Add the initial repospawner service

repospawner turns JSON new-repo requests into terraform-git pull requests via kubernetes Jobs, follows those PRs to merge and optionally activates the repository in Woodpecker.
2026-08-30 14:33:31 +10:00
parent c104212dda
commit f1bcb8cd3a
41 changed files with 5388 additions and 1 deletions
@@ -0,0 +1,180 @@
+// Package vaultauth mints short-lived Gitea credentials from Vault using the
+// pod's projected kubernetes service account token.
+//
+// repospawner deliberately talks to Vault natively rather than shelling out to
+// agentpr: the AppRole path agentpr uses is CIDR-bound to hosts outside the
+// cluster, so an in-cluster login must go through the kubernetes auth mount.
+package vaultauth
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"os"
+	"strings"
+	"sync"
+	"time"
+)
+
+// Creds is a dynamic Gitea credential. Token is secret and must never be
+// logged; String deliberately redacts it.
+type Creds struct {
+	Username string
+	Token    string
+}
+
+func (c Creds) String() string { return "vaultauth.Creds{Username:" + c.Username + ", Token:REDACTED}" }
+
+// Client reads credentials from Vault. It holds no long-lived state: every
+// Creds call performs a fresh login, so nothing outlives the operation that
+// needed it.
+type Client struct {
+	Addr      string
+	Mount     string
+	Role      string
+	TokenPath string
+	HTTP      *http.Client
+}
+
+// New builds a Client with a bounded HTTP client.
+func New(addr, mount, role, tokenPath string) *Client {
+	return &Client{
+		Addr:      strings.TrimSuffix(addr, "/"),
+		Mount:     strings.Trim(mount, "/"),
+		Role:      role,
+		TokenPath: tokenPath,
+		HTTP:      &http.Client{Timeout: 20 * time.Second},
+	}
+}
+
+// Login exchanges the projected service account token for a Vault token.
+func (c *Client) Login(ctx context.Context) (string, error) {
+	jwt, err := os.ReadFile(c.TokenPath)
+	if err != nil {
+		return "", fmt.Errorf("read service account token: %w", err)
+	}
+	body, err := json.Marshal(map[string]string{
+		"role": c.Role,
+		"jwt":  strings.TrimSpace(string(jwt)),
+	})
+	if err != nil {
+		return "", err
+	}
+	var out struct {
+		Auth struct {
+			ClientToken string `json:"client_token"`
+		} `json:"auth"`
+	}
+	url := c.Addr + "/v1/auth/" + c.Mount + "/login"
+	if err := c.do(ctx, http.MethodPost, url, "", bytes.NewReader(body), &out); err != nil {
+		return "", fmt.Errorf("vault kubernetes login: %w", err)
+	}
+	if out.Auth.ClientToken == "" {
+		return "", fmt.Errorf("vault kubernetes login: empty client token")
+	}
+	return out.Auth.ClientToken, nil
+}
+
+// Creds logs in and reads a dynamic Gitea credential from path.
+func (c *Client) Creds(ctx context.Context, path string) (Creds, error) {
+	token, err := c.Login(ctx)
+	if err != nil {
+		return Creds{}, err
+	}
+	var out struct {
+		Data struct {
+			Username string `json:"username"`
+			Token    string `json:"token"`
+		} `json:"data"`
+	}
+	url := c.Addr + "/v1/" + strings.TrimPrefix(path, "/")
+	if err := c.do(ctx, http.MethodGet, url, token, nil, &out); err != nil {
+		return Creds{}, fmt.Errorf("read gitea credential: %w", err)
+	}
+	if out.Data.Token == "" {
+		return Creds{}, fmt.Errorf("read gitea credential: response carried no token")
+	}
+	return Creds{Username: out.Data.Username, Token: out.Data.Token}, nil
+}
+
+// do issues a request and decodes a JSON body, mapping any non-2xx to an error
+// that names the status but never echoes a token back.
