mirror of https://github.com/helm/helm
commit
7953adb06c
@ -0,0 +1,58 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"fmt"
|
||||||
|
"io"
|
||||||
|
"os"
|
||||||
|
"os/user"
|
||||||
|
"path/filepath"
|
||||||
|
)
|
||||||
|
|
||||||
|
func checkPerms(out io.Writer) {
|
||||||
|
// This function MUST NOT FAIL, as it is just a check for a common permissions problem.
|
||||||
|
// If for some reason the function hits a stopping condition, it may panic. But only if
|
||||||
|
// we can be sure that it is panicing because Helm cannot proceed.
|
||||||
|
|
||||||
|
kc := settings.KubeConfig
|
||||||
|
if kc == "" {
|
||||||
|
kc = os.Getenv("KUBECONFIG")
|
||||||
|
}
|
||||||
|
if kc == "" {
|
||||||
|
u, err := user.Current()
|
||||||
|
if err != nil {
|
||||||
|
// No idea where to find KubeConfig, so return silently. Many helm commands
|
||||||
|
// can proceed happily without a KUBECONFIG, so this is not a fatal error.
|
||||||
|
return
|
||||||
|
}
|
||||||
|
kc = filepath.Join(u.HomeDir, ".kube", "config")
|
||||||
|
}
|
||||||
|
fi, err := os.Stat(kc)
|
||||||
|
if err != nil {
|
||||||
|
// DO NOT error if no KubeConfig is found. Not all commands require one.
|
||||||
|
return
|
||||||
|
}
|
||||||
|
|
||||||
|
perm := fi.Mode().Perm()
|
||||||
|
if perm&0040 > 0 {
|
||||||
|
fmt.Fprintf(out, "WARNING: Kubernetes configuration file is group-readable. This is insecure. Location: %s\n", kc)
|
||||||
|
}
|
||||||
|
if perm&0004 > 0 {
|
||||||
|
fmt.Fprintf(out, "WARNING: Kubernetes configuration file is world-readable. This is insecure. Location: %s\n", kc)
|
||||||
|
}
|
||||||
|
}
|
@ -0,0 +1,61 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import (
|
||||||
|
"bytes"
|
||||||
|
"io/ioutil"
|
||||||
|
"os"
|
||||||
|
"path/filepath"
|
||||||
|
"strings"
|
||||||
|
"testing"
|
||||||
|
)
|
||||||
|
|
||||||
|
func TestCheckPerms(t *testing.T) {
|
||||||
|
tdir, err := ioutil.TempDir("", "helmtest")
|
||||||
|
if err != nil {
|
||||||
|
t.Fatal(err)
|
||||||
|
}
|
||||||
|
defer os.RemoveAll(tdir)
|
||||||
|
tfile := filepath.Join(tdir, "testconfig")
|
||||||
|
fh, err := os.OpenFile(tfile, os.O_CREATE|os.O_APPEND|os.O_RDWR, 0440)
|
||||||
|
if err != nil {
|
||||||
|
t.Errorf("Failed to create temp file: %s", err)
|
||||||
|
}
|
||||||
|
|
||||||
|
tconfig := settings.KubeConfig
|
||||||
|
settings.KubeConfig = tfile
|
||||||
|
defer func() { settings.KubeConfig = tconfig }()
|
||||||
|
|
||||||
|
var b bytes.Buffer
|
||||||
|
checkPerms(&b)
|
||||||
|
expectPrefix := "WARNING: Kubernetes configuration file is group-readable. This is insecure. Location:"
|
||||||
|
if !strings.HasPrefix(b.String(), expectPrefix) {
|
||||||
|
t.Errorf("Expected to get a warning for group perms. Got %q", b.String())
|
||||||
|
}
|
||||||
|
|
||||||
|
if err := fh.Chmod(0404); err != nil {
|
||||||
|
t.Errorf("Could not change mode on file: %s", err)
|
||||||
|
}
|
||||||
|
b.Reset()
|
||||||
|
checkPerms(&b)
|
||||||
|
expectPrefix = "WARNING: Kubernetes configuration file is world-readable. This is insecure. Location:"
|
||||||
|
if !strings.HasPrefix(b.String(), expectPrefix) {
|
||||||
|
t.Errorf("Expected to get a warning for world perms. Got %q", b.String())
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
@ -0,0 +1,24 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package main
|
||||||
|
|
||||||
|
import "io"
|
||||||
|
|
||||||
|
func checkPerms(out io.Writer) {
|
||||||
|
// Not yet implemented on Windows. If you know how to do a comprehensive perms
|
||||||
|
// check on Windows, contributions welcomed!
