-
Notifications
You must be signed in to change notification settings - Fork 1.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
fix(new-e2e): Use the new definition of the secret test of ASC
- Loading branch information
Showing
6 changed files
with
186 additions
and
13 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
53 changes: 53 additions & 0 deletions
53
test/new-e2e/tests/agent-shared-components/secretsutils/client.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,53 @@ | ||
| // Unless explicitly stated otherwise all files in this repository are licensed | ||
| // under the Apache License Version 2.0. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). | ||
| // Copyright 2016-present Datadog, Inc. | ||
|
|
||
| package secretsutils | ||
|
|
||
| import ( | ||
| "path" | ||
| "testing" | ||
|
|
||
| "github.com/stretchr/testify/require" | ||
|
|
||
| "github.com/DataDog/datadog-agent/test/new-e2e/pkg/components" | ||
| ) | ||
|
|
||
| // SecretClient is a client that can create and delete files containing secrets | ||
| type SecretClient struct { | ||
| t *testing.T | ||
| rootDir string | ||
| host *components.RemoteHost | ||
| } | ||
|
|
||
| // NewSecretClient creates a new SecretClient that can create and delete files containing secrets | ||
| func NewSecretClient(t *testing.T, host *components.RemoteHost, rootDir string) *SecretClient { | ||
| t.Log("Creating secret client with root directory", rootDir) | ||
| return &SecretClient{ | ||
| t: t, | ||
| rootDir: rootDir, | ||
| host: host, | ||
| } | ||
| } | ||
|
|
||
| // SetSecret creates a new file containing the secret value | ||
| func (c *SecretClient) SetSecret(name string, value string) int64 { | ||
| c.t.Log("Setting secret", name) | ||
|
|
||
| // Create the root directory if it doesn't exist | ||
| err := c.host.MkdirAll(c.rootDir) | ||
| require.NoError(c.t, err) | ||
|
|
||
| fullpath := path.Join(c.rootDir, name) | ||
| b, err := c.host.WriteFile(fullpath, []byte(value)) | ||
| require.NoError(c.t, err) | ||
| return b | ||
| } | ||
|
|
||
| // RemoveSecret deletes the file containing the secret | ||
| func (c *SecretClient) RemoveSecret(name string) error { | ||
| c.t.Log("Removing secret", name) | ||
| err := c.host.Remove(path.Join(c.rootDir, name)) | ||
| return err | ||
| } |
32 changes: 32 additions & 0 deletions
32
test/new-e2e/tests/agent-shared-components/secretsutils/fixtures/secret-resolver.py
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,32 @@ | ||
| #!/usr/bin/env python3 | ||
|
|
||
| import json | ||
| import os | ||
| import os.path | ||
| import sys | ||
|
|
||
|
|
||
| # this script resolves secret from disk | ||
| # a single argument should be given, the directory in which to look for secrets | ||
| # for each requested handle, it will try to read a file named as the handle in the directory | ||
| def main(): | ||
| if len(sys.argv) != 2: | ||
| raise Exception("expected a single argument being the secret directory path") | ||
|
|
||
| cwd = sys.argv[1] | ||
|
|
||
| content = sys.stdin.read() | ||
| obj = json.loads(content) | ||
| handles = obj['secrets'] | ||
|
|
||
| result = {} | ||
| for h in handles: | ||
| with open(os.path.join(cwd, h)) as reader: | ||
| key = reader.read().strip() | ||
| result[h] = {'value': key} | ||
|
|
||
| print(json.dumps(result)) | ||
|
|
||
|
|
||
| if __name__ == '__main__': | ||
| main() |
1 change: 1 addition & 0 deletions
1
test/new-e2e/tests/agent-shared-components/secretsutils/fixtures/secret_wrapper.bat
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1 @@ | ||
| @"C:\Program Files\Datadog\Datadog Agent\embedded3\python.exe" {{.PythonScriptPath}} %* |
91 changes: 91 additions & 0 deletions
91
test/new-e2e/tests/agent-shared-components/secretsutils/helpers.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| // Unless explicitly stated otherwise all files in this repository are licensed | ||
| // under the Apache License Version 2.0. | ||
| // This product includes software developed at Datadog (https://www.datadoghq.com/). | ||
