SecretsManager: Introduce keeper store (#105557)
* SecretsManager: Introduce secret database wrapper Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com> Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com> Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com> Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com> * SecretsManager: Introduce db migrator with keeper table Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com> Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com> Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com> Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com> * SecretsManager: Introduce keeper store Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com> Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com> Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com> * new line * without query listByNameSecureValue * remove unused extractSecureValues for now * SecretsManager: Add keeper integration tests Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com> Co-authored-by: Dana Axinte <53751979+dana-axinte@users.noreply.github.com> Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com> --------- Co-authored-by: PoorlyDefinedBehaviour <brunotj2015@hotmail.com> Co-authored-by: Leandro Deveikis <leandro.deveikis@gmail.com> Co-authored-by: Matheus Macabu <macabu@users.noreply.github.com>
This commit is contained in:
Dana Axinte
co-authored by
PoorlyDefinedBehaviour
Leandro Deveikis
Matheus Macabu
PoorlyDefinedBehaviour
Leandro Deveikis
Matheus Macabu
parent
c5de567c8c
commit
7f2923d4ed
@@ -0,0 +1,569 @@
|
||||
package secret
|
||||
|
||||
import (
|
||||
"context"
|
||||
"errors"
|
||||
"math/rand/v2"
|
||||
"net/http"
|
||||
"strconv"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
secretv0alpha1 "github.com/grafana/grafana/pkg/apis/secret/v0alpha1"
|
||||
"github.com/grafana/grafana/pkg/services/featuremgmt"
|
||||
"github.com/grafana/grafana/pkg/tests/apis"
|
||||
"github.com/grafana/grafana/pkg/tests/testinfra"
|
||||
"github.com/stretchr/testify/require"
|
||||
apierrors "k8s.io/apimachinery/pkg/api/errors"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/runtime"
|
||||
"k8s.io/apimachinery/pkg/runtime/schema"
|
||||
)
|
||||
|
||||
var gvrKeepers = schema.GroupVersionResource{
|
||||
Group: secretv0alpha1.GROUP,
|
||||
Version: secretv0alpha1.VERSION,
|
||||
Resource: secretv0alpha1.KeeperResourceInfo.GetName(),
|
||||
}
|
||||
|
||||
func TestIntegrationKeeper(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test")
|
||||
}
|
||||
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
t.Cleanup(cancel)
|
||||
|
||||
helper := apis.NewK8sTestHelper(t, testinfra.GrafanaOpts{
|
||||
AppModeProduction: false, // required for experimental APIs
|
||||
EnableFeatureToggles: []string{
|
||||
// Required to start the example service
|
||||
featuremgmt.FlagGrafanaAPIServerWithExperimentalAPIs,
|
||||
featuremgmt.FlagSecretsManagementAppPlatform,
|
||||
},
|
||||
})
|
||||
|
||||
permissions := map[string]ResourcePermission{ResourceKeepers: {Actions: ActionsAllKeepers}}
|
||||
|
||||
genericUserEditor := mustCreateUsers(t, helper, permissions).Editor
|
||||
|
||||
client := helper.GetResourceClient(apis.ResourceClientArgs{
|
||||
User: genericUserEditor,
|
||||
GVR: gvrKeepers,
|
||||
})
|
||||
|
||||
t.Run("reading a keeper that does not exist returns a 404", func(t *testing.T) {
|
||||
raw, err := client.Resource.Get(ctx, "some-keeper-that-does-not-exist", metav1.GetOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, raw)
|
||||
|
||||
var statusErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusErr))
|
||||
require.Equal(t, "keeper.secret.grafana.app \"some-keeper-that-does-not-exist\" not found", err.Error())
|
||||
require.Equal(t, http.StatusNotFound, int(statusErr.Status().Code))
|
||||
})
|
||||
|
||||
t.Run("deleting a keeper that does not exist returns an error", func(t *testing.T) {
|
||||
err := client.Resource.Delete(ctx, "some-keeper-that-does-not-exist", metav1.DeleteOptions{})
|
||||
require.Error(t, err)
|
||||
|
||||
var statusErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusErr))
|
||||
require.Equal(t, "keeper.secret.grafana.app \"some-keeper-that-does-not-exist\" not found", err.Error())
