Bug 1872369: Fix reading TLSConfig for HelmChartRepository #6347

pedjak · 2020-08-17T21:10:17Z

Secret containing TLS config was wrongly expected to be found in HelmChartRepository.spec.connectionConfig.tlsconfig.name path.

According to https://github.com/openshift/api/blob/master/helm/v1beta1/types_helm.go#L76 TLS client config is to be found in secret whose name is set in HelmChartRepository.spec.connectionConfig.tlsClientConfig.name path

Additional fixes/improvements:

Refactored Helm chart repo model for better testability
More tests added

pedjak · 2020-08-18T09:53:50Z

/retest

pedjak · 2020-08-18T11:41:10Z

/retest

pedjak · 2020-08-25T14:23:46Z

/retest

spadgett · 2020-08-25T14:45:23Z

/assign @jhadvig

spadgett · 2020-08-25T14:47:00Z

Can you add more a better description to the PR so it's clear what the purpose is? This will require a Bugzilla bug to merge since we're past feature freeze.

spadgett · 2020-08-25T14:49:29Z

pkg/helm/chartproxy/repos.go

+
+func (b helmRepoGetter) unmarshallConfig(repo unstructured.Unstructured) (*helmRepo, error) {
+	h := &helmRepo{}
+	urlValue, _, err := unstructured.NestedString(repo.Object, "spec", "connectionConfig", "url")


If you bump openshift/api, you should have a real struct with these fields, which would be better for type safety.

We would love too, and we tried to add openshift/client-go as the dependency (it contains all necessary types), but we cannot make it work currently in console, because client-go depends on k8s 1.19, but Helm (we depend on here) requires k8s 1.18. Tried to force it, but Helm is not yet compatible to k8s 1.19.

is there any plan to make it compatible ?

sure, when Helm moves to 1.19.

spadgett · 2020-08-25T14:50:12Z

pkg/helm/chartproxy/repos.go

+}
+
+func (b helmRepoGetter) secretValue(name string, dataField string) ([]byte, error) {
+	secret, err := b.CoreClient.Secrets(configNamespace).Get(context.TODO(), name, v1.GetOptions{})


What is the experience for users who don't have authority to get the secret?

They do not have access to that chart repo and consequently to charts managed there. UI will not list them at all.

openshift-ci-robot · 2020-08-25T15:19:47Z

@pedjak: This pull request references Bugzilla bug 1872369, which is invalid:

expected the bug to target the "4.6.0" release, but it targets "---" instead

Comment /bugzilla refresh to re-evaluate validity if changes to the Bugzilla bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

Bug 1872369: Fix reading TLSConfig for HelmChartRepository

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

pedjak · 2020-08-26T05:51:31Z

/bugzilla refresh

openshift-ci-robot · 2020-08-26T05:51:38Z

@pedjak: This pull request references Bugzilla bug 1872369, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target release (4.6.0) matches configured target release for branch (4.6.0)
bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)

In response to this:

/bugzilla refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

pedjak · 2020-08-26T05:52:07Z

/retest

jhadvig

@pedjak thanks for the PR. couple of questions and comments after the first round of review.

jhadvig · 2020-08-31T10:46:43Z

pkg/helm/chartproxy/repos.go

+type helmRepo struct {
+	Name            string
+	Url             *url.URL
+	TlsClientConfig *tls.Config


nit:

Suggested change

TlsClientConfig *tls.Config

TLSClientConfig *tls.Config

jhadvig · 2020-08-31T10:48:23Z

pkg/helm/chartproxy/repos.go

+func (b *helmRepoGetter) List() ([]*helmRepo, error) {
+	var helmRepos []*helmRepo
+	repos, err := b.Client.Resource(helmChartRepositoryGVK).List(context.TODO(), v1.ListOptions{})
+	if err != nil || len(repos.Items) == 0 {


Is silencing the error here intentional ?

yes, check the comment in the next line.

jhadvig · 2020-08-31T10:51:40Z

pkg/helm/handlers/handlers.go

-
-	"github.com/openshift/console/pkg/auth"
-	"github.com/openshift/console/pkg/helm/actions"
-	"github.com/openshift/console/pkg/serverutils"
 )

 var (
 	plog = capnslog.NewPackageLogger("github.com/openshift/console", "helm")


