feat: Support to ory hydra running in secure mode

helpers/http_client.go

@@ -3,13 +3,14 @@ package helpers
 import (
 	"crypto/tls"
 	"net/http"
+	"os"
 
 	ctrl "sigs.k8s.io/controller-runtime"
 
 	httptransport "github.com/go-openapi/runtime/client"
 )
 
-func CreateHttpClient(insecureSkipVerify bool, tlsTrustStore string) *http.Client {
+func CreateHttpClient(insecureSkipVerify bool, tlsTrustStore string) (*http.Client, error) {
 	setupLog := ctrl.Log.WithName("setup")
 	tr := &http.Transport{}
 	httpClient := &http.Client{}
@@ -19,15 +20,19 @@ func CreateHttpClient(insecureSkipVerify bool, tlsTrustStore string) *http.Clien
 		httpClient.Transport = tr
 	}
 	if tlsTrustStore != "" {
+		if _, err := os.Stat(tlsTrustStore); err != nil {
+			return nil, err
+		}
+
 		setupLog.Info("configuring TLS with tlsTrustStore")
 		ops := httptransport.TLSClientOptions{
 			CA:                 tlsTrustStore,
 			InsecureSkipVerify: insecureSkipVerify,
 		}
 		if tlsClient, err := httptransport.TLSClient(ops); err != nil {
 			setupLog.Error(err, "Error while getting TLSClient, default http client will be used")
-			return tlsClient
+			return tlsClient, nil
 		}
 	}
-	return httpClient
+	return httpClient, nil
 }

helpers/http_client_test.go

@@ -1,35 +1,47 @@
-package helpers
+package helpers_test
 
 import (
 	"io/ioutil"
 	"os"
 	"testing"
 
+	"github.com/ory/hydra-maester/helpers"
+
 	"github.com/stretchr/testify/require"
 )
 
 func TestCreateHttpClient(t *testing.T) {
 	t.Run("should create insecureSkipVerify client", func(t *testing.T) {
-		client := CreateHttpClient(true, "")
+		client, err := helpers.CreateHttpClient(true, "")
 		require.NotNil(t, client)
+		require.Nil(t, err)
 	})
 
 	t.Run("should create client with insecureSkipVerify and wrong tlsTrustStore", func(t *testing.T) {
 		tlsTrustStore := "some path"
-		client := CreateHttpClient(true, tlsTrustStore)
+		client, err := helpers.CreateHttpClient(true, tlsTrustStore)
 		require.Nil(t, client)
+		require.Nil(t, err)
 	})
 
 	t.Run("should create client with and tlsTrustStore", func(t *testing.T) {
 		file, err := ioutil.TempFile("/tmp", "test")
 		require.Nil(t, err)
-		client := CreateHttpClient(true, file.Name())
+		client, err := helpers.CreateHttpClient(true, file.Name())
 		defer os.Remove(file.Name())
 		require.NotNil(t, client)
+		require.Nil(t, err)
+	})
+
+	t.Run("should not create client with and wrong tlsTrustStore", func(t *testing.T) {
+		client, err := helpers.CreateHttpClient(true, "/somefile")
+		require.NotNil(t, client)
+		require.NotNil(t, err)
 	})
 
 	t.Run("should create client without and tlsTrustStore", func(t *testing.T) {
-		client := CreateHttpClient(true, "")
+		client, err := helpers.CreateHttpClient(true, "")
 		require.NotNil(t, client)
+		require.Nil(t, err)
 	})
 }

main.go

@@ -105,7 +105,7 @@ func main() {
 		}
 	}
 
-	hydraClient := getHydraClient(defaultSpec, tlsTrustStore, insecureSkipVerify)
+	hydraClient, err := getHydraClient(defaultSpec, tlsTrustStore, insecureSkipVerify)
 	if err != nil {
 		setupLog.Error(err, "making default hydra client", "controller", "OAuth2Client")
 		os.Exit(1)
@@ -130,22 +130,27 @@ func main() {
 	}
 }
 
-func getHydraClient(spec hydrav1alpha1.OAuth2ClientSpec, tlsTrustStore string, insecureSkipVerify bool) controllers.HydraClientInterface {
+func getHydraClient(spec hydrav1alpha1.OAuth2ClientSpec, tlsTrustStore string, insecureSkipVerify bool) (controllers.HydraClientInterface, error) {
 
 	address := fmt.Sprintf("%s:%d", spec.HydraAdmin.URL, spec.HydraAdmin.Port)
 	u, err := url.Parse(address)
 	if err != nil {
-		return nil
+		return nil, err
+	}
+
+	c, err := helpers.CreateHttpClient(insecureSkipVerify, tlsTrustStore)
+	if err != nil {
+		return nil, err
 	}
 
 	client := &hydra.Client{
 		HydraURL:   *u.ResolveReference(&url.URL{Path: spec.HydraAdmin.Endpoint}),
-		HTTPClient: helpers.CreateHttpClient(insecureSkipVerify, tlsTrustStore),
+		HTTPClient: c,
 	}
 
 	if spec.HydraAdmin.ForwardedProto != "" && spec.HydraAdmin.ForwardedProto != "off" {
 		client.ForwardedProto = spec.HydraAdmin.ForwardedProto
 	}
 
-	return client
+	return client, nil
 }