add shared path to SSM parameters

concourse · Feb 15, 2023 · b953898 · b953898
1 parent da2a805
commit b953898
Show file tree

Hide file tree

Showing 7 changed files with 33 additions and 7 deletions.
diff --git a/atc/api/info_test.go b/atc/api/info_test.go
@@ -108,7 +108,7 @@ var _ = Describe("Pipelines API", func() {
 				fakeAccess.IsAuthenticatedReturns(true)
 				fakeAccess.IsAdminReturns(true)
 
-				ssmAccess := ssm.NewSsm(lager.NewLogger("ssm_test"), &mockService, nil)
+				ssmAccess := ssm.NewSsm(lager.NewLogger("ssm_test"), &mockService, nil, "")
 				ssmManager := &ssm.SsmManager{
 					AwsAccessKeyID:         "",
 					AwsSecretAccessKey:     "",
@@ -140,6 +140,7 @@ var _ = Describe("Pipelines API", func() {
 							"method": "GetParameter"
 						},
 						"pipeline_secret_template": "pipeline-secret-template",
+						"shared_path": "",
 						"team_secret_template": "team-secret-template"
           }
         }`))
@@ -165,6 +166,7 @@ var _ = Describe("Pipelines API", func() {
 							"method": "GetParameter"
 						},
 						"pipeline_secret_template": "pipeline-secret-template",
+						"shared_path": "",
 						"team_secret_template": "team-secret-template"
           }
         }`))

diff --git a/atc/creds/ssm/manager.go b/atc/creds/ssm/manager.go
@@ -24,6 +24,7 @@ type SsmManager struct {
 	AwsRegion              string `mapstructure:"region" long:"region" description:"AWS region to send requests to"`
 	PipelineSecretTemplate string `mapstructure:"pipeline_secret_template" long:"pipeline-secret-template" description:"AWS SSM parameter name template used for pipeline specific parameter" default:"/concourse/{{.Team}}/{{.Pipeline}}/{{.Secret}}"`
 	TeamSecretTemplate     string `mapstructure:"team_secret_template" long:"team-secret-template" description:"AWS SSM parameter name template used for team specific parameter" default:"/concourse/{{.Team}}/{{.Secret}}"`
+	SharedPath             string `mapstructure:"shared_path" long:"shared-path" description:"AWS SSM parameter path used for shared parameters"`
 	Ssm                    *Ssm
 }
 
@@ -37,6 +38,7 @@ func (manager *SsmManager) MarshalJSON() ([]byte, error) {
 		"aws_region":               manager.AwsRegion,
 		"pipeline_secret_template": manager.PipelineSecretTemplate,
 		"team_secret_template":     manager.TeamSecretTemplate,
+		"shared_path":              manager.SharedPath,
 		"health":                   health,
 	})
 }
@@ -139,7 +141,7 @@ func (manager *SsmManager) NewSecretsFactory(log lager.Logger) (creds.SecretsFac
 		return nil, err
 	}
 
-	return NewSsmFactory(log, session, []*creds.SecretTemplate{pipelineSecretTemplate, teamSecretTemplate}), nil
+	return NewSsmFactory(log, session, []*creds.SecretTemplate{pipelineSecretTemplate, teamSecretTemplate}, manager.SharedPath), nil
 }
 
 func (manager *SsmManager) Close(logger lager.Logger) {

diff --git a/atc/creds/ssm/ssm.go b/atc/creds/ssm/ssm.go
@@ -17,13 +17,15 @@ type Ssm struct {
 	log             lager.Logger
 	api             ssmiface.SSMAPI
 	secretTemplates []*creds.SecretTemplate
+	sharedPath      string
 }
 
-func NewSsm(log lager.Logger, api ssmiface.SSMAPI, secretTemplates []*creds.SecretTemplate) *Ssm {
+func NewSsm(log lager.Logger, api ssmiface.SSMAPI, secretTemplates []*creds.SecretTemplate, sharedPath string) *Ssm {
 	return &Ssm{
 		log:             log,
 		api:             api,
 		secretTemplates: secretTemplates,
+		sharedPath:      sharedPath,
 	}
 }
 
@@ -35,6 +37,9 @@ func (s *Ssm) NewSecretLookupPaths(teamName string, pipelineName string, allowRo
 			lookupPaths = append(lookupPaths, lPath)
 		}
 	}
+	if s.sharedPath != "" {
+		lookupPaths = append(lookupPaths, creds.NewSecretLookupWithPrefix(s.sharedPath+"/"))
+	}
 	return lookupPaths
 }
 

diff --git a/atc/creds/ssm/ssm_factory.go b/atc/creds/ssm/ssm_factory.go
@@ -11,16 +11,18 @@ type ssmFactory struct {
 	log             lager.Logger
 	api             *ssm.SSM
 	secretTemplates []*creds.SecretTemplate
+	sharedPath      string
 }
 
