diff --git a/cmd/flux/bootstrap_github.go b/cmd/flux/bootstrap_github.go index 162a85bc..c7e821ef 100644 --- a/cmd/flux/bootstrap_github.go +++ b/cmd/flux/bootstrap_github.go @@ -140,11 +140,20 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error { } defer os.RemoveAll(manifestsBase) + var caBundle []byte + if bootstrapArgs.caFile != " " { + var err error + caBundle, err = os.ReadFile(bootstrapArgs.caFile) + if err != nil { + return fmt.Errorf("unable to read TLS CA file: %w", err) + } + } // Build GitHub provider providerCfg := provider.Config{ Provider: provider.GitProviderGitHub, Hostname: githubArgs.hostname, Token: ghToken, + CaBundle: caBundle, } providerClient, err := provider.BuildGitProvider(providerCfg) if err != nil { @@ -233,6 +242,7 @@ func bootstrapGitHubCmdRun(cmd *cobra.Command, args []string) error { bootstrap.WithReadWriteKeyPermissions(githubArgs.readWriteKey), bootstrap.WithKubeconfig(rootArgs.kubeconfig, rootArgs.kubecontext), bootstrap.WithLogger(logger), + bootstrap.WithCABundle(caBundle), } if bootstrapArgs.sshHostname != "" { bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname)) diff --git a/cmd/flux/bootstrap_gitlab.go b/cmd/flux/bootstrap_gitlab.go index 77557ea0..88b85aeb 100644 --- a/cmd/flux/bootstrap_gitlab.go +++ b/cmd/flux/bootstrap_gitlab.go @@ -144,11 +144,21 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error { } defer os.RemoveAll(manifestsBase) + var caBundle []byte + if bootstrapArgs.caFile != "" { + var err error + caBundle, err = os.ReadFile(bootstrapArgs.caFile) + if err != nil { + return fmt.Errorf("unable to read TLS CA file: %w", err) + } + } + // Build GitLab provider providerCfg := provider.Config{ Provider: provider.GitProviderGitLab, Hostname: gitlabArgs.hostname, Token: glToken, + CaBundle: caBundle, } // Workaround for: https://github.com/fluxcd/go-git-providers/issues/55 if hostname := providerCfg.Hostname; hostname != glDefaultDomain && @@ -246,6 +256,7 @@ func bootstrapGitLabCmdRun(cmd *cobra.Command, args []string) error { bootstrap.WithReadWriteKeyPermissions(gitlabArgs.readWriteKey), bootstrap.WithKubeconfig(rootArgs.kubeconfig, rootArgs.kubecontext), bootstrap.WithLogger(logger), + bootstrap.WithCABundle(caBundle), } if bootstrapArgs.sshHostname != "" { bootstrapOpts = append(bootstrapOpts, bootstrap.WithSSHHostname(bootstrapArgs.sshHostname)) diff --git a/go.mod b/go.mod index 0109dbbc..6d257751 100644 --- a/go.mod +++ b/go.mod @@ -6,7 +6,7 @@ require ( github.com/Masterminds/semver/v3 v3.1.0 github.com/ProtonMail/go-crypto v0.0.0-20210428141323-04723f9f07d7 github.com/cyphar/filepath-securejoin v0.2.2 - github.com/fluxcd/go-git-providers v0.3.2 + github.com/fluxcd/go-git-providers v0.4.0 github.com/fluxcd/helm-controller/api v0.13.0 github.com/fluxcd/image-automation-controller/api v0.17.1 github.com/fluxcd/image-reflector-controller/api v0.13.2 diff --git a/go.sum b/go.sum index 8ccdace1..3b488065 100644 --- a/go.sum +++ b/go.sum @@ -223,8 +223,8 @@ github.com/exponent-io/jsonpath v0.0.0-20151013193312-d6023ce2651d/go.mod h1:ZZM github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc= github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= github.com/felixge/httpsnoop v1.0.1/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U= -github.com/fluxcd/go-git-providers v0.3.2 