Skip to content

Commit a4a5e46

Browse files
NautiluXNautiluX
authored
fix(bootstrap-gcp): Generate correct git provider config (#192)
* fix bootstrap provider config * fix DNS01 configuration --------- Signed-off-by: NautiluX <2600004+NautiluX@users.noreply.github.com> Co-authored-by: NautiluX <2600004+NautiluX@users.noreply.github.com>
1 parent 087c025 commit a4a5e46

File tree

9 files changed

+223
-318
lines changed

9 files changed

+223
-318
lines changed

‎NOTICE‎

Lines changed: 28 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ This project includes code licensed under the following terms:
55

66
----------
77
Module: cloud.google.com/go/artifactregistry
8-
Version: v1.19.0
8+
Version: v1.20.0
99
License: Apache-2.0
10-
License URL: https://github.com/googleapis/google-cloud-go/blob/artifactregistry/v1.19.0/artifactregistry/LICENSE
10+
License URL: https://github.com/googleapis/google-cloud-go/blob/artifactregistry/v1.20.0/artifactregistry/LICENSE
1111

1212
----------
1313
Module: cloud.google.com/go/auth
@@ -95,9 +95,9 @@ License URL: https://github.com/clipperhouse/uax29/blob/v2.4.0/LICENSE
9595

9696
----------
9797
Module: github.com/codesphere-cloud/cs-go
98-
Version: v0.16.4
98+
Version: v0.17.0
9999
License: Apache-2.0
100-
License URL: https://github.com/codesphere-cloud/cs-go/blob/v0.16.4/LICENSE
100+
License URL: https://github.com/codesphere-cloud/cs-go/blob/v0.17.0/LICENSE
101101

102102
----------
103103
Module: github.com/codesphere-cloud/oms/internal/tmpl
@@ -179,9 +179,9 @@ License URL: https://github.com/googleapis/enterprise-certificate-proxy/blob/v0.
179179

180180
----------
181181
Module: github.com/googleapis/gax-go/v2
182-
Version: v2.16.0
182+
Version: v2.17.0
183183
License: BSD-3-Clause
184-
License URL: https://github.com/googleapis/gax-go/blob/v2.16.0/v2/LICENSE
184+
License URL: https://github.com/googleapis/gax-go/blob/v2.17.0/v2/LICENSE
185185

186186
----------
187187
Module: github.com/hashicorp/go-cleanhttp
@@ -353,21 +353,21 @@ License URL: https://github.com/yaml/go-yaml/blob/v3.0.4/LICENSE
353353

354354
----------
355355
Module: golang.org/x/crypto
356-
Version: v0.47.0
356+
Version: v0.48.0
357357
License: BSD-3-Clause
358-
License URL: https://cs.opensource.google/go/x/crypto/+/v0.47.0:LICENSE
358+
License URL: https://cs.opensource.google/go/x/crypto/+/v0.48.0:LICENSE
359359

360360
----------
361361
Module: golang.org/x/net
362-
Version: v0.49.0
362+
Version: v0.50.0
363363
License: BSD-3-Clause
364-
License URL: https://cs.opensource.google/go/x/net/+/v0.49.0:LICENSE
364+
License URL: https://cs.opensource.google/go/x/net/+/v0.50.0:LICENSE
365365

366366
----------
367367
Module: golang.org/x/oauth2
368-
Version: v0.34.0
368+
Version: v0.35.0
369369
License: BSD-3-Clause
370-
License URL: https://cs.opensource.google/go/x/oauth2/+/v0.34.0:LICENSE
370+
License URL: https://cs.opensource.google/go/x/oauth2/+/v0.35.0:LICENSE
371371

372372
----------
373373
Module: golang.org/x/sync/semaphore
@@ -377,21 +377,21 @@ License URL: https://cs.opensource.google/go/x/sync/+/v0.19.0:LICENSE
377377

378378
----------
379379
Module: golang.org/x/sys
380-
Version: v0.40.0
380+
Version: v0.41.0
381381
License: BSD-3-Clause
382-
License URL: https://cs.opensource.google/go/x/sys/+/v0.40.0:LICENSE
382+
License URL: https://cs.opensource.google/go/x/sys/+/v0.41.0:LICENSE
383383

384384
----------
385385
Module: golang.org/x/term
386-
Version: v0.39.0
386+
Version: v0.40.0
387387
License: BSD-3-Clause
388-
License URL: https://cs.opensource.google/go/x/term/+/v0.39.0:LICENSE
388+
License URL: https://cs.opensource.google/go/x/term/+/v0.40.0:LICENSE
389389

