support tls certificates when connecting to metal-api

Author: mac641

cmd/root.go

@@ -1,9 +1,13 @@
 package cmd
 
 import (
+	"crypto/tls"
+	"crypto/x509"
+	"encoding/hex"
 	"fmt"
 	"io"
 	"log/slog"
+	"net/http"
 	"os"
 	"strings"
 
@@ -220,14 +224,31 @@ func initConfigWithViperCtx(c *config) error {
 		}
 	}
 
+	certificateAuthorityData := viper.GetString("certificate-authority-data")
+
 	var (
-		client metalgo.Client
-		err    error
+		client    metalgo.Client
+		err       error
+		transport *http.Transport
 	)
-	if hmacAuthType != "" {
-		client, err = metalgo.NewDriver(driverURL, apiToken, hmacKey, metalgo.AuthType(hmacAuthType))
+
+	if certificateAuthorityData == "" {
+		if hmacAuthType == "" {
+			client, err = metalgo.NewClient(driverURL, metalgo.BearerToken(apiToken), metalgo.HMACAuth(hmacKey, "Metal-Admin"))
+		} else {
+			client, err = metalgo.NewClient(driverURL, metalgo.BearerToken(apiToken), metalgo.HMACAuth(hmacKey, hmacAuthType))
+		}
 	} else {
-		client, err = metalgo.NewDriver(driverURL, apiToken, hmacKey)
+		transport, err = createTLSTransport(certificateAuthorityData)
+		if err != nil {
+			return err
+		}
+
+		if hmacAuthType == "" {
+			client, err = metalgo.NewClient(driverURL, metalgo.BearerToken(apiToken), metalgo.HMACAuth(hmacKey, "Metal-Admin"), metalgo.Transport(transport))
+		} else {
+			client, err = metalgo.NewClient(driverURL, metalgo.BearerToken(apiToken), metalgo.HMACAuth(hmacKey, hmacAuthType), metalgo.Transport(transport))
+		}
 	}
 	if err != nil {
 		return err
@@ -240,6 +261,27 @@ func initConfigWithViperCtx(c *config) error {
 	return nil
 }
 
+func createTLSTransport(certificateAuthorityData string) (transport *http.Transport, err error) {
+	var (
+		certificateAuthorityDataHex []byte
+		caCertPool                  x509.CertPool
+	)
+
+	certificateAuthorityDataHex, err = hex.DecodeString(certificateAuthorityData)
+	if err != nil {
+		return nil, err
+	}
+
+	caCertPool.AppendCertsFromPEM(certificateAuthorityDataHex)
+	transport = &http.Transport{
+		TLSClientConfig: &tls.Config{
+			RootCAs: &caCertPool,
+		},
+	}
+
+	return transport, nil
+}
+
 func recursiveAutoGenDisable(cmd *cobra.Command) {
 	cmd.DisableAutoGenTag = true
 	for _, child := range cmd.Commands() {

go.mod

@@ -10,7 +10,7 @@ require (
 	github.com/go-openapi/strfmt v0.23.0
 	github.com/google/go-cmp v0.6.0
 	github.com/google/uuid v1.6.0
-	github.com/metal-stack/metal-go v0.40.3
+	github.com/metal-stack/metal-go v0.40.5-0.20250307164026-7ca4478eda1e
 	github.com/metal-stack/metal-lib v0.20.1
 	github.com/metal-stack/updater v1.2.2
 	github.com/metal-stack/v v1.0.3

go.sum

@@ -246,6 +246,8 @@ github.com/mdlayher/socket v0.5.1 h1:VZaqt6RkGkt2OE9l3GcC6nZkqD3xKeQLyfleW/uBcos
 github.com/mdlayher/socket v0.5.1/go.mod h1:TjPLHI1UgwEv5J1B5q0zTZq12A/6H7nKmtTanQE37IQ=
 github.com/metal-stack/metal-go v0.40.3 h1:ekgdTY23zHs/XGOg8bUJQFYPTX1GnaqgaT/lgVxS3JI=
 github.com/metal-stack/metal-go v0.40.3/go.mod h1:ltItf/Md/z588c7Dr3X6iemCeOFh3rJ8nDL5Dpb9zFQ=
+github.com/metal-stack/metal-go v0.40.5-0.20250307164026-7ca4478eda1e h1:m13vaYr/nv/QxIa7G2V3jr1qqLQ/xACNCTR40cEmz5A=
+github.com/metal-stack/metal-go v0.40.5-0.20250307164026-7ca4478eda1e/go.mod h1:ltItf/Md/z588c7Dr3X6iemCeOFh3rJ8nDL5Dpb9zFQ=
 github.com/metal-stack/metal-lib v0.20.1 h1:gxNg512dS5yzDebELtPZjmoWond0Gw0HHEkSVIAOWRE=
 github.com/metal-stack/metal-lib v0.20.1/go.mod h1:zYzXYpNA4nQ+ANx19s/+1Yb/Q6xhS1nQK2yK2/ryXZM=
 github.com/metal-stack/security v0.9.3 h1:ZF5rGeZ4fIFe0DFFQWkXsUDCzODyjdrpvKmeaLOz9lo=

pkg/api/context.go

@@ -18,14 +18,15 @@ type Contexts struct {
 
 // Context configure metalctl behaviour
 type Context struct {
-	ApiURL       string  `yaml:"url"`
-	IssuerURL    string  `yaml:"issuer_url"`
-	IssuerType   string  `yaml:"issuer_type"`
-	CustomScopes string  `yaml:"custom_scopes"`
-	ClientID     string  `yaml:"client_id"`
-	ClientSecret string  `yaml:"client_secret"`
-	HMAC         *string `yaml:"hmac"`
-	HMACAuthType string  `yaml:"hmac_auth_type,omitempty"`
+	ApiURL                   string  `yaml:"url"`
+	IssuerURL                string  `yaml:"issuer_url"`
+	IssuerType               string  `yaml:"issuer_type"`
+	CustomScopes             string  `yaml:"custom_scopes"`
+	ClientID                 string  `yaml:"client_id"`
+	ClientSecret             string  `yaml:"client_secret"`
+	HMAC                     *string `yaml:"hmac"`
+	HMACAuthType             string  `yaml:"hmac_auth_type,omitempty"`
+	CertificateAuthorityData string  `yaml:"certificate_authority_data,omitempty"`
 }
 
 var defaultCtx = Context{