awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-10-07 10:27:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Standalone infisical SDK instance

Browse Source
This commit is contained in:
Daniel Hougaard
2024-06-13 02:55:00 +02:00
parent bd6a89fa9a
commit b94db5d674
3 changed files with 22 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
k8-operator/controllers/infisicalsecret_auth.go
+7 -6
View File
@@ -6,6 +6,7 @@ import (
"fmt" "fmt"
"github.com/Infisical/infisical/k8-operator/api/v1alpha1" "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
infisicalSdk "github.com/infisical/go-sdk"
) )
type AuthStrategyType string type AuthStrategyType string
@@ -32,7 +33,7 @@ var AuthStrategy = struct {
var ErrAuthNotApplicable = errors.New("authentication not applicable") var ErrAuthNotApplicable = errors.New("authentication not applicable")
func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
// Machine Identities: // Machine Identities:
universalAuthKubeSecret, err := r.GetInfisicalUniversalAuthFromKubeSecret(ctx, infisicalSecret) universalAuthKubeSecret, err := r.GetInfisicalUniversalAuthFromKubeSecret(ctx, infisicalSecret)
@@ -57,7 +58,7 @@ func (r *InfisicalSecretReconciler) handleUniversalAuth(ctx context.Context, inf
} }
func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
kubernetesAuthSpec := infisicalSecret.Spec.Authentication.KubernetesAuth kubernetesAuthSpec := infisicalSecret.Spec.Authentication.KubernetesAuth
if kubernetesAuthSpec.IdentityID == "" { if kubernetesAuthSpec.IdentityID == "" {
@@ -73,7 +74,7 @@ func (r *InfisicalSecretReconciler) handleKubernetesAuth(ctx context.Context, in
} }
func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
awsIamAuthSpec := infisicalSecret.Spec.Authentication.AwsIamAuth awsIamAuthSpec := infisicalSecret.Spec.Authentication.AwsIamAuth
if awsIamAuthSpec.IdentityID == "" { if awsIamAuthSpec.IdentityID == "" {
@@ -89,7 +90,7 @@ func (r *InfisicalSecretReconciler) handleAwsIamAuth(ctx context.Context, infisi
} }
func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
azureAuthSpec := infisicalSecret.Spec.Authentication.AzureAuth azureAuthSpec := infisicalSecret.Spec.Authentication.AzureAuth
if azureAuthSpec.IdentityID == "" { if azureAuthSpec.IdentityID == "" {
@@ -105,7 +106,7 @@ func (r *InfisicalSecretReconciler) handleAzureAuth(ctx context.Context, infisic
} }
func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
gcpIdTokenSpec := infisicalSecret.Spec.Authentication.GcpIdTokenAuth gcpIdTokenSpec := infisicalSecret.Spec.Authentication.GcpIdTokenAuth
if gcpIdTokenSpec.IdentityID == "" { if gcpIdTokenSpec.IdentityID == "" {
@@ -121,7 +122,7 @@ func (r *InfisicalSecretReconciler) handleGcpIdTokenAuth(ctx context.Context, in
} }
func (r *InfisicalSecretReconciler) handleGcpIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { func (r *InfisicalSecretReconciler) handleGcpIamAuth(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
gcpIamSpec := infisicalSecret.Spec.Authentication.GcpIamAuth gcpIamSpec := infisicalSecret.Spec.Authentication.GcpIamAuth
if gcpIamSpec.IdentityID == "" && gcpIamSpec.ServiceAccountKeyFilePath == "" { if gcpIamSpec.IdentityID == "" && gcpIamSpec.ServiceAccountKeyFilePath == "" {
k8-operator/controllers/infisicalsecret_controller.go
+9 -1
View File
@@ -12,6 +12,8 @@ import (
secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1" secretsv1alpha1 "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
"github.com/Infisical/infisical/k8-operator/packages/api" "github.com/Infisical/infisical/k8-operator/packages/api"
infisical "github.com/infisical/go-sdk"
infisicalSdk "github.com/infisical/go-sdk"
) )
// InfisicalSecretReconciler reconciles a InfisicalSecret object // InfisicalSecretReconciler reconciles a InfisicalSecret object
@@ -80,7 +82,13 @@ func (r *InfisicalSecretReconciler) Reconcile(ctx context.Context, req ctrl.Requ
api.API_HOST_URL = infisicalSecretCR.Spec.HostAPI api.API_HOST_URL = infisicalSecretCR.Spec.HostAPI
} }
err = r.ReconcileInfisicalSecret(ctx, infisicalSecretCR) // Initialize the SDK client with the necessary configuration
infisicalClient := infisical.NewInfisicalClient(infisicalSdk.Config{
SiteUrl: api.API_HOST_URL,
UserAgent: api.USER_AGENT_NAME,
})
