PasswordFromKeyRef resolves a password from either environment variable or a Kubernetes secret reference. This provides a unified interface for password resolution similar to PrivateKeyFromKeyRef. Supported formats: - Environment variable: "" (empty string uses COSIGN_PASSWORD env var) - Kubernetes
(ctx context.Context, keyRef string)
| 50 | // - Kubernetes secret: "k8s://namespace/secret-name" (assumes "cosign.password" key) |
| 51 | // - Kubernetes secret: "k8s://namespace/secret-name/key-field" (explicit key field) |
| 52 | func PasswordFromKeyRef(ctx context.Context, keyRef string) ([]byte, error) { |
| 53 | // If keyRef is empty, use environment variable (backward compatibility) |
| 54 | if keyRef == "" { |
| 55 | return []byte(os.Getenv("COSIGN_PASSWORD")), nil |
| 56 | } |
| 57 | |
| 58 | // If it's a Kubernetes secret reference |
| 59 | if strings.HasPrefix(keyRef, "k8s://") { |
| 60 | // If the key-field is not specified assume it is "cosign.password" |
| 61 | adjustedKeyRef := keyRef |
| 62 | parts := strings.Split(strings.TrimPrefix(keyRef, "k8s://"), "/") |
| 63 | if len(parts) == 2 { |
| 64 | adjustedKeyRef = fmt.Sprintf("%s/cosign.password", keyRef) |
| 65 | } |
| 66 | return KeyFromKeyRef(ctx, adjustedKeyRef, nil) // fs not needed for k8s secrets |
| 67 | } |
| 68 | |
| 69 | // For any other format, treat it as environment variable name |
| 70 | return []byte(os.Getenv(keyRef)), nil |
| 71 | } |
no test coverage detected