|
||||
require.Equal(t, http.StatusNotFound, int(statusErr.Status().Code))
|
||||
})
|
||||
|
||||
t.Run("creating a keeper returns it", func(t *testing.T) {
|
||||
raw := mustGenerateKeeper(t, helper, genericUserEditor, nil, "testdata/keeper-aws-generate.yaml")
|
||||
|
||||
keeper := new(secretv0alpha1.Keeper)
|
||||
err := runtime.DefaultUnstructuredConverter.FromUnstructured(raw.Object, keeper)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, keeper)
|
||||
|
||||
require.NotEmpty(t, keeper.Spec.Description)
|
||||
require.NotEmpty(t, keeper.Spec.AWS)
|
||||
require.Empty(t, keeper.Spec.Azure)
|
||||
|
||||
t.Run("and creating another keeper with the same name in the same namespace returns an error", func(t *testing.T) {
|
||||
testKeeper := helper.LoadYAMLOrJSONFile("testdata/keeper-gcp-generate.yaml")
|
||||
testKeeper.SetName(raw.GetName())
|
||||
|
||||
raw, err := client.Resource.Create(ctx, testKeeper, metav1.CreateOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, raw)
|
||||
})
|
||||
|
||||
t.Run("and reading th keeper returns it same as if when it was created", func(t *testing.T) {
|
||||
raw, err := client.Resource.Get(ctx, keeper.Name, metav1.GetOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, raw)
|
||||
|
||||
anotherKeeper := new(secretv0alpha1.Keeper)
|
||||
err = runtime.DefaultUnstructuredConverter.FromUnstructured(raw.Object, anotherKeeper)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, anotherKeeper)
|
||||
|
||||
require.EqualValues(t, keeper, anotherKeeper)
|
||||
})
|
||||
|
||||
t.Run("and listing keepers returns the created keeper", func(t *testing.T) {
|
||||
rawList, err := client.Resource.List(ctx, metav1.ListOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawList)
|
||||
require.GreaterOrEqual(t, len(rawList.Items), 1)
|
||||
require.Equal(t, keeper.Name, rawList.Items[0].GetName())
|
||||
})
|
||||
|
||||
t.Run("and updating the keeper replaces the spec fields and returns them", func(t *testing.T) {
|
||||
newRaw := helper.LoadYAMLOrJSONFile("testdata/keeper-gcp-generate.yaml")
|
||||
newRaw.SetName(raw.GetName())
|
||||
newRaw.Object["spec"].(map[string]any)["description"] = "New description"
|
||||
newRaw.Object["metadata"].(map[string]any)["annotations"] = map[string]any{"newAnnotation": "newValue"}
|
||||
|
||||
updatedRaw, err := client.Resource.Update(ctx, newRaw, metav1.UpdateOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, updatedRaw)
|
||||
|
||||
updatedKeeper := new(secretv0alpha1.Keeper)
|
||||
err = runtime.DefaultUnstructuredConverter.FromUnstructured(updatedRaw.Object, updatedKeeper)
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, updatedKeeper)
|
||||
|
||||
require.NotEqualValues(t, updatedKeeper.Spec, keeper.Spec)
|
||||
})
|
||||
|
||||
t.Run("and updating the keeper to reference securevalues that does not exist returns an error", func(t *testing.T) {
|
||||
t.Skip("skipping because storing credentials as securevalues is not implemented yet")
|
||||
newRaw := helper.LoadYAMLOrJSONFile("testdata/keeper-aws-generate.yaml")
|
||||
newRaw.SetName(raw.GetName())
|
||||
newRaw.Object["spec"].(map[string]any)["aws"] = map[string]any{
|
||||
"accessKeyId": map[string]any{
|
||||
"secureValueName": "securevalue-does-not-exist-1",
|
||||
},
|
||||
"secretAccessKey": map[string]any{
|
||||
"secureValueName": "securevalue-does-not-exist-2",
|
||||
},
|
||||
}
|
||||
|
||||
updatedRaw, err := client.Resource.Update(ctx, newRaw, metav1.UpdateOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, updatedRaw)
|
||||
require.Contains(t, err.Error(), "securevalue-does-not-exist-1")
|
||||
require.Contains(t, err.Error(), "securevalue-does-not-exist-2")
|
||||
})
|
||||
})
|
||||
|
||||
t.Run("creating an invalid keeper fails validation and returns an error", func(t *testing.T) {
|
||||
testData := helper.LoadYAMLOrJSONFile("testdata/keeper-aws-generate.yaml")
|
||||
testData.Object["spec"].(map[string]any)["description"] = ""
|
||||
|
||||
raw, err := client.Resource.Create(ctx, testData, metav1.CreateOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, raw)
|
||||
|
||||
var statusErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusErr))
|
||||
})
|
||||
|
||||
