-
Notifications
You must be signed in to change notification settings - Fork 154
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add validation for kopia repository server controller secrets (#1940)
* add skeleton for validation repoitory server secrets * fix bugs * add licence headers * address review comments * change the secret type to v1.secrettype * initialize k8s client instead of all the clients since they are not required * move the consts to a secrets package so that they can be reused * move the consts to a secrets package so that they can be reused * refactor to use common constants * move the consts to a secrets package so that they can be reused * refactor to use the constants from secrets folder * address review comments * add headers * address review comments * move location key constants to secrets package * move location key constants to repositoryserver package * refactor use the constants from repositoryserver package * resolve merge conflicts * address review comments * add support for filestore secret * make lint happy * address comments * make lint happy * add licence headers * add comments on the constants * consistent error messages * Change name of constants for better readability * fix typo * simplify validation logic * change error message * remove unwanted comments * add comment in the validate repository password function * change function name for getLocationType to getLocationSecret * add nil checks for secrets * fix build issues * add empty secret checks * rename interface name to secret for readability * address review comments * address review comments * use cmd.Context
- Loading branch information
1 parent
ac3723d
commit 7c81e70
Showing
22 changed files
with
694 additions
and
27 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| // Copyright 2023 The Kanister Authors. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package kanctl | ||
|
|
||
| import ( | ||
| "context" | ||
| "os" | ||
|
|
||
| "github.com/pkg/errors" | ||
| corev1 "k8s.io/api/core/v1" | ||
| metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" | ||
| k8sYAML "k8s.io/apimachinery/pkg/util/yaml" | ||
| "k8s.io/client-go/kubernetes" | ||
|
|
||
| "github.com/kanisterio/kanister/pkg/kube" | ||
| "github.com/kanisterio/kanister/pkg/secrets" | ||
| ) | ||
|
|
||
| func performRepoServerSecretsValidation(ctx context.Context, p *validateParams) error { | ||
| var cli kubernetes.Interface | ||
| var secret *corev1.Secret | ||
|
|
||
| cli, err := kube.NewClient() | ||
| if err != nil { | ||
| return errors.Wrap(err, "could not get the kubernetes client") | ||
| } | ||
|
|
||
| secret, err = getSecretFromCmd(ctx, cli, p) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| return secrets.ValidateRepositoryServerSecret(secret) | ||
| } | ||
|
|
||
| func getSecretFromCmd(ctx context.Context, cli kubernetes.Interface, p *validateParams) (*corev1.Secret, error) { | ||
| if p.name != "" { | ||
| return cli.CoreV1().Secrets(p.namespace).Get(ctx, p.name, metav1.GetOptions{}) | ||
| } | ||
| return getSecretFromFile(ctx, p.filename) | ||
| } | ||
|
|
||
| func getSecretFromFile(ctx context.Context, filename string) (*corev1.Secret, error) { | ||
| var f *os.File | ||
| var err error | ||
|
|
||
| if filename == "-" { | ||
| f = os.Stdin | ||
| } else { | ||
| f, err = os.Open(filename) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| defer f.Close() | ||
| } | ||
| d := k8sYAML.NewYAMLOrJSONDecoder(f, 4096) | ||
| secret := &corev1.Secret{} | ||
| err = d.Decode(secret) | ||
| if err != nil { | ||
| return nil, errors.Wrap(err, "failed to decode the secret passed") | ||
| } | ||
| return secret, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| // Copyright 2023 The Kanister Authors. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package errors | ||
|
|
||
| import "fmt" | ||
|
|
||
| var ErrValidate = fmt.Errorf("validation Failed") | ||
|
|
||
| const ( | ||
| // Error msg for missing required field in the secret | ||
| MissingRequiredFieldErrorMsg = "Missing required field %s in the secret '%s:%s'" | ||
| // Error msg for unknown in the secret | ||
| UnknownFieldErrorMsg = "'%s:%s' secret has an unknown field" | ||
| // Unsupported location type in the secret | ||
| UnsupportedLocationTypeErrorMsg = "Unsupported location type '%s' for secret '%s:%s'" | ||
| // Invalid Secret type error msg | ||
| IncompatibleSecretTypeErrorMsg = "Incompatible secret type. Expected type %s in the secret '%s:%s'" | ||
|
|
||
| // Nil Secret error message | ||
| NilSecretErrorMessage = "Secret is Nil" | ||
| // Empty Secret error message | ||
| EmptySecretErrorMessage = "Empty secret. Expected at least one key value pair in the secret '%s:%s'" | ||
| ) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,18 @@ | ||
| // Copyright 2023 The Kanister Authors. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package secrets | ||
|
|
||
| // FilestoreSecretType represents the secret type for Filestore credentials. | ||
| const FilestoreSecretType string = "secrets.kanister.io/filestore" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,58 @@ | ||
| // Copyright 2023 The Kanister Authors. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
|
|
||
| package secrets | ||
|
|
||
| import ( | ||
| "github.com/pkg/errors" | ||
| v1 "k8s.io/api/core/v1" | ||
|
|
||
| secerrors "github.com/kanisterio/kanister/pkg/secrets/errors" | ||
| ) | ||
|
|
||
| const ( | ||
| // GCPProjectID is the config map key for gcp project id data | ||
| GCPProjectID string = "gcp_project_id" | ||
| // GCPServiceKey is the config map key for gcp service key data | ||
| GCPServiceKey string = "gcp_service_key" | ||
| // GCPServerAccountJsonKey is the key for gcp service account json | ||
| GCPServiceAccountJsonKey string = "service-account.json" | ||
|
|
||
| // GCPSecretType represents the secret type for GCP credentials. | ||
| GCPSecretType string = "secrets.kanister.io/gcp" | ||
| ) | ||
|
|
||
| // ValidateGCPCredentials function is to verify the schema of GCP secrets | ||
| // that need to be provided for kopia commands | ||
| func ValidateGCPCredentials(secret *v1.Secret) error { | ||
| // Required fields for the secret are | ||
| // - GCPProjectID | ||
| // - GCPServiceAccountJsonKey | ||
| if secret == nil { | ||
| return errors.Wrapf(secerrors.ErrValidate, secerrors.NilSecretErrorMessage) | ||
| } | ||
| if string(secret.Type) != GCPSecretType { | ||
| return errors.Wrapf(secerrors.ErrValidate, secerrors.IncompatibleSecretTypeErrorMsg, GCPSecretType, secret.Namespace, secret.Name) | ||
| } | ||
| if len(secret.Data) == 0 { | ||
| return errors.Wrapf(secerrors.ErrValidate, secerrors.EmptySecretErrorMessage, secret.Namespace, secret.Name) | ||
| } | ||
| if _, ok := secret.Data[GCPProjectID]; !ok { | ||
| return errors.Wrapf(secerrors.ErrValidate, secerrors.MissingRequiredFieldErrorMsg, GCPProjectID, secret.Namespace, secret.Name) | ||
| } | ||
| if _, ok := secret.Data[GCPServiceAccountJsonKey]; !ok { | ||
| return errors.Wrapf(secerrors.ErrValidate, secerrors.MissingRequiredFieldErrorMsg, GCPServiceAccountJsonKey, secret.Namespace, secret.Name) | ||
| } | ||
| return nil | ||
| } |
Oops, something went wrong.