From 8198c7130e56d63ea38985dd43a67c3229956dde Mon Sep 17 00:00:00 2001 From: Mrudraia1 Date: Mon, 30 Sep 2024 14:57:16 +0530 Subject: [PATCH] Read secrets for client-onboarding-token-validation Signed-off-by: Mrudraia1 --- controllers/storagecluster/storageclient.go | 9 ++-- controllers/util/provider.go | 47 +++++++++++-------- .../ocs-operator.clusterserviceversion.yaml | 10 ++-- .../v4/controllers/util/provider.go | 47 +++++++++++-------- .../onboarding/clienttokens/handler.go | 25 ++++++---- .../handlers/onboarding/peertokens/handler.go | 24 ++++++---- services/ux-backend/main.go | 37 +++++++++++++-- tools/csv-merger/csv-merger.go | 21 ++++----- 8 files changed, 139 insertions(+), 81 deletions(-) diff --git a/controllers/storagecluster/storageclient.go b/controllers/storagecluster/storageclient.go index d048ee52b3..220ea01f3c 100644 --- a/controllers/storagecluster/storageclient.go +++ b/controllers/storagecluster/storageclient.go @@ -17,8 +17,7 @@ import ( ) const ( - tokenLifetimeInHours = 48 - onboardingPrivateKeyFilePath = "/etc/private-key/key" + tokenLifetimeInHours = 48 ocsClientConfigMapName = "ocs-client-operator-config" deployCSIKey = "DEPLOY_CSI" @@ -44,7 +43,11 @@ func (s *storageClient) ensureCreated(r *StorageClusterReconciler, storagecluste storageClient.Name = storagecluster.Name _, err := controllerutil.CreateOrUpdate(r.ctx, r.Client, storageClient, func() error { if storageClient.Status.ConsumerID == "" { - token, err := util.GenerateClientOnboardingToken(tokenLifetimeInHours, onboardingPrivateKeyFilePath, nil) + privateKey, err := util.LoadOnboardingValidationPrivateKey(r.ctx, r.Client, r.OperatorNamespace) + if err != nil { + return fmt.Errorf("unable to get Parsed Private Key: %v", err) + } + token, err := util.GenerateClientOnboardingToken(tokenLifetimeInHours, privateKey, nil) if err != nil { return fmt.Errorf("unable to generate onboarding token: %v", err) } diff --git a/controllers/util/provider.go b/controllers/util/provider.go index ea21067943..6ef07da29a 100644 --- a/controllers/util/provider.go +++ b/controllers/util/provider.go @@ -1,6 +1,7 @@ package util import ( + "context" "crypto" "crypto/rand" "crypto/rsa" @@ -10,17 +11,20 @@ import ( "encoding/json" "encoding/pem" "fmt" - "os" "time" "github.com/google/uuid" "github.com/red-hat-storage/ocs-operator/v4/services" + corev1 "k8s.io/api/core/v1" + "sigs.k8s.io/controller-runtime/pkg/client" ) +const onboardingValidationPrivateKeySecretName = "onboarding-private-key" + // GenerateClientOnboardingToken generates a ocs-client token valid for a duration of "tokenLifetimeInHours". // The token content is predefined and signed by the private key which'll be read from supplied "privateKeyPath". // The storageQuotaInGiB is optional, and it is used to limit the storage of PVC in the application cluster. -func GenerateClientOnboardingToken(tokenLifetimeInHours int, privateKeyPath string, storageQuotainGib *uint) (string, error) { +func GenerateClientOnboardingToken(tokenLifetimeInHours int, privateKey *rsa.PrivateKey, storageQuotainGib *uint) (string, error) { tokenExpirationDate := time.Now(). Add(time.Duration(tokenLifetimeInHours) * time.Hour). Unix() @@ -32,7 +36,7 @@ func GenerateClientOnboardingToken(tokenLifetimeInHours int, privateKeyPath stri StorageQuotaInGiB: storageQuotainGib, } - token, err := encodeAndSignOnboardingToken(privateKeyPath, ticket) + token, err := encodeAndSignOnboardingToken(privateKey, ticket) if err != nil { return "", err } @@ -41,7 +45,7 @@ func GenerateClientOnboardingToken(tokenLifetimeInHours