t.Run("creating a keeper with a provider then changing the provider does not return an error", func(t *testing.T) {
|
||||
rawAWS := mustGenerateKeeper(t, helper, genericUserEditor, nil, "testdata/keeper-aws-generate.yaml")
|
||||
|
||||
testDataKeeperGCP := rawAWS.DeepCopy()
|
||||
testDataKeeperGCP.Object["spec"].(map[string]any)["aws"] = nil
|
||||
testDataKeeperGCP.Object["spec"].(map[string]any)["gcp"] = map[string]any{
|
||||
"projectId": "project-id",
|
||||
"credentialsFile": "/path/to/file.json",
|
||||
}
|
||||
|
||||
rawGCP, err := client.Resource.Update(ctx, testDataKeeperGCP, metav1.UpdateOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawGCP)
|
||||
|
||||
require.NotEqualValues(t, rawAWS.Object["spec"], rawGCP.Object["spec"])
|
||||
})
|
||||
|
||||
t.Run("creating a keeper that references securevalues that does not exist returns an error", func(t *testing.T) {
|
||||
t.Skip("skipping because storing credentials as securevalues is not implemented yet")
|
||||
testDataKeeper := helper.LoadYAMLOrJSONFile("testdata/keeper-aws-generate.yaml")
|
||||
testDataKeeper.Object["spec"].(map[string]any)["aws"] = map[string]any{
|
||||
"accessKeyId": map[string]any{
|
||||
"secureValueName": "securevalue-does-not-exist-1",
|
||||
},
|
||||
"secretAccessKey": map[string]any{
|
||||
"secureValueName": "securevalue-does-not-exist-2",
|
||||
},
|
||||
}
|
||||
|
||||
raw, err := client.Resource.Create(ctx, testDataKeeper, metav1.CreateOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, raw)
|
||||
require.Contains(t, err.Error(), "securevalue-does-not-exist-1")
|
||||
require.Contains(t, err.Error(), "securevalue-does-not-exist-2")
|
||||
})
|
||||
|
||||
t.Run("deleting a keeper that exists does not return an error", func(t *testing.T) {
|
||||
generatePrefix := "generated-"
|
||||
|
||||
testData := helper.LoadYAMLOrJSONFile("testdata/keeper-aws-generate.yaml")
|
||||
testData.SetGenerateName(generatePrefix)
|
||||
|
||||
raw, err := client.Resource.Create(ctx, testData, metav1.CreateOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, raw)
|
||||
|
||||
name := raw.GetName()
|
||||
require.True(t, strings.HasPrefix(name, generatePrefix))
|
||||
|
||||
err = client.Resource.Delete(ctx, name, metav1.DeleteOptions{})
|
||||
require.NoError(t, err)
|
||||
|
||||
t.Run("and then trying to read it returns a 404 error", func(t *testing.T) {
|
||||
raw, err := client.Resource.Get(ctx, name, metav1.GetOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, raw)
|
||||
|
||||
var statusErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusErr))
|
||||
require.Equal(t, http.StatusNotFound, int(statusErr.Status().Code))
|
||||
})
|
||||
|
||||
t.Run("and listing keepers returns an empty list", func(t *testing.T) {
|
||||
rawList, err := client.Resource.List(ctx, metav1.ListOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawList)
|
||||
require.Empty(t, rawList.Items)
|
||||
})
|
||||
})
|
||||
|
||||
t.Run("creating keepers in multiple namespaces", func(t *testing.T) {
|
||||
permissions := map[string]ResourcePermission{
|
||||
ResourceKeepers: {Actions: ActionsAllKeepers},
|
||||
}
|
||||
|
||||
editorOrgA := mustCreateUsers(t, helper, permissions).Editor
|
||||
editorOrgB := mustCreateUsers(t, helper, permissions).Editor
|
||||
|
||||
keeperOrgA := mustGenerateKeeper(t, helper, editorOrgA, nil, "testdata/keeper-aws-generate.yaml")
|
||||
keeperOrgB := mustGenerateKeeper(t, helper, editorOrgB, nil, "testdata/keeper-aws-generate.yaml")
|
||||
|
||||
clientOrgA := helper.GetResourceClient(apis.ResourceClientArgs{User: editorOrgA, GVR: gvrKeepers})
|
||||
clientOrgB := helper.GetResourceClient(apis.ResourceClientArgs{User: editorOrgB, GVR: gvrKeepers})
|
||||
|
||||
// Create
|
||||
t.Run("creating a keeper with the same name as one from another namespace does not return an error", func(t *testing.T) {
|
||||
// OrgA creating a keeper with the same name from OrgB.
|
||||
testData := helper.LoadYAMLOrJSONFile("testdata/keeper-aws-generate.yaml")
|
||||
testData.SetName(keeperOrgB.GetName())
|
||||
|
||||
raw, err := clientOrgA.Resource.Create(ctx, testData, metav1.CreateOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, raw)
|
||||
|
||||
// OrgA creating a keeper with the same name from OrgB.
