Documentation
¶
Overview ¶
Package bagdrop owns the platform-plane configuration and destination resolution lifecycle for the one-way registry mirror described by ADR-0025.
Index ¶
- Constants
- Variables
- func ValidateRecord(record *Record) error
- type Adapter
- type AdapterError
- type AdapterKind
- type ArtifactSnapshot
- type Association
- type AssociationState
- type BucketSnapshot
- type BuildSnapshot
- type ChannelSnapshot
- type Config
- type CredentialSealer
- type Destination
- type DufflebagConfig
- type HCPPackerConfig
- type LastVerification
- type Project
- type ReconcileRepository
- type ReconcileRun
- type Reconciler
- func (r *Reconciler) ReconcileAll(ctx context.Context) error
- func (r *Reconciler) ReconcileProject(ctx context.Context, project Project) error
- func (r *Reconciler) ReconcileStatus(organizationID, projectID string) ReconcilerStatus
- func (r *Reconciler) Run(ctx context.Context)
- func (r *Reconciler) Started() <-chan struct{}
- func (r *Reconciler) Trigger(_ context.Context, organizationID, projectID string) error
- type ReconcilerStatus
- type Record
- type Registry
- type RemoteBucket
- type RemoteBuild
- type RemoteChannel
- type RemoteSbom
- type RemoteVersion
- type RemovalOutcome
- type Repository
- type Runtime
- type SbomSnapshot
- type Service
- func (s *Service) Associate(ctx context.Context, organizationID, projectID, bucketName string) (*Association, error)
- func (s *Service) CredentialProtection() string
- func (s *Service) Delete(ctx context.Context, organizationID, projectID string) error
- func (s *Service) Disable(ctx context.Context, organizationID, projectID string) (*Config, error)
- func (s *Service) Enable(ctx context.Context, organizationID, projectID string, write *Write) (*Config, *VerificationResult, error)
- func (s *Service) Get(ctx context.Context, organizationID, projectID string) (*Config, error)
- func (s *Service) ListAssociations(ctx context.Context, organizationID, projectID string) ([]Association, error)
- func (s *Service) Status(ctx context.Context, organizationID, projectID string) (*Status, error)
- func (s *Service) Unassociate(ctx context.Context, organizationID, projectID, bucketName string) (RemovalOutcome, error)
- func (s *Service) Verify(ctx context.Context, organizationID, projectID string) (VerificationResult, error)
- type Status
- type SyncStatus
- type VerificationOutcome
- type VerificationReason
- type VerificationResult
- type VersionSnapshot
- type Write
Constants ¶
const CredentialKeyEnv = "DFBG_BAGDROP_CREDENTIAL_KEY"
Variables ¶
var ( ErrNotFound = errors.New("bag drop configuration not found") ErrEnabled = errors.New("bag drop configuration is enabled") ErrInvalid = errors.New("invalid bag drop configuration") ErrResolution = errors.New("bag drop destination did not resolve") ErrCredentialSeal = errors.New("bag drop credential sealing unavailable") ErrBucketNotFound = errors.New("bucket not found") ErrCleanupPending = errors.New("bag drop destination cleanup is pending") )
var ( ErrReconcilerNotRunning = errors.New("bag drop reconciler is not running in this process") )
Functions ¶
func ValidateRecord ¶
ValidateRecord keeps the adapter enum and destination requirements in the domain layer even when a row is restored from storage.
Types ¶
type Adapter ¶
type Adapter interface {
Resolve(context.Context, Destination) VerificationResult
BeginReconcile(context.Context, Destination) (ReconcileRun, error)
}
func NewDufflebagAdapter ¶
NewDufflebagAdapter uses one dufflebag listener for both the token grant and Packer-compatible API. caChainPEM augments, rather than replaces, system trust roots.
func NewDufflebagAdapterFactory ¶
func NewDufflebagAdapterFactory() Adapter
NewDufflebagAdapterFactory is the registry entry used by the process. It binds endpoint and trust configuration from each destination at use time.
func NewHCPPackerAdapter ¶
NewHCPPackerAdapter takes bases rather than reading configuration so tests exercise the exact production request shapes against httptest servers.
