mirror of https://github.com/helm/helm
Szymon Gibała
5 years ago
parent
e71d38b414
commit
9119f84cbe
@ -0,0 +1,131 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package sanitize
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"strings"
|
||||
|
||||
"gopkg.in/yaml.v2"
|
||||
)
|
||||
|
||||
const (
|
||||
hiddenSecretValue = "[HIDDEN]"
|
||||
)
|
||||
|
||||
// HideSecrets replaces values in Secrets in the chart manifest with
|
||||
// `[HIDDEN]` value.
|
||||
func HideSecrets(manifest string) (string, error) {
|
||||
resources := strings.Split(manifest, "\n---")
|
||||
outRes := make([]string, 0, len(resources))
|
||||
|
||||
for _, r := range resources {
|
||||
var resourceMap map[string]interface{}
|
||||
err := yaml.Unmarshal([]byte(r), &resourceMap)
|
||||
if err != nil {
|
||||
return "", err
|
||||
}
|
||||
|
||||
if isSecret(resourceMap) {
|
||||
r = hideSecretData(r, resourceMap)
|
||||
}
|
||||
|
||||
outRes = append(outRes, r)
|
||||
}
|
||||
|
||||
return strings.Join(outRes, "\n---"), nil
|
||||
}
|
||||
|
||||
func isSecret(resource map[string]interface{}) bool {
|
||||
kind, ok := resource["kind"].(string)
|
||||
if !ok || kind != "Secret" {
|
||||
return false
|
||||
}
|
||||
|
||||
apiVersion, ok := resource["apiVersion"].(string)
|
||||
if !ok || apiVersion != "v1" {
|
||||
return false
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
func hideSecretData(raw string, resource map[string]interface{}) string {
|
||||
dataRaw, ok := resource["data"].(map[interface{}]interface{})
|
||||
if !ok || len(dataRaw) == 0 {
|
||||
return raw
|
||||
}
|
||||
|
||||
data := toMapOfStrings(dataRaw)
|
||||
|
||||
lines := strings.Split(raw, "\n")
|
||||
outLines := make([]string, len(lines))
|
||||
|
||||
for i, line := range lines {
|
||||
trimmed := strings.TrimSpace(line)
|
||||
|
||||
// If line is part of secret.data, sanitize line by replacing the value part
|
||||
if key, matches := matchKeyValPair(data, trimmed); matches {
|
||||
sanitizedLine := strings.Replace(line, trimmed, formatHiddenValue(key), 1)
|
||||
outLines[i] = sanitizedLine
|
||||
continue
|
||||
}
|
||||
|
||||
outLines[i] = line
|
||||
}
|
||||
|
||||
return strings.Join(outLines, "\n")
|
||||
}
|
||||
|
||||
func toMapOfStrings(rawMap map[interface{}]interface{}) map[string]string {
|
||||
stringsMap := make(map[string]string, len(rawMap))
|
||||
for k, v := range rawMap {
|
||||
key, ok := k.(string)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
val, ok := v.(string)
|
||||
if !ok {
|
||||
continue
|
||||
}
|
||||
stringsMap[key] = val
|
||||
}
|
||||
return stringsMap
|
||||
}
|
||||
|
||||
// matchKeyValPair checks if data contains joined key value pair in format
|
||||
// `key: value` equal to specified string.
|
||||
// Returns key with which string matched and indicator if it matched any.
|
||||
func matchKeyValPair(data map[string]string, str string) (string, bool) {
|
||||
for k, v := range data {
|
||||
joined := joinKeyVal(k, v)
|
||||
|
||||
if joined == str {
|
||||
return k, true
|
||||
}
|
||||
}
|
||||
|
||||
return "", false
|
||||
}
|
||||
|
||||
func joinKeyVal(key, val string) string {
|
||||
return fmt.Sprintf("%s: %s", key, val)
|
||||
}
|
||||
|
||||
func formatHiddenValue(key string) string {
|
||||
return joinKeyVal(key, hiddenSecretValue)
|
||||
}
|
||||
@ -0,0 +1,50 @@
|
||||
/*
|
||||
Copyright The Helm Authors.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
*/
|
||||
|
||||
package sanitize
|
||||
|
||||
import (
|
||||
"io/ioutil"
|
||||
"testing"
|
||||
|
||||
"github.com/stretchr/testify/assert"
|
||||
"github.com/stretchr/testify/require"
|
||||
)
|
||||
|
||||
func TestHideSecrets(t *testing.T) {
|
||||
|
||||
t.Run("hide secret values", func(t *testing.T) {
|
||||
manifestRaw, err := ioutil.ReadFile("testdata/manifest-input.yaml")
|
||||
require.NoError(t, err)
|
||||
expectedManifestRaw, err := ioutil.ReadFile("testdata/manifest-sanitized.yaml")
|
||||
require.NoError(t, err)
|
||||
|
||||
sanitizedManifest, err := HideSecrets(string(manifestRaw))
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, string(expectedManifestRaw), sanitizedManifest)
|
||||
})
|
||||
|
||||
t.Run("do not modify, when no secret values", func(t *testing.T) {
