diff --git a/go.mod b/go.mod index 6546800..597ab46 100644 --- a/go.mod +++ b/go.mod @@ -4,7 +4,7 @@ go 1.20 require ( github.com/cert-manager/cert-manager v1.13.2 - github.com/evertrust/horizon-go v0.0.5-0.20230929081107-895691de404f + github.com/evertrust/horizon-go v0.0.5-0.20231205100356-cc4f36d09c0f github.com/go-logr/logr v1.2.4 gopkg.in/resty.v1 v1.12.0 k8s.io/api v0.28.1 @@ -54,13 +54,13 @@ require ( github.com/spf13/pflag v1.0.5 // indirect go.uber.org/multierr v1.11.0 // indirect go.uber.org/zap v1.25.0 // indirect - golang.org/x/crypto v0.14.0 // indirect + golang.org/x/crypto v0.16.0 // indirect golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect - golang.org/x/net v0.17.0 // indirect + golang.org/x/net v0.19.0 // indirect golang.org/x/oauth2 v0.12.0 // indirect - golang.org/x/sys v0.13.0 // indirect - golang.org/x/term v0.13.0 // indirect - golang.org/x/text v0.13.0 // indirect + golang.org/x/sys v0.15.0 // indirect + golang.org/x/term v0.15.0 // indirect + golang.org/x/text v0.14.0 // indirect golang.org/x/time v0.3.0 // indirect gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect google.golang.org/appengine v1.6.7 // indirect diff --git a/go.sum b/go.sum index 540647d..9dab389 100644 --- a/go.sum +++ b/go.sum @@ -25,6 +25,8 @@ github.com/evanphx/json-patch/v5 v5.6.0 h1:b91NhWfaz02IuVxO9faSllyAtNXHMPkC5J8sJ github.com/evanphx/json-patch/v5 v5.6.0/go.mod h1:G79N1coSVB93tBe7j6PhzjmR3/2VvlbKOFpnXhI9Bw4= github.com/evertrust/horizon-go v0.0.5-0.20230929081107-895691de404f h1:LAA82Sp3I1vSJUSUOKf5zWCWt8U1tcjqLLUAv5jp/wE= github.com/evertrust/horizon-go v0.0.5-0.20230929081107-895691de404f/go.mod h1:/7fKYOw/NK9Hni+B/A24Ai4LyBFWserv3eMGMYDeyX0= +github.com/evertrust/horizon-go v0.0.5-0.20231205100356-cc4f36d09c0f h1:/dAMEbqTxzMudcL3jWZYSKIGBSw8lkTrjUT25XhAdv4= +github.com/evertrust/horizon-go v0.0.5-0.20231205100356-cc4f36d09c0f/go.mod h1:/7fKYOw/NK9Hni+B/A24Ai4LyBFWserv3eMGMYDeyX0= github.com/fsnotify/fsnotify v1.6.0 h1:n+5WquG0fcWoWp6xPWfHdbskMCQaFnG6PfBrh1Ky4HY= github.com/fsnotify/fsnotify v1.6.0/go.mod h1:sl3t1tCWJFWoRz9R8WJCbQihKKwmorjAbSClcnxKAGw= github.com/go-asn1-ber/asn1-ber v1.5.4 h1:vXT6d/FNDiELJnLb6hGNa309LMsrCoYFvpwHDF0+Y1A= @@ -142,6 +144,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU= golang.org/x/crypto v0.14.0 h1:wBqGXzWJW6m1XrIKlAH0Hs1JJ7+9KBwnIO8v66Q9cHc= golang.org/x/crypto v0.14.0/go.mod h1:MVFd36DqK4CsrnJYDkBA3VC4m2GkXAM0PvzMCn4JQf4= +golang.org/x/crypto v0.16.0 h1:mMMrFzRSCF0GvB7Ne27XVtVAaXLrPmgPC7/v0tkwHaY= +golang.org/x/crypto v0.16.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4= golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g= golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k= golang.org/x/lint v0.0.0-20190930215403-16217165b5de/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc= @@ -164,6 +168,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= golang.org/x/net v0.8.0/go.mod h1:QVkue5JL9kW//ek3r6jTKnTFis1tRmNAW2P1shuFdJc= golang.org/x/net v0.17.0 h1:pVaXccu2ozPjCXewfr1S7xza/zcXTity9cCdXQYSjIM= golang.org/x/net v0.17.0/go.mod