mirror of https://github.com/grafana/grafana
Secrets: Add single tenant SecureValueClient (#108099)
* Secrets: Add single tenant SecureValueClient * SecureValueClient: Rename file * SecureValueClient: Move original type to contracts package and export it by aliasingpull/108216/head
Matheus Macabu
4 days ago
committed by
GitHub
parent
a0873736aa
commit
6c69ae244e
@ -0,0 +1,231 @@ |
||||
package secret |
||||
|
||||
import ( |
||||
"context" |
||||
"fmt" |
||||
|
||||
claims "github.com/grafana/authlib/types" |
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
||||
"k8s.io/apimachinery/pkg/apis/meta/v1/unstructured" |
||||
"k8s.io/apimachinery/pkg/runtime" |
||||
"k8s.io/apimachinery/pkg/types" |
||||
"k8s.io/apimachinery/pkg/watch" |
||||
"k8s.io/apiserver/pkg/admission" |
||||
"k8s.io/client-go/dynamic" |
||||
|
||||
secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" |
||||
"github.com/grafana/grafana/pkg/registry/apis/secret/contracts" |
||||
"github.com/grafana/grafana/pkg/registry/apis/secret/xkube" |
||||
) |
||||
|
||||
// SecureValueClient is a CRUD client for the secure value API.
|
||||
type SecureValueClient = contracts.SecureValueClient |
||||
|
||||
type secureValueClient struct { |
||||
namespace string |
||||
service contracts.SecureValueService |
||||
validator contracts.SecureValueValidator |
||||
} |
||||
|
||||
var _ SecureValueClient = &secureValueClient{} |
||||
|
||||
func ProvideSecureValueClient(service contracts.SecureValueService, validator contracts.SecureValueValidator) SecureValueClient { |
||||
return &secureValueClient{ |
||||
service: service, |
||||
validator: validator, |
||||
} |
||||
} |
||||
|
||||
// Client returns a resource interface that is scoped to a specific namespace.
|
||||
func (c *secureValueClient) Client(ctx context.Context, namespace string) (dynamic.ResourceInterface, error) { |
||||
return c.Namespace(namespace), nil |
||||
} |
||||
|
||||
// Namespace returns a resource interface that is scoped to a specific namespace.
|
||||
func (c *secureValueClient) Namespace(ns string) dynamic.ResourceInterface { |
||||
info, err := claims.ParseNamespace(ns) |
||||
if err != nil { |
||||
panic(err) |
||||
} |
||||
if len(info.Value) == 0 { |
||||
panic("namespace is required") |
||||
} |
||||
|
||||
ret := *c |
||||
ret.namespace = ns |
||||
return &ret |
||||
} |
||||
|
||||
// Create a new secure value. Options and subresources are not supported and ignored.
|
||||
func (c *secureValueClient) Create(ctx context.Context, obj *unstructured.Unstructured, _ metav1.CreateOptions, _ ...string) (*unstructured.Unstructured, error) { |
||||
if len(c.namespace) == 0 { |
||||
return nil, fmt.Errorf("namespace is required") |
||||
} |
||||
|
||||
sv, err := fromUnstructured(obj) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
if sv.Namespace != c.namespace { |
||||
return nil, fmt.Errorf("namespace mismatch") |
||||
} |
||||
if errs := c.validator.Validate(sv, nil, admission.Create); len(errs) > 0 { |
||||
return nil, fmt.Errorf("invalid secure value: %w", errs.ToAggregate()) |
||||
} |
||||
|
||||
user, ok := claims.AuthInfoFrom(ctx) |
||||
if !ok { |
||||
return nil, fmt.Errorf("missing auth info in context") |
||||
} |
||||
|
||||
createdSv, err := c.service.Create(ctx, sv, user.GetUID()) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
return toUnstructured(createdSv) |
||||
} |
||||
|
||||
// Get a secure value by name. Options and subresources are not supported and ignored.
|
||||
func (c *secureValueClient) Get(ctx context.Context, name string, _ metav1.GetOptions, _ ...string) (*unstructured.Unstructured, error) { |
||||
if len(c.namespace) == 0 { |
||||
return nil, fmt.Errorf("namespace is required") |
||||
} |
||||
if len(name) == 0 { |
||||
return nil, fmt.Errorf("name is required") |
||||
} |
||||
|
||||
sv, err := c.service.Read(ctx, xkube.Namespace(c.namespace), name) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
return toUnstructured(sv) |
||||
} |
||||
|
||||
// Update a secure value. Options and subresources are not supported and ignored.
