Skip to content

Commit 0e86d08

Browse files
waveywaveswaveywaves
committed
cleanup: remove corev1 usage from credentials package
1 parent 86026ba commit 0e86d08

File tree

6 files changed

+83
-38
lines changed

6 files changed

+83
-38
lines changed

‎pkg/credentials/common/constants.go

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
package common
2+
3+
// Secret key constants used in credential files,
4+
// so as to avoid reliance on corev1.Secret.
5+
const (
6+
BasicAuthUsernameKey = "username"
7+
BasicAuthPasswordKey = "password"
8+
SSHAuthPrivateKey = "ssh-privatekey"
9+
DockerConfigKey = ".dockercfg"
10+
DockerConfigJsonKey = ".dockerconfigjson"
11+
SecretTypeBasicAuth = "kubernetes.io/basic-auth"
12+
SecretTypeSSHAuth = "kubernetes.io/ssh-auth"
13+
SecretTypeDockerConfigJson = "kubernetes.io/dockerconfigjson"
14+
SecretTypeDockercfg = "kubernetes.io/dockercfg"
15+
SecretTypeServiceAccountToken = "kubernetes.io/service-account-token"
16+
SecretTypeOpaque = "kubernetes.io/opaque"
17+
SecretTypeTLS = "kubernetes.io/tls"
18+
SecretTypeBootstrapToken = "kubernetes.io/bootstrap-token"
19+
)

‎pkg/credentials/dockercreds/creds.go

+16-16
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,9 @@ import (
2525
"path/filepath"
2626
"strings"
2727

28+
"github.com/tektoncd/pipeline/pkg/credentials/common"
2829
credmatcher "github.com/tektoncd/pipeline/pkg/credentials/matcher"
2930
credwriter "github.com/tektoncd/pipeline/pkg/credentials/writer"
30-
corev1 "k8s.io/api/core/v1"
3131
)
3232

3333
const annotationPrefix = "tekton.dev/docker-"
@@ -120,13 +120,13 @@ type entry struct {
120120
func newEntry(secret string) (*entry, error) {
121121
secretPath := credmatcher.VolumeName(secret)
122122

123-
ub, err := os.ReadFile(filepath.Join(secretPath, corev1.BasicAuthUsernameKey))
123+
ub, err := os.ReadFile(filepath.Join(secretPath, common.BasicAuthUsernameKey))
124124
if err != nil {
125125
return nil, err
126126
}
127127
username := string(ub)
128128

129-
pb, err := os.ReadFile(filepath.Join(secretPath, corev1.BasicAuthPasswordKey))
129+
pb, err := os.ReadFile(filepath.Join(secretPath, common.BasicAuthPasswordKey))
130130
if err != nil {
131131
return nil, err
132132
}
@@ -154,20 +154,20 @@ func NewBuilder() interface {
154154
// MatchingAnnotations extracts flags for the credential helper
155155
// from the supplied secret and returns a slice (of length 0 or
156156
// greater) of applicable domains.
157-
func (*basicDockerBuilder) MatchingAnnotations(secret *corev1.Secret) []string {
157+
func (*basicDockerBuilder) MatchingAnnotations(secret credmatcher.Secret) []string {
158158
var flags []string
159-
switch secret.Type {
160-
case corev1.SecretTypeBasicAuth:
161-
for _, v := range credwriter.SortAnnotations(secret.Annotations, annotationPrefix) {
162-
flags = append(flags, fmt.Sprintf("-basic-docker=%s=%s", secret.Name, v))
159+
switch credmatcher.GetSecretType(secret) {
160+
case common.SecretTypeBasicAuth:
161+
for _, v := range credwriter.SortAnnotations(secret.GetAnnotations(), annotationPrefix) {
162+
flags = append(flags, fmt.Sprintf("-basic-docker=%s=%s", secret.GetName(), v))
163163
}
164-
case corev1.SecretTypeDockerConfigJson:
165-
flags = append(flags, "-docker-config="+secret.Name)
166-
case corev1.SecretTypeDockercfg:
167-
flags = append(flags, "-docker-cfg="+secret.Name)
164+
case common.SecretTypeDockerConfigJson:
165+
flags = append(flags, "-docker-config="+secret.GetName())
166+
case common.SecretTypeDockercfg:
167+
flags = append(flags, "-docker-cfg="+secret.GetName())
168168

169-
case corev1.SecretTypeOpaque, corev1.SecretTypeServiceAccountToken, corev1.SecretTypeSSHAuth, corev1.SecretTypeTLS, corev1.SecretTypeBootstrapToken:
170-
return flags
169+
case common.SecretTypeOpaque, common.SecretTypeServiceAccountToken, common.SecretTypeSSHAuth, common.SecretTypeTLS, common.SecretTypeBootstrapToken:
170+
fallthrough
171171

