Skip to content

Commit 1c1dbc5

Browse files
wallrj-cyberarkwallrj-cyberark
committed
Refactor the TLSPKMode to be OutputMode and add a Local File mode
Signed-off-by: Richard Wall <[email protected]>
1 parent 6a6361b commit 1c1dbc5

File tree

4 files changed

+69
-86
lines changed

4 files changed

+69
-86
lines changed

‎cmd/agent_test.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@ func TestAgentRunOneShot(t *testing.T) {
2727
"agent",
2828
"--one-shot",
2929
// TODO(wallrj): This should not be required when an `--input-file` has been supplied.
30-
"--api-token=should-not-be-required",
31-
// TODO(wallrj): This should not be required when an `--input-file` has been supplied.
3230
"--install-namespace=default",
3331
"--agent-config-file=testdata/agent/one-shot/success/config.yaml",
3432
"--input-path=testdata/agent/one-shot/success/input.json",

‎pkg/agent/config.go

Lines changed: 45 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -355,19 +355,18 @@ func InitAgentCmdFlags(c *cobra.Command, cfg *AgentCmdFlags) {
355355

356356
}
357357

358-
// TLSPKMode controls how to authenticate to TLSPK / Jetstack Secure. Only one
359-
// TLSPKMode may be provided if using those backends.
360-
type TLSPKMode string
358+
// OutputMode controls how the collected data is published.
359+
// Only one OutputMode may be provided.
360+
type OutputMode string
361361

362362
const (
363-
JetstackSecureOAuth TLSPKMode = "Jetstack Secure OAuth"
364-
JetstackSecureAPIToken TLSPKMode = "Jetstack Secure API Token"
365-
VenafiCloudKeypair TLSPKMode = "Venafi Cloud Key Pair Service Account"
366-
VenafiCloudVenafiConnection TLSPKMode = "Venafi Cloud VenafiConnection"
367-
368-
// It is possible to push to both MachineHub and TLSPK. With this mode, the
369-
// agent will only push to MachineHub and not to TLSPK.
370-
Off TLSPKMode = "MachineHub only"
363+
Unknown OutputMode = ""
364+
JetstackSecureOAuth OutputMode = "Jetstack Secure OAuth"
365+
JetstackSecureAPIToken OutputMode = "Jetstack Secure API Token"
366+
VenafiCloudKeypair OutputMode = "Venafi Cloud Key Pair Service Account"
367+
VenafiCloudVenafiConnection OutputMode = "Venafi Cloud VenafiConnection"
368+
MachineHub OutputMode = "MachineHub"
369+
LocalFile OutputMode = "Local File"
371370
)
372371

373372
// The command-line flags and the config file are combined into this struct by
@@ -380,7 +379,7 @@ type CombinedConfig struct {
380379
StrictMode bool
381380
OneShot bool
382381

383-
TLSPKMode TLSPKMode
382+
OutputMode OutputMode
384383

385384
// Used by all TLSPK modes.
386385
ClusterID string
@@ -410,7 +409,6 @@ type CombinedConfig struct {
410409
InputPath string
411410

412411
// MachineHub-related settings.
413-
MachineHubMode bool
414412
MachineHubSubdomain string
415413
MachineHubCredentialsSecretName string
416414
}
@@ -431,8 +429,6 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
431429
if err := cfg.MachineHub.Validate(); err != nil {
432430
return CombinedConfig{}, nil, fmt.Errorf("invalid MachineHub config provided: %w", err)
433431
}
434-
435-
res.MachineHubMode = true
436432
res.MachineHubSubdomain = cfg.MachineHub.Subdomain
437433
res.MachineHubCredentialsSecretName = cfg.MachineHub.CredentialsSecretName
438434

