func main()

in tools/k8s-2-gsm/main.go [107:305]
106 lines of code
21 McCabe index (conditional complexity)

func main() {
	// check input flags and set variables accordingly
	flag.Parse()

	// use the default namespace if "" accidentally passed as --namespace="${UNSET VARIABLE}"
	if *namespace == "" {
		*namespace = "default"
	}

	// exit if project argument isn't set
	if *project == "" {
		log.Fatalf("❌ `--project=` is not defined in arguments")
	}

	// yell if dry-run is set
	if *dryrun {
		log.Println("🚨 WARNING: DRY RUN ONLY - NO ACTIONS PERFORMED")
		log.Println("===============================================")
	}

	// kick-off!
	log.Printf("📣 Starting migration script [namespace: '%s'] [project: '%s']:\n", *namespace, *project)

	// init the struct for client(s) re-use
	log.Println("Initializing clients:")
	c := newClient()

	// list secrets from a Kubernetes namespace (set by --namespace="" or defaults to "default")
	log.Printf("🔍 Listing all secrets from [namespace: '%s']", *namespace)
	secretsAll, err := c.listKubernetesSecrets(*namespace)
	if err != nil {
		log.Fatalf("Issue interacting with Kubernetes in [namespace: '%s': %v]", *namespace, err)
	}

	// fail and exit if results are empty
	if len(secretsAll.Items) == 0 {
		log.Printf("Error: Issue acquiring list of Kubernetes secrets in [namespace: '%s']", *namespace)
		log.Fatalf("❌ No secrets found to copy, no action taken")
	}

	// log the filtering taking place
	log.Printf("🪚 Filtering secret list to skip secrets of type 'kubernetes.io/service-account-token'")

	// create a "originalList" of secret names only - no data
	originalList := []string{}

	// start of clean-up, get a list of only the secrets we care to migrate
	for index, secret := range secretsAll.Items {

		// dump what is found if --debug is enabled
		if *debug {
			fmt.Printf("Found [%d]: %s\n", index+1, secret.Name)
		}

		// SKIP if the secret is a k8s service account token
		if secret.Type == "kubernetes.io/service-account-token" {
			if *debug {
				log.Printf("SKIPPED: ['%s'] is of type service-account-token", secret.Name)
			}
			continue
		}

		// build the array
		originalList = append(originalList, secret.Name)
	}

	// further list parsing to remove excludes
	log.Printf("🪚 Removing `--exclude` items ['%s']", *exclude)

	// separate the "--exclude" list and remove any found values from the originalList
	for _, excludeName := range strings.Split(*exclude, ",") {
		// remove item if found in originalList and excludeList by comparison
		originalList = remove(originalList, excludeName)
	}

	// fail if we have no objects to migrate
	if len(originalList) == 0 {
		log.Fatalf("❌ No secrets found to copy, no action taken")
	}

	// list after skipping / excluding any strings
	log.Printf("📋 List: %s\n", originalList)

	// define action for JSON data out
	var statusAction string

	// set if we are creating or deleting for list output
	if *delete {
		statusAction = "deleted"
	} else {
		statusAction = "created"
	}

	report := SecretsReportJSON{
		Action:        statusAction,
		MigrationDate: time.Now().UTC().Format("2006-01-02"),
		K8sSecretsMap: make(map[string][]SecretObject),
	}

	// range through the list of k8s secrets to migrate
	for _, secretName := range originalList {

		// get a k8s secretContent based on namespace and name
		secretContent, _ := c.getKubernetesSecret(*namespace, secretName)

		// copy k8s secret names to our reporting JSON object (for future nested secret objects)
		report.K8sSecretsMap[secretName] = make([]SecretObject, 0)

		// this returns a map of the secret object which can contain multiple files, as a result, let's parse through each one and create as needed
		for objName, objData := range secretContent.Data {

			// announce what's happening (either creating or deleting)
			if *delete {
				log.Printf("🚫 Deleting secret object(s) for ['%s']\n", secretContent.ObjectMeta.Name)
			} else {
				log.Printf("✅ Migrating secret object(s) for ['%s']\n", secretContent.ObjectMeta.Name)
			}

			// replace periods with dashes and create a new safe name [OPTIONAL PREFIX]-[NAMESPACE]-[SECRET NAME]-[OBJECT KEY NAME]
			safeSecretName := strings.ToLower(fmt.Sprintf(strings.Replace(*namespace, ".", "-", -1) + "-" + strings.Replace(secretName, ".", "-", -1) + "-" + strings.Replace(objName, ".", "-", -1)))

			// if there's a prefix passed, prepend it!
			safeSecretName = strings.Replace(*prefix, ".", "-", -1) + "-" + safeSecretName

			// create a random UUID to be used if needed to identify/track
			id := uuid.New()

			// append the k8s secret object to the secret name
			// this allows a single k8s secret to contain multiple (sub)objects
			report.K8sSecretsMap[secretName] = append(report.K8sSecretsMap[secretName], SecretObject{
				K8sNamespace:       *namespace,
				GCPProject:         *project,
				GSMName:            safeSecretName,
				K8sObjectName:      objName,
				ScriptGeneratedUID: id.String(),
			})

			// output what's being deleted
			if *delete {
				// don't actually delete anything if `--dry-run` is set
				if !*dryrun {

					// DELETION OF THE SECRET IN GOOGLE SECRET MANAGER
					c.deleteSecret(safeSecretName)
				}
				log.Printf("  - Deleted secret named ['%s'] in GCP project: ['%s'] \n", safeSecretName, *project)
				continue
			}

			// output more information on things being created, if --debug is set
			if *debug {
				log.Printf("Running createGoogleSecret() for Kubernetes secret ['%s'], from ['%s'] namespace, named ['%s'] in Google project ['%s'], using ['%v'] from the ['%s'] object key.\n", secretContent.ObjectMeta.Name, *namespace, safeSecretName, *project, string(objData), objName)
			}

			// if --dry-run is NOT set, create the secret
			if !*dryrun {

				// empty secrets shouldn't be created
				if string(objData) == "" {
					log.Printf("ERROR: ['%s'] in Kubernetes secret ['%s'] has an object value that is EMPTY... SKIPPING...\n", objName, secretContent.ObjectMeta.Name)
					continue
				}

				// CREATION OF THE SECRET IN GOOGLE SECRET MANAGER
				c.createGoogleSecret(safeSecretName, strings.ToLower(objName), id, objData)
			}
			log.Printf("  - Created secret named ['%s'] in GCP project: ['%s']\n", safeSecretName, *project)
		}
	}

	// adding a waitgroup to avoid data races when printing to stdout
	// A WaitGroup waits for a collection of goroutines to finish. The main goroutine calls Add to set the number of goroutines to wait for. Then each of the goroutines runs and calls Done when finished. At the same time, Wait can be used to block until all goroutines have finished.
	wg := new(sync.WaitGroup)
	// Increment the WaitGroup counter.
	wg.Add(1)

	// generate JSON data dump from report
	jsonReport(report)

	// close the report
	wg.Done()
	// Increment the WaitGroup counter & wait for the template to be generated
	wg.Add(1)

	// generate k8s (YAML) output
	// keeping "templates/" is important to dir structure (only bc, if built with `ko` it will use the symlink)
	createTemplate(report, "templates/secret-provider-class.tmpl")

	// close the template and run the rest (not conflicting)!
	wg.Done()

	// generate README help for migration
	// keeping "templates/" is important to dir structure (only bc, if built with `ko` it will use the symlink)
	createTemplate(report, "templates/helper-doc.tmpl")

	// Wait blocks until the WaitGroup counter is zero.
	wg.Wait()

}