Update: allow user to specify secret header references (#126)

* Update: allow user to specify secret header references

* Update: process one request at a time

* Update: catch errors from kube and secret key not found

* Update: use reqOpt instead of req

we already pull the options into a cloned variable, so use this instead.

* Upgrade: fixes lodash vuln

* Update: log ns if secret key not found

Author: alewitt2

lib/BaseDownloadController.js

@@ -31,6 +31,7 @@ module.exports = class BaseDownloadController extends CompositeController {
 
   async added() {
     let requests = objectPath.get(this.data, ['object', 'spec', 'requests'], []);
+
     // when failure to download optional resource occurs, should continue to download other requests, but shouldnt reconcile children
     let optionalResourceFailure = 0;
     let lastModifiedArray = objectPath.get(this.data, ['object', 'status', 'last-modified'], []);
@@ -60,6 +61,21 @@ module.exports = class BaseDownloadController extends CompositeController {
         objectPath.set(reqOpt, 'headers.If-Modified-Since', objectPath.get(imsObj, 'last-modified'));
       }
 
+      try {
+        reqOpt = await this._fetchHeaderSecrets(reqOpt);
+      } catch (e) {
+        // error fetching header secrets
+        if (optional) {
+          ++optionalResourceFailure;
+          this.log.warn(e.message);
+          this.updateRazeeLogs('warn', { controller: 'BaseDownload', warn: e.message, url: url });
+          this.log.debug(`skipping download for ${url}`);
+          continue; // shouldnt continue to try to download if unable to get secret headers
+        } else {
+          return Promise.reject(e.message);
+        }
+      }
+
       try {
         let res = await this.download(reqOpt);
         if (res.statusCode >= 200 && res.statusCode < 300) {
@@ -157,6 +173,51 @@ module.exports = class BaseDownloadController extends CompositeController {
     }
   }
 
+  async _fetchHeaderSecrets(requestOptions) {
+    requestOptions = clone(requestOptions);
+    let headers = objectPath.get(requestOptions, 'headers');
+    if (headers) {
+      for (let [hKey, hObject] of Object.entries(headers)) {
+        let secretRef = objectPath.get(hObject, 'valueFrom.secretKeyRef');
+        if (secretRef) {
+          let secretName = objectPath.get(secretRef, 'name');
+          let secretNamespace = objectPath.get(secretRef, 'namespace', this.namespace);
+          let secretKey = objectPath.get(secretRef, 'key');
+          try {
+            objectPath.set(headers, [hKey], await this._getSecretData(secretName, secretKey, secretNamespace));
+          } catch (e) {
+            throw Error(`Unable to fetch header secret data. { name: ${secretName}, namespace: ${secretNamespace }, key: ${secretKey} }: ${objectPath.get(e, 'error.message')}`);
+          }
+        }
+      }
+    }
+    return requestOptions;
+  }
+
+  async _getSecretData(name, key, ns) {
+    ns = ns || this.namespace;
+    let res = await this.kubeResourceMeta.request({ uri: `/api/v1/namespaces/${ns}/secrets/${name}`, json: true });
+    let secret = Buffer.from(objectPath.get(res, ['data', key], ''), 'base64').toString();
+    if (secret === '') {
+      throw {
+        name: 'StatusCodeError',
+        statusCode: 404,
+        message: `404 - key "${key}" not found in secret "${name}", in namespace "${ns}"`,
+        error: {
+          kind: 'Status',
+          apiVersion: 'v1',
+          metadata: {},
+          status: 'Failure',
+          message: `key "${key}" not found in secret "${name}", in namespace "${ns}"`,
+          reason: 'NotFound',
+          details: { 'name': name, 'namespace': ns, 'kind': 'secrets', 'key': key },
+          code: 404
+        }
+      };
+    }
+    return secret;
+  }
+
   async _saveChild(child) {
     let res = await this.applyChild(child);
     if (!res.statusCode || res.statusCode < 200 || res.statusCode >= 300) {