Suggested change

plog = capnslog.NewPackageLogger("github.com/openshift/console", "helm")

plog = capnslog.NewPackageLogger("github.com/openshift/console", "helm/handlers")

jhadvig · 2020-08-31T14:24:42Z

pkg/server/server.go

 	handle("/api/helm/template", authHandlerWithUser(helmHandlers.HandleHelmRenderManifests))
 	handle("/api/helm/releases", authHandlerWithUser(helmHandlers.HandleHelmList))
 	handle("/api/helm/chart", authHandlerWithUser(helmHandlers.HandleChartGet))
 	handle("/api/helm/release/history", authHandlerWithUser(helmHandlers.HandleGetReleaseHistory))
-	handle("/api/helm/charts/index.yaml", authHandlerWithUser(helmHandlers.HandleGetRepos))
+	handle("/api/helm/charts/index.yaml", authHandlerWithUser(helmHandlers.IndexFile))


Suggested change

handle("/api/helm/charts/index.yaml", authHandlerWithUser(helmHandlers.IndexFile))

handle("/api/helm/charts/index.yaml", authHandlerWithUser(helmHandlers.HandleIndexFile))

jhadvig · 2020-08-31T14:30:40Z

pkg/helm/handlers/handler_test.go

-			t.Errorf("Response status code isn't matching expected %d recieved %d", tt.httpStatusCode, response.Code)
-		}
+			if response.Code != tt.httpStatusCode {
+				t.Errorf("Response status code isn't matching expected %d recieved %d", tt.httpStatusCode, response.Code)


Suggested change

t.Errorf("Response status code isn't matching expected %d recieved %d", tt.httpStatusCode, response.Code)

t.Errorf("Response status code isn't matching expected %d received %d", tt.httpStatusCode, response.Code)

jhadvig · 2020-08-31T14:40:59Z

pkg/helm/chartproxy/repos.go

+
+func (b helmRepoGetter) unmarshallConfig(repo unstructured.Unstructured) (*helmRepo, error) {
+	h := &helmRepo{}
+	urlValue, _, err := unstructured.NestedString(repo.Object, "spec", "connectionConfig", "url")


is there any plan to make it compatible ?

jhadvig · 2020-08-31T14:43:45Z

pkg/helm/chartproxy/repos_test.go

+			expectedRepoName: []string{"sample-repo-1", "sample-repo-2"},
+		},
+		{
+			name:             "return 1 repos found in cluster",


nit:

Suggested change

name: "return 1 repos found in cluster",

name: "return 1 repo found in cluster",

jhadvig · 2020-08-31T14:44:34Z

pkg/helm/chartproxy/repos_test.go

+		},
+		{
+			name:             "return default repo when none are declared in cluster",
+			ReposNum:         0,


Shouldn't this be 1 since the default one is returned ?

it represents the number of HelmChartRepos found in cluster

nope, we are testing the situation when there are no HelmChartRepo CRs available in the cluster - in that case, we should still fall back on the default repo.

jhadvig · 2020-08-31T14:51:11Z

pkg/helm/chartproxy/repos.go

+	"github.com/openshift/library-go/pkg/crypto"
+)
+
+var (


Does this needs to be a global variable ?

is it private to this package. we use it to retrieve the instances. I am open to any better approach.

jhadvig · 2020-08-31T14:55:57Z

pkg/helm/chartproxy/config.go

 	oscrypto "github.com/openshift/library-go/pkg/crypto"
 )

 var (
-	log = capnslog.NewPackageLogger("github.com/openshift/console", "pkg/helm")
+	log         = capnslog.NewPackageLogger("github.com/openshift/console", "pkg/helm")


Suggested change

log = capnslog.NewPackageLogger("github.com/openshift/console", "pkg/helm")

log = capnslog.NewPackageLogger("github.com/openshift/console", "helm/chartproxy")

jhadvig

Some additional comments to fix. Otherwise looks good.

pkg/helm/chartproxy/config.go

jhadvig · 2020-09-03T08:51:12Z

pkg/helm/chartproxy/repos.go

+			return nil, err
+		}
+	}
+	h.TlSClientConfig = &tls.Config{


Suggested change

h.TlSClientConfig = &tls.Config{

h.TLSClientConfig = oscrypto.SecureTLSConfig(&tls.Config{

jhadvig · 2020-09-03T08:51:41Z

pkg/helm/chartproxy/repos.go

+	}
+	h.TlSClientConfig = &tls.Config{
+		RootCAs:      rootCAs,
+		CipherSuites: crypto.DefaultCiphers(),


