Skip to content

Commit 85645f4

Browse files
Domas Monkus0x2b3bfa0
Domas Monkus
and
0x2b3bfa0
authored
Add structure for passing hardcoded credentials to task. (#722)
Co-authored-by: Domas Monkus <domas@iterative.ai> Co-authored-by: Helio Machado <0x2b3bfa0+git@googlemail.com>
1 parent bd37b68 commit 85645f4

File tree

6 files changed

+111
-43
lines changed

6 files changed

+111
-43
lines changed

‎task/aws/client/client.go

Lines changed: 17 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77

88
"github.com/aws/aws-sdk-go-v2/aws"
99
"github.com/aws/aws-sdk-go-v2/config"
10+
"github.com/aws/aws-sdk-go-v2/credentials"
1011
"github.com/aws/aws-sdk-go-v2/service/autoscaling"
1112
"github.com/aws/aws-sdk-go-v2/service/ec2"
1213
"github.com/aws/aws-sdk-go-v2/service/s3"
@@ -29,7 +30,22 @@ func New(ctx context.Context, cloud common.Cloud, tags map[string]string) (*Clie
2930
region = val
3031
}
3132

32-
config, err := config.LoadDefaultConfig(ctx, config.WithRegion(region))
33+
options := []func(*config.LoadOptions) error{
34+
config.WithRegion(region),
35+
}
36+
37+
if awsCredentials := cloud.Credentials.AWSCredentials; awsCredentials != nil {
38+
options = append(options, config.WithCredentialsProvider(credentials.StaticCredentialsProvider{
39+
Value: aws.Credentials{
40+
AccessKeyID: awsCredentials.AccessKeyID,
41+
SecretAccessKey: awsCredentials.SecretAccessKey,
42+
SessionToken: awsCredentials.SessionToken,
43+
Source: "user-specified credentials",
44+
},
45+
}))
46+
}
47+
48+
config, err := config.LoadDefaultConfig(ctx, options...)
3349
if err != nil {
3450
return nil, err
3551
}

‎task/az/client/client.go

Lines changed: 51 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -9,33 +9,52 @@ import (
99
"github.com/Azure/azure-sdk-for-go/services/resources/mgmt/2020-06-01/resources"
1010
"github.com/Azure/azure-sdk-for-go/services/storage/mgmt/2021-04-01/storage"
1111

12+
"github.com/Azure/go-autorest/autorest"
1213
"github.com/Azure/go-autorest/autorest/azure/auth"
1314

1415
"terraform-provider-iterative/task/common"
1516
"terraform-provider-iterative/task/common/ssh"
1617
)
1718

1819
func New(ctx context.Context, cloud common.Cloud, tags map[string]string) (*Client, error) {
19-
settings, err := auth.GetSettingsFromEnvironment()
20-
if err != nil {
21-
return nil, err
22-
}
23-
24-
subscription := settings.GetSubscriptionID()
25-
if subscription == "" {
26-
return nil, errors.New("subscription environment variable not found")
27-
}
28-
29-
authorizer, err := settings.GetAuthorizer()
30-
if err != nil {
31-
return nil, err
20+
var authorizer autorest.Authorizer
21+
22+
if azCredentials := cloud.Credentials.AZCredentials; azCredentials != nil {
23+
au, err := auth.NewClientCredentialsConfig(
24+
azCredentials.ClientID,
25+
azCredentials.ClientSecret,
26+
azCredentials.TenantID,
27+
).Authorizer()
28+
if err != nil {
29+
return nil, err
30+
}
31+
authorizer = au
32+
} else {
33+
settings, err := auth.GetSettingsFromEnvironment()
34+
if err != nil {
35+
return nil, err
36+
}
37+
credentials, err := settings.GetClientCredentials()
38+
if err != nil {
39+
return nil, err
40+
}
41+
authorizer, err = settings.GetAuthorizer()
42+
if err != nil {
43+
return nil, err
44+
}
45+
46+
cloud.Credentials.AZCredentials = &common.AZCredentials{
47+
SubscriptionID: settings.GetSubscriptionID(),
48+
ClientID: credentials.ClientID,
49+
ClientSecret: credentials.ClientSecret,
50+
TenantID: credentials.TenantID,
51+
}
3252
}
3353

3454
agent := "tpi"
3555

3656
c := &Client{
37-
Cloud: cloud,
38-
Settings: settings,
57+
Cloud: cloud,
3958
}
4059

4160
for key, value := range tags {
@@ -54,75 +73,79 @@ func New(ctx context.Context, cloud common.Cloud, tags map[string]string) (*Clie
5473
region = val
5574
}
5675

76+
if cloud.Credentials.AZCredentials.SubscriptionID == "" {
77+
return nil, errors.New("subscription environment variable not found")
78+
}
79+
5780
c.Region = region
5881

59-
c.Services.Groups = resources.NewGroupsClient(subscription)
82+
c.Services.Groups = resources.NewGroupsClient(cloud.Credentials.AZCredentials.SubscriptionID)
6083
c.Services.Groups.Authorizer = authorizer
6184
if err := c.Services.Groups.AddToUserAgent(agent); err != nil {
6285
return nil, err
6386
}
6487

