Merge branch 'tg/hotreload-token-secret-key' into tg/support-new-bm-provider-id

Author: guettli

README.md

@@ -69,6 +69,11 @@ See [CAPH docs](https://syself.com/docs/caph/topics/baremetal/creating-workload-
 
 ## Usage
 
+We recommend to mount the secret `hetzner` as volume and make it available for the container as `/etc/hetzner-secret`.
+Then the credentials are automatically reloaded, when the secret changes.
+When you use hot-reloading, the secret keys must be named `hcloud` (or `token`, for upstream hcloud-ccm compatibility), `robot-user`, and `robot-password`.
+You see an example in the [ccm helm chart](https://github.com/syself/charts/tree/main/charts/ccm-hetzner)
+
 We recommend to mount the secret `hetzner` as volume and make it available for the container as
 `/etc/hetzner-secret`. Then the credentials are automatically reloaded, when the secret changes.
 When you use the hot-reloading, be sure that the keys in the secret use these names: "hcloud" (for

internal/credentials/hotreload.go

@@ -240,8 +240,8 @@ func GetInitialHcloudCredentialsFromDirectory(credentialsDir string) (string, er
 func readHcloudCredentials(credentialsDir string) (string, error) {
 	var allErrors []error
 	for _, key := range []string{"hcloud", "token"} {
-		// upstream hcloud ccm expects by default the key "token" in the secret. To ease migration
-		// (back and forward), we support that, too.
+		// The upstream hcloud-ccm uses "token" as key name in the mounted secret.
+		// To ease migration between both CCMs, we support both key names.
 		hcloudTokenFile := filepath.Join(credentialsDir, key)
 		data, err := os.ReadFile(hcloudTokenFile)
 		if err != nil {

internal/credentials/hotreload_test.go

@@ -0,0 +1,79 @@
+package credentials
+
+import (
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestReadHcloudCredentials(t *testing.T) {
+	t.Run("reads hcloud key", func(t *testing.T) {
+		dir := t.TempDir()
+		err := os.WriteFile(filepath.Join(dir, "hcloud"), []byte(" token-from-hcloud \n"), 0o600)
+		if err != nil {
+			t.Fatalf("write hcloud token: %v", err)
+		}
+
+		token, err := readHcloudCredentials(dir)
+		if err != nil {
+			t.Fatalf("readHcloudCredentials() error = %v", err)
+		}
+		if token != "token-from-hcloud" {
+			t.Fatalf("readHcloudCredentials() token = %q, want %q", token, "token-from-hcloud")
+		}
+	})
+
+	t.Run("falls back to token key", func(t *testing.T) {
+		dir := t.TempDir()
+		err := os.WriteFile(filepath.Join(dir, "token"), []byte("token-from-token-key"), 0o600)
+		if err != nil {
+			t.Fatalf("write token key: %v", err)
+		}
+
+		token, err := readHcloudCredentials(dir)
+		if err != nil {
+			t.Fatalf("readHcloudCredentials() error = %v", err)
+		}
+		if token != "token-from-token-key" {
+			t.Fatalf("readHcloudCredentials() token = %q, want %q", token, "token-from-token-key")
+		}
+	})
+
+	t.Run("prefers hcloud key over token key", func(t *testing.T) {
+		dir := t.TempDir()
+		err := os.WriteFile(filepath.Join(dir, "hcloud"), []byte("first-token"), 0o600)
+		if err != nil {
+			t.Fatalf("write hcloud token: %v", err)
+		}
+		err = os.WriteFile(filepath.Join(dir, "token"), []byte("second-token"), 0o600)
+		if err != nil {
+			t.Fatalf("write token key: %v", err)
+		}
+
+		token, err := readHcloudCredentials(dir)
+		if err != nil {
+			t.Fatalf("readHcloudCredentials() error = %v", err)
+		}
+		if token != "first-token" {
+			t.Fatalf("readHcloudCredentials() token = %q, want %q", token, "first-token")
+		}
+	})
+
+	t.Run("returns error if no key exists", func(t *testing.T) {
+		dir := t.TempDir()
+
+		_, err := readHcloudCredentials(dir)
+		if err == nil {
+			t.Fatal("readHcloudCredentials() error = nil, want non-nil")
+		}
+
+		errText := err.Error()
+		if !strings.Contains(errText, filepath.Join(dir, "hcloud")) {
+			t.Fatalf("error does not mention hcloud key path: %q", errText)
+		}
+		if !strings.Contains(errText, filepath.Join(dir, "token")) {
+			t.Fatalf("error does not mention token key path: %q", errText)
+		}
+	})
+}