This line can be removed, oscrypto.SecureTLSConfig() will take care of it.

jhadvig · 2020-09-03T08:53:19Z

pkg/helm/chartproxy/repos.go

+func (b helmRepoGetter) secretValue(name string, dataField string) ([]byte, error) {
+	secret, err := b.CoreClient.Secrets(configNamespace).Get(context.TODO(), name, v1.GetOptions{})
+	if err != nil {
+		return nil, errors.New(fmt.Sprintf("Failed to read secret %s", name))


nit:

Suggested change

return nil, errors.New(fmt.Sprintf("Failed to read secret %s", name))

return nil, errors.New(fmt.Sprintf("Failed to GET secret %s", name))

jhadvig · 2020-09-03T08:53:45Z

pkg/helm/chartproxy/repos.go

+func (b helmRepoGetter) configMapValue(name string, dataField string) ([]byte, error) {
+	configMap, err := b.CoreClient.ConfigMaps(configNamespace).Get(context.TODO(), name, v1.GetOptions{})
+	if err != nil {
+		return nil, errors.New(fmt.Sprintf("Failed to read configmap %s", name))


nit:

Suggested change

return nil, errors.New(fmt.Sprintf("Failed to read configmap %s", name))

return nil, errors.New(fmt.Sprintf("Failed to GET configmap %s", name))

jhadvig · 2020-09-03T09:29:43Z

pkg/helm/chartproxy/repos.go

+
+type helmRepo struct {
+	Name            string
+	Url             *url.URL


Suggested change

Url *url.URL

URL *url.URL

jhadvig · 2020-09-03T09:31:25Z

pkg/helm/chartproxy/repos.go

+	if err != nil {
+		return nil, err
+	}
+	indexUrl := hr.Url.String()


Suggested change

indexUrl := hr.Url.String()

indexURL := hr.Url.String()

jhadvig · 2020-09-03T09:31:38Z

pkg/helm/chartproxy/repos.go

+	if !strings.HasSuffix(indexUrl, "/index.yaml") {
+		indexUrl += "/index.yaml"
+	}
+	resp, err := httpClient.Get(indexUrl)


Suggested change

resp, err := httpClient.Get(indexUrl)

resp, err := httpClient.Get(indexURL)

jhadvig · 2020-09-03T09:32:15Z

pkg/helm/chartproxy/config.go

-	srv.HelmChartRepoProxyConfig = &proxy.Config{
+	DefaultRepo = helmRepo{
+		Name: "redhat-helm-charts",
+		Url:  repoURL,


Suggested change

Url: repoURL,

URL: repoURL,

jhadvig · 2020-09-03T09:33:26Z

pkg/helm/chartproxy/config.go

@@ -33,14 +32,13 @@ func RegisterFlags(fs *flag.FlagSet) *config {
 	return cfg
 }

-func (cfg *config) Configure(srv *server.Server) {
+func (cfg *config) Configure() {
 	repoURL := bridge.ValidateFlagIsURL("helm-chart-repo-repoUrl", cfg.repoUrl)

 	var rootCAs *x509.CertPool
 	if cfg.repoCaFile != "" {


Suggested change

if cfg.repoCaFile != "" {

if cfg.repoCAFile != "" {

jhadvig · 2020-09-03T09:34:44Z

pkg/helm/chartproxy/config.go

@@ -33,14 +32,13 @@ func RegisterFlags(fs *flag.FlagSet) *config {
 	return cfg
 }

-func (cfg *config) Configure(srv *server.Server) {
+func (cfg *config) Configure() {
 	repoURL := bridge.ValidateFlagIsURL("helm-chart-repo-repoUrl", cfg.repoUrl)


Suggested change

repoURL := bridge.ValidateFlagIsURL("helm-chart-repo-repoUrl", cfg.repoUrl)

repoURL := bridge.ValidateFlagIsURL("helm-chart-repo-url", cfg.repoURL)

jhadvig · 2020-09-03T09:35:22Z

pkg/helm/chartproxy/config.go

 	repoURL := bridge.ValidateFlagIsURL("helm-chart-repo-repoUrl", cfg.repoUrl)

 	var rootCAs *x509.CertPool
 	if cfg.repoCaFile != "" {
 		rootCAs = x509.NewCertPool()
 		certPEM, err := ioutil.ReadFile(cfg.repoCaFile)
-		srv.HelmDefaultRepoCACert = certPEM
 		if err != nil {
 			log.Fatalf("failed to read helm chart repo ca file %v : %v", cfg.repoCaFile, err)