@@ -442,7 +438,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
442438

443439
{
444440
var (
445-
mode TLSPKMode
441+
mode OutputMode
446442
reason string
447443
keysAndValues []any
448444
)
@@ -472,32 +468,32 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
472468
case !flags.VenafiCloudMode && flags.CredentialsPath != "":
473469
mode = JetstackSecureOAuth
474470
reason = "--credentials-file was specified without --venafi-cloud"
471+
case flags.MachineHubMode:
472+
mode = MachineHub
473+
reason = "--machine-hub was specified"
474+
case flags.OutputPath != "":
475+
mode = LocalFile
476+
reason = "--output-path was specified"
475477
default:
476-
if !flags.MachineHubMode {
477-
return CombinedConfig{}, nil, fmt.Errorf("no TLSPK mode specified and MachineHub mode is disabled. You must either enable the MachineHub mode (using --machine-hub), or enable one of the TLSPK modes.\n" +
478-
"To enable one of the TLSPK modes, you can:\n" +
479-
" - Use (--venafi-cloud with --credentials-file) or (--client-id with --private-key-path) to use the " + string(VenafiCloudKeypair) + " mode.\n" +
480-
" - Use --venafi-connection for the " + string(VenafiCloudVenafiConnection) + " mode.\n" +
481-
" - Use --credentials-file alone if you want to use the " + string(JetstackSecureOAuth) + " mode.\n" +
482-
" - Use --api-token if you want to use the " + string(JetstackSecureAPIToken) + " mode.\n" +
483-
"Note that it is possible to use one of the TLSPK modes along with the MachineHub mode (--machine-hub).")
484-
}
485-
486-
mode = Off
478+
return CombinedConfig{}, nil, fmt.Errorf("no output mode specified.\n" +
479+
"To enable one of the output modes, you can:\n" +
480+
" - Use (--venafi-cloud with --credentials-file) or (--client-id with --private-key-path) to use the " + string(VenafiCloudKeypair) + " mode.\n" +
481+
" - Use --venafi-connection for the " + string(VenafiCloudVenafiConnection) + " mode.\n" +
482+
" - Use --credentials-file alone if you want to use the " + string(JetstackSecureOAuth) + " mode.\n" +
483+
" - Use --api-token if you want to use the " + string(JetstackSecureAPIToken) + " mode.\n" +
484+
" - Use --machine-hub for " + string(MachineHub) + " mode.\n" +
485+
" - Use --output-path for " + string(LocalFile) + " mode.")
487486
}
488487

489488
keysAndValues = append(keysAndValues, "mode", mode, "reason", reason)
490-
if mode != Off {
491-
log.V(logs.Debug).Info("Configured to push to Venafi", keysAndValues...)
492-
}
493-
494-
res.TLSPKMode = mode
489+
log.V(logs.Debug).Info("Output mode selected", keysAndValues...)
490+
res.OutputMode = mode
495491
}
496492

497493
var errs error
498494

499495
// Validation and defaulting of `server` and the deprecated `endpoint.path`.
500-
if res.TLSPKMode != Off {
496+
if res.OutputMode != MachineHub {
501497
// Only relevant if using TLSPK backends
502498
hasEndpointField := cfg.Endpoint.Host != "" && cfg.Endpoint.Path != ""
503499
hasServerField := cfg.Server != ""
@@ -520,7 +516,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
520516
endpointPath = cfg.Endpoint.Path
521517
case !hasServerField && !hasEndpointField:
522518
server = "https://preflight.jetstack.io"
523-
if res.TLSPKMode == VenafiCloudKeypair {
519+
if res.OutputMode == VenafiCloudKeypair {
524520
// The VenafiCloudVenafiConnection mode doesn't need a server.
525521
server = client.VenafiCloudProdURL
526522
}
@@ -529,7 +525,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
529525
if urlErr != nil || url.Hostname() == "" {
530526
errs = multierror.Append(errs, fmt.Errorf("server %q is not a valid URL", server))
531527
}
532-
if res.TLSPKMode == VenafiCloudVenafiConnection && server != "" {
528+
if res.OutputMode == VenafiCloudVenafiConnection && server != "" {
533529
log.Info(fmt.Sprintf("ignoring the server field specified in the config file. In %s mode, this field is not needed.", VenafiCloudVenafiConnection))
534530
server = ""
535531
}
@@ -540,10 +536,10 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
540536
// Validation of `venafi-cloud.upload_path`.
541537
{
542538
var uploadPath string
543-
switch res.TLSPKMode { // nolint:exhaustive
539+
switch res.OutputMode { // nolint:exhaustive
544540
case VenafiCloudKeypair:
545541
if cfg.VenafiCloud == nil || cfg.VenafiCloud.UploadPath == "" {
546-
errs = multierror.Append(errs, fmt.Errorf("the venafi-cloud.upload_path field is required when using the %s mode", res.TLSPKMode))
542+
errs = multierror.Append(errs, fmt.Errorf("the venafi-cloud.upload_path field is required when using the %s mode", res.OutputMode))
547543
break // Skip to the end of the switch statement.
548544
}
549545
_, urlErr := url.Parse(cfg.VenafiCloud.UploadPath)
@@ -560,7 +556,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
560556
// change this value with the new --venafi-connection flag, and this
561557
// field is simply ignored.
562558
if cfg.VenafiCloud != nil && cfg.VenafiCloud.UploadPath != "" {
563-
log.Info(fmt.Sprintf(`ignoring the venafi-cloud.upload_path field in the config file. In %s mode, this field is not needed.`, res.TLSPKMode))
559+
log.Info(fmt.Sprintf(`ignoring the venafi-cloud.upload_path field in the config file. In %s mode, this field is not needed.`, res.OutputMode))
564560
}
565561
uploadPath = ""
566562
}
@@ -578,18 +574,18 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
578574
// https://venafi.atlassian.net/browse/VC-35385 is done.
579575
{
580576
if cfg.VenafiCloud != nil && cfg.VenafiCloud.UploaderID != "" {
581-
log.Info(fmt.Sprintf(`ignoring the venafi-cloud.uploader_id field in the config file. This field is not needed in %s mode.`, res.TLSPKMode))
577+
log.Info(fmt.Sprintf(`ignoring the venafi-cloud.uploader_id field in the config file. This field is not needed in %s mode.`, res.OutputMode))
582578
}
583579
}
584580

