[WIP] Generate secret key and JWT token for API auth #23052

sudhir-kelkar · 2024-05-30T12:47:29Z

Generating Secret Key and Token During Worker Deployment

To generate a secret key, I am using the encryption key from the secret app-secrets.
If this secret is not mounted on the path /run/secrets/manageiq/application/encryption_key, then I am using a static value 'opentofu-runner' as the secret key.
Using this secret, I am generating the token with the jwt.encode API.

The same secret and token are mounted as environment variables to the worker pod.

bdunne · 2024-05-30T18:18:10Z

lib/container_orchestrator/object_definition.rb

@@ -176,9 +178,24 @@ def default_environment
        {:name => "WORKER_HEARTBEAT_FILE",   :value => Rails.root.join("tmp/worker.hb").to_s},
        {:name => "WORKER_HEARTBEAT_METHOD", :value => "file"},
        {:name => "TERRAFORM_RUNNER_URL",    :value => "https://opentofu-runner:6000"},
+        {:name => "SECRET_KEY", :value => opentofu_runner_secret_key},


Should this ENV var be prefixed with TERRAFORM_RUNNER_ like the others?

Agree, plus this should probably be a secret instead of an ENV var

Do we need SECRET_KEY defined on every container or just the opentofu-runner?

Agreed, I think this should only be added to the opentofu-runner. Yes, I think it needs to be a volume mount otherwise it may be flagged by security scans.

bdunne · 2024-05-30T18:20:24Z

lib/container_orchestrator/object_definition.rb

      ] + database_environment + memcached_environment + messaging_environment
    end

+    SECRET_KEY_FILE = "/run/secrets/manageiq/application/encryption_key".freeze
+    def opentofu_runner_secret_key
+      @opentofu_runner_secret_key ||= File.exist?(file_path) ? File.read(SECRET_KEY_FILE) : "opentofu_runner_key"


Where does file_path come from? Should it be SECRET_KEY_FILE instead?

bdunne · 2024-05-30T18:56:35Z

lib/container_orchestrator/object_definition.rb

@@ -1,3 +1,5 @@
+require 'jwt'


Please move this require inside of the def opentofu_runner_token method since that is the only caller. Only the orchestrator should call that method, so other workers will not load it.

agrare · 2024-05-30T18:57:47Z

@sudhir-kelkar in order for the tests to pass you have to install libsodium-dev in bin/before_install

bdunne · 2024-05-30T20:02:00Z

lib/container_orchestrator/object_definition.rb

@@ -176,9 +178,24 @@ def default_environment
        {:name => "WORKER_HEARTBEAT_FILE",   :value => Rails.root.join("tmp/worker.hb").to_s},
        {:name => "WORKER_HEARTBEAT_METHOD", :value => "file"},
        {:name => "TERRAFORM_RUNNER_URL",    :value => "https://opentofu-runner:6000"},
+        {:name => "SECRET_KEY", :value => opentofu_runner_secret_key},
+        {:name => "TERRAFORM_RUNNER_TOKEN", :value => opentofu_runner_token},


This should also probably be volume mount to avoid the same security scan issue.

We could probably avoid an ENV var or volume entierly if the token can be generated from the v2_key since all workers have access to that.

True, but then every worker needs to load jwt. Unless the require is moved inside the connection logic.

bdunne · 2024-05-30T20:21:14Z

Gemfile

@@ -44,6 +44,7 @@ gem "gettext_i18n_rails_js",            "~>1.3.0"
 gem "hamlit",                           "~>2.11.0"
 gem "inifile",                          "~>3.0",             :require => false
 gem "inventory_refresh",                "~>2.1",             :require => false
+gem "jwt"