|
||||||
|
}
|
@ -0,0 +1,99 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package chartutil
|
||||||
|
|
||||||
|
import (
|
||||||
|
"regexp"
|
||||||
|
|
||||||
|
"github.com/pkg/errors"
|
||||||
|
)
|
||||||
|
|
||||||
|
// validName is a regular expression for resource names.
|
||||||
|
//
|
||||||
|
// According to the Kubernetes help text, the regular expression it uses is:
|
||||||
|
//
|
||||||
|
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||||
|
//
|
||||||
|
// This follows the above regular expression (but requires a full string match, not partial).
|
||||||
|
//
|
||||||
|
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||||
|
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||||
|
var validName = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`)
|
||||||
|
|
||||||
|
var (
|
||||||
|
// errMissingName indicates that a release (name) was not provided.
|
||||||
|
errMissingName = errors.New("no name provided")
|
||||||
|
|
||||||
|
// errInvalidName indicates that an invalid release name was provided
|
||||||
|
errInvalidName = errors.New("invalid release name, must match regex ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])+$ and the length must not longer than 53")
|
||||||
|
|
||||||
|
// errInvalidKubernetesName indicates that the name does not meet the Kubernetes
|
||||||
|
// restrictions on metadata names.
|
||||||
|
errInvalidKubernetesName = errors.New("invalid metadata name, must match regex ^(([A-Za-z0-9][-A-Za-z0-9_.]*)?[A-Za-z0-9])+$ and the length must not longer than 253")
|
||||||
|
)
|
||||||
|
|
||||||
|
const (
|
||||||
|
// maxNameLen is the maximum length Helm allows for a release name
|
||||||
|
maxReleaseNameLen = 53
|
||||||
|
// maxMetadataNameLen is the maximum length Kubernetes allows for any name.
|
||||||
|
maxMetadataNameLen = 253
|
||||||
|
)
|
||||||
|
|
||||||
|
// ValidateReleaseName performs checks for an entry for a Helm release name
|
||||||
|
//
|
||||||
|
// For Helm to allow a name, it must be below a certain character count (53) and also match
|
||||||
|
// a reguar expression.
|
||||||
|
//
|
||||||
|
// According to the Kubernetes help text, the regular expression it uses is:
|
||||||
|
//
|
||||||
|
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||||
|
//
|
||||||
|
// This follows the above regular expression (but requires a full string match, not partial).
|
||||||
|
//
|
||||||
|
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||||
|
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||||
|
func ValidateReleaseName(name string) error {
|
||||||
|
// This case is preserved for backwards compatibility
|
||||||
|
if name == "" {
|
||||||
|
return errMissingName
|
||||||
|
|
||||||
|
}
|
||||||
|
if len(name) > maxReleaseNameLen || !validName.MatchString(name) {
|
||||||
|
return errInvalidName
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
||||||
|
|
||||||
|
// ValidateMetadataName validates the name field of a Kubernetes metadata object.
|
||||||
|
//
|
||||||
|
// Empty strings, strings longer than 253 chars, or strings that don't match the regexp
|
||||||
|
// will fail.
|
||||||
|
//
|
||||||
|
// According to the Kubernetes help text, the regular expression it uses is:
|
||||||
|
//
|
||||||
|
// [a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*
|
||||||
|
//
|
||||||
|
// This follows the above regular expression (but requires a full string match, not partial).
