mirror of https://github.com/helm/helm
Matt Farina
4 years ago
committed by
GitHub
commit
7953adb06c
@ -0,0 +1,58 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"io"
|
||||
"os"
|
||||
"os/user"
|
||||
"path/filepath"
|
||||
)
|
||||
|
||||
func checkPerms(out io.Writer) {
|
||||
// This function MUST NOT FAIL, as it is just a check for a common permissions problem.
|
||||
// If for some reason the function hits a stopping condition, it may panic. But only if
|
||||
// we can be sure that it is panicing because Helm cannot proceed.
|
||||
|
||||
kc := settings.KubeConfig
|
||||
if kc == "" {
|
||||
kc = os.Getenv("KUBECONFIG")
|
||||
}
|
||||
if kc == "" {
|
||||
u, err := user.Current()
|
||||
if err != nil {
|
||||
// No idea where to find KubeConfig, so return silently. Many helm commands
|
||||
// can proceed happily without a KUBECONFIG, so this is not a fatal error.
|
||||
return
|
||||
}
|
||||
kc = filepath.Join(u.HomeDir, ".kube", "config")
|
||||
}
|
||||
fi, err := os.Stat(kc)
|
||||
if err != nil {
|
||||
// DO NOT error if no KubeConfig is found. Not all commands require one.
|
||||
return
|
||||
}
|
||||
|
||||
perm := fi.Mode().Perm()
|
||||
if perm&0040 > 0 {
|
||||
fmt.Fprintf(out, "WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: %s\n", kc)
|
||||
}
|
||||
if perm&0004 > 0 {
|
||||
fmt.Fprintf(out, "WARNING: Kubernetes configuration file is world-readable. This is insecure. Location: %s\n", kc)
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,61 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"io/ioutil"
|
||||
"os"
|
||||
"path/filepath"
|
||||
"strings"
|
||||
"testing"
|
||||
)
|
||||
|
||||
func TestCheckPerms(t *testing.T) {
|
||||
tdir, err := ioutil.TempDir("", "helmtest")
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
defer os.RemoveAll(tdir)
|
||||
tfile := filepath.Join(tdir, "testconfig")
|
||||
fh, err := os.OpenFile(tfile, os.O_CREATE|os.O_APPEND|os.O_RDWR, 0440)
|
||||
if err != nil {
|
||||
t.Errorf("Failed to create temp file: %s", err)
|
||||
}
|
||||
|
||||
tconfig := settings.KubeConfig
|
||||
settings.KubeConfig = tfile
|
||||
defer func() { settings.KubeConfig = tconfig }()
|
||||
|
||||
var b bytes.Buffer
|
||||
checkPerms(&b)
|
||||
expectPrefix := "WARNING: Kubernetes configuration file is group-readable. This is insecure. Location:"
|
||||
if !strings.HasPrefix(b.String(), expectPrefix) {
|
||||
t.Errorf("Expected to get a warning for group perms. Got %q", b.String())
|
||||
}
|
||||
|
||||
if err := fh.Chmod(0404); err != nil {
|
||||
t.Errorf("Could not change mode on file: %s", err)
|
||||
}
|
||||
b.Reset()
|
||||
checkPerms(&b)
|
||||
expectPrefix = "WARNING: Kubernetes configuration file is world-readable. This is insecure. Location:"
|
||||
if !strings.HasPrefix(b.String(), expectPrefix) {
|
||||
t.Errorf("Expected to get a warning for world perms. Got %q", b.String())
|
||||
}
|
||||
|
||||
}
|
||||
@ -0,0 +1,24 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package main
|
||||
|
||||
import "io"
|
||||
|
||||
func checkPerms(out io.Writer) {
|
||||
// Not yet implemented on Windows. If you know how to do a comprehensive perms
|
||||
// check on Windows, contributions welcomed!
|
||||
}
|
||||
@ -0,0 +1,99 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package chartutil
|
||||
|
||||
import (
|
||||
"regexp"
|
||||
|
||||
"github.com/pkg/errors"
|
||||
)
|
||||
|
||||
// validName is a regular expression for resource names.
|
||||
//
|
||||
// According to the Kubernetes help text, the regular expression it uses is:
|
||||
//
|
||||
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||
//
|
||||
// This follows the above regular expression (but requires a full string match, not partial).
|
||||
//
|
||||
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
var validName = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)
|
||||
|
||||
var (
|
||||
// errMissingName indicates that a release (name) was not provided.
|
||||
errMissingName = errors.New("no name provided")
|
||||
|
||||
// errInvalidName indicates that an invalid release name was provided
|
||||
errInvalidName = errors.New("invalid release name, must match regex ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])+$ and the length must not longer than 53")
|
||||
|
||||
// errInvalidKubernetesName indicates that the name does not meet the Kubernetes
|
||||
// restrictions on metadata names.
