Skip to content

Commit a3f6855

Browse files
clintonkpraveene12
clintonk
and
praveene12
authored
AWS China and US partition secret ARN update
Co-authored-by: praveene12 <[email protected]>
1 parent aff8d19 commit a3f6855

File tree

4 files changed

+95
-16
lines changed

4 files changed

+95
-16
lines changed

‎storage_drivers/ontap/aws_common.go‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ package ontap
55
import (
66
"context"
77
"fmt"
8-
"strings"
98

109
tridentconfig "github.com/netapp/trident/config"
1110
. "github.com/netapp/trident/logging"
@@ -19,11 +18,12 @@ import (
1918
// SetSvmCredentials Pull SVM credentials out of AWS secret store and enter them into the config.
2019
func SetSvmCredentials(ctx context.Context, secretARN string, api awsapi.AWSAPI, config *drivers.OntapStorageDriverConfig) (err error) {
2120
secret, secretErr := api.GetSecret(ctx, secretARN)
22-
secretMap := secret.SecretMap
2321
if secretErr != nil {
2422
return fmt.Errorf("could not retrieve credentials from AWS Secrets Manager; %w", secretErr)
2523
}
2624

25+
secretMap := secret.SecretMap
26+
2727
if username, ok := secretMap["username"]; !ok {
2828
return fmt.Errorf("%s driver must include username in the secret referenced by Credentials",
2929
config.StorageDriverName)
@@ -192,12 +192,13 @@ func getAWSSecretsManagerARNFromConfig(_ context.Context, config *drivers.OntapS
192192
return config.Credentials[drivers.KeyName], nil
193193
}
194194

195-
if strings.HasPrefix(config.Username, "arn:aws:secretsmanager:") {
195+
_, _, _, err := awsapi.ParseSecretARN(config.Username)
196+
if err != nil {
197+
return config.Username, errors.NotFoundError("%s, %s driver with FSxN personality must include Credentials of type %s "+
198+
"in the configuration", err, config.StorageDriverName, string(drivers.CredentialStoreAWSARN))
199+
} else {
196200
return config.Username, nil
197201
}
198-
199-
return "", errors.NotFoundError("%s driver with FSxN personality must include Credentials of type %s "+
200-
"in the configuration", config.StorageDriverName, string(drivers.CredentialStoreAWSARN))
201202
}
202203

203204
// destroyFSxVolume discovers and deletes a volume using the FSx SDK. This is needed to delete a volume in the case

‎storage_drivers/ontap/aws_common_test.go‎

Lines changed: 72 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,16 @@ import (
1414
)
1515

1616
const (
17-
SECRET_MANAGER_ARN = "arn:aws:secretsmanager:eu-west-3:111111111111:secret:secret-name-mlNvrF"
17+
VOLUME_MANAGER_ARN = "arn:aws:fsx:eu-west-3:111111111111:volume/111111111/111111111"
18+
VOLUME_MANAGER_ARN_CN = "arn:aws-cn:fsx:eu-west-3:111111111111:volume/111111111/111111111"
19+
VOLUME_MANAGER_ARN_US = "arn:aws-us-gov:fsx:eu-west-3:111111111111:volume/111111111/111111111"
20+
VOLUME_MANAGER_ARN_INVALID_PARTITION = "arn:aws-us-gov1:fsx:eu-west-3:111111111111:volume/111111111/111111111"
21+
VOLUME_MANAGER_ARN_INVALID_FILESYSTEM = "arn:aws-us-gov:fsx:eu-west-3:111111111111:volume//111111111"
22+
SECRET_MANAGER_ARN = "arn:aws:secretsmanager:eu-west-3:111111111111:secret:secret-name-mlNvrF"
23+
SECRET_MANAGER_ARN_CN = "arn:aws-cn:secretsmanager:cn-west-3:111111111111:secret:secret-name-mlNvrF"
24+
SECRET_MANAGER_ARN_US = "arn:aws-us-gov:secretsmanager:us-west-3:111111111111:secret:secret-name-mlNvrF"
25+
SECRET_MANAGER_ARN_INVALID_PARTITION = "arn:awsaws-cn:secretsmanager:eu-west-3:111111111111:secret:secret-name-mlNvrF"
26+
SECRET_MANAGER_ARN_INVALID_SECRET = "arn:aws-cn:secmanagers:eu-west-3:111111111111:secret:secret-name-mlNvrF"
1827
)
1928

