BIP Need Not Decode Base64 Postfixed Attributes When Attributes are assigned from Vault #2248
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ttributes that end with _BASE64, experience a transformation that is easily missed. The [set-k8s-secrets.sh script](https://github.com/department-of-veterans-affairs/abd-vro/blob/1af4443d64a3d8231258d4e814c4931d9aa7fc59/.github/runner/set-k8s-secrets.sh) will automatically decode them, passing the decoded values as attributes no longer containing the BASE64 postfix
JaCoCo Test Coverage
|
msnwatson
approved these changes
Nov 27, 2023
chengjie8
approved these changes
Nov 28, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
As our secret setting github action runner reads from vault, secret attributes that end with _BASE64, experience a transformation that is easily missed. The set-k8s-secrets.sh script will automatically decode them, passing the decoded values as attributes no longer containing the BASE64 postfix
What was the problem?
The problem is that the keystore and truststore as configured in Vault is inconsistent with truststore and keystore attributes. In some cases we store BIP_KEYSTORE_BASE64, and that attribute gets transformed in the set-k8s-secret.sh script. In this case, the attribute will get decoded in the bash script and the container will receive a BIP_KEYSTORE attribute containing the. decoded value.
Associated tickets or Slack threads:
How does this fix it?1
The code catches failed base64 decoding, and attempts to the raw value.
How to test this PR
Footnotes
Pull-Requests guidelines. If PR is significant, update Current Software State wiki page. ↩