err = r.ReconcileInfisicalSecret(ctx, infisicalSecretCR, infisicalClient)
r.SetReadyToSyncSecretsConditions(ctx, &infisicalSecretCR, err) r.SetReadyToSyncSecretsConditions(ctx, &infisicalSecretCR, err)
if err != nil { if err != nil {
k8-operator/controllers/infisicalsecret_helper.go
+6 -12
View File
@@ -7,7 +7,6 @@ import (
"strings" "strings"
"github.com/Infisical/infisical/k8-operator/api/v1alpha1" "github.com/Infisical/infisical/k8-operator/api/v1alpha1"
"github.com/Infisical/infisical/k8-operator/packages/api"
"github.com/Infisical/infisical/k8-operator/packages/model" "github.com/Infisical/infisical/k8-operator/packages/model"
"github.com/Infisical/infisical/k8-operator/packages/util" "github.com/Infisical/infisical/k8-operator/packages/util"
@@ -39,10 +38,10 @@ const OPERATOR_SETTINGS_CONFIGMAP_NAME = "infisical-config"
const OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE = "infisical-operator-system" const OPERATOR_SETTINGS_CONFIGMAP_NAMESPACE = "infisical-operator-system"
const INFISICAL_DOMAIN = "https://app.infisical.com/api" const INFISICAL_DOMAIN = "https://app.infisical.com/api"
var infisicalClient = infisicalSdk.NewInfisicalClient(infisicalSdk.Config{}) // var infisicalClient = infisicalSdk.NewInfisicalClient(infisicalSdk.Config{})
var authDetails AuthenticationDetails var authDetails AuthenticationDetails
func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error) { func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error) {
// ? Legacy support, service token auth // ? Legacy support, service token auth
infisicalToken, err := r.GetInfisicalTokenFromKubeSecret(ctx, infisicalSecret) infisicalToken, err := r.GetInfisicalTokenFromKubeSecret(ctx, infisicalSecret)
@@ -62,7 +61,7 @@ func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, in
return AuthenticationDetails{authStrategy: AuthStrategy.SERVICE_TOKEN}, nil return AuthenticationDetails{authStrategy: AuthStrategy.SERVICE_TOKEN}, nil
} }
authStrategies := map[AuthStrategyType]func(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) (AuthenticationDetails, error){ authStrategies := map[AuthStrategyType]func(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) (AuthenticationDetails, error){
AuthStrategy.UNIVERSAL_MACHINE_IDENTITY: r.handleUniversalAuth, AuthStrategy.UNIVERSAL_MACHINE_IDENTITY: r.handleUniversalAuth,
AuthStrategy.KUBERNETES_MACHINE_IDENTITY: r.handleKubernetesAuth, AuthStrategy.KUBERNETES_MACHINE_IDENTITY: r.handleKubernetesAuth,
AuthStrategy.AWS_IAM_MACHINE_IDENTITY: r.handleAwsIamAuth, AuthStrategy.AWS_IAM_MACHINE_IDENTITY: r.handleAwsIamAuth,
@@ -72,7 +71,7 @@ func (r *InfisicalSecretReconciler) HandleAuthentication(ctx context.Context, in
} }
for authStrategy, authHandler := range authStrategies { for authStrategy, authHandler := range authStrategies {
authDetails, err := authHandler(ctx, infisicalSecret) authDetails, err := authHandler(ctx, infisicalSecret, infisicalClient)
if err == nil { if err == nil {
return authDetails, nil return authDetails, nil
@@ -288,16 +287,11 @@ func (r *InfisicalSecretReconciler) UpdateInfisicalManagedKubeSecret(ctx context
return nil return nil
} }
func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret) error { func (r *InfisicalSecretReconciler) ReconcileInfisicalSecret(ctx context.Context, infisicalSecret v1alpha1.InfisicalSecret, infisicalClient infisicalSdk.InfisicalClientInterface) error {
// We can't set these values when instantiating the client because we can't be sure that the variables have been populated yet. So instead we're updating the configuration here. This will happen on each reconcile, which is fine.
infisicalClient.UpdateConfiguration(infisicalSdk.Config{
SiteUrl: api.API_HOST_URL,
UserAgent: api.USER_AGENT_NAME,
})
if authDetails.authStrategy == "" { if authDetails.authStrategy == "" {
fmt.Println("ReconcileInfisicalSecret: No authentication strategy found. Attempting to authenticate") fmt.Println("ReconcileInfisicalSecret: No authentication strategy found. Attempting to authenticate")
details, err := r.HandleAuthentication(ctx, infisicalSecret) details, err := r.HandleAuthentication(ctx, infisicalSecret, infisicalClient)
if err != nil { if err != nil {
return fmt.Errorf("unable to authenticate [err=%s]", err) return fmt.Errorf("unable to authenticate [err=%s]", err)