func CreateJWTFromSecret(ctx context.Context, cachedSecrets secret.ReadInterface, secrets secret.ModInterface, tokenSecretName, secretSecretName string, claims map[string]interface{}, ownerRef *meta.OwnerReference) error {
	secret, err := GetTokenSecret(ctx, cachedSecrets, secretSecretName)
	if err != nil {
		return errors.WithStack(err)
	}
	token := jg.NewWithClaims(jg.SigningMethodHS256, jg.MapClaims(claims))
	signedToken, err := token.SignedString([]byte(secret))
	if err != nil {
		return errors.WithStack(err)
	}
	return RunWithTimeout(ctx, func(ctxChild context.Context) error {
		return CreateTokenSecret(ctxChild, secrets, tokenSecretName, signedToken, ownerRef)
	})
}
CreateJWTFromSecret creates a JWT using the secret stored in secretSecretName and stores the
result in a new secret called tokenSecretName
package k8sutil
import (
	"context"
	"github.com/arangodb/kube-arangodb/pkg/util/k8sutil/inspector/secret"
	"github.com/arangodb/kube-arangodb/pkg/util/constants"
	"github.com/arangodb/kube-arangodb/pkg/util/errors"
	jg "github.com/golang-jwt/jwt"
	core "k8s.io/api/core/v1"
	meta "k8s.io/apimachinery/pkg/apis/meta/v1"
)
func ValidateEncryptionKeySecret(secrets secret.Interface, secretName string) error {
	s, err := secrets.Get(context.Background(), secretName, meta.GetOptions{})
	if err != nil {
		return errors.WithStack(err)
	}
	return ValidateEncryptionKeyFromSecret(s)
}
func ValidateEncryptionKeyFromSecret(s *core.Secret) error {
	keyData, found := s.Data[constants.SecretEncryptionKey]
	if !found {
		return errors.WithStack(errors.Newf("No '%s' found in secret '%s'", constants.SecretEncryptionKey, s.GetName()))
	}
	if len(keyData) != 32 {
		return errors.WithStack(errors.Newf("'%s' in secret '%s' is expected to be 32 bytes long, found %d", constants.SecretEncryptionKey, s.GetName(), len(keyData)))
	}
	return nil
}
func CreateEncryptionKeySecret(secrets secret.ModInterface, secretName string, key []byte) error {
	if len(key) != 32 {
		return errors.WithStack(errors.Newf("Key in secret '%s' is expected to be 32 bytes long, got %d", secretName, len(key)))
	}
	secret := &core.Secret{
		ObjectMeta: meta.ObjectMeta{
			Name: secretName,
		},
		Data: map[string][]byte{
			constants.SecretEncryptionKey: key,
		},
	}
	if _, err := secrets.Create(context.Background(), secret, meta.CreateOptions{}); err != nil {
		return errors.WithStack(err)
	}
	return nil
}
func ValidateCACertificateSecret(ctx context.Context, secrets secret.ReadInterface, secretName string) error {
	s, err := secrets.Get(ctx, secretName, meta.GetOptions{})
	if err != nil {
		return errors.WithStack(err)
	}
	_, found := s.Data[constants.SecretCACertificate]
	if !found {
		return errors.WithStack(errors.Newf("No '%s' found in secret '%s'", constants.SecretCACertificate, secretName))
	}
	return nil
}
func GetCACertficateSecret(ctx context.Context, secrets secret.Interface, secretName string) (string, error) {
	ctxChild, cancel := context.WithTimeout(ctx, GetRequestTimeout())
	defer cancel()
	s, err := secrets.Get(ctxChild, secretName, meta.GetOptions{})
	if err != nil {
		return "", errors.WithStack(err)
	}
	cert, found := s.Data[constants.SecretCACertificate]
	if !found {
		return "", errors.WithStack(errors.Newf("No '%s' found in secret '%s'", constants.SecretCACertificate, secretName))
	}
	return string(cert), nil
}
func GetCASecret(ctx context.Context, secrets secret.ReadInterface, secretName string,
	ownerRef *meta.OwnerReference) (string, string, bool, error) {
	s, err := secrets.Get(ctx, secretName, meta.GetOptions{})
	if err != nil {
		return "", "", false, errors.WithStack(err)
	}
	return GetCAFromSecret(s, ownerRef)
}
func GetCAFromSecret(s *core.Secret, ownerRef *meta.OwnerReference) (string, string, bool, error) {
	isOwned := false
	if ownerRef != nil {
		for _, x := range s.GetOwnerReferences() {
