mirror of
https://github.com/kubevela/kubevela.git
synced 2026-05-18 23:38:11 +00:00
* feat(addon): Store addon registry tokens in Secrets Previously, addon registry tokens were stored in plaintext within the 'vela-addon-registry' ConfigMap. This is not a secure practice for sensitive data. This commit refactors the addon registry functionality to store tokens in Kubernetes Secrets. The ConfigMap now only contains a reference to the secret name, while the token itself is stored securely. This change includes: - Creating/updating secrets when a registry is added/updated. - Loading tokens from secrets when a registry is listed/retrieved. - Deleting secrets when a registry is deleted. Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com> * test(addon): Add tests for registry token secret storage This commit introduces a comprehensive test suite for the addon registry feature. It includes: - Isolated unit tests for each CRUD operation (Add, Update, List, Get, Delete) to ensure each function works correctly in isolation. - A stateful integration test to validate the complete lifecycle of an addon registry from creation to deletion. The tests verify that tokens are handled correctly via Kubernetes Secrets, confirming the implementation of the secure token storage feature. Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com> * feat(addon): improve addon registry robustness and fix bugs This commit introduces several improvements to the addon registry to make it more robust and fixes several bugs. - When updating a secret, the existing secret is now fetched and updated to avoid potential conflicts. - Deleting a non-existent registry now returns no error, making the operation idempotent. - Getting a non-existent registry now returns a structured not-found error. - Loading a token from a non-existent secret is now handled gracefully. - When setting a token directly on a git-based addon source, the token secret reference is now cleared. - The token secret reference is now correctly copied in `SafeCopy`. Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com> * Refactor(addon): Fix secret deletion and improve registry logic This commit refactors the addon registry data store to fix a critical bug where deleting an addon registry would not delete its associated token secret. The root cause was that the `GetRegistry` function, which was used by `DeleteRegistry`, would load the token from the secret and then clear the `TokenSecretRef` field on the in-memory object. This meant that when `DeleteRegistry` tried to find the secret to delete, the reference was already gone. This has been fixed by: 1. Introducing a central `getRegistries` helper function to read the raw registry data from the ConfigMap. 2. Refactoring all data store methods (`List`, `Get`, `Add`, `Update`, `Delete`) to use this central helper, removing duplicate code. 3. Ensuring `DeleteRegistry` uses the raw, unmodified registry data so that the `TokenSecretRef` is always available for deletion. Additionally, comprehensive unit tests for the new helper functions (`getRegistries`, `loadTokenFromSecret`, `createOrUpdateTokenSecret`) have been added to verify the fix and improve overall code quality and stability. Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com> * feat(addon): improve addon registry token security and logging This commit enhances the security and observability of addon registry token handling. - Adds a warning message to users when an insecure inline token is detected in an addon registry configuration, prompting them to migrate to a more secure secret-based storage. - Implements info-level logging to create an audit trail for token migrations, providing administrators with visibility into security-related events. - Refactors the token migration logic into a new `migrateInlineTokenToSecret` function, improving code clarity and maintainability. - Introduces unit tests for the `TokenSource` interface methods and the `GetTokenSource` function to ensure correctness and prevent regressions. Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com> * Chore: remove comments to triger ci Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com> --------- Signed-off-by: Ashvin Bambhaniya <ashvin.bambhaniya@improwised.com>
