Skip to content

Commit

Permalink
JWKS / IRSA: Expose public ACLs to terraform
Browse files Browse the repository at this point in the history 
Otherwise terraform wasn't correctly / consistently exposing these
files for JWKS/IRSA/OIDC.
  • Loading branch information
@justinsb
justinsb committed Jan 30, 2022
1 parent d6cb497 commit 16a676f
Show file tree
Hide file tree
Showing 11 changed files with 56 additions and 24 deletions.
2 changes: 2 additions & 0 deletions tests/integration/update_cluster/aws-lb-controller/kubernetes.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -569,6 +569,7 @@ resource "aws_s3_bucket_object" "cluster-completed-spec" {
}

resource "aws_s3_bucket_object" "discovery-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_discovery.json_content")
key = "discovery.example.com/minimal.example.com/.well-known/openid-configuration"
Expand All @@ -593,6 +594,7 @@ resource "aws_s3_bucket_object" "etcd-cluster-spec-main" {
}

resource "aws_s3_bucket_object" "keys-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_keys.json_content")
key = "discovery.example.com/minimal.example.com/openid/v1/jwks"
Expand Down
2 changes: 2 additions & 0 deletions tests/integration/update_cluster/digit/kubernetes.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -568,6 +568,7 @@ resource "aws_s3_bucket_object" "cluster-completed-spec" {
}

resource "aws_s3_bucket_object" "discovery-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_discovery.json_content")
key = "discovery.example.com/123.example.com/.well-known/openid-configuration"
Expand All @@ -592,6 +593,7 @@ resource "aws_s3_bucket_object" "etcd-cluster-spec-main" {
}

resource "aws_s3_bucket_object" "keys-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_keys.json_content")
key = "discovery.example.com/123.example.com/openid/v1/jwks"
Expand Down
2 changes: 2 additions & 0 deletions tests/integration/update_cluster/external_dns_irsa/kubernetes.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -543,6 +543,7 @@ resource "aws_s3_bucket_object" "cluster-completed-spec" {
}

resource "aws_s3_bucket_object" "discovery-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_discovery.json_content")
key = "discovery.example.com/minimal.example.com/.well-known/openid-configuration"
Expand All @@ -567,6 +568,7 @@ resource "aws_s3_bucket_object" "etcd-cluster-spec-main" {
}

resource "aws_s3_bucket_object" "keys-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_keys.json_content")
key = "discovery.example.com/minimal.example.com/openid/v1/jwks"
Expand Down
2 changes: 2 additions & 0 deletions tests/integration/update_cluster/irsa/kubernetes.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -593,6 +593,7 @@ resource "aws_s3_bucket_object" "cluster-completed-spec" {
}

resource "aws_s3_bucket_object" "discovery-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_discovery.json_content")
key = "discovery.example.com/minimal.example.com/.well-known/openid-configuration"
Expand All @@ -617,6 +618,7 @@ resource "aws_s3_bucket_object" "etcd-cluster-spec-main" {
}

resource "aws_s3_bucket_object" "keys-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_keys.json_content")
key = "discovery.example.com/minimal.example.com/openid/v1/jwks"
Expand Down
2 changes: 2 additions & 0 deletions tests/integration/update_cluster/karpenter/kubernetes.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -719,6 +719,7 @@ resource "aws_s3_bucket_object" "cluster-completed-spec" {
}

resource "aws_s3_bucket_object" "discovery-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_discovery.json_content")
key = "discovery.example.com/minimal.example.com/.well-known/openid-configuration"
Expand All @@ -743,6 +744,7 @@ resource "aws_s3_bucket_object" "etcd-cluster-spec-main" {
}

resource "aws_s3_bucket_object" "keys-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_keys.json_content")
key = "discovery.example.com/minimal.example.com/openid/v1/jwks"
Expand Down
2 changes: 2 additions & 0 deletions tests/integration/update_cluster/many-addons-ccm-irsa/kubernetes.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -673,6 +673,7 @@ resource "aws_s3_bucket_object" "cluster-completed-spec" {
}

resource "aws_s3_bucket_object" "discovery-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_discovery.json_content")
key = "discovery.example.com/minimal.example.com/.well-known/openid-configuration"
Expand All @@ -697,6 +698,7 @@ resource "aws_s3_bucket_object" "etcd-cluster-spec-main" {
}

resource "aws_s3_bucket_object" "keys-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_keys.json_content")
key = "discovery.example.com/minimal.example.com/openid/v1/jwks"
Expand Down
2 changes: 2 additions & 0 deletions tests/integration/update_cluster/many-addons-ccm-irsa23/kubernetes.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -647,6 +647,7 @@ resource "aws_s3_bucket_object" "cluster-completed-spec" {
}

resource "aws_s3_bucket_object" "discovery-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_discovery.json_content")
key = "discovery.example.com/minimal.example.com/.well-known/openid-configuration"
Expand All @@ -671,6 +672,7 @@ resource "aws_s3_bucket_object" "etcd-cluster-spec-main" {
}

