-
Notifications
You must be signed in to change notification settings - Fork 6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Feature/azure cert deploy #1132
Merged
Merged
Changes from 9 commits
Commits
Show all changes
12 commits
Select commit
Hold shift + click to select a range
4e40945
Begin work on certPath support
isaac-boaz-trimble 810a9ee
Init new trccertmgmtbase
isaac-boaz-trimble db54fff
Copy from trcapimgmt
isaac-boaz-trimble 42bdb97
Add base impl to ues certmgmt, use propery cert api
isaac-boaz-trimble e0bd26b
Support cert password being stored in vault
isaac-boaz-trimble 4df9376
Fix 500 errors
isaac-boaz-trimble 36965c3
Add existence checks, reomve memory protections
isaac-boaz-trimble 2b28dfc
One-line if-return
isaac-boaz-trimble 36028b7
Fix exists parity
isaac-boaz-trimble b990c88
Convert Fatal -> Print, scrub some output
isaac-boaz-trimble 249339c
Adding APIMConfig template
KarnveerSGill 7837e81
Update failed request error logging
isaac-boaz-trimble File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
84 changes: 84 additions & 0 deletions
84
atrium/vestibulum/trcdb/trccertmgmtbase/trccertmgmtbase.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,84 @@ | ||
package trccertmgmtbase | ||
|
||
import ( | ||
"context" | ||
"encoding/base64" | ||
"errors" | ||
"fmt" | ||
"os" | ||
"strings" | ||
"time" | ||
|
||
"github.com/Azure/azure-sdk-for-go/sdk/azcore/to" | ||
"github.com/Azure/azure-sdk-for-go/sdk/azidentity" | ||
"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/apimanagement/armapimanagement/v2" | ||
eUtils "github.com/trimble-oss/tierceron/pkg/utils" | ||
"github.com/trimble-oss/tierceron/pkg/vaulthelper/kv" | ||
) | ||
|
||
func CommonMain(certPathPtr *string, driverConfig *eUtils.DriverConfig, mod *kv.Modifier) error { | ||
if len(*certPathPtr) == 0 { | ||
return errors.New("certPath flag is empty, expected path to cert") | ||
} | ||
|
||
certBytes, err := os.ReadFile(*certPathPtr) | ||
if err != nil { | ||
return err | ||
} | ||
|
||
apimConfigMap := make(map[string]string) | ||
tempMap, readErr := mod.ReadData("super-secrets/Restricted/APIMConfig/config") | ||
if readErr != nil { | ||
return readErr | ||
} else if len(tempMap) == 0 { | ||
return errors.New("Couldn't get apim configs for update.") | ||
} | ||
|
||
for key, value := range tempMap { | ||
apimConfigMap[fmt.Sprintf("%v", key)] = fmt.Sprintf("%v", value) | ||
} | ||
|
||
svc, err := azidentity.NewClientSecretCredential( | ||
apimConfigMap["azureTenantId"], | ||
apimConfigMap["azureClientId"], | ||
apimConfigMap["azureClientSecret"], | ||
nil) | ||
if err != nil { | ||
driverConfig.CoreConfig.Log.Fatalf("failed to obtain a credential: %v", err) | ||
return err | ||
} | ||
|
||
ctx, _ := context.WithCancel(context.Background()) | ||
clientFactory, err := armapimanagement.NewClientFactory(apimConfigMap["SUBSCRIPTION_ID"], svc, nil) | ||
if err != nil { | ||
driverConfig.CoreConfig.Log.Fatalf("failed to create client: %v", err) | ||
return err | ||
} | ||
|
||
if resourceGroupName, exists := apimConfigMap["RESOURCE_GROUP_NAME"]; exists { | ||
if serviceName, exists := apimConfigMap["SERVICE_NAME"]; exists { | ||
certificateId := time.Now().UTC().Format(strings.ReplaceAll(time.RFC3339, ":", "-")) | ||
|
||
etag := "*" | ||
|
||
_, err = clientFactory.NewCertificateClient().CreateOrUpdate(ctx, resourceGroupName, serviceName, certificateId, armapimanagement.CertificateCreateOrUpdateParameters{ | ||
Properties: &armapimanagement.CertificateCreateOrUpdateProperties{ | ||
Data: to.Ptr(base64.StdEncoding.EncodeToString(certBytes)), | ||
Password: to.Ptr(apimConfigMap["CERTIFICATE_PASSWORD"]), | ||
}, | ||
}, &armapimanagement.CertificateClientCreateOrUpdateOptions{IfMatch: &etag}) | ||
|
||
if err != nil { | ||
driverConfig.CoreConfig.Log.Fatalf("failed to finish the request: %v", err) | ||
return err | ||
} | ||
|
||
fmt.Printf("Certificate %v successfully deployed\n", certificateId) | ||
} else { | ||
return errors.New("SERVICE_NAME is not populated in apimConfigMap") | ||
} | ||
} else { | ||
return errors.New("RESOURCE_GROUP_NAME is not populated in apimConfigMap") | ||
} | ||
return nil | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Don't fatal here... we never "Fatal" inside trcsh.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You can just do an error log and return the error.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If you can identify what the likely cause of the failure is just print that instead... You could possibly log the error message but I'm not a huge fan of that either unless you know the output doesn't contain anything compromising.