Onyx 16433 #2482

foxefj-cyber · 2022-02-09T16:07:33Z

Desired Outcome

Please describe the desired outcome for this PR. Said another way, what was
the original request that resulted in these code changes? Feel free to copy
this information from the connected issue.

Implemented Changes

Adding ability for the kubernetes client to use the environment defined http(s)_proxy environment variable when connecting to kubernetes.

Connected Issue/Story

CyberArk internal issue link: ONYX-16433

Definition of Done

At least 1 todo must be completed in the sections below for the PR to be
merged.

Changelog

The CHANGELOG has been updated, or
This PR does not include user-facing changes and doesn't require a
CHANGELOG update

Test coverage

This PR includes new unit and integration tests to go with the code
changes, or
The changes in this PR do not require tests

Documentation

Docs (e.g. READMEs) were updated in this PR
A follow-up issue to update official docs has been filed here: insert issue ID
This PR does not require updating any documentation

Behavior

This PR changes product behavior and has been reviewed by a PO, or
These changes are part of a larger initiative that will be reviewed later, or
No behavior was changed with this PR

Security

Security architect has reviewed the changes in this PR,
These changes are part of a larger initiative with a separate security review, or
There are no security aspects to these changes

micahlee · 2022-02-09T19:14:30Z

ci/authn-k8s/dev/Dockerfile.tinyproxy

@@ -0,0 +1,3 @@
+FROM travix/tinyproxy:latest
+
+COPY proxy/tinyproxy.conf /etc/tinyproxy.conf


Mind adding the final newline?

micahlee · 2022-02-09T19:16:51Z

app/domain/authentication/authn_k8s/k8s_object_lookup.rb

@@ -59,7 +59,8 @@ def options
          ssl_options: {
            cert_store: @cert_store,
            verify_ssl: OpenSSL::SSL::VERIFY_PEER
-          }
+          },
+          http_proxy_uri: ENV['https_proxy'] ? ENV['https_proxy'] : ENV['http_proxy']


Since we're treating ENV['https_proxy'] as a truthy value anyway, this can be simplified to:

http_proxy_uri: ENV['https_proxy'] || ENV['http_proxy']

micahlee · 2022-02-09T19:18:24Z

ci/authn-k8s/test_oc_entrypoint.sh

+  #oc adm policy remove-scc-from-user anyuid -z default
+  #oc --ignore-not-found=true delete project $CONJUR_AUTHN_K8S_TEST_NAMESPACE


Are these really not needed anymore? (I'm most curious about not deleting the project/namespace)

If not, can we delete the lines rather than commenting them.

uncommented them

micahlee · 2022-02-09T19:19:45Z

ci/authn-k8s/test_oc_entrypoint.sh


      # Rails.logger writes the logs to the environment log file
      oc exec $pod_name -- bash -c "cat /opt/conjur-server/log/test.log" >> "output/$PLATFORM-authn-k8s-logs.txt"

      echo "Printing Logs from Conjur to the console"
      echo "==========================="
-      cat "output/$PLATFORM-authn-k8s-logs.txt"
+      #cat "output/$PLATFORM-authn-k8s-logs.txt"


Should this be uncommented again?

micahlee · 2022-02-09T19:21:00Z

ci/authn-k8s/test_oc_entrypoint.sh

  # set test password value
-#  password=$(openssl rand -hex 12)
-#  conjurcmd conjur variable values add inventory-db/password $password
+  #password=$(openssl rand -hex 12)
+  #conjurcmd conjur variable values add inventory-db/password $password


I realize that you just cleaned up the formatting of these lines, but if they were commented out before you started working on it, we should just remove these lines.

micahlee · 2022-02-09T19:25:40Z

cucumber/kubernetes/features/http_proxy.feature

+  that is defined in the id and the kubernetes host can be reached through a
+  http_proxy
+
+  @http_proxy


I'm guessing there must be some sort of behind-the-scenes magic connecting this tag to the ci/authn-k8s/dev/dev_conjur_http_proxy.template.yaml?

