Skip to content

Commit a55b1bb

Browse files
lhotarilhotari
authored
Remove the dependency to pulsarctl when generating JWT tokens (#584)
1 parent 43f8dfa commit a55b1bb

File tree

5 files changed

+66
-79
lines changed

5 files changed

+66
-79
lines changed

‎.gitignore‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,3 @@ charts/**/*.lock
1717
PRIVATEKEY
1818
PUBLICKEY
1919
.vagrant/
20-
pulsarctl-*-*.tar.gz
21-
pulsarctl-*-*/

‎scripts/pulsar/common_auth.sh‎

Lines changed: 9 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -18,34 +18,13 @@
1818
# under the License.
1919
#
2020

21-
if [ -z "$CHART_HOME" ]; then
22-
echo "error: CHART_HOME should be initialized"
23-
exit 1
24-
fi
25-
26-
OUTPUT=${CHART_HOME}/output
27-
OUTPUT_BIN=${OUTPUT}/bin
28-
PULSARCTL_VERSION=v3.0.2.6
29-
PULSARCTL_BIN=${HOME}/.pulsarctl/pulsarctl
30-
export PATH=${HOME}/.pulsarctl/plugins:${PATH}
31-
32-
test -d "$OUTPUT_BIN" || mkdir -p "$OUTPUT_BIN"
33-
34-
function pulsar::verify_pulsarctl() {
35-
if test -x "$PULSARCTL_BIN"; then
36-
return
21+
if [ -z "$PULSAR_VERSION" ]; then
22+
if command -v yq &> /dev/null; then
23+
# use yq to get the appVersion from the Chart.yaml file
24+
PULSAR_VERSION=$(yq .appVersion charts/pulsar/Chart.yaml)
25+
else
26+
# use a default version if yq is not installed
27+
PULSAR_VERSION="4.0.3"
3728
fi
38-
return 1
39-
}
40-
41-
function pulsar::ensure_pulsarctl() {
42-
if pulsar::verify_pulsarctl; then
43-
return 0
44-
fi
45-
echo "Get pulsarctl install.sh script ..."
46-
install_script=$(mktemp)
47-
trap "test -f $install_script && rm $install_script" RETURN
48-
curl --retry 10 -L -o $install_script https://raw.githubusercontent.com/streamnative/pulsarctl/master/install.sh
49-
chmod +x $install_script
50-
$install_script --user --version ${PULSARCTL_VERSION}
51-
}
29+
fi
30+
PULSAR_TOKENS_CONTAINER_IMAGE="apachepulsar/pulsar:${PULSAR_VERSION}"

‎scripts/pulsar/generate_token.sh‎

Lines changed: 28 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,12 @@
2020

2121
set -e
2222

23-
CHART_HOME=$(unset CDPATH && cd $(dirname "${BASH_SOURCE[0]}")/../.. && pwd)
23+
SCRIPT_DIR="$(unset CDPATH && cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
24+
CHART_HOME=$(unset CDPATH && cd "$SCRIPT_DIR/../.." && pwd)
2425
cd ${CHART_HOME}
2526

27+
source "${SCRIPT_DIR}/common_auth.sh"
28+
2629
usage() {
2730
cat <<EOF
2831
This script is used to generate token for a given pulsar role.
@@ -86,10 +89,6 @@ if [[ "x${role}" == "x" ]]; then
8689
exit 1
8790
fi
8891

89-
source ${CHART_HOME}/scripts/pulsar/common_auth.sh
90-
91-
pulsar::ensure_pulsarctl
92-
9392
namespace=${namespace:-pulsar}
9493
release=${release:-pulsar-dev}
9594

@@ -101,7 +100,6 @@ function pulsar::jwt::get_secret() {
101100
if [[ "${local}" == "true" ]]; then
102101
cp ${type} ${tmpfile}
103102
else
104-
echo "kubectl get -n ${namespace} secrets ${secret_name} -o jsonpath="{.data.${type}}" | base64 --decode > ${tmpfile}"
105103
kubectl get -n ${namespace} secrets ${secret_name} -o jsonpath="{.data['${type}']}" | base64 --decode > ${tmpfile}
106104
fi
107105
}
@@ -110,31 +108,41 @@ function pulsar::jwt::generate_symmetric_token() {
110108
local token_name="${release}-token-${role}"
111109
local secret_name="${release}-token-symmetric-key"
112110

