Gardener config credential repository

pkg/contexts/credentials/core/const.go

@@ -25,4 +25,5 @@ const (
 	ATTR_TOKEN                 = "token"
 	ATTR_AWS_ACCESS_KEY_ID     = "awsAccessKeyID"
 	ATTR_AWS_SECRET_ACCESS_KEY = "awsSecretAccessKey"
+	ATTR_KEY                   = "key"
 )

pkg/contexts/credentials/core/identity.go

@@ -147,17 +147,24 @@ func (i ConsumerIdentity) Match(obj map[string]string) bool {
 }
 
 // Copy copies identity
-func (l ConsumerIdentity) Copy() ConsumerIdentity {
-	if l == nil {
+func (i ConsumerIdentity) Copy() ConsumerIdentity {
+	if i == nil {
 		return nil
 	}
 	n := ConsumerIdentity{}
-	for k, v := range l {
+	for k, v := range i {
 		n[k] = v
 	}
 	return n
 }
 
+// SetNonEmptyValue sets a key-value pair only if the value is not empty
+func (i ConsumerIdentity) SetNonEmptyValue(name, value string) {
+	if value != "" {
+		i[name] = value
+	}
+}
+
 ////////////////////////////////////////////////////////////////////////////////
 
 type IdentityMatcherInfo struct {

pkg/contexts/credentials/cpi/const.go

@@ -26,4 +26,5 @@ const (
 	ATTR_SERVER_ADDRESS = core.ATTR_SERVER_ADDRESS
 	ATTR_IDENTITY_TOKEN = core.ATTR_IDENTITY_TOKEN
 	ATTR_REGISTRY_TOKEN = core.ATTR_REGISTRY_TOKEN
+	ATTR_KEY            = core.ATTR_KEY
 )

pkg/contexts/credentials/identity/hostpath/id_test.go

@@ -34,13 +34,15 @@ var _ = Describe("ctf management", func() {
 			hostpath.ID_HOSTNAME:   "host",
 			hostpath.ID_PATHPREFIX: "a/b",
 			hostpath.ID_PORT:       "4711",
+			hostpath.ID_SCHEME:     "scheme://",
 		}
 
