Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use the access key for the fleetshard-sync AWS auth on the local dev environment #1095

Merged
merged 4 commits into from
Jun 14, 2023
Merged

Use the access key for the fleetshard-sync AWS auth on the local dev environment #1095

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
24c2711
Make rds client load configuration solely from env variables
kovayur Jun 12, 2023
4b2b2fa
Make dev deployment scripts use access key instead of the token
kovayur Jun 13, 2023
fe02904
Change dp-terraform chart
kovayur Jun 13, 2023
f1a4360
Fix tests
kovayur Jun 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion dev/env/manifests/fleetshard-sync/01-fleetshard-sync-secrets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,4 +9,5 @@ stringData:
rhsso-service-account-client-id: "${RHSSO_SERVICE_ACCOUNT_CLIENT_ID}"
rhsso-service-account-client-secret: "${RHSSO_SERVICE_ACCOUNT_CLIENT_SECRET}"
aws-role-arn: "${AWS_ROLE_ARN}"
aws-token: "${AWS_STATIC_TOKEN}"
aws-access-key-id: "${AWS_ACCESS_KEY_ID}"
aws-secret-access-key: "${AWS_SECRET_ACCESS_KEY}"
17 changes: 7 additions & 10 deletions dev/env/manifests/fleetshard-sync/02-fleetshard-sync-deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,11 +51,16 @@ spec:
value: "$MANAGED_DB_SUBNET_GROUP"
- name: MANAGED_DB_PERFORMANCE_INSIGHTS
value: "$MANAGED_DB_PERFORMANCE_INSIGHTS"
- name: AWS_ROLE_ARN
- name: AWS_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
name: fleetshard-sync
key: "aws-role-arn"
key: "aws-access-key-id"
- name: AWS_SECRET_ACCESS_KEY
valueFrom:
secretKeyRef:
name: fleetshard-sync
key: "aws-secret-access-key"
image: "${FLEET_MANAGER_IMAGE}"
imagePullPolicy: IfNotPresent
name: fleetshard-sync
Expand All @@ -65,8 +70,6 @@ spec:
name: secrets
- mountPath: /config
name: config
- mountPath: /var/run/secrets/tokens
name: aws-token
restartPolicy: Always
volumes:
- name: secrets
Expand All @@ -76,9 +79,3 @@ spec:
- name: config
configMap:
name: config
- name: aws-token
secret:
secretName: fleetshard-sync # pragma: allowlist secret
items:
- key: aws-token
path: aws-token
4 changes: 4 additions & 0 deletions dp-terraform/helm/rhacs-terraform/templates/fleetshard-sync-secret.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,3 +8,7 @@ metadata:
stringData:
rhsso-service-account-client-id: {{ .Values.fleetshardSync.redHatSSO.clientId | quote }}
rhsso-service-account-client-secret: {{ .Values.fleetshardSync.redHatSSO.clientSecret | quote }}
{{- if eq .Values.fleetshardSync.aws.enableTokenAuth false }}
aws-access-key-id: {{ required "fleetshardSync.aws.accessKeyId is required when fleetshardSync.aws.enableTokenAuth = false" .Values.fleetshardSync.aws.accessKeyId | quote }}
aws-secret-access-key: {{ required "fleetshardSync.aws.secretAccessKey is required when fleetshardSync.aws.enableTokenAuth = false" .Values.fleetshardSync.aws.secretAccessKey | quote }}
{{- end }}
15 changes: 15 additions & 0 deletions dp-terraform/helm/rhacs-terraform/templates/fleetshard-sync.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,21 @@ spec:
value: {{ .Values.fleetshardSync.telemetry.storage.endpoint | quote }}
- name: TELEMETRY_STORAGE_KEY
value: {{ .Values.fleetshardSync.telemetry.storage.key | quote }}
{{- if .Values.fleetshardSync.aws.enableTokenAuth }}
- name: AWS_WEB_IDENTITY_TOKEN_FILE
value: "/var/run/secrets/tokens/aws-token"
{{- else }}
- name: AWS_ACCESS_KEY_ID
valueFrom:
secretKeyRef:
name: fleetshard-sync
key: "aws-access-key-id"
- name: AWS_SECRET_ACCESS_KEY
valueFrom:
secretKeyRef:
name: fleetshard-sync
key: "aws-secret-access-key"
{{- end }}
volumeMounts:
- mountPath: /var/run/secrets/tokens
name: aws-token
Expand Down
3 changes: 3 additions & 0 deletions dp-terraform/helm/rhacs-terraform/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,9 @@ fleetshardSync:
aws:
region: "us-east-1" # TODO(2023-05-01): Remove the default value here as we now set it explicitly
roleARN: ""
enableTokenAuth: true
accessKeyId: ""
secretAccessKey: ""
telemetry:
storage:
endpoint: ""
Expand Down
11 changes: 0 additions & 11 deletions fleetshard/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,18 +30,10 @@ type Config struct {
FeatureFlagUpgradeOperatorEnabled bool `env:"FEATURE_FLAG_UPGRADE_OPERATOR_ENABLED" envDefault:"false"`
BaseCrdURL string `env:"BASE_CRD_URL" envDefault:"https://raw.githubusercontent.com/stackrox/stackrox/%s/operator/bundle/manifests/"`