390390
----------
391391
Module: golang.org/x/text
392-
Version: v0.33.0
392+
Version: v0.34.0
393393
License: BSD-3-Clause
394-
License URL: https://cs.opensource.google/go/x/text/+/v0.33.0:LICENSE
394+
License URL: https://cs.opensource.google/go/x/text/+/v0.34.0:LICENSE
395395

396396
----------
397397
Module: golang.org/x/time/rate
@@ -401,15 +401,15 @@ License URL: https://cs.opensource.google/go/x/time/+/v0.14.0:LICENSE
401401

402402
----------
403403
Module: google.golang.org/api
404-
Version: v0.264.0
404+
Version: v0.266.0
405405
License: BSD-3-Clause
406-
License URL: https://github.com/googleapis/google-api-go-client/blob/v0.264.0/LICENSE
406+
License URL: https://github.com/googleapis/google-api-go-client/blob/v0.266.0/LICENSE
407407

408408
----------
409409
Module: google.golang.org/api/internal/third_party/uritemplates
410-
Version: v0.264.0
410+
Version: v0.266.0
411411
License: BSD-3-Clause
412-
License URL: https://github.com/googleapis/google-api-go-client/blob/v0.264.0/internal/third_party/uritemplates/LICENSE
412+
License URL: https://github.com/googleapis/google-api-go-client/blob/v0.266.0/internal/third_party/uritemplates/LICENSE
413413

414414
----------
415415
Module: google.golang.org/genproto/googleapis
@@ -419,21 +419,21 @@ License URL: https://github.com/googleapis/go-genproto/blob/8636f8732409/LICENSE
419419

420420
----------
421421
Module: google.golang.org/genproto/googleapis/api
422-
Version: v0.0.0-20260128011058-8636f8732409
422+
Version: v0.0.0-20260203192932-546029d2fa20
423423
License: Apache-2.0
424-
License URL: https://github.com/googleapis/go-genproto/blob/8636f8732409/googleapis/api/LICENSE
424+
License URL: https://github.com/googleapis/go-genproto/blob/546029d2fa20/googleapis/api/LICENSE
425425

426426
----------
427427
Module: google.golang.org/genproto/googleapis/rpc
428-
Version: v0.0.0-20260128011058-8636f8732409
428+
Version: v0.0.0-20260203192932-546029d2fa20
429429
License: Apache-2.0
430-
License URL: https://github.com/googleapis/go-genproto/blob/8636f8732409/googleapis/rpc/LICENSE
430+
License URL: https://github.com/googleapis/go-genproto/blob/546029d2fa20/googleapis/rpc/LICENSE
431431

432432
----------
433433
Module: google.golang.org/grpc
434-
Version: v1.78.0
434+
Version: v1.79.1
435435
License: Apache-2.0
436-
License URL: https://github.com/grpc/grpc-go/blob/v1.78.0/LICENSE
436+
License URL: https://github.com/grpc/grpc-go/blob/v1.79.1/LICENSE
437437

