30 lines
1.2 KiB
Python
30 lines
1.2 KiB
Python
from pathlib import Path
|
|
|
|
COLLECTION_NAME = 'platform_certificates'
|
|
|
|
|
|
class CertProvider:
|
|
"""Downloads the platform's client cert + private key (Mongo metadata,
|
|
MinIO bytes) into a writable cache dir — pod root FS is read-only (§12),
|
|
so `cache_dir` must be an emptyDir/tmpfs mount."""
|
|
|
|
def __init__(self, mongo, minio, cache_dir: str, bucket: str, metadata: dict | None = None):
|
|
self.mongo = mongo
|
|
self.minio = minio
|
|
self.cache_dir = cache_dir
|
|
self.bucket = bucket
|
|
self.metadata = metadata or {}
|
|
|
|
async def fetch(self) -> tuple[str, str]:
|
|
doc = await self.mongo.find_one(COLLECTION_NAME, {}, self.metadata)
|
|
Path(self.cache_dir).mkdir(parents=True, exist_ok=True)
|
|
cert_path = await self._download(doc['client_cert']['minio_object_name'])
|
|
key_path = await self._download(doc['private_key']['minio_object_name'])
|
|
return cert_path, key_path
|
|
|
|
async def _download(self, object_name: str) -> str:
|
|
data = await self.minio.download_file(object_name, self.bucket, self.metadata)
|
|
local_path = str(Path(self.cache_dir) / Path(object_name).name)
|
|
Path(local_path).write_bytes(data)
|
|
return local_path
|