585581
// Validation of `cluster_id` and `organization_id`.
586-
if res.TLSPKMode != Off {
582+
if res.OutputMode != MachineHub {
587583
var clusterID string
588584
var organizationID string // Only used by the old jetstack-secure mode.
589-
switch res.TLSPKMode { // nolint:exhaustive
585+
switch res.OutputMode { // nolint:exhaustive
590586
case VenafiCloudKeypair, VenafiCloudVenafiConnection:
591587
if cfg.ClusterID == "" {
592-
errs = multierror.Append(errs, fmt.Errorf("cluster_id is required in %s mode", res.TLSPKMode))
588+
errs = multierror.Append(errs, fmt.Errorf("cluster_id is required in %s mode", res.OutputMode))
593589
}
594590
clusterID = cfg.ClusterID
595591
case JetstackSecureOAuth, JetstackSecureAPIToken:
@@ -651,7 +647,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
651647
res.InstallNS = installNS
652648

653649
// Validation of --venafi-connection and --venafi-connection-namespace.
654-
if res.TLSPKMode == VenafiCloudVenafiConnection {
650+
if res.OutputMode == VenafiCloudVenafiConnection {
655651
res.VenConnName = flags.VenConnName
656652
venConnNS := flags.VenConnNS
657653
if flags.VenConnNS == "" {
@@ -717,7 +713,7 @@ func validateCredsAndCreateClient(log logr.Logger, flagCredentialsPath, flagClie
717713

718714
var preflightClient client.Client
719715
metadata := &api.AgentMetadata{Version: version.PreflightVersion, ClusterID: cfg.ClusterID}
720-
switch cfg.TLSPKMode {
716+
switch cfg.OutputMode {
721717
case JetstackSecureOAuth:
722718
// Note that there are no command line flags to configure the
723719
// JetstackSecureOAuth mode.
@@ -807,14 +803,16 @@ func validateCredsAndCreateClient(log logr.Logger, flagCredentialsPath, flagClie
807803
if err != nil {
808804
errs = multierror.Append(errs, err)
809805
}
810-
case Off:
806+
case MachineHub:
807+
// No client needed in this mode.
808+
case LocalFile:
811809
// No client needed in this mode.
812810
default:
813-
panic(fmt.Errorf("programmer mistake: auth mode not implemented: %s", cfg.TLSPKMode))
811+
panic(fmt.Errorf("programmer mistake: output mode not implemented: %s", cfg.OutputMode))
814812
}
815813

816814
if errs != nil {
817-
return nil, fmt.Errorf("failed loading config using the %s mode: %w", cfg.TLSPKMode, errs)
815+
return nil, fmt.Errorf("failed loading config using the %s mode: %w", cfg.OutputMode, errs)
818816
}
819817