172172
default:
173173
return flags
@@ -226,7 +226,7 @@ func (*basicDockerBuilder) Write(directory string) error {
226226
func authsFromDockerCfg(secret string) (map[string]entry, error) {
227227
secretPath := credmatcher.VolumeName(secret)
228228
m := make(map[string]entry)
229-
data, err := os.ReadFile(filepath.Join(secretPath, corev1.DockerConfigKey))
229+
data, err := os.ReadFile(filepath.Join(secretPath, common.DockerConfigKey))
230230
if err != nil {
231231
return m, err
232232
}
@@ -238,7 +238,7 @@ func authsFromDockerConfig(secret string) (map[string]entry, error) {
238238
secretPath := credmatcher.VolumeName(secret)
239239
m := make(map[string]entry)
240240
c := configFile{}
241-
data, err := os.ReadFile(filepath.Join(secretPath, corev1.DockerConfigJsonKey))
241+
data, err := os.ReadFile(filepath.Join(secretPath, common.DockerConfigJsonKey))
242242
if err != nil {
243243
return m, err
244244
}

‎pkg/credentials/gitcreds/basic.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ import (
2323
"path/filepath"
2424
"strings"
2525

26+
"github.com/tektoncd/pipeline/pkg/credentials/common"
2627
credmatcher "github.com/tektoncd/pipeline/pkg/credentials/matcher"
27-
corev1 "k8s.io/api/core/v1"
2828
)
2929

3030
// As the flag is read, this status is populated.
@@ -123,13 +123,13 @@ func (be *basicEntry) escapedUsername() string {
123123
func newBasicEntry(u, secret string) (*basicEntry, error) {
124124
secretPath := credmatcher.VolumeName(secret)
125125

126-
ub, err := os.ReadFile(filepath.Join(secretPath, corev1.BasicAuthUsernameKey))
126+
ub, err := os.ReadFile(filepath.Join(secretPath, common.BasicAuthUsernameKey))
127127
if err != nil {
128128
return nil, err
129129
}
130130
username := string(ub)
131131

132-
pb, err := os.ReadFile(filepath.Join(secretPath, corev1.BasicAuthPasswordKey))
132+
pb, err := os.ReadFile(filepath.Join(secretPath, common.BasicAuthPasswordKey))
133133
if err != nil {
134134
return nil, err
135135
}

‎pkg/credentials/gitcreds/creds.go

+20-14
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,9 @@ import (
2020
"flag"
2121
"fmt"
2222

23+
"github.com/tektoncd/pipeline/pkg/credentials/common"
2324
credmatcher "github.com/tektoncd/pipeline/pkg/credentials/matcher"
2425
credwriter "github.com/tektoncd/pipeline/pkg/credentials/writer"
25-
corev1 "k8s.io/api/core/v1"
2626
)
2727

2828
const (
@@ -42,10 +42,15 @@ func AddFlags(flagSet *flag.FlagSet) {
4242
}
4343

4444
func flags(fs *flag.FlagSet) {
45-
basicConfig = basicGitConfig{entries: make(map[string]basicEntry)}
45+
basicConfig = basicGitConfig{
46+
entries: make(map[string]basicEntry),
47+
order: []string{},
48+
}
49+
sshConfig = sshGitConfig{
50+
entries: make(map[string][]sshEntry),
51+
order: []string{},
52+
}
4653
fs.Var(&basicConfig, basicAuthFlag, "List of secret=url pairs.")
47-
48-
sshConfig = sshGitConfig{entries: make(map[string][]sshEntry)}
4954
fs.Var(&sshConfig, sshFlag, "List of secret=url pairs.")
5055
}
5156

@@ -62,28 +67,29 @@ func NewBuilder() interface {
6267
// MatchingAnnotations extracts flags for the credential helper
6368
// from the supplied secret and returns a slice (of length 0 or
6469
// greater) of applicable domains.
65-
func (*gitBuilder) MatchingAnnotations(secret *corev1.Secret) []string {
70+
func (*gitBuilder) MatchingAnnotations(secret credmatcher.Secret) []string {
6671
var flags []string
67-
switch secret.Type {
68-
case corev1.SecretTypeBasicAuth:
69-
for _, v := range credwriter.SortAnnotations(secret.Annotations, annotationPrefix) {
70-
flags = append(flags, fmt.Sprintf("-%s=%s=%s", basicAuthFlag, secret.Name, v))
72+
switch credmatcher.GetSecretType(secret) {
73+
case common.SecretTypeBasicAuth:
74+
for _, v := range credwriter.SortAnnotations(secret.GetAnnotations(), annotationPrefix) {
75+
flags = append(flags, fmt.Sprintf("-%s=%s=%s", basicAuthFlag, secret.GetName(), v))
7176
}
7277