+func (c *Client) do(ctx context.Context, method, url, token string, body io.Reader, out any) error {
+	req, err := http.NewRequestWithContext(ctx, method, url, body)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Accept", "application/json")
+	if body != nil {
+		req.Header.Set("Content-Type", "application/json")
+	}
+	if token != "" {
+		req.Header.Set("X-Vault-Token", token)
+	}
+	resp, err := c.client().Do(req)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = resp.Body.Close() }()
+	if resp.StatusCode < 200 || resp.StatusCode > 299 {
+		return fmt.Errorf("vault %s %s: status %d", method, redactPath(url), resp.StatusCode)
+	}
+	return json.NewDecoder(resp.Body).Decode(out)
+}
+
+func (c *Client) client() *http.Client {
+	if c.HTTP != nil {
+		return c.HTTP
+	}
+	return http.DefaultClient
+}
+
+// redactPath keeps the path for debugging but drops any query string, which is
+// where a stray wrapped token would otherwise appear.
+func redactPath(url string) string {
+	if i := strings.IndexByte(url, '?'); i >= 0 {
+		return url[:i]
+	}
+	return url
+}
+
+// TokenSource hands out Gitea tokens, caching the last mint until a caller asks
+// for a fresh one. Gitea tokens from the dynamic engine live about an hour, so
+// long-running watch jobs re-mint on the first 401 rather than on a timer.
+type TokenSource struct {
+	client *Client
+	path   string
+
+	mu     sync.Mutex
+	cached Creds
+}
+
+// NewTokenSource builds a TokenSource over c reading path.
+func NewTokenSource(c *Client, path string) *TokenSource {
+	return &TokenSource{client: c, path: path}
+}
+
+// Token returns a Gitea token. When force is true the cached value is discarded
+// and a new credential is minted.
+func (t *TokenSource) Token(ctx context.Context, force bool) (string, error) {
+	t.mu.Lock()
+	defer t.mu.Unlock()
+	if !force && t.cached.Token != "" {
+		return t.cached.Token, nil
+	}
+	creds, err := t.client.Creds(ctx, t.path)
+	if err != nil {
+		return "", err
+	}
+	t.cached = creds
+	return creds.Token, nil
+}
+
+// StaticTokenSource is a TokenFunc over a fixed token, for tests and for the
+// server's read-only lookups when a credential has already been minted.
+func StaticTokenSource(token string) func(context.Context, bool) (string, error) {
+	return func(context.Context, bool) (string, error) { return token, nil }
+}
@@ -0,0 +1,165 @@
+package vaultauth
+
+import (
+	"context"
+	"encoding/json"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync/atomic"
+	"testing"
+)
+
+func writeSAToken(t *testing.T, content string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "token")
+	if err := os.WriteFile(path, []byte(content), 0o600); err != nil {
+		t.Fatalf("write token: %v", err)
+	}
+	return path
+}
+
+func TestLogin(t *testing.T) {
+	var gotPath string
+	var gotBody map[string]string
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		gotPath = r.URL.Path
+		raw, _ := io.ReadAll(r.Body)
+		_ = json.Unmarshal(raw, &gotBody)
+		_, _ = w.Write([]byte(`{"auth":{"client_token":"s.vaulttoken"}}`))
+	}))
+	defer srv.Close()
+
+	c := New(srv.URL, "k8s/au/syd1", "repospawner", writeSAToken(t, "  jwt-value\n"))
+	tok, err := c.Login(context.Background())
+	if err != nil {
+		t.Fatalf("Login: %v", err)
+	}
+	if tok != "s.vaulttoken" {
+		t.Errorf("token = %q", tok)
+	}
+	if gotPath != "/v1/auth/k8s/au/syd1/login" {
+		t.Errorf("path = %q", gotPath)
+	}
+	if gotBody["role"] != "repospawner" || gotBody["jwt"] != "jwt-value" {
+		t.Errorf("body = %v (the projected token must be trimmed)", gotBody)
+	}
+}
+