|
||||||
|
//
|
||||||
|
// The Kubernetes documentation is here, though it is not entirely correct:
|
||||||
|
// https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||||
|
func ValidateMetadataName(name string) error {
|
||||||
|
if name == "" || len(name) > maxMetadataNameLen || !validName.MatchString(name) {
|
||||||
|
return errInvalidKubernetesName
|
||||||
|
}
|
||||||
|
return nil
|
||||||
|
}
|
@ -0,0 +1,91 @@
|
|||||||
|
/*
|
||||||
|
Copyright The Helm Authors.
|
||||||
|
|
||||||
|
Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
you may not use this file except in compliance with the License.
|
||||||
|
You may obtain a copy of the License at
|
||||||
|
|
||||||
|
http://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
|
||||||
|
Unless required by applicable law or agreed to in writing, software
|
||||||
|
distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
See the License for the specific language governing permissions and
|
||||||
|
limitations under the License.
|
||||||
|
*/
|
||||||
|
|
||||||
|
package chartutil
|
||||||
|
|
||||||
|
import "testing"
|
||||||
|
|
||||||
|
// TestValidateName is a regression test for ValidateName
|
||||||
|
//
|
||||||
|
// Kubernetes has strict naming conventions for resource names. This test represents
|
||||||
|
// those conventions.
|
||||||
|
//
|
||||||
|
// See https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
|
||||||
|
//
|
||||||
|
// NOTE: At the time of this writing, the docs above say that names cannot begin with
|
||||||
|
// digits. However, `kubectl`'s regular expression explicit allows this, and
|
||||||
|
// Kubernetes (at least as of 1.18) also accepts resources whose names begin with digits.
|
||||||
|
func TestValidateReleaseName(t *testing.T) {
|
||||||
|
names := map[string]bool{
|
||||||
|
"": false,
|
||||||
|
"foo": true,
|
||||||
|
"foo.bar1234baz.seventyone": true,
|
||||||
|
"FOO": false,
|
||||||
|
"123baz": true,
|
||||||
|
"foo.BAR.baz": false,
|
||||||
|
"one-two": true,
|
||||||
|
"-two": false,
|
||||||
|
"one_two": false,
|
||||||
|
"a..b": false,
|
||||||
|
"%^&#$%*@^*@&#^": false,
|
||||||
|
"example:com": false,
|
||||||
|
"example%%com": false,
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z": false,
|
||||||
|
}
|
||||||
|
for input, expectPass := range names {
|
||||||
|
if err := ValidateReleaseName(input); (err == nil) != expectPass {
|
||||||
|
st := "fail"
|
||||||
|
if expectPass {
|
||||||
|
st = "succeed"
|
||||||
|
}
|
||||||
|
t.Errorf("Expected %q to %s", input, st)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
func TestValidateMetadataName(t *testing.T) {
|
||||||
|
names := map[string]bool{
|
||||||
|
"": false,
|
||||||
|
"foo": true,
|
||||||
|
"foo.bar1234baz.seventyone": true,
|
||||||
|
"FOO": false,
|
||||||
|
"123baz": true,
|
||||||
|
"foo.BAR.baz": false,
|
||||||
|
"one-two": true,
|
||||||
|
"-two": false,
|
||||||
|
"one_two": false,
|
||||||
|
"a..b": false,
|
||||||
|
"%^&#$%*@^*@&#^": false,
|
||||||
|
"example:com": false,
|
||||||
|
"example%%com": false,
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z": true,
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z" +
|
||||||
|
"a1111111111111111111111111111111111111111111111111111111111z": false,
|
||||||
|
}
|
||||||
|
for input, expectPass := range names {
|
||||||
|
if err := ValidateMetadataName(input); (err == nil) != expectPass {
|
||||||
|
st := "fail"
|
||||||
|
if expectPass {
|
||||||
|
st = "succeed"
|
||||||
|
}
|
||||||
|
t.Errorf("Expected %q to %s", input, st)
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
Loading…
Reference in new issue