65-
c.Services.SecurityGroups = network.NewSecurityGroupsClient(subscription)
88+
c.Services.SecurityGroups = network.NewSecurityGroupsClient(cloud.Credentials.AZCredentials.SubscriptionID)
6689
c.Services.SecurityGroups.Authorizer = authorizer
6790
if err := c.Services.SecurityGroups.AddToUserAgent(agent); err != nil {
6891
return nil, err
6992
}
7093

71-
c.Services.PublicIPPrefixes = network.NewPublicIPPrefixesClient(subscription)
94+
c.Services.PublicIPPrefixes = network.NewPublicIPPrefixesClient(cloud.Credentials.AZCredentials.SubscriptionID)
7295
c.Services.PublicIPPrefixes.Authorizer = authorizer
7396
if err := c.Services.PublicIPPrefixes.AddToUserAgent(agent); err != nil {
7497
return nil, err
7598
}
7699

77-
c.Services.PublicIPAddresses = network.NewPublicIPAddressesClient(subscription)
100+
c.Services.PublicIPAddresses = network.NewPublicIPAddressesClient(cloud.Credentials.AZCredentials.SubscriptionID)
78101
c.Services.PublicIPAddresses.Authorizer = authorizer
79102
if err := c.Services.PublicIPAddresses.AddToUserAgent(agent); err != nil {
80103
return nil, err
81104
}
82105

83-
c.Services.VirtualNetworks = network.NewVirtualNetworksClient(subscription)
106+
c.Services.VirtualNetworks = network.NewVirtualNetworksClient(cloud.Credentials.AZCredentials.SubscriptionID)
84107
c.Services.VirtualNetworks.Authorizer = authorizer
85108
if err := c.Services.VirtualNetworks.AddToUserAgent(agent); err != nil {
86109
return nil, err
87110
}
88111

89-
c.Services.Subnets = network.NewSubnetsClient(subscription)
112+
c.Services.Subnets = network.NewSubnetsClient(cloud.Credentials.AZCredentials.SubscriptionID)
90113
c.Services.Subnets.Authorizer = authorizer
91114
if err := c.Services.Subnets.AddToUserAgent(agent); err != nil {
92115
return nil, err
93116
}
94117

95-
c.Services.Interfaces = network.NewInterfacesClient(subscription)
118+
c.Services.Interfaces = network.NewInterfacesClient(cloud.Credentials.AZCredentials.SubscriptionID)
96119
c.Services.Interfaces.Authorizer = authorizer
97120
if err := c.Services.Interfaces.AddToUserAgent(agent); err != nil {
98121
return nil, err
99122
}
100123

101-
c.Services.VirtualMachines = compute.NewVirtualMachinesClient(subscription)
124+
c.Services.VirtualMachines = compute.NewVirtualMachinesClient(cloud.Credentials.AZCredentials.SubscriptionID)
102125
c.Services.VirtualMachines.Authorizer = authorizer
103126
if err := c.Services.VirtualMachines.AddToUserAgent(agent); err != nil {
104127
return nil, err
105128
}
106129

107-
c.Services.VirtualMachineScaleSets = compute.NewVirtualMachineScaleSetsClient(subscription)
130+
c.Services.VirtualMachineScaleSets = compute.NewVirtualMachineScaleSetsClient(cloud.Credentials.AZCredentials.SubscriptionID)
108131
c.Services.VirtualMachineScaleSets.Authorizer = authorizer
109132
if err := c.Services.VirtualMachineScaleSets.AddToUserAgent(agent); err != nil {
110133
return nil, err
111134
}
112135

113-
c.Services.VirtualMachineScaleSetVMs = compute.NewVirtualMachineScaleSetVMsClient(subscription)
136+
c.Services.VirtualMachineScaleSetVMs = compute.NewVirtualMachineScaleSetVMsClient(cloud.Credentials.AZCredentials.SubscriptionID)
114137
c.Services.VirtualMachineScaleSetVMs.Authorizer = authorizer
115138
if err := c.Services.VirtualMachineScaleSetVMs.AddToUserAgent(agent); err != nil {
116139
return nil, err
117140
}
118141

119-
c.Services.StorageAccounts = storage.NewAccountsClient(subscription)
142+
c.Services.StorageAccounts = storage.NewAccountsClient(cloud.Credentials.AZCredentials.SubscriptionID)
120143
c.Services.StorageAccounts.Authorizer = authorizer
121144
if err := c.Services.StorageAccounts.AddToUserAgent(agent); err != nil {
122145
return nil, err
123146
}
124147

125-
c.Services.BlobContainers = storage.NewBlobContainersClient(subscription)
148+
c.Services.BlobContainers = storage.NewBlobContainersClient(cloud.Credentials.AZCredentials.SubscriptionID)
126149
c.Services.BlobContainers.Authorizer = authorizer
127150
if err := c.Services.BlobContainers.AddToUserAgent(agent); err != nil {
128151
return nil, err
@@ -153,10 +176,7 @@ type Client struct {
153176
}
154177

