refactor: move vault functions into own package

cli/cmd/beta_vault_secret.go

@@ -7,7 +7,7 @@ import (
 	"fmt"
 
 	packageio "github.com/codesphere-cloud/cs-go/pkg/io"
-	"github.com/codesphere-cloud/oms/internal/installer"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/util"
 	"github.com/spf13/cobra"
 	"k8s.io/apimachinery/pkg/runtime"
@@ -45,7 +45,8 @@ func (c *BetaVaultSecretCmd) RunE(_ *cobra.Command, _ []string) error {
 		return fmt.Errorf("failed to create kubernetes client: %w", err)
 	}
 
-	creator := installer.NewVaultSecretCreator(kubeClient)
+	creator := vault.NewVaultSecretCreator(kubeClient)
+
 	return creator.CreateSecretFromFile(c.cmd.Context(), c.Opts.VaultFile, c.Opts.AgeKeyPath, c.Opts.Namespace, c.Opts.SecretName)
 }
 

cli/cmd/init_install_config_test.go

@@ -13,6 +13,7 @@ import (
 	. "github.com/onsi/gomega"
 
 	"github.com/codesphere-cloud/oms/internal/installer"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/util"
 )
 
@@ -193,7 +194,7 @@ codesphere:
 			Expect(exec.Command("age-keygen", "-o", ageKeyPath).Run()).To(Succeed())
 			recipient, err := exec.Command("age-keygen", "-y", ageKeyPath).Output()
 			Expect(err).NotTo(HaveOccurred())
-			Expect(installer.EncryptFileWithSOPS(plaintextVaultPath, vaultFile.Name(), strings.TrimSpace(string(recipient)))).To(Succeed())
+			Expect(vault.EncryptFileWithSOPS(plaintextVaultPath, vaultFile.Name(), strings.TrimSpace(string(recipient)))).To(Succeed())
 			previousAgeKeyFile, hadPreviousAgeKeyFile := os.LookupEnv("SOPS_AGE_KEY_FILE")
 			Expect(os.Setenv("SOPS_AGE_KEY_FILE", ageKeyPath)).To(Succeed())
 			DeferCleanup(func() {

cli/cmd/install_codesphere.go

@@ -14,6 +14,7 @@ import (
 	"github.com/codesphere-cloud/oms/internal/installer"
 	"github.com/codesphere-cloud/oms/internal/installer/argocd"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/util"
 	"github.com/spf13/cobra"
 	"go.yaml.in/yaml/v3"
@@ -166,7 +167,7 @@ func prepareInstallConfig(opts *InstallCodesphereOpts, cm installer.ConfigManage
 		return nil, files.RootConfig{}, func() {}, fmt.Errorf("no config.yaml input provided: at least one config file is required")
 	}
 
-	store := installer.NewLazyVaultTemplatingSecretStore(opts.Vault, opts.PrivKey)
+	store := vault.NewLazyVaultTemplatingSecretStore(opts.Vault, opts.PrivKey)
 	cleanupFns := []func(){}
 	cleanup := func() {
 		for i := len(cleanupFns) - 1; i >= 0; i-- {

cli/cmd/install_codesphere_config_test.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/codesphere-cloud/oms/internal/installer"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 )
@@ -149,21 +150,21 @@ pcApps:
       targetRevision: '{{ secret "pcAppsRevision" }}'
 `), 0644)).To(Succeed())
 
-		vault := &files.InstallVault{
+		testVault := &files.InstallVault{
 			Secrets: []files.SecretEntry{
 				{Name: "dcCity", File: &files.SecretFile{Content: "Templated City"}},
 				{Name: "baseDomain", File: &files.SecretFile{Content: "templated.example.com"}},
 				{Name: "dcName", File: &files.SecretFile{Content: "dc-from-vault"}},
 				{Name: "pcAppsRevision", File: &files.SecretFile{Content: "from-vault"}},
 			},
 		}
-		vaultYAML, err := vault.Marshal()
+		vaultYAML, err := testVault.Marshal()
 		Expect(err).ToNot(HaveOccurred())
 		Expect(os.WriteFile(plaintextVaultPath, vaultYAML, 0600)).To(Succeed())
 		Expect(exec.Command("age-keygen", "-o", ageKeyPath).Run()).To(Succeed())
 		recipient, err := exec.Command("age-keygen", "-y", ageKeyPath).Output()
 		Expect(err).ToNot(HaveOccurred())
-		Expect(installer.EncryptFileWithSOPS(plaintextVaultPath, vaultPath, strings.TrimSpace(string(recipient)))).To(Succeed())
+		Expect(vault.EncryptFileWithSOPS(plaintextVaultPath, vaultPath, strings.TrimSpace(string(recipient)))).To(Succeed())
 
