Skip to content

Commit cf06b80

Browse files
author
Jeff McCormick
committed
added various fixes for BasicAuth and for Issue 65 load 2nd time error
1 parent 8c543da commit cf06b80

File tree

23 files changed

+222
-84
lines changed

23 files changed

+222
-84
lines changed

‎apiserver.go‎

Lines changed: 26 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,8 @@
11
package main
22

33
import (
4+
//"crypto/tls"
5+
//"crypto/x509"
46
log "github.com/Sirupsen/logrus"
57
"github.com/crunchydata/postgres-operator/apiserver/backupservice"
68
"github.com/crunchydata/postgres-operator/apiserver/cloneservice"
@@ -13,14 +15,15 @@ import (
1315
"github.com/crunchydata/postgres-operator/apiserver/userservice"
1416
"github.com/crunchydata/postgres-operator/apiserver/versionservice"
1517
"github.com/gorilla/mux"
18+
//"io/ioutil"
1619
"net/http"
20+
//"os"
1721
)
1822

1923
func main() {
2024

2125
log.Infoln("postgres-operator apiserver starts")
2226
r := mux.NewRouter()
23-
r.HandleFunc("/authtest", versionservice.AuthTestHandler)
2427
r.HandleFunc("/version", versionservice.VersionHandler)
2528
r.HandleFunc("/clones", cloneservice.CreateCloneHandler)
2629
r.HandleFunc("/policies", policyservice.CreatePolicyHandler)
@@ -38,6 +41,27 @@ func main() {
3841
r.HandleFunc("/clusters/scale/{name}", clusterservice.ScaleClusterHandler)
3942
r.HandleFunc("/backups/{name}", backupservice.ShowBackupHandler).Methods("GET", "DELETE")
4043
r.HandleFunc("/backups", backupservice.CreateBackupHandler).Methods("POST")
41-
//log.Fatal(http.ListenAndServeTLS(":8080", "/cpmkeys/cert.pem", "/cpmkeys/key.pem", r))
44+
//log.Fatal(http.ListenAndServeTLS(":8443", "/config/cert.pem", "/config/key.pem", r))
45+
//log.Fatal(http.ListenAndServeTLS(":8443", "/config/secure.domain.com.crt", "/config/secure.domain.com.key", r))
46+
//caCert, err := ioutil.ReadFile("/config/client.crt")
47+
//if err != nil {
48+
//log.Fatal(err)
49+
//log.Error("could not read /config/client.crt")
50+
//os.Exit(2)
51+
//}
52+
//caCertPool := x509.NewCertPool()
53+
//caCertPool.AppendCertsFromPEM(caCert)
54+
//cfg := &tls.Config{
55+
//ClientAuth: tls.RequireAndVerifyClientCert,
56+
//ClientCAs: caCertPool,
57+
//}
58+
//srv := &http.Server{
59+
////Addr: ":8443",
60+
//Handler: &handler{},
61+
//Handler: r,
62+
//TLSConfig: cfg,
63+
//}
64+
65+
//log.Fatal(srv.ListenAndServeTLS("/config/server.crt", "/config/server.key"))
4266
log.Fatal(http.ListenAndServe(":8080", r))
4367
}

‎apiserver/backupservice/backupimpl.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -220,6 +220,7 @@ func getBackupParams(name, Namespace string) (*crv1.Pgbackup, error) {
220220
spec.StorageSpec.Size = viper.GetString("BackupStorage.Size")
221221
spec.StorageSpec.StorageClass = viper.GetString("BackupStorage.StorageClass")
222222
spec.StorageSpec.StorageType = viper.GetString("BackupStorage.StorageType")
223+
log.Debug("JEFF in backup setting storagetype to " + spec.StorageSpec.StorageType)
223224
spec.StorageSpec.SupplementalGroups = viper.GetString("BackupStorage.SupplementalGroups")
224225
spec.StorageSpec.Fsgroup = viper.GetString("BackupStorage.Fsgroup")
225226
spec.CCPImageTag = viper.GetString("Cluster.CCPImageTag")

‎apiserver/clusterservice/clusterservice.go‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ limitations under the License.
1818
import (
1919
"encoding/json"
2020
log "github.com/Sirupsen/logrus"
21+
"github.com/crunchydata/postgres-operator/apiserver"
2122
msgs "github.com/crunchydata/postgres-operator/apiservermsgs"
2223
"github.com/gorilla/mux"
2324
"net/http"
@@ -78,6 +79,11 @@ func ShowClusterHandler(w http.ResponseWriter, r *http.Request) {
7879
log.Debug("selector param was [" + selector + "]")
7980
}
8081

82+
err := apiserver.Authn("ShowClusterHandler", w, r)
83+
if err != nil {
84+
return
85+
}
86+
8187
w.WriteHeader(http.StatusOK)
8288
w.Header().Set("Content-Type", "application/json")
8389

‎apiserver/loadservice/loadimpl.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
"github.com/crunchydata/postgres-operator/apiserver"
2525
"github.com/crunchydata/postgres-operator/apiserver/util"
2626
msgs "github.com/crunchydata/postgres-operator/apiservermsgs"
27+
operutil "github.com/crunchydata/postgres-operator/util"
2728
"github.com/spf13/viper"
2829
"io/ioutil"
2930
"k8s.io/apimachinery/pkg/labels"
@@ -169,8 +170,8 @@ func Load(request *msgs.LoadRequest) msgs.LoadResponse {
169170