int, privateKeyPath stri // GeneratePeerOnboardingToken generates a ocs-peer token valid for a duration of "tokenLifetimeInHours". // The token content is predefined and signed by the private key which'll be read from supplied "privateKeyPath". -func GeneratePeerOnboardingToken(tokenLifetimeInHours int, privateKeyPath string) (string, error) { +func GeneratePeerOnboardingToken(tokenLifetimeInHours int, privateKey *rsa.PrivateKey) (string, error) { tokenExpirationDate := time.Now(). Add(time.Duration(tokenLifetimeInHours) * time.Hour). Unix() @@ -51,7 +55,7 @@ func GeneratePeerOnboardingToken(tokenLifetimeInHours int, privateKeyPath string ExpirationDate: tokenExpirationDate, SubjectRole: services.PeerRole, } - token, err := encodeAndSignOnboardingToken(privateKeyPath, ticket) + token, err := encodeAndSignOnboardingToken(privateKey, ticket) if err != nil { return "", err } @@ -60,7 +64,7 @@ func GeneratePeerOnboardingToken(tokenLifetimeInHours int, privateKeyPath string // encodeAndSignOnboardingToken generates a token from the ticket. // The token content is predefined and signed by the private key which'll be read from supplied "privateKeyPath". -func encodeAndSignOnboardingToken(privateKeyPath string, ticket services.OnboardingTicket) (string, error) { +func encodeAndSignOnboardingToken(privateKey *rsa.PrivateKey, ticket services.OnboardingTicket) (string, error) { payload, err := json.Marshal(ticket) if err != nil { return "", fmt.Errorf("failed to marshal the payload: %v", err) @@ -75,11 +79,6 @@ func encodeAndSignOnboardingToken(privateKeyPath string, ticket services.Onboard return "", fmt.Errorf("failed to hash onboarding token payload: %v", err) } - privateKey, err := readAndDecodePrivateKey(privateKeyPath) - if err != nil { - return "", fmt.Errorf("failed to read and decode private key: %v", err) - } - msgHashSum := msgHash.Sum(nil) // In order to generate the signature, we provide a random number generator, // our private key, the hashing algorithm that we used, and the hash sum @@ -93,16 +92,26 @@ func encodeAndSignOnboardingToken(privateKeyPath string, ticket services.Onboard return fmt.Sprintf("%s.%s", encodedPayload, encodedSignature), nil } -func readAndDecodePrivateKey(privateKeyPath string) (*rsa.PrivateKey, error) { - pemString, err := os.ReadFile(privateKeyPath) +func LoadOnboardingValidationPrivateKey(ctx context.Context, cl client.Client, namespace string) (*rsa.PrivateKey, error) { + privateSecret := &corev1.Secret{} + privateSecret.Name = onboardingValidationPrivateKeySecretName + privateSecret.Namespace = namespace + + err := cl.Get(ctx, client.ObjectKeyFromObject(privateSecret), privateSecret) if err != nil { - return nil, fmt.Errorf("failed to read private key: %v", err) + return nil, fmt.Errorf("failed to get private secret: %v", err) } - Block, _ := pem.Decode(pemString) - privateKey, err := x509.ParsePKCS1PrivateKey(Block.Bytes) - if err != nil { - return nil, fmt.Errorf("failed to parse private key: %v", err) + if privateSecret.Data != nil { + if privateSecretKey, ok := privateSecret.Data["key"]; ok { + Block, _ := pem.Decode(privateSecretKey) + privateKey, err := x509.ParsePKCS1PrivateKey(Block.Bytes) + if err != nil { + return nil, fmt.Errorf("failed to parse private key: %v", err) + } + return privateKey, nil + } } - return privateKey, nil + + return nil, fmt.Errorf("No data found in secret") } diff --git a/deploy/ocs-operator/manifests/ocs-operator.clusterserviceversion.yaml b/deploy/ocs-operator/manifests/ocs-operator.clusterserviceversion.yaml index 296674280b..e0760e42d0 100644 --- a/deploy/ocs-operator/manifests/ocs-operator.clusterserviceversion.yaml +++ b/deploy/ocs-operator/manifests/ocs-operator.clusterserviceversion.yaml @@ -626,6 +626,10 @@ spec: - name: ONBOARDING_TOKEN_LIFETIME - name: UX_BACKEND_PORT - name: TLS_ENABLED + - name: POD_NAMESPACE + valueFrom: + fieldRef: + fieldPath: metadata.namespace image: quay.io/ocs-dev/ocs-operator:latest imagePullPolicy: IfNotPresent name: ux-backend-server @@ -636,8 +640,6 @@ spec: readOnlyRootFilesystem: true runAsNonRoot: true volumeMounts: - - mountPath: /etc/private-key - name: onboarding-private-key - mountPath: /etc/tls/private name: ux-cert-secret - args: @@ -673,10 +675,6 @@ spec: operator: Equal value: "true" volumes: - - name: onboarding-private-key - secret: - optional: true - secretName: onboarding-private-key - name: ux-proxy-secret secret: secretName: ux-backend-proxy diff --git a/metrics/vendor/github.com/red-hat-storage/ocs-operator/v4/controllers/util/provider.go b/metrics/vendor/github.com/red-hat-storage/ocs-operator/v4/controllers/util/provider.go index ea21067943..6ef07da29a 100644 --- a/metrics/vendor/github.com/red-hat-storage/ocs-operator/v4/controllers/util/provider.go +++ b/metrics/vendor/github.com/red-hat-storage/ocs-operator/v4/controllers/util/provider.go @@ -1,6 +1,7 @@ package util import ( + "context" "crypto" "crypto/rand" "crypto/rsa" @@ -10,17 +11,20 @@ import ( "encoding/json" "encoding/pem" "fmt" - "os" "time" "github.com/google/uuid" "github.com/red-hat-storage/ocs-operator/v4/services" + corev1 "k8s.io/api/core/v1" + "sigs.k8s.io/controller-runtime/pkg/client" ) +const onboardingValidationPrivateKeySecretName = "onboarding-private-key" + // GenerateClientOnboardingToken generates a ocs-client token valid for a duration of "tokenLifetimeInHours". // The token content is predefined and signed by the private key which'll be read from supplied "privateKeyPath". // The storageQuotaInGiB is optional, and it is used to limit the storage of PVC in the application cluster. -func GenerateClientOnboardingToken(tokenLifetimeInHours int, privateKeyPath string, storageQuotainGib *uint) (string, error) { +func GenerateClientOnboardingToken(tokenLifetimeInHours int, privateKey *rsa.PrivateKey, storageQuotainGib *uint) (string, error) { tokenExpirationDate := time.Now(). Add(time.Duration(tokenLifetimeInHours) * time.Hour). Unix() @@ -32,7 +36,7 @@ func GenerateClientOnboardingToken(tokenLifetimeInHours int, privateKeyPath stri StorageQuotaInGiB: storageQuotainGib, } - token, err := encodeAndSignOnboardingToken(privateKeyPath, ticket) + token, err := encodeAndSignOnboardingToken(privateKey, ticket) if err != nil { return "", err } @@ -41,7 +45,7 @@ func GenerateClientOnboardingToken(tokenLifetimeInHours int, privateKeyPath stri // GeneratePeerOnboardingToken generates a ocs-peer token valid for a duration of "tokenLifetimeInHours". // The token content is predefined and signed by the private key which'll be read from supplied "privateKeyPath". -func GeneratePeerOnboardingToken(tokenLifetimeInHours int, privateKeyPath string) (string, error) { +func GeneratePeerOnboardingToken(tokenLifetimeInHours int, privateKey *rsa.PrivateKey) (string, error) { tokenExpirationDate := time.Now(). Add(time.Duration(tokenLifetimeInHours) * time.Hour). Unix() @@ -51,7 +55,7 @@ func GeneratePeerOnboardingToken(tokenLifetimeInHours int, privateKeyPath string ExpirationDate: tokenExpirationDate, SubjectRole: services.PeerRole, } - token, err := encodeAndSignOnboardingToken(privateKeyPath, ticket) + token, err := encodeAndSignOnboardingToken(privateKey, ticket) if err != nil { return "", err } @@ -60,7 +64,7 @@ func GeneratePeerOnboardingToken(tokenLifetimeInHours int, privateKeyPath string // encodeAndSignOnboardingToken generates a token from the ticket. // The token content is predefined and signed by the private key which'll be read from supplied "privateKeyPath". -func encodeAndSignOnboardingToken(privateKeyPath string, ticket services.OnboardingTicket) (string, error) { +func encodeAndSignOnboardingToken(privateKey *rsa.PrivateKey, ticket services.OnboardingTicket) (string, error) { payload, err := json.Marshal(ticket) if err != nil { return "", fmt.Errorf("failed to marshal the payload: %v", err) @@ -75,11 +79,6 @@ func encodeAndSignOnboardingToken(privateKeyPath string, ticket services.Onboard return "", fmt.Errorf("failed to hash onboarding token payload: %v", err) } - privateKey, err := readAndDecodePrivateKey(privateKeyPath) - if err != nil { - return "", fmt.Errorf("failed to read and decode private key: %v", err) - } - msgHashSum := msgHash.Sum(nil) // In order to generate the signature, we provide a random number generator, // our private key, the hashing algorithm that we used, and the hash sum @@ -93,16 +92,26 @@ func encodeAndSignOnboardingToken(privateKeyPath string, ticket services.Onboard return fmt.Sprintf("%s.%s", encodedPayload, encodedSignature), nil } -func readAndDecodePrivateKey(privateKeyPath string) (*rsa.PrivateKey, error) { - pemString, err := os.ReadFile(privateKeyPath) +func LoadOnboardingValidationPrivateKey(ctx context.Context, cl client.Client, namespace string) (*rsa.PrivateKey, error) { + privateSecret := &corev1.Secret{} + privateSecret.Name = onboardingValidationPrivateKeySecretName + privateSecret.Namespace = namespace + + err := cl.Get(ctx, client.ObjectKeyFromObject(privateSecret), privateSecret) if err != nil { - return nil, fmt.Errorf("failed to read private key: %v", err) + return nil, fmt.Errorf("failed to get private secret: %v", err) } - Block, _ := pem.Decode(pemString) - privateKey, err := x509.ParsePKCS1PrivateKey(Block.Bytes) - if err != nil { - return nil, fmt.Errorf("failed to parse private key: %v", err) + if privateSecret.Data != nil { + if privateSecretKey, ok := privateSecret.Data["key"]; ok { + Block, _ := pem.Decode(privateSecretKey) + privateKey, err := x509.ParsePKCS1PrivateKey(Block.Bytes) + if err != nil { + return nil, fmt.Errorf("failed to parse private key: %v", err) + } + return privateKey, nil + } } - return privateKey, nil + + return nil, fmt.Errorf("No data found in secret") } diff --git a/services/ux-backend/handlers/onboarding/clienttokens/handler.go b/services/ux-backend/handlers/onboarding/clienttokens/handler.go index cd4cc5c932..334fbe5fb0 100644 --- a/services/ux-backend/handlers/onboarding/clienttokens/handler.go +++ b/services/ux-backend/handlers/onboarding/clienttokens/handler.go @@ -1,6 +1,7 @@ package clienttokens import ( + "context" "encoding/json" "fmt" "math" @@ -11,10 +12,7 @@ import ( "k8s.io/klog/v2" "k8s.io/utils/ptr" -) - -const ( - onboardingPrivateKeyFilePath = "/etc/private-key/key" + "sigs.k8s.io/controller-runtime/pkg/client" ) var unitToGib = map[string]uint{ @@ -23,26 +21,26 @@ var unitToGib = map[string]uint{ "Pi": 1024 * 1024, } -func HandleMessage(w http.ResponseWriter, r *http.Request, tokenLifetimeInHours int) { +func HandleMessage(ctx context.Context, w http.ResponseWriter, r *http.Request, tokenLifetimeInHours int, cl client.Client, namespace string) { switch r.Method { case "POST": - handlePost(w, r, tokenLifetimeInHours) + handlePost(ctx, w, r, tokenLifetimeInHours, cl, namespace) default: handleUnsupportedMethod(w, r) } } -func handlePost(w http.ResponseWriter, r *http.Request, tokenLifetimeInHours int) { +func handlePost(ctx context.Context, w http.ResponseWriter, r *http.Request, tokenLifetimeInHours int, cl client.Client, namespace string) { var storageQuotaInGiB *uint // When ContentLength is 0 that means request body is empty and // storage quota is unlimited - var err error + if r.ContentLength != 0 { var quota = struct { Value uint `json:"value"` Unit string `json:"unit"` }{} - if err = json.NewDecoder(r.Body).Decode("a); err != nil { + if err := json.NewDecoder(r.Body).Decode("a); err != nil { http.Error(w, err.Error(), http.StatusBadRequest) return } @@ -59,7 +57,14 @@ func handlePost(w http.ResponseWriter, r *http.Request, tokenLifetimeInHours int storageQuotaInGiB = ptr.To(unitAsGiB * quota.Value) } - if onboardingToken, err := util.GenerateClientOnboardingToken(tokenLifetimeInHours, onboardingPrivateKeyFilePath, storageQuotaInGiB); err != nil { + privateKey, err := util.LoadOnboardingValidationPrivateKey(ctx, cl, namespace) + klog.Info("Getting the Pem key") + if err != nil { + http.Error(w, fmt.Sprintf("Failed to get private key: %v", err), http.StatusBadRequest) + return + } + + if onboardingToken, err := util.GenerateClientOnboardingToken(tokenLifetimeInHours, privateKey, storageQuotaInGiB); err != nil { klog.Errorf("failed to get onboarding token: %v", err) w.WriteHeader(http.StatusInternalServerError) w.Header().Set("Content-Type", handlers.ContentTypeTextPlain) diff --git a/services/ux-backend/handlers/onboarding/peertokens/handler.go b/services/ux-backend/handlers/onboarding/peertokens/handler.go index 9dfd8ff414..bad8ed8381 100644 --- a/services/ux-backend/handlers/onboarding/peertokens/handler.go +++ b/services/ux-backend/handlers/onboarding/peertokens/handler.go @@ -1,6 +1,7 @@ package peertokens import ( + "context" "fmt" "net/http" @@ -8,23 +9,30 @@ import ( "github.com/red-hat-storage/ocs-operator/v4/services/ux-backend/handlers" "k8s.io/klog/v2" + "sigs.k8s.io/controller-runtime/pkg/client" ) -const ( - onboardingPrivateKeyFilePath = "/etc/private-key/key" -) - -func HandleMessage(w http.ResponseWriter, r *http.Request, tokenLifetimeInHours int) { +func HandleMessage(w http.ResponseWriter, r *http.Request, tokenLifetimeInHours int, cl client.Client, namespace string) { switch r.Method { case "POST": - handlePost(w, r, tokenLifetimeInHours) + handlePost(w, r, tokenLifetimeInHours, cl, namespace) default: handleUnsupportedMethod(w, r) } } -func handlePost(w http.ResponseWriter, _ *http.Request, tokenLifetimeInHours int) { - if onboardingToken, err := util.GeneratePeerOnboardingToken(tokenLifetimeInHours, onboardingPrivateKeyFilePath); err != nil { +func handlePost(w http.ResponseWriter, _ *http.Request, tokenLifetimeInHours int, cl client.Client, namespace string) { + var err error + + ctx := context.TODO() + privateKey, err := util.LoadOnboardingValidationPrivateKey(ctx, cl, namespace) + klog.Info("Getting the Pem key") + if err != nil { + http.Error(w, fmt.Sprintf("Failed to get private key: %v", err), http.StatusBadRequest) + return + } + + if onboardingToken, err := util.GeneratePeerOnboardingToken(tokenLifetimeInHours, privateKey); err != nil { klog.Errorf("failed to get onboarding token: %v", err) w.WriteHeader(http.StatusInternalServerError) w.Header().Set("Content-Type", handlers.ContentTypeTextPlain) diff --git a/services/ux-backend/main.go b/services/ux-backend/main.go index a88c1762b2..f23940aa45 