|
||||
manifestRaw, err := ioutil.ReadFile("testdata/manifest-no-secret.yaml")
|
||||
require.NoError(t, err)
|
||||
|
||||
sanitizedManifest, err := HideSecrets(string(manifestRaw))
|
||||
require.NoError(t, err)
|
||||
|
||||
assert.Equal(t, string(manifestRaw), sanitizedManifest)
|
||||
})
|
||||
}
|
||||
@ -0,0 +1,63 @@
|
||||
---
|
||||
# Source: test/templates/sa.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: build-robot
|
||||
---
|
||||
# Source: test/templates/secret.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: secret-sample
|
||||
data:
|
||||
test: YmFyCg==
|
||||
password: bXktcGFzc3dvcmQ=
|
||||
---
|
||||
# Source: test/templates/cm.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: 2016-02-18T18:52:05Z
|
||||
name: game-config
|
||||
namespace: default
|
||||
resourceVersion: "516"
|
||||
uid: b4952dc3-d670-11e5-8cd0-68f728db1985
|
||||
data:
|
||||
test: YmFyCg==
|
||||
game.properties: |
|
||||
enemies=aliens
|
||||
lives=3
|
||||
enemies.cheat=true
|
||||
enemies.cheat.level=noGoodRotten
|
||||
secret.code.passphrase=UUDDLRLRBABAS
|
||||
secret.code.allowed=true
|
||||
secret.code.lives=30
|
||||
ui.properties: |
|
||||
color.good=purple
|
||||
color.bad=yellow
|
||||
allow.textmode=true
|
||||
how.nice.to.look=fairlyNice
|
||||
---
|
||||
# Source: test/templates/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nginx-deployment
|
||||
labels:
|
||||
app: nginx
|
||||
spec:
|
||||
replicas: 3
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nginx
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nginx
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:1.14.2
|
||||
ports:
|
||||
- containerPort: 80
|
||||
@ -0,0 +1,40 @@
|
||||
---
|
||||
# Source: test/templates/sa.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: build-robot
|
||||
---
|
||||
# Source: test/templates/secret.yaml
|
||||
apiVersion: my.custom.secret.com/v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: secret-sample
|
||||
data:
|
||||
test: YmFyCg==
|
||||
password: bXktcGFzc3dvcmQ=
|
||||
---
|
||||
# Source: test/templates/cm.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: 2016-02-18T18:52:05Z
|
||||
name: game-config
|
||||
namespace: default
|
||||
resourceVersion: "516"
|
||||
uid: b4952dc3-d670-11e5-8cd0-68f728db1985
|
||||
data:
|
||||
test: YmFyCg==
|
||||
game.properties: |
|
||||
enemies=aliens
|
||||
lives=3
|
||||
enemies.cheat=true
|
||||
enemies.cheat.level=noGoodRotten
|
||||
secret.code.passphrase=UUDDLRLRBABAS
|
||||
secret.code.allowed=true
|
||||
secret.code.lives=30
|
||||
ui.properties: |
|
||||
color.good=purple
|
||||
color.bad=yellow
|
||||
allow.textmode=true
|
||||
how.nice.to.look=fairlyNice
|
||||
@ -0,0 +1,63 @@
|
||||
---
|
||||
# Source: test/templates/sa.yaml
|
||||
apiVersion: v1
|
||||
kind: ServiceAccount
|
||||
metadata:
|
||||
name: build-robot
|
||||
---
|
||||
# Source: test/templates/secret.yaml
|
||||
apiVersion: v1
|
||||
kind: Secret
|
||||
metadata:
|
||||
name: secret-sample
|
||||
data:
|
||||
test: [HIDDEN]
|
||||
password: [HIDDEN]
|
||||
---
|
||||
# Source: test/templates/cm.yaml
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
creationTimestamp: 2016-02-18T18:52:05Z
|
||||
name: game-config
|
||||
namespace: default
|
||||
resourceVersion: "516"
|
||||
uid: b4952dc3-d670-11e5-8cd0-68f728db1985
|
||||
data:
|
||||
test: YmFyCg==
|
||||
game.properties: |
|
||||
enemies=aliens
|
||||
lives=3
|
||||
enemies.cheat=true
|
||||
enemies.cheat.level=noGoodRotten
|
||||
secret.code.passphrase=UUDDLRLRBABAS
|
||||
secret.code.allowed=true
|
||||
secret.code.lives=30
|
||||
ui.properties: |
|
||||
color.good=purple
|
||||
color.bad=yellow
|
||||
allow.textmode=true
|
||||
how.nice.to.look=fairlyNice
|
||||
---
|
||||
# Source: test/templates/deployment.yaml
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: nginx-deployment
|
||||
labels:
|
||||
app: nginx
|
||||
spec:
|
||||
replicas: 3
|
||||
selector:
|
||||
matchLabels:
|
||||
app: nginx
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: nginx
|
||||
spec:
|
||||
containers:
|
||||
- name: nginx
|
||||
image: nginx:1.14.2
|
||||
ports:
|
||||
- containerPort: 80
|
||||
Loading…
Reference in new issue