438438
----------
439439
Module: google.golang.org/protobuf

‎cli/cmd/bootstrap_gcp.go‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -62,6 +62,8 @@ func AddBootstrapGcpCmd(parent *cobra.Command, opts *GlobalOptions) {
6262
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.BaseDomain, "base-domain", "", "Base domain for Codesphere (required)")
6363
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.GithubAppClientID, "github-app-client-id", "", "Github App Client ID (required)")
6464
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.GithubAppClientSecret, "github-app-client-secret", "", "Github App Client Secret (required)")
65+
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.GitHubPAT, "github-pat", "", "GitHub Personal Access Token to use for direct image access. Scope required: package read (optional)")
66+
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.GitHubAppName, "github-app-name", "", "Github App Name (optional)")
6567
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.SecretsDir, "secrets-dir", "/etc/codesphere/secrets", "Directory for secrets (default: /etc/codesphere/secrets)")
6668
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.FolderID, "folder-id", "", "GCP Folder ID (optional)")
6769
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.SSHPublicKeyPath, "ssh-public-key-path", "~/.ssh/id_rsa.pub", "SSH Public Key Path (default: ~/.ssh/id_rsa.pub)")
@@ -74,16 +76,13 @@ func AddBootstrapGcpCmd(parent *cobra.Command, opts *GlobalOptions) {
7476
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.Region, "region", "europe-west4", "GCP Region (default: europe-west4)")
7577
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.Zone, "zone", "europe-west4-a", "GCP Zone (default: europe-west4-a)")
7678
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.DNSProjectID, "dns-project-id", "", "GCP Project ID for Cloud DNS (optional)")
77-
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.DNSProjectServiceAccount, "dns-project-sa", "", "GCP Project Service Account for Cloud DNS (optional)")
7879
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.DNSZoneName, "dns-zone-name", "oms-testing", "Cloud DNS Zone Name (optional)")
7980
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.InstallVersion, "install-version", "", "Codesphere version to install (default: none)")
8081
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.InstallHash, "install-hash", "", "Codesphere package hash to install (default: none)")
8182
flags.StringArrayVarP(&bootstrapGcpCmd.CodesphereEnv.InstallSkipSteps, "install-skip-steps", "s", []string{}, "Installation steps to skip during Codesphere installation (optional)")
82-
8383
flags.StringVar(&bootstrapGcpCmd.InputRegistryType, "registry-type", "local-container", "Container registry type to use (options: local-container, artifact-registry) (default: artifact-registry)")
8484
flags.BoolVar(&bootstrapGcpCmd.CodesphereEnv.WriteConfig, "write-config", true, "Write generated install config to file (default: true)")
8585
flags.BoolVar(&bootstrapGcpCmd.SSHQuiet, "ssh-quiet", true, "Suppress SSH command output (default: true)")
86-
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.GitHubPAT, "github-pat", "", "GitHub Personal Access Token to use for direct image access. Scope required: package read (optional)")
8786
flags.StringVar(&bootstrapGcpCmd.CodesphereEnv.RegistryUser, "registry-user", "", "Custom Registry username (only for GitHub registry type) (optional)")
8887
flags.StringArrayVar(&bootstrapGcpCmd.CodesphereEnv.Experiments, "experiments", gcp.DefaultExperiments, "Experiments to enable in Codesphere installation (optional)")
8988
flags.StringArrayVar(&bootstrapGcpCmd.CodesphereEnv.FeatureFlags, "feature-flags", []string{}, "Feature flags to enable in Codesphere installation (optional)")

‎docs/oms-cli_beta_bootstrap-gcp.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,13 +22,13 @@ oms-cli beta bootstrap-gcp [flags]
2222
--custom-pg-ip string Custom PostgreSQL IP (optional)
2323
--datacenter-id int Datacenter ID (default: 1) (default 1)
2424
--dns-project-id string GCP Project ID for Cloud DNS (optional)
25-
--dns-project-sa string GCP Project Service Account for Cloud DNS (optional)
2625
--dns-zone-name string Cloud DNS Zone Name (optional) (default "oms-testing")
2726
--experiments stringArray Experiments to enable in Codesphere installation (optional) (default [managed-services,vcluster,custom-service-image,ms-in-ls,secret-management,sub-path-mount])
2827
--feature-flags stringArray Feature flags to enable in Codesphere installation (optional)
2928
--folder-id string GCP Folder ID (optional)
3029
--github-app-client-id string Github App Client ID (required)
3130
--github-app-client-secret string Github App Client Secret (required)
31+
--github-app-name string Github App Name (optional)
3232
--github-pat string GitHub Personal Access Token to use for direct image access. Scope required: package read (optional)
3333
-h, --help help for bootstrap-gcp
3434
--install-config string Path to install config file (optional) (default "config.yaml")

‎internal/bootstrap/gcp/gcp.go‎

Lines changed: 47 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ import (
77
"context"
88
"errors"
99
"fmt"
10+
"slices"
1011
"sort"
1112
"strings"
1213
"sync"
@@ -78,28 +79,28 @@ type GCPBootstrapper struct {
7879
}
7980

