Support file-mounted secret for cloud-agents (#677)

* support file-mounted secret

* sync latest protocol and add file mountable agent secret

* fix overwrite confirm bug

* do not diplay secret kind until cloud-agents is released

Author: yoonsio

cmd/lk/agent.go

@@ -37,6 +37,10 @@ import (
 	"github.com/livekit/protocol/logger"
 )
 
+const (
+	maxSecretFileSize = 1024 * 1024 // 1MB
+)
+
 var (
 	idFlag = func(required bool) *cli.StringFlag {
 		return &cli.StringFlag{
@@ -65,6 +69,12 @@ var (
 		Required: false,
 	}
 
+	secretsMountFlag = &cli.StringSliceFlag{
+		Name:     "secret-mount",
+		Usage:    "Local path to a secret file to be mounted on agent environment",
+		Required: false,
+	}
+
 	logTypeFlag = &cli.StringFlag{
 		Name:     "log-type",
 		Usage:    "Type of logs to retrieve. Valid values are 'deploy' and 'build'",
@@ -142,6 +152,7 @@ var (
 					Flags: []cli.Flag{
 						secretsFlag,
 						secretsFileFlag,
+						secretsMountFlag,
 						silentFlag,
 						regionFlag,
 						skipSDKCheckFlag,
@@ -185,6 +196,7 @@ var (
 					Flags: []cli.Flag{
 						secretsFlag,
 						secretsFileFlag,
+						secretsMountFlag,
 						skipSDKCheckFlag,
 					},
 					// NOTE: since secrets may contain commas, or indeed any special character we might want to treat as a flag separator,
@@ -210,6 +222,7 @@ var (
 					Flags: []cli.Flag{
 						secretsFlag,
 						secretsFileFlag,
+						secretsMountFlag,
 					},
 					// NOTE: since secrets may contain commas, or indeed any special character we might want to treat as a flag separator,
 					// we disable it entirely here and require multiple --secrets flags to be used.
@@ -302,6 +315,7 @@ var (
 					Flags: []cli.Flag{
 						secretsFlag,
 						secretsFileFlag,
+						secretsMountFlag,
 						idFlag(false),
 						&cli.BoolFlag{
 							Name:     "overwrite",
@@ -1041,6 +1055,7 @@ func listAgentSecrets(ctx context.Context, cmd *cli.Command) error {
 		return fmt.Errorf("unable to list agent secrets: %w", err)
 	}
 
+	// TODO (steveyoon): show secret.Kind.String() once cloud-agents is released
 	table := util.CreateTable().
 		Headers("Name", "Created At", "Updated At")
 
@@ -1080,10 +1095,9 @@ func updateAgentSecrets(ctx context.Context, cmd *cli.Command) error {
 		).Run(); err != nil {
 			return err
 		}
-	}
-
-	if !confirmOverwrite {
-		return nil
+		if !confirmOverwrite {
+			return nil
+		}
 	}
 
 	req := &lkproto.UpdateAgentSecretsRequest{
@@ -1184,17 +1198,39 @@ func requireSecrets(_ context.Context, cmd *cli.Command, required, lazy bool) ([
 	silent := cmd.Bool("silent")
 	secrets := make(map[string]*lkproto.AgentSecret)
 
+	mountableSecretFiles := cmd.StringSlice("secret-mount")
+	for _, filePath := range mountableSecretFiles {
+		fileInfo, err := os.Stat(filePath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to get secret file: %w", err)
+		}
+		if fileInfo.Size() > maxSecretFileSize {
+			return nil, fmt.Errorf("secret file size is too large (must be under %d MB): %s", maxSecretFileSize/(1024*1024), filePath)
+		}
+		fileContent, err := os.ReadFile(filePath)
+		if err != nil {
+			return nil, fmt.Errorf("failed to read secret file: %w", err)
+		}
+		name := fileInfo.Name()
+		agentSecret := &lkproto.AgentSecret{
+			Name:  name,
+			Value: []byte(fileContent),
+			Kind:  lkproto.AgentSecretKind_AGENT_SECRET_KIND_FILE,
+		}
+		secrets[name] = agentSecret
+	}
+
 	if values, err := parseKeyValuePairs(cmd, "secrets"); err != nil {
 		return nil, fmt.Errorf("failed to parse secrets: %w", err)
 	} else {
 		for key, val := range values {
 			agentSecret := &lkproto.AgentSecret{
 				Name:  key,
 				Value: []byte(val),
+				Kind:  lkproto.AgentSecretKind_AGENT_SECRET_KIND_ENVIRONMENT,
 			}
 			secrets[key] = agentSecret
 		}
-
 	}
 
 	shouldReadFromDisk := cmd.IsSet("secrets-file") || !lazy || (required && len(secrets) == 0)
@@ -1215,6 +1251,7 @@ func requireSecrets(_ context.Context, cmd *cli.Command, required, lazy bool) ([
 			secret := &lkproto.AgentSecret{
 				Name:  k,
 				Value: []byte(v),
+				Kind:  lkproto.AgentSecretKind_AGENT_SECRET_KIND_ENVIRONMENT,
 			}
 			secrets[k] = secret
 		}