|
||||
testData = helper.LoadYAMLOrJSONFile("testdata/keeper-aws-generate.yaml")
|
||||
testData.SetName(keeperOrgA.GetName())
|
||||
|
||||
raw, err = clientOrgB.Resource.Create(ctx, testData, metav1.CreateOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, raw)
|
||||
|
||||
require.NoError(t, clientOrgA.Resource.Delete(ctx, keeperOrgB.GetName(), metav1.DeleteOptions{}))
|
||||
require.NoError(t, clientOrgB.Resource.Delete(ctx, keeperOrgA.GetName(), metav1.DeleteOptions{}))
|
||||
})
|
||||
|
||||
// Read
|
||||
t.Run("fetching a keeper from another namespace returns not found", func(t *testing.T) {
|
||||
var statusErr *apierrors.StatusError
|
||||
|
||||
// OrgA trying to fetch keeper from OrgB.
|
||||
raw, err := clientOrgA.Resource.Get(ctx, keeperOrgB.GetName(), metav1.GetOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, raw)
|
||||
require.True(t, errors.As(err, &statusErr))
|
||||
require.Equal(t, http.StatusNotFound, int(statusErr.Status().Code))
|
||||
|
||||
// OrgB trying to fetch keeper from OrgA.
|
||||
raw, err = clientOrgB.Resource.Get(ctx, keeperOrgA.GetName(), metav1.GetOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, raw)
|
||||
require.True(t, errors.As(err, &statusErr))
|
||||
require.Equal(t, http.StatusNotFound, int(statusErr.Status().Code))
|
||||
})
|
||||
|
||||
// Update
|
||||
t.Run("updating a keeper from another namespace returns not found", func(t *testing.T) {
|
||||
var statusErr *apierrors.StatusError
|
||||
|
||||
// OrgA trying to update securevalue from OrgB.
|
||||
testData := helper.LoadYAMLOrJSONFile("testdata/keeper-aws-generate.yaml")
|
||||
testData.SetName(keeperOrgB.GetName())
|
||||
testData.Object["spec"].(map[string]any)["description"] = "New description"
|
||||
|
||||
raw, err := clientOrgA.Resource.Update(ctx, testData, metav1.UpdateOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, raw)
|
||||
require.True(t, errors.As(err, &statusErr))
|
||||
require.Equal(t, http.StatusNotFound, int(statusErr.Status().Code))
|
||||
|
||||
// OrgB trying to update keeper from OrgA.
|
||||
testData = helper.LoadYAMLOrJSONFile("testdata/keeper-aws-generate.yaml")
|
||||
testData.SetName(keeperOrgA.GetName())
|
||||
testData.Object["spec"].(map[string]any)["description"] = "New description"
|
||||
|
||||
raw, err = clientOrgB.Resource.Update(ctx, testData, metav1.UpdateOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, raw)
|
||||
require.True(t, errors.As(err, &statusErr))
|
||||
require.Equal(t, http.StatusNotFound, int(statusErr.Status().Code))
|
||||
})
|
||||
|
||||
// Delete
|
||||
t.Run("deleting a keeper from another namespace returns an error and does not delete it", func(t *testing.T) {
|
||||
var statusErr *apierrors.StatusError
|
||||
|
||||
// OrgA trying to delete keeper from OrgB.
|
||||
err := clientOrgA.Resource.Delete(ctx, keeperOrgB.GetName(), metav1.DeleteOptions{})
|
||||
require.Error(t, err)
|
||||
require.True(t, errors.As(err, &statusErr))
|
||||
require.Equal(t, http.StatusNotFound, int(statusErr.Status().Code))
|
||||
|
||||
// Check that it still exists from the perspective of OrgB.
|
||||
raw, err := clientOrgB.Resource.Get(ctx, keeperOrgB.GetName(), metav1.GetOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, raw)
|
||||
|
||||
// OrgB trying to delete keeper from OrgA.
|
||||
err = clientOrgB.Resource.Delete(ctx, keeperOrgA.GetName(), metav1.DeleteOptions{})
|
||||
require.Error(t, err)
|
||||
require.Equal(t, http.StatusNotFound, int(statusErr.Status().Code))
|
||||
|
||||
// Check that it still exists from the perspective of OrgA.
|
||||
raw, err = clientOrgA.Resource.Get(ctx, keeperOrgA.GetName(), metav1.GetOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, raw)
|
||||
})
|
||||
|
||||
// List
|
||||
t.Run("listing keeper from a namespace does not return the ones from another namespace", func(t *testing.T) {
|
||||
// OrgA listing keeper.
|
||||
listOrgA, err := clientOrgA.Resource.List(ctx, metav1.ListOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, listOrgA)
|
||||
require.Len(t, listOrgA.Items, 1)
|
||||
require.Equal(t, *keeperOrgA, listOrgA.Items[0])
|
||||
|
||||
// OrgB listing keeper.
