Skip to content

Commit 06dfe47

Browse files
openshift-ci[bot]openshift-ci[bot]
authored
Merge pull request #924 from flavianmissi/OCPBUGS-2889
OCPBUGS-2889: accept user/pass OR application credentials on Swift UPI secret
2 parents 067c23f + ff56012 commit 06dfe47

File tree

2 files changed

+119
-33
lines changed

2 files changed

+119
-33
lines changed

‎pkg/storage/swift/swift.go

Lines changed: 12 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -152,25 +152,18 @@ func GetConfig(listers *regopclient.StorageListers) (*Swift, error) {
152152
} else if err != nil {
153153
return nil, err
154154
} else {
155-
cfg.Username, err = util.GetValueFromSecret(sec, "REGISTRY_STORAGE_SWIFT_USERNAME")
156-
if err != nil {
157-
return nil, err
158-
}
159-
cfg.Password, err = util.GetValueFromSecret(sec, "REGISTRY_STORAGE_SWIFT_PASSWORD")
160-
if err != nil {
161-
return nil, err
162-
}
163-
cfg.ApplicationCredentialID, err = util.GetValueFromSecret(sec, "REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALID")
164-
if err != nil {
165-
return nil, err
166-
}
167-
cfg.ApplicationCredentialName, err = util.GetValueFromSecret(sec, "REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALNAME")
168-
if err != nil {
169-
return nil, err
170-
}
171-
cfg.ApplicationCredentialSecret, err = util.GetValueFromSecret(sec, "REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALSECRET")
172-
if err != nil {
173-
return nil, err
155+
cfg.Username, _ = util.GetValueFromSecret(sec, "REGISTRY_STORAGE_SWIFT_USERNAME")
156+
cfg.Password, _ = util.GetValueFromSecret(sec, "REGISTRY_STORAGE_SWIFT_PASSWORD")
157+
cfg.ApplicationCredentialID, _ = util.GetValueFromSecret(sec, "REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALID")
158+
cfg.ApplicationCredentialName, _ = util.GetValueFromSecret(sec, "REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALNAME")
159+
cfg.ApplicationCredentialSecret, _ = util.GetValueFromSecret(sec, "REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALSECRET")
160+
userPassValid := len(cfg.Username) > 0 && len(cfg.Password) > 0
161+
appCredsValid := len(cfg.ApplicationCredentialID) > 0 && len(cfg.ApplicationCredentialName) > 0 && len(cfg.ApplicationCredentialSecret) > 0
162+
if !userPassValid && !appCredsValid {
163+
return nil, fmt.Errorf(
164+
"secret %q does not contain required keys 'REGISTRY_STORAGE_SWIFT_USERNAME' and 'REGISTRY_STORAGE_SWIFT_PASSWORD'; or 'REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALID', 'REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALNAME' and 'REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALSECRET'",
165+
fmt.Sprintf("%s/%s", sec.Namespace, sec.Name),
166+
)
174167
}
175168
}
176169

‎pkg/storage/swift/swift_test.go

Lines changed: 107 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -48,9 +48,11 @@ const (
4848

4949
var (
5050
// Fake Swift credentials map
51-
fakeSecretData = map[string][]byte{
52-
"REGISTRY_STORAGE_SWIFT_USERNAME": []byte(username),
53-
"REGISTRY_STORAGE_SWIFT_PASSWORD": []byte(password),
51+
fakeUserPassSecretData = map[string][]byte{
52+
"REGISTRY_STORAGE_SWIFT_USERNAME": []byte(username),
53+
"REGISTRY_STORAGE_SWIFT_PASSWORD": []byte(password),
54+
}
55+
fakeAppCredsSecretData = map[string][]byte{
5456
"REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALID": []byte(applicationCredentialID),
5557
"REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALNAME": []byte(applicationCredentialName),
5658
"REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALSECRET": []byte(applicationCredentialSecret),
@@ -63,12 +65,41 @@ type MockSecretNamespaceLister interface {
6365
Get(string) (*corev1.Secret, error)
6466
List(selector labels.Selector) ([]*corev1.Secret, error)
6567
}
68+
69+
type MockUPIAppCredsSecretNamespaceLister struct{}
70+
71+
func (m MockUPIAppCredsSecretNamespaceLister) Get(name string) (*corev1.Secret, error) {
72+
if name == upiSecretName {
73+
return &corev1.Secret{
74+
Data: fakeAppCredsSecretData,
75+
}, nil
76+
}
77+
78+
return nil, &k8serrors.StatusError{
79+
ErrStatus: metav1.Status{
80+
Status: metav1.StatusFailure,
81+
Code: http.StatusNotFound,
82+
Reason: metav1.StatusReasonNotFound,
83+
Details: &metav1.StatusDetails{},
84+
Message: fmt.Sprintf("No secret with name %v was found", name),
85+
},
86+
}
87+
}
88+
89+
func (m MockUPIAppCredsSecretNamespaceLister) List(selector labels.Selector) ([]*corev1.Secret, error) {
90+
return []*corev1.Secret{
91+
{
92+
Data: fakeAppCredsSecretData,
93+
},
94+
}, nil
95+
}
96+
6697
type MockUPISecretNamespaceLister struct{}
6798

