Skip to content

Commit 8a48f9e

Browse files
wallrj-cyberarkwallrj-cyberark
committed
Refactor the TLSPKMode to be OutputMode and add a Local File mode
Signed-off-by: Richard Wall <[email protected]>
1 parent c4bad68 commit 8a48f9e

File tree

4 files changed

+68
-86
lines changed

4 files changed

+68
-86
lines changed

‎cmd/agent_test.go

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,6 @@ func TestAgentRunOneShot(t *testing.T) {
2727
"agent",
2828
"--one-shot",
2929
// TODO(wallrj): This should not be required when an `--input-file` has been supplied.
30-
"--api-token=should-not-be-required",
31-
// TODO(wallrj): This should not be required when an `--input-file` has been supplied.
3230
"--install-namespace=default",
3331
"--agent-config-file=testdata/agent/one-shot/success/config.yaml",
3432
"--input-path=testdata/agent/one-shot/success/input.json",

‎pkg/agent/config.go

Lines changed: 44 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -355,19 +355,17 @@ func InitAgentCmdFlags(c *cobra.Command, cfg *AgentCmdFlags) {
355355

356356
}
357357

358-
// TLSPKMode controls how to authenticate to TLSPK / Jetstack Secure. Only one
359-
// TLSPKMode may be provided if using those backends.
360-
type TLSPKMode string
358+
// OutputMode controls how the collected data is published.
359+
// Only one OutputMode may be provided.
360+
type OutputMode string
361361

362362
const (
363-
JetstackSecureOAuth TLSPKMode = "Jetstack Secure OAuth"
364-
JetstackSecureAPIToken TLSPKMode = "Jetstack Secure API Token"
365-
VenafiCloudKeypair TLSPKMode = "Venafi Cloud Key Pair Service Account"
366-
VenafiCloudVenafiConnection TLSPKMode = "Venafi Cloud VenafiConnection"
367-
368-
// It is possible to push to both MachineHub and TLSPK. With this mode, the
369-
// agent will only push to MachineHub and not to TLSPK.
370-
Off TLSPKMode = "MachineHub only"
363+
JetstackSecureOAuth OutputMode = "Jetstack Secure OAuth"
364+
JetstackSecureAPIToken OutputMode = "Jetstack Secure API Token"
365+
VenafiCloudKeypair OutputMode = "Venafi Cloud Key Pair Service Account"
366+
VenafiCloudVenafiConnection OutputMode = "Venafi Cloud VenafiConnection"
367+
MachineHub OutputMode = "MachineHub"
368+
LocalFile OutputMode = "Local File"
371369
)
372370

373371
// The command-line flags and the config file are combined into this struct by
@@ -380,7 +378,7 @@ type CombinedConfig struct {
380378
StrictMode bool
381379
OneShot bool
382380

383-
TLSPKMode TLSPKMode
381+
OutputMode OutputMode
384382

385383
// Used by all TLSPK modes.
386384
ClusterID string
@@ -410,7 +408,6 @@ type CombinedConfig struct {
410408
InputPath string
411409

412410
// MachineHub-related settings.
413-
MachineHubMode bool
414411
MachineHubSubdomain string
415412
MachineHubCredentialsSecretName string
416413
}
@@ -431,8 +428,6 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
431428
if err := cfg.MachineHub.Validate(); err != nil {
432429
return CombinedConfig{}, nil, fmt.Errorf("invalid MachineHub config provided: %w", err)
433430
}
434-
435-
res.MachineHubMode = true
436431
res.MachineHubSubdomain = cfg.MachineHub.Subdomain
437432
res.MachineHubCredentialsSecretName = cfg.MachineHub.CredentialsSecretName
438433