|
||||
listOrgB, err := clientOrgB.Resource.List(ctx, metav1.ListOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, listOrgB)
|
||||
require.Len(t, listOrgB.Items, 1)
|
||||
require.Equal(t, *keeperOrgB, listOrgB.Items[0])
|
||||
})
|
||||
})
|
||||
|
||||
t.Run("keeper actions without having required permissions", func(t *testing.T) {
|
||||
// Create users on a random org without specifying secrets-related permissions.
|
||||
editorP := mustCreateUsers(t, helper, nil).Editor
|
||||
|
||||
clientP := helper.GetResourceClient(apis.ResourceClientArgs{
|
||||
User: editorP,
|
||||
GVR: gvrKeepers,
|
||||
})
|
||||
|
||||
// GET
|
||||
rawGet, err := clientP.Resource.Get(ctx, "some-keeper", metav1.GetOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, rawGet)
|
||||
|
||||
var statusGetErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusGetErr))
|
||||
require.EqualValues(t, http.StatusForbidden, statusGetErr.Status().Code)
|
||||
|
||||
// LIST
|
||||
rawList, err := clientP.Resource.List(ctx, metav1.ListOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, rawList)
|
||||
|
||||
var statusListErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusListErr))
|
||||
require.EqualValues(t, http.StatusForbidden, statusListErr.Status().Code)
|
||||
|
||||
// CREATE
|
||||
testKeeper := helper.LoadYAMLOrJSONFile("testdata/keeper-gcp-generate.yaml") // to pass validation before authz.
|
||||
rawCreate, err := clientP.Resource.Create(ctx, testKeeper, metav1.CreateOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, rawCreate)
|
||||
|
||||
var statusCreateErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusCreateErr))
|
||||
require.EqualValues(t, http.StatusForbidden, statusCreateErr.Status().Code)
|
||||
|
||||
// UPDATE
|
||||
testKeeper.SetName("test") // to pass validation before authz.
|
||||
rawUpdate, err := clientP.Resource.Update(ctx, testKeeper, metav1.UpdateOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, rawUpdate)
|
||||
|
||||
var statusUpdateErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusUpdateErr))
|
||||
require.EqualValues(t, http.StatusForbidden, statusUpdateErr.Status().Code)
|
||||
|
||||
// DELETE
|
||||
err = clientP.Resource.Delete(ctx, "some-keeper", metav1.DeleteOptions{})
|
||||
require.Error(t, err)
|
||||
|
||||
var statusDeleteErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusDeleteErr))
|
||||
require.EqualValues(t, http.StatusForbidden, statusDeleteErr.Status().Code)
|
||||
})
|
||||
|
||||
t.Run("keeper actions with permissions but with limited scope", func(t *testing.T) {
|
||||
suffix := strconv.FormatInt(rand.Int64(), 10)
|
||||
|
||||
// Fix the Keeper names.
|
||||
keeperName := "kp-" + suffix
|
||||
testKeeper := helper.LoadYAMLOrJSONFile("testdata/keeper-gcp-generate.yaml")
|
||||
testKeeper.SetName(keeperName)
|
||||
|
||||
keeperNameAnother := "kp-another-" + suffix
|
||||
testKeeperAnother := helper.LoadYAMLOrJSONFile("testdata/keeper-gcp-generate.yaml")
|
||||
testKeeperAnother.SetName(keeperNameAnother)
|
||||
|
||||
// Fix the org ID because we will create another user with scope "all" permissions on the same org, to compare.
|
||||
orgID := rand.Int64() + 2
|
||||
|
||||
// Permissions which allow any action, but scoped actions (get, update, delete) only on `keeperName` and NO OTHER Keeper.
|
||||
scopedLimitedPermissions := map[string]ResourcePermission{
|
||||
ResourceKeepers: {
|
||||
Actions: ActionsAllKeepers,
|
||||
Name: keeperName,
|
||||
},
|
||||
}
|
||||
|
||||
// Create users (+ client) with permission to manage ONLY the Keeper `keeperName`.
|
||||
editorLimited := mustCreateUsersWithOrg(t, helper, orgID, scopedLimitedPermissions).Editor
|
||||
|
||||
clientScopedLimited := helper.GetResourceClient(apis.ResourceClientArgs{
|
||||
User: editorLimited,
|
||||
GVR: gvrKeepers,
|
||||
})
|
||||
|
||||
// Create users (+ client) with permission to manage ANY Keepers.
|
||||
scopedAllPermissions := map[string]ResourcePermission{
|
||||
ResourceKeepers: {
|
||||
Actions: ActionsAllKeepers,
|
||||
Name: "*", // this or not sending a `Name` have the same effect.