6899
func (m MockUPISecretNamespaceLister) Get(name string) (*corev1.Secret, error) {
69100
if name == upiSecretName {
70101
return &corev1.Secret{
71-
Data: fakeSecretData,
102+
Data: fakeUserPassSecretData,
72103
}, nil
73104
}
74105

@@ -86,7 +117,7 @@ func (m MockUPISecretNamespaceLister) Get(name string) (*corev1.Secret, error) {
86117
func (m MockUPISecretNamespaceLister) List(selector labels.Selector) ([]*corev1.Secret, error) {
87118
return []*corev1.Secret{
88119
{
89-
Data: fakeSecretData,
120+
Data: fakeUserPassSecretData,
90121
},
91122
}, nil
92123
}
@@ -542,7 +573,7 @@ func TestSwiftStorageExistsNativeSecret(t *testing.T) {
542573
th.AssertEquals(t, true, res)
543574
}
544575

545-
func TestSwiftSecrets(t *testing.T) {
576+
func TestSwiftSecretsAppCreds(t *testing.T) {
546577
config := imageregistryv1.ImageRegistryConfigStorageSwift{
547578
AuthURL: "http://localhost:5000/v3",
548579
Container: container,
@@ -551,7 +582,7 @@ func TestSwiftSecrets(t *testing.T) {
551582
}
552583
d := driver{
553584
Listers: &regopclient.StorageListers{
554-
Secrets: MockUPISecretNamespaceLister{},
585+
Secrets: MockUPIAppCredsSecretNamespaceLister{},
555586
Infrastructures: fakeInfrastructureLister(cloudName),
556587
OpenShiftConfig: MockConfigMapNamespaceLister{},
557588
},
@@ -562,8 +593,8 @@ func TestSwiftSecrets(t *testing.T) {
562593
res, err := configenv.SecretData()
563594
th.AssertNoErr(t, err)
564595
th.AssertEquals(t, 5, len(res))
565-
th.AssertEquals(t, username, res["REGISTRY_STORAGE_SWIFT_USERNAME"])
566-
th.AssertEquals(t, password, res["REGISTRY_STORAGE_SWIFT_PASSWORD"])
596+
th.AssertEquals(t, `""`, res["REGISTRY_STORAGE_SWIFT_USERNAME"])
597+
th.AssertEquals(t, `""`, res["REGISTRY_STORAGE_SWIFT_PASSWORD"])
567598
th.AssertEquals(t, applicationCredentialID, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALID"])
568599
th.AssertEquals(t, applicationCredentialName, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALNAME"])
569600
th.AssertEquals(t, applicationCredentialSecret, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALSECRET"])
@@ -586,13 +617,11 @@ func TestSwiftSecrets(t *testing.T) {
586617
auth:
587618
auth_url: "http://localhost:5000/v3"
588619
project_name: ` + tenant + `
589-
username: ` + username + `
590-
password: ` + password + `
591620
application_credential_id: ` + applicationCredentialID + `
592621
application_credential_name: ` + applicationCredentialName + `
593622
application_credential_secret: ` + applicationCredentialSecret + `
594623
domain_name: ` + domain + `
595-
region_name: RegionOne`)
624+
region_name: RegionOne`)
596625

