Skip to content

Commit 3db680d

Browse files
JoshVanLelena-kolevska
JoshVanL
authored and
elena-kolevska
committed
Refactor SPIFFE from pkg/security to kit (dapr#7669)
* Refactor SPIFFE from `pkg/security` to `kit` Updates the `pkg/security` package to move the SPIFFE implementation to a new kit package. This new kit package is more modulated and fuller test coverage. This package has been moved so that it can be both imported by dapr & components-contrib, as well as making the package more suitable for further development to support X.509 Component auth. dapr/proposals#51 Also moves in test/utils from dapr to crypto/test for shared usage. Part of dapr/proposals#51 Uses go mod fork of dapr/kit#92 Signed-off-by: joshvanl <[email protected]> * Include SVID context with `Init`ing Component Signed-off-by: joshvanl <[email protected]> * Adds security to processor options Signed-off-by: joshvanl <[email protected]> * Update github.com/dapr/dapr to master Signed-off-by: joshvanl <[email protected]> * Update `util` to new `test` package import Signed-off-by: joshvanl <[email protected]> * Update go.sum Signed-off-by: joshvanl <[email protected]> --------- Signed-off-by: joshvanl <[email protected]> Signed-off-by: Elena Kolevska <[email protected]>
1 parent 5ecba7e commit 3db680d

File tree

37 files changed

+361
-1278
lines changed

37 files changed

+361
-1278
lines changed

‎cmd/injector/app/app.go‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -91,7 +91,7 @@ func Run() {
9191
SentryAddress: cfg.SentryAddress,
9292
ControlPlaneTrustDomain: cfg.ControlPlaneTrustDomain,
9393
ControlPlaneNamespace: namespace,
94-
TrustAnchorsFile: cfg.TrustAnchorsFile,
94+
TrustAnchorsFile: &cfg.TrustAnchorsFile,
9595
AppID: "dapr-injector",
9696
MTLSEnabled: true,
9797
Mode: modes.KubernetesMode,
@@ -165,7 +165,7 @@ func Run() {
165165
return rerr
166166
}
167167

168-
caBundle, rErr := sec.CurrentTrustAnchors()
168+
caBundle, rErr := sec.CurrentTrustAnchors(ctx)
169169
if rErr != nil {
170170
return rErr
171171
}

‎cmd/placement/app/app.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ func Run() {
7474
SentryAddress: opts.SentryAddress,
7575
ControlPlaneTrustDomain: opts.TrustDomain,
7676
ControlPlaneNamespace: security.CurrentNamespace(),
77-
TrustAnchorsFile: opts.TrustAnchorsFile,
77+
TrustAnchorsFile: &opts.TrustAnchorsFile,
7878
AppID: "dapr-placement",
7979
MTLSEnabled: opts.TLSEnabled,
8080
Mode: modes.DaprMode(opts.Mode),

‎go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ require (
1111
github.com/cenkalti/backoff/v4 v4.2.1
1212
github.com/cloudevents/sdk-go/v2 v2.14.0
1313
github.com/dapr/components-contrib v1.13.0-rc.2.0.20240503231149-1f46231d875c
14-
github.com/dapr/kit v0.13.1-0.20240402103809-0c7cfce53d9e
14+
github.com/dapr/kit v0.13.1-0.20240415171926-a3f906d60908
1515
github.com/evanphx/json-patch/v5 v5.8.1
1616
github.com/go-chi/chi/v5 v5.0.11
1717
github.com/go-chi/cors v1.2.1
@@ -45,7 +45,7 @@ require (
4545
github.com/sony/gobreaker v0.5.0
4646
github.com/spf13/cast v1.6.0
4747
github.com/spf13/pflag v1.0.5
48-
github.com/spiffe/go-spiffe/v2 v2.1.6
48+
github.com/spiffe/go-spiffe/v2 v2.1.7
4949
github.com/stretchr/testify v1.9.0
5050
github.com/valyala/fasthttp v1.51.0
5151
go.mongodb.org/mongo-driver v1.12.1
@@ -66,7 +66,6 @@ require (
6666
google.golang.org/genproto/googleapis/api v0.0.0-20231120223509-83a465c0220f
6767
google.golang.org/genproto/googleapis/rpc v0.0.0-20231212172506-995d672761c0
6868
google.golang.org/grpc v1.60.1
69-
google.golang.org/grpc/examples v0.0.0-20230224211313-3775f633ce20
7069
google.golang.org/protobuf v1.33.0
7170
gopkg.in/yaml.v3 v3.0.1
7271
k8s.io/api v0.28.4
@@ -414,6 +413,7 @@ require (
414413
google.golang.org/api v0.149.0 // indirect
415414
google.golang.org/appengine v1.6.8 // indirect
416415
google.golang.org/genproto v0.0.0-20231211222908-989df2bf70f3 // indirect
416+
google.golang.org/grpc/examples v0.0.0-20230224211313-3775f633ce20 // indirect
417417
gopkg.in/alexcesaro/quotedprintable.v3 v3.0.0-20150716171945-2caba252f4dc // indirect
418418
gopkg.in/couchbase/gocb.v1 v1.6.7 // indirect
419419
gopkg.in/couchbase/gocbcore.v7 v7.1.18 // indirect

