Skip to content

Commit 7775244

Browse files
author
Elad Ben-Israel
committed
fix(core): names generated using non-FIPS compliant algorithm
The CDK8s name generator (`Names.toLabelValue()` and `Names.toDnsLabel()`) have used sha256, which cannot be used in environments that are FIPS compliant. To fix this, we are now using the [recently introduced](aws/constructs#314) `Node.of(construct).addr` as the hash postfix of generated names. Fixes #334 BREAKING CHANGE: CAUTION! Auto-generated resource names will change with this release. Resource names in manifests synthesized by a previous version of the CDK8s will be invalidated. Deploying new manifests will cause **resources to be replaced**. Temporarily, you can opt to use the legacy hashing mechanism by setting the environment variable `CDK8S_LEGACY_HASH=1`. * **core:** `Names.toDnsLabel()` now accepts a construct scope instead of a string path, and a set of options instead of `maxLen`. * **core:** `Names.toLabelValue()` now accepts a construct scope instead of a string path, and a set of options instead of `maxLen`.
1 parent a8337e8 commit 7775244

28 files changed

+489
-249
lines changed

‎packages/cdk8s-cli/package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@
5353
"@types/node": "^10.17.0",
5454
"cdk8s": "0.0.0",
5555
"codemaker": "^1.14.1",
56-
"constructs": "3.0.4",
56+
"constructs": "3.2.34",
5757
"fs-extra": "^8.1.0",
5858
"jsii-pacmak": "^1.14.1",
5959
"jsii-srcmak": "^0.1.36",

‎packages/cdk8s-plus-17/API.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -627,7 +627,7 @@ addRules(...rules: IngressV1Beta1Rule[]): void
627627

628628
#### protected onValidate()🔹 <a id="cdk8s-plus-17-ingressv1beta1-onvalidate"></a>
629629

630-
Validate the current construct.
630+
(deprecated) Validate the current construct.
631631

632632
This method can be implemented by derived constructs in order to perform
633633
validation logic. It is called on all constructs before synthesis.

‎packages/cdk8s-plus-17/package.json

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -38,16 +38,16 @@
3838
"@typescript-eslint/eslint-plugin": "^4.3.0",
3939
"@typescript-eslint/parser": "^4.3.0",
4040
"cdk8s": "^0.0.0",
41-
"constructs": "3.0.4",
41+
"constructs": "3.2.34",
4242
"eslint": "^6.8.0",
4343
"eslint-import-resolver-node": "^0.3.3",
4444
"eslint-import-resolver-typescript": "^2.0.0",
4545
"eslint-plugin-import": "^2.20.2",
4646
"jest": "^26.4.2",
47-
"jsii": "^1.9.0",
48-
"jsii-diff": "^1.9.0",
47+
"jsii": "^1.14.1",
48+
"jsii-diff": "^1.14.1",
4949
"jsii-docgen": "^1.3.2",
50-
"jsii-pacmak": "^1.9.0",
50+
"jsii-pacmak": "^1.14.1",
5151
"json-schema": "^0.2.5",
5252
"projen": "^0.3.168",
5353
"standard-version": "^9.0.0",
@@ -56,7 +56,7 @@
5656
},
5757
"peerDependencies": {
5858
"cdk8s": "^0.0.0",
59-
"constructs": "^3.0.4"
59+
"constructs": "^3.2.34"
6060
},
6161
"dependencies": {
6262
"minimatch": "^3.0.4"

‎packages/cdk8s-plus-17/src/deployment.ts

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
import { ApiObject, ApiObjectMetadataDefinition, Lazy, Names } from 'cdk8s';
2-
import { Construct, Node } from 'constructs';
2+
import { Construct } from 'constructs';
33
import { Resource, ResourceProps } from './base';
44
import { Container, ContainerProps } from './container';
55
import * as k8s from './imports/k8s';
@@ -124,7 +124,7 @@ export class Deployment extends Resource implements IPodTemplate {
124124

125125
if (props.defaultSelector ?? true) {
126126
const selector = 'cdk8s.deployment';
127-
const matcher = Names.toLabelValue(Node.of(this).path);
127+
const matcher = Names.toLabelValue(this);
128128
this.podMetadata.addLabel(selector, matcher);
129129
this.selectByLabel(selector, matcher);
130130
}

