Skip to content

Commit ef1a0ef

Browse files
robertpatrickrobertpatrick
committed
Merge branch 'model-encryption-secret' into 'main'
Add support for model encryption passphrase in an environment variable secret See merge request weblogic-cloud/weblogic-deploy-tooling!1708
2 parents d5583ae + b4ebd4d commit ef1a0ef

File tree

4 files changed

+66
-37
lines changed

4 files changed

+66
-37
lines changed

‎core/src/main/python/wlsdeploy/util/cla_helper.py

Lines changed: 39 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
from java.io import IOException
1111
from java.lang import IllegalArgumentException
1212
from java.lang import String
13+
from java.lang import System
1314

1415
from oracle.weblogic.deploy.util import FileUtils
1516
from oracle.weblogic.deploy.util import TranslateException
@@ -25,17 +26,20 @@
2526
from wlsdeploy.util import cla_utils
2627
from wlsdeploy.util import env_helper
2728
from wlsdeploy.util import getcreds
29+
from wlsdeploy.util import model_config
2830
from wlsdeploy.util import model_helper
2931
from wlsdeploy.util import model_translator
3032
from wlsdeploy.util import path_helper
3133
from wlsdeploy.util import string_utils
34+
from wlsdeploy.util import unicode_helper as str_helper
3235

3336
from wlsdeploy.util import variables
3437
from wlsdeploy.util.cla_utils import CommandLineArgUtil
3538
from wlsdeploy.util.exit_code import ExitCode
3639
from wlsdeploy.util.model_translator import FileToPython
3740
from wlsdeploy.exception.exception_helper import create_cla_exception
3841

42+
MODEL_ENCRYPTION_SECRET_KEY = 'passphrase'
3943

4044
__logger = PlatformLogger('wlsdeploy.util')
4145
_class_name = 'cla_helper'
@@ -149,18 +153,42 @@ def process_encryption_args(optional_arg_map, is_encryption_supported):
149153
"""
150154
_method_name = '__process_encryption_args'
151155

156+
if is_encryption_supported and CommandLineArgUtil.PASSPHRASE_SWITCH not in optional_arg_map:
157+
if CommandLineArgUtil.PASSPHRASE_PROMPT_SWITCH in optional_arg_map:
158+
try:
159+
passphrase = getcreds.getpass('WLSDPLY-20002')
160+
except IOException, ioe:
161+
ex = exception_helper.create_cla_exception(ExitCode.ARG_VALIDATION_ERROR,
162+
'WLSDPLY-20003', ioe.getLocalizedMessage(), error=ioe)
163+
__logger.throwing(ex, class_name=_class_name, method_name=_method_name)
164+
raise ex
152165

153-
if is_encryption_supported and \
154-
CommandLineArgUtil.PASSPHRASE_PROMPT_SWITCH in optional_arg_map and \
155-
CommandLineArgUtil.PASSPHRASE_SWITCH not in optional_arg_map:
156-
try:
157-
passphrase = getcreds.getpass('WLSDPLY-20002')
158-
except IOException, ioe:
159-
ex = exception_helper.create_cla_exception(ExitCode.ARG_VALIDATION_ERROR,
160-
'WLSDPLY-20003', ioe.getLocalizedMessage(), error=ioe)
161-
__logger.throwing(ex, class_name=_class_name, method_name=_method_name)
162-
raise ex
163-
optional_arg_map[CommandLineArgUtil.PASSPHRASE_SWITCH] = String(passphrase)
166+
optional_arg_map[CommandLineArgUtil.PASSPHRASE_SWITCH] = String(passphrase)
167+
return
168+
169+
# the encryption passphrase may be in a secret specified by an environment variable.
170+
# the variable uses the same naming prefix as tool.properties
171+
env_variable_name = model_config.SYS_PROP_PREFIX + "model.encryption.secret"
172+
secret_name = System.getProperty(env_variable_name, None)
173+
if secret_name:
174+
# we can't use similar methods in variable module, model context is not established,
175+
# and we don't want to depend on strict/lax mode.
176+
passphrase = None
177+
locations = env_helper.getenv(str_helper.to_string(variables.SECRET_DIRS_VARIABLE))
178+
if locations is not None:
179+
for secret_dir in locations.split(","):
180+
secret_path = os.path.join(secret_dir, secret_name, MODEL_ENCRYPTION_SECRET_KEY)
181+
if os.path.isfile(secret_path):
182+
__logger.info('WLSDPLY-02300', secret_path)
183+
passphrase = cla_utils.get_from_file_value(secret_path)
184+
optional_arg_map[CommandLineArgUtil.PASSPHRASE_SWITCH] = passphrase
185+
break
186+
187+
if not passphrase:
188+
ex = exception_helper.create_cla_exception(
189+
ExitCode.ARG_VALIDATION_ERROR, 'WLSDPLY-02301', secret_name, locations)
190+
__logger.throwing(ex, class_name=_class_name, method_name=_method_name)
191+
raise ex
164192

