allow finding credentials for subdomain of terraform registry #4445
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎
|
📝 Walkthrough""" WalkthroughA new method for suffix-based credential lookup was added to the credentials system, allowing tokens to be matched using host suffixes rather than exact hostnames. The HTTP request authentication logic was updated to use this new method, attempting host suffix matches before falling back to environment variable tokens. Changes
Sequence Diagram(s)sequenceDiagram
participant Caller
participant CredentialsSource
participant Env
participant Config
Caller->>CredentialsSource: ForHost(host)
alt Exact match found
CredentialsSource-->>Caller: Return credentials
else No exact match
Caller->>CredentialsSource: ForHostSuffix(host)
alt Suffix match in Env
CredentialsSource->>Env: hostSuffixCredentialsFromEnv(host)
Env-->>CredentialsSource: Return credentials
CredentialsSource-->>Caller: Return credentials
else Suffix match in Config
CredentialsSource->>Config: Check for suffix match
Config-->>CredentialsSource: Return credentials
CredentialsSource-->>Caller: Return credentials
else No suffix match
CredentialsSource-->>Caller: nil
end
end
Assessment against linked issues
Possibly related PRs
Suggested reviewers
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 golangci-lint (1.64.8)Error: you are using a configuration file for golangci-lint v2 with golangci-lint v1: please use golangci-lint v2 📜 Recent review detailsConfiguration used: .coderabbit.yaml 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
Documentation and Community
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
📜 Review details
Configuration used: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
tf/cliconfig/credentials.go(2 hunks)tf/getter.go(1 hunks)
🧰 Additional context used
📓 Path-based instructions (1)
`**/*.go`: Review the Go code for quality and correctness. Make sure that the Go code follows best practices, is performant, and is easy to understand and maintain.
**/*.go: Review the Go code for quality and correctness. Make sure that the Go code follows best practices, is performant, and is easy to understand and maintain.
tf/getter.gotf/cliconfig/credentials.go
🔇 Additional comments (1)
tf/getter.go (1)
337-343: Implementation looks correct, but inherits security concern.The three-step credential resolution logic is well-implemented and the comments clearly explain the approach. However, this code will inherit the security concern from the
ForHostSuffixmethod intf/cliconfig/credentials.go.Once the subdomain-specific matching is implemented in the credentials file, this function will automatically benefit from the improved security.
|
Could you add some testing for this? If it can't reliably be run without access to an external service, please add a test using build flags. We're happy to help if that seems daunting. |
I'll try to take a stab at that but not 100% sure the flow in this project so any pointers would be great 👍 @yhakbar I'm working my through this and believe this is how to run those specific tests and where I can add them but they are getting skipped? Probably missing something simple: |
|
That was from the setup function in |
|
@yhakbar Could you give me some pointers here? I am a bit confused on how to test this properly with regards to setting up a mock/fake registry? I may be misunderstanding that a bit. |
Description
Fixes #4444.
This allows terraform registries to provide module paths from subdomains where terragrunt will be able to use the token of the original host from the credentials file to still authenticate correctly.
Spacelift is an example of this as they ask you to login into spacelift.io but their registry will have you download from app.spacelift.io.
TODOs
Read the Gruntwork contribution guidelines.
Release Notes (draft)
Added support for using a terraform registry host token on subdomains for module download.
Migration Guide
Summary by CodeRabbit