|
||||
},
|
||||
}
|
||||
|
||||
editorAll := mustCreateUsersWithOrg(t, helper, orgID, scopedAllPermissions).Editor
|
||||
|
||||
clientScopedAll := helper.GetResourceClient(apis.ResourceClientArgs{
|
||||
User: editorAll,
|
||||
GVR: gvrKeepers,
|
||||
})
|
||||
|
||||
// For create, we don't have actual granular permissions, so we can use any client that has unscoped create permissions.
|
||||
// This is because when we don't know yet what the name of the resource will be, the request comes with an empty value.
|
||||
// And thus the authorizer can't do granular checks.
|
||||
t.Run("CREATE", func(t *testing.T) {
|
||||
rawCreateLimited, err := clientScopedAll.Resource.Create(ctx, testKeeper, metav1.CreateOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawCreateLimited)
|
||||
|
||||
rawCreateLimited, err = clientScopedAll.Resource.Create(ctx, testKeeperAnother, metav1.CreateOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawCreateLimited)
|
||||
})
|
||||
|
||||
t.Run("READ", func(t *testing.T) {
|
||||
// Retrieve `keeperName` from the limited client.
|
||||
rawGetLimited, err := clientScopedLimited.Resource.Get(ctx, keeperName, metav1.GetOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawGetLimited)
|
||||
require.Equal(t, rawGetLimited.GetUID(), rawGetLimited.GetUID())
|
||||
|
||||
// Retrieve `keeperName` from the scope-all client.
|
||||
rawGetAll, err := clientScopedAll.Resource.Get(ctx, keeperName, metav1.GetOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawGetAll)
|
||||
require.Equal(t, rawGetAll.GetUID(), rawGetLimited.GetUID())
|
||||
|
||||
// Even though we can create it, we cannot retrieve `keeperNameAnother` from the limited client.
|
||||
rawGetLimited, err = clientScopedLimited.Resource.Get(ctx, keeperNameAnother, metav1.GetOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, rawGetLimited)
|
||||
|
||||
var statusGetErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusGetErr))
|
||||
require.EqualValues(t, http.StatusForbidden, statusGetErr.Status().Code)
|
||||
|
||||
// Retrieve `keeperNameAnother` from the scope-all client.
|
||||
rawGetAll, err = clientScopedAll.Resource.Get(ctx, keeperNameAnother, metav1.GetOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawGetAll)
|
||||
})
|
||||
|
||||
t.Run("LIST", func(t *testing.T) {
|
||||
// List Keepers from the limited client should return only 1.
|
||||
rawList, err := clientScopedLimited.Resource.List(ctx, metav1.ListOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawList)
|
||||
require.Len(t, rawList.Items, 1)
|
||||
require.Equal(t, keeperName, rawList.Items[0].GetName())
|
||||
|
||||
// List Keepers from the scope-all client should return all of them.
|
||||
rawList, err = clientScopedAll.Resource.List(ctx, metav1.ListOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawList)
|
||||
require.Len(t, rawList.Items, 2)
|
||||
})
|
||||
|
||||
t.Run("UPDATE", func(t *testing.T) {
|
||||
// Update `keeperName` from the limited client.
|
||||
testKeeperUpdate := testKeeper.DeepCopy()
|
||||
testKeeperUpdate.Object["spec"].(map[string]any)["description"] = "keeper-description-1234"
|
||||
|
||||
rawUpdate, err := clientScopedLimited.Resource.Update(ctx, testKeeperUpdate, metav1.UpdateOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawUpdate)
|
||||
|
||||
// Try to update `keeperNameAnother` from the limited client.
|
||||
testKeeperAnotherUpdate := testKeeperAnother.DeepCopy()
|
||||
testKeeperAnotherUpdate.Object["spec"].(map[string]any)["description"] = "keeper-description-5678"
|
||||
|
||||
rawUpdate, err = clientScopedLimited.Resource.Update(ctx, testKeeperAnotherUpdate, metav1.UpdateOptions{})
|
||||
require.Error(t, err)
|
||||
require.Nil(t, rawUpdate)
|
||||
|
||||
var statusUpdateErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusUpdateErr))
|
||||
require.EqualValues(t, http.StatusForbidden, statusUpdateErr.Status().Code)
|
||||
|
||||
// Update `keeperNameAnother` from the scope-all client.
|
||||
rawUpdate, err = clientScopedAll.Resource.Update(ctx, testKeeperAnotherUpdate, metav1.UpdateOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, rawUpdate)
|
||||
})
|
||||
|
||||
// Keep this last for cleaning up the resources.
