Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove bind credential scripts #7

Merged
merged 2 commits into from Dec 1, 2017

Conversation

djzager
Copy link
Contributor

@djzager djzager commented Nov 14, 2017

The asb-modules, specifically asb_encode_binding, creates a
secret instead of writing to a file, we no longer need bind credential
scripts that will keep the pod alive.

See the
proposal

for more information.

The asb-modules, specifically `asb_encode_binding`, creates a
secret instead of writing to a file, we no longer need bind credential
scripts that will keep the pod alive.

See [the
proposal](https://github.com/openshift/ansible-service-broker/blob/master/docs/proposals/prop-apb-gen-creds.md)
for more information.
@djzager
Copy link
Contributor Author

djzager commented Nov 14, 2017

Testing

Include the changes from ansibleplaybookbundle/ansible-asb-modules#8 by changing the Dockerfile-canary:

--- a/Dockerfile-canary
+++ b/Dockerfile-canary
@@ -41,7 +41,7 @@ RUN git clone https://github.com/ansible/ansible-kubernetes-modules.git /etc/ans
 RUN cd /etc/ansible/roles/ansible.kubernetes-modules \
     && git checkout 1684bd7a8cb592da3d922b38251d38876032d801

-RUN git clone https://github.com/ansibleplaybookbundle/ansible-asb-modules.git /etc/ansible/roles/ansibleplaybookbundle.asb-modules
+RUN git clone -b bind-creds https://github.com/djzager/ansible-asb-modules.git /etc/ansible/roles/ansibleplaybookbundle.asb-modules

Update hello-world-db-apb to use new apb-base:

--- a/Dockerfile
+++ b/Dockerfile
@@ -1,22 +1,22 @@
-FROM ansibleplaybookbundle/apb-base
+FROM docker.io/djzager/apb-base

Build and push:

$ docker run --rm --privileged -v $PWD:/mnt -v $HOME/.kube:/.kube -v /var/run/docker.sock:/var/run/docker.sock -u $UID docker.io/ansibleplaybookbundle/apb build
$ docker run --rm --privileged -v $PWD:/mnt -v $HOME/.kube:/.kube -v /var/run/docker.sock:/var/run/docker.sock -u $UID docker.io/ansibleplaybookbundle/apb push

Provision the apb and see if the secret is created:

$ oc get secrets -n apb-push-hello-world-db-apb-prov-7mbn8 -w
...
asb-encode-binding   Opaque    1         0s // This is when it is created
...
asb-encode-binding   Opaque    1         11s // This is when it is removed by cleaning up sandbox

djzager pushed a commit to djzager/ansible-service-broker that referenced this pull request Nov 15, 2017
This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Implements openshift#544 and the proposal openshift#550. Also addresses the potential
issue in openshift#553.

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8)
  This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7)
  Remove scripts related to extracting credentials from the containers
  filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163)
  Bump the APB versions so freshly built APBs will pass version
  validation checks.
djzager pushed a commit to djzager/ansible-service-broker that referenced this pull request Nov 15, 2017
This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Implements openshift#544 and the proposal openshift#550. Also addresses the potential
issue in openshift#553.

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8)
  This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7)
  Remove scripts related to extracting credentials from the containers
  filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163)
  Bump the APB versions so freshly built APBs will pass version
  validation checks.
djzager added a commit to djzager/ansible-service-broker that referenced this pull request Nov 15, 2017
This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Fixes openshift#544
Fixes openshift#553
Implements the proposal openshift#550

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.
djzager added a commit to djzager/ansible-service-broker that referenced this pull request Nov 16, 2017
This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Fixes openshift#544
Fixes openshift#553
Implements the proposal openshift#550

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.
djzager added a commit to djzager/ansible-service-broker that referenced this pull request Nov 20, 2017
This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Fixes openshift#544
Fixes openshift#553
Implements the proposal openshift#550

