fix(sec): switching to uid to avoid ns+name collision (#1235)

Signed-off-by: Dario Tranchitella <dario@tranchitella.eu>

api/v1alpha1/tenantcontrolplane_funcs.go

@@ -8,7 +8,6 @@ import (
 	"fmt"
 	"net"
 	"strconv"
-	"strings"
 
 	corev1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -112,16 +111,10 @@ func getLoadBalancerAddress(ingress []corev1.LoadBalancerIngress) (string, error
 	return "", kamajierrors.MissingValidIPError{}
 }
 
-func (in *TenantControlPlane) normalizeNamespaceName() string {
-	// The dash character (-) must be replaced with an underscore, PostgreSQL is complaining about it:
-	// https://github.com/clastix/kamaji/issues/328
-	return strings.ReplaceAll(fmt.Sprintf("%s_%s", in.GetNamespace(), in.GetName()), "-", "_")
-}
-
 func (in *TenantControlPlane) GetDefaultDatastoreUsername() string {
-	return in.normalizeNamespaceName()
+	return string(in.UID)
 }
 
 func (in *TenantControlPlane) GetDefaultDatastoreSchema() string {
-	return in.normalizeNamespaceName()
+	return string(in.UID)
 }

internal/datastore/mysql.go

@@ -27,7 +27,7 @@ const (
 	mysqlFetchUserStatement        = "SELECT User FROM mysql.user WHERE User= ? LIMIT 1"
 	mysqlFetchDBStatement          = "SELECT SCHEMA_NAME FROM INFORMATION_SCHEMA.SCHEMATA WHERE SCHEMA_NAME=? LIMIT 1"
 	mysqlShowGrantsStatement       = "SHOW GRANTS FOR `%s`@`%%`"
-	mysqlCreateDBStatement         = "CREATE DATABASE IF NOT EXISTS %s"
+	mysqlCreateDBStatement         = "CREATE DATABASE IF NOT EXISTS `%s`"
 	mysqlCreateUserStatement       = "CREATE USER `%s`@`%%` IDENTIFIED BY '%s'"
 	mysqlUpdateUserStatement       = "ALTER USER `%s`@`%%` IDENTIFIED BY '%s'"
 	mysqlGrantPrivilegesStatement  = "GRANT SELECT, INSERT, UPDATE, DELETE, CREATE, ALTER, INDEX ON `%s`.* TO `%s`@`%%`"
@@ -59,7 +59,7 @@ func (c *MySQLConnection) Migrate(ctx context.Context, tcp kamajiv1alpha1.Tenant
 	}
 	defer os.RemoveAll(dir)
 
-	if _, err = c.db.ExecContext(ctx, fmt.Sprintf("USE %s_%s", tcp.GetNamespace(), tcp.GetName())); err != nil {
+	if _, err = c.db.ExecContext(ctx, fmt.Sprintf("USE %s", tcp.Status.Storage.Setup.Schema)); err != nil {
 		return fmt.Errorf("unable to switch DB for MySQL migration: %w", err)
 	}
 

internal/datastore/postgresql.go

@@ -227,7 +227,7 @@ func (r *PostgreSQLConnection) GrantPrivileges(ctx context.Context, user, dbName
 	}
 
 	if tableExists {
-		if _, err = dbConn.ExecContext(ctx, fmt.Sprintf("ALTER TABLE kine OWNER TO %s", user)); err != nil {
+		if _, err = dbConn.ExecContext(ctx, fmt.Sprintf(`ALTER TABLE kine OWNER TO "%s"`, user)); err != nil {
 			return errors.NewGrantPrivilegesError(err)
 		}
 	}

internal/resources/datastore/datastore_storage_config_test.go

@@ -5,7 +5,6 @@ package datastore_test
 
 import (
 	"context"
-	"fmt"
 
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
@@ -71,7 +70,7 @@ var _ = Describe("DatastoreStorageConfig", func() {
 			Expect(fakeClient.List(ctx, &secrets)).To(Succeed())
 			Expect(secrets.Items).To(HaveLen(1))
 
-			expectedValue := []byte(fmt.Sprintf("%s_%s", tcp.Namespace, tcp.Name))
+			expectedValue := []byte(string(tcp.UID))
 
 			Expect(secrets.Items[0].Data["DB_SCHEMA"]).To(Equal(expectedValue))
 			Expect(secrets.Items[0].Data["DB_USER"]).To(Equal(expectedValue))

internal/webhook/handlers/tcp_defaults_test.go

@@ -10,6 +10,7 @@ import (
 	. "github.com/onsi/gomega"
 	"gomodules.xyz/jsonpatch/v2"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/util/uuid"
 	"k8s.io/utils/ptr"
 	"sigs.k8s.io/controller-runtime/pkg/webhook/admission"
 
@@ -32,6 +33,7 @@ var _ = Describe("TCP Defaulting Webhook", func() {
 			ObjectMeta: metav1.ObjectMeta{
 				Name:      "tcp",
 				Namespace: "default",
+				UID:       uuid.NewUUID(),
 			},
 			Spec: kamajiv1alpha1.TenantControlPlaneSpec{
 				NetworkProfile: kamajiv1alpha1.NetworkProfileSpec{
@@ -64,10 +66,10 @@ var _ = Describe("TCP Defaulting Webhook", func() {
 			ops, err := t.OnCreate(tcp)(ctx, admission.Request{})
 			Expect(err).ToNot(HaveOccurred())
 			Expect(ops).To(ContainElement(
-				jsonpatch.Operation{Operation: "add", Path: "/spec/dataStoreSchema", Value: "default_tcp"},
+				jsonpatch.Operation{Operation: "add", Path: "/spec/dataStoreSchema", Value: string(tcp.UID)},
 			))
 			Expect(ops).To(ContainElement(
-				jsonpatch.Operation{Operation: "add", Path: "/spec/dataStoreUsername", Value: "default_tcp"},
+				jsonpatch.Operation{Operation: "add", Path: "/spec/dataStoreUsername", Value: string(tcp.UID)},
 			))
 		})
 	})