|
||||
t.Run("DELETE", func(t *testing.T) {
|
||||
// Try to delete `keeperNameAnother` from the limited client.
|
||||
err := clientScopedLimited.Resource.Delete(ctx, keeperNameAnother, metav1.DeleteOptions{})
|
||||
require.Error(t, err)
|
||||
|
||||
var statusDeleteErr *apierrors.StatusError
|
||||
require.True(t, errors.As(err, &statusDeleteErr))
|
||||
require.EqualValues(t, http.StatusForbidden, statusDeleteErr.Status().Code)
|
||||
|
||||
// Delete `keeperNameAnother` from the scope-all client.
|
||||
err = clientScopedAll.Resource.Delete(ctx, keeperNameAnother, metav1.DeleteOptions{})
|
||||
require.NoError(t, err)
|
||||
|
||||
// Delete `keeperName` from the limited client.
|
||||
err = clientScopedLimited.Resource.Delete(ctx, keeperName, metav1.DeleteOptions{})
|
||||
require.NoError(t, err)
|
||||
})
|
||||
})
|
||||
}
|
||||
@@ -0,0 +1,150 @@
|
||||
package secret
|
||||
|
||||
import (
|
||||
"cmp"
|
||||
"context"
|
||||
"encoding/json"
|
||||
"math/rand/v2"
|
||||
"strconv"
|
||||
"testing"
|
||||
|
||||
"github.com/grafana/grafana/pkg/registry/apis/secret"
|
||||
"github.com/grafana/grafana/pkg/services/accesscontrol/resourcepermissions"
|
||||
"github.com/grafana/grafana/pkg/services/featuremgmt"
|
||||
"github.com/grafana/grafana/pkg/services/org"
|
||||
"github.com/grafana/grafana/pkg/services/team"
|
||||
"github.com/grafana/grafana/pkg/tests/apis"
|
||||
"github.com/grafana/grafana/pkg/tests/testinfra"
|
||||
"github.com/grafana/grafana/pkg/tests/testsuite"
|
||||
"github.com/stretchr/testify/require"
|
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
|
||||
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured"
|
||||
)
|
||||
|
||||
var (
|
||||
ResourceSecureValues = "secret.securevalues"
|
||||
ResourceKeepers = "secret.keepers"
|
||||
|
||||
ActionsAllKeepers = []string{
|
||||
secret.ActionSecretKeepersCreate,
|
||||
secret.ActionSecretKeepersWrite,
|
||||
secret.ActionSecretKeepersRead,
|
||||
secret.ActionSecretKeepersDelete,
|
||||
}
|
||||
ActionsAllSecureValues = []string{
|
||||
secret.ActionSecretSecureValuesCreate,
|
||||
secret.ActionSecretSecureValuesWrite,
|
||||
secret.ActionSecretSecureValuesRead,
|
||||
secret.ActionSecretSecureValuesDelete,
|
||||
}
|
||||
)
|
||||
|
||||
type ResourcePermission struct {
|
||||
Actions []string
|
||||
Name string // empty or "*" for all
|
||||
}
|
||||
|
||||
func TestMain(m *testing.M) {
|
||||
testsuite.Run(m)
|
||||
}
|
||||
|
||||
func TestIntegrationDiscoveryClient(t *testing.T) {
|
||||
if testing.Short() {
|
||||
t.Skip("skipping integration test")
|
||||
}
|
||||
|
||||
helper := apis.NewK8sTestHelper(t, testinfra.GrafanaOpts{
|
||||
AppModeProduction: false, // required for experimental APIs
|
||||
EnableFeatureToggles: []string{
|
||||
// Required to start the example service
|
||||
featuremgmt.FlagGrafanaAPIServerWithExperimentalAPIs,
|
||||
featuremgmt.FlagSecretsManagementAppPlatform,
|
||||
},
|
||||
})
|
||||
|
||||
t.Run("check discovery client", func(t *testing.T) {
|
||||
disco := helper.NewDiscoveryClient()
|
||||
|
||||
resources, err := disco.ServerResourcesForGroupVersion("secret.grafana.app/v0alpha1")
|
||||
require.NoError(t, err)
|
||||
|
||||
v1Disco, err := json.MarshalIndent(resources, "", " ")
|
||||
require.NoError(t, err)
|
||||
|
||||
var apiResourceList map[string]any
|
||||
require.NoError(t, json.Unmarshal(v1Disco, &apiResourceList))
|
||||
|
||||
groupVersion, ok := apiResourceList["groupVersion"].(string)
|
||||
require.True(t, ok)
|
||||
require.Equal(t, "secret.grafana.app/v0alpha1", groupVersion)
|
||||
|
||||
apiResources, ok := apiResourceList["resources"].([]any)
|
||||
require.True(t, ok)
|
||||
require.Len(t, apiResources, 2) // securevalue + keeper + (subresources...)
|
||||
})
|
||||
}
|
||||
|
||||
func mustCreateUsersWithOrg(t *testing.T, helper *apis.K8sTestHelper, orgID int64, permissionMap map[string]ResourcePermission) apis.OrgUsers {
|
||||
t.Helper()
|
||||
|
||||
permissions := make([]resourcepermissions.SetResourcePermissionCommand, 0, len(permissionMap))
|
||||
for resource, permission := range permissionMap {
|
||||
permissions = append(permissions, resourcepermissions.SetResourcePermissionCommand{
|
||||
Actions: permission.Actions,
|
||||
Resource: resource,
|
||||
ResourceAttribute: "uid",
|
||||
ResourceID: cmp.Or(permission.Name, "*"),
|
||||
})
|
||||
}
|
||||
|
||||
orgName := "org-" + strconv.FormatInt(orgID, 10)
|
||||
|
||||
userSuffix := strconv.FormatInt(rand.Int64(), 10)
|
||||
|
||||
// Add here admin or viewer if necessary.
|
||||
editor := helper.CreateUser("editor-"+userSuffix, orgName, org.RoleEditor, permissions)
|
||||
|
||||
staff := helper.CreateTeam("staff-"+userSuffix, "staff-"+userSuffix+"@"+orgName, editor.Identity.GetOrgID())
|
||||
|
||||
// Also call this method for each new user.
|
||||
helper.AddOrUpdateTeamMember(editor, staff.ID, team.PermissionTypeMember)
|
||||
|
||||
return apis.OrgUsers{
|
||||
Editor: editor,
|
||||
Staff: staff,
|
||||
}
|
||||
}
|
||||
|
||||
func mustCreateUsers(t *testing.T, helper *apis.K8sTestHelper, permissionMap map[string]ResourcePermission) apis.OrgUsers {
|
||||
orgID := rand.Int64() + 2 // if it is 0, becomes 2 and not 1.
|
||||
return mustCreateUsersWithOrg(t, helper, orgID, permissionMap)
|
||||
}
|
||||
|
||||
func mustGenerateKeeper(t *testing.T, helper *apis.K8sTestHelper, user apis.User, specType map[string]any, testFile string) *unstructured.Unstructured {
|
||||
t.Helper()
|
||||
|
||||
require.NotEmpty(t, testFile, "testFile must not be empty")
|
||||
|
||||
ctx, cancel := context.WithCancel(context.Background())
|
||||
t.Cleanup(cancel)
|
||||
|
||||
keeperClient := helper.GetResourceClient(apis.ResourceClientArgs{
|
||||
User: user,
|
||||
GVR: gvrKeepers,
|
||||
})
|
||||
|
||||
testKeeper := helper.LoadYAMLOrJSONFile(testFile)
|
||||
if specType != nil {
|
||||
testKeeper.Object["spec"] = specType
|
||||
}
|
||||
|
||||
raw, err := keeperClient.Resource.Create(ctx, testKeeper, metav1.CreateOptions{})
|
||||
require.NoError(t, err)
|
||||
require.NotNil(t, raw)
|
||||
|
||||
t.Cleanup(func() {
|
||||
require.NoError(t, keeperClient.Resource.Delete(ctx, raw.GetName(), metav1.DeleteOptions{}))
|
||||
})
|
||||
|
||||
return raw
|
||||
}
|
||||
@@ -0,0 +1,15 @@
|
||||
apiVersion: secret.grafana.app/v0alpha1
|
||||
kind: Keeper
|
||||
metadata:
|
||||
annotations:
|
||||
xx: XXX
|
||||
labels:
|
||||
aa: AAA
|
||||
spec:
|
||||
description: AWS XYZ value
|
||||
aws:
|
||||
accessKeyId:
|
||||
valueFromEnv: ACCESS_KEY_ID_XYZ
|
||||
secretAccessKey:
|
||||
valueFromEnv: SECRET_ACCESS_KEY_XYZ
|
||||
kmsKeyId: kmsKeyId-xyz
|
||||
@@ -0,0 +1,14 @@
|
||||
apiVersion: secret.grafana.app/v0alpha1
|
||||
kind: Keeper
|
||||
metadata:
|
||||
annotations:
|
||||
xx: XXX
|
||||
yy: YYY
|
||||
labels:
|
||||
aa: AAA
|
||||
bb: BBB
|
||||
spec:
|
||||
description: GCP XYZ value
|
||||
gcp:
|
||||
projectId: project-id
|
||||
credentialsFile: /path/to/file.json
|
||||
Reference in New Issue
Block a user