feat: fetch certificate from api

Signed-off-by: Christopher Thomsen <christhomsen82@gmail.com>

Author: sikksakk

Models/Certificate.cs

@@ -0,0 +1,10 @@
+namespace IamOrchestrator.Models;
+
+public class CertificateResponse
+{
+    public string CustomerName { get; set; } = string.Empty;
+    public string CertificateData { get; set; } = string.Empty; // Base64 encoded PFX
+    public string Thumbprint { get; set; } = string.Empty;
+    public DateTime ExpiresAt { get; set; }
+    public string Password { get; set; } = string.Empty;
+}

OrchestratorWorker.cs

@@ -171,10 +171,42 @@ private async Task ExecuteJobAsync(Job job)
             await _apiClient.UpdateJobStatusAsync(job.Id, JobStatus.Running);
             await SendLogAsync(job.Id, $"Job execution started", Models.LogLevel.Info);
 
-            // Execute the container
-            var success = await _containerExecutor.ExecuteJobAsync(job, 
+            // Download certificate for customer if customer is specified
+            byte[]? certificatePfx = null;
+            string? certificatePassword = null;
+            
+            if (!string.IsNullOrEmpty(job.Customer))
+            {
+                _logger.LogInformation("Downloading certificate for customer: {Customer}", job.Customer);
+                var certificate = await _apiClient.GetCertificateAsync(job.Customer);
+                
+                if (certificate != null)
+                {
+                    certificatePfx = Convert.FromBase64String(certificate.CertificateData);
+                    certificatePassword = certificate.Password;
+                    
+                    await SendLogAsync(job.Id, 
+                        $"Certificate acquired for {job.Customer} (expires: {certificate.ExpiresAt:yyyy-MM-dd HH:mm:ss} UTC)", 
+                        Models.LogLevel.Info);
+                    
+                    _logger.LogInformation("Certificate downloaded - Thumbprint: {Thumbprint}, Expires: {ExpiresAt}", 
+                        certificate.Thumbprint, certificate.ExpiresAt);
+                }
+                else
+                {
+                    await SendLogAsync(job.Id, 
+                        $"Warning: Could not obtain certificate for {job.Customer}", 
+                        Models.LogLevel.Warning);
+                }
+            }
+
+            // Execute the container with certificate
+            var success = await _containerExecutor.ExecuteJobAsync(
+                job, 
                 async (logMessage) => await SendLogAsync(job.Id, logMessage, Models.LogLevel.Info, "orchestrator"),
-                async (logMessage) => await SendLogAsync(job.Id, logMessage, Models.LogLevel.Info, "container"));
+                async (logMessage) => await SendLogAsync(job.Id, logMessage, Models.LogLevel.Info, "container"),
+                certificatePfx,
+                certificatePassword);
 
             // Update final status
             var finalStatus = success ? JobStatus.Completed : JobStatus.Failed;

Services/ApiClient.cs

@@ -260,4 +260,42 @@ public async Task SendHeartbeatAsync(Orchestrator orchestrator)
             throw;
         }
     }
+
+    public async Task<CertificateResponse?> GetCertificateAsync(string customerName)
+    {
+        try
+        {
+            if (!await EnsureAuthenticatedAsync())
+            {
+                _logger.LogWarning("Cannot get certificate: Not authenticated");
+                return null;
+            }
+
+            var response = await _httpClient.GetAsync($"/api/certificates/{Uri.EscapeDataString(customerName)}");
+            
+            if (response.StatusCode == System.Net.HttpStatusCode.Unauthorized)
+            {
+                _logger.LogWarning("Received 401, re-authenticating...");
+                _authToken = null;
+                if (await EnsureAuthenticatedAsync())
+                {
+                    response = await _httpClient.GetAsync($"/api/certificates/{Uri.EscapeDataString(customerName)}");
+                }
+            }
+
+            if (!response.IsSuccessStatusCode)
+            {
+                _logger.LogWarning("Failed to get certificate for {Customer}: {StatusCode}", 
+                    customerName, response.StatusCode);
+                return null;
+            }
+
+            return await response.Content.ReadFromJsonAsync<CertificateResponse>(_jsonOptions);
+        }
+        catch (Exception ex)
+        {
+            _logger.LogError(ex, "Failed to get certificate for {Customer}", customerName);
+            return null;
+        }
+    }
 }