+func TestLoginRejectsEmptyToken(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		_, _ = w.Write([]byte(`{"auth":{}}`))
+	}))
+	defer srv.Close()
+
+	c := New(srv.URL, "k8s/au/syd1", "repospawner", writeSAToken(t, "jwt"))
+	if _, err := c.Login(context.Background()); err == nil {
+		t.Fatal("expected an error when vault returns no client token")
+	}
+}
+
+func TestLoginSurfacesStatus(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusForbidden)
+	}))
+	defer srv.Close()
+
+	c := New(srv.URL, "k8s/au/syd1", "repospawner", writeSAToken(t, "jwt"))
+	_, err := c.Login(context.Background())
+	if err == nil || !strings.Contains(err.Error(), "403") {
+		t.Fatalf("error = %v, want one naming status 403", err)
+	}
+}
+
+func TestCredsUsesVaultToken(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case strings.HasSuffix(r.URL.Path, "/login"):
+			_, _ = w.Write([]byte(`{"auth":{"client_token":"s.vaulttoken"}}`))
+		case r.URL.Path == "/v1/gitea/creds/repospawner":
+			if got := r.Header.Get("X-Vault-Token"); got != "s.vaulttoken" {
+				t.Errorf("X-Vault-Token = %q", got)
+			}
+			_, _ = w.Write([]byte(`{"data":{"username":"repospawner-abc","token":"gitea-token"}}`))
+		default:
+			t.Errorf("unexpected path %s", r.URL.Path)
+		}
+	}))
+	defer srv.Close()
+
+	c := New(srv.URL, "k8s/au/syd1", "repospawner", writeSAToken(t, "jwt"))
+	creds, err := c.Creds(context.Background(), "gitea/creds/repospawner")
+	if err != nil {
+		t.Fatalf("Creds: %v", err)
+	}
+	if creds.Token != "gitea-token" || creds.Username != "repospawner-abc" {
+		t.Errorf("creds = %+v", creds)
+	}
+	if strings.Contains(creds.String(), "gitea-token") {
+		t.Errorf("Creds.String() leaked the token: %s", creds.String())
+	}
+}
+
+func TestCredsRejectsEmptyToken(t *testing.T) {
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, "/login") {
+			_, _ = w.Write([]byte(`{"auth":{"client_token":"s.t"}}`))
+			return
+		}
+		_, _ = w.Write([]byte(`{"data":{"username":"u"}}`))
+	}))
+	defer srv.Close()
+
+	c := New(srv.URL, "k8s/au/syd1", "repospawner", writeSAToken(t, "jwt"))
+	if _, err := c.Creds(context.Background(), "gitea/creds/repospawner"); err == nil {
+		t.Fatal("expected an error when the credential carries no token")
+	}
+}
+
+func TestTokenSourceCachesUntilForced(t *testing.T) {
+	var reads atomic.Int32
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, "/login") {
+			_, _ = w.Write([]byte(`{"auth":{"client_token":"s.t"}}`))
+			return
+		}
+		n := reads.Add(1)
+		_, _ = w.Write([]byte(`{"data":{"username":"u","token":"tok` + string(rune('0'+n)) + `"}}`))
+	}))
+	defer srv.Close()
+
+	src := NewTokenSource(New(srv.URL, "k8s/au/syd1", "repospawner", writeSAToken(t, "jwt")), "gitea/creds/repospawner")
+	ctx := context.Background()
+
+	first, err := src.Token(ctx, false)
+	if err != nil {
+		t.Fatalf("Token: %v", err)
+	}
+	cached, err := src.Token(ctx, false)
+	if err != nil {
+		t.Fatalf("Token: %v", err)
+	}
+	if cached != first {
+		t.Errorf("cached token %q != first %q", cached, first)
+	}
+	forced, err := src.Token(ctx, true)
+	if err != nil {
+		t.Fatalf("Token: %v", err)
+	}
+	if forced == first {
+		t.Errorf("forced mint returned the cached token %q", forced)
+	}
+	if reads.Load() != 2 {
+		t.Errorf("credential reads = %d, want 2", reads.Load())
+	}
+}
+
+func TestLoginMissingTokenFile(t *testing.T) {
+	c := New("https://vault.invalid", "k8s/au/syd1", "repospawner", filepath.Join(t.TempDir(), "absent"))
+	if _, err := c.Login(context.Background()); err == nil {
+		t.Fatal("expected an error when the projected token is missing")
+	}
+}