-
Notifications
You must be signed in to change notification settings - Fork 1.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Load credentials and pass through via config
Update NewObjectBackupStore to take a CredentialsGetter which can be used to get the credentials for a BackupStorageLocation if it has been configured with a Credential. If the BSL has a credential, use that SecretKeySelector to fetch the secret, write the contents to a temp file and then pass that file through to the plugin via the config map. This relies on the plugin being able to use the config field. This does not yet handle VolumeSnapshotLocations or ResticRepositories. Signed-off-by: Bridget McErlean <[email protected]>
- Loading branch information
Showing
20 changed files
with
432 additions
and
62 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,82 @@ | ||
| /* | ||
| Copyright the Velero contributors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
|
|
||
| package credentials | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
| "path/filepath" | ||
|
|
||
| "github.com/pkg/errors" | ||
| corev1 "k8s.io/api/core/v1" | ||
| kbclient "sigs.k8s.io/controller-runtime/pkg/client" | ||
|
|
||
| "github.com/vmware-tanzu/velero/pkg/util/kube" | ||
|
|
||
| "github.com/vmware-tanzu/velero/pkg/util/filesystem" | ||
| ) | ||
|
|
||
| // FileStore defines operations for interacting with credentials | ||
| // that are stored on a file system. | ||
| type FileStore interface { | ||
| // Get returns a path on disk where the secret defined by the given | ||
| // selector is serialized. | ||
| Get(selector *corev1.SecretKeySelector) (string, error) | ||
| } | ||
|
|
||
| type namespacedFileStore struct { | ||
| client kbclient.Client | ||
| namespace string | ||
|
|
||
| fsRoot string | ||
| fs filesystem.Interface | ||
| } | ||
|
|
||
| func (n *namespacedFileStore) Get(selector *corev1.SecretKeySelector) (string, error) { | ||
| creds, err := kube.GetSecretKey(n.client, n.namespace, selector) | ||
| if err != nil { | ||
| return "", err | ||
| } | ||
|
|
||
| keyFilePath := filepath.Join(n.fsRoot, fmt.Sprintf("%s-%s", selector.Name, selector.Key)) | ||
| file, err := n.fs.OpenFile(keyFilePath, os.O_RDWR|os.O_CREATE, 0644) | ||
| if err != nil { | ||
| return "", errors.Wrap(err, "unable to open credentials file for writing") | ||
| } | ||
| if _, err := file.Write(creds); err != nil { | ||
| return "", errors.Wrap(err, "unable to write credentials to store") | ||
| } | ||
| if err := file.Close(); err != nil { | ||
| return "", errors.Wrap(err, "unable to close credentials file") | ||
| } | ||
| return keyFilePath, nil | ||
| } | ||
|
|
||
| func NewNamespacedFileStore(client kbclient.Client, namespace string, fsRoot string, fs filesystem.Interface) (FileStore, error) { | ||
| fsNamespaceRoot := filepath.Join(fsRoot, namespace) | ||
|
|
||
| if err := fs.MkdirAll(fsNamespaceRoot, 0644); err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return &namespacedFileStore{ | ||
| client: client, | ||
| namespace: namespace, | ||
| fsRoot: fsNamespaceRoot, | ||
| fs: fs, | ||
| }, nil | ||
| } |
Oops, something went wrong.