type AdapterError ¶
func (*AdapterError) Error ¶
func (e *AdapterError) Error() string
type AdapterKind ¶
type AdapterKind string
const ( AdapterHCPPacker AdapterKind = "hcp-packer" AdapterDufflebag AdapterKind = "dufflebag" )
type ArtifactSnapshot ¶
type Association ¶
type Association struct {
OrganizationID string
ProjectID string
BucketName string
State AssociationState
FirstAttemptedAt *time.Time
LastAttemptAt *time.Time
LastSyncedAt *time.Time
LastSyncError *string
CreatedAt time.Time
UpdatedAt time.Time
}
func (Association) SyncStatus ¶
func (a Association) SyncStatus() SyncStatus
type AssociationState ¶
type AssociationState string
const ( AssociationActive AssociationState = "active" AssociationPendingRemoval AssociationState = "pending_removal" )
type BucketSnapshot ¶
type BucketSnapshot struct {
Name string
Description string
Versions []VersionSnapshot
Channels []ChannelSnapshot
}
type BuildSnapshot ¶
type BuildSnapshot struct {
ID string
ComponentType string
PackerRunUUID string
Platform string
Labels map[string]string
SourceExternalIdentifier string
Metadata json.RawMessage
Artifacts []ArtifactSnapshot
Sboms []SbomSnapshot
}
type ChannelSnapshot ¶
type Config ¶
type Config struct {
Adapter AdapterKind
HCPPacker HCPPackerConfig
Dufflebag DufflebagConfig
SecretSet bool
Enabled bool
LastVerification *LastVerification
CreatedAt time.Time
UpdatedAt time.Time
}
type CredentialSealer ¶
type CredentialSealer struct {
// contains filtered or unexported fields
}
func NewCredentialSealer ¶
func NewCredentialSealer(ring *keyring.Keyring, environmentKey string) *CredentialSealer
func (*CredentialSealer) Mode ¶
func (s *CredentialSealer) Mode() string
Mode reports which deployment key protects Bag Drop credentials.
type Destination ¶
type Destination struct {
HCPPackerConfig
Dufflebag DufflebagConfig
ClientSecret string
}
type DufflebagConfig ¶
type HCPPackerConfig ¶
type LastVerification ¶
type LastVerification struct {
VerificationResult
VerifiedAt time.Time
}
type ReconcileRepository ¶
type ReconcileRepository interface {
ListBagDropProjects(context.Context) ([]Project, error)
GetBagDropConfig(context.Context, string, string) (*Record, error)
ListBagDropAssociations(context.Context, string, string) ([]Association, error)
GetBagDropBucketSnapshot(context.Context, string, string, string) (*BucketSnapshot, error)
MarkBagDropAssociationAttempt(context.Context, string, string, string, time.Time) error
RecordBagDropAssociationSuccess(context.Context, string, string, string, time.Time) error
RecordBagDropAssociationFailure(context.Context, string, string, string, string, time.Time) error
DeleteBagDropAssociation(context.Context, string, string, string) error
}
type ReconcileRun ¶
type ReconcileRun interface {
GetBucket(context.Context, string) (*RemoteBucket, bool, error)
CreateBucket(context.Context, BucketSnapshot) error
UpdateBucket(context.Context, BucketSnapshot) error
DeleteBucket(context.Context, string) error
GetVersion(context.Context, string, string) (*RemoteVersion, bool, error)
CreateVersion(context.Context, string, VersionSnapshot) error
RevokeVersion(context.Context, string, string, time.Time, string) error
RestoreVersion(context.Context, string, string) error
DeleteVersion(context.Context, string, string) error
ListBuilds(context.Context, string, string) ([]RemoteBuild, error)
CreateBuild(context.Context, string, string, BuildSnapshot) (string, error)
UpdateBuildRunning(context.Context, string, string, string) error
UpdateBuild(context.Context, string, string, string, BuildSnapshot) error
DeleteBuild(context.Context, string, string, string) error
ListSboms(context.Context, string, string, string) ([]RemoteSbom, error)
UploadSbom(context.Context, string, string, string, SbomSnapshot) error
ListChannels(context.Context, string) ([]RemoteChannel, error)
CreateChannel(context.Context, string, ChannelSnapshot) error
UpdateChannelAssignment(context.Context, string, string, *string) error
UpdateChannelRestriction(context.Context, string, string, bool) error
DeleteChannel(context.Context, string, string) error
}
type Reconciler ¶
type Reconciler struct {
// contains filtered or unexported fields
}
func NewReconciler ¶
func NewReconciler( repository ReconcileRepository, sealer *CredentialSealer, adapters Registry, writer audit.Writer, interval time.Duration, logger *slog.Logger, ) (*Reconciler, error)
func (*Reconciler) ReconcileAll ¶
func (r *Reconciler) ReconcileAll(ctx context.Context) error
func (*Reconciler) ReconcileProject ¶
func (r *Reconciler) ReconcileProject(ctx context.Context, project Project) error
func (*Reconciler) ReconcileStatus ¶
func (r *Reconciler) ReconcileStatus(organizationID, projectID string) ReconcilerStatus
func (*Reconciler) Run ¶
func (r *Reconciler) Run(ctx context.Context)
func (*Reconciler) Started ¶
func (r *Reconciler) Started() <-chan struct{}
Started is closed once Run is accepting on-demand triggers.
