Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: refacto github/gitlab clients #413

Open
wants to merge 9 commits into
base: main
Choose a base branch
from

Conversation

LucasMrqes
Copy link
Collaborator

@LucasMrqes LucasMrqes commented Nov 27, 2024

Currently, the way burrito connects to a remote repository and to github/gitlab is quite messy.

  • Each repository is linked to a secret that contains a user / password or a SSH private key for the runner to clone the repository (TerraformRepository.spec.repository.secretName)
  • The pull request controller initializes a single GitHub and GitLab client with either GitHub app credentials, a Github API token or a Gitlab API token. (config: burrito.controller.githubConfig and burrito.controller.gitlabConfig.
  • A single webhook secret for GitHub and GitLab is passed to Burrito server to handle webhook requests (burrito.server.webhook.github.secret and burrito.server.webhook.gitlab.secret)

This poses several issues:

  • As a user, it is difficult to understand how credentials are managed ; and I need to use several credential types
  • Using a Github App or GitHub/GitLab API Token to clone repositories in runner pods is not supported
  • A single GitHub/GitLab client must have access to all repositories that implement PR/MR workflow

With this PR:

  • Git/GitHub/GitLab credentials and webhook secrets are centralized in the secret referenced to the repository
  • Github App and GitHub/GitLab API Tokens are supported for cloning repositories in runners
  • Creating a GitHub/GitLab client for the PullRequestController for each repository is supported
  • Using several webhook secrets is supported

Finally, in terms of code structure: git clients are now centralized in a single package internal/utils/gitproviders/. Adding support for a new provider such as bitbucket is easier and less error prone, since in only requires to implement all the functions for authenticating and interacting with the external repository in one spot.

@codecov-commenter
Copy link

codecov-commenter commented Nov 27, 2024

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

Attention: Patch coverage is 39.73430% with 499 lines in your changes missing coverage. Please review.

Project coverage is 50.05%. Comparing base (b7a2bbc) to head (1e820c9).

Files with missing lines Patch % Lines
internal/utils/gitprovider/github/github.go 27.43% 158 Missing and 6 partials ⚠️
internal/utils/gitprovider/gitlab/gitlab.go 35.59% 109 Missing and 5 partials ⚠️
internal/webhook/webhook.go 0.00% 90 Missing ⚠️
...nal/controllers/terraformpullrequest/controller.go 50.60% 37 Missing and 4 partials ⚠️
internal/server/server.go 0.00% 26 Missing ⚠️
internal/utils/gitprovider/standard/standard.go 43.18% 22 Missing and 3 partials ⚠️
internal/utils/gitprovider/mock/mock.go 65.11% 14 Missing and 1 partial ⚠️
internal/runner/runner.go 61.29% 9 Missing and 3 partials ⚠️
internal/utils/gitprovider/gitprovider.go 70.00% 8 Missing and 1 partial ⚠️
internal/testing/loading.go 77.77% 1 Missing and 1 partial ⚠️
... and 1 more

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files
@@            Coverage Diff             @@
##             main     #413      +/-   ##
==========================================
- Coverage   51.12%   50.05%   -1.08%     
==========================================
  Files          73       72       -1     
  Lines        4350     4805     +455     
==========================================
+ Hits         2224     2405     +181     
- Misses       1937     2197     +260     
- Partials      189      203      +14     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@LucasMrqes LucasMrqes force-pushed the feat/refacto-git-authentication branch from 9900f2e to fc2a0cb Compare November 27, 2024 16:27
@LucasMrqes LucasMrqes linked an issue Nov 29, 2024 that may be closed by this pull request
Copy link
Member

@corrieriluca corrieriluca left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We have across Burrito multiple Provider interfaces that represent Git providers.

I think we should create an universal interface named GitProvider to be used by:

  • TerraformPullRequestController (to get and comment PRs)
  • Runner (to clone repos)
  • Webhook server (to decode events)

This will ease future implementations of Git providers in Burrito and will help also for future Burrito components that interact with Git online services.

internal/controllers/terraformpullrequest/controller.go Outdated Show resolved Hide resolved
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: secret-access
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should be a ClusterRole named burrito-server-secret-access

@LucasMrqes LucasMrqes force-pushed the feat/refacto-git-authentication branch from 8229285 to 2bf2f08 Compare December 20, 2024 11:21
log.Infof("kubernetes resources successfully retrieved")
return nil
}

func (r *Runner) initGitProvider() error {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome, it totally abstracts the provider!

e.Logger.Fatal(e.Start(s.config.Server.Addr))
log.Infof("burrito server started on addr %s", s.config.Server.Addr)
}

func handleHealthz(c echo.Context) error {
return c.String(http.StatusOK, "OK")
}

func (s *Server) refreshWebhookHandlers(ctx context.Context) {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So this refreshes the webhook configuration every 5 minutes in case of the user has configured a new repository?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, the timing choice is a bit random, I will make it customizable in the config

}

func New(c *config.Config) *Webhook {
return &Webhook{
Config: c,
Config: c,
Providers: make(map[string][]gitprovider.Provider),
}
}

type Provider interface {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this interface still needed?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was the old one, good catch. I'm deleting it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Support Per-Repository Authentication Settings
3 participants