@@ -442,7 +437,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
442437

443438
{
444439
var (
445-
mode TLSPKMode
440+
mode OutputMode
446441
reason string
447442
keysAndValues []any
448443
)
@@ -472,32 +467,32 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
472467
case !flags.VenafiCloudMode && flags.CredentialsPath != "":
473468
mode = JetstackSecureOAuth
474469
reason = "--credentials-file was specified without --venafi-cloud"
470+
case flags.MachineHubMode:
471+
mode = MachineHub
472+
reason = "--machine-hub was specified"
473+
case flags.OutputPath != "":
474+
mode = LocalFile
475+
reason = "--output-path was specified"
475476
default:
476-
if !flags.MachineHubMode {
477-
return CombinedConfig{}, nil, fmt.Errorf("no TLSPK mode specified and MachineHub mode is disabled. You must either enable the MachineHub mode (using --machine-hub), or enable one of the TLSPK modes.\n" +
478-
"To enable one of the TLSPK modes, you can:\n" +
479-
" - Use (--venafi-cloud with --credentials-file) or (--client-id with --private-key-path) to use the " + string(VenafiCloudKeypair) + " mode.\n" +
480-
" - Use --venafi-connection for the " + string(VenafiCloudVenafiConnection) + " mode.\n" +
481-
" - Use --credentials-file alone if you want to use the " + string(JetstackSecureOAuth) + " mode.\n" +
482-
" - Use --api-token if you want to use the " + string(JetstackSecureAPIToken) + " mode.\n" +
483-
"Note that it is possible to use one of the TLSPK modes along with the MachineHub mode (--machine-hub).")
484-
}
485-
486-
mode = Off
477+
return CombinedConfig{}, nil, fmt.Errorf("no output mode specified.\n" +
478+
"To enable one of the output modes, you can:\n" +
479+
" - Use (--venafi-cloud with --credentials-file) or (--client-id with --private-key-path) to use the " + string(VenafiCloudKeypair) + " mode.\n" +
480+
" - Use --venafi-connection for the " + string(VenafiCloudVenafiConnection) + " mode.\n" +
481+
" - Use --credentials-file alone if you want to use the " + string(JetstackSecureOAuth) + " mode.\n" +
482+
" - Use --api-token if you want to use the " + string(JetstackSecureAPIToken) + " mode.\n" +
483+
" - Use --machine-hub for " + string(MachineHub) + " mode.\n" +
484+
" - Use --output-path for " + string(LocalFile) + " mode.")
487485
}
488486

489487
keysAndValues = append(keysAndValues, "mode", mode, "reason", reason)
490-
if mode != Off {
491-
log.V(logs.Debug).Info("Configured to push to Venafi", keysAndValues...)
492-
}
493-
494-
res.TLSPKMode = mode
488+
log.V(logs.Debug).Info("Output mode selected", keysAndValues...)
489+
res.OutputMode = mode
495490
}
496491

497492
var errs error
498493

499494
// Validation and defaulting of `server` and the deprecated `endpoint.path`.
500-
if res.TLSPKMode != Off {
495+
if res.OutputMode != MachineHub {
501496
// Only relevant if using TLSPK backends
502497
hasEndpointField := cfg.Endpoint.Host != "" && cfg.Endpoint.Path != ""
503498
hasServerField := cfg.Server != ""
@@ -520,7 +515,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
520515
endpointPath = cfg.Endpoint.Path
521516
case !hasServerField && !hasEndpointField:
522517
server = "https://preflight.jetstack.io"
523-
if res.TLSPKMode == VenafiCloudKeypair {
518+
if res.OutputMode == VenafiCloudKeypair {
524519
// The VenafiCloudVenafiConnection mode doesn't need a server.
525520
server = client.VenafiCloudProdURL
526521
}
@@ -529,7 +524,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
529524
if urlErr != nil || url.Hostname() == "" {
530525
errs = multierror.Append(errs, fmt.Errorf("server %q is not a valid URL", server))
531526
}
532-
if res.TLSPKMode == VenafiCloudVenafiConnection && server != "" {
527+
if res.OutputMode == VenafiCloudVenafiConnection && server != "" {
533528
log.Info(fmt.Sprintf("ignoring the server field specified in the config file. In %s mode, this field is not needed.", VenafiCloudVenafiConnection))
534529
server = ""
535530
}
@@ -540,10 +535,10 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
540535
// Validation of `venafi-cloud.upload_path`.
541536
{
542537
var uploadPath string
543-
switch res.TLSPKMode { // nolint:exhaustive
538+
switch res.OutputMode { // nolint:exhaustive
544539
case VenafiCloudKeypair:
545540
if cfg.VenafiCloud == nil || cfg.VenafiCloud.UploadPath == "" {
546-
errs = multierror.Append(errs, fmt.Errorf("the venafi-cloud.upload_path field is required when using the %s mode", res.TLSPKMode))
541+
errs = multierror.Append(errs, fmt.Errorf("the venafi-cloud.upload_path field is required when using the %s mode", res.OutputMode))
547542
break // Skip to the end of the switch statement.
548543
}
549544
_, urlErr := url.Parse(cfg.VenafiCloud.UploadPath)
@@ -560,7 +555,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
560555
// change this value with the new --venafi-connection flag, and this
561556
// field is simply ignored.
562557
if cfg.VenafiCloud != nil && cfg.VenafiCloud.UploadPath != "" {
563-
log.Info(fmt.Sprintf(`ignoring the venafi-cloud.upload_path field in the config file. In %s mode, this field is not needed.`, res.TLSPKMode))
558+
log.Info(fmt.Sprintf(`ignoring the venafi-cloud.upload_path field in the config file. In %s mode, this field is not needed.`, res.OutputMode))
564559
}
565560
uploadPath = ""
566561
}
@@ -578,18 +573,18 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
578573
// https://venafi.atlassian.net/browse/VC-35385 is done.
579574
{
580575
if cfg.VenafiCloud != nil && cfg.VenafiCloud.UploaderID != "" {
581-
log.Info(fmt.Sprintf(`ignoring the venafi-cloud.uploader_id field in the config file. This field is not needed in %s mode.`, res.TLSPKMode))
576+
log.Info(fmt.Sprintf(`ignoring the venafi-cloud.uploader_id field in the config file. This field is not needed in %s mode.`, res.OutputMode))
582577
}
583578
}
584579