It would probably be worth adding a small comment above this test explaining what it does, and perhaps link to the template file for reference in the future.

comment added :)

ci/authn-k8s/test_oc_entrypoint.sh

app/domain/authentication/authn_k8s/k8s_object_lookup.rb

CHANGELOG.md

codihuston

Looks like you took care of Micah's remarks. I'm going to LGTM this!

codihuston

LGTM!

codeclimate · 2022-02-10T16:55:51Z

Code Climate has analyzed commit b3b8d6f and detected 0 issues on this pull request.

The test coverage on the diff in this pull request is 100.0% (50% is the threshold).

This pull request will bring the total coverage in the repository to 88.0% (-1.4% change).

View more on Code Climate.

foxefj-cyber force-pushed the ONYX-16433 branch 2 times, most recently from de1f890 to a0b075f Compare February 9, 2022 19:00

foxefj-cyber requested review from adamouamani and a team February 9, 2022 19:00

foxefj-cyber marked this pull request as ready for review February 9, 2022 19:00

micahlee reviewed Feb 9, 2022

View reviewed changes

codeclimate bot reviewed Feb 9, 2022

View reviewed changes

foxefj-cyber force-pushed the ONYX-16433 branch from 1f75628 to 4a6426d Compare February 9, 2022 20:52

foxefj-cyber requested a review from a team February 10, 2022 16:28

codihuston previously approved these changes Feb 10, 2022

View reviewed changes

foxefj-cyber added 2 commits February 10, 2022 11:29

Add support for http(s)_proxy for use in k8s authenticator

f7b0ac2

Fixing codeclimate and PR comments

b3b8d6f

foxefj-cyber dismissed codihuston’s stale review via b3b8d6f February 10, 2022 16:30

foxefj-cyber force-pushed the ONYX-16433 branch from 4a6426d to b3b8d6f Compare February 10, 2022 16:30

foxefj-cyber requested a review from codihuston February 10, 2022 16:30

codihuston approved these changes Feb 10, 2022

View reviewed changes

foxefj-cyber merged commit 9e4ce5c into master Feb 10, 2022

foxefj-cyber deleted the ONYX-16433 branch February 10, 2022 16:56

jtuttle mentioned this pull request Jul 12, 2022

Update suite.yml for v1.17.6+suite.1 release cyberark/conjur-oss-suite-release#247

Merged

gl-johnson mentioned this pull request Aug 23, 2022

Update suite.yml for v18.0.0+suite1 release cyberark/conjur-oss-suite-release#250

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Onyx 16433 #2482

Onyx 16433 #2482

foxefj-cyber commented Feb 9, 2022

micahlee Feb 9, 2022

foxefj-cyber Feb 9, 2022

micahlee Feb 9, 2022

foxefj-cyber Feb 9, 2022

micahlee Feb 9, 2022

foxefj-cyber Feb 9, 2022

micahlee Feb 9, 2022

foxefj-cyber Feb 9, 2022

micahlee Feb 9, 2022

foxefj-cyber Feb 9, 2022

micahlee Feb 9, 2022

foxefj-cyber Feb 9, 2022

codihuston left a comment

codihuston left a comment

codeclimate bot commented Feb 10, 2022

		@@ -0,0 +1,3 @@
		FROM travix/tinyproxy:latest

		COPY proxy/tinyproxy.conf /etc/tinyproxy.conf

		#oc adm policy remove-scc-from-user anyuid -z default
		#oc --ignore-not-found=true delete project $CONJUR_AUTHN_K8S_TEST_NAMESPACE

Onyx 16433 #2482

Onyx 16433 #2482

Conversation

foxefj-cyber commented Feb 9, 2022

Desired Outcome

Implemented Changes

Connected Issue/Story

Definition of Done

Changelog

Test coverage

Documentation

Behavior

Security

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codihuston left a comment

Choose a reason for hiding this comment

codihuston left a comment

Choose a reason for hiding this comment

codeclimate bot commented Feb 10, 2022