 		opts := &InstallCodesphereOpts{
 			Configs: []string{basePath, overlayPath},

cli/cmd/install_codesphere_dependencies.go

@@ -16,6 +16,7 @@ import (
 	argocdinstaller "github.com/codesphere-cloud/oms/internal/installer/argocd"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
 	"github.com/codesphere-cloud/oms/internal/installer/secrets"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/system"
 	"github.com/spf13/cobra"
 	"k8s.io/client-go/rest"
@@ -168,8 +169,8 @@ func (i *argoCDAndAppsInstall) syncVaultSecret() error {
 	if err := secrets.EnsureServiceAccountTokens(i.vault); err != nil {
 		return fmt.Errorf("failed to ensure service account tokens: %w", err)
 	}
-	creator := installer.NewVaultSecretCreator(i.kubeClient)
-	if err := creator.CreateSecretFromVault(i.ctx, i.vault, installer.VaultSecretNamespace, installer.VaultSecretName); err != nil {
+	creator := vault.NewVaultSecretCreator(i.kubeClient)
+	if err := creator.CreateSecretFromVault(i.ctx, i.vault, vault.VaultSecretNamespace, vault.VaultSecretName); err != nil {
 		return fmt.Errorf("failed to sync vault secret: %w", err)
 	}
 	return nil

cli/cmd/install_k0s.go

@@ -15,6 +15,7 @@ import (
 	"github.com/codesphere-cloud/oms/internal/env"
 	"github.com/codesphere-cloud/oms/internal/installer"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/portal"
 	"github.com/codesphere-cloud/oms/internal/util"
 )
@@ -287,13 +288,13 @@ func (c *InstallK0sCmd) writeEncryptedVault(vaultYAML []byte) error {
 		return fmt.Errorf("failed to write temporary vault file: %w", err)
 	}
 
-	recipient, _, err := installer.ResolveAgeKey(c.Opts.VaultPrivKey, "")
+	recipient, _, err := vault.ResolveAgeKey(c.Opts.VaultPrivKey, "")
 	if err != nil {
 		_ = c.FileWriter.Remove(tmpPath)
 		return fmt.Errorf("failed to resolve age key for vault rencryption: %w", err)
 	}
 
-	if err := installer.EncryptFileWithSOPS(tmpPath, c.Opts.Vault, recipient); err != nil {
+	if err := vault.EncryptFileWithSOPS(tmpPath, c.Opts.Vault, recipient); err != nil {
 		_ = c.FileWriter.Remove(tmpPath)
 		return fmt.Errorf("failed to encrypt vault file: %w", err)
 	}
@@ -307,12 +308,12 @@ func (c *InstallK0sCmd) loadOrCreateVault() (*files.InstallVault, bool, error) {
 		return &files.InstallVault{}, false, nil
 	}
 
-	wasEncrypted, err := installer.IsSOPSEncryptedFile(c.Opts.Vault)
+	wasEncrypted, err := vault.IsSOPSEncryptedFile(c.Opts.Vault)
 	if err != nil {
 		return nil, false, fmt.Errorf("failed to check if vault is encrypted: %w", err)
 	}
 
-	vault, err := installer.LoadVaultData(c.Opts.Vault, c.Opts.VaultPrivKey)
+	vault, err := vault.LoadVaultData(c.Opts.Vault, c.Opts.VaultPrivKey)
 	if err != nil {
 		return nil, false, fmt.Errorf("failed to load vault: %w", err)
 	}

cli/cmd/install_k0s_test.go

@@ -18,6 +18,7 @@ import (
 	"github.com/codesphere-cloud/oms/internal/env"
 	"github.com/codesphere-cloud/oms/internal/installer"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/util"
 )
 