Suggested change

log.Fatalf("failed to read helm chart repo ca file %v : %v", cfg.repoCaFile, err)

log.Fatalf("failed to read helm chart repo ca file %v : %v", cfg.repoCAFile, err)

jhadvig · 2020-09-03T09:35:43Z

pkg/helm/chartproxy/config.go

@@ -33,14 +32,13 @@ func RegisterFlags(fs *flag.FlagSet) *config {
 	return cfg
 }

-func (cfg *config) Configure(srv *server.Server) {
+func (cfg *config) Configure() {
 	repoURL := bridge.ValidateFlagIsURL("helm-chart-repo-repoUrl", cfg.repoUrl)

 	var rootCAs *x509.CertPool
 	if cfg.repoCaFile != "" {
 		rootCAs = x509.NewCertPool()
 		certPEM, err := ioutil.ReadFile(cfg.repoCaFile)


Suggested change

certPEM, err := ioutil.ReadFile(cfg.repoCaFile)

certPEM, err := ioutil.ReadFile(cfg.repoCAFile)

jhadvig · 2020-09-03T09:36:13Z

pkg/helm/chartproxy/repos_test.go

+				indexFileContennts = append(indexFileContennts, "")
+			}
+			client := fake.K8sDynamicClient(indexFileContennts...)
+			cfg := config{repoUrl: "https://default-url.com"}


Suggested change

cfg := config{repoUrl: "https://default-url.com"}

cfg := config{repoURL: "https://default-url.com"}

jhadvig · 2020-09-03T13:00:32Z

pkg/helm/chartproxy/repos.go

+		RootCAs: rootCAs,
+	})
+	if tlsReference != "" {
+		tlsCert, err := b.secretValue(tlsReference, "tls.crt")


secretValue() method is making the API call. Should be enough to call it once and check the wanted field.

tlsSecret, err := b.CoreClient.Secrets(configNamespace).Get(context.TODO(), name, v1.GetOptions{}) if err != nil { return nil, errors.New(fmt.Sprintf("Failed to GET secret %s", name)) } tlsCert, err := b.secretValue(tlsSecret, "tls.crt") tlsCert, err := b.secretValue(tlsSecret, "tls.key")

jhadvig · 2020-09-03T13:01:35Z

pkg/helm/chartproxy/repos.go

+
+	var rootCAs *x509.CertPool
+	if caReference != "" {
+		caCert, err := b.configMapValue(caReference, "ca-bundle.crt")


Would pull the API call for GETting the CM from the configMapValue method and just check for it ... check the comment below

Additional fixes/improvements: * Refactored Helm chart repo model for better testability * More tests added Co-authored-by: Predrag Knezevic <pknezevi@redhat.com>

jhadvig

/lgtm
/approve

spadgett · 2020-09-03T14:49:58Z

/approve

openshift-ci-robot · 2020-09-03T14:50:17Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jhadvig, pedjak, spadgett

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [spadgett]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-bot · 2020-09-03T15:28:38Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-09-03T15:41:36Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-bot · 2020-09-03T16:21:26Z

/retest

Please review the full test history for this PR and help us cut down flakes.

openshift-ci-robot · 2020-09-03T20:59:11Z

@pedjak: All pull requests linked via external trackers have merged:

openshift/console#6347

Bugzilla bug 1872369 has been moved to the MODIFIED state.

In response to this:

Bug 1872369: Fix reading TLSConfig for HelmChartRepository

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci-robot added the component/backend Related to backend label Aug 17, 2020

openshift-ci-robot requested review from alecmerdler and spadgett August 17, 2020 21:10

openshift-ci-robot assigned jhadvig Aug 25, 2020

spadgett reviewed Aug 25, 2020

View reviewed changes

pedjak changed the title ~~Deserialize TLSConfig for correct secret~~ Deserialize TLSConfig from correct secret Aug 25, 2020

pedjak changed the title ~~Deserialize TLSConfig from correct secret~~ Fix reading TLSConfig for HelmChartRepository Aug 25, 2020

pedjak changed the title ~~Fix reading TLSConfig for HelmChartRepository~~ Bug 1872369: Fix reading TLSConfig for HelmChartRepository Aug 25, 2020