585580
// Validation of `cluster_id` and `organization_id`.
586-
if res.TLSPKMode != Off {
581+
if res.OutputMode != MachineHub {
587582
var clusterID string
588583
var organizationID string // Only used by the old jetstack-secure mode.
589-
switch res.TLSPKMode { // nolint:exhaustive
584+
switch res.OutputMode { // nolint:exhaustive
590585
case VenafiCloudKeypair, VenafiCloudVenafiConnection:
591586
if cfg.ClusterID == "" {
592-
errs = multierror.Append(errs, fmt.Errorf("cluster_id is required in %s mode", res.TLSPKMode))
587+
errs = multierror.Append(errs, fmt.Errorf("cluster_id is required in %s mode", res.OutputMode))
593588
}
594589
clusterID = cfg.ClusterID
595590
case JetstackSecureOAuth, JetstackSecureAPIToken:
@@ -651,7 +646,7 @@ func ValidateAndCombineConfig(log logr.Logger, cfg Config, flags AgentCmdFlags)
651646
res.InstallNS = installNS
652647

653648
// Validation of --venafi-connection and --venafi-connection-namespace.
654-
if res.TLSPKMode == VenafiCloudVenafiConnection {
649+
if res.OutputMode == VenafiCloudVenafiConnection {
655650
res.VenConnName = flags.VenConnName
656651
venConnNS := flags.VenConnNS
657652
if flags.VenConnNS == "" {
@@ -717,7 +712,7 @@ func validateCredsAndCreateClient(log logr.Logger, flagCredentialsPath, flagClie
717712

718713
var preflightClient client.Client
719714
metadata := &api.AgentMetadata{Version: version.PreflightVersion, ClusterID: cfg.ClusterID}
720-
switch cfg.TLSPKMode {
715+
switch cfg.OutputMode {
721716
case JetstackSecureOAuth:
722717
// Note that there are no command line flags to configure the
723718
// JetstackSecureOAuth mode.
@@ -807,14 +802,16 @@ func validateCredsAndCreateClient(log logr.Logger, flagCredentialsPath, flagClie
807802
if err != nil {
808803
errs = multierror.Append(errs, err)
809804
}
810-
case Off:
805+
case MachineHub:
806+
// No client needed in this mode.
807+
case LocalFile:
811808
// No client needed in this mode.
812809
default:
813-
panic(fmt.Errorf("programmer mistake: auth mode not implemented: %s", cfg.TLSPKMode))
810+
panic(fmt.Errorf("programmer mistake: output mode not implemented: %s", cfg.OutputMode))
814811
}
815812

816813
if errs != nil {
817-
return nil, fmt.Errorf("failed loading config using the %s mode: %w", cfg.TLSPKMode, errs)
814+
return nil, fmt.Errorf("failed loading config using the %s mode: %w", cfg.OutputMode, errs)
818815
}
819816

820817
return preflightClient, nil

‎pkg/agent/config_test.go

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
9696
withCmdLineFlags("--period", "99m", "--credentials-file", fakeCredsPath))
9797
require.NoError(t, err)
9898
assert.Equal(t, testutil.Undent(`
99-
INFO Configured to push to Venafi mode="Jetstack Secure OAuth" reason="--credentials-file was specified without --venafi-cloud"
99+
INFO Output mode selected mode="Jetstack Secure OAuth" reason="--credentials-file was specified without --venafi-cloud"
100100
INFO Both the 'period' field and --period are set. Using the value provided with --period.
101101
`), gotLogs.String())
102102
assert.Equal(t, 99*time.Minute, got.Period)
@@ -178,7 +178,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
178178