‎go.sum‎

Lines changed: 8 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -121,8 +121,8 @@ github.com/HdrHistogram/hdrhistogram-go v1.1.2/go.mod h1:yDgFjdqOqDEKOvasDdhWNXY
121121
github.com/IBM/sarama v1.42.2 h1:VoY4hVIZ+WQJ8G9KNY/SQlWguBQXQ9uvFPOnrcu8hEw=
122122
github.com/IBM/sarama v1.42.2/go.mod h1:FLPGUGwYqEs62hq2bVG6Io2+5n+pS6s/WOXVKWSLFtE=
123123
github.com/Knetic/govaluate v3.0.1-0.20171022003610-9aa49832a739+incompatible/go.mod h1:r7JcOSlj0wfOMncg0iLm8Leh48TZaKVeNIfJntJ2wa0=
124-
github.com/Microsoft/go-winio v0.6.0 h1:slsWYD/zyx7lCXoZVlvQrj0hPTM1HI4+v1sIda2yDvg=
125-
github.com/Microsoft/go-winio v0.6.0/go.mod h1:cTAf44im0RAYeL23bpB+fzCyDH2MJiz2BO69KH/soAE=
124+
github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migciow=
125+
github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM=
126126
github.com/Netflix/go-env v0.0.0-20220526054621-78278af1949d h1:wvStE9wLpws31NiWUx+38wny1msZ/tm+eL5xmm4Y7So=
127127
github.com/Netflix/go-env v0.0.0-20220526054621-78278af1949d/go.mod h1:9XMFaCeRyW7fC9XJOWQ+NdAv8VLG7ys7l3x4ozEGLUQ=
128128
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
@@ -439,8 +439,8 @@ github.com/danieljoos/wincred v1.1.2 h1:QLdCxFs1/Yl4zduvBdcHB8goaYk9RARS2SgLLRuA
439439
github.com/danieljoos/wincred v1.1.2/go.mod h1:GijpziifJoIBfYh+S7BbkdUTU4LfM+QnGqR5Vl2tAx0=
440440
github.com/dapr/components-contrib v1.13.0-rc.2.0.20240503231149-1f46231d875c h1:vzu6TjW2XYZAQY+g9fHmTzOGYNB1lPvRAun7YLV73Nk=
441441
github.com/dapr/components-contrib v1.13.0-rc.2.0.20240503231149-1f46231d875c/go.mod h1:8/+3UcZLcNytOKLXPpseDT3gB0Mo4ryoMaiud+9u60k=
442-
github.com/dapr/kit v0.13.1-0.20240402103809-0c7cfce53d9e h1:mLvqfGuppb6uhsijmwTlF5sZVtGvig+Ua5ESKF17SxA=
443-
github.com/dapr/kit v0.13.1-0.20240402103809-0c7cfce53d9e/go.mod h1:dons8V2bF6MPR2yFdxtTa86PfaE7EJtKAOkZ9hOavBQ=
442+
github.com/dapr/kit v0.13.1-0.20240415171926-a3f906d60908 h1:8Bs9nVJh00BVNJxsB5Djf0xICW53kiKi3QL/jZ5qp8s=
443+
github.com/dapr/kit v0.13.1-0.20240415171926-a3f906d60908/go.mod h1:LkPZyrSpa2xLBgYMwUhDbWZcZVt/WdL7FSPlN0PrSog=
444444
github.com/dave/jennifer v1.4.0/go.mod h1:fIb+770HOpJ2fmN9EPPKOqm1vMGhB+TwXKMZhrIygKg=
445445
github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
446446
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
@@ -579,8 +579,8 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2
579579
github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
580580
github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
581581
github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
582-
github.com/go-jose/go-jose/v3 v3.0.0 h1:s6rrhirfEP/CGIoc6p+PZAeogN2SxKav6Wp7+dyMWVo=
583-
github.com/go-jose/go-jose/v3 v3.0.0/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
582+
github.com/go-jose/go-jose/v3 v3.0.1 h1:pWmKFVtt+Jl0vBZTIpz/eAKwsm6LkIxDVVbFHKkchhA=
583+
github.com/go-jose/go-jose/v3 v3.0.1/go.mod h1:RNkWWRld676jZEYoV3+XK8L2ZnNSvIsxFMht0mSX+u8=
584584
github.com/go-kit/kit v0.8.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
585585
github.com/go-kit/kit v0.9.0/go.mod h1:xBxKIO96dXMWWy0MnWVtmwkA9/13aqxPnvrjFYMA2as=
586586
github.com/go-kit/kit v0.10.0 h1:dXFJfIHVvUcpSgDOV+Ne6t7jXri8Tfv2uOLHUZ2XNuo=
@@ -1522,8 +1522,8 @@ github.com/spf13/viper v1.7.0/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5q
15221522
github.com/spf13/viper v1.7.1/go.mod h1:8WkrPz2fc9jxqZNCJI/76HCieCp4Q8HaLFoCha5qpdg=
15231523
github.com/spf13/viper v1.15.0 h1:js3yy885G8xwJa6iOISGFwd+qlUo5AvyXb7CiihdtiU=
15241524
github.com/spf13/viper v1.15.0/go.mod h1:fFcTBJxvhhzSJiZy8n+PeW6t8l+KeT/uTARa0jHOQLA=
1525-
github.com/spiffe/go-spiffe/v2 v2.1.6 h1:4SdizuQieFyL9eNU+SPiCArH4kynzaKOOj0VvM8R7Xo=
1526-
github.com/spiffe/go-spiffe/v2 v2.1.6/go.mod h1:eVDqm9xFvyqao6C+eQensb9ZPkyNEeaUbqbBpOhBnNk=
1525+
github.com/spiffe/go-spiffe/v2 v2.1.7 h1:VUkM1yIyg/x8X7u1uXqSRVRCdMdfRIEdFBzpqoeASGk=
1526+
github.com/spiffe/go-spiffe/v2 v2.1.7/go.mod h1:QJDGdhXllxjxvd5B+2XnhhXB/+rC8gr+lNrtOryiWeE=
15271527
github.com/stealthrocket/wasi-go v0.8.1-0.20230912180546-8efbab50fb58 h1:mTC4gyv3lcJ1XpzZMAckqkvWUqeT5Bva4RAT1IoHAAA=
15281528
github.com/stealthrocket/wasi-go v0.8.1-0.20230912180546-8efbab50fb58/go.mod h1:ZAYCOqLJkc9P6fcq14TV4cf+gJ2fHthp9kCGxBViagE=
15291529
github.com/stealthrocket/wazergo v0.19.1 h1:BPrITETPgSFwiytwmToO0MbUC/+RGC39JScz1JmmG6c=

