Function getCredentials

cmd/gitops-pusher/gitops-pusher.go:233–272

()

}

func getCredentials() (*http.Client, string) {
	getCredentialsOnce.Do(func() {
		apiKeyEnv, ok := os.LookupEnv("TS_API_KEY")
		oauthId, oiok := os.LookupEnv("TS_OAUTH_ID")
		oauthSecret, osok := os.LookupEnv("TS_OAUTH_SECRET")
		idToken, idok := os.LookupEnv("TS_ID_TOKEN")

		if !ok && (!oiok || (!osok && !idok)) {
			log.Fatal("set envvar TS_API_KEY to your Tailscale API key, TS_OAUTH_ID and TS_OAUTH_SECRET to a Tailscale OAuth ID and Secret, or TS_OAUTH_ID and TS_ID_TOKEN to a Tailscale federated identity Client ID and OIDC identity token")
		}
		if apiKeyEnv != "" && (oauthId != "" || (oauthSecret != "" && idToken != "")) {
			log.Fatal("set either the envvar TS_API_KEY, TS_OAUTH_ID and TS_OAUTH_SECRET, or TS_OAUTH_ID and TS_ID_TOKEN")
		}
		if oiok && ((oauthId != "" && !idok) || oauthSecret != "") {
			// Both should ideally be set, but if either are non-empty it means the user had an intent
			// to set _something_, so they should receive the oauth error flow.
			oauthConfig := &clientcredentials.Config{
				ClientID:     oauthId,
				ClientSecret: oauthSecret,
				TokenURL:     fmt.Sprintf("https://%s/api/v2/oauth/token", *apiServer),
			}
			client = oauthConfig.Client(context.Background())
		} else if idok && idToken != "" && oiok && oauthId != "" {
			if exchangeJWTForToken, ok := tailscale.HookExchangeJWTForTokenViaWIF.GetOk(); ok {
				var err error
				apiKeyEnv, err = exchangeJWTForToken(context.Background(), fmt.Sprintf("https://%s", *apiServer), oauthId, idToken)
				if err != nil {
					log.Fatal(err)
				}
			}
			client = http.DefaultClient
		} else {
			client = http.DefaultClient
		}

		apiKey = apiKeyEnv
	})

	return client, apiKey
}

func sumFile(fname string) (string, error) {
	data, err := os.ReadFile(fname)