-func NewSsmFactory(log lager.Logger, session *session.Session, secretTemplates []*creds.SecretTemplate) *ssmFactory {
+func NewSsmFactory(log lager.Logger, session *session.Session, secretTemplates []*creds.SecretTemplate, sharedPath string) *ssmFactory {
 	return &ssmFactory{
 		log:             log,
 		api:             ssm.New(session),
 		secretTemplates: secretTemplates,
+		sharedPath:      sharedPath,
 	}
 }
 
 func (factory *ssmFactory) NewSecrets() creds.Secrets {
-	return NewSsm(factory.log, factory.api, factory.secretTemplates)
+	return NewSsm(factory.log, factory.api, factory.secretTemplates, factory.sharedPath)
 }
diff --git a/atc/creds/ssm/ssm_test.go b/atc/creds/ssm/ssm_test.go
@@ -98,7 +98,7 @@ var _ = Describe("Ssm", func() {
 		t2, err := creds.BuildSecretTemplate("t2", DefaultTeamSecretTemplate)
 		Expect(t2).NotTo(BeNil())
 		Expect(err).To(BeNil())
-		ssmAccess = NewSsm(lagertest.NewTestLogger("ssm_test"), &mockService, []*creds.SecretTemplate{t1, t2})
+		ssmAccess = NewSsm(lagertest.NewTestLogger("ssm_test"), &mockService, []*creds.SecretTemplate{t1, t2}, "/concourse/shared")
 		variables = creds.NewVariables(ssmAccess, "alpha", "bogus", false)
 		Expect(ssmAccess).NotTo(BeNil())
 		mockService.stubGetParameter = func(input string) (string, error) {
@@ -120,7 +120,7 @@ var _ = Describe("Ssm", func() {
 			Expect(err).To(BeNil())
 		})
 
-		It("should get complex paramter", func() {
+		It("should get complex parameter", func() {
 			mockService.stubGetParametersByPathPages = func(path string) []mockPathResultPage {
 				return []mockPathResultPage{
 					{
@@ -164,6 +164,19 @@ var _ = Describe("Ssm", func() {
 			Expect(err).To(BeNil())
 		})
 
+		It("should get shared parameter if exists", func() {
+			mockService.stubGetParameter = func(input string) (string, error) {
+				if input != "/concourse/shared/cheery" {
+					return "", awserr.New(ssm.ErrCodeParameterNotFound, "", nil)
+				}
+				return "shared decrypted value", nil
+			}
+			value, found, err := variables.Get(varRef)
+			Expect(value).To(BeEquivalentTo("shared decrypted value"))
+			Expect(found).To(BeTrue())
+			Expect(err).To(BeNil())
+		})
+
 		It("should return not found on error", func() {
 			mockService.stubGetParameter = nil
 			value, found, err := variables.Get(varRef)

diff --git a/go.mod b/go.mod
@@ -225,6 +225,7 @@ require (
 	github.com/go-openapi/jsonpointer v0.19.6 // indirect
 	github.com/go-openapi/jsonreference v0.20.1 // indirect
 	github.com/go-openapi/swag v0.22.3 // indirect
+	github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 // indirect
 	github.com/gobuffalo/envy v1.7.0 // indirect
 	github.com/gobuffalo/packd v0.3.0 // indirect
 	github.com/google/gnostic v0.5.7-v3refs // indirect

diff --git a/go.sum b/go.sum
@@ -496,6 +496,7 @@ github.com/go-playground/validator/v10 v10.4.1/go.mod h1:nlOn6nFhuKACm19sB/8EGNn
 github.com/go-sql-driver/mysql v1.6.0 h1:BCTh4TKNUYmOmMUcQ3IipzF5prigylS7XXjEkfCHuOE=
 github.com/go-sql-driver/mysql v1.6.0/go.mod h1:DCzpHaOWr8IXmIStZouvnhqoel9Qv2LBy8hT2VhHyBg=
 github.com/go-stack/stack v1.8.0/go.mod h1:v0f6uXyyMGvRgIKkXu+yp6POWl0qKG85gN/melR3HDY=
+github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0 h1:p104kn46Q8WdvHunIJ9dAyjPVtrBPhSr3KT2yUst43I=
 github.com/go-task/slim-sprig v0.0.0-20210107165309-348f09dbbbc0/go.mod h1:fyg7847qk6SyHyPtNmDHnmrv/HOrqktSC+C9fM+CJOE=
 github.com/go-test/deep v1.0.2 h1:onZX1rnHT3Wv6cqNgYyFOOlgVKJrksuCMCRvJStbMYw=
 github.com/gobuffalo/envy v1.7.0 h1:GlXgaiBkmrYMHco6t4j7SacKO4XUjvh5pwXh0f4uxXU=