h1:89dzg5SCAwdNsLjD4GvCVWo9zNKUDkea6shjBJEfspg= -github.com/fluxcd/go-git-providers v0.3.2/go.mod h1:enIPrXnSOBxahS6rngohpG3d/QZ3yjjy/w+agbp97ZI= +github.com/fluxcd/go-git-providers v0.4.0 h1:hdGGRDCNphf9FRrk297lorhwHWcST74R7cGAOZTRtSU= +github.com/fluxcd/go-git-providers v0.4.0/go.mod h1:enIPrXnSOBxahS6rngohpG3d/QZ3yjjy/w+agbp97ZI= github.com/fluxcd/helm-controller/api v0.13.0 h1:f9SwsHjqbWfeHMEtpr9wfdbMm0HQ2dL8bVayp2QyPxs= github.com/fluxcd/helm-controller/api v0.13.0/go.mod h1:zWmzV0s2SU4rEIGLPTt+dsaMs40OsNQgSgOATgJmxB0= github.com/fluxcd/image-automation-controller/api v0.17.1 h1:nINAsH6ERKItuWQSH2/Iovjn6a/fu/n7WRFVrloryFE= diff --git a/internal/bootstrap/bootstrap_plain_git.go b/internal/bootstrap/bootstrap_plain_git.go index 160594a1..16d66ed7 100644 --- a/internal/bootstrap/bootstrap_plain_git.go +++ b/internal/bootstrap/bootstrap_plain_git.go @@ -75,16 +75,6 @@ func WithRepositoryURL(url string) GitOption { return repositoryURLOption(url) } -func WithCABundle(b []byte) GitOption { - return caBundleOption(b) -} - -type caBundleOption []byte - -func (o caBundleOption) applyGit(b *PlainGitBootstrapper) { - b.caBundle = o -} - type repositoryURLOption string func (o repositoryURLOption) applyGit(b *PlainGitBootstrapper) { diff --git a/internal/bootstrap/options.go b/internal/bootstrap/options.go index 0e95dba9..2deb67db 100644 --- a/internal/bootstrap/options.go +++ b/internal/bootstrap/options.go @@ -62,6 +62,20 @@ func (o authorOption) applyGitProvider(b *GitProviderBootstrapper) { o.applyGit(b.PlainGitBootstrapper) } +func WithCABundle(b []byte) Option { + return caBundleOption(b) +} + +type caBundleOption []byte + +func (o caBundleOption) applyGit(b *PlainGitBootstrapper) { + b.caBundle = o +} + +func (o caBundleOption) applyGitProvider(b *GitProviderBootstrapper) { + b.caBundle = o +} + func WithCommitMessageAppendix(appendix string) Option { return commitMessageAppendixOption(appendix) } diff --git a/internal/bootstrap/provider/factory.go b/internal/bootstrap/provider/factory.go index 1790963a..b120361e 100644 --- a/internal/bootstrap/provider/factory.go +++ b/internal/bootstrap/provider/factory.go @@ -39,6 +39,9 @@ func BuildGitProvider(config Config) (gitprovider.Client, error) { if config.Hostname != "" { opts = append(opts, gitprovider.WithDomain(config.Hostname)) } + if config.CaBundle != nil { + opts = append(opts, gitprovider.WithCustomCAPostChainTransportHook(config.CaBundle)) + } if client, err = github.NewClient(opts...); err != nil { return nil, err } @@ -49,6 +52,9 @@ func BuildGitProvider(config Config) (gitprovider.Client, error) { if config.Hostname != "" { opts = append(opts, gitprovider.WithDomain(config.Hostname)) } + if config.CaBundle != nil { + opts = append(opts, gitprovider.WithCustomCAPostChainTransportHook(config.CaBundle)) + } if client, err = gitlab.NewClient(config.Token, "", opts...); err != nil { return nil, err } diff --git a/internal/bootstrap/provider/provider.go b/internal/bootstrap/provider/provider.go index face6cc1..4d1f92ac 100644 --- a/internal/bootstrap/provider/provider.go +++ b/internal/bootstrap/provider/provider.go @@ -41,4 +41,7 @@ type Config struct { // Token contains the token used to authenticate with the // Provider. Token string + + // CABunle contains the CA bundle to use for the client. + CaBundle []byte }