read secret from k8s
This commit is contained in:
parent
da809273e0
commit
b22355d2a5
12 changed files with 583 additions and 85 deletions
257
main.go
257
main.go
|
|
@ -1,138 +1,231 @@
|
|||
// Copyright (C) 2019 Marius Schellenberger
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io/ioutil"
|
||||
"log"
|
||||
"net"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"reflect"
|
||||
"strconv"
|
||||
"strings"
|
||||
"time"
|
||||
|
||||
//corev1 "k8s.io/api/core/v1"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/client-go/kubernetes"
|
||||
typedcorev1 "k8s.io/client-go/kubernetes/typed/core/v1"
|
||||
"k8s.io/client-go/rest"
|
||||
)
|
||||
|
||||
var version string
|
||||
var debug = false
|
||||
|
||||
type PR struct {
|
||||
Action string `json:"action"`
|
||||
const (
|
||||
prAction = "X-Interceptor-Pr-Action"
|
||||
pushAction = "X-Interceptor-Push-Action"
|
||||
commentAction = "X-Interceptor-Comment-Action"
|
||||
|
||||
contentType = "Content-Type"
|
||||
jsonType = "application/json"
|
||||
|
||||
githubEvent = "X-GitHub-Event"
|
||||
giteaEvent = "X-Gitea-Event"
|
||||
|
||||
issueHeader = "Issue"
|
||||
commitHeader = "Commit"
|
||||
|
||||
secretName = "git-auth"
|
||||
)
|
||||
|
||||
func init() {
|
||||
log.SetFlags(log.Flags() | log.Lshortfile)
|
||||
}
|
||||
|
||||
func prHandler(w http.ResponseWriter, r *http.Request) {
|
||||
var pr PR
|
||||
defer r.Body.Close()
|
||||
body, err := ioutil.ReadAll(r.Body)
|
||||
func (h *Handler) getSecret(host string) (username, password string, err error) {
|
||||
sec, err := h.sec.Get(secretName, metav1.GetOptions{})
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
log.Printf("debug headers: %#v", r.Header)
|
||||
log.Printf("debug body: %s", string(body))
|
||||
err = json.Unmarshal(body, &pr)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
s, ok := sec.Data[host]
|
||||
if !ok {
|
||||
err = fmt.Errorf("no key found for host %s in secret %s/%s", host, sec.Namespace, sec.Name)
|
||||
return
|
||||
}
|
||||
switch pr.Action {
|
||||
case "opened", "reopened", "synchronize", // GitHub
|
||||
"synchronized": // Gitea
|
||||
if r.Header.Get("X-Interceptor-Action") == "create" {
|
||||
w.Write(body)
|
||||
return
|
||||
}
|
||||
case "closed":
|
||||
if r.Header.Get("X-Interceptor-Action") == "delete" {
|
||||
w.Write(body)
|
||||
return
|
||||
}
|
||||
a := strings.SplitN(string(s), ":", 2)
|
||||
if len(a) < 2 {
|
||||
err = fmt.Errorf("missing credentials for host %s in secret %s/%s", host, sec.Namespace, sec.Name)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
username = a[0]
|
||||
password = a[1]
|
||||
return
|
||||
}
|
||||
|
||||
type Push struct {
|
||||
Ref string `json:"ref"`
|
||||
func (h *Handler) getPullRequest(repo Repository, api, id string) (*PullRequest, error) {
|
||||
u, err := url.Parse(repo.CloneURL)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
u.Path = strings.Join([]string{api, "repos",
|
||||
repo.Owner.Login, repo.Name,
|
||||
"pulls", id}, "/")
|
||||
req, err := http.NewRequest("GET", u.String(), nil)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
req.Header.Set(contentType, jsonType)
|
||||
|
||||
user, pass, err := h.getSecret(u.Host)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
req.SetBasicAuth(user, pass)
|
||||
|
||||
resp, err := h.cl.Do(req)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
defer resp.Body.Close()
|
||||
pr := new(PullRequest)
|
||||
err = json.NewDecoder(resp.Body).Decode(pr)
|
||||
if err != nil {
|
||||
return nil, err
|
||||
}
|
||||
return pr, nil
|
||||
}
|
||||
|
||||
func pushHandler(w http.ResponseWriter, r *http.Request) {
|
||||
var p Push
|
||||
defer r.Body.Close()
|
||||
body, err := ioutil.ReadAll(r.Body)
|
||||
type Handler struct {
|
||||
sec typedcorev1.SecretInterface
|
||||
cl *http.Client
|
||||
}
|
||||
|
||||
func (h *Handler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
|
||||
event := r.Header.Get(githubEvent)
|
||||
switch event {
|
||||
case "pull_request":
|
||||
h.prHandler(w, r)
|
||||
case "push":
|
||||
h.pushHandler(w, r)
|
||||
case "issue_comment":
|
||||
h.commentHandler(w, r)
|
||||
default:
|
||||
h.dumpHandler(w, r)
|
||||
}
|
||||
status := int(reflect.Indirect(reflect.ValueOf(w)).FieldByName("status").Int())
|
||||
log.Printf("%s %s %s event:%s status:%d", r.RemoteAddr, r.Method, r.URL, event, status)
|
||||
}
|
||||
|
||||
func (h *Handler) prHandler(w http.ResponseWriter, r *http.Request) {
|
||||
var prb PullRequestBody
|
||||
body, err := readBody(r, &prb)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
