Skip to content

Commit 16402ec

Browse files
BSWANGBSWANG
authored
Merge pull request #712 from l1b0k/feat/secret
deprecated direct get secret
2 parents 2db47a6 + 1cb024c commit 16402ec

File tree

6 files changed

+27
-74
lines changed

6 files changed

+27
-74
lines changed

‎cmd/terway-controlplane/terway-controlplane.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,7 @@ func main() {
151151
if string(cfg.Credential.AccessKey) != "" && string(cfg.Credential.AccessSecret) != "" {
152152
providers = append(providers, credential.NewAKPairProvider(string(cfg.Credential.AccessKey), string(cfg.Credential.AccessSecret)))
153153
}
154-
providers = append(providers, credential.NewEncryptedCredentialProvider(cfg.CredentialPath, cfg.SecretNamespace, cfg.SecretName))
154+
providers = append(providers, credential.NewEncryptedCredentialProvider(cfg.CredentialPath))
155155
providers = append(providers, credential.NewMetadataProvider())
156156

157157
clientSet, err := credential.NewClientMgr(cfg.RegionID, providers...)

‎daemon/builder.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -155,7 +155,7 @@ func (b *NetworkServiceBuilder) setupAliyunClient() error {
155155
if string(b.config.AccessID) != "" && string(b.config.AccessSecret) != "" {
156156
providers = append(providers, credential.NewAKPairProvider(string(b.config.AccessID), string(b.config.AccessSecret)))
157157
}
158-
providers = append(providers, credential.NewEncryptedCredentialProvider(utils.NormalizePath(b.config.CredentialPath), "", ""))
158+
providers = append(providers, credential.NewEncryptedCredentialProvider(utils.NormalizePath(b.config.CredentialPath)))
159159
providers = append(providers, credential.NewMetadataProvider())
160160

161161
clientSet, err := credential.NewClientMgr(meta.RegionID, providers...)

‎examples/maxpods/maxpods.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ func main() {
3636

3737
providers := []credential.Interface{
3838
credential.NewAKPairProvider(accessKeyID, accessKeySecret),
39-
credential.NewEncryptedCredentialProvider(credentialPath, "", ""),
39+
credential.NewEncryptedCredentialProvider(credentialPath),
4040
credential.NewMetadataProvider(),
4141
}
4242

‎pkg/aliyun/credential/sts.go

Lines changed: 19 additions & 54 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
package credential
22

33
import (
4-
"context"
54
"crypto/aes"
65
"crypto/cipher"
76
"encoding/base64"
@@ -11,14 +10,8 @@ import (
1110
"time"
1211

1312
"github.com/aliyun/alibaba-cloud-sdk-go/sdk/auth/credentials"
14-
corev1 "k8s.io/api/core/v1"
15-
"k8s.io/apimachinery/pkg/api/errors"
16-
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
17-
"k8s.io/client-go/util/retry"
1813

19-
"github.com/AliyunContainerService/terway/pkg/backoff"
2014
"github.com/AliyunContainerService/terway/pkg/utils"
21-
"github.com/AliyunContainerService/terway/pkg/utils/k8sclient"
2215
)
2316

2417
type EncryptedCredentialInfo struct {
@@ -30,65 +23,37 @@ type EncryptedCredentialInfo struct {
3023
}
3124

3225
type EncryptedCredentialProvider struct {
33-
credentialPath string
34-
secretNamespace string
35-
secretName string
26+
credentialPath string
3627
}
3728

38-
// NewEncryptedCredentialProvider get token from file or secret. default filepath /var/addon/token-config
39-
func NewEncryptedCredentialProvider(credentialPath, secretNamespace, secretName string) *EncryptedCredentialProvider {
40-
return &EncryptedCredentialProvider{credentialPath: credentialPath, secretNamespace: secretNamespace, secretName: secretName}
29+
// NewEncryptedCredentialProvider get token from file. default filepath /var/addon/token-config
30+
func NewEncryptedCredentialProvider(credentialPath string) *EncryptedCredentialProvider {
31+
return &EncryptedCredentialProvider{credentialPath: credentialPath}
4132
}
4233

4334
func (e *EncryptedCredentialProvider) Resolve() (*Credential, error) {
44-
if e.credentialPath == "" && e.secretNamespace == "" && e.secretName == "" {
35+
if e.credentialPath == "" {
4536
return nil, nil
4637
}
4738
var encodeTokenCfg []byte
4839
var err error
4940
var akInfo EncryptedCredentialInfo
5041