@@ -418,7 +419,7 @@ var _ = Describe("InstallK0sCmd", func() {
 				Expect(err).NotTo(HaveOccurred(), string(encryptOut))
 				Expect(os.Remove(plainPath)).To(Succeed())
 
-				encrypted, err := installer.IsSOPSEncryptedFile(vaultPath)
+				encrypted, err := vault.IsSOPSEncryptedFile(vaultPath)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(encrypted).To(BeTrue())
 
@@ -439,7 +440,7 @@ var _ = Describe("InstallK0sCmd", func() {
 				Expect(err).NotTo(HaveOccurred())
 
 				// Verify the vault was re-encrypted after saving kubeconfig.
-				encrypted, err = installer.IsSOPSEncryptedFile(vaultPath)
+				encrypted, err = vault.IsSOPSEncryptedFile(vaultPath)
 				Expect(err).NotTo(HaveOccurred())
 				Expect(encrypted).To(BeTrue(), "vault should be re-encrypted after saving kubeconfig")
 

cli/cmd/install_openbao.go

@@ -22,6 +22,7 @@ import (
 	"github.com/spf13/cobra"
 
 	"github.com/codesphere-cloud/oms/internal/installer"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/util"
 )
 
@@ -59,7 +60,7 @@ func (c *InstallOpenBaoCmd) RunE(_ *cobra.Command, _ []string) error {
 	// Pass --age-key-file explicitly so ResolveAgeKey prefers it without
 	// mutating the process environment. When empty, the normal
 	// auto-discovery chain (env vars, default location, generation) applies.
-	recipient, keyPath, err := installer.ResolveAgeKey(c.Opts.AgeKeyFile, fallbackDir)
+	recipient, keyPath, err := vault.ResolveAgeKey(c.Opts.AgeKeyFile, fallbackDir)
 	if err != nil {
 		return fmt.Errorf("resolving age key: %w", err)
 	}

cli/cmd/template_config.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/codesphere-cloud/cs-go/pkg/io"
 	"github.com/codesphere-cloud/oms/internal/configtemplating"
-	"github.com/codesphere-cloud/oms/internal/installer"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/util"
 	"github.com/spf13/cobra"
 )
@@ -95,7 +95,7 @@ func (c *TemplateConfigCmd) Render() ([]byte, error) {
 		return nil, fmt.Errorf("failed to read config file %s: %w", c.Opts.Config, err)
 	}
 
-	store := installer.NewLazyVaultTemplatingSecretStore(c.Opts.Vault, c.Opts.AgeKey)
+	store := vault.NewLazyVaultTemplatingSecretStore(c.Opts.Vault, c.Opts.AgeKey)
 	rendered, err := configtemplating.RenderInstallConfigTemplate(data, store)
 	if err != nil {
 		return nil, fmt.Errorf("failed to render config template: %w", err)

cli/cmd/template_config_test.go

@@ -11,8 +11,8 @@ import (
 	"strings"
 
 	"github.com/codesphere-cloud/oms/cli/cmd"
-	"github.com/codesphere-cloud/oms/internal/installer"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -43,7 +43,7 @@ postgres:
 `), 0644)).To(Succeed())
 		Expect(exec.Command("age-keygen", "-o", ageKeyPath).Run()).To(Succeed())
 
-		vault := &files.InstallVault{
+		testVault := &files.InstallVault{
 			Secrets: []files.SecretEntry{
 				{
 					Name: "codesphereLicenseKey",
@@ -58,12 +58,12 @@ postgres:
 				},
 			},
 		}
-		vaultYaml, err := vault.Marshal()
+		vaultYaml, err := testVault.Marshal()
 		Expect(err).NotTo(HaveOccurred())
 		Expect(os.WriteFile(plaintextVaultPath, vaultYaml, 0600)).To(Succeed())
 		recipient, err := exec.Command("age-keygen", "-y", ageKeyPath).Output()
 		Expect(err).NotTo(HaveOccurred())
-		Expect(installer.EncryptFileWithSOPS(plaintextVaultPath, vaultPath, strings.TrimSpace(string(recipient)))).To(Succeed())
+		Expect(vault.EncryptFileWithSOPS(plaintextVaultPath, vaultPath, strings.TrimSpace(string(recipient)))).To(Succeed())
 