type ReconcilerStatus ¶
type Record ¶
type Record struct {
OrganizationID string
ProjectID string
Adapter AdapterKind
HCPPacker HCPPackerConfig
Dufflebag DufflebagConfig
SealedSecret []byte
Enabled bool
LastVerification *LastVerification
CreatedAt time.Time
UpdatedAt time.Time
}
Record is the repository shape. SealedSecret is deliberately absent from Config, the only shape platform responses render.
type Registry ¶
type Registry map[AdapterKind]Adapter
type RemoteBucket ¶
type RemoteBucket struct {
Description string `json:"description"`
Versions []RemoteVersion
}
type RemoteBuild ¶
type RemoteChannel ¶
type RemoteSbom ¶
type RemoteVersion ¶
type RemovalOutcome ¶
type RemovalOutcome string
const ( RemovedClean RemovalOutcome = "removed_clean" RemovalPending RemovalOutcome = "removal_pending" )
type Repository ¶
type Repository interface {
GetBagDropConfig(context.Context, string, string) (*Record, error)
PutBagDropConfig(context.Context, *Record) (*Record, error)
DeleteBagDropConfig(context.Context, string, string) error
RecordBagDropVerification(context.Context, string, string, VerificationResult, time.Time) (*Record, error)
SetBagDropEnabled(context.Context, string, string, bool, *VerificationResult, time.Time) (*Record, error)
ListBagDropAssociations(context.Context, string, string) ([]Association, error)
PutBagDropAssociation(context.Context, Association) (*Association, error)
RemoveBagDropAssociation(context.Context, string, string, string, time.Time) (RemovalOutcome, error)
BagDropBucketExists(context.Context, string, string, string) (bool, error)
HasBlockingBagDropAssociations(context.Context, string, string) (bool, error)
}
type Runtime ¶
type Runtime struct {
*Service
*Reconciler
}
Runtime composes the request-facing configuration service with the process-owned reconciliation loop for platform handler injection.
type SbomSnapshot ¶
type Service ¶
type Service struct {
// contains filtered or unexported fields
}
func NewService ¶
func NewService(repository Repository, sealer *CredentialSealer, adapters Registry) *Service
func (*Service) CredentialProtection ¶
CredentialProtection reports the sealer posture exposed with configuration responses.
func (*Service) ListAssociations ¶
func (*Service) Unassociate ¶
type Status ¶
type Status struct {
Configured bool
Config *Config
Associations []Association
}
type SyncStatus ¶
type SyncStatus string
const ( SyncPending SyncStatus = "pending" SyncSynced SyncStatus = "synced" SyncError SyncStatus = "error" SyncRemoving SyncStatus = "removing" )
type VerificationOutcome ¶
type VerificationOutcome string
const ( OutcomeResolved VerificationOutcome = "resolved" OutcomeFailed VerificationOutcome = "failed" )
type VerificationReason ¶
type VerificationReason string
const ( ReasonCredentialRefused VerificationReason = "credential_refused" ReasonProjectNotFound VerificationReason = "project_not_found" ReasonUnreachable VerificationReason = "unreachable" ReasonTLSFailure VerificationReason = "tls_failure" )
type VerificationResult ¶
type VerificationResult struct {
Outcome VerificationOutcome `json:"outcome"`
Reason VerificationReason `json:"reason,omitempty"`
Message string `json:"message,omitempty"`
}
type VersionSnapshot ¶
type Write ¶
type Write struct {
Adapter AdapterKind
HCPPacker *HCPPackerConfig
Dufflebag *DufflebagConfig
ClientSecret *string
}