|
||||
func (c *secureValueClient) Update(ctx context.Context, obj *unstructured.Unstructured, _ metav1.UpdateOptions, _ ...string) (*unstructured.Unstructured, error) { |
||||
if len(c.namespace) == 0 { |
||||
return nil, fmt.Errorf("namespace is required") |
||||
} |
||||
|
||||
oldUnstructured, err := c.Get(ctx, obj.GetName(), metav1.GetOptions{}) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
oldSv, err := fromUnstructured(oldUnstructured) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
sv, err := fromUnstructured(obj) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
if sv.Namespace != c.namespace { |
||||
return nil, fmt.Errorf("namespace mismatch") |
||||
} |
||||
if errs := c.validator.Validate(sv, oldSv, admission.Update); len(errs) > 0 { |
||||
return nil, fmt.Errorf("invalid secure value: %w", errs.ToAggregate()) |
||||
} |
||||
|
||||
user, ok := claims.AuthInfoFrom(ctx) |
||||
if !ok { |
||||
return nil, fmt.Errorf("missing auth info in context") |
||||
} |
||||
|
||||
updatedSv, _, err := c.service.Update(ctx, sv, user.GetUID()) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
return toUnstructured(updatedSv) |
||||
} |
||||
|
||||
// Delete a secure value by name. Options and subresources are not supported and ignored.
|
||||
func (c *secureValueClient) Delete(ctx context.Context, name string, _ metav1.DeleteOptions, _ ...string) error { |
||||
if len(c.namespace) == 0 { |
||||
return fmt.Errorf("namespace is required") |
||||
} |
||||
if len(name) == 0 { |
||||
return fmt.Errorf("name is required") |
||||
} |
||||
|
||||
_, err := c.service.Delete(ctx, xkube.Namespace(c.namespace), name) |
||||
return err |
||||
} |
||||
|
||||
// List all secure values in the namespace. Options and subresources are not supported and ignored.
|
||||
func (c *secureValueClient) List(ctx context.Context, _ metav1.ListOptions) (*unstructured.UnstructuredList, error) { |
||||
if len(c.namespace) == 0 { |
||||
return nil, fmt.Errorf("namespace is required") |
||||
} |
||||
|
||||
list, err := c.service.List(ctx, xkube.Namespace(c.namespace)) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
items := make([]unstructured.Unstructured, 0, len(list.Items)) |
||||
for _, sv := range list.Items { |
||||
u, err := toUnstructured(&sv) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
|
||||
items = append(items, *u) |
||||
} |
||||
|
||||
return &unstructured.UnstructuredList{ |
||||
Items: items, |
||||
}, nil |
||||
} |
||||
|
||||
// DeleteCollection is not supported and returns an error.
|
||||
func (c *secureValueClient) DeleteCollection(_ context.Context, _ metav1.DeleteOptions, _ metav1.ListOptions) error { |
||||
return fmt.Errorf("deleteCollection is not supported") |
||||
} |
||||
|
||||
// Watch is not supported and returns an error.
|
||||
func (c *secureValueClient) Watch(_ context.Context, _ metav1.ListOptions) (watch.Interface, error) { |
||||
return nil, fmt.Errorf("watch is not supported") |
||||
} |
||||
|
||||
// Patch is not supported and returns an error.
|
||||
func (c *secureValueClient) Patch(_ context.Context, _ string, _ types.PatchType, _ []byte, _ metav1.PatchOptions, _ ...string) (*unstructured.Unstructured, error) { |
||||
return nil, fmt.Errorf("patch is not supported") |
||||
} |
||||
|
||||
// Apply is not supported and returns an error.
|
||||
func (c *secureValueClient) Apply(_ context.Context, _ string, _ *unstructured.Unstructured, _ metav1.ApplyOptions, _ ...string) (*unstructured.Unstructured, error) { |
||||
return nil, fmt.Errorf("apply is not supported") |
||||
} |
||||
|
||||
// UpdateStatus is not supported and returns an error.
|
||||
func (c *secureValueClient) UpdateStatus(_ context.Context, _ *unstructured.Unstructured, _ metav1.UpdateOptions) (*unstructured.Unstructured, error) { |
||||
return nil, fmt.Errorf("updateStatus is not supported") |
||||
} |
||||
|
||||
// ApplyStatus is not supported and returns an error.