 		rootCmd := cmd.GetRootCmd()
 		var output bytes.Buffer

cli/cmd/update_install_config_test.go

@@ -16,6 +16,7 @@ import (
 	"github.com/codesphere-cloud/oms/internal/installer"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
 	"github.com/codesphere-cloud/oms/internal/installer/secrets"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 )
 
 func quoteYAMLString(s string) string {
@@ -193,7 +194,7 @@ codesphere:
 		Expect(exec.Command("age-keygen", "-o", ageKeyPath).Run()).To(Succeed())
 		recipient, err := exec.Command("age-keygen", "-y", ageKeyPath).Output()
 		Expect(err).NotTo(HaveOccurred())
-		Expect(installer.EncryptFileWithSOPS(plaintextVaultPath, vaultFile.Name(), strings.TrimSpace(string(recipient)))).To(Succeed())
+		Expect(vault.EncryptFileWithSOPS(plaintextVaultPath, vaultFile.Name(), strings.TrimSpace(string(recipient)))).To(Succeed())
 		previousAgeKeyFile, hadPreviousAgeKeyFile := os.LookupEnv("SOPS_AGE_KEY_FILE")
 		Expect(os.Setenv("SOPS_AGE_KEY_FILE", ageKeyPath)).To(Succeed())
 		DeferCleanup(func() {

internal/bootstrap/local/local.go

@@ -16,6 +16,7 @@ import (
 	"github.com/codesphere-cloud/oms/internal/installer"
 	"github.com/codesphere-cloud/oms/internal/installer/argocd"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/util"
 	corev1 "k8s.io/api/core/v1"
 	apierrors "k8s.io/apimachinery/pkg/api/errors"
@@ -384,7 +385,6 @@ func (b *LocalBootstrapper) ReadClusterCIDRs() (podCIDR string, serviceCIDR stri
 		log.Printf("can't read service CIDR from cluster, trying proc filesystem next: %s", err)
 
 		serviceCIDR, err = b.readServiceCIDRFromProc()
-
 		if err != nil {
 			err = fmt.Errorf("failed to determine service CIDR: %w", err)
 		}
@@ -518,7 +518,7 @@ func (b *LocalBootstrapper) EnsureSecrets() error {
 }
 
 func (b *LocalBootstrapper) ResolveAgeKey() error {
-	recipient, keyPath, err := installer.ResolveAgeKey("", filepath.Dir(b.Env.SecretsFilePath))
+	recipient, keyPath, err := vault.ResolveAgeKey("", filepath.Dir(b.Env.SecretsFilePath))
 	if err != nil {
 		return fmt.Errorf("failed to resolve age key: %w", err)
 	}
@@ -655,12 +655,12 @@ func (b *LocalBootstrapper) UpdateInstallConfig() (err error) {
 	if err := b.icg.WriteVault(b.Env.SecretsFilePath, true); err != nil {
 		return fmt.Errorf("failed to write vault file: %w", err)
 	}
-	if err := installer.EncryptFileWithSOPS(b.Env.SecretsFilePath, filepath.Join(b.Env.InstallConfig.Secrets.BaseDir, "prod.vault.yaml"), b.ageRecipient); err != nil {
+	if err := vault.EncryptFileWithSOPS(b.Env.SecretsFilePath, filepath.Join(b.Env.InstallConfig.Secrets.BaseDir, "prod.vault.yaml"), b.ageRecipient); err != nil {
 		return fmt.Errorf("failed to encrypt vault file: %w", err)
 	}
 
-	creator := installer.NewVaultSecretCreator(b.kubeClient)
-	if err := creator.CreateSecretFromVault(b.ctx, b.icg.GetVault(), installer.VaultSecretNamespace, installer.VaultSecretName); err != nil {
+	creator := vault.NewVaultSecretCreator(b.kubeClient)
+	if err := creator.CreateSecretFromVault(b.ctx, b.icg.GetVault(), vault.VaultSecretNamespace, vault.VaultSecretName); err != nil {
 		return fmt.Errorf("failed to create vault secret: %w", err)
 	}
 

