github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-08-30 14:25:43 +00:00
Code Issues Projects Releases Wiki Activity

agent:cdh: Refactor cdh client methods for better integration

Browse Source 
Move `unseal_env` and `secure_mount` functions on the global `CDH_CLIENT` instance to access the CDH client.

Signed-off-by: ChengyuZhu6 <chengyu.zhu@intel.com>
This commit is contained in:
ChengyuZhu6 2024-09-02 08:28:19 +08:00
parent 0ad35dc91b
commit bc8156c3ae
1 changed files with 32 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

45
src/agent/src/cdh.rs
View File

@ -57,19 +57,6 @@ impl CDHClient {
Ok(unsealed_secret.plaintext)
}
pub async fn unseal_env(&self, env: &str) -> Result<String> {
if let Some((key, value)) = env.split_once('=') {
if value.starts_with(SEALED_SECRET_PREFIX) {
let unsealed_value = self.unseal_secret_async(value).await?;
let unsealed_env = format!("{}={}", key, std::str::from_utf8(&unsealed_value)?);
return Ok(unsealed_env);
}
}
Ok((*env.to_owned()).to_string())
}
pub async fn secure_mount(
&self,
volume_type: &str,
@ -98,6 +85,38 @@ pub async fn init_cdh_client() -> Result<()> {
Ok(())
}
pub async fn unseal_env(env: &str) -> Result<String> {
let cdh_client = CDH_CLIENT
.get()
.expect("Confidential Data Hub not initialized");
if let Some((key, value)) = env.split_once('=') {
if value.starts_with(SEALED_SECRET_PREFIX) {
let unsealed_value = cdh_client.unseal_secret_async(value).await?;
let unsealed_env = format!("{}={}", key, std::str::from_utf8(&unsealed_value)?);
return Ok(unsealed_env);
}
}
Ok((*env.to_owned()).to_string())
}
pub async fn secure_mount(
volume_type: &str,
options: &std::collections::HashMap<String, String>,
flags: Vec<String>,
mount_point: &str,
) -> Result<()> {
let cdh_client = CDH_CLIENT
.get()
.expect("Confidential Data Hub not initialized");
cdh_client
.secure_mount(volume_type, options, flags, mount_point)
.await?;
Ok(())
}
#[cfg(test)]
#[cfg(feature = "sealed-secret")]
mod tests {