170171
func createJob(clusterName, namespace string) error {
171172
var err error
172-
173-
LoadConfigTemplate.Name = "csvload-" + clusterName
173+
randStr := operutil.GenerateRandString(3)
174+
LoadConfigTemplate.Name = "csvload-" + clusterName + "-" + randStr
174175
LoadConfigTemplate.DbHost = clusterName
175176
LoadConfigTemplate.DbPass, err = util.GetSecretPassword(clusterName, crv1.RootSecretSuffix, namespace)
176177
if err != nil {

‎apiserver/root.go‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,15 @@ limitations under the License.
1717

1818
import (
1919
"bufio"
20+
"errors"
2021
"flag"
2122
log "github.com/Sirupsen/logrus"
2223
crdclient "github.com/crunchydata/postgres-operator/client"
2324
"github.com/spf13/viper"
2425
"k8s.io/client-go/kubernetes"
2526
"k8s.io/client-go/rest"
2627
"k8s.io/client-go/tools/clientcmd"
28+
"net/http"
2729
"os"
2830
"strings"
2931
)
@@ -197,3 +199,24 @@ func BasicAuthCheck(username, password string) bool {
197199

198200
return true
199201
}
202+
203+
func Authn(where string, w http.ResponseWriter, r *http.Request) error {
204+
var err error
205+
w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
206+
207+
username, password, authOK := r.BasicAuth()
208+
log.Debugf("Authn Attempt %s username=[%s] password=[%s]\n", where, username, password)
209+
if authOK == false {
210+
http.Error(w, "Not authorized", 401)
211+
return errors.New("Not Authorized")
212+
}
213+
214+
if !BasicAuthCheck(username, password) {
215+
log.Errorf("Authn Failed %s username=[%s] password=[%s]\n", where, username, password)
216+
http.Error(w, "Not authenticated in apiserver", 401)
217+
return errors.New("Not Authenticated")
218+
}
219+
log.Debugf("Authn Success %s username=[%s] password=[%s]\n", where, username, password)
220+
return err
221+
222+
}

‎apiserver/upgradeservice/upgradeimpl.go‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -310,15 +310,16 @@ func getUpgradeParams(name, currentImageTag string, request *msgs.CreateUpgradeR
310310
if request.CCPImageTag == existingImage {
311311
log.Error("CCPImageTag is the same as the cluster")
312312
log.Error("can't upgrade to the same image version")
313-
313+
log.Error("requested version is " + request.CCPImageTag)
314+
log.Error("existing version is " + existingImage)
314315
return nil, errors.New("invalid image tag")
315316
}
316317
requestedMajorVersion, strRep, err = parseMajorVersion(request.CCPImageTag)
317318
if err != nil {
318319
log.Error(err)
319320
}
320321
} else if viper.GetString("Cluster.CCPImageTag") == existingImage {
321-
log.Error("CCPImageTag is the same as the cluster")
322+
log.Error("Cluster.CCPImageTag is the same as the cluster")
322323
log.Error("can't upgrade to the same image version")
323324

324325
return nil, errors.New("invalid image tag")

‎apiserver/versionservice/versionimpl.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ func Version() msgs.VersionResponse {
2525
resp := msgs.VersionResponse{}
2626
resp.Status.Code = msgs.Ok
2727
resp.Status.Msg = "apiserver version"
28-
resp.Version = "2.1"
28+
resp.Version = "2.2"
2929

3030
return resp
3131
}

‎apiserver/versionservice/versionservice.go‎

Lines changed: 9 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -28,35 +28,28 @@ func VersionHandler(w http.ResponseWriter, r *http.Request) {
2828

2929
log.Debug("versionservice.VersionHandler called")
3030

31-
w.WriteHeader(http.StatusOK)
32-
w.Header().Set("Content-Type", "application/json")
33-
34-
resp := Version()
35-
36-
json.NewEncoder(w).Encode(resp)
37-
}
38-
39-
// VersionHandler ...
40-
// pgo version
41-
func AuthTestHandler(w http.ResponseWriter, r *http.Request) {
42-
43-
log.Debug("versionservice.AuthTestHandler called")
44-
4531
w.Header().Set("WWW-Authenticate", `Basic realm="Restricted"`)
4632

33+
err := apiserver.Authn("VersionHandler", w, r)
34+
if err != nil {
35+
return
36+
}
37+
38+
/**
4739
username, password, authOK := r.BasicAuth()
4840
if authOK == false {
4941
http.Error(w, "Not authorized", 401)
5042
return
5143
}
5244
53-
log.Debugf("versionservice.AuthTestHandler username=[%s] password=[%s]\n", username, password)
45+
log.Debugf("versionservice.VersionHandler username=[%s] password=[%s]\n", username, password)
5446
5547
if !apiserver.BasicAuthCheck(username, password) {
56-
//if username != "username" || password != "password" {
48+
log.Error("authentication failed for " + username + " in VersionHandler")
5749
http.Error(w, "Not authenticated in apiserver", 401)
5850
return
5951
}
52+
*/
6053

6154
w.WriteHeader(http.StatusOK)
6255
w.Header().Set("Content-Type", "application/json")

‎deploy/deployment.json‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@
1717
"name": "apiserver",
1818
"image": "crunchydata/apiserver:$CO_IMAGE_TAG",
1919
"imagePullPolicy": "IfNotPresent",
20-
"ports":[{
21-
"containerPort": 8080
22-
}],
20+
"ports":[{
21+
"containerPort": 8080
22+
}],
2323
"env": [{
2424
"name": "DEBUG",
2525
"value": "true"

0 commit comments

Comments
 (0)