This should be :require => false

miq-bot · 2024-05-31T07:40:38Z

Checked commits sudhir-kelkar/manageiq@595d0ec~...546d95c with ruby 2.7.8, rubocop 1.56.3, haml-lint 0.51.0, and yamllint
3 files checked, 6 offenses detected

lib/container_orchestrator/object_definition.rb

❗ - Line 203, Col 7 - Naming/VariableName - Use snake_case for variable names.
❗ - Line 206, Col 20 - Naming/VariableName - Use snake_case for variable names.
❗ - Line 207, Col 10 - Layout/TrailingWhitespace - Trailing whitespace detected.
❗ - Line 208, Col 30 - Layout/SpaceAroundOperators - Operator ||= should be surrounded by a single space.
❗ - Line 208, Col 33 - Layout/ExtraSpacing - Unnecessary spacing detected.
❗ - Line 74, Col 19 - Layout/HashAlignment - Align the keys and values of a hash literal if they span more than one line.

agrare · 2024-05-31T17:14:54Z

lib/container_orchestrator/object_definition.rb

+        file.sync = true
+        file.write(jwtToken)
+      end  
+      @opentofu_runner_token ||=  TERRAFORM_RUNNER_TOKEN_FILE


Do we need an instance var for a frozen constant? Or did you intend to set this to the value in jwtToken ?

sudhir-kelkar · 2024-05-31T17:35:21Z

I am covering this scenario in PR
ManageIQ/manageiq-pods#1115
#23054

Instead of generating JWT token here in deployment.
I am using encryption key as a secret key, and generating token and placing it in same secret app-secrets.
Then ,mounting that token on the volume mount.

Closing this PR as we don't need it anymore

Generate secret key and JWT token for API auth

595d0ec

sudhir-kelkar requested a review from Fryguy as a code owner May 30, 2024 12:47

miq-bot added the dependencies label May 30, 2024

sudhir-kelkar added 3 commits May 30, 2024 19:37

rectify lint issues

08fe85c

lint updates

c2ffd0d

lint updates

a1db4bf

sudhir-kelkar changed the title ~~WIP: Generate secret key and JWT token for API auth~~ [WIP]: Generate secret key and JWT token for API auth May 30, 2024

miq-bot added the wip label May 30, 2024

agrare changed the title ~~[WIP]: Generate secret key and JWT token for API auth~~ [WIP] Generate secret key and JWT token for API auth May 30, 2024

Installing libsodium to support jwt encryption

6ad9530

bdunne reviewed May 30, 2024

View reviewed changes

removed jwt gem from gemfile

7b41aac

bdunne reviewed May 30, 2024

View reviewed changes

installing libsodium in before install

24e0577

sudhir-kelkar requested a review from jrafanie as a code owner May 30, 2024 20:14

bdunne reviewed May 30, 2024

View reviewed changes

sudhir-kelkar added 4 commits May 31, 2024 11:28

Creating JWT token and writing it to a file for volume mount

76a0c79

rectified file open end

107d0b5

rectified unit test for container volume

ee8cee4

writing token file on rail.root folder

546d95c

agrare mentioned this pull request May 31, 2024

Mounting terraform-runner-token on volume mount #23054

Closed

agrare reviewed May 31, 2024

View reviewed changes

sudhir-kelkar closed this May 31, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[WIP] Generate secret key and JWT token for API auth #23052

[WIP] Generate secret key and JWT token for API auth #23052

sudhir-kelkar commented May 30, 2024

bdunne May 30, 2024

agrare May 30, 2024

agrare May 30, 2024

bdunne May 30, 2024

bdunne May 30, 2024 •

edited

Loading

bdunne May 30, 2024

agrare commented May 30, 2024

bdunne May 30, 2024

agrare May 30, 2024

bdunne May 30, 2024

bdunne May 30, 2024

miq-bot commented May 31, 2024

agrare May 31, 2024

sudhir-kelkar commented May 31, 2024

[WIP] Generate secret key and JWT token for API auth #23052

[WIP] Generate secret key and JWT token for API auth #23052

Conversation

sudhir-kelkar commented May 30, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

bdunne May 30, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

agrare commented May 30, 2024

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

miq-bot commented May 31, 2024

Choose a reason for hiding this comment

sudhir-kelkar commented May 31, 2024

bdunne May 30, 2024 •

edited

Loading