			if x.UID == ownerRef.UID {
				isOwned = true
				break
			}
		}
	}
	cert, found := s.Data[constants.SecretCACertificate]
	if !found {
		return "", "", isOwned, errors.WithStack(errors.Newf("No '%s' found in secret '%s'", constants.SecretCACertificate, s.GetName()))
	}
	priv, found := s.Data[constants.SecretCAKey]
	if !found {
		return "", "", isOwned, errors.WithStack(errors.Newf("No '%s' found in secret '%s'", constants.SecretCAKey, s.GetName()))
	}
	return string(cert), string(priv), isOwned, nil
}
func CreateCASecret(ctx context.Context, secrets secret.ModInterface, secretName string, certificate, key string,
	ownerRef *meta.OwnerReference) error {
	secret := &core.Secret{
		ObjectMeta: meta.ObjectMeta{
			Name: secretName,
		},
		Data: map[string][]byte{
			constants.SecretCACertificate: []byte(certificate),
			constants.SecretCAKey:         []byte(key),
		},
	}
	AddOwnerRefToObject(secret, ownerRef)
	if _, err := secrets.Create(ctx, secret, meta.CreateOptions{}); err != nil {
		return errors.WithStack(err)
	}
	return nil
}
func GetTLSKeyfileSecret(secrets secret.ReadInterface, secretName string) (string, error) {
	s, err := secrets.Get(context.Background(), secretName, meta.GetOptions{})
	if err != nil {
		return "", errors.WithStack(err)
	}
	return GetTLSKeyfileFromSecret(s)
}
func GetTLSKeyfileFromSecret(s *core.Secret) (string, error) {
	keyfile, found := s.Data[constants.SecretTLSKeyfile]
	if !found {
		return "", errors.WithStack(errors.Newf("No '%s' found in secret '%s'", constants.SecretTLSKeyfile, s.GetName()))
	}
	return string(keyfile), nil
}
func CreateTLSKeyfileSecret(ctx context.Context, secrets secret.ModInterface, secretName string, keyfile string,
	ownerRef *meta.OwnerReference) error {
	secret := &core.Secret{
		ObjectMeta: meta.ObjectMeta{
			Name: secretName,
		},
		Data: map[string][]byte{
			constants.SecretTLSKeyfile: []byte(keyfile),
		},
	}
	AddOwnerRefToObject(secret, ownerRef)
	if _, err := secrets.Create(ctx, secret, meta.CreateOptions{}); err != nil {
		return errors.WithStack(err)
	}
	return nil
}
func ValidateTokenSecret(ctx context.Context, secrets secret.ReadInterface, secretName string) error {
	s, err := secrets.Get(ctx, secretName, meta.GetOptions{})
	if err != nil {
		return errors.WithStack(err)
	}
	return ValidateTokenFromSecret(s)
}
func ValidateTokenFromSecret(s *core.Secret) error {
	_, found := s.Data[constants.SecretKeyToken]
	if !found {
		return errors.WithStack(errors.Newf("No '%s' found in secret '%s'", constants.SecretKeyToken, s.GetName()))
	}
	return nil
}
func GetTokenSecret(ctx context.Context, secrets secret.ReadInterface, secretName string) (string, error) {
	s, err := secrets.Get(ctx, secretName, meta.GetOptions{})
	if err != nil {
		return "", errors.WithStack(err)
	}
	return GetTokenFromSecret(s)
}
func GetTokenFromSecret(s *core.Secret) (string, error) {
	data, found := s.Data[constants.SecretKeyToken]
	if !found {
		return "", errors.WithStack(errors.Newf("No '%s' data found in secret '%s'", constants.SecretKeyToken, s.GetName()))
	}
	return string(data), nil
}
func CreateTokenSecret(ctx context.Context, secrets secret.ModInterface, secretName, token string,
	ownerRef *meta.OwnerReference) error {
	secret := &core.Secret{
		ObjectMeta: meta.ObjectMeta{
			Name: secretName,
		},
		Data: map[string][]byte{
			constants.SecretKeyToken: []byte(token),
		},
	}
	AddOwnerRefToObject(secret, ownerRef)
	if _, err := secrets.Create(ctx, secret, meta.CreateOptions{}); err != nil {
		return errors.WithStack(err)
	}
	return nil
}
func CreateJWTTokenFromSecret(secret string, claims map[string]interface{}) (string, error) {
	token := jg.NewWithClaims(jg.SigningMethodHS256, jg.MapClaims(claims))
	signedToken, err := token.SignedString([]byte(secret))
	if err != nil {
		return "", errors.WithStack(err)
	}
	return signedToken, nil
}