Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 102 additions & 0 deletions internal/pkg/generator/generate.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,102 @@
package generator

import (
"fmt"
"path/filepath"
"time"

"gopkg.in/yaml.v3"

"github.com/siderolabs/talos/cmd/talosctl/cmd/mgmt/gen"
"github.com/siderolabs/talos/pkg/machinery/config"
"github.com/siderolabs/talos/pkg/machinery/config/generate"
"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
)

type Options struct {
RootDir string
TalosVersion string
Preset string
Force bool

APIServerURL string
}

// Run performs full generation exactly like "talm init"
func Run(opts Options) error {
var (
contract *config.VersionContract
secretsBundle *secrets.Bundle
err error
)

// Version contract
if opts.TalosVersion != "" {
contract, err = config.ParseContractFromVersion(opts.TalosVersion)
if err != nil {
return fmt.Errorf("invalid talos-version: %w", err)
}
}

// Secrets bundle
secretsBundle, err = secrets.NewBundle(secrets.NewFixedClock(time.Now()), contract)
if err != nil {
return fmt.Errorf("failed to create secrets bundle: %w", err)
}

// Write secrets.yaml
if err := writeSecretsBundle(opts, secretsBundle); err != nil {
return err
}

// Cluster name = name of directory
absolutePath, err := filepath.Abs(opts.RootDir)
if err != nil {
return err
}
clusterName := filepath.Base(absolutePath)

// Config generation
var genOptions []generate.Option
genOptions = append(genOptions, generate.WithSecretsBundle(secretsBundle))

if contract != nil {
genOptions = append(genOptions, generate.WithVersionContract(contract))
}

if opts.APIServerURL == "" {
opts.APIServerURL = "https://192.168.0.1:6443"
}
Comment on lines +67 to +69
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

high

The API server URL is hardcoded to https://192.168.0.1:6443 as a default. This is not a safe assumption and can lead to configuration errors in different network environments. It would be better to make this a required field or derive it from a more reliable source.


configBundle, err := gen.GenerateConfigBundle(
genOptions,
clusterName,
opts.APIServerURL,
"",
[]string{},
[]string{},
[]string{},
)
if err != nil {
return err
}

configBundle.TalosConfig().Contexts[clusterName].Endpoints = []string{"127.0.0.1"}

// Write talosconfig
content, err := yaml.Marshal(configBundle.TalosConfig())
if err != nil {
return err
}

if err := writeFile(opts, filepath.Join(opts.RootDir, "talosconfig"), content); err != nil {
return err
}

// Write preset files
if err := writePresets(opts, clusterName); err != nil {
return err
}

return nil
}
66 changes: 66 additions & 0 deletions internal/pkg/generator/write.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,66 @@
package generator

import (
"fmt"
"os"
"path/filepath"
"strings"

"github.com/cozystack/talm/pkg/generated"
"gopkg.in/yaml.v3"

"github.com/siderolabs/talos/pkg/machinery/config/generate/secrets"
)

func writeSecretsBundle(opts Options, bundle *secrets.Bundle) error {
bytes, err := yaml.Marshal(bundle)
if err != nil {
return err
}

dest := filepath.Join(opts.RootDir, "secrets.yaml")
return writeFile(opts, dest, bytes)
}

func writeFile(opts Options, dest string, content []byte) error {
if !opts.Force {
if _, err := os.Stat(dest); err == nil {
return fmt.Errorf("%s already exists (use Force=true)", dest)
}
}

if err := os.MkdirAll(filepath.Dir(dest), os.ModePerm); err != nil {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Using os.ModePerm (0777) for creating directories is overly permissive and a security risk. Please use a more restrictive permission set, such as 0755, to adhere to the principle of least privilege.

Suggested change
if err := os.MkdirAll(filepath.Dir(dest), os.ModePerm); err != nil {
if err := os.MkdirAll(filepath.Dir(dest), 0755); err != nil {

return fmt.Errorf("failed to create dir: %w", err)
}

if err := os.WriteFile(dest, content, 0o644); err != nil {
return fmt.Errorf("failed to write file: %w", err)
}

fmt.Fprintf(os.Stderr, "Created %s\n", dest)
return nil
}

func writePresets(opts Options, clusterName string) error {
for path, content := range generated.PresetFiles {

parts := strings.SplitN(path, "/", 2)
chartName := parts[0]

if chartName != opts.Preset && chartName != "talm" {
continue
}

out := filepath.Join(opts.RootDir, parts[1])

// Template Chart.yaml
if strings.HasSuffix(path, "Chart.yaml") {
content = fmt.Sprintf(content, clusterName, "0.1.0")
}

if err := writeFile(opts, out, []byte(content)); err != nil {
return err
}
}
return nil
}
Loading