AWS AWS
ManagedDB ManagedDB
Telemetry Telemetry
}

// AWS for configuring AWS specific parameters
type AWS struct {
Region string `env:"AWS_REGION" envDefault:"us-east-1"`
RoleARN string `env:"AWS_ROLE_ARN"`
TokenFile string `env:"AWS_STS_TOKEN_FILE" envDefault:"/var/run/secrets/tokens/aws-token"`
}

// ManagedDB for configuring managed DB specific parameters
type ManagedDB struct {
Enabled bool `env:"MANAGED_DB_ENABLED" envDefault:"false"`
Expand Down Expand Up @@ -86,9 +78,6 @@ func validateManagedDBConfig(c Config, configErrors *errorhelpers.ErrorList) {
if !c.ManagedDB.Enabled {
return
}
if c.AWS.RoleARN == "" {
configErrors.AddError(errors.New("MANAGED_DB_ENABLED == true and AWS_ROLE_ARN unset in the environment"))
}
if c.ManagedDB.SecurityGroup == "" {
configErrors.AddError(errors.New("MANAGED_DB_ENABLED == true and MANAGED_DB_SECURITY_GROUP unset in the environment"))
}
Expand Down
13 changes: 0 additions & 13 deletions fleetshard/config/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,30 +30,17 @@ func TestSingleton_Failure(t *testing.T) {

func TestSingleton_Success_WhenManagedDBEnabled(t *testing.T) {
t.Setenv("CLUSTER_ID", "some-value")
t.Setenv("AWS_ROLE_ARN", "arn:aws:iam::012456789:role/fake_role")
t.Setenv("MANAGED_DB_ENABLED", "true")
t.Setenv("MANAGED_DB_SECURITY_GROUP", "some-group")
cfg, err := GetConfig()
require.NoError(t, err)
assert.Equal(t, cfg.AWS.RoleARN, "arn:aws:iam::012456789:role/fake_role")
assert.Equal(t, cfg.AWS.Region, "us-east-1")
assert.Equal(t, cfg.ManagedDB.Enabled, true)
assert.Equal(t, cfg.ManagedDB.SecurityGroup, "some-group")
}

func TestSingleton_Failure_WhenManagedDBEnabledAndAWSRoleArnNotSet(t *testing.T) {
t.Setenv("CLUSTER_ID", "some-value")
t.Setenv("MANAGED_DB_ENABLED", "true")
t.Setenv("MANAGED_DB_SECURITY_GROUP", "some-group")
cfg, err := GetConfig()
assert.Error(t, err, "MANAGED_DB_ENABLED == true and AWS_ROLE_ARN unset in the environment")
assert.Nil(t, cfg)
}

func TestSingleton_Failure_WhenManagedDBEnabledAndManagedDbSecurityGroupNotSet(t *testing.T) {
t.Setenv("CLUSTER_ID", "some-value")
t.Setenv("MANAGED_DB_ENABLED", "true")
t.Setenv("AWS_ROLE_ARN", "arn:aws:iam::012456789:role/fake_role")
cfg, err := GetConfig()
assert.Error(t, err, "MANAGED_DB_ENABLED == true and MANAGED_DB_SECURITY_GROUP unset in the environment")
assert.Nil(t, cfg)
Expand Down
23 changes: 3 additions & 20 deletions fleetshard/pkg/central/cloudprovider/awsclient/rds.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,11 +9,8 @@ import (