h1:NxSsAGuq816PNPmqtQdLE42eU2Fs7NoRIZrHJAlaCOE= +golang.org/x/net v0.19.0 h1:zTwKpTd2XuCqf8huc7Fo2iSy+4RHPd10s4KzeTnVr1c= +golang.org/x/net v0.19.0/go.mod h1:CfAk/cbD4CthTvqiEl8NpboMuiuOYsAr/7NOjZJtv1U= golang.org/x/oauth2 v0.12.0 h1:smVPGxink+n1ZI5pkQa8y6fZT0RW0MgCO5bFpepy4B4= golang.org/x/oauth2 v0.12.0/go.mod h1:A74bZ3aGXgCY0qaIC9Ahg6Lglin4AMAco8cIv9baba4= golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -187,12 +193,16 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE= golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +golang.org/x/sys v0.15.0 h1:h48lPFYpsTvQJZF4EKyI4aLHaev3CxivZmv7yZig9pc= +golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= golang.org/x/term v0.6.0/go.mod h1:m6U89DPEgQRMq3DNkDClhWw02AUbt2daBVO4cn4Hv9U= golang.org/x/term v0.13.0 h1:bb+I9cTfFazGW51MZqBVmZy7+JEJMouUHTUSKVQLBek= golang.org/x/term v0.13.0/go.mod h1:LTmsnFJwVN6bCy1rVCoS+qHT1HhALEFxKncY3WNNh4U= +golang.org/x/term v0.15.0 h1:y/Oo/a/q3IXu26lQgl04j/gjuBDOBlx7X6Om1j2CPW4= +golang.org/x/term v0.15.0/go.mod h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= @@ -201,6 +211,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= golang.org/x/text v0.8.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= golang.org/x/text v0.13.0 h1:ablQoSUd0tRdKxZewP80B+BaqeKJuVhuRxj/dkrun3k= golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= +golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ= +golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/time v0.3.0 h1:rg5rLMjNzMS1RkNLzCG38eapWhnYLFYXDXj2gOlr8j4= golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= diff --git a/internal/controllers/certificaterequest_controller.go b/internal/controllers/certificaterequest_controller.go index d3c470c..7e4d4da 100644 --- a/internal/controllers/certificaterequest_controller.go +++ b/internal/controllers/certificaterequest_controller.go @@ -138,7 +138,7 @@ func (r *CertificateRequestReconciler) Reconcile(ctx context.Context, req ctrl.R } // From here, we're ready to instantiate a Horizon client - clientFromIssuer, err := horizonissuer.ClientFromIssuer(log, issuerSpec, secret.Data) + clientFromIssuer, err := horizonissuer.ClientFromIssuer(log, issuerSpec, secret) if err != nil || clientFromIssuer == nil { return ctrl.Result{}, fmt.Errorf("%s: %v", "Unable to instantiate an Horizon client", err) } diff --git a/internal/controllers/issuer_controller.go b/internal/controllers/issuer_controller.go index 842b665..df1b497 100644 --- a/internal/controllers/issuer_controller.go +++ b/internal/controllers/issuer_controller.go @@ -121,7 +121,7 @@ func (r *IssuerReconciler) Reconcile(ctx context.Context, req ctrl.Request) (res } log.V(1).Info("Starting health check") - checker, err := r.HealthCheckerBuilder(log, issuerSpec, secret.Data) + checker, err := r.HealthCheckerBuilder(log, issuerSpec, secret) if err != nil { return ctrl.Result{}, fmt.Errorf("%w: %v", errHealthCheckerBuilder, err) } diff --git a/internal/issuer/horizon/health.go b/internal/issuer/horizon/health.go index 9cfc571..593749f 100644 --- a/internal/issuer/horizon/health.go +++ b/internal/issuer/horizon/health.go @@ -4,6 +4,7 @@ import ( "github.com/evertrust/horizon-go" horizonapi "github.com/evertrust/horizon-issuer/api/v1beta1" "github.com/go-logr/logr" + corev1 "k8s.io/api/core/v1" "sigs.k8s.io/controller-runtime/pkg/log" ) @@ -11,10 +12,10 @@ type HealthChecker interface { Check() error } -type HealthCheckerBuilder func(logr.Logger, *horizonapi.IssuerSpec, map[string][]byte) (*HorizonHealthChecker, error) +type HealthCheckerBuilder func(logr.Logger, *horizonapi.IssuerSpec, corev1.Secret) (*HorizonHealthChecker, error) -func HealthCheckerFromIssuer(log logr.Logger, issuerSpec *horizonapi.IssuerSpec, secretData map[string][]byte) (*HorizonHealthChecker, error) { - client, err := ClientFromIssuer(log, issuerSpec, secretData) +func HealthCheckerFromIssuer(log logr.Logger, issuerSpec *horizonapi.IssuerSpec, secret corev1.Secret) (*HorizonHealthChecker, error) { + client, err := ClientFromIssuer(log, issuerSpec, secret) if err != nil { return nil, err } diff --git a/internal/issuer/horizon/util.go b/internal/issuer/horizon/util.go index 262cd22..e1468ed 100644 --- a/internal/issuer/horizon/util.go +++ b/internal/issuer/horizon/util.go @@ -9,10 +9,11 @@ import ( horizonapi "github.com/evertrust/horizon-issuer/api/v1beta1" "github.com/go-logr/logr" "gopkg.in/resty.v1" + corev1 "k8s.io/api/core/v1" "net/url" ) -func ClientFromIssuer(log logr.Logger, issuerSpec *horizonapi.IssuerSpec, secretData map[string][]byte) (*horizon.Horizon, error) { +func ClientFromIssuer(log logr.Logger, issuerSpec *horizonapi.IssuerSpec, secret corev1.Secret) (*horizon.Horizon, error) { client := new(horizon.Horizon) tlsConfig := &tls.Config{} @@ -43,10 +44,37 @@ func ClientFromIssuer(log logr.Logger, issuerSpec *horizonapi.IssuerSpec, secret if err != nil { return nil, fmt.Errorf("%s: %v", "Invalid base URL", err) } - username := string(secretData["username"]) - password := string(secretData["password"]) + + if secret.Type == corev1.SecretTypeTLS { + if _, ok := secret.Data["tls.crt"]; !ok { + return nil, fmt.Errorf("%s: %v", "Missing tls.crt in secret", secret.Name) + } + if _, ok := secret.Data["tls.key"]; !ok { + return nil, fmt.Errorf("%s: %v", "Missing tls.key in secret", secret.Name) + } + + cert, err := tls.X509KeyPair(secret.Data["tls.crt"], secret.Data["tls.key"]) + if err != nil { + return nil, fmt.Errorf("%s: %v", "Failed to load TLS certificate", err) + } + + client.Http.WithCertAuth(cert) + } else if secret.Type == corev1.SecretTypeOpaque { + if _, ok := secret.Data["username"]; !ok { + return nil, fmt.Errorf("%s: %v", "Missing username in secret", secret.Name) + } + if _, ok := secret.Data["password"]; !ok { + return nil, fmt.Errorf("%s: %v", "Missing password in secret", secret.Name) + } + client.Http.WithPasswordAuth( + string(secret.Data["username"]), + string(secret.Data["password"]), + ) + } else { + return nil, fmt.Errorf("%s: %v", "Unsupported secret type", secret.Type) + } + client.Http.WithBaseUrl(*baseUrl) - client.Http.WithPasswordAuth(username, password) return client, nil }