 		It("complete", func() {
 			id := credentials.ConsumerIdentity{
 				hostpath.ID_HOSTNAME:   "host",
 				hostpath.ID_PATHPREFIX: "a/b",
 				hostpath.ID_PORT:       "4711",
+				hostpath.ID_SCHEME:     "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeTrue())
 			Expect(IdentityMatcher(pat, id, id)).To(BeFalse())
@@ -51,6 +53,7 @@ var _ = Describe("ctf management", func() {
 				hostpath.ID_HOSTNAME:   "host",
 				hostpath.ID_PATHPREFIX: "a",
 				hostpath.ID_PORT:       "4711",
+				hostpath.ID_SCHEME:     "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeTrue())
 			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
@@ -60,6 +63,7 @@ var _ = Describe("ctf management", func() {
 				hostpath.ID_HOSTNAME:   "host",
 				hostpath.ID_PATHPREFIX: "b",
 				hostpath.ID_PORT:       "4711",
+				hostpath.ID_SCHEME:     "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeFalse())
 			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
@@ -69,6 +73,7 @@ var _ = Describe("ctf management", func() {
 				hostpath.ID_HOSTNAME:   "host",
 				hostpath.ID_PATHPREFIX: "a/b/c",
 				hostpath.ID_PORT:       "4711",
+				hostpath.ID_SCHEME:     "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeFalse())
 			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
@@ -77,6 +82,7 @@ var _ = Describe("ctf management", func() {
 			id := credentials.ConsumerIdentity{
 				hostpath.ID_HOSTNAME: "host",
 				hostpath.ID_PORT:     "4711",
+				hostpath.ID_SCHEME:   "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeTrue())
 			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
@@ -85,6 +91,7 @@ var _ = Describe("ctf management", func() {
 			id := credentials.ConsumerIdentity{
 				hostpath.ID_HOSTNAME:   "host",
 				hostpath.ID_PATHPREFIX: "a/b",
+				hostpath.ID_SCHEME:     "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeTrue())
 			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
@@ -97,6 +104,7 @@ var _ = Describe("ctf management", func() {
 				hostpath.ID_HOSTNAME:   "host",
 				hostpath.ID_PATHPREFIX: "a/b",
 				hostpath.ID_PORT:       "0815",
+				hostpath.ID_SCHEME:     "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeFalse())
 			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
@@ -107,6 +115,7 @@ var _ = Describe("ctf management", func() {
 				hostpath.ID_HOSTNAME:   "other",
 				hostpath.ID_PATHPREFIX: "a/b",
 				hostpath.ID_PORT:       "4711",
+				hostpath.ID_SCHEME:     "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeFalse())
 			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
@@ -115,6 +124,28 @@ var _ = Describe("ctf management", func() {
 			id := credentials.ConsumerIdentity{
 				hostpath.ID_PATHPREFIX: "a/b",
 				hostpath.ID_PORT:       "4711",
+				hostpath.ID_SCHEME:     "scheme://",
+			}
+			Expect(IdentityMatcher(id, nil, pat)).To(BeTrue())
+			Expect(IdentityMatcher(pat, id, id)).To(BeFalse())
+			Expect(IdentityMatcher(pat, id, pat)).To(BeTrue())
+		})
+
+		It("different scheme", func() {
+			id := credentials.ConsumerIdentity{
+				hostpath.ID_HOSTNAME:   "host",
+				hostpath.ID_PATHPREFIX: "a/b",
+				hostpath.ID_PORT:       "4711",
+				hostpath.ID_SCHEME:     "otherscheme://",
+			}
+			Expect(IdentityMatcher(pat, nil, id)).To(BeFalse())
+			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
+		})
+		It("no scheme", func() {
+			id := credentials.ConsumerIdentity{
+				hostpath.ID_HOSTNAME:   "host",
+				hostpath.ID_PATHPREFIX: "a/b",
+				hostpath.ID_PORT:       "4711",
 			}
 			Expect(IdentityMatcher(id, nil, pat)).To(BeTrue())
 			Expect(IdentityMatcher(pat, id, id)).To(BeFalse())
@@ -126,12 +157,14 @@ var _ = Describe("ctf management", func() {
 		pat := credentials.ConsumerIdentity{
 			hostpath.ID_HOSTNAME: "host",
 			hostpath.ID_PORT:     "4711",
+			hostpath.ID_SCHEME:   "scheme://",
 		}
 
 		It("complete", func() {
 			id := credentials.ConsumerIdentity{
 				hostpath.ID_HOSTNAME: "host",
 				hostpath.ID_PORT:     "4711",
+				hostpath.ID_SCHEME:   "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeTrue())
 			Expect(IdentityMatcher(pat, id, id)).To(BeFalse())
@@ -142,13 +175,15 @@ var _ = Describe("ctf management", func() {
 				hostpath.ID_HOSTNAME:   "host",
 				hostpath.ID_PORT:       "4711",
 				hostpath.ID_PATHPREFIX: "b",
+				hostpath.ID_SCHEME:     "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeFalse())
 			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
 		})
 		It("missing port", func() {
 			id := credentials.ConsumerIdentity{
 				hostpath.ID_HOSTNAME: "host",
+				hostpath.ID_SCHEME:   "scheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeTrue())
 			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
@@ -157,10 +192,29 @@ var _ = Describe("ctf management", func() {
 			id := credentials.ConsumerIdentity{
 				hostpath.ID_HOSTNAME: "host",
 				hostpath.ID_PORT:     "0815",
+				hostpath.ID_SCHEME:   "scheme://",
+			}
+			Expect(IdentityMatcher(pat, nil, id)).To(BeFalse())
+			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
+		})
+
+		It("different scheme", func() {
+			id := credentials.ConsumerIdentity{
+				hostpath.ID_HOSTNAME: "host",
+				hostpath.ID_PORT:     "4711",
+				hostpath.ID_SCHEME:   "otherscheme://",
 			}
 			Expect(IdentityMatcher(pat, nil, id)).To(BeFalse())
 			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
 		})
+		It("no scheme", func() {
+			id := credentials.ConsumerIdentity{
+				hostpath.ID_HOSTNAME: "host",
+				hostpath.ID_PORT:     "4711",
+			}
+			Expect(IdentityMatcher(pat, nil, id)).To(BeTrue())
+			Expect(IdentityMatcher(pat, pat, id)).To(BeFalse())
+		})
 	})
 
