engineering/sshpiper
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

support cross auth type mapping (#483)

Browse source 
* add testcase

* add fix

* Refactor skelpipe wrappers to separate password and private key handling
This commit is contained in:
Boshi Lian 2024-11-10 03:01:52 -08:00 • committed by GitHub
parent 503f112c5d
commit 085ba59c58
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
7 changed files with 152 additions and 57 deletions
Download patch file Download diff file Expand all files Collapse all files

36
plugin/kubernetes/skel.go
View file

@ -44,6 +44,14 @@ type skelpipeToWrapper struct {
to *piperv1beta1.ToSpec
}
type skelpipeToPasswordWrapper struct {
skelpipeToWrapper
}
type skelpipeToPrivateKeyWrapper struct {
skelpipeToWrapper
}
func (s *skelpipeWrapper) From() []libplugin.SkelPipeFrom {
var froms []libplugin.SkelPipeFrom
for _, f := range s.pipe.Spec.From {
@ -108,11 +116,25 @@ func (s *skelpipeFromWrapper) MatchConn(conn libplugin.ConnMetadata) (libplugin.
}
if matched {
return &skelpipeToWrapper{
plugin: s.plugin,
pipe: s.pipe,
username: targetuser,
to: s.to,
if s.to.PrivateKeySecret.Name != "" {
return &skelpipeToPrivateKeyWrapper{
skelpipeToWrapper: skelpipeToWrapper{
plugin: s.plugin,
pipe: s.pipe,
username: targetuser,
to: s.to,
},
}, nil
}
return &skelpipeToPasswordWrapper{
skelpipeToWrapper: skelpipeToWrapper{
plugin: s.plugin,
pipe: s.pipe,
username: targetuser,
to: s.to,
},
}, nil
}
@ -156,7 +178,7 @@ func (s *skelpipePublicKeyWrapper) TrustedUserCAKeys(conn libplugin.ConnMetadata
return nil, nil // TODO support trusted_user_ca_keys
}
func (s *skelpipeToWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
func (s *skelpipeToPrivateKeyWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []byte, error) {
log.Debugf("mapping to %v private key using secret %v", s.to.Host, s.to.PrivateKeySecret.Name)
secret, err := s.plugin.k8sclient.Secrets(s.pipe.Namespace).Get(context.Background(), s.to.PrivateKeySecret.Name, metav1.GetOptions{})
@ -189,7 +211,7 @@ func (s *skelpipeToWrapper) PrivateKey(conn libplugin.ConnMetadata) ([]byte, []b
return privateKey, publicKey, nil
}
func (s *skelpipeToWrapper) OverridePassword(conn libplugin.ConnMetadata) ([]byte, error) {
func (s *skelpipeToPasswordWrapper) OverridePassword(conn libplugin.ConnMetadata) ([]byte, error) {
if s.to.PasswordSecret.Name != "" {
log.Debugf("mapping to %v password using secret %v", s.to.Host, s.to.PasswordSecret.Name)
secret, err := s.plugin.k8sclient.Secrets(s.pipe.Namespace).Get(context.Background(), s.to.PasswordSecret.Name, metav1.GetOptions{})