|
||||
func (c *secureValueClient) ApplyStatus(_ context.Context, _ string, _ *unstructured.Unstructured, _ metav1.ApplyOptions) (*unstructured.Unstructured, error) { |
||||
return nil, fmt.Errorf("applyStatus is not supported") |
||||
} |
||||
|
||||
func toUnstructured(sv *secretv1beta1.SecureValue) (*unstructured.Unstructured, error) { |
||||
unstructuredObj, err := runtime.DefaultUnstructuredConverter.ToUnstructured(sv) |
||||
if err != nil { |
||||
return nil, err |
||||
} |
||||
return &unstructured.Unstructured{Object: unstructuredObj}, nil |
||||
} |
||||
|
||||
func fromUnstructured(u *unstructured.Unstructured) (*secretv1beta1.SecureValue, error) { |
||||
sv := new(secretv1beta1.SecureValue) |
||||
if err := runtime.DefaultUnstructuredConverter.FromUnstructured(u.Object, sv); err != nil { |
||||
return nil, err |
||||
} |
||||
return sv, nil |
||||
} |
||||
@ -0,0 +1,109 @@ |
||||
package secret |
||||
|
||||
import ( |
||||
"testing" |
||||
|
||||
"github.com/stretchr/testify/require" |
||||
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" |
||||
"k8s.io/utils/ptr" |
||||
|
||||
secretv1beta1 "github.com/grafana/grafana/apps/secret/pkg/apis/secret/v1beta1" |
||||
"github.com/grafana/grafana/pkg/registry/apis/secret/contracts" |
||||
"github.com/grafana/grafana/pkg/registry/apis/secret/testutils" |
||||
"github.com/grafana/grafana/pkg/registry/apis/secret/validator" |
||||
) |
||||
|
||||
func TestIntegration_SecureValueClient_CRUD(t *testing.T) { |
||||
setup := testutils.Setup(t) |
||||
|
||||
validator := validator.ProvideSecureValueValidator() |
||||
|
||||
client := ProvideSecureValueClient( |
||||
setup.SecureValueService, |
||||
validator, |
||||
) |
||||
|
||||
ns := "stacks-1234" |
||||
ctx := testutils.CreateUserAuthContext(t.Context(), ns, map[string][]string{ |
||||
"securevalues:read": {"securevalues:uid:*"}, |
||||
}) |
||||
|
||||
nsClient, err := client.Client(ctx, ns) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, nsClient) |
||||
|
||||
sv := &secretv1beta1.SecureValue{ |
||||
ObjectMeta: metav1.ObjectMeta{ |
||||
Name: "test-sv", |
||||
Namespace: ns, |
||||
}, |
||||
Spec: secretv1beta1.SecureValueSpec{ |
||||
Description: "test-description", |
||||
Value: ptr.To(secretv1beta1.NewExposedSecureValue("test-value")), |
||||
}, |
||||
} |
||||
|
||||
unstructured, err := toUnstructured(sv) |
||||
require.NoError(t, err) |
||||
|
||||
// Create
|
||||
created, err := nsClient.Create(ctx, unstructured, metav1.CreateOptions{}) |
||||
require.NoError(t, err) |
||||
|
||||
createdSv, err := fromUnstructured(created) |
||||
require.NoError(t, err) |
||||
|
||||
require.NotEmpty(t, createdSv.UID) |
||||
require.Nil(t, createdSv.Spec.Value) |
||||
require.Equal(t, sv.Name, createdSv.Name) |
||||
require.Equal(t, sv.Namespace, createdSv.Namespace) |
||||
|
||||
// Read
|
||||
read, err := nsClient.Get(ctx, createdSv.Name, metav1.GetOptions{}) |
||||
require.NoError(t, err) |
||||
|
||||
readSv, err := fromUnstructured(read) |
||||
require.NoError(t, err) |
||||
require.EqualValues(t, createdSv, readSv) |
||||
|
||||
// Update
|
||||
updatedSv := &secretv1beta1.SecureValue{ |
||||
ObjectMeta: metav1.ObjectMeta{ |
||||
Name: createdSv.Name, |
||||
Namespace: createdSv.Namespace, |
||||
}, |
||||
Spec: secretv1beta1.SecureValueSpec{ |
||||
Description: "test-description-updated", |
||||
Value: ptr.To(secretv1beta1.NewExposedSecureValue("test-value-updated")), |
||||
}, |
||||
} |
||||
|
||||
unstructured, err = toUnstructured(updatedSv) |
||||
require.NoError(t, err) |
||||
|
||||
_, err = nsClient.Update(ctx, unstructured, metav1.UpdateOptions{}) |
||||
require.NoError(t, err) |
||||
|
||||
read, err = nsClient.Get(ctx, createdSv.Name, metav1.GetOptions{}) |
||||
require.NoError(t, err) |
||||
readSv, err = fromUnstructured(read) |
||||
require.NoError(t, err) |
||||
require.Equal(t, updatedSv.Spec.Description, readSv.Spec.Description) |
||||
require.Equal(t, updatedSv.Name, readSv.Name) |
||||
require.Equal(t, updatedSv.Namespace, readSv.Namespace) |
||||
|
||||
// List
|
||||
list, err := nsClient.List(ctx, metav1.ListOptions{}) |
||||
require.NoError(t, err) |
||||
require.Len(t, list.Items, 1) |
||||
require.Equal(t, createdSv.Name, list.Items[0].GetName()) |
||||
require.Equal(t, createdSv.Namespace, list.Items[0].GetNamespace()) |
||||
|
||||
// Delete
|
||||
err = nsClient.Delete(ctx, createdSv.Name, metav1.DeleteOptions{}) |
||||
require.NoError(t, err) |
||||
|
||||
read, err = nsClient.Get(ctx, createdSv.Name, metav1.GetOptions{}) |
||||
require.ErrorIs(t, err, contracts.ErrSecureValueNotFound) |
||||
require.Nil(t, read) |
||||
} |
||||
Loading…
Reference in new issue