| // Copyright 2016-present Datadog, Inc. | ||
|
|
||
| // Package secretsutils contains utilities to manage secrets for e2e tests. | ||
| package secretsutils | ||
|
|
||
| import ( | ||
| "bytes" | ||
| _ "embed" | ||
| "html/template" | ||
| "path/filepath" | ||
| "strings" | ||
|
|
||
| "github.com/DataDog/test-infra-definitions/components/datadog/agentparams" | ||
| perms "github.com/DataDog/test-infra-definitions/components/datadog/agentparams/filepermissions" | ||
|
|
||
| "github.com/DataDog/datadog-agent/pkg/util/optional" | ||
| ) | ||
|
|
||
| //go:embed fixtures/secret-resolver.py | ||
| var secretResolverScript string | ||
|
|
||
| // WithUnixSecretSetupScript returns an agent param that setups a secret resolver script with correct permissions. | ||
| func WithUnixSecretSetupScript(path string, allowGroupExec bool) func(*agentparams.Params) error { | ||
| return agentparams.WithFileWithPermissions(path, secretResolverScript, true, WithUnixSecretPermissions(allowGroupExec)) | ||
| } | ||
|
|
||
| // WithUnixSecretPermissions returns an UnixPermissions object containing correct permissions for a secret backend script. | ||
| func WithUnixSecretPermissions(allowGroupExec bool) optional.Option[perms.FilePermissions] { | ||
| if allowGroupExec { | ||
| return perms.NewUnixPermissions(perms.WithPermissions("0750"), perms.WithOwner("dd-agent"), perms.WithGroup("root")) | ||
| } | ||
|
|
||
| return perms.NewUnixPermissions(perms.WithPermissions("0700"), perms.WithOwner("dd-agent"), perms.WithGroup("dd-agent")) | ||
| } | ||
|
|
||
| //go:embed fixtures/secret_wrapper.bat | ||
| var secretWrapperScript string | ||
|
|
||
| // WithWindowsSecretSetupScript returns a list of agent params that setups a secret resolver script with correct permissions. | ||
| func WithWindowsSecretSetupScript(wrapperPath string, allowGroupExec bool) []func(*agentparams.Params) error { | ||
| // On Windows we're using a wrapper around the python script because we can't execute python scripts directly | ||
| // (this would require modifying permissions of the python binary) | ||
| // Basically the setup looks like this: | ||
| // <path>/ | ||
| // ├── secret.py | ||
| // └── secret_wrapper.bat (specific permissions) | ||
|
|
||
| wrapperPath = strings.ReplaceAll(wrapperPath, `\`, `/`) | ||
|
|
||
| dir, _ := filepath.Split(wrapperPath) | ||
| pythonScriptPath := filepath.Join(dir, "secret.py") | ||
| secretWrapperContent := fillSecretWrapperTemplate(strings.ReplaceAll(pythonScriptPath, "/", "\\")) | ||
|
|
||
| return []func(*agentparams.Params) error{ | ||
| agentparams.WithFileWithPermissions(wrapperPath, secretWrapperContent, true, WithWindowsSecretPermissions(allowGroupExec)), | ||
| agentparams.WithFile(pythonScriptPath, secretResolverScript, true), | ||
| } | ||
| } | ||
|
|
||
| // WithWindowsSecretPermissions returns a WindowsPermissions object containing correct permissions for a secret backend script. | ||
| func WithWindowsSecretPermissions(allowGroupExec bool) optional.Option[perms.FilePermissions] { | ||
| icaclsCmd := `/grant "ddagentuser:(RX)"` | ||
| if allowGroupExec { | ||
| icaclsCmd += ` "Administrators:(RX)"` | ||
| } | ||
|
|
||
| return perms.NewWindowsPermissions(perms.WithIcaclsCommand(icaclsCmd), perms.WithDisableInheritance()) | ||
| } | ||
|
|
||
| // fillSecretWrapperTemplate fills the secret wrapper template with the correct path to the python script. | ||
| func fillSecretWrapperTemplate(pythonScriptPath string) string { | ||
| var buffer bytes.Buffer | ||
| var templateVars = map[string]string{ | ||
| "PythonScriptPath": pythonScriptPath, | ||
| } | ||
|
|
||
| tmpl, err := template.New("").Parse(secretWrapperScript) | ||
| if err != nil { | ||
| panic("Could not parse secret wrapper template") | ||
| } | ||
|
|
||
| err = tmpl.Execute(&buffer, templateVars) | ||
| if err != nil { | ||
| panic("Could not fill variables in secret wrapper template") | ||
| } | ||
|
|
||
| return buffer.String() | ||
| } |