Services/ContainerExecutor.cs

@@ -20,9 +20,15 @@ public ContainerExecutor(ILogger<ContainerExecutor> logger, IConfiguration confi
         _dockerClient = new DockerClientConfiguration(new Uri(dockerEndpoint)).CreateClient();
     }
 
-    public async Task<bool> ExecuteJobAsync(Job job, Func<string, Task> orchestratorLogCallback, Func<string, Task> containerOutputCallback)
+    public async Task<bool> ExecuteJobAsync(
+        Job job, 
+        Func<string, Task> orchestratorLogCallback, 
+        Func<string, Task> containerOutputCallback,
+        byte[]? certificatePfx = null,
+        string? certificatePassword = null)
     {
         string? containerId = null;
+        string? tempCertPath = null;
 
         try
         {
@@ -38,6 +44,26 @@ public async Task<bool> ExecuteJobAsync(Job job, Func<string, Task> orchestrator
             envVars.Add($"SCRIPT_PATH={job.ScriptPath}");
             envVars.Add($"WHAT_IF={job.IsWhatIf}");
 
+            // Handle certificate if provided
+            var binds = new List<string>();
+            if (certificatePfx != null && !string.IsNullOrEmpty(certificatePassword))
+            {
+                await orchestratorLogCallback("Certificate provided - preparing for container");
+                
+                // Write certificate to temp file
+                tempCertPath = Path.Combine(Path.GetTempPath(), $"cert-{job.Id}.pfx");
+                await File.WriteAllBytesAsync(tempCertPath, certificatePfx);
+                
+                // Mount certificate into container
+                binds.Add($"{tempCertPath}:/tmp/client-cert.pfx:ro");
+                
+                // Add certificate environment variables
+                envVars.Add("CLIENT_CERT_PATH=/tmp/client-cert.pfx");
+                envVars.Add($"CLIENT_CERT_PASSWORD={certificatePassword}");
+                
+                _logger.LogInformation("Certificate mounted for job {JobId}", job.Id);
+            }
+
             await orchestratorLogCallback($"Pulling container image: {job.ContainerImage}");
 
             // Debug: Log registry credential availability
@@ -140,7 +166,8 @@ await _dockerClient.Images.CreateImageAsync(
                 Env = envVars,
                 HostConfig = new HostConfig
                 {
-                    AutoRemove = true
+                    AutoRemove = true,
+                    Binds = binds.Any() ? binds : null
                 },
                 Name = $"iam-job-{job.Id}"
             });
@@ -175,6 +202,20 @@ await _dockerClient.Images.CreateImageAsync(
         }
         finally
         {
+            // Cleanup temp certificate file
+            if (!string.IsNullOrEmpty(tempCertPath) && File.Exists(tempCertPath))
+            {
+                try
+                {
+                    File.Delete(tempCertPath);
+                    _logger.LogDebug("Deleted temporary certificate file: {Path}", tempCertPath);
+                }
+                catch (Exception ex)
+                {
+                    _logger.LogWarning(ex, "Failed to delete temporary certificate file: {Path}", tempCertPath);
+                }
+            }
+            
             // Cleanup
             if (containerId != null)
             {

Services/IApiClient.cs

@@ -9,4 +9,5 @@ public interface IApiClient
     Task<bool> UpdateJobStatusAsync(Guid jobId, JobStatus status);
     Task<bool> SendLogAsync(LogEntry logEntry);
     Task SendHeartbeatAsync(Orchestrator orchestrator);
+    Task<CertificateResponse?> GetCertificateAsync(string customerName);
 }

Services/IContainerExecutor.cs

@@ -4,5 +4,10 @@ namespace IamOrchestrator.Services;
 
 public interface IContainerExecutor
 {
-    Task<bool> ExecuteJobAsync(Job job, Func<string, Task> orchestratorLogCallback, Func<string, Task> containerOutputCallback);
+    Task<bool> ExecuteJobAsync(
+        Job job, 
+        Func<string, Task> orchestratorLogCallback, 
+        Func<string, Task> containerOutputCallback,
+        byte[]? certificatePfx = null,
+        string? certificatePassword = null);
 }