openshift-ci-robot added bugzilla/severity-urgent Referenced Bugzilla bug's severity is urgent for the branch this PR is targeting. bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. labels Aug 25, 2020

openshift-ci-robot removed the bugzilla/invalid-bug Indicates that a referenced Bugzilla bug is invalid for the branch this PR is targeting. label Aug 26, 2020

jhadvig requested changes Aug 31, 2020

View reviewed changes

jhadvig requested changes Sep 3, 2020

View reviewed changes

pedjak force-pushed the fix-helm-repo-tlsconf-reading branch from e5a854a to 6b8c619 Compare September 3, 2020 12:14

jhadvig reviewed Sep 3, 2020

View reviewed changes

Deserialize TLSConfig for correct secret

100377a

Additional fixes/improvements: * Refactored Helm chart repo model for better testability * More tests added Co-authored-by: Predrag Knezevic <pknezevi@redhat.com>

pedjak force-pushed the fix-helm-repo-tlsconf-reading branch from 277bfe0 to 100377a Compare September 3, 2020 14:42

jhadvig approved these changes Sep 3, 2020

View reviewed changes

openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Sep 3, 2020

openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 3, 2020

openshift-merge-robot merged commit 2521851 into openshift:master Sep 3, 2020

spadgett added this to the v4.6 milestone Sep 11, 2020

	plog = capnslog.NewPackageLogger("github.com/openshift/console", "helm")
	plog = capnslog.NewPackageLogger("github.com/openshift/console", "helm/handlers")

	handle("/api/helm/charts/index.yaml", authHandlerWithUser(helmHandlers.IndexFile))
	handle("/api/helm/charts/index.yaml", authHandlerWithUser(helmHandlers.HandleIndexFile))

	t.Errorf("Response status code isn't matching expected %d recieved %d", tt.httpStatusCode, response.Code)
	t.Errorf("Response status code isn't matching expected %d received %d", tt.httpStatusCode, response.Code)

	name: "return 1 repos found in cluster",
	name: "return 1 repo found in cluster",

	log = capnslog.NewPackageLogger("github.com/openshift/console", "pkg/helm")
	log = capnslog.NewPackageLogger("github.com/openshift/console", "helm/chartproxy")

	h.TlSClientConfig = &tls.Config{
	h.TLSClientConfig = oscrypto.SecureTLSConfig(&tls.Config{

	return nil, errors.New(fmt.Sprintf("Failed to read secret %s", name))
	return nil, errors.New(fmt.Sprintf("Failed to GET secret %s", name))

	resp, err := httpClient.Get(indexUrl)
	resp, err := httpClient.Get(indexURL)

	repoURL := bridge.ValidateFlagIsURL("helm-chart-repo-repoUrl", cfg.repoUrl)
	repoURL := bridge.ValidateFlagIsURL("helm-chart-repo-url", cfg.repoURL)

	log.Fatalf("failed to read helm chart repo ca file %v : %v", cfg.repoCaFile, err)
	log.Fatalf("failed to read helm chart repo ca file %v : %v", cfg.repoCAFile, err)

	certPEM, err := ioutil.ReadFile(cfg.repoCaFile)
	certPEM, err := ioutil.ReadFile(cfg.repoCAFile)

	cfg := config{repoUrl: "https://default-url.com"}
	cfg := config{repoURL: "https://default-url.com"}

Bug 1872369: Fix reading TLSConfig for HelmChartRepository #6347

Bug 1872369: Fix reading TLSConfig for HelmChartRepository #6347

Conversation

pedjak commented Aug 17, 2020 • edited

pedjak commented Aug 18, 2020

pedjak commented Aug 18, 2020

pedjak commented Aug 25, 2020

spadgett commented Aug 25, 2020

spadgett commented Aug 25, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

openshift-ci-robot commented Aug 25, 2020

pedjak commented Aug 26, 2020

openshift-ci-robot commented Aug 26, 2020

pedjak commented Aug 26, 2020

jhadvig left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jhadvig left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jhadvig left a comment

Choose a reason for hiding this comment

spadgett commented Sep 3, 2020

openshift-ci-robot commented Sep 3, 2020

openshift-bot commented Sep 3, 2020

openshift-bot commented Sep 3, 2020

openshift-bot commented Sep 3, 2020

openshift-ci-robot commented Sep 3, 2020

pedjak commented Aug 17, 2020 •

edited