2029
func TestFSxFilesystemValidation_Error(t *testing.T) {
@@ -301,3 +310,65 @@ func TestSvmCredentials(t *testing.T) {
301310
})
302311
}
303312
}
313+
314+
func TestParseSecretARN(t *testing.T) {
315+
secretArn := SECRET_MANAGER_ARN
316+
secretArn_cn := SECRET_MANAGER_ARN_CN
317+
secretArn_invalid_partition := SECRET_MANAGER_ARN_INVALID_PARTITION
318+
secretArn_invalid_secret := SECRET_MANAGER_ARN_INVALID_SECRET
319+
secretArn_us := SECRET_MANAGER_ARN_US
320+
tests := []struct {
321+
name string
322+
userName string
323+
error string
324+
}{
325+
{"Invalid secret ARN partition value", secretArn_invalid_partition, "secret ARN " + secretArn_invalid_partition + " is invalid"},
326+
{"Invalid secret fomrat", secretArn_invalid_secret, "secret ARN " + secretArn_invalid_secret + " is invalid"},
327+
{"valid aws us secret", secretArn_us, ""},
328+
{"valid aws cn secret", secretArn_cn, ""},
329+
{"valid aws cn secret", secretArn, ""},
330+
}
331+
for _, test := range tests {
332+
t.Run(test.name, func(t *testing.T) {
333+
secretARN := test.userName
334+
335+
_, _, _, err := awsapi.ParseSecretARN(secretARN)
336+
if test.error == "" {
337+
assert.Nil(t, err)
338+
} else {
339+
assert.Equal(t, err.Error(), test.error)
340+
}
341+
})
342+
}
343+
}
344+
345+
func TestParseVolumeARN(t *testing.T) {
346+
volumeArn := VOLUME_MANAGER_ARN
347+
volumeArn_cn := VOLUME_MANAGER_ARN_CN
348+
volumeArn_invalid_filesystem := VOLUME_MANAGER_ARN_INVALID_FILESYSTEM
349+
volumeArn_invalid_partition := VOLUME_MANAGER_ARN_INVALID_PARTITION
350+
volumeArn_us := VOLUME_MANAGER_ARN_US
351+
tests := []struct {
352+
name string
353+
userName string
354+
error string
355+
}{
356+
{"Invalid volume ARN parition value", volumeArn_invalid_partition, "volume ARN " + volumeArn_invalid_partition + " is invalid"},
357+
{"Invalid volume ARN filesystem value", volumeArn_invalid_filesystem, "volume ARN " + volumeArn_invalid_filesystem + " is invalid"},
358+
{"valid volume us secret", volumeArn_us, ""},
359+
{"valid volume cn secret", volumeArn_cn, ""},
360+
{"valid volume secret", volumeArn, ""},
361+
}
362+
for _, test := range tests {
363+
t.Run(test.name, func(t *testing.T) {
364+
volumeARN := test.userName
365+
366+
_, _, _, _, err := awsapi.ParseVolumeARN(volumeARN)
367+
if test.error == "" {
368+
assert.Nil(t, err)
369+
} else {
370+
assert.Equal(t, err.Error(), test.error)
371+
}
372+
})
373+
}
374+
}

‎storage_drivers/ontap/awsapi/aws.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ const (
3535
)
3636

3737
var (
38-
volumeARNRegex = regexp.MustCompile(`^arn:aws:fsx:(?P<region>[^:]+):(?P<accountID>\d{12}):volume/(?P<filesystemID>[A-z0-9-]+)/(?P<volumeID>[A-z0-9-]+)$`)
39-
secretARNRegex = regexp.MustCompile(`^arn:aws:secretsmanager:(?P<region>[^:]+):(?P<accountID>\d{12}):secret:(?P<secretName>[A-z0-9/_+=.@-]+)-[A-z0-9/_+=.@-]{6}$`)
38+
volumeARNRegex = regexp.MustCompile(`^arn:(?P<partition>aws|aws-cn|aws-us-gov){1}:fsx:(?P<region>[^:]+):(?P<accountID>\d{12}):volume/(?P<filesystemID>[A-z0-9-]+)/(?P<volumeID>[A-z0-9-]+)$`)
39+
secretARNRegex = regexp.MustCompile(`^arn:(?P<partition>aws|aws-cn|aws-us-gov){1}:secretsmanager:(?P<region>[^:]+):(?P<accountID>\d{12}):secret:(?P<secretName>[A-z0-9/_+=.@-]+)-[A-z0-9/_+=.@-]{6}$`)
4040
)
4141

4242
// ClientConfig holds configuration data for the API driver object.

