forked from coop-cloud/abra
283 lines
7.2 KiB
Go
283 lines
7.2 KiB
Go
// Package secret provides functionality for generating and storing secrets
|
|
// both in a remote swarm and locally within supported storage such as pass
|
|
// stores.
|
|
package secret
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"slices"
|
|
"strconv"
|
|
"strings"
|
|
"sync"
|
|
|
|
"coopcloud.tech/abra/pkg/client"
|
|
"coopcloud.tech/abra/pkg/config"
|
|
"coopcloud.tech/abra/pkg/upstream/stack"
|
|
loader "coopcloud.tech/abra/pkg/upstream/stack"
|
|
"github.com/decentral1se/passgen"
|
|
"github.com/docker/docker/api/types"
|
|
dockerClient "github.com/docker/docker/client"
|
|
"github.com/sirupsen/logrus"
|
|
)
|
|
|
|
// secretValue represents a parsed `SECRET_FOO=v1 # length=bar` env var config
|
|
// secret definition.
|
|
type secretValue struct {
|
|
Version string
|
|
Length int
|
|
}
|
|
|
|
// GeneratePasswords generates passwords.
|
|
func GeneratePasswords(count, length uint) ([]string, error) {
|
|
passwords, err := passgen.GeneratePasswords(
|
|
count,
|
|
length,
|
|
passgen.AlphabetDefault,
|
|
)
|
|
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
logrus.Debugf("generated %s", strings.Join(passwords, ", "))
|
|
|
|
return passwords, nil
|
|
}
|
|
|
|
// GeneratePassphrases generates human readable and rememberable passphrases.
|
|
func GeneratePassphrases(count uint) ([]string, error) {
|
|
passphrases, err := passgen.GeneratePassphrases(
|
|
count,
|
|
passgen.PassphraseWordCountDefault,
|
|
rune('-'),
|
|
passgen.PassphraseCasingDefault,
|
|
passgen.WordListDefault,
|
|
)
|
|
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
logrus.Debugf("generated %s", strings.Join(passphrases, ", "))
|
|
|
|
return passphrases, nil
|
|
}
|
|
|
|
// ReadSecretsConfig reads secret names/versions from the recipe config. The
|
|
// function generalises appEnv/composeFiles because some times you have an app
|
|
// and some times you don't (as the caller). We need to be able to handle the
|
|
// "app new" case where we pass in the .env.sample and the "secret generate"
|
|
// case where the app is created.
|
|
func ReadSecretsConfig(appEnvPath string, composeFiles []string, recipeName string) (map[string]string, error) {
|
|
secretConfigs := make(map[string]string)
|
|
|
|
appEnv, err := config.ReadEnv(appEnvPath, config.ReadEnvOptions{IncludeModifiers: true})
|
|
if err != nil {
|
|
return secretConfigs, err
|
|
}
|
|
|
|
opts := stack.Deploy{Composefiles: composeFiles}
|
|
config, err := loader.LoadComposefile(opts, appEnv)
|
|
if err != nil {
|
|
return secretConfigs, err
|
|
}
|
|
|
|
var enabledSecrets []string
|
|
for _, service := range config.Services {
|
|
for _, secret := range service.Secrets {
|
|
enabledSecrets = append(enabledSecrets, secret.Source)
|
|
}
|
|
}
|
|
|
|
if len(enabledSecrets) == 0 {
|
|
logrus.Debugf("not generating app secrets, none enabled in recipe config")
|
|
return secretConfigs, nil
|
|
}
|
|
|
|
for secretId, secretConfig := range config.Secrets {
|
|
if string(secretConfig.Name[len(secretConfig.Name)-1]) == "_" {
|
|
return secretConfigs, fmt.Errorf("missing version for secret? (%s)", secretId)
|
|
}
|
|
|
|
if !(slices.Contains(enabledSecrets, secretId)) {
|
|
logrus.Warnf("%s not enabled in recipe config, skipping", secretId)
|
|
continue
|
|
}
|
|
|
|
lastIdx := strings.LastIndex(secretConfig.Name, "_")
|
|
secretVersion := secretConfig.Name[lastIdx+1:]
|
|
secretConfigs[secretId] = secretVersion
|
|
}
|
|
|
|
return secretConfigs, nil
|
|
}
|
|
|
|
func ParseSecretValue(secret string) (secretValue, error) {
|
|
values := strings.Split(secret, "#")
|
|
if len(values) == 0 {
|
|
return secretValue{}, fmt.Errorf("unable to parse %s", secret)
|
|
}
|
|
|
|
if len(values) == 1 {
|
|
return secretValue{Version: values[0], Length: 0}, nil
|
|
}
|
|
|
|
split := strings.Split(values[1], "=")
|
|
parsed := split[len(split)-1]
|
|
stripped := strings.ReplaceAll(parsed, " ", "")
|
|
length, err := strconv.Atoi(stripped)
|
|
if err != nil {
|
|
return secretValue{}, err
|
|
}
|
|
version := strings.ReplaceAll(values[0], " ", "")
|
|
|
|
logrus.Debugf("parsed version %s and length '%v' from %s", version, length, secret)
|
|
|
|
return secretValue{Version: version, Length: length}, nil
|
|
}
|
|
|
|
// GenerateSecrets generates secrets locally and sends them to a remote server for storage.