internal/installer/cluster_admin.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/codesphere-cloud/oms/internal/clusteradmin"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/util"
 	"k8s.io/client-go/rest"
 	"k8s.io/client-go/tools/clientcmd"
@@ -22,9 +23,11 @@ func ResolveVaultPath(vaultPath string, config files.RootConfig) (string, error)
 	if strings.TrimSpace(vaultPath) != "" {
 		return vaultPath, nil
 	}
+
 	if strings.TrimSpace(config.Secrets.BaseDir) == "" {
 		return "", fmt.Errorf("vault path is not set and config.yaml secrets.baseDir is empty")
 	}
+
 	return filepath.Join(config.Secrets.BaseDir, "prod.vault.yaml"), nil
 }
 
@@ -36,29 +39,35 @@ func VaultAndRESTConfig(vaultPath, privKey string, cfg files.RootConfig) (*files
 	if err != nil {
 		return nil, nil, err
 	}
-	vault, err := LoadVaultData(resolvedPath, privKey)
+
+	vault, err := vault.LoadVaultData(resolvedPath, privKey)
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to load vault %s: %w", resolvedPath, err)
 	}
+
 	kubeConfigContent, err := kubeConfigContentFromVault(vault)
 	if err != nil {
 		return nil, nil, err
 	}
+
 	restConfig, err := clientcmd.RESTConfigFromKubeConfig([]byte(kubeConfigContent))
 	if err != nil {
 		return nil, nil, fmt.Errorf("failed to load kubernetes config from vault: %w", err)
 	}
+
 	return vault, restConfig, nil
 }
 
 func kubeConfigContentFromVault(vault *files.InstallVault) (string, error) {
 	if vault == nil {
 		return "", fmt.Errorf("vault is not loaded")
 	}
+
 	kubeConfig := vault.GetSecret(files.SecretKubeConfig)
 	if kubeConfig == nil || kubeConfig.File == nil || strings.TrimSpace(kubeConfig.File.Content) == "" {
 		return "", fmt.Errorf("kubeconfig not found in vault (secret %q)", files.SecretKubeConfig)
 	}
+
 	return kubeConfig.File.Content, nil
 }
 

internal/installer/codesphere.go

@@ -17,6 +17,7 @@ import (
 
 	"github.com/codesphere-cloud/oms/internal/configtemplating"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/system"
 	"github.com/codesphere-cloud/oms/internal/util"
 )
@@ -121,7 +122,7 @@ func (ci *CodesphereInstaller) prepareConfig(cm ConfigManager) (files.RootConfig
 	}
 
 	if ci.VaultPath != "" {
-		store := NewLazyVaultTemplatingSecretStore(ci.VaultPath, ci.PrivKey)
+		store := vault.NewLazyVaultTemplatingSecretStore(ci.VaultPath, ci.PrivKey)
 		renderedConfig, renderCleanup, err := configtemplating.RenderConfigFileToTemp(ci.ConfigPath, store)
 		if err != nil {
 			return files.RootConfig{}, cleanup, fmt.Errorf("failed to render config template: %w", err)

internal/installer/config_manager.go

@@ -11,6 +11,7 @@ import (
 
 	"github.com/codesphere-cloud/oms/internal/configtemplating"
 	"github.com/codesphere-cloud/oms/internal/installer/files"
+	"github.com/codesphere-cloud/oms/internal/installer/vault"
 	"github.com/codesphere-cloud/oms/internal/util"
 )
 
@@ -68,7 +69,7 @@ func (g *InstallConfig) LoadInstallConfigFromFile(configPath string) error {
 		return fmt.Errorf("failed to read %s: %w", configPath, err)
 	}
 
-	store := NewVaultTemplatingSecretStore(g.Vault)
+	store := vault.NewVaultTemplatingSecretStore(g.Vault)
 	data, err = configtemplating.RenderInstallConfigTemplate(data, store)
 	if err != nil {
 		return err
@@ -84,7 +85,7 @@ func (g *InstallConfig) LoadInstallConfigFromFile(configPath string) error {
 }
 
 func (g *InstallConfig) LoadVaultFromFile(vaultPath string) error {
-	vault, err := LoadVaultData(vaultPath, "")
+	vault, err := vault.LoadVaultData(vaultPath, "")
 	if err != nil {
 		return err
 	}