322 lines
8.6 KiB
Go
322 lines
8.6 KiB
Go
/*
|
|
Copyright 2021 The KubeVela Authors.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package addon
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
// mockItem implements the Item interface for testing
|
|
type mockItem struct {
|
|
path string
|
|
name string
|
|
typeName string
|
|
}
|
|
|
|
func (m mockItem) GetType() string { return m.typeName }
|
|
func (m mockItem) GetPath() string { return m.path }
|
|
func (m mockItem) GetName() string { return m.name }
|
|
|
|
// mockReader implements the AsyncReader interface for testing
|
|
type mockReader struct{}
|
|
|
|
func (m mockReader) ListAddonMeta() (map[string]SourceMeta, error) { return nil, nil }
|
|
func (m mockReader) ReadFile(path string) (string, error) { return "", nil }
|
|
func (m mockReader) RelativePath(item Item) string { return item.GetPath() }
|
|
|
|
func TestClassifyItemByPattern(t *testing.T) {
|
|
addonName := "my-addon"
|
|
meta := &SourceMeta{
|
|
Name: addonName,
|
|
Items: []Item{
|
|
mockItem{path: "my-addon/metadata.yaml"},
|
|
mockItem{path: "my-addon/template.cue"},
|
|
mockItem{path: "my-addon/definitions/def.cue"},
|
|
mockItem{path: "my-addon/resources/res.yaml"},
|
|
mockItem{path: "my-addon/schemas/schema.cue"},
|
|
mockItem{path: "my-addon/views/view.cue"},
|
|
mockItem{path: "my-addon/some-other-file.txt"}, // Should be ignored
|
|
},
|
|
}
|
|
|
|
r := mockReader{}
|
|
classified := ClassifyItemByPattern(meta, r)
|
|
|
|
assert.Contains(t, classified, MetadataFileName)
|
|
assert.Len(t, classified[MetadataFileName], 1)
|
|
|
|
assert.Contains(t, classified, AppTemplateCueFileName)
|
|
assert.Len(t, classified[AppTemplateCueFileName], 1)
|
|
|
|
assert.Contains(t, classified, DefinitionsDirName)
|
|
assert.Len(t, classified[DefinitionsDirName], 1)
|
|
|
|
assert.Contains(t, classified, ResourcesDirName)
|
|
assert.Len(t, classified[ResourcesDirName], 1)
|
|
|
|
assert.Contains(t, classified, DefSchemaName)
|
|
assert.Len(t, classified[DefSchemaName], 1)
|
|
|
|
assert.Contains(t, classified, ViewDirName)
|
|
assert.Len(t, classified[ViewDirName], 1)
|
|
|
|
assert.NotContains(t, classified, "some-other-file.txt")
|
|
}
|
|
|
|
func TestNewAsyncReader(t *testing.T) {
|
|
testCases := map[string]struct {
|
|
baseURL string
|
|
bucket string
|
|
repo string
|
|
subPath string
|
|
token string
|
|
rdType ReaderType
|
|
wantType interface{}
|
|
wantErr bool
|
|
}{
|
|
"git type": {
|
|
baseURL: "https://github.com/kubevela/catalog",
|
|
subPath: "addons",
|
|
rdType: gitType,
|
|
wantType: &gitReader{},
|
|
wantErr: false,
|
|
},
|
|
"gitee type": {
|
|
baseURL: "https://gitee.com/kubevela/catalog",
|
|
subPath: "addons",
|
|
rdType: giteeType,
|
|
wantType: &giteeReader{},
|
|
wantErr: false,
|
|
},
|
|
"oss type": {
|
|
baseURL: "oss-cn-hangzhou.aliyuncs.com",
|
|
bucket: "kubevela-addons",
|
|
rdType: ossType,
|
|
wantType: &ossReader{},
|
|
wantErr: false,
|
|
},
|
|
"invalid url": {
|
|
baseURL: "://invalid-url",
|
|
rdType: gitType,
|
|
wantErr: true,
|
|
},
|
|
"invalid type": {
|
|
baseURL: "https://github.com/kubevela/catalog",
|
|
rdType: "invalid",
|
|
wantErr: true,
|
|
},
|
|
}
|
|
|
|
for name, tc := range testCases {
|
|
t.Run(name, func(t *testing.T) {
|
|
// Note: This test does not cover the gitlab case as it requires a live API call
|
|
// or a complex mock setup, which is beyond the scope of this unit test.
|
|
if tc.rdType == gitlabType {
|
|
t.Skip("Skipping gitlab test in this unit test suite.")
|
|
}
|
|
|
|
reader, err := NewAsyncReader(tc.baseURL, tc.bucket, tc.repo, tc.subPath, tc.token, tc.rdType)
|
|
|
|
if tc.wantErr {
|
|
assert.Error(t, err)
|
|
} else {
|
|
assert.NoError(t, err)
|
|
assert.IsType(t, tc.wantType, reader)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestPathWithParent(t *testing.T) {
|
|
testCases := []struct {
|
|
readPath string
|
|
parentPath string
|
|
actualReadPath string
|
|
}{
|
|
{
|
|
readPath: "example",
|
|
parentPath: "experimental",
|
|
actualReadPath: "experimental/example",
|
|
},
|
|
{
|
|
readPath: "example/",
|
|
parentPath: "experimental",
|
|
actualReadPath: "experimental/example/",
|
|
},
|
|
}
|
|
for _, tc := range testCases {
|
|
res := pathWithParent(tc.readPath, tc.parentPath)
|
|
assert.Equal(t, res, tc.actualReadPath)
|
|
}
|
|
}
|
|
|
|
func TestConvert2OssItem(t *testing.T) {
|
|
subPath := "sub-addons"
|
|
reader, err := NewAsyncReader("ep-beijing.com", "bucket", "", subPath, "", ossType)
|
|
|
|
assert.NoError(t, err)
|
|
|
|
o, ok := reader.(*ossReader)
|
|
assert.Equal(t, ok, true)
|
|
var testFiles = []File{
|
|
{
|
|
Name: "sub-addons/fluxcd",
|
|
Size: 0,
|
|
},
|
|
{
|
|
Name: "sub-addons/fluxcd/metadata.yaml",
|
|
Size: 100,
|
|
},
|
|
{
|
|
Name: "sub-addons/fluxcd/definitions/",
|
|
Size: 0,
|
|
},
|
|
{
|
|
Name: "sub-addons/fluxcd/definitions/helm-release.yaml",
|
|
Size: 100,
|
|
},
|
|
{
|
|
Name: "sub-addons/example/resources/configmap.yaml",
|
|
Size: 100,
|
|
},
|
|
{
|
|
Name: "sub-addons/example/metadata.yaml",
|
|
Size: 100,
|
|
},
|
|
}
|
|
var expectItemCase = map[string]SourceMeta{
|
|
"fluxcd": {
|
|
Name: "fluxcd",
|
|
Items: []Item{
|
|
&OSSItem{
|
|
tp: FileType,
|
|
path: "fluxcd/definitions/helm-release.yaml",
|
|
name: "helm-release.yaml",
|
|
},
|
|
&OSSItem{
|
|
tp: FileType,
|
|
path: "fluxcd/metadata.yaml",
|
|
name: "metadata.yaml",
|
|
},
|
|
},
|
|
},
|
|
"example": {
|
|
Name: "example",
|
|
Items: []Item{
|
|
&OSSItem{
|
|
tp: FileType,
|
|
path: "example/metadata.yaml",
|
|
name: "metadata.yaml",
|
|
},
|
|
&OSSItem{
|
|
tp: FileType,
|
|
path: "example/resources/configmap.yaml",
|
|
name: "configmap.yaml",
|
|
},
|
|
},
|
|
},
|
|
}
|
|
addonMetas := o.convertOSSFiles2Addons(testFiles)
|
|
assert.Equal(t, expectItemCase, addonMetas)
|
|
|
|
}
|
|
|
|
func TestSafeCopy(t *testing.T) {
|
|
var git *GitAddonSource
|
|
sgit := git.SafeCopy()
|
|
assert.Nil(t, sgit)
|
|
git = &GitAddonSource{URL: "http://github.com/kubevela", Path: "addons", Token: "123456"}
|
|
sgit = git.SafeCopy()
|
|
assert.Empty(t, sgit.Token)
|
|
assert.Equal(t, "http://github.com/kubevela", sgit.URL)
|
|
assert.Equal(t, "addons", sgit.Path)