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.
djzager added a commit to djzager/ansible-service-broker that referenced this pull request Nov 22, 2017
This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Fixes openshift#544
Fixes openshift#553
Implements the proposal openshift#550

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.
djzager added a commit to djzager/ansible-service-broker that referenced this pull request Nov 29, 2017
This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Fixes openshift#544
Fixes openshift#553
Implements the proposal openshift#550

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.
djzager added a commit to djzager/ansible-service-broker that referenced this pull request Nov 29, 2017
This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Fixes openshift#544
Fixes openshift#553
Implements the proposal openshift#550

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.
@rthallisey rthallisey merged commit ae903de into ansibleplaybookbundle:master Dec 1, 2017
djzager added a commit to djzager/ansible-service-broker that referenced this pull request Dec 4, 2017
This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Fixes openshift#544
Fixes openshift#553
Implements the proposal openshift#550

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.
rthallisey pushed a commit to openshift/ansible-service-broker that referenced this pull request Dec 4, 2017
* Broker should extract credentials from secret

This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Fixes #544
Fixes #553
Implements the proposal #550

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.

* Add APB runtime version to our APB Spec object

Update the broker to evaluate the `com.redhat.apb.runtime` label on APBs
(default to `1` when there is no label). Add version checking of this
new min/max apb runtime version and update associated tests.

* Handle bind credential extraction based on runtime

Update apb execution to be handle multiple apb runtime versions.

* Fixing log statements

* Only decode bind creds if encoded

Secrets retrieved using client-go are already decoded. So the extract
credentials function has been updated to only attempt to decode the
credentials if they need it.

Also changed the `log.Error` when the APB completed to a `log.Notice`
since it is not a failure.

* Pull k8s API call to get pod status into k8s client

* Cleanup extract credentials based on comments

* Update proposal based on what is implemented

* Improve adapter log info on apb runtime eval

* Fixes after rebase

* Address review comments and fix unit tests

* Ask for the k8s client when we need it

* Use canary APB images
jaymccon added a commit to amazon-archives/aws-servicebroker-s3 that referenced this pull request Feb 26, 2018
shawn-hurley pushed a commit to automationbroker/bundle-lib that referenced this pull request Mar 5, 2018
* Broker should extract credentials from secret

This change makes it so the broker can handle secrets that are created
by APBs when using the `asb_encode_binding` module.

- Update the broker so that it can handle secrets generated by the APB
  when `asb_encode_binding` module is used from the asb-modules.
- Update `executor::ExecuteApb` to wait for pod to complete, since the
  pod is no longer kept alive for credential extraction.
- Clean up some of the log messages and code format related to apb
  actions.

Fixes #544
Fixes #553
Implements the proposal #550

Depends on the following PRs:
- [ansible-asb-modules#8](ansibleplaybookbundle/ansible-asb-modules#8) This is how the secret gets generated.
- [apb-base#7](ansibleplaybookbundle/apb-base#7) Remove scripts related to extracting credentials from the containers filesystem.
- [ansible-playbook-bundle#163](ansibleplaybookbundle/ansible-playbook-bundle#163) Bump the APB versions so freshly built APBs will pass version validation checks.

* Add APB runtime version to our APB Spec object

Update the broker to evaluate the `com.redhat.apb.runtime` label on APBs
(default to `1` when there is no label). Add version checking of this
new min/max apb runtime version and update associated tests.

* Handle bind credential extraction based on runtime

Update apb execution to be handle multiple apb runtime versions.

* Fixing log statements

* Only decode bind creds if encoded

Secrets retrieved using client-go are already decoded. So the extract
credentials function has been updated to only attempt to decode the
credentials if they need it.

Also changed the `log.Error` when the APB completed to a `log.Notice`
since it is not a failure.

* Pull k8s API call to get pod status into k8s client

* Cleanup extract credentials based on comments

* Update proposal based on what is implemented

* Improve adapter log info on apb runtime eval

* Fixes after rebase

* Address review comments and fix unit tests

* Ask for the k8s client when we need it

* Use canary APB images
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants