public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Secrets: Add namespace matches checks to authorizer and secure value client (#109651)

Browse Source 
* Decrypt: Add namespace matches to authorizer

* SecureValueClient: Add namespace matches when auth checking
This commit is contained in:
Matheus Macabu
2025-08-14 11:50:56 +02:00
committed by GitHub
parent a38a5e0301
commit dfae5e5b4d
7 changed files with 145 additions and 103 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/registry/apis/secret/secure_value_client_test.go
+63 -48
View File
@@ -1,6 +1,7 @@
package secret
import (
"context"
"testing"
"github.com/stretchr/testify/require"
@@ -118,61 +119,75 @@ func TestIntegration_SecureValueClient_CRUD(t *testing.T) {
}
func Test_SecureValueClient_CRUD_NoPermissions(t *testing.T) {
setup := testutils.Setup(t)
validator := validator.ProvideSecureValueValidator()
client := ProvideSecureValueClient(
setup.SecureValueService,
validator,
setup.AccessClient,
)
ns := "stacks-1234"
ctx := testutils.CreateUserAuthContext(t.Context(), ns, nil)
nsClient, err := client.Client(ctx, ns)
require.NoError(t, err)
require.NotNil(t, nsClient)
sv := &secretv1beta1.SecureValue{
ObjectMeta: metav1.ObjectMeta{
Name: "test-sv",
Namespace: ns,
},
testcases := []struct {
name string
ctx context.Context
errorReason metav1.StatusReason
}{
{"no auth context", context.Background(), metav1.StatusReasonUnauthorized},
{"no permissions", testutils.CreateUserAuthContext(t.Context(), ns, nil), metav1.StatusReasonForbidden},
{"mismatching namespace", testutils.CreateUserAuthContext(t.Context(), "other-ns", nil), metav1.StatusReasonForbidden},
}
unstructured, err := toUnstructured(sv)
require.NoError(t, err)
for _, tc := range testcases {
t.Run(tc.name, func(t *testing.T) {
setup := testutils.Setup(t)
// Create
created, err := nsClient.Create(ctx, unstructured, metav1.CreateOptions{})
var apiErr *apierrors.StatusError
require.ErrorAs(t, err, &apiErr)
require.Equal(t, apiErr.ErrStatus.Reason, metav1.StatusReasonForbidden)
require.Nil(t, created)
validator := validator.ProvideSecureValueValidator()
// Read
read, err := nsClient.Get(ctx, sv.Name, metav1.GetOptions{})
require.ErrorAs(t, err, &apiErr)
require.Equal(t, apiErr.ErrStatus.Reason, metav1.StatusReasonForbidden)
require.Nil(t, created)
client := ProvideSecureValueClient(
setup.SecureValueService,
validator,
setup.AccessClient,
)
// Update
updated, err := nsClient.Update(ctx, unstructured, metav1.UpdateOptions{})
require.ErrorAs(t, err, &apiErr)
require.Equal(t, apiErr.ErrStatus.Reason, metav1.StatusReasonForbidden)
require.Nil(t, updated)
ctx := tc.ctx
// List
list, err := nsClient.List(ctx, metav1.ListOptions{})
require.ErrorAs(t, err, &apiErr)
require.Equal(t, apiErr.ErrStatus.Reason, metav1.StatusReasonForbidden)
require.Nil(t, list)
nsClient, err := client.Client(ctx, ns)
require.NoError(t, err)
require.NotNil(t, nsClient)
// Delete
err = nsClient.Delete(ctx, sv.Name, metav1.DeleteOptions{})
require.ErrorAs(t, err, &apiErr)
require.Equal(t, apiErr.ErrStatus.Reason, metav1.StatusReasonForbidden)
require.Nil(t, read)
sv := &secretv1beta1.SecureValue{
ObjectMeta: metav1.ObjectMeta{
Name: "test-sv",
Namespace: ns,
},
}
unstructured, err := toUnstructured(sv)
require.NoError(t, err)
// Create
created, err := nsClient.Create(ctx, unstructured, metav1.CreateOptions{})
var apiErr *apierrors.StatusError
require.ErrorAs(t, err, &apiErr)
require.Equal(t, apiErr.ErrStatus.Reason, tc.errorReason)
require.Nil(t, created)
// Read
read, err := nsClient.Get(ctx, sv.Name, metav1.GetOptions{})
require.ErrorAs(t, err, &apiErr)
require.Equal(t, apiErr.ErrStatus.Reason, tc.errorReason)
require.Nil(t, read)
// Update
updated, err := nsClient.Update(ctx, unstructured, metav1.UpdateOptions{})
require.ErrorAs(t, err, &apiErr)
require.Equal(t, apiErr.ErrStatus.Reason, tc.errorReason)
require.Nil(t, updated)
// List
list, err := nsClient.List(ctx, metav1.ListOptions{})
require.ErrorAs(t, err, &apiErr)
require.Equal(t, apiErr.ErrStatus.Reason, tc.errorReason)
require.Nil(t, list)
// Delete
err = nsClient.Delete(ctx, sv.Name, metav1.DeleteOptions{})
require.ErrorAs(t, err, &apiErr)
require.Equal(t, apiErr.ErrStatus.Reason, tc.errorReason)
})
}
}