Skip to content

Commit

Permalink
Merge pull request #1150 from ashley-cui/secretsapi
Browse files Browse the repository at this point in the history 
Use StoreOpts for secret store API
  • Loading branch information
@openshift-merge-robot
openshift-merge-robot authored Sep 9, 2022
2 parents 0c45a3f + f59b942 commit e568579
Show file tree
Hide file tree
Showing 2 changed files with 82 additions and 28 deletions.
32 changes: 24 additions & 8 deletions pkg/secrets/secrets.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -80,7 +80,7 @@ type Secret struct {
CreatedAt time.Time `json:"createdAt"`
// Driver is the driver used to store secret data
Driver string `json:"driver"`
// DriverOptions is other metadata needed to use the driver
// DriverOptions are extra options used to run this driver
DriverOptions map[string]string `json:"driverOptions"`
}

Expand All @@ -102,6 +102,16 @@ type SecretsDriver interface {
Delete(id string) error
}

// StoreOptions are optional metadata fields that can be set when storing a new secret
type StoreOptions struct {
// DriverOptions are extra options used to run this driver
DriverOpts map[string]string
// Metadata stores extra metadata on the secret
Metadata map[string]string
// Labels are labels on the secret
Labels map[string]string
}

// NewManager creates a new secrets manager
// rootPath is the directory where the secrets data file resides
func NewManager(rootPath string) (*SecretsManager, error) {
Expand Down Expand Up @@ -131,7 +141,7 @@ func NewManager(rootPath string) (*SecretsManager, error) {
// Store takes a name, creates a secret and stores the secret metadata and the secret payload.
// It returns a generated ID that is associated with the secret.
// The max size for secret data is 512kB.
func (s *SecretsManager) Store(name string, data []byte, driverType string, driverOpts map[string]string, metadata map[string]string, labels map[string]string) (string, error) {
func (s *SecretsManager) Store(name string, data []byte, driverType string, options StoreOptions) (string, error) {
err := validateSecretName(name)
if err != nil {
return "", err
Expand Down Expand Up @@ -170,17 +180,23 @@ func (s *SecretsManager) Store(name string, data []byte, driverType string, driv
}
}

if metadata == nil {
metadata = make(map[string]string)
if options.Metadata == nil {
options.Metadata = make(map[string]string)
}
if options.Labels == nil {
options.Labels = make(map[string]string)
}
if options.DriverOpts == nil {
options.DriverOpts = make(map[string]string)
}

secr.Driver = driverType
secr.Metadata = metadata
secr.Metadata = options.Metadata
secr.CreatedAt = time.Now()
secr.DriverOptions = driverOpts
secr.Labels = labels
secr.DriverOptions = options.DriverOpts
secr.Labels = options.Labels

driver, err := getDriver(driverType, driverOpts)
driver, err := getDriver(driverType, options.DriverOpts)
if err != nil {
return "", err
}
Expand Down
78 changes: 58 additions & 20 deletions pkg/secrets/secrets_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,7 +39,13 @@ func TestAddSecretAndLookupData(t *testing.T) {
labels["foo"] = "bar"
labels["another"] = "label"

_, err = manager.Store("mysecret", []byte("mydata"), drivertype, opts, metaData, labels)
storeOpts := StoreOptions{
DriverOpts: opts,
Metadata: metaData,
Labels: labels,
}

_, err = manager.Store("mysecret", []byte("mydata"), drivertype, storeOpts)
require.NoError(t, err)

_, err = manager.lookupSecret("mysecret")
Expand All @@ -66,29 +72,33 @@ func TestAddSecretName(t *testing.T) {
require.NoError(t, err)
defer cleanup(testpath)

storeOpts := StoreOptions{
DriverOpts: opts,
}

// test one char secret name
_, err = manager.Store("a", []byte("mydata"), drivertype, opts, nil, nil)
_, err = manager.Store("a", []byte("mydata"), drivertype, storeOpts)
require.NoError(t, err)

_, err = manager.lookupSecret("a")
require.NoError(t, err)

// name too short
_, err = manager.Store("", []byte("mydata"), drivertype, opts, nil, nil)
_, err = manager.Store("", []byte("mydata"), drivertype, storeOpts)
require.Error(t, err)
// name too long
_, err = manager.Store("uatqsbssrapurkuqoapubpifvsrissslzjehalxcesbhpxcvhsozlptrmngrivaiz", []byte("mydata"), drivertype, opts, nil, nil)
_, err = manager.Store("uatqsbssrapurkuqoapubpifvsrissslzjehalxcesbhpxcvhsozlptrmngrivaiz", []byte("mydata"), drivertype, storeOpts)
require.Error(t, err)
// invalid chars
_, err = manager.Store("??", []byte("mydata"), drivertype, opts, nil, nil)
_, err = manager.Store("??", []byte("mydata"), drivertype, storeOpts)
require.Error(t, err)
_, err = manager.Store("-a", []byte("mydata"), drivertype, opts, nil, nil)
_, err = manager.Store("-a", []byte("mydata"), drivertype, storeOpts)
require.Error(t, err)
_, err = manager.Store("a-", []byte("mydata"), drivertype, opts, nil, nil)
_, err = manager.Store("a-", []byte("mydata"), drivertype, storeOpts)
require.Error(t, err)
_, err = manager.Store(".a", []byte("mydata"), drivertype, opts, nil, nil)
_, err = manager.Store(".a", []byte("mydata"), drivertype, storeOpts)
require.Error(t, err)
_, err = manager.Store("a.", []byte("mydata"), drivertype, opts, nil, nil)
_, err = manager.Store("a.", []byte("mydata"), drivertype, storeOpts)
require.Error(t, err)
}

