74 lines
1.9 KiB
Go
74 lines
1.9 KiB
Go
package main
|
|
|
|
import (
|
|
"flag"
|
|
"fmt"
|
|
"os"
|
|
"strings"
|
|
|
|
platformsecrets "git.cin.su/m/Assistant/platform/secrets"
|
|
)
|
|
|
|
const (
|
|
defaultRoot = "/run/control-plane-secrets"
|
|
defaultRuntimeUID = 100
|
|
defaultRuntimeGID = 101
|
|
)
|
|
|
|
func main() {
|
|
reason := flag.String("reason", "", "rotation reason: owner-requested-rotation or exposure-detected")
|
|
credential := flag.String("credential", "control-plane", "credential purpose: control-plane or acceptance-harness")
|
|
flag.Parse()
|
|
if flag.NArg() != 1 {
|
|
fail("usage: secret-control-plane [ensure|rotate]")
|
|
}
|
|
root := os.Getenv("SECRET_CONTROL_PLANE_ROOT")
|
|
if root == "" {
|
|
root = defaultRoot
|
|
}
|
|
store, err := platformsecrets.NewLocalMachineCredentialStore(root, defaultRuntimeUID, defaultRuntimeGID, nil)
|
|
if err != nil {
|
|
fail("control-plane credential store unavailable")
|
|
}
|
|
spec := platformsecrets.ControlPlaneServiceTokenSpec()
|
|
if strings.TrimSpace(*credential) == "acceptance-harness" {
|
|
spec = platformsecrets.AcceptanceHarnessServiceTokenSpec()
|
|
}
|
|
switch strings.TrimSpace(flag.Arg(0)) {
|
|
case "ensure":
|
|
result, err := store.Ensure(spec)
|
|
if err != nil {
|
|
fail("control-plane credential provisioning failed")
|
|
}
|
|
if result.Created {
|
|
fmt.Println("control-plane credential provisioned")
|
|
return
|
|
}
|
|
fmt.Println("control-plane credential already active")
|
|
case "rotate":
|
|
if !validRotationReason(*reason) {
|
|
fail("rotation reason is invalid")
|
|
}
|
|
if _, err := store.Rotate(spec, *reason); err != nil {
|
|
fail("control-plane credential rotation failed")
|
|
}
|
|
fmt.Println("control-plane credential rotated")
|
|
default:
|
|
fail("unsupported control-plane credential operation")
|
|
}
|
|
}
|
|
|
|
func validRotationReason(reason string) bool {
|
|
switch strings.TrimSpace(reason) {
|
|
case "owner-requested-rotation", "exposure-detected":
|
|
return true
|
|
default:
|
|
return false
|
|
}
|
|
}
|
|
|
|
func fail(message string) {
|
|
fmt.Fprintln(os.Stderr, message)
|
|
os.Exit(1)
|
|
}
|