179179
// The log line printed by pflag is not captured by the log recorder.
180180
assert.Equal(t, testutil.Undent(`
181-
INFO Configured to push to Venafi mode="Jetstack Secure OAuth" reason="--credentials-file was specified without --venafi-cloud"
181+
INFO Output mode selected mode="Jetstack Secure OAuth" reason="--credentials-file was specified without --venafi-cloud"
182182
INFO Using period from config period="1h0m0s"
183183
`), b.String())
184184
})
@@ -194,13 +194,14 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
194194
withoutCmdLineFlags(),
195195
)
196196
assert.EqualError(t, err, testutil.Undent(`
197-
no TLSPK mode specified and MachineHub mode is disabled. You must either enable the MachineHub mode (using --machine-hub), or enable one of the TLSPK modes.
198-
To enable one of the TLSPK modes, you can:
197+
no output mode specified.
198+
To enable one of the output modes, you can:
199199
- Use (--venafi-cloud with --credentials-file) or (--client-id with --private-key-path) to use the Venafi Cloud Key Pair Service Account mode.
200200
- Use --venafi-connection for the Venafi Cloud VenafiConnection mode.
201201
- Use --credentials-file alone if you want to use the Jetstack Secure OAuth mode.
202202
- Use --api-token if you want to use the Jetstack Secure API Token mode.
203-
Note that it is possible to use one of the TLSPK modes along with the MachineHub mode (--machine-hub).`))
203+
- Use --machine-hub for MachineHub mode.
204+
- Use --output-path for Local File mode.`))
204205
assert.Nil(t, cl)
205206
})
206207

@@ -228,8 +229,8 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
228229
withCmdLineFlags("--credentials-file", credsPath),
229230
)
230231
expect := CombinedConfig{
231-
TLSPKMode: "Jetstack Secure OAuth",
232-
ClusterID: "example-cluster",
232+
OutputMode: "Jetstack Secure OAuth",
233+
ClusterID: "example-cluster",
233234
DataGatherers: []DataGatherer{{Kind: "dummy",
234235
Name: "d1",
235236
Config: &dummyConfig{},
@@ -277,7 +278,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
277278
InputPath: "/home",
278279
OutputPath: "/nothome",
279280
UploadPath: "/testing/path",
280-
TLSPKMode: VenafiCloudKeypair,
281+
OutputMode: VenafiCloudKeypair,
281282
ClusterID: "the cluster name",
282283
BackoffMaxTime: 99 * time.Minute,
283284
InstallNS: "venafi",
@@ -301,7 +302,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
301302
withCmdLineFlags("--client-id", "5bc7d07c-45da-11ef-a878-523f1e1d7de1", "--private-key-path", privKeyPath),
302303
)
303304
require.NoError(t, err)
304-
assert.Equal(t, VenafiCloudKeypair, got.TLSPKMode)
305+
assert.Equal(t, VenafiCloudKeypair, got.OutputMode)
305306
assert.IsType(t, &client.VenafiCloudClient{}, cl)
306307
})
307308

@@ -390,7 +391,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
390391
`)),
391392
withCmdLineFlags("--credentials-file", path))
392393
require.NoError(t, err)
393-
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, OrganizationID: "foo", ClusterID: "bar", TLSPKMode: JetstackSecureOAuth, BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
394+
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, OrganizationID: "foo", ClusterID: "bar", OutputMode: JetstackSecureOAuth, BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
394395
assert.IsType(t, &client.OAuthClient{}, cl)
395396
})
396397

@@ -469,7 +470,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
469470
`)),
470471
withCmdLineFlags("--client-id", "5bc7d07c-45da-11ef-a878-523f1e1d7de1", "--private-key-path", path))
471472
require.NoError(t, err)
472-
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, TLSPKMode: VenafiCloudKeypair, ClusterID: "the cluster name", UploadPath: "/foo/bar", BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
473+
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, OutputMode: VenafiCloudKeypair, ClusterID: "the cluster name", UploadPath: "/foo/bar", BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
473474
assert.IsType(t, &client.VenafiCloudClient{}, cl)
474475
})
475476

