil {
86-
ref, err := ParseImageReference(repo.Spec.Image, repo.Spec.Insecure)
87-
if err != nil {
88-
return nil, fmt.Errorf("failed parsing image reference %q: %w", repo.Spec.Image, err)
89-
}
90-
91-
if err := r.Get(ctx, types.NamespacedName{
92-
Namespace: repo.GetNamespace(),
93-
Name: repo.Spec.SecretRef.Name,
94-
}, &authSecret); err != nil {
95-
return nil, err
96-
}
97-
authenticator, authErr = secret.AuthFromSecret(authSecret, ref)
98-
} else if provider := repo.GetProvider(); provider != "generic" {
82+
if provider := repo.GetProvider(); provider != "" && provider != "generic" {
9983
// Build login provider options and use it to attempt registry login.
10084
var opts []auth.Option
10185
if proxyURL != nil {
@@ -111,12 +95,11 @@ func (r *AuthOptionsGetter) GetOptions(ctx context.Context, repo *imagev1.ImageR
11195
if r.TokenCache != nil {
11296
opts = append(opts, auth.WithCache(*r.TokenCache, *involvedObject))
11397
}
114-
authenticator, authErr = authutils.GetArtifactRegistryCredentials(ctx, provider, repo.Spec.Image, opts...)
115-
}
116-
if authErr != nil {
117-
return nil, authErr
118-
}
119-
if authenticator != nil {
98+
var err error
99+
authenticator, err = authutils.GetArtifactRegistryCredentials(ctx, provider, repo.Spec.Image, opts...)
100+
if err != nil {
101+
return nil, err
102+
}
120103
options = append(options, remote.WithAuth(authenticator))
121104
}
122105

@@ -134,20 +117,10 @@ func (r *AuthOptionsGetter) GetOptions(ctx context.Context, repo *imagev1.ImageR
134117
}
135118
}
136119

137-
tlsConfig, err := secret.TLSConfigFromKubeTLSSecret(&certSecret)
120+
tlsConfig, err := secrets.TLSConfigFromSecret(ctx, r.Client, certSecret.Name, certSecret.Namespace)
138121
if err != nil {
139122
return nil, err
140123
}
141-
if tlsConfig == nil {
142-
tlsConfig, err = secret.TLSConfigFromSecret(&certSecret)
143-
if err != nil {
144-
return nil, err
145-
}
146-
if tlsConfig != nil {
147-
ctrl.LoggerFrom(ctx).
148-
Info("warning: specifying TLS auth data via `certFile`/`keyFile`/`caFile` is deprecated, please use `tls.crt`/`tls.key`/`ca.crt` instead")
149-
}
150-
}
151124
if tlsConfig != nil {
152125
transportOptions = append(transportOptions, func(t *http.Transport) {
153126
t.TLSClientConfig = tlsConfig
@@ -164,29 +137,32 @@ func (r *AuthOptionsGetter) GetOptions(ctx context.Context, repo *imagev1.ImageR
164137
options = append(options, remote.WithTransport(tr))
165138
}
166139

167-
if authenticator == nil && repo.Spec.ServiceAccountName != "" {
168-
serviceAccount := corev1.ServiceAccount{}
169-
// Lookup service account
170-
if err := r.Get(ctx, types.NamespacedName{
171-
Namespace: repo.GetNamespace(),
172-
Name: repo.Spec.ServiceAccountName,
173-
}, &serviceAccount); err != nil {
174-
return nil, err
140+
if authenticator == nil {
141+
var pullSecrets []corev1.Secret
142+
143+
if repo.Spec.SecretRef != nil {
144+
var s corev1.Secret
145+
key := types.NamespacedName{
146+
Name: repo.Spec.SecretRef.Name,
147+
Namespace: repo.GetNamespace(),
148+
}
149+
if err := r.Get(ctx, key, &s); err != nil {
150+
return nil, err
151+
}
152+
pullSecrets = append(pullSecrets, s)
175153
}
176154

177-
if len(serviceAccount.ImagePullSecrets) > 0 {
178-
imagePullSecrets := make([]corev1.Secret, len(serviceAccount.ImagePullSecrets))
179-
for i, ips := range serviceAccount.ImagePullSecrets {
180-
var saAuthSecret corev1.Secret
181-
if err := r.Get(ctx, types.NamespacedName{
182-
Namespace: repo.GetNamespace(),
183-
Name: ips.Name,
184-
}, &saAuthSecret); err != nil {
185-
return nil, err
186-
}
187-
imagePullSecrets[i] = saAuthSecret
155+
if repo.Spec.ServiceAccountName != "" {
156+
s, err := secrets.PullSecretsFromServiceAccount(ctx, r.Client,
157+
repo.Spec.ServiceAccountName, repo.GetNamespace())
158+
if err != nil {
159+
return nil, err
188160
}
189-
keychain, err := k8schain.NewFromPullSecrets(ctx, imagePullSecrets)
161+
pullSecrets = append(pullSecrets, s...)
162+
}
163+
164+
if len(pullSecrets) > 0 {
165+
keychain, err := k8schain.NewFromPullSecrets(ctx, pullSecrets)
190166
if err != nil {
191167
return nil, err
192168
}
@@ -196,37 +172,3 @@ func (r *AuthOptionsGetter) GetOptions(ctx context.Context, repo *imagev1.ImageR
196172

197173
return options, nil
198174
}
199-
200-
// GetProxyURL gets the proxy configuration for the transport based on the
201-
// specified proxy secret reference in the ImageRepository object.
202-
func (r *AuthOptionsGetter) GetProxyURL(ctx context.Context, obj *imagev1.ImageRepository) (*url.URL, error) {
203-
if obj.Spec.ProxySecretRef == nil || obj.Spec.ProxySecretRef.Name == "" {
204-
return nil, nil
205-
}
206-
207-
proxySecretName := types.NamespacedName{
208-
Namespace: obj.Namespace,
209-
Name: obj.Spec.ProxySecretRef.Name,
210-
}
211-
var proxySecret corev1.Secret
212-
if err := r.Get(ctx, proxySecretName, &proxySecret); err != nil {
213-
return nil, err
214-
}
215-
216-
proxyData := proxySecret.Data
217-
address, ok := proxyData["address"]
218-
if !ok {
219-
return nil, fmt.Errorf("invalid proxy secret '%s/%s': key 'address' is missing",
220-
obj.Namespace, obj.Spec.ProxySecretRef.Name)
221-
}
222-
proxyURL, err := url.Parse(string(address))
223-
if err != nil {
224-
return nil, fmt.Errorf("failed to parse proxy address '%s': %w", address, err)
225-
}
226-
user, hasUser := proxyData["username"]
227-
password, hasPassword := proxyData["password"]
228-
if hasUser || hasPassword {
229-
proxyURL.User = url.UserPassword(string(user), string(password))
230-
}
231-
return proxyURL, nil
232-
}

0 commit comments

Comments
 (0)