Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cleanup: breakup the pkg/credentials into writer and matcher #8542

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

cleanup: breakup the pkg/credentials into writer and matcher #8542

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
9e090f3
cleanup: breakup the pkg/credentials into writer and matcher
waveywaves Jan 30, 2025
29b53ce
cleanup: use better names for the credentials interfaces
waveywaves Jan 30, 2025
86026ba
cleanup: use CredsDir from entrypoint pkg instead of pipeline
waveywaves Feb 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions cmd/entrypoint/main.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,10 @@ import (
"github.com/containerd/containerd/platforms"
"github.com/tektoncd/pipeline/cmd/entrypoint/subcommands"
featureFlags "github.com/tektoncd/pipeline/pkg/apis/config"
"github.com/tektoncd/pipeline/pkg/apis/pipeline"
v1 "github.com/tektoncd/pipeline/pkg/apis/pipeline/v1"
"github.com/tektoncd/pipeline/pkg/credentials"
"github.com/tektoncd/pipeline/pkg/credentials/dockercreds"
"github.com/tektoncd/pipeline/pkg/credentials/gitcreds"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We will need to do the same for credentials/{dockercreds,gitcreds… 👼🏼

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

not sure what you mean 🤔 😅

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we need to find a way to not use these imports
"github.com/tektoncd/pipeline/pkg/credentials/dockercreds"
"github.com/tektoncd/pipeline/pkg/credentials/gitcreds"

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not necessarily not use them, but finding a way so they do not bring corev1 with it.

credwriter "github.com/tektoncd/pipeline/pkg/credentials/writer"
"github.com/tektoncd/pipeline/pkg/entrypoint"
"github.com/tektoncd/pipeline/pkg/spire"
"github.com/tektoncd/pipeline/pkg/spire/config"
Expand Down Expand Up @@ -96,9 +95,9 @@ func main() {
// from secret volume mounts to /tekton/creds. This is done to support the expansion
// of a variable, $(credentials.path), that resolves to a single place with all the
// stored credentials.
builders := []credentials.Builder{dockercreds.NewBuilder(), gitcreds.NewBuilder()}
builders := []credwriter.Writer{dockercreds.NewBuilder(), gitcreds.NewBuilder()}
for _, c := range builders {
if err := c.Write(pipeline.CredsDir); err != nil {
if err := c.Write(entrypoint.CredsDir); err != nil {
log.Printf("Error initializing credentials: %s", err)
}
}
Expand Down Expand Up @@ -164,7 +163,7 @@ func main() {

// Copy any creds injected by the controller into the $HOME directory of the current
// user so that they're discoverable by git / ssh.
if err := credentials.CopyCredsToHome(credentials.CredsInitCredentials); err != nil {
if err := credwriter.CopyCredsToHome(credwriter.CredsInitCredentials); err != nil {
log.Printf("non-fatal error copying credentials: %q", err)
}

Expand Down
18 changes: 12 additions & 6 deletions pkg/credentials/dockercreds/creds.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,8 @@ import (
"path/filepath"
"strings"

"github.com/tektoncd/pipeline/pkg/credentials"
credmatcher "github.com/tektoncd/pipeline/pkg/credentials/matcher"
credwriter "github.com/tektoncd/pipeline/pkg/credentials/writer"
corev1 "k8s.io/api/core/v1"
)

Expand Down Expand Up @@ -117,7 +118,7 @@ type entry struct {
}

func newEntry(secret string) (*entry, error) {
secretPath := credentials.VolumeName(secret)
secretPath := credmatcher.VolumeName(secret)

ub, err := os.ReadFile(filepath.Join(secretPath, corev1.BasicAuthUsernameKey))
if err != nil {
Expand All @@ -143,7 +144,12 @@ func newEntry(secret string) (*entry, error) {
type basicDockerBuilder struct{}

// NewBuilder returns a new builder for Docker credentials.
func NewBuilder() credentials.Builder { return &basicDockerBuilder{} }
func NewBuilder() interface {
credmatcher.Matcher
credwriter.Writer
} {
return &basicDockerBuilder{}
}