@@ -491,7 +492,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
491492
`)),
492493
withCmdLineFlags("--venafi-cloud", "--credentials-file", credsPath))
493494
require.NoError(t, err)
494-
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, TLSPKMode: VenafiCloudKeypair, ClusterID: "the cluster name", UploadPath: "/foo/bar", BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
495+
assert.Equal(t, CombinedConfig{Server: "https://api.venafi.eu", Period: time.Hour, OutputMode: VenafiCloudKeypair, ClusterID: "the cluster name", UploadPath: "/foo/bar", BackoffMaxTime: 10 * time.Minute, InstallNS: "venafi"}, got)
495496
})
496497

497498
t.Run("venafi-cloud-keypair-auth: venafi-cloud.upload_path field is required", func(t *testing.T) {
@@ -568,7 +569,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
568569
assert.Equal(t, CombinedConfig{
569570
Period: 1 * time.Hour,
570571
ClusterID: "the cluster name",
571-
TLSPKMode: VenafiCloudVenafiConnection,
572+
OutputMode: VenafiCloudVenafiConnection,
572573
VenConnName: "venafi-components",
573574
VenConnNS: "venafi",
574575
InstallNS: "venafi",
@@ -594,13 +595,13 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
594595
)
595596
require.NoError(t, err)
596597
assert.Equal(t, testutil.Undent(`
597-
INFO Configured to push to Venafi venConnName="venafi-components" mode="Venafi Cloud VenafiConnection" reason="--venafi-connection was specified"
598+
INFO Output mode selected venConnName="venafi-components" mode="Venafi Cloud VenafiConnection" reason="--venafi-connection was specified"
598599
INFO ignoring the server field specified in the config file. In Venafi Cloud VenafiConnection mode, this field is not needed.
599600
INFO ignoring the venafi-cloud.upload_path field in the config file. In Venafi Cloud VenafiConnection mode, this field is not needed.
600601
INFO ignoring the venafi-cloud.uploader_id field in the config file. This field is not needed in Venafi Cloud VenafiConnection mode.
601602
INFO Using period from config period="1h0m0s"
602603
`), gotLogs.String())
603-
assert.Equal(t, VenafiCloudVenafiConnection, got.TLSPKMode)
604+
assert.Equal(t, VenafiCloudVenafiConnection, got.OutputMode)
604605
assert.IsType(t, &client.VenConnClient{}, gotCl)
605606
})
606607

@@ -615,7 +616,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
615616
`)),
616617
withCmdLineFlags("--venafi-connection", "venafi-components"))
617618
require.NoError(t, err)
618-
assert.Equal(t, VenafiCloudVenafiConnection, got.TLSPKMode)
619+
assert.Equal(t, VenafiCloudVenafiConnection, got.OutputMode)
619620
})
620621

621622
t.Run("machinehub only: username and password", func(t *testing.T) {
@@ -630,8 +631,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
630631
`)),
631632
withCmdLineFlags("--machine-hub"))
632633
require.NoError(t, err)
633-
assert.Equal(t, Off, got.TLSPKMode)
634-
assert.Equal(t, true, got.MachineHubMode)
634+
assert.Equal(t, MachineHub, got.OutputMode)
635635
})
636636

637637
t.Run("machinehub + venafi-cloud-keypair-auth should work simultaneously", func(t *testing.T) {
@@ -650,8 +650,7 @@ func Test_ValidateAndCombineConfig(t *testing.T) {
650650
`)),
651651
withCmdLineFlags("--machine-hub", "--venafi-cloud", "--client-id", "5bc7d07c-45da-11ef-a878-523f1e1d7de1", "--private-key-path", privKeyPath))
652652
require.NoError(t, err)
653-
assert.Equal(t, VenafiCloudKeypair, got.TLSPKMode)
654-
assert.Equal(t, true, got.MachineHubMode)
653+
assert.Equal(t, VenafiCloudKeypair, got.OutputMode)
655654
})
656655
}
657656

@@ -690,7 +689,7 @@ func Test_ValidateAndCombineConfig_VenafiCloudKeyPair(t *testing.T) {
690689
)
691690
require.NoError(t, err)
692691
testutil.TrustCA(t, cl, cert)
693-
assert.Equal(t, VenafiCloudKeypair, got.TLSPKMode)
692+
assert.Equal(t, VenafiCloudKeypair, got.OutputMode)
694693

695694
err = cl.PostDataReadingsWithOptions(ctx, nil, client.Options{ClusterName: "test cluster name"})
696695
require.NoError(t, err)

0 commit comments

Comments
 (0)