113-
tmpfile=$(mktemp)
114-
trap "test -f $tmpfile && rm $tmpfile" RETURN
115-
tokentmpfile=$(mktemp)
116-
trap "test -f $tokentmpfile && rm $tokentmpfile" RETURN
117-
pulsar::jwt::get_secret SECRETKEY ${tmpfile} ${secret_name}
118-
${PULSARCTL_BIN} token create -a HS256 --secret-key-file ${tmpfile} --subject ${role} 2&> ${tokentmpfile}
119-
newtokentmpfile=$(mktemp)
111+
112+
local tmpdir=$(mktemp -d)
113+
trap "test -d $tmpdir && rm -rf $tmpdir" RETURN
114+
secretkeytmpfile=${tmpdir}/secret.key
115+
tokentmpfile=${tmpdir}/token.jwt
116+
117+
pulsar::jwt::get_secret SECRETKEY ${secretkeytmpfile} ${secret_name}
118+
119+
docker run --user 0 --rm -t -v ${tmpdir}:/keydir ${PULSAR_TOKENS_CONTAINER_IMAGE} bin/pulsar tokens create -a HS256 --subject "${role}" --secret-key=file:/keydir/secret.key > ${tokentmpfile}
120+
121+
newtokentmpfile=${tmpdir}/token.jwt.new
120122
tr -d '\n' < ${tokentmpfile} > ${newtokentmpfile}
121-
echo "kubectl create secret generic ${token_name} -n ${namespace} --from-file="TOKEN=${newtokentmpfile}" --from-literal="TYPE=symmetric" ${local:+ -o yaml --dry-run=client}"
122123
kubectl create secret generic ${token_name} -n ${namespace} --from-file="TOKEN=${newtokentmpfile}" --from-literal="TYPE=symmetric" ${local:+ -o yaml --dry-run=client}
124+
rm -rf $tmpdir
123125
}
124126

125127
function pulsar::jwt::generate_asymmetric_token() {
126128
local token_name="${release}-token-${role}"
127129
local secret_name="${release}-token-asymmetric-key"
128130

129-
privatekeytmpfile=$(mktemp)
130-
trap "test -f $privatekeytmpfile && rm $privatekeytmpfile" RETURN
131-
tokentmpfile=$(mktemp)
132-
trap "test -f $tokentmpfile && rm $tokentmpfile" RETURN
131+
local tmpdir=$(mktemp -d)
132+
trap "test -d $tmpdir && rm -rf $tmpdir" RETURN
133+
134+
privatekeytmpfile=${tmpdir}/privatekey.der
135+
tokentmpfile=${tmpdir}/token.jwt
136+
133137
pulsar::jwt::get_secret PRIVATEKEY ${privatekeytmpfile} ${secret_name}
134-
${PULSARCTL_BIN} token create -a RS256 --private-key-file ${privatekeytmpfile} --subject ${role} 2&> ${tokentmpfile}
135-
newtokentmpfile=$(mktemp)
138+
139+
# Generate token
140+
docker run --user 0 --rm -t -v ${tmpdir}:/keydir ${PULSAR_TOKENS_CONTAINER_IMAGE} bin/pulsar tokens create -a RS256 --subject "${role}" --private-key=file:/keydir/privatekey.der > ${tokentmpfile}
141+
142+
newtokentmpfile=${tmpdir}/token.jwt.new
136143
tr -d '\n' < ${tokentmpfile} > ${newtokentmpfile}
137144
kubectl create secret generic ${token_name} -n ${namespace} --from-file="TOKEN=${newtokentmpfile}" --from-literal="TYPE=asymmetric" ${local:+ -o yaml --dry-run=client}
145+
rm -rf $tmpdir
138146
}
139147

140148
if [[ "${symmetric}" == "true" ]]; then

‎scripts/pulsar/generate_token_secret_key.sh‎

Lines changed: 29 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -20,9 +20,12 @@
2020

2121
set -e
2222

23-
CHART_HOME=$(unset CDPATH && cd $(dirname "${BASH_SOURCE[0]}")/../.. && pwd)
23+
SCRIPT_DIR="$(unset CDPATH && cd "$(dirname "${BASH_SOURCE[0]}")" &>/dev/null && pwd)"
24+
CHART_HOME=$(unset CDPATH && cd "$SCRIPT_DIR/../.." && pwd)
2425
cd ${CHART_HOME}
2526

27+
source "${SCRIPT_DIR}/common_auth.sh"
28+
2629
usage() {
2730
cat <<EOF
2831
This script is used to generate token secret key for a given pulsar helm release.
@@ -74,42 +77,45 @@ case $key in
7477
esac
7578
done
7679

