diff --git a/docs/resources/cached_image.md b/docs/resources/cached_image.md index a7f4a38..93923fe 100644 --- a/docs/resources/cached_image.md +++ b/docs/resources/cached_image.md @@ -37,6 +37,7 @@ The cached image resource can be used to retrieve a cached image produced by env - `git_clone_single_branch` (Boolean) (Envbuilder option) Clone only a single branch of the Git repository. - `git_http_proxy_url` (String) (Envbuilder option) The URL for the HTTP proxy. This is optional. - `git_password` (String, Sensitive) (Envbuilder option) The password to use for Git authentication. This is optional. +- `git_ssh_private_key_base64` (String, Sensitive) (Envbuilder option) Base64 encoded SSH private key to be used for Git authentication. - `git_ssh_private_key_path` (String) (Envbuilder option) Path to an SSH private key to be used for Git authentication. - `git_username` (String) (Envbuilder option) The username to use for Git authentication. This is optional. - `ignore_paths` (List of String) (Envbuilder option) The comma separated list of paths to ignore when building the workspace. diff --git a/go.mod b/go.mod index 2435f51..b961c18 100644 --- a/go.mod +++ b/go.mod @@ -10,7 +10,7 @@ replace tailscale.com => github.com/coder/tailscale v1.1.1-0.20240702054557-aa55 require ( github.com/GoogleContainerTools/kaniko v1.9.2 - github.com/coder/envbuilder v1.0.3 + github.com/coder/envbuilder v1.0.4 github.com/coder/serpent v0.8.0 github.com/docker/docker v26.1.5+incompatible github.com/gliderlabs/ssh v0.3.7 diff --git a/go.sum b/go.sum index 1e5903c..cf57857 100644 --- a/go.sum +++ b/go.sum @@ -186,8 +186,8 @@ github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoC github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI= github.com/coder/coder/v2 v2.10.1-0.20240704130443-c2d44d16a352 h1:L/EjCuZxs5tOcqqCaASj/nu65TRYEFcTt8qRQfHZXX0= github.com/coder/coder/v2 v2.10.1-0.20240704130443-c2d44d16a352/go.mod h1:P1KoQSgnKEAG6Mnd3YlGzAophty+yKA9VV48LpfNRvo= -github.com/coder/envbuilder v1.0.3 h1:Ne2s+JBjGXwdO8PoNBEtgIos1a+VFB2iSuOBQHj+cFA= -github.com/coder/envbuilder v1.0.3/go.mod h1:CkP/qKzWmK14I/aSPwEXoEHlss7OqYDmaM8Q7rDhwt8= +github.com/coder/envbuilder v1.0.4 h1:27DFtKhgsode5I0kBPTCHuzG88Zpny27OVvXOuA/zso= +github.com/coder/envbuilder v1.0.4/go.mod h1:CkP/qKzWmK14I/aSPwEXoEHlss7OqYDmaM8Q7rDhwt8= github.com/coder/kaniko v0.0.0-20240925122543-caa18967f374 h1:/cyXf0vTSwFh7evQqeWHXXl14aRfC4CsNIYxOenJytQ= github.com/coder/kaniko v0.0.0-20240925122543-caa18967f374/go.mod h1:XoTDIhNF0Ll4tLmRYdOn31udU9w5zFrY2PME/crSRCA= github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 h1:3A0ES21Ke+FxEM8CXx9n47SZOKOpgSE1bbJzlE4qPVs= diff --git a/internal/provider/cached_image_resource.go b/internal/provider/cached_image_resource.go index 9378094..097b5fd 100644 --- a/internal/provider/cached_image_resource.go +++ b/internal/provider/cached_image_resource.go @@ -49,28 +49,29 @@ type CachedImageResourceModel struct { CacheRepo types.String `tfsdk:"cache_repo"` GitURL types.String `tfsdk:"git_url"` // Optional "inputs". - BaseImageCacheDir types.String `tfsdk:"base_image_cache_dir"` - BuildContextPath types.String `tfsdk:"build_context_path"` - CacheTTLDays types.Int64 `tfsdk:"cache_ttl_days"` - DevcontainerDir types.String `tfsdk:"devcontainer_dir"` - DevcontainerJSONPath types.String `tfsdk:"devcontainer_json_path"` - DockerfilePath types.String `tfsdk:"dockerfile_path"` - DockerConfigBase64 types.String `tfsdk:"docker_config_base64"` - ExitOnBuildFailure types.Bool `tfsdk:"exit_on_build_failure"` - ExtraEnv types.Map `tfsdk:"extra_env"` - FallbackImage types.String `tfsdk:"fallback_image"` - GitCloneDepth types.Int64 `tfsdk:"git_clone_depth"` - GitCloneSingleBranch types.Bool `tfsdk:"git_clone_single_branch"` - GitHTTPProxyURL types.String `tfsdk:"git_http_proxy_url"` - GitPassword types.String `tfsdk:"git_password"` - GitSSHPrivateKeyPath types.String `tfsdk:"git_ssh_private_key_path"` - GitUsername types.String `tfsdk:"git_username"` - IgnorePaths types.List `tfsdk:"ignore_paths"` - Insecure types.Bool `tfsdk:"insecure"` - RemoteRepoBuildMode types.Bool `tfsdk:"remote_repo_build_mode"` - SSLCertBase64 types.String `tfsdk:"ssl_cert_base64"` - Verbose types.Bool `tfsdk:"verbose"` - WorkspaceFolder types.String `tfsdk:"workspace_folder"` + BaseImageCacheDir types.String `tfsdk:"base_image_cache_dir"` + BuildContextPath types.String `tfsdk:"build_context_path"` + CacheTTLDays types.Int64 `tfsdk:"cache_ttl_days"` + DevcontainerDir types.String `tfsdk:"devcontainer_dir"` + DevcontainerJSONPath types.String `tfsdk:"devcontainer_json_path"` + DockerfilePath types.String `tfsdk:"dockerfile_path"` + DockerConfigBase64 types.String `tfsdk:"docker_config_base64"` + ExitOnBuildFailure types.Bool `tfsdk:"exit_on_build_failure"` + ExtraEnv types.Map `tfsdk:"extra_env"` + FallbackImage types.String `tfsdk:"fallback_image"` + GitCloneDepth types.Int64 `tfsdk:"git_clone_depth"` + GitCloneSingleBranch types.Bool `tfsdk:"git_clone_single_branch"` + GitHTTPProxyURL types.String `tfsdk:"git_http_proxy_url"` + GitPassword types.String `tfsdk:"git_password"` + GitSSHPrivateKeyPath types.String `tfsdk:"git_ssh_private_key_path"` + GitSSHPrivateKeyBase64 types.String `tfsdk:"git_ssh_private_key_base64"` + GitUsername types.String `tfsdk:"git_username"` + IgnorePaths types.List `tfsdk:"ignore_paths"` + Insecure types.Bool `tfsdk:"insecure"` + RemoteRepoBuildMode types.Bool `tfsdk:"remote_repo_build_mode"` + SSLCertBase64 types.String `tfsdk:"ssl_cert_base64"` + Verbose types.Bool `tfsdk:"verbose"` + WorkspaceFolder types.String `tfsdk:"workspace_folder"` // Computed "outputs". Env types.List `tfsdk:"env"` EnvMap types.Map `tfsdk:"env_map"` @@ -186,6 +187,11 @@ func (r *CachedImageResource) Schema(ctx context.Context, req resource.SchemaReq MarkdownDescription: "(Envbuilder option) Path to an SSH private key to be used for Git authentication.", Optional: true, }, + "git_ssh_private_key_base64": schema.StringAttribute{ + MarkdownDescription: "(Envbuilder option) Base64 encoded SSH private key to be used for Git authentication.", + Optional: true, + Sensitive: true, + }, "git_username": schema.StringAttribute{ MarkdownDescription: "(Envbuilder option) The username to use for Git authentication. This is optional.", Optional: true, diff --git a/internal/provider/helpers.go b/internal/provider/helpers.go index 21137f1..af4d237 100644 --- a/internal/provider/helpers.go +++ b/internal/provider/helpers.go @@ -102,6 +102,11 @@ func optionsFromDataModel(data