 })

pkg/contexts/credentials/identity/hostpath/identity.go

@@ -33,6 +33,9 @@ const ID_PORT = "port"
 // ID_PATHPREFIX is the path prefix below the host.
 const ID_PATHPREFIX = "pathprefix"
 
+// ID_SCHEME is the scheme prefix.
+const ID_SCHEME = "scheme"
+
 func init() {
 	cpi.RegisterStandardIdentityMatcher(IDENTITY_TYPE, IdentityMatcher(""), `Host and path based credential matcher
 
@@ -60,6 +63,12 @@ func IdentityMatcher(identityType string) cpi.IdentityMatcher {
 			}
 		}
 
+		if pattern[ID_SCHEME] != "" {
+			if id[ID_SCHEME] != "" && id[ID_SCHEME] != pattern[ID_SCHEME] {
+				return false
+			}
+		}
+
 		if pattern[ID_PATHPREFIX] != "" {
 			if id[ID_PATHPREFIX] != "" {
 				if len(id[ID_PATHPREFIX]) > len(pattern[ID_PATHPREFIX]) {
@@ -93,6 +102,9 @@ func IdentityMatcher(identityType string) cpi.IdentityMatcher {
 		if cur[ID_PORT] == "" && (id[ID_PORT] != "" && pattern[ID_PORT] != "") {
 			return true
 		}
+		if cur[ID_SCHEME] == "" && (id[ID_SCHEME] != "" && pattern[ID_SCHEME] != "") {
+			return true
+		}
 
 		if len(cur[ID_PATHPREFIX]) < len(id[ID_PATHPREFIX]) {
 			return true

pkg/contexts/credentials/repositories/directcreds/repository.go

@@ -40,7 +40,7 @@ func (r *Repository) LookupCredentials(name string) (cpi.Credentials, error) {
 	return r.Credentials, nil
 }
 
-func (r Repository) WriteCredentials(name string, creds cpi.Credentials) (cpi.Credentials, error) {
+func (r *Repository) WriteCredentials(name string, creds cpi.Credentials) (cpi.Credentials, error) {
 	return nil, errors.ErrNotSupported(cpi.KIND_CREDENTIALS, "write", "constant credential")
 }
 

pkg/contexts/credentials/repositories/dockerconfig/type.go

@@ -29,7 +29,7 @@ func init() {
 	cpi.RegisterRepositoryType(TypeV1, cpi.NewRepositoryType(TypeV1, &RepositorySpec{}))
 }
 
-// RepositorySpec describes a cocker config based credential repository interface.
+// RepositorySpec describes a docker config based credential repository interface.
 type RepositorySpec struct {
 	runtime.ObjectVersionedType `json:",inline"`
 	DockerConfigFile            string `json:"dockerConfigFile"`

pkg/contexts/credentials/repositories/gardenerconfig/README.md

@@ -0,0 +1,3 @@
+# Gardener Config Credential Repository
+
+The gardener config credential repository implements the retrieval of secrets in a data format specified by the gardener concourse utils (https://github.com/gardener/cc-utils/tree/master/model). It supports either handing in the data via a local json file or retrieve it from a secret server (as defined in https://github.com/gardener/cc-utils/blob/master/ccc/secrets_server.py#L29).