73-
case corev1.SecretTypeSSHAuth:
74-
for _, v := range credwriter.SortAnnotations(secret.Annotations, annotationPrefix) {
75-
flags = append(flags, fmt.Sprintf("-%s=%s=%s", sshFlag, secret.Name, v))
78+
case common.SecretTypeSSHAuth:
79+
for _, v := range credwriter.SortAnnotations(secret.GetAnnotations(), annotationPrefix) {
80+
flags = append(flags, fmt.Sprintf("-%s=%s=%s", sshFlag, secret.GetName(), v))
7681
}
7782

78-
case corev1.SecretTypeOpaque, corev1.SecretTypeServiceAccountToken, corev1.SecretTypeDockercfg, corev1.SecretTypeDockerConfigJson, corev1.SecretTypeTLS, corev1.SecretTypeBootstrapToken:
79-
return flags
83+
case common.SecretTypeOpaque, common.SecretTypeServiceAccountToken, common.SecretTypeDockercfg, common.SecretTypeDockerConfigJson, common.SecretTypeTLS, common.SecretTypeBootstrapToken:
84+
fallthrough
8085

8186
default:
8287
return flags
8388
}
8489
return flags
8590
}
8691

92+
// Write writes the credentials to the provided directory.
8793
func (*gitBuilder) Write(directory string) error {
8894
if err := basicConfig.Write(directory); err != nil {
8995
return err

‎pkg/credentials/gitcreds/ssh.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ import (
2323
"path/filepath"
2424
"strings"
2525

26+
"github.com/tektoncd/pipeline/pkg/credentials/common"
2627
credmatcher "github.com/tektoncd/pipeline/pkg/credentials/matcher"
27-
corev1 "k8s.io/api/core/v1"
2828
)
2929

3030
const sshKnownHosts = "known_hosts"
@@ -142,7 +142,7 @@ func (be *sshEntry) Write(sshDir string) error {
142142
func newSSHEntry(url, secretName string) (*sshEntry, error) {
143143
secretPath := credmatcher.VolumeName(secretName)
144144

145-
pk, err := os.ReadFile(filepath.Join(secretPath, corev1.SSHAuthPrivateKey))
145+
pk, err := os.ReadFile(filepath.Join(secretPath, common.SSHAuthPrivateKey))
146146
if err != nil {
147147
return nil, err
148148
}

‎pkg/credentials/matcher/matcher.go

+23-3
Original file line numberDiff line numberDiff line change
@@ -18,23 +18,43 @@ package matcher
1818

1919
import (
2020
"fmt"
21-
22-
corev1 "k8s.io/api/core/v1"
21+
"reflect"
2322
)
2423

2524
// VolumePath is the path where build secrets are written.
2625
// It is mutable and exported for testing.
2726
var VolumePath = "/tekton/creds-secrets"
2827

28+
// Secret is the minimal interface needed for credential matching
29+
type Secret interface {
30+
GetName() string
31+
GetAnnotations() map[string]string
32+
}
33+
2934
// Matcher is the interface for a credential initializer of any type.
3035
type Matcher interface {
3136
// MatchingAnnotations extracts flags for the credential
3237
// helper from the supplied secret and returns a slice (of
3338
// length 0 or greater) of applicable domains.
34-
MatchingAnnotations(secret *corev1.Secret) []string
39+
MatchingAnnotations(secret Secret) []string
3540
}
3641

3742
// VolumeName returns the full path to the secret, inside the VolumePath.
3843
func VolumeName(secretName string) string {
3944
return fmt.Sprintf("%s/%s", VolumePath, secretName)
4045
}
46+
47+
// GetSecretType returns secret type from secret interface using reflection
48+
func GetSecretType(secret Secret) string {
49+
v := reflect.ValueOf(secret)
50+
// If it's a pointer, unwrap it
51+
if v.Kind() == reflect.Ptr {
52+
v = v.Elem()
53+
}
54+
// Grab the field by name
55+
f := v.FieldByName("Type")
56+
if !f.IsValid() || !f.CanInterface() {
57+
return ""
58+
}
59+
return fmt.Sprintf("%v", f.Interface())
60+
}

0 commit comments

Comments
 (0)