kubernetes
/
git-sync
mirror of https://github.com/kubernetes/git-sync.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #431 from zhouhaibing089/flag-password-file 

Add option to read password from file
This commit is contained in:
Kubernetes Prow Robot 2021-07-05 15:21:38 -07:00 committed by GitHub
parent 8003e8cc1b 6076daf3c4
commit 83d9a44f4f
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 29 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
README.md
View File

@ -183,8 +183,12 @@ OPTIONS
--password <string>, $GIT_SYNC_PASSWORD
The password or personal access token (see github docs) to use for
git authentication (see --username). NOTE: for security reasons,
users should prefer the environment variable for specifying the
password.
users should prefer using a file for specifying the password (see
--password-file).
--password-file <string>, $GIT_SYNC_PASSWORD_FILE
The path to password file which contains password or personal access
token (see --password).
--period <duration>, $GIT_SYNC_PERIOD
How long to wait between sync attempts. This must be at least

24
cmd/git-sync/main.go
View File

@ -102,6 +102,8 @@ var flUsername = pflag.String("username", envString("GIT_SYNC_USERNAME", ""),
"the username to use for git auth")
var flPassword = pflag.String("password", envString("GIT_SYNC_PASSWORD", ""),
"the password or personal access token to use for git auth (prefer env vars for passwords)")
var flPasswordFile = pflag.String("password-file", envString("GIT_SYNC_PASSWORD_FILE", ""),
"the file from which the password or personal access token for git auth will be sourced")
var flSSH = pflag.Bool("ssh", envBool("GIT_SYNC_SSH", false),
"use SSH for git operations")
@ -473,6 +475,9 @@ func main() {
if *flPassword != "" {
handleError(false, "ERROR: only one of --ssh and --password may be specified")
}
if *flPasswordFile != "" {
handleError(false, "ERROR: only one of --ssh and --password-file may be specified")
}
if *flAskPassURL != "" {
handleError(false, "ERROR: only one of --ssh and --askpass-url may be specified")
}
@ -489,6 +494,15 @@ func main() {
}
}
if *flPassword != "" && *flPasswordFile != "" {
handleError(false, "ERROR: only one of --password and --password-file may be specified")
}
if *flUsername != "" {
if *flPassword == "" && *flPasswordFile == "" {
handleError(true, "ERROR: --password or --password-file must be set when --username is specified")
}
}
// From here on, output goes through logging.
log.V(0).Info("starting up",
"pid", os.Getpid(),
@ -545,7 +559,15 @@ func main() {
// `git clone`, so hopefully 30 seconds will be enough.
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
if *flUsername != "" && *flPassword != "" {
if *flUsername != "" {
if *flPasswordFile != "" {
flPasswordFileBytes, err := ioutil.ReadFile(*flPasswordFile)
if err != nil {
log.Error(err, "ERROR: can't read password file")
os.Exit(1)
}
*flPassword = string(flPasswordFileBytes)
}
if err := git.SetupAuth(ctx, *flUsername, *flPassword); err != nil {
log.Error(err, "ERROR: can't set up git auth")
os.Exit(1)