155178
func (c *Client) GetKeyPair(ctx context.Context) (*ssh.DeterministicSSHKeyPair, error) {
156-
credentials, err := c.Settings.GetClientCredentials()
157-
if err != nil {
158-
return nil, err
159-
}
179+
credentials := c.Cloud.Credentials.AZCredentials
160180

161181
if len(credentials.ClientSecret) == 0 {
162182
return nil, errors.New("unable to find client secret")

‎task/az/resources/data_source_credentials.go

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,10 +30,7 @@ type Credentials struct {
3030
}
3131

3232
func (c *Credentials) Read(ctx context.Context) error {
33-
credentials, err := c.client.Settings.GetClientCredentials()
34-
if err != nil {
35-
return err
36-
}
33+
credentials := c.client.Cloud.Credentials.AZCredentials
3734

3835
if len(credentials.ClientSecret) == 0 {
3936
return errors.New("unable to find client secret")
@@ -44,12 +41,10 @@ func (c *Credentials) Read(ctx context.Context) error {
4441
return err
4542
}
4643

47-
subscriptionID := c.client.Settings.GetSubscriptionID()
48-
4944
c.Resource = map[string]string{
5045
"AZURE_CLIENT_ID": credentials.ClientID,
5146
"AZURE_CLIENT_SECRET": credentials.ClientSecret,
52-
"AZURE_SUBSCRIPTION_ID": subscriptionID,
47+
"AZURE_SUBSCRIPTION_ID": credentials.SubscriptionID,
5348
"AZURE_TENANT_ID": credentials.TenantID,
5449
"RCLONE_REMOTE": connectionString,
5550
"TPI_TASK_CLOUD_PROVIDER": string(c.client.Cloud.Provider),

‎task/common/cloud.go

Lines changed: 33 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,11 @@ import (
66
)
77

88
type Cloud struct {
9-
Timeouts Timeouts
10-
Provider Provider
11-
Region Region
12-
Tags map[string]string
9+
Timeouts Timeouts
10+
Provider Provider
11+
Credentials Credentials
12+
Region Region
13+
Tags map[string]string
1314
}
1415

1516
type Timeouts struct {
@@ -29,6 +30,34 @@ const (
2930
ProviderK8S Provider = "k8s"
3031
)
3132

33+
type Credentials struct {
34+
AWSCredentials *AWSCredentials
35+
GCPCredentials *GCPCredentials
36+
AZCredentials *AZCredentials
37+
K8SCredentials *K8SCredentials
38+
}
39+
40+
type AWSCredentials struct {
41+
AccessKeyID string // AWS_ACCESS_KEY_ID
42+
SecretAccessKey string // AWS_SECRET_ACCESS_KEY
43+
SessionToken string // AWS_SESSION_TOKEN
44+
}
45+
46+
type GCPCredentials struct {
47+
ApplicationCredentials string // GOOGLE_APPLICATION_CREDENTIALS (contents of file)
48+
}
49+
50+
type AZCredentials struct {
51+
ClientID string // AZURE_CLIENT_ID
52+
ClientSecret string // AZURE_CLIENT_SECRET
53+
SubscriptionID string // AZURE_SUBSCRIPTION_ID
54+
TenantID string // AZURE_TENANT_ID
55+
}
56+
57+
type K8SCredentials struct {
58+
Config string // KUBECONFIG (contents of file)
59+
}
60+
3261
func (c *Cloud) GetClosestRegion(regions map[string]Region) (string, error) {
3362
for key, value := range regions {
3463
if value == c.Region {

‎task/gcp/client/client.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,10 @@ func New(ctx context.Context, cloud common.Cloud, tags map[string]string) (*Clie
2323

2424
credentialsData := []byte(os.Getenv("GOOGLE_APPLICATION_CREDENTIALS_DATA"))
2525

26+
if gcpCredentials := cloud.Credentials.GCPCredentials; gcpCredentials != nil {
27+
credentialsData = []byte(gcpCredentials.ApplicationCredentials)
28+
}
29+
2630
var err error
2731
var credentials *google.Credentials
2832
if len(credentialsData) > 0 {

‎task/k8s/client/client.go

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,10 @@ func New(ctx context.Context, cloud common.Cloud, tags map[string]string) (*Clie
2222
kubeconfig = os.Getenv("KUBECONFIG_DATA")
2323
}
2424

25+
if k8sCredentials := cloud.Credentials.K8SCredentials; k8sCredentials != nil {
26+
kubeconfig = k8sCredentials.Config
27+
}
28+
2529
config, err := clientcmd.NewClientConfigFromBytes([]byte(kubeconfig))
2630
if err != nil || kubeconfig == "" {
2731
config = clientcmd.NewNonInteractiveDeferredLoadingClientConfig(

0 commit comments

Comments
 (0)