Skip to content

Commit 27f8998

Browse files
SoulKyuSoulKyu
authored
feat(state): enhance information that are stored on the state for debugging purpose including sa, podname and nodename (#20)
1 parent 3334cc5 commit 27f8998

File tree

5 files changed

+66
-23
lines changed

5 files changed

+66
-23
lines changed

‎pkg/k8s/pod_utils.go

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,11 @@ func NewPodService(clientset KubernetesClient, cfg *config.Config) PodService {
3636
}
3737

3838
type PodInformations struct {
39-
PodNameUUIDs []string
40-
Namespace string
39+
PodNameUUIDs []string
40+
Namespace string
41+
ServiceAccountName string
42+
PodName string
43+
NodeName string
4144
}
4245

4346
func (p *podServiceImpl) GetAllPodAndNamespace(ctx context.Context) ([]PodInformations, error) {
@@ -61,8 +64,11 @@ func (p *podServiceImpl) GetAllPodAndNamespace(ctx context.Context) ([]PodInform
6164
for _, pod := range pods.Items {
6265
if uuid, exists := pod.GetAnnotations()[ANNOTATION_VAULT_POD_UUID]; exists {
6366
podInfos = append(podInfos, PodInformations{
64-
PodNameUUIDs: strings.Split(uuid, ","),
65-
Namespace: pod.Namespace,
67+
PodNameUUIDs: strings.Split(uuid, ","),
68+
Namespace: pod.Namespace,
69+
PodName: pod.Name,
70+
NodeName: pod.Spec.NodeName,
71+
ServiceAccountName: pod.Spec.ServiceAccountName,
6672
})
6773
}
6874
}

‎pkg/k8smutator/k8smutator.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -107,7 +107,7 @@ func handlePodConfiguration(ctx context.Context, cfg *config.Config, dbConfs *[]
107107
podUuid := generateUUID(logger)
108108
podUuids = append(podUuids, podUuid)
109109
// Request temporary database credentials from vault using configured role
110-
creds, err := vaultConn.GetDbCredentials(ctx, cfg.TokenTTL, podUuid, pod.Namespace, cfg.VaultSecretName, cfg.VaultSecretPrefix)
110+
creds, err := vaultConn.GetDbCredentials(ctx, cfg.TokenTTL, podUuid, pod.Namespace, cfg.VaultSecretName, cfg.VaultSecretPrefix, pod.Spec.ServiceAccountName)
111111
if err != nil {
112112
vaultConn.RevokeSelfToken(ctx, vaultConn.K8sSaVaultToken, "", "")
113113
return nil, dbConf.Role, nil, errors.Newf("cannot get database credentials from role %s: %s", dbConf.Role, err.Error())

‎pkg/vault/handle_token.go

Lines changed: 46 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,26 +14,43 @@ import (
1414
)
1515

1616
type KeyInformation struct {
17-
PodNameUID string
18-
LeaseId string
19-
TokenId string
20-
Namespace string
17+
PodNameUID string
18+
LeaseId string
19+
TokenId string
20+
Namespace string
21+
PodName string
22+
NodeName string
23+
ServiceAccount string
2124
}
2225

23-
func NewKeyInformation(podName, leaseId, tokenId, namespace string) *KeyInformation {
26+
func NewKeyInformation(podUuid, leaseId, tokenId, namespace, serviceAccount string, podName ...string) *KeyInformation {
27+
var pn string
28+
var nn string
29+
if len(podName) > 0 {
30+
pn = podName[0]
31+
}
32+
if len(podName) > 1 {
33+
nn = podName[1]
34+
}
2435
return &KeyInformation{
25-
PodNameUID: podName,
26-
LeaseId: leaseId,
27-
TokenId: tokenId,
28-
Namespace: namespace,
36+
PodNameUID: podUuid,
37+
LeaseId: leaseId,
38+
TokenId: tokenId,
39+
Namespace: namespace,
40+
PodName: pn,
41+
NodeName: nn,
42+
ServiceAccount: serviceAccount,
2943
}
3044
}
3145

3246
func (c *Connector) StoreData(ctx context.Context, vaultInformation *KeyInformation, secretName, uuid, namespace, prefix string) (string, error) {
3347
data := map[string]interface{}{
34-
"LeaseId": vaultInformation.LeaseId,
35-
"TokenId": vaultInformation.TokenId,
36-
"Namespace": vaultInformation.Namespace,
48+
"LeaseId": vaultInformation.LeaseId,
49+
"TokenId": vaultInformation.TokenId,
50+
"Namespace": vaultInformation.Namespace,
51+
"ServiceAccountName": vaultInformation.ServiceAccount,
52+
"PodName": vaultInformation.PodName,
53+
"NodeName": vaultInformation.NodeName,
3754
}
3855

3956
kv := c.client.KVv2(secretName)
@@ -72,6 +89,9 @@ func (c *Connector) DeleteData(ctx context.Context, podName, secretName, uuid, n
7289
}
7390