pkg/contexts/credentials/repositories/gardenerconfig/cache.go

@@ -0,0 +1,36 @@
+package gardenerconfig
+
+import (
+	"fmt"
+	"sync"
+
+	"github.com/open-component-model/ocm/pkg/contexts/credentials/cpi"
+	gardenercfgcpi "github.com/open-component-model/ocm/pkg/contexts/credentials/repositories/gardenerconfig/cpi"
+	"github.com/open-component-model/ocm/pkg/contexts/datacontext"
+)
+
+const ATTR_REPOS = "github.com/open-component-model/ocm/pkg/contexts/credentials/repositories/gardenerconfig"
+
+type Repositories struct {
+	lock  sync.Mutex
+	repos map[string]*Repository
+}
+
+func newRepositories(datacontext.Context) interface{} {
+	return &Repositories{
+		repos: map[string]*Repository{},
+	}
+}
+
+func (r *Repositories) GetRepository(ctx cpi.Context, url string, configType gardenercfgcpi.ConfigType, cipher Cipher, key []byte, propagateConsumerIdentity bool) (*Repository, error) {
+	r.lock.Lock()
+	defer r.lock.Unlock()
+	if _, ok := r.repos[url]; !ok {
+		repo, err := NewRepository(ctx, url, configType, cipher, key, propagateConsumerIdentity)
+		if err != nil {
+			return nil, fmt.Errorf("unable to create repository: %w", err)
+		}
+		r.repos[url] = repo
+	}
+	return r.repos[url], nil
+}

pkg/contexts/credentials/repositories/gardenerconfig/cpi/interface.go

@@ -0,0 +1,51 @@
+package cpi
+
+import (
+	"io"
+	"sync"
+
+	"github.com/open-component-model/ocm/pkg/contexts/credentials/cpi"
+)
+
+type ConfigType string
+
+const (
+	ContainerRegistry ConfigType = "container_registry"
+)
+
+type Credential interface {
+	Name() string
+	ConsumerIdentity() cpi.ConsumerIdentity
+	Properties() cpi.Credentials
+}
+
+type Handler interface {
+	ConfigType() ConfigType
+	ParseConfig(io.Reader) ([]Credential, error)
+}
+
+var handlers = map[ConfigType]Handler{}
+var lock sync.RWMutex
+
+func RegisterHandler(h Handler) {
+	lock.Lock()
+	defer lock.Unlock()
+	handlers[h.ConfigType()] = h
+}
+
+func GetHandler(configType ConfigType) Handler {
+	lock.RLock()
+	defer lock.RUnlock()
+	return handlers[configType]
+}
+
+func GetHandlers() map[ConfigType]Handler {
+	lock.RLock()
+	defer lock.RUnlock()
+
+	m := map[ConfigType]Handler{}
+	for k, v := range handlers {
+		m[k] = v
+	}
+	return m
+}

pkg/contexts/credentials/repositories/gardenerconfig/credentials.go

@@ -0,0 +1,15 @@
+package gardenerconfig
+
+import (
+	"github.com/open-component-model/ocm/pkg/contexts/credentials/cpi"
+)
+
+type credentialGetter struct {
+	getCredentials func() (cpi.Credentials, error)
+}
+
+var _ cpi.CredentialsSource = credentialGetter{}
+
+func (c credentialGetter) Credentials(ctx cpi.Context, cs ...cpi.CredentialsSource) (cpi.Credentials, error) {
+	return c.getCredentials()
+}

pkg/contexts/credentials/repositories/gardenerconfig/handler/container_registry/credentials.go

@@ -0,0 +1,26 @@
+package container_registry
+
+import (
+	"github.com/open-component-model/ocm/pkg/contexts/credentials/cpi"
+	gardenercfgcpi "github.com/open-component-model/ocm/pkg/contexts/credentials/repositories/gardenerconfig/cpi"
+)
+
+type credentials struct {
+	name             string
+	consumerIdentity cpi.ConsumerIdentity
+	properties       cpi.Credentials
+}
+
+func (c credentials) Name() string {
+	return c.name
+}
+
+func (c credentials) ConsumerIdentity() cpi.ConsumerIdentity {
+	return c.consumerIdentity
+}
+
+func (c credentials) Properties() cpi.Credentials {
+	return c.properties
+}
+
+var _ gardenercfgcpi.Credential = credentials{}