‎packages/cdk8s-plus-17/test/__snapshots__/config-map.test.ts.snap

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ Array [
99
},
1010
"kind": "ConfigMap",
1111
"metadata": Object {
12-
"name": "test-my-config-map-91419662",
12+
"name": "test-my-config-map-c8eaefa4",
1313
},
1414
},
1515
]
@@ -25,7 +25,7 @@ Array [
2525
},
2626
"kind": "ConfigMap",
2727
"metadata": Object {
28-
"name": "test-my-config-map-91419662",
28+
"name": "test-my-config-map-c8eaefa4",
2929
},
3030
},
3131
]
@@ -41,7 +41,7 @@ Array [
4141
},
4242
"kind": "ConfigMap",
4343
"metadata": Object {
44-
"name": "test-my-config-map-91419662",
44+
"name": "test-my-config-map-c8eaefa4",
4545
},
4646
},
4747
]
@@ -56,7 +56,7 @@ Array [
5656
},
5757
"kind": "ConfigMap",
5858
"metadata": Object {
59-
"name": "test-my-config-map-91419662",
59+
"name": "test-my-config-map-c8eaefa4",
6060
},
6161
},
6262
]
@@ -72,7 +72,7 @@ Array [
7272
},
7373
"kind": "ConfigMap",
7474
"metadata": Object {
75-
"name": "test-my-config-map-91419662",
75+
"name": "test-my-config-map-c8eaefa4",
7676
},
7777
},
7878
]

‎packages/cdk8s-plus-17/test/config-map.test.ts

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ test('minimal', () => {
2525
apiVersion: 'v1',
2626
kind: 'ConfigMap',
2727
metadata: {
28-
name: 'test-my-config-map-91419662',
28+
name: 'test-my-config-map-c8eaefa4',
2929
},
3030
},
3131
]);
@@ -53,7 +53,7 @@ test('with data', () => {
5353
key2: 'bar',
5454
},
5555
metadata: {
56-
name: 'test-my-config-map-91419662',
56+
name: 'test-my-config-map-c8eaefa4',
5757
},
5858
},
5959
]);
@@ -81,7 +81,7 @@ test('with binaryData', () => {
8181
key2: 'bar',
8282
},
8383
metadata: {
84-
name: 'test-my-config-map-91419662',
84+
name: 'test-my-config-map-c8eaefa4',
8585
},
8686
},
8787
]);
@@ -115,7 +115,7 @@ test('with binaryData and data', () => {
115115
key2: 'bar',
116116
},
117117
metadata: {
118-
name: 'test-my-config-map-91419662',
118+
name: 'test-my-config-map-c8eaefa4',
119119
},
120120
},
121121
]);
@@ -174,7 +174,7 @@ test('addData()/addBinaryDataq() can be used to add data', () => {
174174
},
175175
kind: 'ConfigMap',
176176
metadata: {
177-
name: 'test-my-config-map-91419662',
177+
name: 'test-my-config-map-c8eaefa4',
178178
},
179179
},
180180
]);

‎packages/cdk8s-plus-17/test/deployment.test.ts

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ test('A label selector is automatically allocated', () => {
1919
const deployment = new kplus.Deployment(chart, 'Deployment');
2020
deployment.addContainer({ image: 'foobar' });
2121

22-
const expectedValue = 'test-Deployment-9e0110cd';
22+
const expectedValue = 'test-Deployment-c83f5e59';
2323
const expectedSelector = { 'cdk8s.deployment': expectedValue };
2424

2525
// assert the k8s spec has it.
@@ -94,7 +94,7 @@ test('Can be exposed as via service', () => {
9494

9595
const spec = Testing.synth(chart)[1].spec;
9696
expect(spec.type).toEqual('LoadBalancer');
97-
expect(spec.selector).toEqual({ 'cdk8s.deployment': 'test-Deployment-9e0110cd' });
97+
expect(spec.selector).toEqual({ 'cdk8s.deployment': 'test-Deployment-c83f5e59' });
9898
expect(spec.ports![0].port).toEqual(9200);
9999
expect(spec.ports![0].targetPort).toEqual(9300);
100100

@@ -149,7 +149,7 @@ test('Expose can set service and port details', () => {
149149
expect(srv.metadata.name).toEqual('test-srv');
150150
expect(spec.type).toEqual('ClusterIP');
151151
expect(spec.selector).toEqual({
152-
'cdk8s.deployment': 'test-Deployment-9e0110cd',
152+
'cdk8s.deployment': 'test-Deployment-c83f5e59',
153153
});
154154
expect(spec.ports![0].port).toEqual(9200);
155155
expect(spec.ports![0].targetPort).toEqual(9500);

‎packages/cdk8s-plus-17/test/ingress-v1beta1.test.ts

Lines changed: 19 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ describe('IngressBackend', () => {
2424

2525
// THEN
2626
expect(IngressV1Beta1Backend.fromService(service)._toKube()).toEqual({
27-
serviceName: 'test-my-service-72ba846b',
27+
serviceName: 'test-my-service-c8493104',
2828
servicePort: 8899,
2929
});
3030
});
@@ -61,7 +61,7 @@ describe('IngressBackend', () => {
6161

6262
// THEN
6363
expect(IngressV1Beta1Backend.fromService(service, { port: 6011 })._toKube()).toEqual({
64-
serviceName: 'test-my-service-72ba846b',
64+
serviceName: 'test-my-service-c8493104',
6565
servicePort: 6011,
6666
});
6767
});
@@ -78,7 +78,7 @@ describe('IngressBackend', () => {
7878

7979
// THEN
8080
expect(IngressV1Beta1Backend.fromService(service, { port: 8899 })._toKube()).toEqual({
81-
serviceName: 'test-my-service-72ba846b',
81+
serviceName: 'test-my-service-c8493104',
8282
servicePort: 8899,
8383
});
8484
});
@@ -130,10 +130,10 @@ describe('Ingress', () => {
130130
{
131131
apiVersion: 'networking.k8s.io/v1beta1',
132132
kind: 'Ingress',
133-
metadata: { name: 'test-my-ingress-e859c4c6' },
133+
metadata: { name: 'test-my-ingress-c8135042' },
134134
spec: {
135135
backend: {
136-
serviceName: 'test-my-service-72ba846b',
136+
serviceName: 'test-my-service-c8493104',
137137
servicePort: 80,
138138
},
139139
},
@@ -155,10 +155,10 @@ describe('Ingress', () => {
155155
{
156156
apiVersion: 'networking.k8s.io/v1beta1',
157157
kind: 'Ingress',
158-
metadata: { name: 'test-my-ingress-e859c4c6' },
158+
metadata: { name: 'test-my-ingress-c8135042' },
159159
spec: {
160160
backend: {
161-
serviceName: 'test-my-service-72ba846b',
161+
serviceName: 'test-my-service-c8493104',
162162
servicePort: 80,
163163
},
164164
},
@@ -182,15 +182,15 @@ describe('Ingress', () => {
182182
{
183183
apiVersion: 'networking.k8s.io/v1beta1',
184184
kind: 'Ingress',
185-
metadata: { name: 'test-my-ingress-e859c4c6' },
185+
metadata: { name: 'test-my-ingress-c8135042' },
186186
spec: {
187187
rules: [{
188188
host: 'my.host',
189189
http: {
190190
paths: [
191191
{
192192
backend: {
193-
serviceName: 'test-my-service-72ba846b',
193+
serviceName: 'test-my-service-c8493104',
194194
servicePort: 80,
195195
},
196196
},
@@ -219,7 +219,7 @@ describe('Ingress', () => {
219219
{
220220
apiVersion: 'networking.k8s.io/v1beta1',
221221
kind: 'Ingress',
222-
metadata: { name: 'test-my-ingress-e859c4c6' },
222+
metadata: { name: 'test-my-ingress-c8135042' },
223223
spec: {
224224
rules: [
225225
{
@@ -229,14 +229,14 @@ describe('Ingress', () => {
229229
{
230230
path: '/bar',
231231
backend: {
232-
serviceName: 'test-my-service-72ba846b',
232+
serviceName: 'test-my-service-c8493104',
233233
servicePort: 80,
234234
},
235235
},
236236
{
237237
path: '/foo',
238238
backend: {
239-
serviceName: 'test-my-service-72ba846b',
239+
serviceName: 'test-my-service-c8493104',
240240
servicePort: 80,
241241
},
242242
},
@@ -249,14 +249,14 @@ describe('Ingress', () => {
249249
paths: [
250250
{
251251
backend: {
252-
serviceName: 'test-my-service-72ba846b',
252+
serviceName: 'test-my-service-c8493104',
253253
servicePort: 80,
254254
},
255255
},
256256
{
257257
path: '/',
258258
backend: {
259-
serviceName: 'test-my-service-72ba846b',
259+
serviceName: 'test-my-service-c8493104',
260260
servicePort: 80,
261261
},
262262
},
@@ -284,7 +284,7 @@ describe('Ingress', () => {
284284
{
285285
apiVersion: 'networking.k8s.io/v1beta1',
286286
kind: 'Ingress',
287-
metadata: { name: 'test-my-ingress-e859c4c6' },
287+
metadata: { name: 'test-my-ingress-c8135042' },
288288
spec: {
289289
rules: [
290290
{
@@ -293,14 +293,14 @@ describe('Ingress', () => {
293293
{
294294
path: '/foo',
295295
backend: {
296-
serviceName: 'test-my-service-72ba846b',
296+
serviceName: 'test-my-service-c8493104',
297297
servicePort: 80,
298298
},
299299
},
300300
{
301301
path: '/foo/bar',
302302
backend: {
303-
serviceName: 'test-my-service-72ba846b',
303+
serviceName: 'test-my-service-c8493104',
304304
servicePort: 80,
305305
},
306306
},
@@ -331,13 +331,13 @@ describe('Ingress', () => {
331331
});
332332

333333
// THEN
334-
const expectedBackend = { serviceName: 'test-my-service-72ba846b', servicePort: 4000 };
334+
const expectedBackend = { serviceName: 'test-my-service-c8493104', servicePort: 4000 };
335335
expect(Testing.synth(chart).filter(x => x.kind === 'Ingress')).toEqual([
336336
{
337337
apiVersion: 'networking.k8s.io/v1beta1',
338338
kind: 'Ingress',
339339
metadata: {
340-
name: 'test-my-ingress-e859c4c6',
340+
name: 'test-my-ingress-c8135042',
341341
},
342342
spec: {
343343
backend: expectedBackend,

‎packages/cdk8s-plus-17/test/secret.test.ts

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,35 @@
1-
import { Testing, ApiObject } from 'cdk8s';
2-
import { Node } from 'constructs';
3-
import * as kplus from '../src';
1+
import { Testing, ApiObject } from "cdk8s";
2+
import { Node } from "constructs";
3+
import * as kplus from "../src";
44

5-
test('defaultChild', () => {
5+
test("defaultChild", () => {
66
const chart = Testing.chart();
77

8-
const defaultChild = Node.of(new kplus.Secret(chart, 'Secret')).defaultChild as ApiObject;
9-
10-
expect(defaultChild.kind).toEqual('Secret');
8+
const defaultChild = Node.of(new kplus.Secret(chart, "Secret"))
9+
.defaultChild as ApiObject;
1110

11+
expect(defaultChild.kind).toEqual("Secret");
1212
});
1313

14-
test('Can be imported from secret name', () => {
15-
const secret = kplus.Secret.fromSecretName('secret');
14+
test("Can be imported from secret name", () => {
15+
const secret = kplus.Secret.fromSecretName("secret");
1616

17-
expect(secret.name).toEqual('secret');
17+
expect(secret.name).toEqual("secret");
1818
});
1919

20-
test('Can add data to new secrets', () => {
20+
test("Can add data to new secrets", () => {
2121
const chart = Testing.chart();
2222

23-
const secret = new kplus.Secret(chart, 'Secret');
24-
secret.addStringData('key', 'value');
23+
const secret = new kplus.Secret(chart, "Secret");
24+
secret.addStringData("key", "value");
2525

2626
expect(Testing.synth(chart)).toMatchInlineSnapshot(`
2727
Array [
2828
Object {
2929
"apiVersion": "v1",
3030
"kind": "Secret",
3131
"metadata": Object {
32-
"name": "test-secret-17f996fa",
32+
"name": "test-secret-c837fa76",
3333
},
3434
"stringData": Object {
3535
"key": "value",

0 commit comments

Comments
 (0)