From 6f8b8a217d4a933dd13321d2fafbcec4839ce98a Mon Sep 17 00:00:00 2001 From: Bence Csati Date: Wed, 14 Aug 2024 14:07:11 +0200 Subject: [PATCH] chore: code review Signed-off-by: Bence Csati --- pkg/provider/aws/common.go | 94 +++++++++++++++++---------------- pkg/provider/aws/secret.go | 2 +- pkg/provider/bao/configmap.go | 2 +- pkg/provider/vault/configmap.go | 11 ++-- 4 files changed, 57 insertions(+), 52 deletions(-) diff --git a/pkg/provider/aws/common.go b/pkg/provider/aws/common.go index 653fd08..6bf5b89 100644 --- a/pkg/provider/aws/common.go +++ b/pkg/provider/aws/common.go @@ -39,31 +39,31 @@ func getDataFromStore(ctx context.Context, storeClient client, storeType string, func getDataFromSM(ctx context.Context, storeClient client, data map[string]string) (map[string]string, error) { var secretsMap = make(map[string]string, len(data)) for key, value := range data { - if strings.Contains(value, "secretsmanager:") { - secret, err := storeClient.smClient.GetSecretValueWithContext( - ctx, - &secretsmanager.GetSecretValueInput{ - SecretId: aws.String(value), - }) - if err != nil { - return nil, fmt.Errorf("failed to get secret from AWS secrets manager: %w", err) - } - - secretBytes, err := extractSecretValueFromSM(secret) - if err != nil { - return nil, fmt.Errorf("failed to extract secret value from AWS secrets manager: %w", err) - } - - secretValue, err := parseSecretValueFromSM(secretBytes) - if err != nil { - return nil, fmt.Errorf("failed to parse secret value from AWS secrets manager: %w", err) - } - - secretsMap[key] = string(secretValue) + if !strings.Contains(value, "secretsmanager:") { + secretsMap[key] = value continue } - secretsMap[key] = value + secret, err := storeClient.smClient.GetSecretValueWithContext( + ctx, + &secretsmanager.GetSecretValueInput{ + SecretId: aws.String(value), + }) + if err != nil { + return nil, fmt.Errorf("failed to get secret from AWS secrets manager: %w", err) + } + + secretBytes, err := extractSecretValueFromSM(secret) + if err != nil { + return nil, fmt.Errorf("failed to extract secret value from AWS secrets manager: %w", err) + } + + secretValue, err := parseSecretValueFromSM(secretBytes) + if err != nil { + return nil, fmt.Errorf("failed to parse secret value from AWS secrets manager: %w", err) + } + + secretsMap[key] = string(secretValue) } return secretsMap, nil @@ -126,39 +126,43 @@ func parseSecretValueFromSM(secretBytes []byte) ([]byte, error) { func getDataFromSSM(ctx context.Context, storeClient client, data map[string]string) (map[string]string, error) { var secretsMap = make(map[string]string, len(data)) for key, value := range data { - if strings.Contains(value, "ssm:") { - parameteredSecret, err := storeClient.ssmClient.GetParameterWithContext( - ctx, - &ssm.GetParameterInput{ - Name: aws.String(value), - WithDecryption: aws.Bool(true), - }) - if err != nil { - return nil, fmt.Errorf("failed to get secret from AWS SSM: %w", err) - } - - secretsMap[key] = aws.StringValue(parameteredSecret.Parameter.Value) + if !strings.Contains(value, "ssm:") { + secretsMap[key] = value continue } - secretsMap[key] = value + parameteredSecret, err := storeClient.ssmClient.GetParameterWithContext( + ctx, + &ssm.GetParameterInput{ + Name: aws.String(value), + WithDecryption: aws.Bool(true), + }) + if err != nil { + return nil, fmt.Errorf("failed to get secret from AWS SSM: %w", err) + } + + secretsMap[key] = aws.StringValue(parameteredSecret.Parameter.Value) } return secretsMap, nil } func checkOtherStoreForSecrets(ctx context.Context, storeClient client, data map[string]string) (map[string]string, error) { - // we might ARN's that are from the other store type + // we might have ARN's that are from the other store type for k, v := range data { - if valid, storeType := isValidPrefixWithStoreType(v); valid { - secretFromOtherStore, err := getDataFromStore(ctx, storeClient, storeType, map[string]string{k: v}) - if err != nil { - return nil, fmt.Errorf("getting data from store failed: %w", err) - } - - for key, value := range secretFromOtherStore { - data[key] = value - } + valid, storeType := isValidPrefixWithStoreType(v) + if !valid { + continue + } + + secretFromOtherStore, err := getDataFromStore(ctx, storeClient, storeType, map[string]string{k: v}) + if err != nil { + return nil, fmt.Errorf("getting data from store failed: %w", err) } + + for key, value := range secretFromOtherStore { + data[key] = value + } + } return data, nil diff --git a/pkg/provider/aws/secret.go b/pkg/provider/aws/secret.go index cd7796e..a3502cb 100644 --- a/pkg/provider/aws/secret.go +++ b/pkg/provider/aws/secret.go @@ -159,7 +159,7 @@ func secretNeedsMutation(secret *corev1.Secret) (bool, string, error) { return false, "", fmt.Errorf("invalid auth type") } - // check if any of the sub-keys have a vault prefix + // check if any of the sub-keys have a valid prefix for _, v := range authMap { if valid, storeType := isValidPrefixWithStoreType(v.(string)); valid { return true, storeType, nil diff --git a/pkg/provider/bao/configmap.go b/pkg/provider/bao/configmap.go index d939ba2..d851315 100644 --- a/pkg/provider/bao/configmap.go +++ b/pkg/provider/bao/configmap.go @@ -41,7 +41,7 @@ func (m *mutator) MutateConfigMap(ctx context.Context, mutateRequest provider.Co TransitKeyID: m.config.TransitKeyID, TransitPath: m.config.TransitPath, TransitBatchSize: m.config.TransitBatchSize, - }, m.client, nil, m.logger) + }, m.client, nil /* baoinjector.SecretRenewer */, m.logger) mutateRequest.ConfigMap.Data, err = injector.GetDataFromBao(mutateRequest.ConfigMap.Data) if err != nil { diff --git a/pkg/provider/vault/configmap.go b/pkg/provider/vault/configmap.go index 289fc25..4ad6373 100644 --- a/pkg/provider/vault/configmap.go +++ b/pkg/provider/vault/configmap.go @@ -36,11 +36,12 @@ func (m *mutator) MutateConfigMap(ctx context.Context, mutateRequest provider.Co } defer m.client.Close() - injector := vaultinjector.NewSecretInjector(vaultinjector.Config{ - TransitKeyID: m.config.TransitKeyID, - TransitPath: m.config.TransitPath, - TransitBatchSize: m.config.TransitBatchSize, - }, m.client, nil, m.logger) + injector := vaultinjector.NewSecretInjector( + vaultinjector.Config{ + TransitKeyID: m.config.TransitKeyID, + TransitPath: m.config.TransitPath, + TransitBatchSize: m.config.TransitBatchSize, + }, m.client, nil /* vaultinjector.SecretRenewer */, m.logger) mutateRequest.ConfigMap.Data, err = injector.GetDataFromVault(mutateRequest.ConfigMap.Data) if err != nil {