internal: add package flagfolder to populate FlagSets with a secret mount

Signed-off-by: Xe Iaso <me@xeiaso.net>

7 files changed, 189 insertions, 0 deletions

diff --git a/flagfolder/flagfolder.go b/flagfolder/flagfolder.go
new file mode 100644
index 0000000..cb0d249
--- /dev/null
+++ b/flagfolder/flagfolder.go
@@ -0,0 +1,110 @@
+// Package flagfolder parses a folder on the disk as if each file in it had the contents of a command line flag.
+//
+// This is mainly intended to be used with environments like Kubernetes where you have your secrets mounted as a filesystem.
+package flagfolder
+
+import (
+	"flag"
+	"fmt"
+	"log/slog"
+	"os"
+	"path/filepath"
+
+	"github.com/stoewer/go-strcase"
+)
+
+// ParseSet parses secrets in a single folder into the given *flag.FlagSet.
+//
+// By default this will attempt to correct for several styles of naming for files:
+//
+// * kebab-case (the default)
+// * SHOUTING-KEBAB-CASE
+// * snake_case
+// * SHOUTING_SNAKE_CASE
+// * camelCase
+// * HammerCase
+func ParseSet(secretLocation string, set *flag.FlagSet) error {
+	var (
+		data []byte
+		err  error
+	)
+
+	set.VisitAll(func(f *flag.Flag) {
+		if err != nil {
+			return
+		}
+
+		for _, fname := range []string{
+			filepath.Join(secretLocation, f.Name),
+			filepath.Join(secretLocation, strcase.UpperKebabCase(f.Name)),
+			filepath.Join(secretLocation, strcase.LowerCamelCase(f.Name)),
+			filepath.Join(secretLocation, strcase.UpperCamelCase(f.Name)),
+			filepath.Join(secretLocation, strcase.SnakeCase(f.Name)),
+			filepath.Join(secretLocation, strcase.UpperSnakeCase(f.Name)),
+		} {
+			data, err = os.ReadFile(fname)
+			if err != nil {
+				slog.Debug("can't read", "fname", fname, "err", err)
+				if os.IsNotExist(err) {
+					err = nil
+					continue
+				}
+				continue
+			}
+		}
+
+		if ferr := f.Value.Set(string(data)); ferr != nil {
+			err = fmt.Errorf("flagfolder: failed to set flag %q with value %q", f.Name, string(data))
+		}
+	})
+
+	return err
+}
+
+// Parse parses all files in every folder under /run/secrets as if they were command-line flags.
+//
+// This is most useful when you are using environments like Kubernetes where the path of least resistance
+// is to mount your secrets as a filesystem. Mount all your secrets into the pod and then let it figure
+// itself out!
+//
+// To use this effectively, ensure that your Pods and Deployments mount secrets as volumes like this:
+//
+//	volumes:
+//	  - name: secret-volume
+//	    secret:
+//	    secretName: shell
+//	containers:
+//	  - name: shell
+//	    image: ubuntu:latest
+//	    volumeMounts:
+//	      - name: secret-volume
+//	        readOnly: true
+//	        mountPath: "/run/secrets/shell"
+//
+// By default this will attempt to correct for several styles of naming for files:
+//
+// * kebab-case (the default)
+// * SHOUTING-KEBAB-CASE
+// * snake_case
+// * SHOUTING_SNAKE_CASE
+// * camelCase
+// * HammerCase
+func Parse() {
+	stats, err := os.ReadDir("/run/secrets")
+	if err != nil {
+		slog.Debug("can't read from /run/secrets", "err", err)
+		return
+	}
+
+	for _, stat := range stats {
+		if !stat.IsDir() {
+			continue
+		}
+
+		loc := filepath.Join("/run/secrets", stat.Name())
+
+		if err := ParseSet(loc, flag.CommandLine); err != nil {
+			slog.Error("can't parse folder", "folder", loc, "err", err)
+		}
+	}
+}
diff --git a/flagfolder/flagfolder_test.go b/flagfolder/flagfolder_test.go
new file mode 100644
index 0000000..d85e023
--- /dev/null
+++ b/flagfolder/flagfolder_test.go
@@ -0,0 +1,44 @@
+package flagfolder
+
+import (
+	"flag"
+	"testing"
+)
+
+func TestFlagFolderSimple(t *testing.T) {
+	for _, cs := range []struct {
+		flagName  string
+		wantValue string
+	}{
+		{
+			flagName:  "foo",
+			wantValue: "foo",
+		},
+		{
+			flagName:  "bar",
+			wantValue: "bar",
+		},
+		{
+			flagName:  "something-here",
+			wantValue: "something here",
+		},
+		{
+			flagName:  "what-is-computer",
+			wantValue: "what is computer",
+		},
+	} {
+		t.Run(cs.flagName, func(t *testing.T) {
+			fs := flag.NewFlagSet("flagfolder_test", flag.PanicOnError)
+
+			f := fs.String(cs.flagName, "fail", "help for "+cs.flagName)
+
+			if err := ParseSet("./testdata", fs); err != nil {
+				t.Errorf("can't parse ./testdata: %v", err)
+			}
+
+			if *f != cs.wantValue {
+				t.Errorf("wanted --%s to be %q, got: %q", cs.flagName, cs.wantValue, *f)
+			}
+		})
+	}
+}
diff --git a/flagfolder/testdata/FOO b/flagfolder/testdata/FOO
new file mode 100644
index 0000000..1910281
--- /dev/null
+++ b/flagfolder/testdata/FOO
@@ -0,0 +1 @@
+foo
\ No newline at end of file
diff --git a/flagfolder/testdata/WHAT_IS_COMPUTER b/flagfolder/testdata/WHAT_IS_COMPUTER
new file mode 100644
index 0000000..aae2638
--- /dev/null
+++ b/flagfolder/testdata/WHAT_IS_COMPUTER
@@ -0,0 +1 @@
+what is computer
\ No newline at end of file
diff --git a/flagfolder/testdata/bar b/flagfolder/testdata/bar
new file mode 100644
index 0000000..ba0e162
--- /dev/null
+++ b/flagfolder/testdata/bar
@@ -0,0 +1 @@
+bar
\ No newline at end of file
diff --git a/flagfolder/testdata/something_here b/flagfolder/testdata/something_here
new file mode 100644
index 0000000..709c317
--- /dev/null
+++ b/flagfolder/testdata/something_here
@@ -0,0 +1 @@
+something here
\ No newline at end of file
diff --git a/flagfolder/testpod.yml b/flagfolder/testpod.yml
new file mode 100644
index 0000000..392d629
--- /dev/null
+++ b/flagfolder/testpod.yml
@@ -0,0 +1,31 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: shell
+  namespace: default
+data:
+  foo: Zm9v
+  bar: YmFy
+---
+apiVersion: v1
+kind: Pod
+metadata:
+  name: shell
+  namespace: default
+spec:
+  volumes:
+    - name: secret-volume
+      secret:
+        secretName: shell
+  containers:
+    - name: shell
+      image: ubuntu:latest
+      command:
+        - sleep
+        - "infinity"
+      imagePullPolicy: IfNotPresent
+      volumeMounts:
+        - name: secret-volume
+          readOnly: true
+          mountPath: "/run/secrets/shell"
+  restartPolicy: Always