@@ -67,67 +67,34 @@ var (
6767)
6868
6969// ResolveObjectStorageCredentials resolves Object Storage access and secret keys, tracking their source.
70- // Credentials are resolved in priority order:
71- // 1. Environment variables IONOS_S3_ACCESS_KEY / IONOS_S3_SECRET_KEY
72- // 2. s3AccessKey / s3SecretKey in the current ionosctl config profile
70+ // Both keys must come from the same source; mixing is not allowed. Priority order:
71+ // 1. Environment variables IONOS_S3_ACCESS_KEY / IONOS_S3_SECRET_KEY (both must be set)
72+ // 2. s3AccessKey / s3SecretKey in the current ionosctl config profile (both must be set)
7373func ResolveObjectStorageCredentials () (accessKey , secretKey string , akSrc ObjectStorageAccessKeySource , skSrc ObjectStorageSecretKeySource , err error ) {
74- src , cfgErr := retrieveConfigFile ()
75- if cfgErr != nil {
76- return accessKey , secretKey , akSrc , skSrc , fmt .Errorf ("failed to retrieve config file: %w" , cfgErr )
74+ // Priority 1: both from environment variables
75+ envAccessKey := os .Getenv (shared .IonosS3AccessKeyEnvVar )
76+ envSecretKey := os .Getenv (shared .IonosS3SecretKeyEnvVar )
77+ if envAccessKey != "" && envSecretKey != "" {
78+ return envAccessKey , envSecretKey , ObjectStorageAccessKeyEnv , ObjectStorageSecretKeyEnv , nil
7779 }
7880
79- accessKey = os .Getenv (shared .IonosS3AccessKeyEnvVar )
80- if accessKey != "" {
81- akSrc = ObjectStorageAccessKeyEnv
82- }
83-
84- secretKey = os .Getenv (shared .IonosS3SecretKeyEnvVar )
85- if secretKey != "" {
86- skSrc = ObjectStorageSecretKeyEnv
87- }
88-
89- // Fall back to config file if either key is missing
90- if accessKey == "" || secretKey == "" {
91- accessKey , akSrc , secretKey , skSrc = fillObjectStorageCredsFromConfig (src , accessKey , akSrc , secretKey , skSrc )
92- }
93-
94- if accessKey == "" {
95- akSrc = ObjectStorageAccessKeyNone
96- }
97- if secretKey == "" {
98- skSrc = ObjectStorageSecretKeyNone
81+ // Priority 2: both from config file
82+ src , cfgErr := retrieveConfigFile ()
83+ if cfgErr != nil {
84+ return "" , "" , ObjectStorageAccessKeyNone , ObjectStorageSecretKeyNone ,
85+ fmt .Errorf ("failed to retrieve config file: %w" , cfgErr )
9986 }
100-
101- if accessKey == "" || secretKey == "" {
102- return "" , "" , akSrc , skSrc , fmt .Errorf (
103- "object storage credentials not found. Set %s and %s environment variables, or configure s3AccessKey/s3SecretKey in your ionosctl profile" ,
104- shared .IonosS3AccessKeyEnvVar , shared .IonosS3SecretKeyEnvVar ,
105- )
87+ if src .Config != nil && src .Config .GetCurrentProfile () != nil {
88+ creds := src .Config .GetCurrentProfile ().Credentials
89+ if creds .S3AccessKey != "" && creds .S3SecretKey != "" {
90+ return creds .S3AccessKey , creds .S3SecretKey , ObjectStorageAccessKeyCfg , ObjectStorageSecretKeyCfg , nil
91+ }
10692 }
10793
108- return accessKey , secretKey , akSrc , skSrc , nil
109- }
110-
111- // fillObjectStorageCredsFromConfig fills in blank Object Storage access/secret keys from the config
112- // file's current profile, returning the (possibly updated) values and their sources.
113- func fillObjectStorageCredsFromConfig (
114- src ConfigSource ,
115- accessKey string , akSrc ObjectStorageAccessKeySource ,
116- secretKey string , skSrc ObjectStorageSecretKeySource ,
117- ) (string , ObjectStorageAccessKeySource , string , ObjectStorageSecretKeySource ) {
118- if src .Config == nil || src .Config .GetCurrentProfile () == nil {
119- return accessKey , akSrc , secretKey , skSrc
120- }
121- creds := src .Config .GetCurrentProfile ().Credentials
122- if accessKey == "" && creds .S3AccessKey != "" {
123- accessKey = creds .S3AccessKey
124- akSrc = ObjectStorageAccessKeyCfg
125- }
126- if secretKey == "" && creds .S3SecretKey != "" {
127- secretKey = creds .S3SecretKey
128- skSrc = ObjectStorageSecretKeyCfg
129- }
130- return accessKey , akSrc , secretKey , skSrc
94+ return "" , "" , ObjectStorageAccessKeyNone , ObjectStorageSecretKeyNone , fmt .Errorf (
95+ "object storage credentials not found. Set %s and %s environment variables, or configure s3AccessKey/s3SecretKey in your ionosctl profile" ,
96+ shared .IonosS3AccessKeyEnvVar , shared .IonosS3SecretKeyEnvVar ,
97+ )
13198}
13299
133100// newObjectStorageClient builds a new ObjectStorageClient for the given endpoint.
0 commit comments