77-
source ${CHART_HOME}/scripts/pulsar/common_auth.sh
78-
79-
pulsar::ensure_pulsarctl
80-
8180
namespace=${namespace:-pulsar}
8281
release=${release:-pulsar-dev}
8382
local_cmd=${file:+-o yaml --dry-run=client >secret.yaml}
8483

8584
function pulsar::jwt::generate_symmetric_key() {
8685
local secret_name="${release}-token-symmetric-key"
8786

88-
tmpfile=$(mktemp)
89-
trap "test -f $tmpfile && rm $tmpfile" RETURN
90-
${PULSARCTL_BIN} token create-secret-key --output-file ${tmpfile}
91-
mv $tmpfile SECRETKEY
92-
kubectl create secret generic ${secret_name} -n ${namespace} --from-file=SECRETKEY ${local:+ -o yaml --dry-run=client}
93-
if [[ "${local}" != "true" ]]; then
94-
rm SECRETKEY
87+
local tmpdir=$(mktemp -d)
88+
trap "test -d $tmpdir && rm -rf $tmpdir" RETURN
89+
local tmpfile=${tmpdir}/SECRETKEY
90+
docker run --rm -t ${PULSAR_TOKENS_CONTAINER_IMAGE} bin/pulsar tokens create-secret-key > "${tmpfile}"
91+
kubectl create secret generic ${secret_name} -n ${namespace} --from-file=$tmpfile ${local:+ -o yaml --dry-run=client}
92+
# if local is true, keep the file available for debugging purposes
93+
if [[ "${local}" == "true" ]]; then
94+
mv $tmpfile SECRETKEY
9595
fi
96+
rm -rf $tmpdir
9697
}
9798

9899
function pulsar::jwt::generate_asymmetric_key() {
99100
local secret_name="${release}-token-asymmetric-key"
100101

101-
privatekeytmpfile=$(mktemp)
102-
trap "test -f $privatekeytmpfile && rm $privatekeytmpfile" RETURN
103-
publickeytmpfile=$(mktemp)
104-
trap "test -f $publickeytmpfile && rm $publickeytmpfile" RETURN
105-
${PULSARCTL_BIN} token create-key-pair -a RS256 --output-private-key ${privatekeytmpfile} --output-public-key ${publickeytmpfile}
106-
mv $privatekeytmpfile PRIVATEKEY
107-
mv $publickeytmpfile PUBLICKEY
108-
kubectl create secret generic ${secret_name} -n ${namespace} --from-file=PRIVATEKEY --from-file=PUBLICKEY ${local:+ -o yaml --dry-run=client}
109-
if [[ "${local}" != "true" ]]; then
110-
rm PRIVATEKEY
111-
rm PUBLICKEY
102+
local tmpdir=$(mktemp -d)
103+
trap "test -d $tmpdir && rm -rf $tmpdir" RETURN
104+
105+
privatekeytmpfile=${tmpdir}/PRIVATEKEY
106+
publickeytmpfile=${tmpdir}/PUBLICKEY
107+
108+
# Generate key pair
109+
docker run --user 0 --rm -t -v ${tmpdir}:/keydir ${PULSAR_TOKENS_CONTAINER_IMAGE} bin/pulsar tokens create-key-pair --output-private-key=/keydir/PRIVATEKEY --output-public-key=/keydir/PUBLICKEY
110+
111+
kubectl create secret generic ${secret_name} -n ${namespace} --from-file=$privatekeytmpfile --from-file=$publickeytmpfile ${local:+ -o yaml --dry-run=client}
112+
113+
# if local is true, keep the files available for debugging purposes
114+
if [[ "${local}" == "true" ]]; then
115+
mv $privatekeytmpfile PRIVATEKEY
116+
mv $publickeytmpfile PUBLICKEY
112117
fi
118+
rm -rf $tmpdir
113119
}
114120

115121
if [[ "${symmetric}" == "true" ]]; then

‎scripts/pulsar/get_token.sh‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,6 @@ if [[ "x${role}" == "x" ]]; then
7474
exit 1
7575
fi
7676

77-
source ${CHART_HOME}/scripts/pulsar/common_auth.sh
78-
79-
pulsar::ensure_pulsarctl
80-
8177
namespace=${namespace:-pulsar}
8278
release=${release:-pulsar-dev}
8379

0 commit comments

Comments
 (0)