"github.com/aws/aws-sdk-go/aws"
"github.com/aws/aws-sdk-go/aws/awserr"
awscredentials "github.com/aws/aws-sdk-go/aws/credentials"
"github.com/aws/aws-sdk-go/aws/credentials/stscreds"
"github.com/aws/aws-sdk-go/aws/session"
"github.com/aws/aws-sdk-go/service/rds"
"github.com/aws/aws-sdk-go/service/sts"
"github.com/golang/glog"
"github.com/stackrox/acs-fleet-manager/fleetshard/config"
"github.com/stackrox/acs-fleet-manager/fleetshard/pkg/central/cloudprovider"
Expand Down Expand Up @@ -327,7 +324,7 @@ func (r *RDS) waitForInstanceToBeAvailable(ctx context.Context, instanceID strin

// NewRDSClient initializes a new awsclient.RDS
func NewRDSClient(config *config.Config) (*RDS, error) {
rdsClient, err := newRdsClient(config.AWS)
rdsClient, err := newRdsClient()
if err != nil {
return nil, fmt.Errorf("unable to create RDS client: %w", err)
}
Expand Down Expand Up @@ -432,22 +429,8 @@ func newDeleteCentralDBClusterInput(clusterID string, skipFinalSnapshot bool) *r
return input
}

func newRdsClient(awsConfig config.AWS) (*rds.RDS, error) {
cfg := &aws.Config{
Region: aws.String(awsConfig.Region),
}
sess, err := session.NewSession(cfg)
if err != nil {
return nil, fmt.Errorf("unable to create session for STS client: %w", err)
}
stsClient := sts.New(sess)

roleProvider := stscreds.NewWebIdentityRoleProviderWithOptions(stsClient, awsConfig.RoleARN, "rds",
stscreds.FetchTokenPath(awsConfig.TokenFile))

cfg.Credentials = awscredentials.NewCredentials(roleProvider)

sess, err = session.NewSession(cfg)
func newRdsClient() (*rds.RDS, error) {
sess, err := session.NewSession()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Did I understand correctly, that by using this it will automatically use:

  • AWS_ACCESS_KEY and AWS_SECRET_ACCESS_KEY if set
  • AWS_ROLE_ARN and AWS_WEB_IDENTITY_TOKEN_FILE if set
  • return an error if no successful authentication was possible?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, correct.

if err != nil {
return nil, fmt.Errorf("unable to create session for RDS client: %w", err)
}
Expand Down
10 changes: 6 additions & 4 deletions fleetshard/pkg/central/reconciler/reconciler_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -190,14 +190,16 @@ func TestReconcileCreateWithLabelOperatorVersion(t *testing.T) {
}

func TestReconcileCreateWithManagedDBNoCredentials(t *testing.T) {
t.Setenv("AWS_ACCESS_KEY", "")
t.Setenv("AWS_SECRET_ACCESS_KEY", "")
t.Setenv("AWS_REGION", "us-east-1")
t.Setenv("AWS_ROLE_ARN", "arn:aws:iam::012456789:role/fake_role")
t.Setenv("AWS_WEB_IDENTITY_TOKEN_FILE", "/var/run/secrets/tokens/aws-token")

fakeClient := testutils.NewFakeClientBuilder(t).Build()

managedDBProvisioningClient, err := awsclient.NewRDSClient(
&config.Config{
AWS: config.AWS{
Region: "us-east-1",
RoleARN: "arn:aws:iam::012456789:role/fake_role",
},
ManagedDB: config.ManagedDB{
SecurityGroup: "security-group",
SubnetGroup: "db-group",
Expand Down