refactor: wire shared Instance dependencies at startup

2026-09-11 16:10:36 +00:00
parent 305e778203
commit 61985acb32
13 changed files with 221 additions and 337 deletions
@@ -0,0 +1,71 @@
+/*
+Copyright 2026.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package main
+
+import (
+	"errors"
+	"flag"
+	"strings"
+	"time"
+
+	"git.ddupan.top/panxiao81/postgresql-tenant-operator/internal/openbao"
+	bao "github.com/openbao/openbao/api/v2"
+)
+
+// dependencyOptions belongs to process startup, never to an Instance.
+// Configuration is immutable after assembly; no configuration hot reload is enabled.
+type dependencyOptions struct {
+	address                 string
+	consumerAddress         string
+	authMount               string
+	authRole                string
+	kvMount                 string
+	tenantBasePath          string
+	externalSecretStoreName string
+	postgreSQLCABundlePath  string
+	timeout                 time.Duration
+}
+
+func (o *dependencyOptions) bindFlags(flags *flag.FlagSet) {
+	flags.StringVar(&o.address, "openbao-address", "", "OpenBao API address.")
+	flags.StringVar(&o.consumerAddress, "openbao-consumer-address", "", "Consumer OpenBao API address.")
+	flags.StringVar(&o.authMount, "openbao-auth-mount", "kubernetes", "OpenBao Kubernetes auth mount.")
+	flags.StringVar(&o.authRole, "openbao-auth-role", "", "OpenBao Kubernetes auth role.")
+	flags.StringVar(&o.kvMount, "openbao-kv-mount", "kv", "OpenBao KV v2 mount.")
+	flags.StringVar(&o.tenantBasePath, "openbao-tenant-base-path", "postgresql-tenants", "Tenant credential prefix.")
+	flags.StringVar(&o.externalSecretStoreName, "external-secret-store-name", "", "ESO ClusterSecretStore name.")
+	flags.StringVar(&o.postgreSQLCABundlePath, "postgresql-ca-bundle-path", "", "PostgreSQL CA bundle path.")
+	flags.DurationVar(&o.timeout, "reconcile-timeout", 30*time.Second, "External operation deadline.")
+}
+
+func (o dependencyOptions) credentials() (*openbao.Credentials, error) {
+	if o.address == "" || o.authRole == "" || o.authMount == "" || o.kvMount == "" {
+		return nil, errors.New("OpenBao address, auth role, auth mount and KV mount are required")
+	}
+	if o.timeout <= 0 {
+		return nil, errors.New("reconcile timeout must be positive")
+	}
+	// Delegate connection address parsing to the SDK, and avoid implicit BAO_* overrides.
+	config := bao.NewConfig()
+	config.Address = strings.TrimRight(o.address, "/")
+	config.Timeout = o.timeout
+	client, err := bao.NewClient(config)
+	if err != nil {
+		return nil, errors.New("invalid OpenBao client configuration")
+	}
+	return openbao.NewCredentials(client, o.kvMount, o.authMount, o.authRole), nil
+}