820818
return preflightClient, nil

‎pkg/agent/config_test.go

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
9696
withCmdLineFlags("--period", "99m", "--credentials-file", fakeCredsPath))
9797
require.NoError(t, err)
9898
assert.Equal(t, testutil.Undent(`
99-
INFO Configured to push to Venafi mode="Jetstack Secure OAuth" reason="--credentials-file was specified without --venafi-cloud"
99+
INFO Output mode selected mode="Jetstack Secure OAuth" reason="--credentials-file was specified without --venafi-cloud"
100100
INFO Both the 'period' field and --period are set. Using the value provided with --period.
101101
`), gotLogs.String())
102102
assert.Equal(t, 99*time.Minute, got.Period)
@@ -178,7 +178,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
178178

179179
// The log line printed by pflag is not captured by the log recorder.
180180
assert.Equal(t, testutil.Undent(`
181-
INFO Configured to push to Venafi mode="Jetstack Secure OAuth" reason="--credentials-file was specified without --venafi-cloud"
181+
INFO Output mode selected mode="Jetstack Secure OAuth" reason="--credentials-file was specified without --venafi-cloud"
182182
INFO Using period from config period="1h0m0s"
183183
`), b.String())
184184
})
@@ -194,13 +194,14 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
194194
withoutCmdLineFlags(),
195195
)
196196
assert.EqualError(t, err, testutil.Undent(`
197-
no TLSPK mode specified and MachineHub mode is disabled. You must either enable the MachineHub mode (using --machine-hub), or enable one of the TLSPK modes.
198-
To enable one of the TLSPK modes, you can:
197+
no output mode specified.
198+
To enable one of the output modes, you can:
199199
- Use (--venafi-cloud with --credentials-file) or (--client-id with --private-key-path) to use the Venafi Cloud Key Pair Service Account mode.
200200
- Use --venafi-connection for the Venafi Cloud VenafiConnection mode.
201201
- Use --credentials-file alone if you want to use the Jetstack Secure OAuth mode.
202202
- Use --api-token if you want to use the Jetstack Secure API Token mode.
203-
Note that it is possible to use one of the TLSPK modes along with the MachineHub mode (--machine-hub).`))
203+
- Use --machine-hub for MachineHub mode.
204+
- Use --output-path for Local File mode.`))
204205
assert.Nil(t, cl)
205206
})
206207

@@ -228,8 +229,8 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
228229
withCmdLineFlags("--credentials-file", credsPath),
229230
)
230231
expect := CombinedConfig{
231-
TLSPKMode: "Jetstack Secure OAuth",
232-
ClusterID: "example-cluster",
232+
OutputMode: "Jetstack Secure OAuth",
233+
ClusterID: "example-cluster",
233234
DataGatherers: []DataGatherer{{Kind: "dummy",
234235
Name: "d1",
235236
Config: &dummyConfig{},
@@ -277,7 +278,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
277278
InputPath: "/home",
278279
OutputPath: "/nothome",
279280
UploadPath: "/testing/path",
280-
TLSPKMode: VenafiCloudKeypair,
281+
OutputMode: VenafiCloudKeypair,
281282
ClusterID: "the cluster name",
282283
BackoffMaxTime: 99 * time.Minute,
283284
InstallNS: "venafi",
@@ -301,7 +302,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
301302
withCmdLineFlags("--client-id", "5bc7d07c-45da-11ef-a878-523f1e1d7de1", "--private-key-path", privKeyPath),
302303
)
303304
require.NoError(t, err)
304-
assert.Equal(t, VenafiCloudKeypair, got.TLSPKMode)
305+
assert.Equal(t, VenafiCloudKeypair, got.OutputMode)
305306
assert.IsType(t, &client.VenafiCloudClient{}, cl)
306307
})
307308

@@ -390,7 +391,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
390391
`)),
391392
withCmdLineFlags("--credentials-file", path))
392393
require.NoError(t, err)
393-
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, OrganizationID: "foo", ClusterID: "bar", TLSPKMode: JetstackSecureOAuth, BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
394+
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, OrganizationID: "foo", ClusterID: "bar", OutputMode: JetstackSecureOAuth, BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
394395
assert.IsType(t, &client.OAuthClient{}, cl)
395396
})
396397

@@ -469,7 +470,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
469470
`)),
470471
withCmdLineFlags("--client-id", "5bc7d07c-45da-11ef-a878-523f1e1d7de1", "--private-key-path", path))
471472
require.NoError(t, err)
472-
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, TLSPKMode: VenafiCloudKeypair, ClusterID: "the cluster name", UploadPath: "/foo/bar", BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
473+
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, OutputMode: VenafiCloudKeypair, ClusterID: "the cluster name", UploadPath: "/foo/bar", BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
473474
assert.IsType(t, &client.VenafiCloudClient{}, cl)
474475
})
475476

