Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Removing TF secret prefix #6273

Merged
merged 5 commits into from
Sep 19, 2023
Merged

Removing TF secret prefix #6273

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ab72925
removing tf secret prefix
sk593 Sep 14, 2023
4ef9f3a
update func tests
sk593 Sep 14, 2023
64bcf8d
update func test
sk593 Sep 15, 2023
da95c77
revert name
sk593 Sep 19, 2023
b158633
nit
sk593 Sep 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 1 addition & 12 deletions pkg/recipes/terraform/config/backends/kubernetes.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,24 +71,13 @@ func generateSecretSuffix(resourceRecipe *recipes.ResourceMetadata) (string, err
return "", err
}

prefix := fmt.Sprintf("%s-%s-%s", parsedEnvID.Name(), parsedAppID.Name(), parsedResourceID.Name())

// Kubernetes enforces a character limit of 63 characters on the suffix for state file stored in kubernetes secret.
// 22 = 63 (max length of Kubernetes secret suffix) - 40 (hex hash length) - 1 (dot separator)
maxResourceNameLen := 22
if len(prefix) >= maxResourceNameLen {
prefix = prefix[:maxResourceNameLen]
}

hasher := sha1.New()
_, err = hasher.Write([]byte(strings.ToLower(fmt.Sprintf("%s-%s-%s", parsedEnvID.Name(), parsedAppID.Name(), parsedResourceID.String()))))
if err != nil {
return "", err
}
hash := hasher.Sum(nil)

// example: env-app-redis.ec291e26078b7ea8a74abfac82530005a0ecbf15
return fmt.Sprintf("%s.%x", prefix, hash), nil
return fmt.Sprintf("%x", hash), nil
sk593 marked this conversation as resolved.
Show resolved Hide resolved
}

// generateKubernetesBackendConfig returns Terraform backend configuration to store Terraform state file for the deployment.
Expand Down
46 changes: 32 additions & 14 deletions pkg/recipes/terraform/config/backends/kubernetes_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,9 @@ const (
testTemplatePath = "Azure/redis/azurerm"
testRecipeName = "redis-azure"
testTemplateVersion = "1.1.0"
envName = "env"
appName = "app"
resourceName = "redis"
)

var (
Expand Down Expand Up @@ -82,28 +85,43 @@ func Test_GenerateKubernetesBackendConfig(t *testing.T) {
require.Equal(t, expectedConfig, actualConfig)
}

func Test_GenerateKubernetesBackendConfig_Error(t *testing.T) {
t.Setenv("KUBERNETES_SERVICE_HOST", "testvalue")
t.Setenv("KUBERNETES_SERVICE_PORT", "1111")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This makes me pretty nervous. Do you know why this is needed?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc/ @vishwahiremat (this was an existing test, I just moved the function up)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This was done to inject error for rest.InClusterConfig() call, but I understand this isn't most reliable, so I'm fine with removing this test unless we can find a better way to inject failure.


backend, err := generateKubernetesBackendConfig("test-suffix")
require.Error(t, err)
require.Nil(t, backend)
}

func Test_GenerateSecretSuffix(t *testing.T) {
_, resourceRecipe := getTestInputs()
hasher := sha1.New()
_, err := hasher.Write([]byte(strings.ToLower(fmt.Sprintf("%s-%s-%s", envName, appName, resourceRecipe.ResourceID))))
require.NoError(t, err)
expSecret := fmt.Sprintf("%x", hasher.Sum(nil))
secret, err := generateSecretSuffix(&resourceRecipe)
require.NoError(t, err)
require.Equal(t, expSecret, secret)
}

func Test_GenerateSecretSuffix_invalid_resourceid(t *testing.T) {
_, resourceRecipe := getTestInputs()
resourceRecipe.ResourceID = "invalid"
_, err := generateSecretSuffix(&resourceRecipe)
require.Equal(t, err.Error(), "'invalid' is not a valid resource id")
}

func Test_GenerateSecretSuffix_with_lengthy_resource_name(t *testing.T) {
func Test_GenerateSecretSuffix_invalid_envid(t *testing.T) {
_, resourceRecipe := getTestInputs()
act, err := generateSecretSuffix(&resourceRecipe)
require.NoError(t, err)
hasher := sha1.New()
_, _ = hasher.Write([]byte(strings.ToLower("env-app-" + resourceRecipe.ResourceID)))
hash := hasher.Sum(nil)
require.Equal(t, act, "env-app-redis."+fmt.Sprintf("%x", hash))
resourceRecipe.EnvironmentID = "invalid"
_, err := generateSecretSuffix(&resourceRecipe)
require.Equal(t, err.Error(), "'invalid' is not a valid resource id")
}

func Test_GenerateKubernetesBackendConfig_Error(t *testing.T) {
t.Setenv("KUBERNETES_SERVICE_HOST", "testvalue")
t.Setenv("KUBERNETES_SERVICE_PORT", "1111")

backend, err := generateKubernetesBackendConfig("test-suffix")
require.Error(t, err)
require.Nil(t, backend)
func Test_GenerateSecretSuffix_invalid_appid(t *testing.T) {
_, resourceRecipe := getTestInputs()
resourceRecipe.ApplicationID = "invalid"
_, err := generateSecretSuffix(&resourceRecipe)
require.Equal(t, err.Error(), "'invalid' is not a valid resource id")
}
28 changes: 13 additions & 15 deletions test/functional/shared/resources/recipe_terraform_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,6 @@ package resource_test

import (
"context"
"crypto/sha1"
"encoding/base64"
"encoding/json"
"fmt"
Expand All @@ -39,6 +38,7 @@ import (
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"

"github.com/radius-project/radius/pkg/recipes"
"github.com/radius-project/radius/pkg/recipes/terraform/config/backends"
"github.com/radius-project/radius/pkg/ucp/resources"
resources_radius "github.com/radius-project/radius/pkg/ucp/resources/radius"
"github.com/radius-project/radius/test/functional"
Expand Down Expand Up @@ -382,24 +382,22 @@ func testSecretDeletion(t *testing.T, ctx context.Context, test shared.RPTest, a
}

func getSecretSuffix(resourceID, envName, appName string) (string, error) {
parsedResourceID, err := resources.Parse(resourceID)
if err != nil {
return "", err
}

prefix := fmt.Sprintf("%s-%s-%s", envName, appName, parsedResourceID.Name())
maxResourceNameLen := 22
if len(prefix) >= maxResourceNameLen {
prefix = prefix[:maxResourceNameLen]
envID := "/planes/radius/local/resourcegroups/kind-radius/providers/Applications.Core/environments/" + envName
appID := "/planes/radius/local/resourcegroups/kind-radius/providers/Applications.Core/applications/" + appName

resourceRecipe := recipes.ResourceMetadata{
EnvironmentID: envID,
ApplicationID: appID,
ResourceID: resourceID,
Parameters: nil,
}

hasher := sha1.New()
_, err = hasher.Write([]byte(strings.ToLower(fmt.Sprintf("%s-%s-%s", envName, appName, parsedResourceID.String()))))
backend := backends.NewKubernetesBackend()
secretMap, err := backend.BuildBackend(&resourceRecipe)
if err != nil {
return "", err
}
hash := hasher.Sum(nil)
kubernetes := secretMap["kubernetes"].(map[string]any)

// example: env-app-redis.ec291e26078b7ea8a74abfac82530005a0ecbf15
return fmt.Sprintf("%s.%x", prefix, hash), nil
return kubernetes["secret_suffix"].(string), nil
}