resource "aws_s3_bucket_object" "keys-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_keys.json_content")
key = "discovery.example.com/minimal.example.com/openid/v1/jwks"
Expand Down
2 changes: 2 additions & 0 deletions tests/integration/update_cluster/minimal_gossip_irsa/kubernetes.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -517,6 +517,7 @@ resource "aws_s3_bucket_object" "cluster-completed-spec" {
}

resource "aws_s3_bucket_object" "discovery-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_discovery.json_content")
key = "discovery.example.com/minimal.example.com/.well-known/openid-configuration"
Expand All @@ -541,6 +542,7 @@ resource "aws_s3_bucket_object" "etcd-cluster-spec-main" {
}

resource "aws_s3_bucket_object" "keys-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_keys.json_content")
key = "discovery.example.com/minimal.example.com/openid/v1/jwks"
Expand Down
2 changes: 2 additions & 0 deletions tests/integration/update_cluster/public-jwks-apiserver/kubernetes.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -543,6 +543,7 @@ resource "aws_s3_bucket_object" "cluster-completed-spec" {
}

resource "aws_s3_bucket_object" "discovery-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_discovery.json_content")
key = "discovery.example.com/minimal.example.com/.well-known/openid-configuration"
Expand All @@ -567,6 +568,7 @@ resource "aws_s3_bucket_object" "etcd-cluster-spec-main" {
}

resource "aws_s3_bucket_object" "keys-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_keys.json_content")
key = "discovery.example.com/minimal.example.com/openid/v1/jwks"
Expand Down
2 changes: 2 additions & 0 deletions tests/integration/update_cluster/vfs-said/kubernetes.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -517,6 +517,7 @@ resource "aws_s3_bucket_object" "cluster-completed-spec" {
}

resource "aws_s3_bucket_object" "discovery-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_discovery.json_content")
key = "discovery.example.com/minimal.example.com/.well-known/openid-configuration"
Expand All @@ -541,6 +542,7 @@ resource "aws_s3_bucket_object" "etcd-cluster-spec-main" {
}

resource "aws_s3_bucket_object" "keys-json" {
acl = "public-read"
bucket = "testingBucket"
content = file("${path.module}/data/aws_s3_bucket_object_keys.json_content")
key = "discovery.example.com/minimal.example.com/openid/v1/jwks"
Expand Down
60 changes: 36 additions & 24 deletions upup/pkg/fi/fitasks/managedfile.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,10 +35,16 @@ type ManagedFile struct {
Name *string
Lifecycle fi.Lifecycle

Base *string
// Base is the root location of the store for the managed file
Base *string

// Location is the relative path of the managed file
Location *string

Contents fi.Resource
Public *bool

// Public controls whether the object is world-readable
Public *bool
}

func (e *ManagedFile) Find(c *fi.Context) (*ManagedFile, error) {
Expand Down Expand Up @@ -103,6 +109,30 @@ func (s *ManagedFile) CheckChanges(a, e, changes *ManagedFile) error {
return nil
}

func (e *ManagedFile) getACL(c *fi.Context, p vfs.Path) (vfs.ACL, error) {
var acl vfs.ACL
if fi.BoolValue(e.Public) {
switch p := p.(type) {
case *vfs.S3Path:
acl = &vfs.S3Acl{
RequestACL: fi.String("public-read"),
}
case *vfs.MemFSPath:
if !p.IsClusterReadable() {
return nil, fmt.Errorf("the %q path is intended for use in tests", p.Path())
}
acl = &vfs.S3Acl{
RequestACL: fi.String("public-read"),
}
default:
return nil, fmt.Errorf("the %q path does not support public ACL", p.Path())
}
return acl, nil
}

return acls.GetACL(p, c.Cluster)
}

func (_ *ManagedFile) Render(c *fi.Context, a, e, changes *ManagedFile) error {
location := fi.StringValue(e.Location)
if location == "" {
Expand All @@ -120,27 +150,9 @@ func (_ *ManagedFile) Render(c *fi.Context, a, e, changes *ManagedFile) error {
}
p = p.Join(location)

var acl vfs.ACL
if fi.BoolValue(e.Public) {
switch p := p.(type) {
case *vfs.S3Path:
acl = &vfs.S3Acl{
RequestACL: fi.String("public-read"),
}
case *vfs.MemFSPath:
if !p.IsClusterReadable() {
return fmt.Errorf("the %q path is intended for use in tests", p.Path())
}
acl = nil
default:
return fmt.Errorf("the %q path does not support public ACL", p.Path())
}
} else {

acl, err = acls.GetACL(p, c.Cluster)
if err != nil {
return err
}
acl, err := e.getACL(c, p)
if err != nil {
return err
}

err = p.WriteFile(bytes.NewReader(data), acl)
Expand Down Expand Up @@ -181,7 +193,7 @@ func (f *ManagedFile) RenderTerraform(c *fi.Context, t *terraform.TerraformTarge
}
p = p.Join(location)

acl, err := acls.GetACL(p, c.Cluster)
acl, err := e.getACL(c, p)
if err != nil {
return err
}
Expand Down

0 comments on commit 16a676f

Please sign in to comment.