51-
if e.credentialPath != "" {
52-
log.Info("resolve encrypted credential", "path", e.credentialPath)
53-
if utils.IsWindowsOS() {
54-
// NB(thxCode): since os.Stat has not worked as expected,
55-
// we use os.Lstat instead of os.Stat here,
56-
// ref to https://github.com/microsoft/Windows-Containers/issues/97#issuecomment-887713195.
57-
_, err = os.Lstat(e.credentialPath)
58-
} else {
59-
_, err = os.Stat(e.credentialPath)
60-
}
61-
if err != nil {
62-
return nil, fmt.Errorf("failed to read config %s, err: %w", e.credentialPath, err)
63-
}
64-
encodeTokenCfg, err = os.ReadFile(e.credentialPath)
65-
if err != nil {
66-
return nil, fmt.Errorf("failed to read token config, err: %w", err)
67-
}
42+
log.Info("resolve encrypted credential", "path", e.credentialPath)
43+
if utils.IsWindowsOS() {
44+
// NB(thxCode): since os.Stat has not worked as expected,
45+
// we use os.Lstat instead of os.Stat here,
46+
// ref to https://github.com/microsoft/Windows-Containers/issues/97#issuecomment-887713195.
47+
_, err = os.Lstat(e.credentialPath)
6848
} else {
69-
log.Info(fmt.Sprintf("resolve secret %s/%s", e.secretNamespace, e.secretName))
70-
71-
var secret *corev1.Secret
72-
err = retry.OnError(backoff.Backoff(backoff.WaitStsTokenReady), func(err error) bool {
73-
if errors.IsNotFound(err) || errors.IsTooManyRequests(err) {
74-
return true
75-
}
76-
return false
77-
}, func() error {
78-
secret, err = k8sclient.K8sClient.CoreV1().Secrets(e.secretNamespace).Get(context.Background(), e.secretName, metav1.GetOptions{})
79-
if err != nil {
80-
return err
81-
}
82-
return nil
83-
})
84-
if err != nil {
85-
return nil, err
86-
}
87-
var ok bool
88-
encodeTokenCfg, ok = secret.Data["addon.token.config"]
89-
if !ok {
90-
return nil, fmt.Errorf("token is not found in addon.network.token")
91-
}
49+
_, err = os.Stat(e.credentialPath)
50+
}
51+
if err != nil {
52+
return nil, fmt.Errorf("failed to read config %s, err: %w", e.credentialPath, err)
53+
}
54+
encodeTokenCfg, err = os.ReadFile(e.credentialPath)
55+
if err != nil {
56+
return nil, fmt.Errorf("failed to read token config, err: %w", err)
9257
}
9358

9459
err = json.Unmarshal(encodeTokenCfg, &akInfo)

‎types/controlplane/config_default.go

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -78,13 +78,11 @@ type Config struct {
7878
}
7979

8080
type Credential struct {
81-
AccessKey secret.Secret `json:"accessKey" validate:"required_with=AccessSecret"`
82-
AccessSecret secret.Secret `json:"accessSecret" validate:"required_with=AccessKey"`
83-
CredentialPath string `json:"credentialPath"`
84-
SecretNamespace string `json:"secretNamespace" validate:"required_with=SecretName"`
85-
SecretName string `json:"secretName" validate:"required_with=SecretNamespace"`
86-
OtelEndpoint string `json:"otelEndpoint"`
87-
OtelToken secret.Secret `json:"otelToken"`
81+
AccessKey secret.Secret `json:"accessKey" validate:"required_with=AccessSecret"`
82+
AccessSecret secret.Secret `json:"accessSecret" validate:"required_with=AccessKey"`
83+
CredentialPath string `json:"credentialPath"`
84+
OtelEndpoint string `json:"otelEndpoint"`
85+
OtelToken secret.Secret `json:"otelToken"`
8886
}
8987

9088
type MultiIPController struct {

‎types/controlplane/config_test.go

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -63,16 +63,6 @@ func TestParseAndValidateCredential(t *testing.T) {
6363
CredentialPath: "foo",
6464
},
6565
wantErr: true,
66-
}, {
67-
name: "use secret",
68-
credential: Credential{
69-
AccessKey: "",
70-
AccessSecret: "",
71-
CredentialPath: "",
72-
SecretNamespace: "foo",
73-
SecretName: "foo",
74-
},
75-
wantErr: false,
7666
},
7767
{
7868
name: "miss all",

0 commit comments

Comments
 (0)