* Merge commit from fork
* fix: prevent unbounded read in Terraform remote configuration loader (GHSA-fmgp-q6jx-gg3x)
* fix: bound remote Terraform clone and invalidate cache on rejection
Follow-up hardening for GHSA-fmgp-q6jx-gg3x.
Bound the clone of the attacker-supplied repository: shallow Depth:1, a
2-minute fetch timeout via PlainCloneContext, and post-clone caps on the
retained tree size (64 MiB) and file count, rejecting and removing a clone
that exceeds them.
Invalidate the clone cache: re-clone when the recorded remote URL changes,
and remove the cache on a failed clone or a rejected read so a corrected
repository is re-fetched instead of a poisoned or stale tree being reused.
Validate the module name before building the cache path, and log clone,
rejection, and eviction events.
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* Fix: resolve gosec G304 lint failure in Terraform module cache check (#7190)
Wrap the cache remote marker read in filepath.Clean, the same pattern
other os.ReadFile call sites in this repo use to satisfy gosec. The
path is built from filepath.Join and a constant suffix, with the module
name validated beforehand, so behavior is unchanged.
The finding surfaced on master after the GHSA-fmgp-q6jx-gg3x merge
because the advisory workflow did not run the full lint job.
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
* Fix: retain resource creator when rebuilding appliedResources from ResourceTracker
The release-1.10 change that rebuilds Application status.appliedResources from
the ResourceTracker (#7086) dropped the per-resource creator, because the
ResourceTracker does not persist the creator field. As a result
status.appliedResources reported an empty creator and the "applied resource in
workflow step status" controller test failed, since it expects the creator
"workflow".
Re-attach the creator recorded during dispatch to the resources rebuilt from
the ResourceTracker. The ResourceTracker stays authoritative for which
resources exist; only the creator attribution that it does not persist is
restored.
Signed-off-by: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com>
* Fix: do not log or persist credentials embedded in Terraform module remote URLs
The remote URL of a Terraform module can embed credentials (for example
https://user:token@host/repo.git). The cache-reuse logic logged the raw URL
and wrote it to the .remote-url cache marker, which could leak those
credentials into controller logs and onto disk.
Strip the userinfo from the URL before logging it and before writing the cache
marker. The marker now stores a credential-free URL and the reuse check
compares the same stripped form, so cache reuse and re-clone-on-change behave
as before while no secret is persisted.
Signed-off-by: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com>
---------
Signed-off-by: Ayush Kumar <ayushshyamkumar888@gmail.com>
Signed-off-by: Ayush Kumar <65535504+roguepikachu@users.noreply.github.com>
* Feat: support to manage the integrations by the CLI and the workflow
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: remove the xml
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: add the unit test for the nacos writer
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: add the integration API
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: make the provider commands to be deprecated
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: make the unit test work
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: rename the integration to the config
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: make the unit test cases work
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: refactor the config commands
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: add the distribution status for the config
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: sort the import packages
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: refine the code style
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: refine the code style
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: get the content format before render the content
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: add some examples
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: the command test cases
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Feat: add the definitions of the workflow step
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: add some tests
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: add some tests
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: change the name
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: retry the CI
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
* Fix: refine some words
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
Signed-off-by: barnettZQG <barnett.zqg@gmail.com>
The UT `TestGetOpenAPISchemaFromTerraformComponentDefinition` won't
succeed 100%. The required variables in the generated isn't in the expected
order all the time.
Signed-off-by: Zheng Xi Zhou <zzxwill@gmail.com>
Add another unit test when the configuration of Terraform locates
in a subpath of a git remote repository
Signed-off-by: Zheng Xi Zhou <zzxwill@gmail.com>
* Fix: retrieve Terraform variables from variables.tf
If Terraform modules/resources are stored in remote git repos, get
variables from file `varialbes.tf`, or from `main.tf`.
Signed-off-by: Zheng Xi Zhou <zzxwill@gmail.com>
* Fix: Generate doc for Terraform typed ComponentDefinition
When the configuration of a Terraform Typed ComponentDefinition is in
remote Git, generate the properties for it. And generated outputs for
all Terraform ComponentDefinition
Signed-off-by: Zheng Xi Zhou <zzxwill@gmail.com>
The io/ioutil package has been deprecated as of Go 1.16, see
https://golang.org/doc/go1.16#ioutil. This commit replaces the existing
io/ioutil functions with their new definitions in io and os packages.
Signed-off-by: Eng Zer Jun <zerjun@beatchain.co>
* Support cloud resource provisioning and consuming (Crossplane)
Provided a way to store secret for cloud resource generated by
Crossplane and to consume the secret
Refer to #1128
* Separate cloud resource producer and consumer in two applications
* add unit test to check whether application can consume cloud resource secret
* update Cloud Resource doc
* Provisioning and consuming cloud resource in different applications v1 (one cloud resource)
* one component consumes two cloud resources
Co-authored-by: Jianbo Sun <wonderflow.sun@gmail.com>
* Store capability OpenAPI V3 JSON schema in ConfigMap
Store the OpenAPI v3 JSON Schema generated from the parameters of
a capability which could be used by api server
To fix#899
address comments
try to fix data race issue
Co-authored-by: Jianbo Sun <wonderflow.sun@gmail.com>
* address comments: generate cue instance from cue json instead of local file
* update ConfigMap data at any time
* add more unit-test
* fix conflicts
* adapt to new spec.schematic.cue.template
* adapt to new spec.schematic.cue.template for controller unittest cases
* fix ci issues
* adapt to namespaced scope definition
* add more testcases on namespaced definitions with and without namespaces
Co-authored-by: Jianbo Sun <wonderflow.sun@gmail.com>
Ayush Kumar
Tianxin Dong
Somefive
Joshua Agboola
Tianxin Dong
barnettZQG
Jianbo Sun
Zheng Xi Zhou
qiaozp
Eng Zer Jun
yangsoon
Kinsoandkinsolee
Jian.Li
Yue Wang
