-
Notifications
You must be signed in to change notification settings - Fork 174
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Update zarf-managed secrets in all namespaces on a reinit (#1898)
## Description This updates the secret handling logic to update image pull secrets and git pull secrets in the event of a reinit. ## Related Issue Relates to #1715 ## Type of change - [X] Bug fix (non-breaking change which fixes an issue) - [ ] New feature (non-breaking change which adds functionality) - [ ] Other (security config, docs update, etc) ## Checklist before merging - [ ] Test, docs, adr added or updated as needed - [X] [Contributor Guide Steps](https://github.com/defenseunicorns/zarf/blob/main/CONTRIBUTING.md#developer-workflow) followed --------- Co-authored-by: Case Wylie <[email protected]> Co-authored-by: razzle <[email protected]>
- Loading branch information
3 people
authored
Aug 15, 2023
1 parent
575cdef
commit b73f581
Showing
61 changed files
with
1,527 additions
and
797 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
21 changes: 19 additions & 2 deletions
21
docs/2-the-zarf-cli/100-cli-commands/zarf_tools_get-creds.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
80 changes: 80 additions & 0 deletions
80
docs/2-the-zarf-cli/100-cli-commands/zarf_tools_update-creds.md
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,80 @@ | ||
| # zarf tools update-creds | ||
| <!-- Auto-generated by hack/gen-cli-docs.sh --> | ||
|
|
||
| Updates the credentials for deployed Zarf services. Pass a service key to update credentials for a single service | ||
|
|
||
| ## Synopsis | ||
|
|
||
| Updates the credentials for deployed Zarf services. Pass a service key to update credentials for a single service. i.e. 'zarf tools update-creds registry' | ||
|
|
||
| ``` | ||
| zarf tools update-creds [flags] | ||
| ``` | ||
|
|
||
| ## Examples | ||
|
|
||
| ``` | ||
| # Autogenerate all Zarf credentials at once: | ||
| zarf tools update-creds | ||
| # Autogenerate specific Zarf service credentials: | ||
| zarf tools update-creds registry | ||
| zarf tools update-creds git | ||
| zarf tools update-creds artifact | ||
| zarf tools update-creds logging | ||
| # Update all Zarf credentials w/external services at once: | ||
| zarf tools update-creds \ | ||
| --registry-push-username={USERNAME} --registry-push-password={PASSWORD} \ | ||
| --git-push-username={USERNAME} --git-push-password={PASSWORD} \ | ||
| --artifact-push-username={USERNAME} --artifact-push-token={PASSWORD} | ||
| # NOTE: Any credentials omitted from flags without a service key specified will be autogenerated - URLs will only change if specified. | ||
| # Config options can also be set with the 'init' section of a Zarf config file. | ||
| # Update specific Zarf credentials w/external services: | ||
| zarf tools update-creds registry --registry-push-username={USERNAME} --registry-push-password={PASSWORD} | ||
| zarf tools update-creds git --git-push-username={USERNAME} --git-push-password={PASSWORD} | ||
| zarf tools update-creds artifact --artifact-push-username={USERNAME} --artifact-push-token={PASSWORD} | ||
| # NOTE: Not specifying a pull username/password will keep the previous pull username/password. | ||
| ``` | ||
|
|
||
| ## Options | ||
|
|
||
| ``` | ||
| --artifact-push-token string [alpha] API Token for the push-user to access the artifact registry | ||
| --artifact-push-username string [alpha] Username to access to the artifact registry Zarf is configured to use. User must be able to upload package artifacts. | ||
| --artifact-url string [alpha] External artifact registry url to use for this Zarf cluster | ||
| --confirm Confirm updating credentials without prompting | ||
| --git-pull-password string Password for the pull-only user to access the git server | ||
| --git-pull-username string Username for pull-only access to the git server | ||
| --git-push-password string Password for the push-user to access the git server | ||
| --git-push-username string Username to access to the git server Zarf is configured to use. User must be able to create repositories via 'git push' | ||
| --git-url string External git server url to use for this Zarf cluster | ||
| -h, --help help for update-creds | ||
| --registry-pull-password string Password for the pull-only user to access the registry | ||
| --registry-pull-username string Username for pull-only access to the registry | ||
| --registry-push-password string Password for the push-user to connect to the registry | ||
| --registry-push-username string Username to access to the registry Zarf is configured to use | ||
| --registry-url string External registry url address to use for this Zarf cluster | ||
