github/paralus
1
0
Fork 0
mirror of https://github.com/paralus/paralus.git synced 2026-08-24 15:47:19 +00:00
Code Issues Packages Projects Releases Wiki Activity

added ability to conifigure SA account lifetime with validation

Browse Source 
Signed-off-by: mabhi <abhijit.mukherjee@infracloud.io>
This commit is contained in:
mabhi
2023-02-07 08:32:01 +05:30
parent f9a0792362
commit 42bf234fc1
12 changed files with 392 additions and 299 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/service/kubeconfig_settings.go
+23
View File
@@ -3,6 +3,7 @@ package service
import (
"context"
"database/sql"
"fmt"
"time"
"github.com/google/uuid"
@@ -54,6 +55,26 @@ func (kss *kubeconfigSettingService) Patch(ctx context.Context, ks *sentry.Kubec
if err != nil {
accId = uuid.Nil
}
const maxSeconds = 30 * 24 * 60 * 60
const minSeconds = 10 * 60
minTimeDuration := time.Second * time.Duration(minSeconds) // min. 10 mins
maxTimeDuration := time.Second * time.Duration(maxSeconds) // max. 30 days
validityDuration := time.Second * time.Duration(ks.ValiditySeconds)
if validityDuration < minTimeDuration || validityDuration > maxTimeDuration {
maxTimeDisplay, _ := time.ParseDuration(fmt.Sprintf("%ds", maxSeconds))
minTimeDisplay, _ := time.ParseDuration(fmt.Sprintf("%ds", minSeconds))
return fmt.Errorf("invalid validity duration. should be between %.0f mins and %.0f hours", minTimeDisplay.Minutes(), maxTimeDisplay.Hours())
}
saValidityDuration := time.Second * time.Duration(ks.SaValiditySeconds)
if saValidityDuration < minTimeDuration || saValidityDuration > maxTimeDuration {
maxTimeDisplay, _ := time.ParseDuration(fmt.Sprintf("%ds", maxSeconds))
minTimeDisplay, _ := time.ParseDuration(fmt.Sprintf("%ds", minSeconds))
return fmt.Errorf("invalid sa validity duration. should be between %.0f mins and %.0f hours", minTimeDisplay.Minutes(), maxTimeDisplay.Hours())
}
return kss.db.RunInTx(ctx, &sql.TxOptions{}, func(ctx context.Context, tx bun.Tx) error {
_, err := dao.GetKubeconfigSetting(ctx, tx, uuid.MustParse(ks.OrganizationID), accId, ks.IsSSOUser)
db := convertToKubeCfgSettingModel(ks)
@@ -74,6 +95,7 @@ func prepareKubeCfgSettingResponse(ks *models.KubeconfigSetting) *sentry.Kubecon
AccountID: ks.AccountId.String(),
Scope: ks.Scope,
ValiditySeconds: ks.ValiditySeconds,
SaValiditySeconds: ks.SaValiditySeconds,
CreatedAt: timestamppb.New(ks.CreatedAt),
ModifiedAt: timestamppb.New(ks.ModifiedAt),
EnableSessionCheck: ks.EnforceRsId,
@@ -90,6 +112,7 @@ func convertToKubeCfgSettingModel(ks *sentry.KubeconfigSetting) *models.Kubeconf
OrganizationId: uuid.MustParse(ks.OrganizationID),
Scope: ks.Scope,
ValiditySeconds: ks.ValiditySeconds,
SaValiditySeconds: ks.SaValiditySeconds,
