msb-public
/
helm
mirror of https://github.com/helm/helm
1
0
Code Issues Projects Releases Wiki Activity

Hardcoded value removed

Browse Source 
Signed-off-by: Sunil Kumar <suryakn27@outlook.com>
pull/10807/head^2
suryatech27-cloud 4 years ago
parent c0eba04702
commit 163af70dae
6 changed files with 59 additions and 37 deletions
Show Stats Download Patch File Download Diff File

1
cmd/helm/root.go
Unescape View File

@ -67,6 +67,7 @@ Environment variables:
| $HELM_KUBEASUSER | set the Username to impersonate for the operation. | | $HELM_KUBEASUSER | set the Username to impersonate for the operation. |
| $HELM_KUBECONTEXT | set the name of the kubeconfig context. | | $HELM_KUBECONTEXT | set the name of the kubeconfig context. |
| $HELM_KUBETOKEN | set the Bearer KubeToken used for authentication. | | $HELM_KUBETOKEN | set the Bearer KubeToken used for authentication. |
| $HELM_SECONDARY_CERT_DIR | set the secondary certificate directory for 2-way ssl support for oci pull. |
Helm stores cache, configuration, and data based on the following configuration order: Helm stores cache, configuration, and data based on the following configuration order:

1
cmd/helm/testdata/output/env-comp.txt vendored
Unescape View File

@ -15,5 +15,6 @@ HELM_PLUGINS
HELM_REGISTRY_CONFIG HELM_REGISTRY_CONFIG
HELM_REPOSITORY_CACHE HELM_REPOSITORY_CACHE
HELM_REPOSITORY_CONFIG HELM_REPOSITORY_CONFIG
HELM_SECONDARY_CERT_DIR
:4 :4
Completion ended with directive: ShellCompDirectiveNoFileComp Completion ended with directive: ShellCompDirectiveNoFileComp

38
internal/tlsutil/cfg.go
Unescape View File

@ -22,8 +22,10 @@ import (
"fmt" "fmt"
"io/ioutil" "io/ioutil"
"os" "os"
"os/exec"
"path/filepath" "path/filepath"
"runtime" "runtime"
"strings"
"github.com/pkg/errors" "github.com/pkg/errors"
) )
@ -61,13 +63,27 @@ func ClientConfig(opts Options) (cfg *tls.Config, err error) {
return cfg, nil return cfg, nil
} }
func ReadCertFromSecDir(cfgFileBaseName string, host string) (opts Options, err error) { func ReadCertFromSecDir(host string) (opts Options, err error) {
if runtime.GOOS == "windows" || runtime.GOOS == "unix" { if runtime.GOOS == "windows" || runtime.GOOS == "unix" {
fmt.Printf("%v OS not supported for this oci pull. Contact your administrator for more information !!!", runtime.GOOS) fmt.Printf("%v OS not supported for this oci pull. Contact your administrator for more information !!!", runtime.GOOS)
os.Exit(1)
} else { } else {
var clientCertDir = "/etc/docker/certs.d/" cmd, err := exec.Command("helm", "env", "HELM_SECONDARY_CERT_DIR").Output()
clientCertDir = clientCertDir + host if err != nil {
fmt.Printf("Error : %s", err)
os.Exit(1)
}
clientCertDir := strings.TrimSuffix(string(cmd), "\n")
if clientCertDir == "" {
fmt.Printf("Please Configure secondary certificate directory for ssl connection set/export HELM_SECONDARY_CERT_DIR='/etc/docker/certs.d/'\n")
os.Exit(1)
}
lastIndex := strings.LastIndexByte(clientCertDir, '/')
if lastIndex < 19 {
clientCertDir = fmt.Sprintf("%s/%s", clientCertDir, host)
} else {
clientCertDir = fmt.Sprintf("%s%s", clientCertDir, host)
}
if _, err := os.Stat(clientCertDir); err != nil { if _, err := os.Stat(clientCertDir); err != nil {
if os.IsNotExist(err) { if os.IsNotExist(err) {
os.MkdirAll(clientCertDir, os.ModePerm) os.MkdirAll(clientCertDir, os.ModePerm)
@ -78,11 +94,11 @@ func ReadCertFromSecDir(cfgFileBaseName string, host string) (opts Options, err
if files, err := ioutil.ReadDir(clientCertDir); err == nil { if files, err := ioutil.ReadDir(clientCertDir); err == nil {
for _, file := range files { for _, file := range files {
if filepath.Ext(file.Name()) == ".crt" { if filepath.Ext(file.Name()) == ".crt" {
opts.CaCertFile = clientCertDir + "/" + file.Name() opts.CaCertFile = fmt.Sprintf("%s/%s", clientCertDir, file.Name())
} else if filepath.Ext(file.Name()) == ".pem" { } else if filepath.Ext(file.Name()) == ".pem" {
opts.CertFile = clientCertDir + "/" + file.Name() opts.CertFile = fmt.Sprintf("%s/%s", clientCertDir, file.Name())
} else if filepath.Ext(file.Name()) == ".key" { } else if filepath.Ext(file.Name()) == ".key" {
opts.KeyFile = clientCertDir + "/" + file.Name() opts.KeyFile = fmt.Sprintf("%s/%s", clientCertDir, file.Name())
} }
} }
} else { } else {
@ -90,22 +106,22 @@ func ReadCertFromSecDir(cfgFileBaseName string, host string) (opts Options, err
os.Exit(1) os.Exit(1)
} }
if opts.CaCertFile == "" && opts.CertFile == "" && opts.KeyFile == "" { if opts.CaCertFile == "" && opts.CertFile == "" && opts.KeyFile == "" {
fmt.Printf("Error Certificate (cacerts.crt,client.pem,client.key) required : Client authentication failed due to certificate not present in cert directory !! \n") fmt.Printf("Error : Missing certificate (cacerts.crt,client.pem,client.key) required !!\n")
os.Exit(1) os.Exit(1)
} }
if opts.CaCertFile == "" && opts.CertFile == "" { if opts.CaCertFile == "" && opts.CertFile == "" {
fmt.Printf("Error Certificate Required : Root-CA and client certificate (cacerts.crt,client.pem) not found.\n") fmt.Printf("Error : Missing certificate : Root-CA and client certificate (cacerts.crt,client.pem) required !!\n")
os.Exit(1) os.Exit(1)
} }
if opts.CaCertFile == "" && opts.KeyFile == "" { if opts.CaCertFile == "" && opts.KeyFile == "" {
fmt.Printf("Error Certificate Required : Root-CA and and client keyfie (cacerts.crt,client.key) not found.\n") fmt.Printf("Error Certificate Required : Root-CA and and client key (cacerts.crt,client.key) not found.\n")
os.Exit(1) os.Exit(1)
} }
if opts.CertFile == "" && opts.KeyFile == "" { if opts.CertFile == "" && opts.KeyFile == "" {
fmt.Printf("Error Certificate Required : Client certificate and client keyfile (client.pem,client.key) not found.\n") fmt.Printf("Error Certificate Required : Client certificate and client key (client.pem,client.key) not found.\n")
os.Exit(1) os.Exit(1)
} }
if opts.CaCertFile == "" { if opts.CaCertFile == "" {

