From b94db5d6744615f9f4f2410ee11c52a4e9f70591 Mon Sep 17 00:00:00 2001 From: Daniel Hougaard <62331820+DanielHougaard@users.noreply.github.com> Date: Thu, 13 Jun 2024 02:55:00 +0200 Subject: [PATCH] Standalone infisical SDK instance --- .../controllers/infisicalsecret_auth.go | 13 +++++++------ .../controllers/infisicalsecret_controller.go | 10 +++++++++- .../controllers/infisicalsecret_helper.go | 18 ++++++------------ 3 files changed, 22 insertions(+), 19 deletions(-) diff --git a/k8-operator/controllers/infisicalsecret_auth.go b/k8-operator/controllers/infisicalsecret_auth.go index 912ff9b12..a2930b330 100644 --- a/k8-operator/controllers/infisicalsecret_auth.go +++ b/k8-operator/controllers/infisicalsecret_auth.go @@ -6,6 +6,7 @@ import ( "fmt" "github.com/Infisical/infisical/k8-operator/api/v1alpha1" + infisicalSdk "github.com/infisical/go-sdk" ) type AuthStrategyType string @@ -32,7 +33,7 @@ var AuthStrategy = struct { var ErrAuthNotApplicable = errors.New("authentication not applicable") -func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { // Machine Identities: universalAuthKubeSecret, err := r.GetInfisicalUniversalAuthFromKubeSecret(ctx, infisicalSecret) @@ -57,7 +58,7 @@ func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, inf } -func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { kubernetesAuthSpec := infisicalSecret.Spec.Authentication.KubernetesAuth if kubernetesAuthSpec.IdentityID == "" { @@ -73,7 +74,7 @@ func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, in } -func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { awsIamAuthSpec := infisicalSecret.Spec.Authentication.AwsIamAuth if awsIamAuthSpec.IdentityID == "" { @@ -89,7 +90,7 @@ func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisi } -func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { azureAuthSpec := infisicalSecret.Spec.Authentication.AzureAuth if azureAuthSpec.IdentityID == "" { @@ -105,7 +106,7 @@ func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisic } -func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { gcpIdTokenSpec := infisicalSecret.Spec.Authentication.GcpIdTokenAuth if gcpIdTokenSpec.IdentityID == "" { @@ -121,7 +122,7 @@ func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, in } -func (r *InfisicalSecretReconciler) handleGcpIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) handleGcpIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { gcpIamSpec := infisicalSecret.Spec.Authentication.GcpIamAuth if gcpIamSpec.IdentityID == "" && gcpIamSpec.ServiceAccountKeyFilePath == "" { diff --git a/k8-operator/controllers/infisicalsecret_controller.go b/k8-operator/controllers/infisicalsecret_controller.go index 5d57dd831..0bbd3b89b 100644 --- a/k8-operator/controllers/infisicalsecret_controller.go +++ b/k8-operator/controllers/infisicalsecret_controller.go @@ -12,6 +12,8 @@ import ( secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1" "github.com/Infisical/infisical/k8-operator/packages/api" + infisical "github.com/infisical/go-sdk" + infisicalSdk "github.com/infisical/go-sdk" ) // InfisicalSecretReconciler reconciles a InfisicalSecret object @@ -80,7 +82,13 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ api.API_HOST_URL = infisicalSecretCR.Spec.HostAPI } - err = r.ReconcileInfisicalSecret(ctx, infisicalSecretCR) + // Initialize the SDK client with the necessary configuration + infisicalClient := infisical.NewInfisicalClient(infisicalSdk.Config{ + SiteUrl: api.API_HOST_URL, + UserAgent: api.USER_AGENT_NAME, + }) + + err = r.ReconcileInfisicalSecret(ctx, infisicalSecretCR, infisicalClient) r.SetReadyToSyncSecretsConditions(ctx, &infisicalSecretCR, err) if err != nil { diff --git a/k8-operator/controllers/infisicalsecret_helper.go b/k8-operator/controllers/infisicalsecret_helper.go index e0b618994..ebd94a1e8 100644 --- a/k8-operator/controllers/infisicalsecret_helper.go +++ b/k8-operator/controllers/infisicalsecret_helper.go @@ -7,7 +7,6 @@ import ( "strings" "github.com/Infisical/infisical/k8-operator/api/v1alpha1" - "github.com/Infisical/infisical/k8-operator/packages/api" "github.com/Infisical/infisical/k8-operator/packages/model" "github.com/Infisical/infisical/k8-operator/packages/util" @@ -39,10 +38,10 @@ const OPERATOR_SETTINGS_CONFIGMAP_NAME = "infisical-config" const OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE = "infisical-operator-system" const INFISICAL_DOMAIN = "https://app.infisical.com/api" -var infisicalClient = infisicalSdk.NewInfisicalClient(infisicalSdk.Config{}) +// var infisicalClient = infisicalSdk.NewInfisicalClient(infisicalSdk.Config{}) var authDetails AuthenticationDetails -func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { +func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) { // ? Legacy support, service token auth infisicalToken, err := r.GetInfisicalTokenFromKubeSecret(ctx, infisicalSecret) @@ -62,7 +61,7 @@ func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, in return AuthenticationDetails{authStrategy: AuthStrategy.SERVICE_TOKEN}, nil } - authStrategies := map[AuthStrategyType]func(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error){ + authStrategies := map[AuthStrategyType]func(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error){ AuthStrategy.UNIVERSAL_MACHINE_IDENTITY: r.handleUniversalAuth, AuthStrategy.KUBERNETES_MACHINE_IDENTITY: r.handleKubernetesAuth, AuthStrategy.AWS_IAM_MACHINE_IDENTITY: r.handleAwsIamAuth, @@ -72,7 +71,7 @@ func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, in } for authStrategy, authHandler := range authStrategies { - authDetails, err := authHandler(ctx, infisicalSecret) + authDetails, err := authHandler(ctx, infisicalSecret, infisicalClient) if err == nil { return authDetails, nil @@ -288,16 +287,11 @@ func (r *InfisicalSecretReconciler) UpdateInfisicalManagedKubeSecret(ctx context return nil } -func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) error { - // We can't set these values when instantiating the client because we can't be sure that the variables have been populated yet. So instead we're updating the configuration here. This will happen on each reconcile, which is fine. - infisicalClient.UpdateConfiguration(infisicalSdk.Config{ - SiteUrl: api.API_HOST_URL, - UserAgent: api.USER_AGENT_NAME, - }) +func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) error { if authDetails.authStrategy == "" { fmt.Println("ReconcileInfisicalSecret: No authentication strategy found. Attempting to authenticate") - details, err := r.HandleAuthentication(ctx, infisicalSecret) + details, err := r.HandleAuthentication(ctx, infisicalSecret, infisicalClient) if err != nil { return fmt.Errorf("unable to authenticate [err=%s]", err)