fix(deploy): generalize connector secret overrides

2026-08-04 15:21:49 +02:00
parent b5071f1494
commit eb01979072
9 changed files with 384 additions and 91 deletions
@@ -0,0 +1,127 @@
+#!/usr/bin/env bash
+# Validate operator-managed Compose inputs before delegating to Docker Compose.
+set -euo pipefail
+
+usage() {
+  echo "usage: $0 --env-file <operator.env> -f <compose.yaml> ... <docker-compose-command>" >&2
+  exit 2
+}
+
+trim() {
+  local value="$1"
+  value="${value#"${value%%[![:space:]]*}"}"
+  value="${value%"${value##*[![:space:]]}"}"
+  printf '%s' "$value"
+}
+
+is_safe_absolute_path() {
+  local value="$1" segment
+  local -a segments
+  [[ "$value" == /* && "$value" != *//* ]] || return 1
+  IFS=/ read -r -a segments <<<"$value"
+  for segment in "${segments[@]}"; do
+    [[ "$segment" != . && "$segment" != .. ]] || return 1
+  done
+}
+
+read_env_value() {
+  local source="$1" wanted="$2" line trimmed name value result=""
+  while IFS= read -r line || [[ -n "$line" ]]; do
+    trimmed="$(trim "$line")"
+    [[ -n "$trimmed" && "$trimmed" != \#* && "$trimmed" == *=* ]] || continue
+    name="$(trim "${trimmed%%=*}")"
+    [[ "$name" == "$wanted" ]] || continue
+    value="$(trim "${trimmed#*=}")"
+    value="$(trim "${value%%#*}")"
+    value="${value#\"}"; value="${value%\"}"
+    value="${value#\'}"; value="${value%\'}"
+    result="$value"
+  done <"$source"
+  printf '%s' "$result"
+}
+
+source_names() {
+  local source="$1" line trimmed name
+  {
+    while IFS= read -r line || [[ -n "$line" ]]; do
+      trimmed="$(trim "$line")"
+      [[ -n "$trimmed" && "$trimmed" != \#* && "$trimmed" == *=* ]] || continue
+      name="$(trim "${trimmed%%=*}")"
+      [[ "$name" =~ ^[A-Za-z_][A-Za-z0-9_]*_SOURCE$ ]] && printf '%s\n' "$name"
+    done <"$source"
+    while IFS= read -r line; do
+      name="${line%%=*}"
+      [[ "$name" =~ ^[A-Za-z_][A-Za-z0-9_]*_SOURCE$ ]] && printf '%s\n' "$name"
+    done < <(env)
+  } | sort -u
+}
+
+record_git_transport() {
+  local compose_file="$1" transport=""
+  [[ -f "$compose_file" ]] || return 0
+  transport="$(awk '
+    /^[[:space:]]*x-thoth-git-transport:[[:space:]]*/ {
+      value = $0
+      sub(/^[[:space:]]*x-thoth-git-transport:[[:space:]]*/, "", value)
+      sub(/[[:space:]]*#.*/, "", value)
+      print value
+      exit
+    }
+  ' "$compose_file")"
+  case "$transport" in
+    ssh) ssh_override=1 ;;
+    https) https_override=1 ;;
+    "")
+      case "$(basename "$compose_file")" in
+        *git-ssh*.yaml|*git-ssh*.yml) ssh_override=1 ;;
+        *git-https*.yaml|*git-https*.yml) https_override=1 ;;
+      esac
+      ;;
+    *) echo "invalid x-thoth-git-transport in $compose_file" >&2; exit 2 ;;
+  esac
+}
+
+env_file=""
+ssh_override=0
+https_override=0
+arguments=("$@")
+for ((index = 0; index < ${#arguments[@]}; index += 1)); do
+  argument="${arguments[index]}"
+  case "$argument" in
+    --env-file)
+      ((index + 1 < ${#arguments[@]})) || usage
+      ((index += 1))
+      env_file="${arguments[index]}"
+      ;;
+    --env-file=*) env_file="${argument#--env-file=}" ;;
+    -f|--file)
+      ((index + 1 < ${#arguments[@]})) || usage
+      ((index += 1))
+      compose_file="${arguments[index]}"
+      record_git_transport "$compose_file"
+      ;;
+    --file=*)
+      compose_file="${argument#--file=}"
+      record_git_transport "$compose_file"
+      ;;
+  esac
+done
+
+[[ -n "$env_file" && -f "$env_file" ]] || { echo "Compose preflight requires an existing --env-file" >&2; exit 2; }
+if ((ssh_override && https_override)); then
+  echo "SSH and HTTPS Git overrides are mutually exclusive" >&2
+  exit 2
+fi
+
+while IFS= read -r name; do
+  value="$(read_env_value "$env_file" "$name")"
+  if [[ -v "$name" ]]; then
+    value="${!name}"
+  fi
+  if [[ -n "$value" ]] && ! is_safe_absolute_path "$value"; then
+    echo "unsafe source path for $name in $env_file" >&2
+    exit 2
+  fi
+done < <(source_names "$env_file")
+
+exec docker compose "${arguments[@]}"