165193

166194
def validate_model(program_name, model_dictionary, model_context, aliases, wlst_mode,

‎core/src/main/python/wlsdeploy/util/cla_utils.py

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -264,7 +264,7 @@ def process_args(self, args, tool_type=TOOL_TYPE_DEFAULT, trailing_arg_count=0):
264264
self._add_arg(self.get_admin_pass_key(), value)
265265
elif self.is_admin_pass_file_key(key):
266266
file_var, idx = self._get_arg_value(args, idx)
267-
value = self._get_from_file_value(file_var)
267+
value = get_from_file_value(file_var)
268268
self._add_arg(self.get_admin_pass_key(), value)
269269
elif self.is_archive_file_key(key):
270270
value, idx = self._get_arg_value(args, idx)
@@ -276,7 +276,7 @@ def process_args(self, args, tool_type=TOOL_TYPE_DEFAULT, trailing_arg_count=0):
276276
self._add_arg(self.get_opss_passphrase_key(), value)
277277
elif self.is_opss_passphrase_file(key):
278278
file_var, idx = self._get_arg_value(args, idx)
279-
value = self._get_from_file_value(file_var)
279+
value = get_from_file_value(file_var)
280280
self._add_arg(self.get_opss_passphrase_key(), value)
281281
elif self.is_opss_passphrase_key(key):
282282
value, idx = self._get_arg_value(args, idx)
@@ -307,7 +307,7 @@ def process_args(self, args, tool_type=TOOL_TYPE_DEFAULT, trailing_arg_count=0):
307307
self._add_arg(self.get_passphrase_switch(), value)
308308
elif self.is_passphrase_file_switch(key):
309309
file_var, idx = self._get_arg_value(args, idx)
310-
value = self._get_from_file_value(file_var)
310+
value = get_from_file_value(file_var)
311311
self._add_arg(self.get_passphrase_switch(), value)
312312
elif self.is_one_pass_switch(key):
313313
value, idx = self._get_arg_value(args, idx)
@@ -874,24 +874,6 @@ def _get_env_var_value(self, env_var):
874874
raise ex
875875
return value
876876

877-
# TODO - Improve the error handling to give the user better error messages.
878-
def _get_from_file_value(self, file_var):
879-
_method_name = '_get_from_file_value'
880-
ifile = None
881-
try:
882-
stream = JFileUtils.getFileAsStream(file_var)
883-
ifile = BufferedReader(InputStreamReader(stream))
884-
value = ifile.readLine()
885-
ifile.close()
886-
return value
887-
except IOException,ioe:
888-
if ifile:
889-
ifile.close()
890-
ex = create_cla_exception(ExitCode.ARG_VALIDATION_ERROR, 'WLSDPLY-01651', file_var,
891-
ioe.getLocalizedMessage(), error=ioe)
892-
_logger.throwing(ex, class_name=self._class_name, method_name=_method_name)
893-
raise ex
894-
895877
def get_passphrase_switch(self):
896878
return self.PASSPHRASE_SWITCH
897879