8081
type CodesphereEnvironment struct {
81-
ProjectID string `json:"project_id"`
82-
ProjectName string `json:"project_name"`
83-
DNSProjectID string `json:"dns_project_id"`
84-
DNSProjectServiceAccount string `json:"dns_project_service_account"`
85-
Jumpbox *node.Node `json:"jumpbox"`
86-
PostgreSQLNode *node.Node `json:"postgres_node"`
87-
ControlPlaneNodes []*node.Node `json:"control_plane_nodes"`
88-
CephNodes []*node.Node `json:"ceph_nodes"`
89-
ContainerRegistryURL string `json:"-"`
90-
ExistingConfigUsed bool `json:"-"`
91-
InstallVersion string `json:"install_version"`
92-
InstallHash string `json:"install_hash"`
93-
InstallSkipSteps []string `json:"install_skip_steps"`
94-
Preemptible bool `json:"preemptible"`
95-
WriteConfig bool `json:"-"`
96-
GatewayIP string `json:"gateway_ip"`
97-
PublicGatewayIP string `json:"public_gateway_ip"`
98-
RegistryType RegistryType `json:"registry_type"`
99-
GitHubPAT string `json:"-"`
100-
RegistryUser string `json:"-"`
101-
Experiments []string `json:"experiments"`
102-
FeatureFlags []string `json:"feature_flags"`
82+
ProjectID string `json:"project_id"`
83+
ProjectName string `json:"project_name"`
84+
DNSProjectID string `json:"dns_project_id"`
85+
Jumpbox *node.Node `json:"jumpbox"`
86+
PostgreSQLNode *node.Node `json:"postgres_node"`
87+
ControlPlaneNodes []*node.Node `json:"control_plane_nodes"`
88+
CephNodes []*node.Node `json:"ceph_nodes"`
89+
ContainerRegistryURL string `json:"-"`
90+
ExistingConfigUsed bool `json:"-"`
91+
InstallVersion string `json:"install_version"`
92+
InstallHash string `json:"install_hash"`
93+
InstallSkipSteps []string `json:"install_skip_steps"`
94+
Preemptible bool `json:"preemptible"`
95+
WriteConfig bool `json:"-"`
96+
GatewayIP string `json:"gateway_ip"`
97+
PublicGatewayIP string `json:"public_gateway_ip"`
98+
RegistryType RegistryType `json:"registry_type"`
99+
GitHubPAT string `json:"-"`
100+
GitHubAppName string `json:"-"`
101+
RegistryUser string `json:"-"`
102+
Experiments []string `json:"experiments"`
103+
FeatureFlags []string `json:"feature_flags"`
103104

104105
// Config
105106
InstallConfigPath string `json:"-"`
@@ -154,9 +155,9 @@ func GetInfraFilePath() string {
154155

155156
func (b *GCPBootstrapper) Bootstrap() error {
156157
if b.Env.InstallVersion != "" {
157-
err := b.stlog.Step("Validate package to install", b.ValidatePackageName)
158+
err := b.stlog.Step("Validate input", b.ValidateInput)
158159
if err != nil {
159-
return fmt.Errorf("invalid package name: %w", err)
160+
return fmt.Errorf("invalid input: %w", err)
160161
}
161162

162163
}
@@ -293,7 +294,7 @@ func (b *GCPBootstrapper) Bootstrap() error {
293294
return nil
294295
}
295296

296-
func (b *GCPBootstrapper) ValidatePackageName() error {
297+
func (b *GCPBootstrapper) ValidateInput() error {
297298
build, err := b.PortalClient.GetBuild(portal.CodesphereProduct, b.Env.InstallVersion, b.Env.InstallHash)
298299
if err != nil {
299300
return fmt.Errorf("failed to get codesphere package: %w", err)
@@ -312,6 +313,11 @@ func (b *GCPBootstrapper) ValidatePackageName() error {
312313
}
313314
}
314315

316+
ghParams := []string{b.Env.GitHubAppName, b.Env.GithubAppClientID, b.Env.GithubAppClientSecret}
317+
if slices.Contains(ghParams, "") && strings.Join(ghParams, "") != "" {
318+
return fmt.Errorf("GitHub app credentials are not fully specified (all or none of GitHubAppName, GithubAppClientID, GithubAppClientSecret must be set)")
319+
}
320+
315321
return fmt.Errorf("specified package does not contain required installer artifact %s. Existing artifacts: %s", requiredFilename, strings.Join(filenames, ", "))
316322
}
317323

@@ -467,7 +473,7 @@ func (b *GCPBootstrapper) EnsureServiceAccounts() error {
467473
}
468474

469475
func (b *GCPBootstrapper) EnsureIAMRoles() error {
470-
err := b.ensureIAMRoleWithRetry("cloud-controller", []string{"roles/compute.admin"})
476+
err := b.ensureIAMRoleWithRetry(b.Env.ProjectID, "cloud-controller", b.Env.ProjectID, []string{"roles/compute.admin"})
471477
if err != nil {
472478
return err
473479
}
@@ -481,14 +487,14 @@ func (b *GCPBootstrapper) EnsureIAMRoles() error {
481487
return nil
482488
}
483489