|
|
func GenerateSecrets(cl *dockerClient.Client, secretsFromConfig map[string]string, appName, server string) (map[string]string, error) {
|
|
secrets := make(map[string]string)
|
|
|
|
var mutex sync.Mutex
|
|
var wg sync.WaitGroup
|
|
ch := make(chan error, len(secretsFromConfig))
|
|
for n, v := range secretsFromConfig {
|
|
wg.Add(1)
|
|
|
|
go func(secretName, secretValue string) {
|
|
defer wg.Done()
|
|
|
|
parsedSecretValue, err := ParseSecretValue(secretValue)
|
|
if err != nil {
|
|
ch <- err
|
|
return
|
|
}
|
|
|
|
secretRemoteName := fmt.Sprintf("%s_%s_%s", appName, secretName, parsedSecretValue.Version)
|
|
logrus.Debugf("attempting to generate and store %s on %s", secretRemoteName, server)
|
|
|
|
if parsedSecretValue.Length > 0 {
|
|
passwords, err := GeneratePasswords(1, uint(parsedSecretValue.Length))
|
|
if err != nil {
|
|
ch <- err
|
|
return
|
|
}
|
|
|
|
if err := client.StoreSecret(cl, secretRemoteName, passwords[0], server); err != nil {
|
|
if strings.Contains(err.Error(), "AlreadyExists") {
|
|
logrus.Warnf("%s already exists, moving on...", secretRemoteName)
|
|
ch <- nil
|
|
} else {
|
|
ch <- err
|
|
}
|
|
return
|
|
}
|
|
|
|
mutex.Lock()
|
|
defer mutex.Unlock()
|
|
secrets[secretName] = passwords[0]
|
|
} else {
|
|
passphrases, err := GeneratePassphrases(1)
|
|
if err != nil {
|
|
ch <- err
|
|
return
|
|
}
|
|
|
|
if err := client.StoreSecret(cl, secretRemoteName, passphrases[0], server); err != nil {
|
|
if strings.Contains(err.Error(), "AlreadyExists") {
|
|
logrus.Warnf("%s already exists, moving on...", secretRemoteName)
|
|
ch <- nil
|
|
} else {
|
|
ch <- err
|
|
}
|
|
return
|
|
}
|
|
|
|
mutex.Lock()
|
|
defer mutex.Unlock()
|
|
secrets[secretName] = passphrases[0]
|
|
}
|
|
ch <- nil
|
|
}(n, v)
|
|
}
|
|
|
|
wg.Wait()
|
|
|
|
for range secretsFromConfig {
|
|
err := <-ch
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
}
|
|
|
|
logrus.Debugf("generated and stored %s on %s", secrets, server)
|
|
|
|
return secrets, nil
|
|
}
|
|
|
|
type secretStatus struct {
|
|
LocalName string
|
|
RemoteName string
|
|
Version string
|
|
CreatedOnRemote bool
|
|
}
|
|
|
|
type secretStatuses []secretStatus
|
|
|
|
// PollSecretsStatus checks status of secrets by comparing the local recipe
|
|
// config and deploymend server state.
|
|
func PollSecretsStatus(cl *dockerClient.Client, app config.App) (secretStatuses, error) {
|
|
var secStats secretStatuses
|
|
|
|
composeFiles, err := config.GetComposeFiles(app.Recipe, app.Env)
|
|
if err != nil {
|
|
return secStats, err
|
|
}
|
|
|
|
secretsConfig, err := ReadSecretsConfig(app.Path, composeFiles, app.Recipe)
|
|
if err != nil {
|
|
return secStats, err
|
|
}
|
|
|
|
filters, err := app.Filters(false, false)
|
|
if err != nil {
|
|
return secStats, err
|
|
}
|
|
|
|
secretList, err := cl.SecretList(context.Background(), types.SecretListOptions{Filters: filters})
|
|
if err != nil {
|
|
return secStats, err
|
|
}
|
|
|
|
remoteSecretNames := make(map[string]bool)
|
|
for _, cont := range secretList {
|
|
remoteSecretNames[cont.Spec.Annotations.Name] = true
|
|
}
|
|
|
|
for secretName, secretValue := range secretsConfig {
|
|
createdRemote := false
|
|
|
|
val, err := ParseSecretValue(secretValue)
|
|
if err != nil {
|
|
return secStats, err
|
|
}
|
|
|
|
secretRemoteName := fmt.Sprintf("%s_%s_%s", app.StackName(), secretName, val.Version)
|
|
if _, ok := remoteSecretNames[secretRemoteName]; ok {
|
|
createdRemote = true
|
|
}
|
|
|
|
secStats = append(secStats, secretStatus{
|
|
LocalName: secretName,
|
|
RemoteName: secretRemoteName,
|
|
Version: val.Version,
|
|
CreatedOnRemote: createdRemote,
|
|
})
|
|
}
|
|
|
|
return secStats, nil
|
|
}
|