Create secret for bind credentials #8

djzager · 2017-11-14T17:25:03Z

When asb_encode_binding is used, we want for a secret to be created in
the transient namespace where the APB is being executed.

See the proposal
for more information.

When `asb_encode_binding` is used, we want for a secret to be created in the transient namespace where the APB is being executed. See [the proposal](https://github.com/openshift/ansible-service-broker/blob/master/docs/proposals/prop-apb-gen-creds.md) for more information.

fabianvf · 2017-11-14T19:40:35Z

library/asb_encode_binding.py

+    config.load_kube_config()
+    api = client.CoreV1Api()
+except Exception as error:
+    ansible_module.fail_json(msg="Error attempting to load kubernetes client: " + str(error))


better to use python string formatting here, ex: "Error is {}".format(error)

fabianvf · 2017-11-14T19:48:30Z

library/asb_encode_binding.py


 ENCODED_BINDING_PATH = "/var/tmp/bind-creds"
+ENV_NAMESPACE = "POD_NAMESPACE"


why is this set to POD_NAMESPACE?

https://github.com/openshift/ansible-service-broker/blob/master/pkg/apb/executor.go#L137

cfchase

ACK

Giving the secret a name equivalent to the pod's name is cleaner with respect to the broker knowing how to find the secret.

This change makes it so the broker can handle secrets that are created by APBs when using the `asb_encode_binding` module. - Update the broker so that it can handle secrets generated by the APB when `asb_encode_binding` module is used from the asb-modules. - Update `executor::ExecuteApb` to wait for pod to complete, since the pod is no longer kept alive for credential extraction. - Clean up some of the log messages and code format related to apb actions. Implements openshift#544 and the proposal openshift#550. Also addresses the potential issue in openshift#553. Depends on the following PRs: - [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated. - [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem. - [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.

This change makes it so the broker can handle secrets that are created by APBs when using the `asb_encode_binding` module. - Update the broker so that it can handle secrets generated by the APB when `asb_encode_binding` module is used from the asb-modules. - Update `executor::ExecuteApb` to wait for pod to complete, since the pod is no longer kept alive for credential extraction. - Clean up some of the log messages and code format related to apb actions. Fixes openshift#544 Fixes openshift#553 Implements the proposal openshift#550 Depends on the following PRs: - [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated. - [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem. - [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.

* Broker should extract credentials from secret This change makes it so the broker can handle secrets that are created by APBs when using the `asb_encode_binding` module. - Update the broker so that it can handle secrets generated by the APB when `asb_encode_binding` module is used from the asb-modules. - Update `executor::ExecuteApb` to wait for pod to complete, since the pod is no longer kept alive for credential extraction. - Clean up some of the log messages and code format related to apb actions. Fixes #544 Fixes #553 Implements the proposal #550 Depends on the following PRs: - [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated. - [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem. - [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks. * Add APB runtime version to our APB Spec object Update the broker to evaluate the `com.redhat.apb.runtime` label on APBs (default to `1` when there is no label). Add version checking of this new min/max apb runtime version and update associated tests. * Handle bind credential extraction based on runtime Update apb execution to be handle multiple apb runtime versions. * Fixing log statements * Only decode bind creds if encoded Secrets retrieved using client-go are already decoded. So the extract credentials function has been updated to only attempt to decode the credentials if they need it. Also changed the `log.Error` when the APB completed to a `log.Notice` since it is not a failure. * Pull k8s API call to get pod status into k8s client * Cleanup extract credentials based on comments * Update proposal based on what is implemented * Improve adapter log info on apb runtime eval * Fixes after rebase * Address review comments and fix unit tests * Ask for the k8s client when we need it * Use canary APB images

djzager added do-not-merge work-in-progress labels Nov 14, 2017

djzager mentioned this pull request Nov 14, 2017

Remove bind credential scripts ansibleplaybookbundle/apb-base#7

Merged

djzager requested review from cfchase and fabianvf November 14, 2017 18:09

fabianvf reviewed Nov 14, 2017

View reviewed changes

Use python string formatting

6b7af9f

cfchase approved these changes Nov 14, 2017

View reviewed changes

Encode binding as secret named after pod's name

9bab90e

Giving the secret a name equivalent to the pod's name is cleaner with respect to the broker knowing how to find the secret.

djzager mentioned this pull request Nov 17, 2017

First pass at last_operation description proposal openshift/ansible-service-broker#537

Merged

rthallisey approved these changes Nov 28, 2017

View reviewed changes

rthallisey merged commit a81eac2 into ansibleplaybookbundle:master Dec 1, 2017

Create secret for bind credentials #8

Create secret for bind credentials #8

djzager commented Nov 14, 2017 •

edited

fabianvf Nov 14, 2017

fabianvf Nov 14, 2017

djzager Nov 14, 2017

cfchase left a comment


		ENCODED_BINDING_PATH = "/var/tmp/bind-creds"
		ENV_NAMESPACE = "POD_NAMESPACE"

Create secret for bind credentials #8

Create secret for bind credentials #8

Conversation

djzager commented Nov 14, 2017 • edited

fabianvf Nov 14, 2017

Choose a reason for hiding this comment

fabianvf Nov 14, 2017

Choose a reason for hiding this comment

djzager Nov 14, 2017

Choose a reason for hiding this comment

cfchase left a comment

Choose a reason for hiding this comment

djzager commented Nov 14, 2017 •

edited