// MatchingAnnotations extracts flags for the credential helper
// from the supplied secret and returns a slice (of length 0 or
Expand All @@ -152,7 +158,7 @@ func (*basicDockerBuilder) MatchingAnnotations(secret *corev1.Secret) []string {
var flags []string
switch secret.Type {
case corev1.SecretTypeBasicAuth:
for _, v := range credentials.SortAnnotations(secret.Annotations, annotationPrefix) {
for _, v := range credwriter.SortAnnotations(secret.Annotations, annotationPrefix) {
flags = append(flags, fmt.Sprintf("-basic-docker=%s=%s", secret.Name, v))
}
case corev1.SecretTypeDockerConfigJson:
Expand Down Expand Up @@ -218,7 +224,7 @@ func (*basicDockerBuilder) Write(directory string) error {
}

func authsFromDockerCfg(secret string) (map[string]entry, error) {
secretPath := credentials.VolumeName(secret)
secretPath := credmatcher.VolumeName(secret)
m := make(map[string]entry)
data, err := os.ReadFile(filepath.Join(secretPath, corev1.DockerConfigKey))
if err != nil {
Expand All @@ -229,7 +235,7 @@ func authsFromDockerCfg(secret string) (map[string]entry, error) {
}

func authsFromDockerConfig(secret string) (map[string]entry, error) {
secretPath := credentials.VolumeName(secret)
secretPath := credmatcher.VolumeName(secret)
m := make(map[string]entry)
c := configFile{}
data, err := os.ReadFile(filepath.Join(secretPath, corev1.DockerConfigJsonKey))
Expand Down
60 changes: 30 additions & 30 deletions pkg/credentials/dockercreds/creds_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,14 +23,14 @@ import (
"testing"

"github.com/google/go-cmp/cmp"
"github.com/tektoncd/pipeline/pkg/credentials"
credmatcher "github.com/tektoncd/pipeline/pkg/credentials/matcher"
corev1 "k8s.io/api/core/v1"
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
)

func TestFlagHandling(t *testing.T) {
credentials.VolumePath = t.TempDir()
dir := credentials.VolumeName("foo")
credmatcher.VolumePath = t.TempDir()
dir := credmatcher.VolumeName("foo")
if err := os.MkdirAll(dir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", dir, err)
}
Expand All @@ -50,12 +50,12 @@ func TestFlagHandling(t *testing.T) {
t.Fatalf("flag.CommandLine.Parse() = %v", err)
}

t.Setenv("HOME", credentials.VolumePath)
if err := NewBuilder().Write(credentials.VolumePath); err != nil {
t.Setenv("HOME", credmatcher.VolumePath)
if err := NewBuilder().Write(credmatcher.VolumePath); err != nil {
t.Fatalf("Write() = %v", err)
}

b, err := os.ReadFile(filepath.Join(credentials.VolumePath, ".docker", "config.json"))
b, err := os.ReadFile(filepath.Join(credmatcher.VolumePath, ".docker", "config.json"))
if err != nil {
t.Fatalf("os.ReadFile(.docker/config.json) = %v", err)
}
Expand All @@ -68,8 +68,8 @@ func TestFlagHandling(t *testing.T) {
}

func TestFlagHandlingTwice(t *testing.T) {
credentials.VolumePath = t.TempDir()
fooDir := credentials.VolumeName("foo")
credmatcher.VolumePath = t.TempDir()
fooDir := credmatcher.VolumeName("foo")
if err := os.MkdirAll(fooDir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", fooDir, err)
}
Expand All @@ -79,7 +79,7 @@ func TestFlagHandlingTwice(t *testing.T) {
if err := os.WriteFile(filepath.Join(fooDir, corev1.BasicAuthPasswordKey), []byte("blah"), 0o777); err != nil {
t.Fatalf("os.WriteFile(password) = %v", err)
}
barDir := credentials.VolumeName("bar")
barDir := credmatcher.VolumeName("bar")
if err := os.MkdirAll(barDir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", barDir, err)
}
Expand All @@ -100,12 +100,12 @@ func TestFlagHandlingTwice(t *testing.T) {
t.Fatalf("flag.CommandLine.Parse() = %v", err)
}

t.Setenv("HOME", credentials.VolumePath)
if err := NewBuilder().Write(credentials.VolumePath); err != nil {
t.Setenv("HOME", credmatcher.VolumePath)
if err := NewBuilder().Write(credmatcher.VolumePath); err != nil {
t.Fatalf("Write() = %v", err)
}

b, err := os.ReadFile(filepath.Join(credentials.VolumePath, ".docker", "config.json"))
b, err := os.ReadFile(filepath.Join(credmatcher.VolumePath, ".docker", "config.json"))
if err != nil {
t.Fatalf("os.ReadFile(.docker/config.json) = %v", err)
}
Expand All @@ -118,8 +118,8 @@ func TestFlagHandlingTwice(t *testing.T) {
}

func TestFlagHandlingMissingFiles(t *testing.T) {
credentials.VolumePath = t.TempDir()
dir := credentials.VolumeName("not-found")
credmatcher.VolumePath = t.TempDir()
dir := credmatcher.VolumeName("not-found")
if err := os.MkdirAll(dir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", dir, err)
}
Expand All @@ -132,8 +132,8 @@ func TestFlagHandlingMissingFiles(t *testing.T) {
}

func TestFlagHandlingURLCollision(t *testing.T) {
credentials.VolumePath = t.TempDir()
dir := credentials.VolumeName("foo")
credmatcher.VolumePath = t.TempDir()
dir := credmatcher.VolumeName("foo")
if err := os.MkdirAll(dir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", dir, err)
}
Expand Down Expand Up @@ -244,8 +244,8 @@ func TestMatchingAnnotations(t *testing.T) {
}

func TestMultipleFlagHandling(t *testing.T) {
credentials.VolumePath = t.TempDir()
fooDir := credentials.VolumeName("foo")
credmatcher.VolumePath = t.TempDir()
fooDir := credmatcher.VolumeName("foo")
if err := os.MkdirAll(fooDir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", fooDir, err)
}
Expand All @@ -256,31 +256,31 @@ func TestMultipleFlagHandling(t *testing.T) {
t.Fatalf("os.WriteFile(password) = %v", err)
}

barDir := credentials.VolumeName("bar")
barDir := credmatcher.VolumeName("bar")
if err := os.MkdirAll(barDir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", barDir, err)
}
if err := os.WriteFile(filepath.Join(barDir, corev1.DockerConfigJsonKey), []byte(`{"auths":{"https://index.docker.io/v1":{"auth":"fooisbar"}}}`), 0o777); err != nil {
t.Fatalf("os.WriteFile(username) = %v", err)
}

blubbDir := credentials.VolumeName("blubb")
blubbDir := credmatcher.VolumeName("blubb")
if err := os.MkdirAll(blubbDir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", blubbDir, err)
}
if err := os.WriteFile(filepath.Join(blubbDir, corev1.DockerConfigJsonKey), []byte(`{"auths":{"us.icr.io":{"auth":"fooisblubb"}}}`), 0o777); err != nil {
t.Fatalf("os.WriteFile(username) = %v", err)
}

bazDir := credentials.VolumeName("baz")
bazDir := credmatcher.VolumeName("baz")
if err := os.MkdirAll(bazDir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", bazDir, err)
}
if err := os.WriteFile(filepath.Join(bazDir, corev1.DockerConfigKey), []byte(`{"https://my.registry/v1":{"auth":"fooisbaz"}}`), 0o777); err != nil {
t.Fatalf("os.WriteFile(username) = %v", err)
}

blaDir := credentials.VolumeName("bla")
blaDir := credmatcher.VolumeName("bla")
if err := os.MkdirAll(blaDir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", blaDir, err)
}
Expand All @@ -301,12 +301,12 @@ func TestMultipleFlagHandling(t *testing.T) {
t.Fatalf("flag.CommandLine.Parse() = %v", err)
}

t.Setenv("HOME", credentials.VolumePath)
if err := NewBuilder().Write(credentials.VolumePath); err != nil {
t.Setenv("HOME", credmatcher.VolumePath)
if err := NewBuilder().Write(credmatcher.VolumePath); err != nil {
t.Fatalf("Write() = %v", err)
}