‎pkg/actors/placement/client_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -161,7 +161,7 @@ func testSecurity(t *testing.T) security.Handler {
161161
ControlPlaneTrustDomain: "test.example.com",
162162
ControlPlaneNamespace: "default",
163163
MTLSEnabled: false,
164-
OverrideCertRequestSource: func(context.Context, []byte) ([]*x509.Certificate, error) {
164+
OverrideCertRequestFn: func(context.Context, []byte) ([]*x509.Certificate, error) {
165165
return []*x509.Certificate{nil}, nil
166166
},
167167
})

‎pkg/injector/service/handler_test.go‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ package service
1515

1616
import (
1717
"bytes"
18+
"context"
1819
"encoding/json"
1920
"io"
2021
"net/http"
@@ -52,7 +53,7 @@ func TestHandleRequest(t *testing.T) {
5253

5354
require.NoError(t, err)
5455
injector := i.(*injector)
55-
injector.currentTrustAnchors = func() ([]byte, error) {
56+
injector.currentTrustAnchors = func(context.Context) ([]byte, error) {
5657
return nil, nil
5758
}
5859

‎pkg/injector/service/injector.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ var AllowedServiceAccountInfos = []string{
5656
}
5757

5858
type (
59-
currentTrustAnchorsFn func() (ca []byte, err error)
59+
currentTrustAnchorsFn func(context.Context) (ca []byte, err error)
6060
)
6161

6262
// Injector is the interface for the Dapr runtime sidecar injection component.