@@ -491,7 +492,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
491492
`)),
492493
withCmdLineFlags("--venafi-cloud", "--credentials-file", credsPath))
493494
require.NoError(t, err)
494-
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, TLSPKMode: VenafiCloudKeypair, ClusterID: "the cluster name", UploadPath: "/foo/bar", BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
495+
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, OutputMode: VenafiCloudKeypair, ClusterID: "the cluster name", UploadPath: "/foo/bar", BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
495496
})
496497

497498
t.Run("venafi-cloud-keypair-auth: venafi-cloud.upload_path field is required", func(t *testing.T) {
@@ -568,7 +569,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
568569
assert.Equal(t, CombinedConfig{
569570
Period: 1 * time.Hour,
570571
ClusterID: "the cluster name",
571-
TLSPKMode: VenafiCloudVenafiConnection,
572+
OutputMode: VenafiCloudVenafiConnection,
572573
VenConnName: "venafi-components",
573574
VenConnNS: "venafi",
574575
InstallNS: "venafi",
@@ -594,13 +595,13 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
594595
)
595596
require.NoError(t, err)
596597
assert.Equal(t, testutil.Undent(`
597-
INFO Configured to push to Venafi venConnName="venafi-components" mode="Venafi Cloud VenafiConnection" reason="--venafi-connection was specified"
598+
INFO Output mode selected venConnName="venafi-components" mode="Venafi Cloud VenafiConnection" reason="--venafi-connection was specified"
598599
INFO ignoring the server field specified in the config file. In Venafi Cloud VenafiConnection mode, this field is not needed.
599600
INFO ignoring the venafi-cloud.upload_path field in the config file. In Venafi Cloud VenafiConnection mode, this field is not needed.
600601
INFO ignoring the venafi-cloud.uploader_id field in the config file. This field is not needed in Venafi Cloud VenafiConnection mode.
601602
INFO Using period from config period="1h0m0s"
602603
`), gotLogs.String())
603-
assert.Equal(t, VenafiCloudVenafiConnection, got.TLSPKMode)
604+
assert.Equal(t, VenafiCloudVenafiConnection, got.OutputMode)
604605
assert.IsType(t, &client.VenConnClient{}, gotCl)
605606
})
606607

@@ -615,7 +616,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
615616
`)),
616617
withCmdLineFlags("--venafi-connection", "venafi-components"))
617618
require.NoError(t, err)
618-
assert.Equal(t, VenafiCloudVenafiConnection, got.TLSPKMode)
619+
assert.Equal(t, VenafiCloudVenafiConnection, got.OutputMode)
619620
})
620621

621622
t.Run("machinehub only: username and password", func(t *testing.T) {
@@ -630,8 +631,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
630631
`)),
631632
withCmdLineFlags("--machine-hub"))
632633
require.NoError(t, err)
633-
assert.Equal(t, Off, got.TLSPKMode)
634-
assert.Equal(t, true, got.MachineHubMode)
634+
assert.Equal(t, MachineHub, got.OutputMode)
635635
})
636636

637637
t.Run("machinehub + venafi-cloud-keypair-auth should work simultaneously", func(t *testing.T) {
@@ -650,8 +650,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
650650
`)),
651651
withCmdLineFlags("--machine-hub", "--venafi-cloud", "--client-id", "5bc7d07c-45da-11ef-a878-523f1e1d7de1", "--private-key-path", privKeyPath))
652652
require.NoError(t, err)
653-
assert.Equal(t, VenafiCloudKeypair, got.TLSPKMode)
654-
assert.Equal(t, true, got.MachineHubMode)
653+
assert.Equal(t, VenafiCloudKeypair, got.OutputMode)
655654
})
656655
}
657656

@@ -690,7 +689,7 @@ func Test_ValidateAndCombineConfig_VenafiCloudKeyPair(t *testing.T) {
690689
)
691690
require.NoError(t, err)
692691
testutil.TrustCA(t, cl, cert)
693-
assert.Equal(t, VenafiCloudKeypair, got.TLSPKMode)
692+
assert.Equal(t, VenafiCloudKeypair, got.OutputMode)
694693

695694
err = cl.PostDataReadingsWithOptions(ctx, nil, client.Options{ClusterName: "test cluster name"})
696695
require.NoError(t, err)

0 commit comments

Comments
 (0)