diff --git a/infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeysProvisioner.java b/infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeysProvisioner.java index f44d2fd879f..8771ef51d0e 100644 --- a/infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeysProvisioner.java +++ b/infrastructures/kubernetes/src/main/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeysProvisioner.java @@ -13,6 +13,7 @@ import static com.google.common.base.Strings.isNullOrEmpty; +import com.google.common.hash.Hashing; import io.fabric8.kubernetes.api.model.ConfigMap; import io.fabric8.kubernetes.api.model.ConfigMapBuilder; import io.fabric8.kubernetes.api.model.ConfigMapVolumeSourceBuilder; @@ -24,6 +25,7 @@ import io.fabric8.kubernetes.api.model.VolumeBuilder; import io.fabric8.kubernetes.api.model.VolumeMount; import io.fabric8.kubernetes.api.model.VolumeMountBuilder; +import java.nio.charset.StandardCharsets; import java.util.Base64; import java.util.HashMap; import java.util.List; @@ -139,10 +141,11 @@ private void doProvisionSshKey(SshPair sshPair, KubernetesEnvironment k8sEnv, St .values() .forEach( p -> - mountSshKeySecret(secret.getMetadata().getName(), validNameForSecret, p.getSpec())); + mountSshKeySecret( + secret.getMetadata().getName(), getSha256(sshPair.getName()), p.getSpec())); } - private void mountSshKeySecret(String secretName, String sshKeyName, PodSpec podSpec) { + private void mountSshKeySecret(String secretName, String sshKeyNameHashed, PodSpec podSpec) { podSpec .getVolumes() .add( @@ -158,7 +161,7 @@ private void mountSshKeySecret(String secretName, String sshKeyName, PodSpec pod .withName(secretName) .withNewReadOnly(false) .withReadOnly(false) - .withMountPath(SSH_BASE_CONFIG_PATH + sshKeyName) + .withMountPath(SSH_BASE_CONFIG_PATH + sshKeyNameHashed) .build(); container.getVolumeMounts().add(volumeMount); }); @@ -238,7 +241,7 @@ private String buildConfig(@NotNull String name) { + host + "\nIdentityFile " + SSH_BASE_CONFIG_PATH - + getValidNameForSecret(name) + + getSha256(name) + "/" + SSH_PRIVATE_KEY + "\n"; @@ -248,4 +251,9 @@ private String buildConfig(@NotNull String name) { private String getValidNameForSecret(@NotNull String name) { return name.replace(".", "-"); } + + /** Returns a sha256-hashed string value. */ + private String getSha256(@NotNull String value) { + return Hashing.sha256().hashString(value, StandardCharsets.UTF_8).toString(); + } } diff --git a/infrastructures/kubernetes/src/test/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeySecretProvisionerTest.java b/infrastructures/kubernetes/src/test/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeySecretProvisionerTest.java index ed8afcf85eb..de259f897d5 100644 --- a/infrastructures/kubernetes/src/test/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeySecretProvisionerTest.java +++ b/infrastructures/kubernetes/src/test/java/org/eclipse/che/workspace/infrastructure/kubernetes/provision/VcsSshKeySecretProvisionerTest.java @@ -20,12 +20,14 @@ import static org.testng.Assert.assertTrue; import com.google.common.collect.ImmutableList; +import com.google.common.hash.Hashing; import io.fabric8.kubernetes.api.model.ConfigMap; import io.fabric8.kubernetes.api.model.ObjectMeta; import io.fabric8.kubernetes.api.model.ObjectMetaBuilder; import io.fabric8.kubernetes.api.model.Pod; import io.fabric8.kubernetes.api.model.PodSpec; import io.fabric8.kubernetes.api.model.Secret; +import java.nio.charset.StandardCharsets; import java.util.Collections; import java.util.Map; import java.util.UUID; @@ -124,12 +126,20 @@ public void addSshKeysConfigInPod() throws Exception { String sshConfig = mapData.get("ssh_config"); assertTrue(sshConfig.contains("host " + keyName1)); - assertTrue(sshConfig.contains("IdentityFile " + "/etc/ssh/" + keyName1 + "/ssh-privatekey")); + assertTrue( + sshConfig.contains("IdentityFile /etc/ssh/" + getSha256(keyName1) + "/ssh-privatekey")); assertTrue(sshConfig.contains("host *")); - assertTrue(sshConfig.contains("IdentityFile " + "/etc/ssh/" + keyName2 + "/ssh-privatekey")); + assertTrue( + sshConfig.contains("IdentityFile /etc/ssh/" + getSha256(keyName2) + "/ssh-privatekey")); - assertTrue(sshConfig.contains("host github.com")); - assertTrue(sshConfig.contains("IdentityFile /etc/ssh/github-com/ssh-privatekey")); + assertTrue(sshConfig.contains("host " + keyName3)); + assertTrue( + sshConfig.contains("IdentityFile /etc/ssh/" + getSha256(keyName3) + "/ssh-privatekey")); + } + + /** Returns a sha256-hashed string value. */ + private String getSha256(String value) { + return Hashing.sha256().hashString(value, StandardCharsets.UTF_8).toString(); } }