138 lines
4 KiB
Go
138 lines
4 KiB
Go
package cmd
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
"strings"
|
|
|
|
"github.com/Pingu-Studio/MaidnCLI/internal/k8s"
|
|
"github.com/Pingu-Studio/MaidnCLI/internal/ui"
|
|
"github.com/Pingu-Studio/MaidnCLI/internal/utils"
|
|
"github.com/Pingu-Studio/MaidnCLI/internal/vault"
|
|
"github.com/spf13/cobra"
|
|
)
|
|
|
|
var vaultCmd = &cobra.Command{
|
|
Use: "vault",
|
|
Short: "Manage Vault secrets for CI/CD.",
|
|
}
|
|
|
|
func init() {
|
|
rootCmd.AddCommand(vaultCmd)
|
|
vaultCmd.AddCommand(createDockerSecretCmd)
|
|
vaultCmd.AddCommand(createGhcrSecretCmd)
|
|
vaultCmd.AddCommand(createGithubSecretCmd)
|
|
}
|
|
|
|
var createDockerSecretCmd = &cobra.Command{
|
|
Use: "create-docker-secret",
|
|
Short: "Creates a secret in Vault for Docker Hub and applies it to Kubernetes.",
|
|
Run: runCreateDockerSecret,
|
|
}
|
|
|
|
var createGhcrSecretCmd = &cobra.Command{
|
|
Use: "create-ghcr-secret",
|
|
Short: "Creates secrets in Vault for GHCR.",
|
|
Run: runCreateGhcrSecret,
|
|
}
|
|
|
|
var createGithubSecretCmd = &cobra.Command{
|
|
Use: "create-github-secret",
|
|
Short: "Creates a GitHub authentication secret in Vault.",
|
|
Run: runCreateGithubSecret,
|
|
}
|
|
|
|
func runCreateDockerSecret(cmd *cobra.Command, args []string) {
|
|
if err := k8s.CheckExternalSecretCRD(); err != nil {
|
|
fmt.Printf("[ERROR] Prerequisite check failed: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
vm, err := vault.NewVaultManager()
|
|
if err != nil {
|
|
fmt.Printf("[ERROR] Failed to initialize Vault manager: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
username, password, err := ui.GetUserInputForDockerHub()
|
|
if err != nil {
|
|
fmt.Printf("[ERROR] %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
dockerConfigJSON, err := vault.CreateDockerConfig(vault.DockerHubRegistry, username, password)
|
|
if err != nil {
|
|
fmt.Printf("[ERROR] Failed to create Docker config: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
secretData := map[string]string{vault.DockerConfigJSONKey: dockerConfigJSON}
|
|
if err := vm.StoreSecret(vault.DockerHubSecretPath, secretData); err != nil {
|
|
fmt.Printf("[ERROR] Failed to store Docker Hub secret in Vault: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
if err := k8s.CreateDockerHubExternalSecret(); err != nil {
|
|
// Call our new universal handler for the specific cache error.
|
|
utils.HandleKubectlCacheError(err)
|
|
|
|
// Provide a generic warning for all other potential errors.
|
|
if !strings.Contains(err.Error(), "no matches for kind") {
|
|
fmt.Printf("[WARNING] The secret was stored in Vault, but failed to create the ExternalSecret: %v\n", err)
|
|
}
|
|
os.Exit(1) // Exit after handling the error to prompt the user to re-run.
|
|
}
|
|
}
|
|
|
|
func runCreateGhcrSecret(cmd *cobra.Command, args []string) {
|
|
vm, err := vault.NewVaultManager()
|
|
if err != nil {
|
|
fmt.Printf("[ERROR] Failed to initialize Vault manager: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
username, registryToken, orgToken, err := ui.GetUserInputForGhcr()
|
|
if err != nil {
|
|
fmt.Printf("[ERROR] %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
dockerConfigJSON, err := vault.CreateDockerConfig(vault.GhcrRegistry, username, registryToken)
|
|
if err != nil {
|
|
fmt.Printf("[ERROR] Failed to create Docker config for GHCR: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
dockerSecretData := map[string]string{vault.DockerConfigJSONKey: dockerConfigJSON}
|
|
if err := vm.StoreSecret(vault.GhcrSecretPath, dockerSecretData); err != nil {
|
|
fmt.Printf("[ERROR] Failed to store GHCR secret in Vault: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
orgSecretData := map[string]string{vault.OrgManagementPATKey: orgToken}
|
|
if err := vm.StoreSecret(vault.OrgManagementSecretPath, orgSecretData); err != nil {
|
|
fmt.Printf("[ERROR] Failed to store organization management PAT in Vault: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|
|
|
|
func runCreateGithubSecret(cmd *cobra.Command, args []string) {
|
|
vm, err := vault.NewVaultManager()
|
|
if err != nil {
|
|
fmt.Printf("[ERROR] Failed to initialize Vault manager: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
username, token, err := ui.GetUserInputForGithubAuth()
|
|
if err != nil {
|
|
fmt.Printf("[ERROR] %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
|
|
secretData := map[string]string{"username": username, "password": token}
|
|
if err := vm.StoreSecret(vault.GithubAuthSecretPath, secretData); err != nil {
|
|
fmt.Printf("[ERROR] Failed to store GitHub auth secret in Vault: %v\n", err)
|
|
os.Exit(1)
|
|
}
|
|
}
|