‎pkg/injector/service/pod_patch.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ func (i *injector) getPodPatchOperations(ctx context.Context, ar *admissionv1.Ad
5151
sentryAddress := patcher.ServiceSentry.Address(i.config.Namespace, i.config.KubeClusterDomain)
5252
operatorAddress := patcher.ServiceAPI.Address(i.config.Namespace, i.config.KubeClusterDomain)
5353

54-
trustAnchors, err := i.currentTrustAnchors()
54+
trustAnchors, err := i.currentTrustAnchors(ctx)
5555
if err != nil {
5656
return nil, err
5757
}

‎pkg/operator/api/api_test.go‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ import (
4242
"github.com/dapr/dapr/pkg/operator/api/informer"
4343
informerfake "github.com/dapr/dapr/pkg/operator/api/informer/fake"
4444
operatorv1pb "github.com/dapr/dapr/pkg/proto/operator/v1"
45-
"github.com/dapr/dapr/tests/util"
45+
"github.com/dapr/kit/crypto/test"
4646
)
4747

4848
type mockComponentUpdateServer struct {
@@ -196,7 +196,7 @@ func TestProcessComponentSecrets(t *testing.T) {
196196
func TestComponentUpdate(t *testing.T) {
197197
appID := spiffeid.RequireFromString("spiffe://example.org/ns/ns1/app1")
198198
serverID := spiffeid.RequireFromString("spiffe://example.org/ns/dapr-system/dapr-operator")
199-
pki := util.GenPKI(t, util.PKIOptions{
199+
pki := test.GenPKI(t, test.PKIOptions{
200200
LeafID: serverID,
201201
ClientID: appID,
202202
})
@@ -317,7 +317,7 @@ func TestComponentUpdate(t *testing.T) {
317317
func TestHTTPEndpointUpdate(t *testing.T) {
318318
appID := spiffeid.RequireFromString("spiffe://example.org/ns/ns1/app1")
319319
serverID := spiffeid.RequireFromString("spiffe://example.org/ns/dapr-system/dapr-operator")
320-
pki := util.GenPKI(t, util.PKIOptions{
320+
pki := test.GenPKI(t, test.PKIOptions{
321321
LeafID: serverID,
322322
ClientID: appID,
323323
})
@@ -411,7 +411,7 @@ func TestHTTPEndpointUpdate(t *testing.T) {
411411
func TestListScopes(t *testing.T) {
412412
appID := spiffeid.RequireFromString("spiffe://example.org/ns/namespace-a/app1")
413413
serverID := spiffeid.RequireFromString("spiffe://example.org/ns/dapr-system/dapr-operator")
414-
pki := util.GenPKI(t, util.PKIOptions{
414+
pki := test.GenPKI(t, test.PKIOptions{
415415
LeafID: serverID,
416416
ClientID: appID,
417417
})
@@ -482,7 +482,7 @@ func TestListScopes(t *testing.T) {
482482
func TestListsNamespaced(t *testing.T) {
483483
appID := spiffeid.RequireFromString("spiffe://example.org/ns/namespace-a/app1")
484484
serverID := spiffeid.RequireFromString("spiffe://example.org/ns/dapr-system/dapr-operator")
485-
pki := util.GenPKI(t, util.PKIOptions{
485+
pki := test.GenPKI(t, test.PKIOptions{
486486
LeafID: serverID,
487487
ClientID: appID,
488488
})

‎pkg/operator/api/authz/authz_test.go‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,13 @@ import (
2424
"google.golang.org/grpc/status"
2525

2626
"github.com/dapr/dapr/pkg/security/spiffe"
27-
"github.com/dapr/dapr/tests/util"
27+
"github.com/dapr/kit/crypto/test"
2828
)
2929

3030
func Test_Request(t *testing.T) {
3131
appID := spiffeid.RequireFromString("spiffe://example.org/ns/ns1/app1")
3232
serverID := spiffeid.RequireFromString("spiffe://example.org/ns/dapr-system/dapr-operator")
33-
pki := util.GenPKI(t, util.PKIOptions{LeafID: serverID, ClientID: appID})
33+
pki := test.GenPKI(t, test.PKIOptions{LeafID: serverID, ClientID: appID})
3434

3535
t.Run("no auth context should error", func(t *testing.T) {
3636
id, err := Request(context.Background(), "ns1")
@@ -55,7 +55,7 @@ func Test_Request(t *testing.T) {
5555

5656
t.Run("invalid SPIFFE path should error", func(t *testing.T) {
5757
appID := spiffeid.RequireFromString("spiffe://example.org/foo/bar")
58-
pki2 := util.GenPKI(t, util.PKIOptions{LeafID: serverID, ClientID: appID})
58+
pki2 := test.GenPKI(t, test.PKIOptions{LeafID: serverID, ClientID: appID})
5959
id, err := Request(pki2.ClientGRPCCtx(t), "ns1")
6060
require.Error(t, err)
6161
assert.Equal(t, codes.PermissionDenied, status.Code(err))

0 commit comments

Comments
 (0)