| ``` | ||
|
|
||
| ## Options inherited from parent commands | ||
|
|
||
| ``` | ||
| -a, --architecture string Architecture for OCI images and Zarf packages | ||
| --insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture. | ||
| -l, --log-level string Log level when running Zarf. Valid options are: warn, info, debug, trace (default "info") | ||
| --no-color Disable colors in output | ||
| --no-log-file Disable log file creation | ||
| --no-progress Disable fancy UI progress bars, spinners, logos, etc | ||
| --tmpdir string Specify the temporary directory to use for intermediate files | ||
| --zarf-cache string Specify the location of the Zarf cache directory (default "~/.zarf-cache") | ||
| ``` | ||
|
|
||
| ## SEE ALSO | ||
|
|
||
| * [zarf tools](zarf_tools.md) - Collection of additional tools to make airgap easier |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -11,7 +11,7 @@ components: | |
| # The following performs a full Git Repo Mirror with `go-git` (internal to Zarf) | ||
| - https://github.com/defenseunicorns/zarf-public-test.git | ||
| # The following performs a full Git Repo Mirror forcing a fallback to host `git` | ||
| - https://racer159.visualstudio.com/zarf-public-test/_git/zarf-public-test | ||
| - https://dev.azure.com/defenseunicorns/zarf-public-test/_git/zarf-public-test | ||
|
|
||
| - name: specific-tag | ||
| required: true | ||
|
|
@@ -21,21 +21,21 @@ components: | |
| # The following performs a refspec tag Git Repo Mirror with `go-git` | ||
| - https://github.com/defenseunicorns/zarf-public-test.git@refs/tags/v0.0.1 | ||
| # The following performs a tag Git Repo Mirror forcing a fallback to host `git` | ||
| - https://racer159.visualstudio.com/zarf-public-test/_git/[email protected] | ||
| - https://dev.azure.com/defenseunicorns/zarf-public-test/_git/[email protected] | ||
|
|
||
| - name: specific-branch | ||
| required: true | ||
| repos: | ||
| # The following performs a branch Git Repo Mirror with `go-git` (internal to Zarf) | ||
| - https://github.com/defenseunicorns/zarf-public-test.git@refs/heads/dragons | ||
| # The following performs a branch Git Repo Mirror forcing a fallback to host `git` | ||
| - https://racer159.visualstudio.com/zarf-public-test/_git/zarf-public-test@refs/heads/dragons | ||
| - https://dev.azure.com/defenseunicorns/zarf-public-test/_git/zarf-public-test@refs/heads/dragons | ||
|
|
||
| - name: specific-hash | ||
| required: true | ||
| repos: | ||
| # The following performs a SHA Git Repo Mirror with `go-git` (internal to Zarf) | ||
| - https://github.com/defenseunicorns/zarf-public-test.git@01a23218923f24194133b5eb11268cf8d73ff1bb | ||
| # The following performs a SHA Git Repo Mirror forcing a fallback to host `git` | ||
| - https://racer159.visualstudio.com/zarf-public-test/_git/zarf-public-test@01a23218923f24194133b5eb11268cf8d73ff1bb | ||
| - https://dev.azure.com/defenseunicorns/zarf-public-test/_git/zarf-public-test@01a23218923f24194133b5eb11268cf8d73ff1bb | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| // SPDX-License-Identifier: Apache-2.0 | ||
| // SPDX-FileCopyrightText: 2021-Present The Zarf Authors | ||
|
|
||
| // Package common handles command configuration across all commands | ||
| package common | ||
|
|
||
| import ( | ||
| "os" | ||
|
|
||
| "github.com/defenseunicorns/zarf/src/config" | ||
| "github.com/defenseunicorns/zarf/src/config/lang" | ||
| "github.com/defenseunicorns/zarf/src/pkg/message" | ||
| "github.com/defenseunicorns/zarf/src/pkg/utils/exec" | ||
| ) | ||
|
|
||
| // LogLevelCLI holds the log level as input from a command | ||
| var LogLevelCLI string | ||
|
|
||
| // SetupCLI sets up the CLI logging, interrupt functions, and more | ||
| func SetupCLI() { | ||
| exec.ExitOnInterrupt() | ||
|
|
||
| match := map[string]message.LogLevel{ | ||
| "warn": message.WarnLevel, | ||
| "info": message.InfoLevel, | ||
| "debug": message.DebugLevel, | ||
| "trace": message.TraceLevel, | ||
| } | ||
|
|
||
| if config.NoColor { | ||
| message.DisableColor() | ||
| } | ||
|
|
||
| printViperConfigUsed() | ||
|
|
||
| // No log level set, so use the default | ||
| if LogLevelCLI != "" { | ||
| if lvl, ok := match[LogLevelCLI]; ok { | ||
| message.SetLogLevel(lvl) | ||
| message.Debug("Log level set to " + LogLevelCLI) | ||
| } else { | ||
| message.Warn(lang.RootCmdErrInvalidLogLevel) | ||
| } | ||
| } | ||
|
|
||
| // Disable progress bars for CI envs | ||
| if os.Getenv("CI") == "true" { | ||
| message.Debug("CI environment detected, disabling progress bars") | ||
| message.NoProgress = true | ||
| } | ||
|
|
||
| if !config.SkipLogFile { | ||
| message.UseLogFile() | ||
| } | ||
| } |
Oops, something went wrong.