‎storage_drivers/ontap/ontap_factory.go‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,13 @@ func GetStorageDriver(
4242
return nil, fmt.Errorf("error initializing %s driver: %v", commonConfig.StorageDriverName, err)
4343
}
4444

45+
// Initialize AWS API if applicable.
46+
// Unit tests mock the API layer, so we only use the real API interface if it doesn't already exist.
47+
AWSAPI, err := initializeAWSDriver(ctx, ontapConfig)
48+
if err != nil {
49+
return nil, fmt.Errorf("error initializing %s AWS driver; %v", commonConfig.StorageDriverName, err)
50+
}
51+
4552
// Initialize the ONTAP API.
4653
API, err := InitializeOntapDriver(ctx, ontapConfig)
4754
if err != nil {
@@ -59,13 +66,13 @@ func GetStorageDriver(
5966
switch ontapConfig.StorageDriverName {
6067

6168
case config.OntapNASStorageDriverName:
62-
storageDriver = &NASStorageDriver{API: API, Config: *ontapConfig}
69+
storageDriver = &NASStorageDriver{API: API, AWSAPI: AWSAPI, Config: *ontapConfig}
6370
case config.OntapNASFlexGroupStorageDriverName:
64-
storageDriver = &NASFlexGroupStorageDriver{API: API, Config: *ontapConfig}
71+
storageDriver = &NASFlexGroupStorageDriver{API: API, AWSAPI: AWSAPI, Config: *ontapConfig}
6572
case config.OntapNASQtreeStorageDriverName:
66-
storageDriver = &NASQtreeStorageDriver{API: API, Config: *ontapConfig}
73+
storageDriver = &NASQtreeStorageDriver{API: API, AWSAPI: AWSAPI, Config: *ontapConfig}
6774
case config.OntapSANEconomyStorageDriverName:
68-
storageDriver = &SANEconomyStorageDriver{API: API, Config: *ontapConfig}
75+
storageDriver = &SANEconomyStorageDriver{API: API, AWSAPI: AWSAPI, Config: *ontapConfig}
6976

7077
// ontap-san uses additional system details to choose the needed driver
7178
case config.OntapSANStorageDriverName:
@@ -75,15 +82,15 @@ func GetStorageDriver(
7582
ontapConfig.Flags[FlagPersonality] = PersonalityASAr2 // Used by ASUP to distinguish personalities
7683
storageDriver = &ASAStorageDriver{API: API, Config: *ontapConfig}
7784
} else if !API.IsSANOptimized() && !API.IsDisaggregated() {
78-
storageDriver = &SANStorageDriver{API: API, Config: *ontapConfig}
85+
storageDriver = &SANStorageDriver{API: API, AWSAPI: AWSAPI, Config: *ontapConfig}
7986
} else {
8087
return nil, fmt.Errorf("unsupported ONTAP personality with disaggregated %t and SAN optimized %t",
8188
API.IsDisaggregated(), API.IsSANOptimized())
8289
}
8390
case sa.FCP:
84-
storageDriver = &SANStorageDriver{API: API, Config: *ontapConfig}
91+
storageDriver = &SANStorageDriver{API: API, AWSAPI: AWSAPI, Config: *ontapConfig}
8592
case sa.NVMe:
86-
storageDriver = &NVMeStorageDriver{API: API, Config: *ontapConfig}
93+
storageDriver = &NVMeStorageDriver{API: API, AWSAPI: AWSAPI, Config: *ontapConfig}
8794
default:
8895
return nil, fmt.Errorf("unsupported SAN protocol %s", driverProtocol)
8996
}

0 commit comments

Comments
 (0)