b, err := os.ReadFile(filepath.Join(credentials.VolumePath, ".docker", "config.json"))
b, err := os.ReadFile(filepath.Join(credmatcher.VolumePath, ".docker", "config.json"))
if err != nil {
t.Fatalf("os.ReadFile(.docker/config.json) = %v", err)
}
Expand All @@ -321,8 +321,8 @@ func TestMultipleFlagHandling(t *testing.T) {
// TestNoAuthProvided confirms that providing zero secrets results in no docker
// credential file being written to disk.
func TestNoAuthProvided(t *testing.T) {
credentials.VolumePath = t.TempDir()
fooDir := credentials.VolumeName("foo")
credmatcher.VolumePath = t.TempDir()
fooDir := credmatcher.VolumeName("foo")
if err := os.MkdirAll(fooDir, os.ModePerm); err != nil {
t.Fatalf("os.MkdirAll(%s) = %v", fooDir, err)
}
Expand All @@ -333,11 +333,11 @@ func TestNoAuthProvided(t *testing.T) {
if err != nil {
t.Fatalf("flag.CommandLine.Parse() = %v", err)
}
t.Setenv("HOME", credentials.VolumePath)
if err := NewBuilder().Write(credentials.VolumePath); err != nil {
t.Setenv("HOME", credmatcher.VolumePath)
if err := NewBuilder().Write(credmatcher.VolumePath); err != nil {
t.Fatalf("Write() = %v", err)
}
_, err = os.ReadFile(filepath.Join(credentials.VolumePath, ".docker", "config.json"))
_, err = os.ReadFile(filepath.Join(credmatcher.VolumePath, ".docker", "config.json"))
if err == nil || !os.IsNotExist(err) {
t.Errorf("expected does not exist error but received: %v", err)
}
Expand Down
4 changes: 2 additions & 2 deletions pkg/credentials/gitcreds/basic.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ import (
"path/filepath"
"strings"

"github.com/tektoncd/pipeline/pkg/credentials"
credmatcher "github.com/tektoncd/pipeline/pkg/credentials/matcher"
corev1 "k8s.io/api/core/v1"
)

Expand Down Expand Up @@ -121,7 +121,7 @@ func (be *basicEntry) escapedUsername() string {
}

func newBasicEntry(u, secret string) (*basicEntry, error) {
secretPath := credentials.VolumeName(secret)
secretPath := credmatcher.VolumeName(secret)

ub, err := os.ReadFile(filepath.Join(secretPath, corev1.BasicAuthUsernameKey))
if err != nil {
Expand Down
29 changes: 17 additions & 12 deletions pkg/credentials/gitcreds/creds.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,8 @@ import (
"flag"
"fmt"

"github.com/tektoncd/pipeline/pkg/credentials"
credmatcher "github.com/tektoncd/pipeline/pkg/credentials/matcher"
credwriter "github.com/tektoncd/pipeline/pkg/credentials/writer"
corev1 "k8s.io/api/core/v1"
)

Expand Down Expand Up @@ -48,38 +49,42 @@ func flags(fs *flag.FlagSet) {
fs.Var(&sshConfig, sshFlag, "List of secret=url pairs.")
}

type gitConfigBuilder struct{}
type gitBuilder struct{}

// NewBuilder returns a new builder for Git credentials.
func NewBuilder() credentials.Builder { return &gitConfigBuilder{} }
func NewBuilder() interface {
credmatcher.Matcher
credwriter.Writer
} {
return &gitBuilder{}
}

// MatchingAnnotations extracts flags for the credential helper
// from the supplied secret and returns a slice (of length 0 or
// greater) of applicable domains.
func (*gitConfigBuilder) MatchingAnnotations(secret *corev1.Secret) []string {
var flagName string
func (*gitBuilder) MatchingAnnotations(secret *corev1.Secret) []string {
var flags []string
switch secret.Type {
case corev1.SecretTypeBasicAuth:
flagName = basicAuthFlag
for _, v := range credwriter.SortAnnotations(secret.Annotations, annotationPrefix) {
flags = append(flags, fmt.Sprintf("-%s=%s=%s", basicAuthFlag, secret.Name, v))
}

case corev1.SecretTypeSSHAuth:
flagName = sshFlag
for _, v := range credwriter.SortAnnotations(secret.Annotations, annotationPrefix) {
flags = append(flags, fmt.Sprintf("-%s=%s=%s", sshFlag, secret.Name, v))
}

case corev1.SecretTypeOpaque, corev1.SecretTypeServiceAccountToken, corev1.SecretTypeDockercfg, corev1.SecretTypeDockerConfigJson, corev1.SecretTypeTLS, corev1.SecretTypeBootstrapToken:
return flags

default:
return flags
}

for _, v := range credentials.SortAnnotations(secret.Annotations, annotationPrefix) {
flags = append(flags, fmt.Sprintf("-%s=%s=%s", flagName, secret.Name, v))
}
return flags
}

func (*gitConfigBuilder) Write(directory string) error {
func (*gitBuilder) Write(directory string) error {
if err := basicConfig.Write(directory); err != nil {
return err
}
Expand Down
Loading
Loading