mirror of
https://github.com/hanzoai/deploy.git
synced 2026-10-07 08:44:50 +00:00
zeekayandHanzo Dev
1ab6e799c1
go.mod still declared `module github.com/hanzoai/deploy` after the repo was renamed. A Go module path is not cosmetic — it is the resolvable location. So `go get github.com/hanzoai/cd` could not work, and anything importing this module had to spell a name that no longer exists at that address. The build log of v3.6.0 is where it surfaced: the compiler was still emitting github.com/hanzoai/deploy/cmd/cd/commands. 3541 import paths across 690 .go, 19 .proto, 4 .yaml, 3 .sh, 2 .mod, Procfile and Makefile. Plus the 62 ghcr.io/hanzoai/deploy image references, moved to ghcr.io/hanzoai/cd to match hanzo.yml's build target — a distinct string from the module path, replaced separately so neither could clobber the other. go mod tidy clean, CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build ./... clean. Co-authored-by: Hanzo Dev <[email protected]>
51 lines
2.4 KiB
Go
51 lines
2.4 KiB
Go
package settings
|
|
|
|
import (
|
|
"fmt"
|
|
"strings"
|
|
|
|
"github.com/hanzoai/cd/pkg/apis/application/v1alpha1"
|
|
"github.com/hanzoai/cd/util/glob"
|
|
)
|
|
|
|
const (
|
|
// serviceAccountDisallowedCharSet contains the characters that are not allowed to be present
|
|
// in a DefaultServiceAccount configured for a DestinationServiceAccount
|
|
serviceAccountDisallowedCharSet = "!*[]{}\\/"
|
|
)
|
|
|
|
// DeriveServiceAccountToImpersonate determines the service account to be used for impersonation for the sync operation.
|
|
// The returned service account will be fully qualified including namespace and the service account name in the format system:serviceaccount:<namespace>:<service_account>
|
|
func DeriveServiceAccountToImpersonate(project *v1alpha1.AppProject, application *v1alpha1.Application, destCluster *v1alpha1.Cluster) (string, error) {
|
|
// spec.Destination.Namespace is optional. If not specified, use the Application's
|
|
// namespace
|
|
serviceAccountNamespace := application.Spec.Destination.Namespace
|
|
if serviceAccountNamespace == "" {
|
|
serviceAccountNamespace = application.Namespace
|
|
}
|
|
// Loop through the destinationServiceAccounts and see if there is any destination that is a candidate.
|
|
// if so, return the service account specified for that destination.
|
|
for _, item := range project.Spec.DestinationServiceAccounts {
|
|
dstServerMatched, err := glob.MatchWithError(item.Server, destCluster.Server)
|
|
if err != nil {
|
|
return "", fmt.Errorf("invalid glob pattern for destination server: %w", err)
|
|
}
|
|
dstNamespaceMatched, err := glob.MatchWithError(item.Namespace, application.Spec.Destination.Namespace)
|
|
if err != nil {
|
|
return "", fmt.Errorf("invalid glob pattern for destination namespace: %w", err)
|
|
}
|
|
if dstServerMatched && dstNamespaceMatched {
|
|
if strings.Trim(item.DefaultServiceAccount, " ") == "" || strings.ContainsAny(item.DefaultServiceAccount, serviceAccountDisallowedCharSet) {
|
|
return "", fmt.Errorf("default service account contains invalid chars '%s'", item.DefaultServiceAccount)
|
|
} else if strings.Contains(item.DefaultServiceAccount, ":") {
|
|
// service account is specified along with its namespace.
|
|
return "system:serviceaccount:" + item.DefaultServiceAccount, nil
|
|
}
|
|
// service account needs to be prefixed with a namespace
|
|
return fmt.Sprintf("system:serviceaccount:%s:%s", serviceAccountNamespace, item.DefaultServiceAccount), nil
|
|
}
|
|
}
|
|
// if there is no match found in the AppProject.Spec.DestinationServiceAccounts, return empty string
|
|
return "", nil
|
|
}
|