7491
func safeString(v interface{}) string {
92+
if v == nil {
93+
return ""
94+
}
7595
s, _ := v.(string)
7696
return s
7797
}
@@ -98,6 +118,9 @@ func (c *Connector) GetKeyInformations(ctx context.Context, podName, uuid, path,
98118
safeString(dataMap["LeaseId"]),
99119
safeString(dataMap["TokenId"]),
100120
safeString(dataMap["Namespace"]),
121+
safeString(dataMap["ServiceAccountName"]),
122+
safeString(dataMap["PodName"]),
123+
safeString(dataMap["NodeName"]),
101124
)
102125

103126
return keyInfo, nil
@@ -163,6 +186,9 @@ func (c *Connector) ListKeyInformations(ctx context.Context, path, prefix string
163186
safeString(dataMap["LeaseId"]),
164187
safeString(dataMap["TokenId"]),
165188
safeString(dataMap["Namespace"]),
189+
safeString(dataMap["ServiceAccountName"]),
190+
safeString(dataMap["PodName"]),
191+
safeString(dataMap["NodeName"]),
166192
)
167193
keyInformationsChan <- keyInfo
168194
}(k)
@@ -250,6 +276,14 @@ func (c *Connector) HandleTokens(ctx context.Context, cfg *config.Config, keysIn
250276
isOk = false
251277
return
252278
}
279+
if ki.ServiceAccount == "" || ki.NodeName == "" || ki.PodName == "" {
280+
fullyKiInformations := NewKeyInformation(ki.PodNameUID, ki.LeaseId, ki.TokenId, ki.Namespace, podInfoMap[ki.PodNameUID].ServiceAccountName, podInfoMap[ki.PodNameUID].PodName, podInfoMap[ki.PodNameUID].NodeName)
281+
c.Log.Debugf("Renewing information for UUID %s", ki.PodNameUID)
282+
status, err := c.StoreData(ctx, fullyKiInformations, secretName, ki.PodNameUID, ki.Namespace, prefix)
283+
if err != nil {
284+
c.Log.Infof("%s : Extended vault information could not been saved, process will continue : %v", status, err)
285+
}
286+
}
253287
} else {
254288
leaseTooYoung, err := c.isLeaseTooYoung(ctx, ki.LeaseId)
255289
if err != nil {

‎pkg/vault/handle_token_test.go

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,9 @@ func TestNewKeyInformation(t *testing.T) {
4848
leaseId := "lease-id"
4949
tokenId := "token-id"
5050
namespace := "test-namespace"
51+
serviceaccount := "sa"
5152

52-
keyInfo := NewKeyInformation(podName, leaseId, tokenId, namespace)
53+
keyInfo := NewKeyInformation(podName, leaseId, tokenId, namespace, serviceaccount)
5354
assert.Equal(t, podName, keyInfo.PodNameUID)
5455
assert.Equal(t, leaseId, keyInfo.LeaseId)
5556
assert.Equal(t, tokenId, keyInfo.TokenId)
@@ -125,6 +126,7 @@ func TestStoreData(t *testing.T) {
125126
assert.Equal(t, tt.vaultInfo.LeaseId, data["LeaseId"])
126127
assert.Equal(t, tt.vaultInfo.TokenId, data["TokenId"])
127128
assert.Equal(t, tt.vaultInfo.Namespace, data["Namespace"])
129+
assert.Equal(t, tt.vaultInfo.ServiceAccount, data["ServiceAccountName"])
128130
}
129131
})
130132
}
@@ -179,9 +181,10 @@ func TestDeleteData(t *testing.T) {
179181
// Setup data to delete
180182
data := map[string]interface{}{
181183
"data": map[string]interface{}{
182-
"LeaseId": "lease-id",
183-
"TokenId": "token-id",
184-
"Namespace": "namespace",
184+
"LeaseId": "lease-id",
185+
"TokenId": "token-id",
186+
"Namespace": "namespace",
187+
"ServiceAccountName": "sa",
185188
},
186189
}
187190
_, err := client.Logical().Write("vault-db-injector/data/"+tt.prefix+"/"+tt.podName, data)

‎pkg/vault/vault.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -168,7 +168,7 @@ func (c *Connector) CanIGetRoles(serviceAccountName, namespace, vaultAuthPath, d
168168
return true, nil
169169
}
170170

171-
func (c *Connector) GetDbCredentials(ctx context.Context, ttl, PodNameUID, namespace, secretName, prefix string) (*DbCreds, error) {
171+
func (c *Connector) GetDbCredentials(ctx context.Context, ttl, PodNameUID, namespace, secretName, prefix, serviceAccount string) (*DbCreds, error) {
172172
// Create orphan token before retrieving BDD IDs
173173
var policies []string
174174
policies = append(policies, c.dbRole)
@@ -198,7 +198,7 @@ func (c *Connector) GetDbCredentials(ctx context.Context, ttl, PodNameUID, names
198198
creds.DbLeaseId = secret.LeaseID
199199
creds.DbTokenId = c.vaultToken
200200

201-
vaultInformation := NewKeyInformation(PodNameUID, creds.DbLeaseId, creds.DbTokenId, namespace)
201+
vaultInformation := NewKeyInformation(PodNameUID, creds.DbLeaseId, creds.DbTokenId, namespace, serviceAccount, "", "")
202202

203203
c.SetToken(c.K8sSaVaultToken)
204204

0 commit comments

Comments
 (0)