CachedImageResourceModel) (eboptions.Options, dia opts.GitSSHPrivateKeyPath = data.GitSSHPrivateKeyPath.ValueString() } + if !data.GitSSHPrivateKeyBase64.IsNull() { + providerOpts["ENVBUILDER_GIT_SSH_PRIVATE_KEY_BASE64"] = true + opts.GitSSHPrivateKeyBase64 = data.GitSSHPrivateKeyBase64.ValueString() + } + if !data.GitUsername.IsNull() { providerOpts["ENVBUILDER_GIT_USERNAME"] = true opts.GitUsername = data.GitUsername.ValueString() @@ -151,6 +156,11 @@ func optionsFromDataModel(data CachedImageResourceModel) (eboptions.Options, dia } diags = append(diags, overrideOptionsFromExtraEnv(&opts, extraEnv, providerOpts)...) + if opts.GitSSHPrivateKeyPath != "" && opts.GitSSHPrivateKeyBase64 != "" { + diags.AddError("Cannot set more than one git ssh private key option", + "Both ENVBUILDER_GIT_SSH_PRIVATE_KEY_PATH and ENVBUILDER_GIT_SSH_PRIVATE_KEY_BASE64 have been set.") + } + return opts, diags } diff --git a/internal/provider/provider_internal_test.go b/internal/provider/provider_internal_test.go index aedfca2..c273a8c 100644 --- a/internal/provider/provider_internal_test.go +++ b/internal/provider/provider_internal_test.go @@ -211,6 +211,59 @@ func Test_optionsFromDataModel(t *testing.T) { }, expectNumErrorDiags: 2, }, + { + name: "errors when git ssh private key path and base64 are set", + data: CachedImageResourceModel{ + BuilderImage: basetypes.NewStringValue("envbuilder:latest"), + CacheRepo: basetypes.NewStringValue("localhost:5000/cache"), + GitURL: basetypes.NewStringValue("git@git.local/devcontainer.git"), + GitSSHPrivateKeyPath: basetypes.NewStringValue("/tmp/id_rsa"), + GitSSHPrivateKeyBase64: basetypes.NewStringValue("cHJpdmF0ZUtleQo="), + }, + expectOpts: eboptions.Options{ + CacheRepo: "localhost:5000/cache", + GitURL: "git@git.local/devcontainer.git", + RemoteRepoBuildMode: true, + GitSSHPrivateKeyPath: "/tmp/id_rsa", + GitSSHPrivateKeyBase64: "cHJpdmF0ZUtleQo=", + }, + expectNumErrorDiags: 1, + }, + { + name: "extra_env override errors when git ssh private key path and base64 are set", + data: CachedImageResourceModel{ + BuilderImage: basetypes.NewStringValue("envbuilder:latest"), + CacheRepo: basetypes.NewStringValue("localhost:5000/cache"), + GitURL: basetypes.NewStringValue("git@git.local/devcontainer.git"), + GitSSHPrivateKeyBase64: basetypes.NewStringValue("cHJpdmF0ZUtleQo="), + ExtraEnv: extraEnvMap(t, + "ENVBUILDER_GIT_SSH_PRIVATE_KEY_PATH", "/tmp/id_rsa", + ), + }, + expectOpts: eboptions.Options{ + CacheRepo: "localhost:5000/cache", + GitURL: "git@git.local/devcontainer.git", + RemoteRepoBuildMode: true, + GitSSHPrivateKeyPath: "/tmp/id_rsa", + GitSSHPrivateKeyBase64: "cHJpdmF0ZUtleQo=", + }, + expectNumErrorDiags: 1, + }, + { + name: "required only with base64 ssh key", + data: CachedImageResourceModel{ + BuilderImage: basetypes.NewStringValue("envbuilder:latest"), + CacheRepo: basetypes.NewStringValue("localhost:5000/cache"), + GitURL: basetypes.NewStringValue("git@git.local/devcontainer.git"), + GitSSHPrivateKeyBase64: basetypes.NewStringValue("cHJpdmF0ZUtleQo="), + }, + expectOpts: eboptions.Options{ + CacheRepo: "localhost:5000/cache", + GitURL: "git@git.local/devcontainer.git", + RemoteRepoBuildMode: true, + GitSSHPrivateKeyBase64: "cHJpdmF0ZUtleQo=", + }, + }, } { t.Run(tc.name, func(t *testing.T) { t.Parallel()