Expand All @@ -97,10 +107,14 @@ func TestAddMultipleSecrets(t *testing.T) {
require.NoError(t, err)
defer cleanup(testpath)

id, err := manager.Store("mysecret", []byte("mydata"), drivertype, opts, nil, nil)
storeOpts := StoreOptions{
DriverOpts: opts,
}

id, err := manager.Store("mysecret", []byte("mydata"), drivertype, storeOpts)
require.NoError(t, err)

id2, err := manager.Store("mysecret2", []byte("mydata2"), drivertype, opts, nil, nil)
id2, err := manager.Store("mysecret2", []byte("mydata2"), drivertype, storeOpts)
require.NoError(t, err)

secrets, err := manager.List()
Expand Down Expand Up @@ -131,10 +145,14 @@ func TestAddSecretDupName(t *testing.T) {
require.NoError(t, err)
defer cleanup(testpath)

_, err = manager.Store("mysecret", []byte("mydata"), drivertype, opts, nil, nil)
storeOpts := StoreOptions{
DriverOpts: opts,
}

_, err = manager.Store("mysecret", []byte("mydata"), drivertype, storeOpts)
require.NoError(t, err)

_, err = manager.Store("mysecret", []byte("mydata"), drivertype, opts, nil, nil)
_, err = manager.Store("mysecret", []byte("mydata"), drivertype, storeOpts)
require.Error(t, err)
}

Expand All @@ -143,12 +161,16 @@ func TestAddSecretPrefix(t *testing.T) {
require.NoError(t, err)
defer cleanup(testpath)

storeOpts := StoreOptions{
DriverOpts: opts,
}

// If the randomly generated secret id is something like "abcdeiuoergnadufigh"
// we should still allow someone to store a secret with the name "abcd" or "a"
secretID, err := manager.Store("mysecret", []byte("mydata"), drivertype, opts, nil, nil)
secretID, err := manager.Store("mysecret", []byte("mydata"), drivertype, storeOpts)
require.NoError(t, err)

_, err = manager.Store(secretID[0:5], []byte("mydata"), drivertype, opts, nil, nil)
_, err = manager.Store(secretID[0:5], []byte("mydata"), drivertype, storeOpts)
require.NoError(t, err)
}

Expand All @@ -157,7 +179,11 @@ func TestRemoveSecret(t *testing.T) {
require.NoError(t, err)
defer cleanup(testpath)

_, err = manager.Store("mysecret", []byte("mydata"), drivertype, opts, nil, nil)
storeOpts := StoreOptions{
DriverOpts: opts,
}

_, err = manager.Store("mysecret", []byte("mydata"), drivertype, storeOpts)
require.NoError(t, err)

_, err = manager.lookupSecret("mysecret")
Expand Down Expand Up @@ -187,7 +213,11 @@ func TestLookupAllSecrets(t *testing.T) {
require.NoError(t, err)
defer cleanup(testpath)

id, err := manager.Store("mysecret", []byte("mydata"), drivertype, opts, nil, nil)
storeOpts := StoreOptions{
DriverOpts: opts,
}

id, err := manager.Store("mysecret", []byte("mydata"), drivertype, storeOpts)
require.NoError(t, err)

// inspect using secret name
Expand All @@ -201,7 +231,11 @@ func TestInspectSecretId(t *testing.T) {
require.NoError(t, err)
defer cleanup(testpath)

id, err := manager.Store("mysecret", []byte("mydata"), drivertype, opts, nil, nil)
storeOpts := StoreOptions{
DriverOpts: opts,
}

id, err := manager.Store("mysecret", []byte("mydata"), drivertype, storeOpts)
require.NoError(t, err)

_, err = manager.lookupSecret("mysecret")
Expand Down Expand Up @@ -233,9 +267,13 @@ func TestSecretList(t *testing.T) {
require.NoError(t, err)
defer cleanup(testpath)

_, err = manager.Store("mysecret", []byte("mydata"), drivertype, opts, nil, nil)
storeOpts := StoreOptions{
DriverOpts: opts,
}

_, err = manager.Store("mysecret", []byte("mydata"), drivertype, storeOpts)
require.NoError(t, err)
_, err = manager.Store("mysecret2", []byte("mydata2"), drivertype, opts, nil, nil)
_, err = manager.Store("mysecret2", []byte("mydata2"), drivertype, storeOpts)
require.NoError(t, err)

allSecrets, err := manager.List()
Expand Down

0 comments on commit e568579

Please sign in to comment.