|
|
|
|
var gitee *GiteeAddonSource
|
|
sgitee := gitee.SafeCopy()
|
|
assert.Nil(t, sgitee)
|
|
gitee = &GiteeAddonSource{URL: "http://gitee.com/kubevela", Path: "addons", Token: "123456"}
|
|
sgitee = gitee.SafeCopy()
|
|
assert.Empty(t, sgitee.Token)
|
|
assert.Equal(t, "http://gitee.com/kubevela", sgitee.URL)
|
|
assert.Equal(t, "addons", sgitee.Path)
|
|
|
|
var gitlab *GitlabAddonSource
|
|
sgitlab := gitlab.SafeCopy()
|
|
assert.Nil(t, sgitlab)
|
|
gitlab = &GitlabAddonSource{URL: "http://gitlab.com/kubevela", Repo: "vela", Path: "addons", Token: "123456"}
|
|
sgitlab = gitlab.SafeCopy()
|
|
assert.Empty(t, sgitlab.Token)
|
|
assert.Equal(t, "http://gitlab.com/kubevela", sgitlab.URL)
|
|
assert.Equal(t, "addons", sgitlab.Path)
|
|
assert.Equal(t, "vela", sgitlab.Repo)
|
|
|
|
var helm *HelmSource
|
|
shelm := helm.SafeCopy()
|
|
assert.Nil(t, shelm)
|
|
helm = &HelmSource{URL: "https://hub.vela.com/chartrepo/addons", Username: "user123", Password: "pass456"}
|
|
shelm = helm.SafeCopy()
|
|
assert.Empty(t, shelm.Username)
|
|
assert.Empty(t, shelm.Password)
|
|
assert.Equal(t, "https://hub.vela.com/chartrepo/addons", shelm.URL)
|
|
}
|
|
|
|
func TestTokenSource(t *testing.T) {
|
|
t.Run("GitAddonSource", func(t *testing.T) {
|
|
source := &GitAddonSource{}
|
|
assert.Equal(t, "", source.GetToken())
|
|
assert.Equal(t, "", source.GetTokenSecretRef())
|
|
|
|
source.SetToken("test-token")
|
|
assert.Equal(t, "test-token", source.GetToken())
|
|
assert.Equal(t, "", source.GetTokenSecretRef())
|
|
|
|
source.SetTokenSecretRef("test-secret")
|
|
assert.Equal(t, "test-secret", source.GetTokenSecretRef())
|
|
assert.Equal(t, "", source.GetToken())
|
|
})
|
|
|
|
t.Run("GiteeAddonSource", func(t *testing.T) {
|
|
source := &GiteeAddonSource{}
|
|
assert.Equal(t, "", source.GetToken())
|
|
assert.Equal(t, "", source.GetTokenSecretRef())
|
|
|
|
source.SetToken("test-token")
|
|
assert.Equal(t, "test-token", source.GetToken())
|
|
assert.Equal(t, "", source.GetTokenSecretRef())
|
|
|
|
source.SetTokenSecretRef("test-secret")
|
|
assert.Equal(t, "test-secret", source.GetTokenSecretRef())
|
|
assert.Equal(t, "", source.GetToken())
|
|
})
|
|
|
|
t.Run("GitlabAddonSource", func(t *testing.T) {
|
|
source := &GitlabAddonSource{}
|
|
assert.Equal(t, "", source.GetToken())
|
|
assert.Equal(t, "", source.GetTokenSecretRef())
|
|
|
|
source.SetToken("test-token")
|
|
assert.Equal(t, "test-token", source.GetToken())
|
|
assert.Equal(t, "", source.GetTokenSecretRef())
|
|
|
|
source.SetTokenSecretRef("test-secret")
|
|
assert.Equal(t, "test-secret", source.GetTokenSecretRef())
|
|
assert.Equal(t, "", source.GetToken())
|
|
})
|
|
}
|