1Password/onepassword-operator
1
0
Fork 0
mirror of https://github.com/1Password/onepassword-operator.git synced 2025-10-22 07:28:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #170 from mmorejon/add-volumes-projected-detection

Browse Source 
Add volumes projected detection
This commit is contained in:
Jillian W
2023-08-15 11:08:41 -03:00
committed by GitHub
parent a42a96bd26 1e73bc1220
commit 030d451c94
4 changed files with 93 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
pkg/onepassword/deployments_test.go
View File

@@ -11,16 +11,28 @@ func TestIsDeploymentUsingSecretsUsingVolumes(t *testing.T) {
secretNamesToSearch := map[string]*corev1.Secret{
"onepassword-database-secret": {},
"onepassword-api-key": {},
"onepassword-app-token": {},
"onepassword-user-credentials": {},
}
volumeSecretNames := []string{
"onepassword-database-secret",
"onepassword-api-key",
"some_other_key",
}
volumes := generateVolumes(volumeSecretNames)
volumeProjectedSecretNames := []string{
"onepassword-app-token",
"onepassword-user-credentials",
}
volumeProjected := generateVolumesProjected(volumeProjectedSecretNames)
volumes = append(volumes, volumeProjected)
deployment := &appsv1.Deployment{}
deployment.Spec.Template.Spec.Volumes = generateVolumes(volumeSecretNames)
deployment.Spec.Template.Spec.Volumes = volumes
if !IsDeploymentUsingSecrets(deployment, secretNamesToSearch) {
t.Errorf("Expected that deployment was using secrets but they were not detected.")
}

23
pkg/onepassword/object_generators_for_test.go
View File

@@ -17,6 +17,29 @@ func generateVolumes(names []string) []corev1.Volume {
}
return volumes
}
func generateVolumesProjected(names []string) corev1.Volume {
volumesProjection := []corev1.VolumeProjection{}
for i := 0; i < len(names); i++ {
volumeProjection := corev1.VolumeProjection{
Secret: &corev1.SecretProjection{
LocalObjectReference: corev1.LocalObjectReference{
Name: names[i],
},
},
}
volumesProjection = append(volumesProjection, volumeProjection)
}
volume := corev1.Volume{
Name: "someName",
VolumeSource: corev1.VolumeSource{
Projected: &corev1.ProjectedVolumeSource{
Sources: volumesProjection,
},
},
}
return volume
}
func generateContainersWithSecretRefsFromEnv(names []string) []corev1.Container {
containers := []corev1.Container{}
for i := 0; i < len(names); i++ {

53
pkg/onepassword/volumes.go
View File

@@ -4,26 +4,55 @@ import corev1 "k8s.io/api/core/v1"
func AreVolumesUsingSecrets(volumes []corev1.Volume, secrets map[string]*corev1.Secret) bool {
for i := 0; i < len(volumes); i++ {
if secret := volumes[i].Secret; secret != nil {
secretName := secret.SecretName
_, ok := secrets[secretName]
if ok {
return true
}
}
}
secret := IsVolumeUsingSecret(volumes[i], secrets)
secretProjection := IsVolumeUsingSecretProjection(volumes[i], secrets)
if secret == nil && secretProjection == nil {
return false
}
}
if len(volumes) == 0 {
return false
}
return true
}
func AppendUpdatedVolumeSecrets(volumes []corev1.Volume, secrets map[string]*corev1.Secret, updatedDeploymentSecrets map[string]*corev1.Secret) map[string]*corev1.Secret {
for i := 0; i < len(volumes); i++ {
if secret := volumes[i].Secret; secret != nil {
secretName := secret.SecretName
secret, ok := secrets[secretName]
if ok {
secret := IsVolumeUsingSecret(volumes[i], secrets)
if secret != nil {
updatedDeploymentSecrets[secret.Name] = secret
} else {
secretProjection := IsVolumeUsingSecretProjection(volumes[i], secrets)
if secretProjection != nil {
updatedDeploymentSecrets[secretProjection.Name] = secretProjection
}
}
}
return updatedDeploymentSecrets
}
func IsVolumeUsingSecret(volume corev1.Volume, secrets map[string]*corev1.Secret) *corev1.Secret {
if secret := volume.Secret; secret != nil {
secretName := secret.SecretName
secretFound, ok := secrets[secretName]
if ok {
return secretFound
}
}
return nil
}
func IsVolumeUsingSecretProjection(volume corev1.Volume, secrets map[string]*corev1.Secret) *corev1.Secret {
if volume.Projected != nil {
for i := 0; i < len(volume.Projected.Sources); i++ {
if secret := volume.Projected.Sources[i].Secret; secret != nil {
secretName := secret.Name
secretFound, ok := secrets[secretName]
if ok {
return secretFound
}
}
}
}
return nil
}

12
pkg/onepassword/volumes_test.go
View File

@@ -10,16 +10,26 @@ func TestAreVolmesUsingSecrets(t *testing.T) {
secretNamesToSearch := map[string]*corev1.Secret{
"onepassword-database-secret": {},
"onepassword-api-key": {},
"onepassword-app-token": {},
"onepassword-user-credentials": {},
}
volumeSecretNames := []string{
"onepassword-database-secret",
"onepassword-api-key",
"some_other_key",
}
volumes := generateVolumes(volumeSecretNames)
volumeProjectedSecretNames := []string{
"onepassword-app-token",
"onepassword-user-credentials",
}
volumeProjected := generateVolumesProjected(volumeProjectedSecretNames)
volumes = append(volumes, volumeProjected)
if !AreVolumesUsingSecrets(volumes, secretNamesToSearch) {
t.Errorf("Expected that volumes were using secrets but they were not detected.")
}