EnforceRsId: ks.EnableSessionCheck,
IsSSOUser: ks.IsSSOUser,
DisableWebKubectl: ks.DisableWebKubectl,
pkg/service/kubeconfig_settings_test.go
+13 -9
View File
@@ -10,7 +10,7 @@ import (
"github.com/paralus/paralus/proto/types/sentry"
)
func performkubeconfigSettingBasicChecks(t *testing.T, kss *sentry.KubeconfigSetting, uuuid string, ouuid string, acuuid string, validity_seconds int, disable_web_kubectl bool, disable_cli_kubectl bool) {
func performkubeconfigSettingBasicChecks(t *testing.T, kss *sentry.KubeconfigSetting, uuuid string, ouuid string, acuuid string, validity_seconds int, sa_validity_seconds int, disable_web_kubectl bool, disable_cli_kubectl bool) {
if kss.Id != uuuid {
t.Fatal("incorrect kubeconfig settings ID :", uuuid)
}
@@ -26,6 +26,9 @@ func performkubeconfigSettingBasicChecks(t *testing.T, kss *sentry.KubeconfigSet
if kss.ValiditySeconds != int64(validity_seconds) {
t.Fatal("incorrect Validity Seconds : ", kss.ValiditySeconds)
}
if kss.SaValiditySeconds != int64(sa_validity_seconds) {
t.Fatal("incorrect Sa Validity Seconds : ", kss.ValiditySeconds)
}
if kss.DisableWebKubectl != disable_web_kubectl {
t.Fatal("incorrect KubeconfigSetting(disable_web_kubectl) : ", kss.DisableWebKubectl)
}
@@ -44,9 +47,10 @@ func TestGetKubeconfigSetting(t *testing.T) {
ouuid := uuid.New().String()
acuuid := uuid.UUID.String(uuid.New())
validity_seconds := 300
sa_validity_seconds := 300
mock.ExpectQuery(`SELECT "ks"."id", "ks"."organization_id", "ks"."partner_id", "ks"."account_id", "ks"."scope", "ks"."validity_seconds", "ks"."created_at", "ks"."modified_at", "ks"."deleted_at", "ks"."enforce_rsid", "ks"."disable_all_audit", "ks"."disable_cmd_audit", "ks"."is_sso_user", "ks"."disable_web_kubectl", "ks"."disable_cli_kubectl", "ks"."enable_privaterelay", "ks"."enforce_orgadmin_secret_access" FROM "sentry_kubeconfig_setting" AS "ks" WHERE \(organization_id = '` + ouuid + `'\) AND \(account_id = '` + acuuid + `'\)`).
WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id", "organization_id", "account_id", "validity_seconds", "disable_web_kubectl", "disable_cli_kubectl"}).AddRow(uuuid, ouuid, acuuid, validity_seconds, true, true))
mock.ExpectQuery(`SELECT "ks"."id", "ks"."organization_id", "ks"."partner_id", "ks"."account_id", "ks"."scope", "ks"."validity_seconds", "ks"."sa_validity_seconds", "ks"."created_at", "ks"."modified_at", "ks"."deleted_at", "ks"."enforce_rsid", "ks"."disable_all_audit", "ks"."disable_cmd_audit", "ks"."is_sso_user", "ks"."disable_web_kubectl", "ks"."disable_cli_kubectl", "ks"."enable_privaterelay", "ks"."enforce_orgadmin_secret_access" FROM "sentry_kubeconfig_setting" AS "ks" WHERE \(organization_id = '` + ouuid + `'\) AND \(account_id = '` + acuuid + `'\)`).
WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id", "organization_id", "account_id", "validity_seconds", "sa_validity_seconds", "disable_web_kubectl", "disable_cli_kubectl"}).AddRow(uuuid, ouuid, acuuid, validity_seconds, sa_validity_seconds, true, true))
kss := &sentry.KubeconfigSetting{Id: uuuid, OrganizationID: ouuid, AccountID: acuuid}
@@ -54,8 +58,7 @@ func TestGetKubeconfigSetting(t *testing.T) {
if err != nil {
t.Fatal("could not get Kubeconfig Setting:", err)
}
performkubeconfigSettingBasicChecks(t, kss, uuuid, ouuid, acuuid, validity_seconds, true, true)
performkubeconfigSettingBasicChecks(t, kss, uuuid, ouuid, acuuid, validity_seconds, sa_validity_seconds, true, true)
}
func TestGetKubeconfigSettingInvalidId(t *testing.T) {
@@ -135,15 +138,16 @@ func TestUpdateKubeconfigSetting(t *testing.T) {
ouuid := uuid.New().String()
acuuid := uuid.UUID.String(uuid.New())
validity_seconds := 300
sa_validity_seconds := 300
kss := &sentry.KubeconfigSetting{Id: uuuid, OrganizationID: ouuid, AccountID: acuuid, ValiditySeconds: int64(validity_seconds), DisableWebKubectl: true, DisableCLIKubectl: true}
kss := &sentry.KubeconfigSetting{Id: uuuid, OrganizationID: ouuid, AccountID: acuuid, ValiditySeconds: int64(validity_seconds), SaValiditySeconds: int64(sa_validity_seconds), DisableWebKubectl: true, DisableCLIKubectl: true}
mock.ExpectBegin()
mock.ExpectQuery(`SELECT "ks"."id", "ks"."organization_id", "ks"."partner_id", "ks"."account_id", "ks"."scope", "ks"."validity_seconds", "ks"."created_at", "ks"."modified_at", "ks"."deleted_at", "ks"."enforce_rsid", "ks"."disable_all_audit", "ks"."disable_cmd_audit", "ks"."is_sso_user", "ks"."disable_web_kubectl", "ks"."disable_cli_kubectl", "ks"."enable_privaterelay", "ks"."enforce_orgadmin_secret_access" FROM "sentry_kubeconfig_setting" AS "ks" WHERE \(organization_id = '` + ouuid + `'\) AND \(account_id = '` + acuuid + `'\)`).
mock.ExpectQuery(`SELECT "ks"."id", "ks"."organization_id", "ks"."partner_id", "ks"."account_id", "ks"."scope", "ks"."validity_seconds", "ks"."sa_validity_seconds", "ks"."created_at", "ks"."modified_at", "ks"."deleted_at", "ks"."enforce_rsid", "ks"."disable_all_audit", "ks"."disable_cmd_audit", "ks"."is_sso_user", "ks"."disable_web_kubectl", "ks"."disable_cli_kubectl", "ks"."enable_privaterelay", "ks"."enforce_orgadmin_secret_access" FROM "sentry_kubeconfig_setting" AS "ks" WHERE \(organization_id = '` + ouuid + `'\) AND \(account_id = '` + acuuid + `'\)`).
WithArgs().WillReturnRows(sqlmock.NewRows([]string{"id", "organization_id", "account_id"}).AddRow(uuuid, ouuid, acuuid))
mock.ExpectExec(`UPDATE "sentry_kubeconfig_setting" AS "ks" SET .*, validity_seconds = ` + fmt.Sprint(validity_seconds) + `, enforce_rsid = FALSE, is_sso_user = FALSE, disable_web_kubectl = TRUE, disable_cli_kubectl = TRUE, enable_privaterelay = FALSE, enforce_orgadmin_secret_access = FALSE WHERE \(organization_id = '` + ouuid + `'\) AND \(account_id = '` + acuuid + `'\) AND \(is_sso_user= FALSE\)`).
mock.ExpectExec(`UPDATE "sentry_kubeconfig_setting" AS "ks" SET .*, validity_seconds = ` + fmt.Sprint(validity_seconds) + `, sa_validity_seconds = ` + fmt.Sprint(sa_validity_seconds) + `, enforce_rsid = FALSE, is_sso_user = FALSE, disable_web_kubectl = TRUE, disable_cli_kubectl = TRUE, enable_privaterelay = FALSE, enforce_orgadmin_secret_access = FALSE WHERE \(organization_id = '` + ouuid + `'\) AND \(account_id = '` + acuuid + `'\) AND \(is_sso_user= FALSE\)`).
WillReturnResult(sqlmock.NewResult(1, 1))
mock.ExpectCommit()
@@ -152,5 +156,5 @@ func TestUpdateKubeconfigSetting(t *testing.T) {
if errr != nil {
t.Fatal("could not patch kubeconfig Setting:", errr)
}
performkubeconfigSettingBasicChecks(t, kss, uuuid, ouuid, acuuid, validity_seconds, true, true)
performkubeconfigSettingBasicChecks(t, kss, uuuid, ouuid, acuuid, validity_seconds, sa_validity_seconds, true, true)
}