Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Increase the entropy in generated PAC secrets #1663

Closed
arewm opened this issue Apr 12, 2024 · 1 comment · Fixed by #1664
Closed

Increase the entropy in generated PAC secrets #1663

arewm opened this issue Apr 12, 2024 · 1 comment · Fixed by #1664
Assignees
@chmouel

Comments

@arewm
Copy link

arewm commented Apr 12, 2024

When the auth secret names only have four characters of entropy, the likelihood of collisions is high especially when there are many concurrent events triggered within a namespace.

At a minimum, we should increase the number of random characters in the secret name. If possible, this can be a configurable parameter during the deployment of PAC.
@chmouel chmouel self-assigned this Apr 15, 2024
chmouel added a commit to chmouel/pipelines-as-code that referenced this issue Apr 15, 2024
@chmouel
Increase the entropy in generated pac secrets
5d4eaae 
we would hit some conflicts when generating the pac secrets, so increase
the entropy of 6. The secret is composed of 62 characters (26 uppercase
+ 26 lowercase + 10 digits) so the total number of combinations for a
string of length nn would be 62n62n.

With a length of 6 there are approximately 56.8 billion possible
combinations which would not conflict anymore.

Fixes openshift-pipelines#1663

Signed-off-by: Chmouel Boudjnah <chmouel@redhat.com>
@chmouel chmouel mentioned this issue Apr 15, 2024
Merged
7 tasks
@chmouel
Copy link
Member

chmouel commented Apr 15, 2024

I increased the random string to 6, i didn't make it configurable since this only make more of a burden for paac to have another knob to test/validate (k8s limitations) and supports. let me know if you have a specific use case why we should give this a setting.

chmouel added a commit that referenced this issue Apr 15, 2024
@chmouel
Increase the entropy in generated pac secrets
9237056 
we would hit some conflicts when generating the pac secrets, so increase
the entropy of 6. The secret is composed of 62 characters (26 uppercase
+ 26 lowercase + 10 digits) so the total number of combinations for a
string of length nn would be 62n62n.

With a length of 6 there are approximately 56.8 billion possible
combinations which would not conflict anymore.

Fixes #1663

Signed-off-by: Chmouel Boudjnah <chmouel@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@chmouel chmouel

Labels
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

Increase the entropy in generated pac secrets chmouel/pipelines-as-code
2 participants
@chmouel @arewm