1
pkg/action/pull.go
Unescape View File

@ -125,7 +125,6 @@ func (p *Pull) Run(chartRef string) (string, error) {
saved, v, err := c.DownloadTo(chartRef, p.Version, dest) saved, v, err := c.DownloadTo(chartRef, p.Version, dest)
if err != nil { if err != nil {
//fmt.Printf("Error : %v\n", err)
if strings.Contains(fmt.Sprint(err), "remote error: tls: handshake failure") { if strings.Contains(fmt.Sprint(err), "remote error: tls: handshake failure") {
registryClient, err := registry.NewCrosClient(chartRef, registryClient, err := registry.NewCrosClient(chartRef,
registry.ClientOptDebug(p.Settings.Debug), registry.ClientOptDebug(p.Settings.Debug),

51
pkg/cli/environment.go
Unescape View File

@ -68,22 +68,25 @@ type EnvSettings struct {
PluginsDirectory string PluginsDirectory string
// MaxHistory is the max release history maintained. // MaxHistory is the max release history maintained.
MaxHistory int MaxHistory int
// Secondary Certificate directory for helm oci pull
ClientSecCertDirectory string
} }
func New() *EnvSettings { func New() *EnvSettings {
env := &EnvSettings{ env := &EnvSettings{
namespace: os.Getenv("HELM_NAMESPACE"), namespace: os.Getenv("HELM_NAMESPACE"),
MaxHistory: envIntOr("HELM_MAX_HISTORY", defaultMaxHistory), MaxHistory: envIntOr("HELM_MAX_HISTORY", defaultMaxHistory),
KubeContext: os.Getenv("HELM_KUBECONTEXT"), KubeContext: os.Getenv("HELM_KUBECONTEXT"),
KubeToken: os.Getenv("HELM_KUBETOKEN"), KubeToken: os.Getenv("HELM_KUBETOKEN"),
KubeAsUser: os.Getenv("HELM_KUBEASUSER"), KubeAsUser: os.Getenv("HELM_KUBEASUSER"),
KubeAsGroups: envCSV("HELM_KUBEASGROUPS"), KubeAsGroups: envCSV("HELM_KUBEASGROUPS"),
KubeAPIServer: os.Getenv("HELM_KUBEAPISERVER"), KubeAPIServer: os.Getenv("HELM_KUBEAPISERVER"),
KubeCaFile: os.Getenv("HELM_KUBECAFILE"), KubeCaFile: os.Getenv("HELM_KUBECAFILE"),
PluginsDirectory: envOr("HELM_PLUGINS", helmpath.DataPath("plugins")), ClientSecCertDirectory: envOr("HELM_SECONDARY_CERT_DIR", ""),
RegistryConfig: envOr("HELM_REGISTRY_CONFIG", helmpath.ConfigPath("registry/config.json")), PluginsDirectory: envOr("HELM_PLUGINS", helmpath.DataPath("plugins")),
RepositoryConfig: envOr("HELM_REPOSITORY_CONFIG", helmpath.ConfigPath("repositories.yaml")), RegistryConfig: envOr("HELM_REGISTRY_CONFIG", helmpath.ConfigPath("registry/config.json")),
RepositoryCache: envOr("HELM_REPOSITORY_CACHE", helmpath.CachePath("repository")), RepositoryConfig: envOr("HELM_REPOSITORY_CONFIG", helmpath.ConfigPath("repositories.yaml")),
RepositoryCache: envOr("HELM_REPOSITORY_CACHE", helmpath.CachePath("repository")),
} }
env.Debug, _ = strconv.ParseBool(os.Getenv("HELM_DEBUG")) env.Debug, _ = strconv.ParseBool(os.Getenv("HELM_DEBUG"))
@ -115,6 +118,7 @@ func (s *EnvSettings) AddFlags(fs *pflag.FlagSet) {
fs.StringVar(&s.RegistryConfig, "registry-config", s.RegistryConfig, "path to the registry config file") fs.StringVar(&s.RegistryConfig, "registry-config", s.RegistryConfig, "path to the registry config file")