|
||||
errInvalidKubernetesName = errors.New("invalid metadata name, must match regex ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])+$ and the length must not longer than 253")
|
||||
)
|
||||
|
||||
const (
|
||||
// maxNameLen is the maximum length Helm allows for a release name
|
||||
maxReleaseNameLen = 53
|
||||
// maxMetadataNameLen is the maximum length Kubernetes allows for any name.
|
||||
maxMetadataNameLen = 253
|
||||
)
|
||||
|
||||
// ValidateReleaseName performs checks for an entry for a Helm release name
|
||||
//
|
||||
// For Helm to allow a name, it must be below a certain character count (53) and also match
|
||||
// a reguar expression.
|
||||
//
|
||||
// According to the Kubernetes help text, the regular expression it uses is:
|
||||
//
|
||||
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||
//
|
||||
// This follows the above regular expression (but requires a full string match, not partial).
|
||||
//
|
||||
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
func ValidateReleaseName(name string) error {
|
||||
// This case is preserved for backwards compatibility
|
||||
if name == "" {
|
||||
return errMissingName
|
||||
|
||||
}
|
||||
if len(name) > maxReleaseNameLen || !validName.MatchString(name) {
|
||||
return errInvalidName
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
// ValidateMetadataName validates the name field of a Kubernetes metadata object.
|
||||
//
|
||||
// Empty strings, strings longer than 253 chars, or strings that don't match the regexp
|
||||
// will fail.
|
||||
//
|
||||
// According to the Kubernetes help text, the regular expression it uses is:
|
||||
//
|
||||
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||
//
|
||||
// This follows the above regular expression (but requires a full string match, not partial).
|
||||
//
|
||||
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
func ValidateMetadataName(name string) error {
|
||||
if name == "" || len(name) > maxMetadataNameLen || !validName.MatchString(name) {
|
||||
return errInvalidKubernetesName
|
||||
}
|
||||
return nil
|
||||
}
|
||||
@ -0,0 +1,91 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package chartutil
|
||||
|
||||
import "testing"
|
||||
|
||||
// TestValidateName is a regression test for ValidateName
|
||||
//
|
||||
// Kubernetes has strict naming conventions for resource names. This test represents
|
||||
// those conventions.
|
||||
//
|
||||
// See https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||
//
|
||||
// NOTE: At the time of this writing, the docs above say that names cannot begin with
|
||||
// digits. However, `kubectl`'s regular expression explicit allows this, and
|
||||
// Kubernetes (at least as of 1.18) also accepts resources whose names begin with digits.
|
||||
func TestValidateReleaseName(t *testing.T) {
|
||||
names := map[string]bool{
|
||||
"": false,
|
||||
"foo": true,
|
||||
"foo.bar1234baz.seventyone": true,
|
||||
"FOO": false,
|
||||
"123baz": true,
|
||||
"foo.BAR.baz": false,
|
||||
"one-two": true,
|
||||
"-two": false,
|
||||
"one_two": false,
|
||||
"a..b": false,
|
||||
"%^&#$%*@^*@&#^": false,
|
||||
"example:com": false,
|
||||
"example%%com": false,
|
||||
"a1111111111111111111111111111111111111111111111111111111111z": false,
|
||||
}
|
||||
for input, expectPass := range names {
|
||||
if err := ValidateReleaseName(input); (err == nil) != expectPass {
|
||||
st := "fail"
|
||||
if expectPass {
|
||||
st = "succeed"
|
||||
}
|
||||
t.Errorf("Expected %q to %s", input, st)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestValidateMetadataName(t *testing.T) {
|
||||
names := map[string]bool{
|
||||
"": false,
|
||||
"foo": true,
|
||||
"foo.bar1234baz.seventyone": true,
|
||||
"FOO": false,
|
||||
"123baz": true,
|
||||
"foo.BAR.baz": false,
|
||||
"one-two": true,
|
||||
"-two": false,
|
||||
"one_two": false,
|
||||
"a..b": false,
|
||||
"%^&#$%*@^*@&#^": false,
|
||||
"example:com": false,
|
||||
"example%%com": false,
|
||||
"a1111111111111111111111111111111111111111111111111111111111z": true,
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||
"a1111111111111111111111111111111111111111111111111111111111z": false,
|
||||
}
|
||||
for input, expectPass := range names {
|
||||
if err := ValidateMetadataName(input); (err == nil) != expectPass {
|
||||
st := "fail"
|
||||
if expectPass {
|
||||
st = "succeed"
|
||||
}
|
||||
t.Errorf("Expected %q to %s", input, st)
|
||||
}
|
||||
}
|
||||
}
|
||||
Loading…
Reference in new issue