484-
err = b.ensureIAMRoleWithRetry("artifact-registry-writer", []string{"roles/artifactregistry.writer"})
490+
err = b.ensureIAMRoleWithRetry(b.Env.ProjectID, "artifact-registry-writer", b.Env.ProjectID, []string{"roles/artifactregistry.writer"})
485491
return err
486492
}
487493

488-
func (b *GCPBootstrapper) ensureIAMRoleWithRetry(serviceAccount string, roles []string) error {
494+
func (b *GCPBootstrapper) ensureIAMRoleWithRetry(projectID string, serviceAccount string, serviceAccountProjectID string, roles []string) error {
489495
var err error
490496
for retries := range 5 {
491-
err = b.GCPClient.AssignIAMRole(b.Env.ProjectID, serviceAccount, roles)
497+
err = b.GCPClient.AssignIAMRole(projectID, serviceAccount, serviceAccountProjectID, roles)
492498
if err == nil {
493499
return nil
494500
}
@@ -501,17 +507,11 @@ func (b *GCPBootstrapper) ensureIAMRoleWithRetry(serviceAccount string, roles []
501507
}
502508

503509
func (b *GCPBootstrapper) ensureDnsPermissions() error {
504-
if b.Env.DNSProjectID != "" {
505-
if b.Env.DNSProjectServiceAccount == "" {
506-
return errors.New("dns project service account with role roles/dns.admin must be provided when dns project id is set")
507-
}
508-
err := b.GCPClient.GrantImpersonation("cloud-controller", b.Env.ProjectID, b.Env.DNSProjectServiceAccount, b.Env.DNSProjectID)
509-
if err != nil {
510-
return fmt.Errorf("failed to grant impersonization on dns project %s to cloud-controller service account: %w", b.Env.DNSProjectID, err)
511-
}
512-
return nil
510+
dnsProject := b.Env.DNSProjectID
511+
if b.Env.DNSProjectID == "" {
512+
dnsProject = b.Env.ProjectID
513513
}
514-
err := b.ensureIAMRoleWithRetry("cloud-controller", []string{"roles/dns.admin"})
514+
err := b.ensureIAMRoleWithRetry(dnsProject, "cloud-controller", b.Env.ProjectID, []string{"roles/dns.admin"})
515515
if err != nil {
516516
return err
517517
}
@@ -1218,8 +1218,10 @@ func (b *GCPBootstrapper) UpdateInstallConfig() error {
12181218
},
12191219
},
12201220
}
1221-
b.Env.InstallConfig.Codesphere.GitProviders = &files.GitProvidersConfig{
1222-
GitHub: &files.GitProviderConfig{
1221+
1222+
b.Env.InstallConfig.Codesphere.GitProviders = &files.GitProvidersConfig{}
1223+
if b.Env.GitHubAppName != "" && b.Env.GithubAppClientID != "" && b.Env.GithubAppClientSecret != "" {
1224+
b.Env.InstallConfig.Codesphere.GitProviders.GitHub = &files.GitProviderConfig{
12231225
Enabled: true,
12241226
URL: "https://github.com",
12251227
API: files.APIConfig{
@@ -1229,11 +1231,14 @@ func (b *GCPBootstrapper) UpdateInstallConfig() error {
12291231
Issuer: "https://github.com",
12301232
AuthorizationEndpoint: "https://github.com/login/oauth/authorize",
12311233
TokenEndpoint: "https://github.com/login/oauth/access_token",
1234+
ClientAuthMethod: "client_secret_post",
1235+
RedirectURI: "https://cs." + b.Env.BaseDomain + "/ide/auth/github/callback",
1236+
InstallationURI: "https://github.com/apps/" + b.Env.GitHubAppName + "/installations/new",
12321237

12331238
ClientID: b.Env.GithubAppClientID,
12341239
ClientSecret: b.Env.GithubAppClientSecret,
12351240
},
1236-
},
1241+
}
12371242
}
12381243
b.Env.InstallConfig.Codesphere.Experiments = b.Env.Experiments
12391244
b.Env.InstallConfig.Codesphere.Features = b.Env.FeatureFlags

0 commit comments

Comments
 (0)