fs.StringVar(&s.RepositoryConfig, "repository-config", s.RepositoryConfig, "path to the file containing repository names and URLs") fs.StringVar(&s.RepositoryConfig, "repository-config", s.RepositoryConfig, "path to the file containing repository names and URLs")
fs.StringVar(&s.RepositoryCache, "repository-cache", s.RepositoryCache, "path to the file containing cached repository indexes") fs.StringVar(&s.RepositoryCache, "repository-cache", s.RepositoryCache, "path to the file containing cached repository indexes")
fs.StringVar(&s.ClientSecCertDirectory, "client-sec-cert-dir", s.ClientSecCertDirectory, "path to the secondary certificate directory used for 2-way ssl support(oci pull for artificat repo)")
} }
func envOr(name, def string) string { func envOr(name, def string) string {
@ -146,17 +150,18 @@ func envCSV(name string) (ls []string) {
func (s *EnvSettings) EnvVars() map[string]string { func (s *EnvSettings) EnvVars() map[string]string {
envvars := map[string]string{ envvars := map[string]string{
"HELM_BIN": os.Args[0], "HELM_BIN": os.Args[0],
"HELM_CACHE_HOME": helmpath.CachePath(""), "HELM_CACHE_HOME": helmpath.CachePath(""),
"HELM_CONFIG_HOME": helmpath.ConfigPath(""), "HELM_CONFIG_HOME": helmpath.ConfigPath(""),
"HELM_DATA_HOME": helmpath.DataPath(""), "HELM_DATA_HOME": helmpath.DataPath(""),
"HELM_DEBUG": fmt.Sprint(s.Debug), "HELM_DEBUG": fmt.Sprint(s.Debug),
"HELM_PLUGINS": s.PluginsDirectory, "HELM_PLUGINS": s.PluginsDirectory,
"HELM_REGISTRY_CONFIG": s.RegistryConfig, "HELM_REGISTRY_CONFIG": s.RegistryConfig,
"HELM_REPOSITORY_CACHE": s.RepositoryCache, "HELM_REPOSITORY_CACHE": s.RepositoryCache,
"HELM_REPOSITORY_CONFIG": s.RepositoryConfig, "HELM_REPOSITORY_CONFIG": s.RepositoryConfig,
"HELM_NAMESPACE": s.Namespace(), "HELM_NAMESPACE": s.Namespace(),
"HELM_MAX_HISTORY": strconv.Itoa(s.MaxHistory), "HELM_MAX_HISTORY": strconv.Itoa(s.MaxHistory),
"HELM_SECONDARY_CERT_DIR": s.ClientSecCertDirectory,
// broken, these are populated from helm flags and not kubeconfig. // broken, these are populated from helm flags and not kubeconfig.
"HELM_KUBECONTEXT": s.KubeContext, "HELM_KUBECONTEXT": s.KubeContext,

4
pkg/registry/client.go
Unescape View File

@ -155,9 +155,9 @@ func NewCrosClient(chartref string, options ...ClientOption) (*Client, error) {
if client.resolver == nil { if client.resolver == nil {
host, err := urlutil.ExtractHostname(chartref) host, err := urlutil.ExtractHostname(chartref)
if err != nil { if err != nil {
fmt.Printf("error :%v\n", err)
} }
clientOpts, err := tlsutil.ReadCertFromSecDir(CredentialsFileBasename, host) clientOpts, err := tlsutil.ReadCertFromSecDir(host)
if err != nil { if err != nil {
return client, errors.Wrapf(err, "Client certificate/directory Not Exist !!") return client, errors.Wrapf(err, "Client certificate/directory Not Exist !!")
} }

Write Preview
Loading…
Cancel
Save