597626
fakeCloudsYAML = map[string][]byte{
598627
cloudSecretKey: fakeCloudsYAMLData,
@@ -602,13 +631,77 @@ func TestSwiftSecrets(t *testing.T) {
602631
res, err = configenv.SecretData()
603632
th.AssertNoErr(t, err)
604633
th.AssertEquals(t, 5, len(res))
605-
th.AssertEquals(t, username, res["REGISTRY_STORAGE_SWIFT_USERNAME"])
606-
th.AssertEquals(t, password, res["REGISTRY_STORAGE_SWIFT_PASSWORD"])
634+
th.AssertEquals(t, `""`, res["REGISTRY_STORAGE_SWIFT_USERNAME"])
635+
th.AssertEquals(t, `""`, res["REGISTRY_STORAGE_SWIFT_PASSWORD"])
607636
th.AssertEquals(t, applicationCredentialID, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALID"])
608637
th.AssertEquals(t, applicationCredentialName, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALNAME"])
609638
th.AssertEquals(t, applicationCredentialSecret, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALSECRET"])
610639
}
611640

641+
func TestSwiftSecretsUserPass(t *testing.T) {
642+
config := imageregistryv1.ImageRegistryConfigStorageSwift{
643+
AuthURL: "http://localhost:5000/v3",
644+
Container: container,
645+
Domain: domain,
646+
Tenant: tenant,
647+
}
648+
d := driver{
649+
Listers: &regopclient.StorageListers{
650+
Secrets: MockUPISecretNamespaceLister{},
651+
Infrastructures: fakeInfrastructureLister(cloudName),
652+
OpenShiftConfig: MockConfigMapNamespaceLister{},
653+
},
654+
Config: &config,
655+
}
656+
configenv, err := d.ConfigEnv()
657+
th.AssertNoErr(t, err)
658+
res, err := configenv.SecretData()
659+
th.AssertNoErr(t, err)
660+
th.AssertEquals(t, 5, len(res))
661+
th.AssertEquals(t, username, res["REGISTRY_STORAGE_SWIFT_USERNAME"])
662+
th.AssertEquals(t, password, res["REGISTRY_STORAGE_SWIFT_PASSWORD"])
663+
th.AssertEquals(t, `""`, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALID"])
664+
th.AssertEquals(t, `""`, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALNAME"])
665+
th.AssertEquals(t, `""`, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALSECRET"])
666+
667+
config = imageregistryv1.ImageRegistryConfigStorageSwift{
668+
Container: container,
669+
}
670+
// Support any cloud name provided by platform status
671+
customCloud := "myCloud"
672+
d = driver{
673+
Listers: &regopclient.StorageListers{
674+
Secrets: MockIPISecretNamespaceLister{},
675+
Infrastructures: fakeInfrastructureLister(customCloud),
676+
OpenShiftConfig: MockConfigMapNamespaceLister{},
677+
},
678+
Config: &config,
679+
}
680+
fakeCloudsYAMLData := []byte(`clouds:
681+
` + customCloud + `:
682+
auth:
683+
auth_url: "http://localhost:5000/v3"
684+
project_name: ` + tenant + `
685+
username: ` + username + `
686+
password: ` + password + `
687+
domain_name: ` + domain + `
688+
region_name: RegionOne`)
689+
690+
fakeCloudsYAML = map[string][]byte{
691+
cloudSecretKey: fakeCloudsYAMLData,
692+
}
693+
configenv, err = d.ConfigEnv()
694+
th.AssertNoErr(t, err)
695+
res, err = configenv.SecretData()
696+
th.AssertNoErr(t, err)
697+
th.AssertEquals(t, 5, len(res))
698+
th.AssertEquals(t, username, res["REGISTRY_STORAGE_SWIFT_USERNAME"])
699+
th.AssertEquals(t, password, res["REGISTRY_STORAGE_SWIFT_PASSWORD"])
700+
th.AssertEquals(t, `""`, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALID"])
701+
th.AssertEquals(t, `""`, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALNAME"])
702+
th.AssertEquals(t, `""`, res["REGISTRY_STORAGE_SWIFT_APPLICATIONCREDENTIALSECRET"])
703+
}
704+
612705
func TestSwiftCreateStorageCloudConfig(t *testing.T) {
613706
th.SetupHTTP()
614707
defer th.TeardownHTTP()

0 commit comments

Comments
 (0)