|
|
@@ -39,12 +39,12 @@ const (
|
|
|
defaultVersion = "latest"
|
|
|
|
|
|
errGCPSMStore = "received invalid GCPSM SecretStore resource"
|
|
|
- errGCPSMCredSecretName = "invalid GCPSM SecretStore resource: missing GCP Secret Access Key"
|
|
|
errClientClose = "unable to close SecretManager client: %w"
|
|
|
errInvalidClusterStoreMissingSAKNamespace = "invalid ClusterSecretStore: missing GCP SecretAccessKey Namespace"
|
|
|
errFetchSAKSecret = "could not fetch SecretAccessKey secret: %w"
|
|
|
errMissingSAK = "missing SecretAccessKey"
|
|
|
errUnableProcessJSONCredentials = "failed to process the provided JSON credentials: %w"
|
|
|
+ errUnableProcessDefaultCredentials = "failed to process the default credentials: %w"
|
|
|
errUnableCreateGCPSMClient = "failed to create GCP secretmanager client: %w"
|
|
|
errUninitalizedGCPProvider = "provider GCP is not initialized"
|
|
|
errClientGetSecretAccess = "unable to access Secret from SecretManager Client: %w"
|
|
|
@@ -73,9 +73,6 @@ type gClient struct {
|
|
|
func (c *gClient) setAuth(ctx context.Context) error {
|
|
|
credentialsSecret := &corev1.Secret{}
|
|
|
credentialsSecretName := c.store.Auth.SecretRef.SecretAccessKey.Name
|
|
|
- if credentialsSecretName == "" {
|
|
|
- return fmt.Errorf(errGCPSMCredSecretName)
|
|
|
- }
|
|
|
objectKey := types.NamespacedName{
|
|
|
Name: credentialsSecretName,
|
|
|
Namespace: c.namespace,
|
|
|
@@ -88,7 +85,10 @@ func (c *gClient) setAuth(ctx context.Context) error {
|
|
|
}
|
|
|
objectKey.Namespace = *c.store.Auth.SecretRef.SecretAccessKey.Namespace
|
|
|
}
|
|
|
-
|
|
|
+ if credentialsSecretName == "" {
|
|
|
+ c.credentials = nil
|
|
|
+ return nil
|
|
|
+ }
|
|
|
err := c.kube.Get(ctx, objectKey, credentialsSecret)
|
|
|
if err != nil {
|
|
|
return fmt.Errorf(errFetchSAKSecret, err)
|
|
|
@@ -122,12 +122,23 @@ func (sm *ProviderGCP) NewClient(ctx context.Context, store esv1alpha1.GenericSt
|
|
|
|
|
|
sm.projectID = cliStore.store.ProjectID
|
|
|
|
|
|
- config, err := google.JWTConfigFromJSON(cliStore.credentials, CloudPlatformRole)
|
|
|
+ if cliStore.credentials != nil {
|
|
|
+ config, err := google.JWTConfigFromJSON(cliStore.credentials, CloudPlatformRole)
|
|
|
+ if err != nil {
|
|
|
+ return nil, fmt.Errorf(errUnableProcessJSONCredentials, err)
|
|
|
+ }
|
|
|
+ ts := config.TokenSource(ctx)
|
|
|
+ clientGCPSM, err := secretmanager.NewClient(ctx, option.WithTokenSource(ts))
|
|
|
+ if err != nil {
|
|
|
+ return nil, fmt.Errorf(errUnableCreateGCPSMClient, err)
|
|
|
+ }
|
|
|
+ sm.SecretManagerClient = clientGCPSM
|
|
|
+ return sm, nil
|
|
|
+ }
|
|
|
+ ts, err := google.DefaultTokenSource(ctx, CloudPlatformRole)
|
|
|
if err != nil {
|
|
|
- return nil, fmt.Errorf(errUnableProcessJSONCredentials, err)
|
|
|
+ return nil, fmt.Errorf(errUnableProcessDefaultCredentials, err)
|
|
|
}
|
|
|
- ts := config.TokenSource(ctx)
|
|
|
-
|
|
|
clientGCPSM, err := secretmanager.NewClient(ctx, option.WithTokenSource(ts))
|
|
|
if err != nil {
|
|
|
return nil, fmt.Errorf(errUnableCreateGCPSMClient, err)
|
paul-the-alien[bot]