This repository has been archived by the owner on Oct 9, 2023. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 59
/
gcp_secret_manager.go
156 lines (138 loc) · 5.27 KB
/
gcp_secret_manager.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
package webhook
import (
"context"
"fmt"
"os"
"path/filepath"
"strings"
"github.com/flyteorg/flyteidl/gen/pb-go/flyteidl/core"
"github.com/flyteorg/flytepropeller/pkg/webhook/config"
"github.com/flyteorg/flytestdlib/logger"
corev1 "k8s.io/api/core/v1"
)
const (
// GCPSecretsVolumeName defines the static name of the volume used for mounting/sharing secrets between init-container
// sidecar and the rest of the containers in the pod.
GCPSecretsVolumeName = "gcp-secret-vol" // #nosec
)
var (
// GCPSecretMountPath defines the default mount path for secrets
GCPSecretMountPath = filepath.Join(string(os.PathSeparator), "etc", "flyte", "secrets")
)
// GCPSecretManagerInjector allows injecting of secrets from GCP Secret Manager as files. It uses a Google Cloud
// SDK SideCar as an init-container to download the secret and save it to a local volume shared with all other
// containers in the pod. It supports multiple secrets to be mounted but that will result into adding an init
// container for each secret. The Google serviceaccount (GSA) associated with the Pod, either via Workload
// Identity (recommended) or the underlying node's serviceacccount, must have permissions to pull the secret
// from GCP Secret Manager. Currently, the secret must also exist in the same project. Otherwise, the Pod will
// fail with an init-error.
// Files will be mounted on /etc/flyte/secrets/<SecretGroup>/<SecretGroupVersion>
type GCPSecretManagerInjector struct {
cfg config.GCPSecretManagerConfig
}
func formatGCPSecretAccessCommand(secret *core.Secret) []string {
// `gcloud` writes this file with permission 0600.
// This will cause permission issues in the main container when using non-root
// users, so we fix the file permissions with `chmod`.
secretDir := strings.ToLower(filepath.Join(GCPSecretMountPath, secret.Group))
secretPath := strings.ToLower(filepath.Join(secretDir, secret.GroupVersion))
args := []string{
"gcloud",
"secrets",
"versions",
"access",
secret.GroupVersion,
fmt.Sprintf("--secret=%s", secret.Group),
fmt.Sprintf(
"--out-file=%s",
secretPath,
),
"&&",
"chmod",
"+rX",
secretDir,
secretPath,
}
return []string{"sh", "-c", strings.Join(args, " ")}
}
func formatGCPInitContainerName(index int) string {
return fmt.Sprintf("gcp-pull-secret-%v", index)
}
func (i GCPSecretManagerInjector) Type() config.SecretManagerType {
return config.SecretManagerTypeGCP
}
func (i GCPSecretManagerInjector) Inject(ctx context.Context, secret *core.Secret, p *corev1.Pod) (newP *corev1.Pod, injected bool, err error) {
if len(secret.Group) == 0 || len(secret.GroupVersion) == 0 {
return nil, false, fmt.Errorf("GCP Secrets Webhook require both group and group version to be set. "+
"Secret: [%v]", secret)
}
switch secret.MountRequirement {
case core.Secret_ANY:
fallthrough
case core.Secret_FILE:
// A Volume with a static name so that if we try to inject multiple secrets, we won't mount multiple volumes.
// We use Memory as the storage medium for volume source to avoid
vol := corev1.Volume{
Name: GCPSecretsVolumeName,
VolumeSource: corev1.VolumeSource{
EmptyDir: &corev1.EmptyDirVolumeSource{
Medium: corev1.StorageMediumMemory,
},
},
}
p.Spec.Volumes = appendVolumeIfNotExists(p.Spec.Volumes, vol)
p.Spec.InitContainers = append(p.Spec.InitContainers, createGCPSidecarContainer(i.cfg, p, secret))
secretVolumeMount := corev1.VolumeMount{
Name: GCPSecretsVolumeName,
ReadOnly: true,
MountPath: GCPSecretMountPath,
}
p.Spec.Containers = AppendVolumeMounts(p.Spec.Containers, secretVolumeMount)
p.Spec.InitContainers = AppendVolumeMounts(p.Spec.InitContainers, secretVolumeMount)
// Inject GCP secret-inject webhook annotations to mount the secret in a predictable location.
envVars := []corev1.EnvVar{
// Set environment variable to let the container know where to find the mounted files.
{
Name: SecretPathDefaultDirEnvVar,
Value: GCPSecretMountPath,
},
// Sets an empty prefix to let the containers know the file names will match the secret keys as-is.
{
Name: SecretPathFilePrefixEnvVar,
Value: "",
},
}
for _, envVar := range envVars {
p.Spec.InitContainers = AppendEnvVars(p.Spec.InitContainers, envVar)
p.Spec.Containers = AppendEnvVars(p.Spec.Containers, envVar)
}
case core.Secret_ENV_VAR:
fallthrough
default:
err := fmt.Errorf("unrecognized mount requirement [%v] for secret [%v]", secret.MountRequirement.String(), secret.Key)
logger.Error(ctx, err)
return p, false, err
}
return p, true, nil
}
func createGCPSidecarContainer(cfg config.GCPSecretManagerConfig, p *corev1.Pod, secret *core.Secret) corev1.Container {
return corev1.Container{
Image: cfg.SidecarImage,
// Create a unique name to allow multiple secrets to be mounted.
Name: formatGCPInitContainerName(len(p.Spec.InitContainers)),
Command: formatGCPSecretAccessCommand(secret),
VolumeMounts: []corev1.VolumeMount{
{
Name: GCPSecretsVolumeName,
MountPath: GCPSecretMountPath,
},
},
Resources: cfg.Resources,
}
}
// NewGCPSecretManagerInjector creates a SecretInjector that's able to mount secrets from GCP Secret Manager.
func NewGCPSecretManagerInjector(cfg config.GCPSecretManagerConfig) GCPSecretManagerInjector {
return GCPSecretManagerInjector{
cfg: cfg,
}
}