logError(w, err.Error())
|
||||
return
|
||||
}
|
||||
log.Printf("debug headers: %#v", r.Header)
|
||||
log.Printf("debug: %s", string(body))
|
||||
err = json.Unmarshal(body, &p)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if r.Header.Get("X-Interceptor-Ref") == p.Ref {
|
||||
if contains(r.Header[prAction], prb.Action) {
|
||||
h := w.Header()
|
||||
h.Set(issueHeader, strconv.FormatInt(prb.Number, 10))
|
||||
h.Set(commitHeader, prb.PullRequest.Head.SHA)
|
||||
w.Write(body)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
}
|
||||
|
||||
type CommentBody struct {
|
||||
Comment Comment `json:"comment"`
|
||||
}
|
||||
|
||||
type Comment struct {
|
||||
Body string `json:"body"`
|
||||
}
|
||||
|
||||
func commentHandler(w http.ResponseWriter, r *http.Request) {
|
||||
var c CommentBody
|
||||
defer r.Body.Close()
|
||||
body, err := ioutil.ReadAll(r.Body)
|
||||
func (h *Handler) pushHandler(w http.ResponseWriter, r *http.Request) {
|
||||
var pb PushBody
|
||||
body, err := readBody(r, &pb)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
logError(w, err.Error())
|
||||
return
|
||||
}
|
||||
log.Printf("debug headers: %#v", r.Header)
|
||||
log.Printf("debug: %s", string(body))
|
||||
err = json.Unmarshal(body, &c)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
if r.Header.Get("X-Interceptor-Comment") == c.Comment.Body {
|
||||
if contains(r.Header[pushAction], pb.Ref) {
|
||||
h := w.Header()
|
||||
h.Set(commitHeader, pb.After)
|
||||
w.Write(body)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
}
|
||||
|
||||
func dumpHandler(w http.ResponseWriter, r *http.Request) {
|
||||
defer r.Body.Close()
|
||||
body, err := ioutil.ReadAll(r.Body)
|
||||
func (h *Handler) commentHandler(w http.ResponseWriter, r *http.Request) {
|
||||
var cb CommentBody
|
||||
body, err := readBody(r, &cb)
|
||||
if err != nil {
|
||||
http.Error(w, err.Error(), http.StatusInternalServerError)
|
||||
logError(w, err.Error())
|
||||
return
|
||||
}
|
||||
log.Printf("debug headers: %#v", r.Header)
|
||||
log.Printf("debug: %s", string(body))
|
||||
//if label := r.Header.Get(labelHeader); label != "" {
|
||||
//}
|
||||
if contains(r.Header[commentAction], cb.Comment.Body) {
|
||||
issue := strconv.FormatInt(cb.Issue.Number, 10)
|
||||
api := detectAPI(r)
|
||||
if api == "" {
|
||||
logError(w, "unable to detect git provider API")
|
||||
return
|
||||
}
|
||||
pr, err := h.getPullRequest(cb.Repository, api, issue)
|
||||
if err != nil {
|
||||
logError(w, err.Error())
|
||||
return
|
||||
}
|
||||
|
||||
h := w.Header()
|
||||
h.Set(issueHeader, issue)
|
||||
h.Set(commitHeader, pr.Head.SHA)
|
||||
w.Write(body)
|
||||
return
|
||||
}
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
}
|
||||
|
||||
func (h *Handler) dumpHandler(w http.ResponseWriter, r *http.Request) {
|
||||
defer r.Body.Close()
|
||||
if debug {
|
||||
body, err := ioutil.ReadAll(r.Body)
|
||||
if err != nil {
|
||||
logError(w, err.Error())
|
||||
return
|
||||
}
|
||||
log.Printf("debug headers: %#v", r.Header)
|
||||
log.Printf("debug: %s", string(body))
|
||||
}
|
||||
w.WriteHeader(http.StatusBadRequest)
|
||||
}
|
||||
|
||||
func main() {
|
||||
http.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
|
||||
event := r.Header.Get("X-GitHub-Event")
|
||||
log.Printf("%s %s %s: %s", r.RemoteAddr, r.Method, r.URL, event)
|
||||
switch event {
|
||||
case "pull_request":
|
||||
prHandler(w, r)
|
||||
case "push":
|
||||
pushHandler(w, r)
|
||||
//case "issue_comment":
|
||||
// commentHandler(w, r)
|
||||
default:
|
||||
dumpHandler(w, r)
|
||||
}
|
||||
})
|
||||
cfg, err := rest.InClusterConfig()
|
||||
if err != nil {
|
||||
log.Fatalf("error configuring kube client: %s\n", err)
|
||||
}
|
||||
cl, err := kubernetes.NewForConfig(cfg)
|
||||
if err != nil {
|
||||
log.Fatalf("error creating new kube client: %s\n", err)
|
||||
}
|
||||
ns, err := getNS()
|
||||
if err != nil {
|
||||
log.Fatalf("error getting current namespace %s\n", err)
|
||||
}
|
||||
h := &Handler{
|
||||
sec: cl.CoreV1().Secrets(ns),
|
||||
cl: &http.Client{Transport: &http.Transport{
|
||||
DialContext: (&net.Dialer{
|
||||
Timeout: 30 * time.Second,
|
||||
}).DialContext,
|
||||
}},
|
||||
}
|
||||
|
||||
http.Handle("/", h)
|
||||
s := &http.Server{
|
||||
ReadTimeout: 5 * time.Second,
|
||||
WriteTimeout: 10 * time.Second,
|
||||
IdleTimeout: 120 * time.Second,
|
||||
Addr: ":8080",
|
||||
}
|
||||
log.Println("started webhook listener")
|
||||
log.Fatal(s.ListenAndServe())
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue