PrivateKeyFromKeyRef resolves a private key from either a file path or a Kubernetes secret reference. This follows the same pattern as cosignSig.PublicKeyFromKeyRef but for private keys. Supported formats: - File path: "/path/to/private-key.pem" - Kubernetes secret: "k8s://namespace/secret-name" - K
(ctx context.Context, keyRef string, fs afero.Fs)
| 32 | // - Kubernetes secret: "k8s://namespace/secret-name" |
| 33 | // - Kubernetes secret: "k8s://namespace/secret-name/key-field" |
| 34 | func PrivateKeyFromKeyRef(ctx context.Context, keyRef string, fs afero.Fs) ([]byte, error) { |
| 35 | // If the key-field is not specified assume it is "cosign.key" |
| 36 | adjustedKeyRef := keyRef |
| 37 | if strings.HasPrefix(keyRef, "k8s://") { |
| 38 | parts := strings.Split(strings.TrimPrefix(keyRef, "k8s://"), "/") |
| 39 | if len(parts) == 2 { |
| 40 | adjustedKeyRef = fmt.Sprintf("%s/cosign.key", keyRef) |
| 41 | } |
| 42 | } |
| 43 | return KeyFromKeyRef(ctx, adjustedKeyRef, fs) |
| 44 | } |
| 45 | |
| 46 | // PasswordFromKeyRef resolves a password from either environment variable or a Kubernetes secret reference. |
| 47 | // This provides a unified interface for password resolution similar to PrivateKeyFromKeyRef. |