@@ -1378,3 +1360,21 @@ def validate_domain_home_arg(value):
13781360

13791361
home_dir = JFile(value)
13801362
return home_dir.getAbsolutePath()
1363+
1364+
# TODO - Improve the error handling to give the user better error messages.
1365+
def get_from_file_value(file_var):
1366+
_method_name = 'get_from_file_value'
1367+
ifile = None
1368+
try:
1369+
stream = JFileUtils.getFileAsStream(file_var)
1370+
ifile = BufferedReader(InputStreamReader(stream))
1371+
value = ifile.readLine()
1372+
ifile.close()
1373+
return value
1374+
except IOException,ioe:
1375+
if ifile:
1376+
ifile.close()
1377+
ex = create_cla_exception(ExitCode.ARG_VALIDATION_ERROR, 'WLSDPLY-01651', file_var,
1378+
ioe.getLocalizedMessage(), error=ioe)
1379+
_logger.throwing(ex, class_name=self._class_name, method_name=_method_name)
1380+
raise ex

‎core/src/main/python/wlsdeploy/util/variables.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@
4040
# if this pattern is found, token substitution was incomplete
4141
_unresolved_token_pattern = re.compile("(@@(PROP|FILE|ENV|SECRET):)")
4242

43-
_secret_dirs_variable = "WDT_MODEL_SECRETS_DIRS"
43+
SECRET_DIRS_VARIABLE = "WDT_MODEL_SECRETS_DIRS"
4444
_secret_dir_pairs_variable = "WDT_MODEL_SECRETS_NAME_DIR_PAIRS"
4545

4646
_secret_token_map = None
@@ -444,12 +444,12 @@ def _init_secret_token_map(model_context):
444444

445445
# add name/key pairs for files in sub-directories of directories in WDT_MODEL_SECRETS_DIRS.
446446

447-
locations = env_helper.getenv(str_helper.to_string(_secret_dirs_variable))
447+
locations = env_helper.getenv(str_helper.to_string(SECRET_DIRS_VARIABLE))
448448
if locations is not None:
449449
for secret_dir in locations.split(","):
450450
if not os.path.isdir(secret_dir):
451451
# log at WARN or INFO, but no exception is thrown
452-
log_method('WLSDPLY-01738', _secret_dirs_variable, secret_dir, class_name=_class_name,
452+
log_method('WLSDPLY-01738', SECRET_DIRS_VARIABLE, secret_dir, class_name=_class_name,
453453
method_name=method_name)
454454
continue
455455

‎core/src/main/resources/oracle/weblogic/deploy/messages/wlsdeploy_rb.properties

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -398,8 +398,6 @@ WLSDPLY-00915=Specified discover security provider data scope was empty or null
398398
WLSDPLY-00916=Unrecognized scopes specified in discover security provider data scope ({0}): {1}
399399
WLSDPLY-00917=Using default configuration {0} for target {1}
400400

401-
# wlsdeploy/util/cla_helper.py
402-
403401
# wlsdeploy/util/target_configuration_helper.py
404402
# wlsdeploy/util/targets/*.py
405403
WLSDPLY-01660=Unknown additional output type "{0}" specified for target environment {1}, skipping
@@ -551,6 +549,9 @@ WLSDPLY-02107=Unable to get remote parent directory for relative path {0} since
551549
# wlsdeploy/util/structured_apps_helper.py
552550
WLSDPLY-02200=Application {0} with SourcePath {1} and combined PlanPath {2} appears to be a structured application but number of common path elements {3} is too small.
553551

552+
# wlsdeploy/util/cla_helper.py
553+
WLSDPLY-02300=Using model encryption passphrase from secret file {0}
554+
WLSDPLY-02301=Model encryption passphrase secret {0} not found in any of these locations: {1}
554555

555556
###############################################################################
556557
# Encrypt Messages (04000 - 04999) #

0 commit comments

Comments
 (0)