100644 --- a/services/ux-backend/main.go +++ b/services/ux-backend/main.go @@ -7,10 +7,15 @@ import ( "os" "strconv" + "github.com/red-hat-storage/ocs-operator/v4/controllers/util" "github.com/red-hat-storage/ocs-operator/v4/services/ux-backend/handlers/onboarding/clienttokens" "github.com/red-hat-storage/ocs-operator/v4/services/ux-backend/handlers/onboarding/peertokens" + corev1 "k8s.io/api/core/v1" + "k8s.io/apimachinery/pkg/runtime" "k8s.io/klog/v2" + "sigs.k8s.io/controller-runtime/pkg/client" + "sigs.k8s.io/controller-runtime/pkg/client/config" ) type serverConfig struct { @@ -52,6 +57,25 @@ func loadAndValidateServerConfig() (*serverConfig, error) { return &config, nil } +func newK8sClient() (client.Client, error) { + klog.Info("Setting up k8s client") + scheme := runtime.NewScheme() + if err := corev1.AddToScheme(scheme); err != nil { + return nil, err + } + + config, err := config.GetConfig() + if err != nil { + return nil, err + } + k8sClient, err := client.New(config, client.Options{Scheme: scheme}) + if err != nil { + return nil, err + } + + return k8sClient, nil +} + func main() { klog.Info("Starting ux backend server") @@ -63,18 +87,25 @@ func main() { os.Exit(-1) } + cl, err := newK8sClient() + if err != nil { + klog.Exitf("failed to create client: %v", err) + } + + namespace := util.GetPodNamespace() + // TODO: remove '/onboarding-tokens' in the future http.HandleFunc("/onboarding-tokens", func(w http.ResponseWriter, r *http.Request) { // Set the Deprecation header w.Header().Set("Deprecation", "true") // Standard "Deprecation" header w.Header().Set("Link", "/onboarding/client-tokens; rel=\"alternate\"") - clienttokens.HandleMessage(w, r, config.tokenLifetimeInHours) + clienttokens.HandleMessage(r.Context(), w, r, config.tokenLifetimeInHours, cl, namespace) }) http.HandleFunc("/onboarding/client-tokens", func(w http.ResponseWriter, r *http.Request) { - clienttokens.HandleMessage(w, r, config.tokenLifetimeInHours) + clienttokens.HandleMessage(r.Context(), w, r, config.tokenLifetimeInHours, cl, namespace) }) http.HandleFunc("/onboarding/peer-tokens", func(w http.ResponseWriter, r *http.Request) { - peertokens.HandleMessage(w, r, config.tokenLifetimeInHours) + peertokens.HandleMessage(w, r, config.tokenLifetimeInHours, cl, namespace) }) klog.Info("ux backend server listening on port ", config.listenPort) diff --git a/tools/csv-merger/csv-merger.go b/tools/csv-merger/csv-merger.go index a39e88894c..29acf6e5e3 100644 --- a/tools/csv-merger/csv-merger.go +++ b/tools/csv-merger/csv-merger.go @@ -644,10 +644,6 @@ func getUXBackendServerDeployment() appsv1.DeploymentSpec { { Name: "ux-backend-server", VolumeMounts: []corev1.VolumeMount{ - { - Name: "onboarding-private-key", - MountPath: "/etc/private-key", - }, { Name: "ux-cert-secret", MountPath: "/etc/tls/private", @@ -674,6 +670,14 @@ func getUXBackendServerDeployment() appsv1.DeploymentSpec { Name: "TLS_ENABLED", Value: os.Getenv("TLS_ENABLED"), }, + { + Name: util.PodNamespaceEnvVar, + ValueFrom: &corev1.EnvVarSource{ + FieldRef: &corev1.ObjectFieldSelector{ + FieldPath: "metadata.namespace", + }, + }, + }, }, SecurityContext: &corev1.SecurityContext{ RunAsNonRoot: ptr.To(true), @@ -716,15 +720,6 @@ func getUXBackendServerDeployment() appsv1.DeploymentSpec { }, }, Volumes: []corev1.Volume{ - { - Name: "onboarding-private-key", - VolumeSource: corev1.VolumeSource{ - Secret: &corev1.SecretVolumeSource{ - SecretName: "onboarding-private-key", - Optional: ptr.To(true), - }, - }, - }, { Name: "ux-proxy-secret", VolumeSource: corev1.VolumeSource{