Skip to content

Commit 54edca0

Browse files
tremesRicardo Lüders
tremes
and
Ricardo Lüders
authored
[release-4.8] Bug 2020601: Anonymize the ImageRegistry storage information also in status (#536)
* [release-4.8] Bug 2020601: Anonymize the ImageRegistry storage information also in (#507) * Bug 2005771: Anonymize the ImageRegistry storage information also in status * Update test * Lint * Replacing deprecated ioutil (#532) * refactor: replacing deprecated ioutil * style: fixing lint issues * fix: lint and error handling * fix: govet err shadow declaration * fix: ignore fileInfo error on prune Co-authored-by: Ricardo Lüders <[email protected]>
1 parent 0406b5e commit 54edca0

File tree

13 files changed

+155
-88
lines changed

13 files changed

+155
-88
lines changed

‎cmd/changelog/main.go

+11-7
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import (
44
"context"
55
"encoding/json"
66
"fmt"
7-
"io/ioutil"
7+
"io"
88
"log"
99
"net/http"
1010
"os"
@@ -77,8 +77,8 @@ func createPullRequestLink(id string) string {
7777
func main() {
7878
log.SetFlags(0)
7979
if len(os.Args) != 1 && len(os.Args) != 3 {
80-
log.Fatalf(`Either specify two date arguments, AFTER and UNTIL,
81-
to create a brand new CHANGELOG, or call it without arguments to
80+
log.Fatalf(`Either specify two date arguments, AFTER and UNTIL,
81+
to create a brand new CHANGELOG, or call it without arguments to
8282
update the current one with new changes.`)
8383
}
8484
gitHubToken = os.Getenv("GITHUB_TOKEN")
@@ -120,7 +120,7 @@ type MarkdownReleaseBlock struct {
120120

121121
func readCHANGELOG() map[string]MarkdownReleaseBlock {
122122
releaseBlocks := make(map[string]MarkdownReleaseBlock)
123-
rawBytes, _ := ioutil.ReadFile("./CHANGELOG.md")
123+
rawBytes, _ := os.ReadFile("./CHANGELOG.md")
124124
rawString := string(rawBytes)
125125
if match := latestHashRegexp.FindStringSubmatch(rawString); len(match) > 0 {
126126
latestHash = match[1]
@@ -181,7 +181,7 @@ func updateToMarkdownReleaseBlock(releaseBlocks map[string]MarkdownReleaseBlock,
181181
func createCHANGELOG(releaseBlocks map[string]MarkdownReleaseBlock) {
182182
file, _ := os.Create("CHANGELOG.md")
183183
defer file.Close()
184-
_, _ = file.WriteString(`# Note: This CHANGELOG is only for the changes in insights operator.
184+
_, _ = file.WriteString(`# Note: This CHANGELOG is only for the changes in insights operator.
185185
Please see OpenShift release notes for official changes\n`)
186186
_, _ = file.WriteString(fmt.Sprintf("<!--Latest hash: %s-->\n", latestHash))
187187
var releases []string
@@ -231,7 +231,11 @@ func getPullRequestFromGitHub(id string) *Change {
231231
// There is a limit for the GitHub API, if you use auth then its 5000/hour
232232
var bearer = "token " + gitHubToken
233233

234-
req, err := http.NewRequestWithContext(context.Background(), "GET", fmt.Sprintf(gitHubAPIFormat, gitHubRepoOwner, gitHubRepo, id), nil)
234+
req, err := http.NewRequestWithContext(
235+
context.Background(),
236+
"GET",
237+
fmt.Sprintf(gitHubAPIFormat, gitHubRepoOwner, gitHubRepo, id),
238+
http.NoBody)
235239
if err != nil {
236240
log.Fatalf(err.Error())
237241
}
@@ -242,7 +246,7 @@ func getPullRequestFromGitHub(id string) *Change {
242246
log.Fatalf(err.Error())
243247
}
244248
defer resp.Body.Close()
245-
body, err := ioutil.ReadAll(resp.Body)
249+
body, err := io.ReadAll(resp.Body)
246250
if err != nil {
247251
defer log.Fatalf(err.Error())
248252
return nil

‎cmd/gendoc/main.go

+1-2
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import (
66
"go/ast"
77
"go/parser"
88
"go/token"
9-
"io/ioutil"
109
"log"
1110
"math/rand"
1211
"os"
@@ -218,7 +217,7 @@ func findGoMod(pkgFilePath string) (goModPath, relPkgPath string, err error) {
218217

219218
// getModuleNameFromGoMod parses the go.mod file and returns the name (URL) of the module.
220219
func getModuleNameFromGoMod(goModPath string) (string, error) {
221-
goModBytes, err := ioutil.ReadFile(goModPath)
220+
goModBytes, err := os.ReadFile(goModPath)
222221
if err != nil {
223222
return "", err
224223
}

‎pkg/cmd/start/start.go

+2-3
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package start
22

33
import (
44
"context"
5-
"io/ioutil"
65
"math/rand"
76
"os"
87
"time"
@@ -83,7 +82,7 @@ func runGather(operator *controller.GatherJob, cfg *controllercmd.ControllerComm
8382

8483
var clientConfig *rest.Config
8584
if kubeConfigPath := cmd.Flags().Lookup("kubeconfig").Value.String(); len(kubeConfigPath) > 0 {
86-
kubeConfigBytes, err := ioutil.ReadFile(kubeConfigPath) //nolint: govet
85+
kubeConfigBytes, err := os.ReadFile(kubeConfigPath) //nolint: govet
8786
if err != nil {
8887
klog.Fatal(err)
8988
}
@@ -139,7 +138,7 @@ func runOperator(operator *controller.Operator, cfg *controllercmd.ControllerCom
139138
}
140139

141140
// if the service CA is rotated, we want to restart
142-
if data, err := ioutil.ReadFile(serviceCACertPath); err == nil {
141+
if data, err := os.ReadFile(serviceCACertPath); err == nil {
143142
startingFileContent[serviceCACertPath] = data
144143
} else {
145144
klog.V(4).Infof("Unable to read service ca bundle: %v", err)

‎pkg/gatherers/clusterconfig/certificate_signing_requests_test.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ package clusterconfig
33
import (
44
"encoding/json"
55
"fmt"
6-
"io/ioutil"
6+
"io"
77
"os"
88
"reflect"
99
"testing"
@@ -33,7 +33,7 @@ func Test_CSR(t *testing.T) {
3333
t.Fatal("test failed to unmarshal csr data", err)
3434
}
3535
defer f.Close()
36-
bts, err := ioutil.ReadAll(f)
36+
bts, err := io.ReadAll(f)
3737
if err != nil {
3838
t.Fatal("error reading test data file", err)
3939
}
@@ -48,7 +48,7 @@ func Test_CSR(t *testing.T) {
4848
t.Fatal("test failed to unmarshal csr anonymized data", err)
4949
}
5050
defer f.Close()
51-
bts, err = ioutil.ReadAll(f)
51+
bts, err = io.ReadAll(f)
5252
if err != nil {
5353
t.Fatal("error reading test data file", err)
5454
}

‎pkg/gatherers/clusterconfig/config_maps_test.go

+4-3
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,11 @@
11
package clusterconfig
22

33
import (
4+
"bytes"
45
"context"
56
"encoding/json"
67
"fmt"
7-
"io/ioutil"
8+
"io"
89
"os"
910
"strings"
1011
"testing"
@@ -86,7 +87,7 @@ func Test_ConfigMap_Anonymizer(t *testing.T) {
8687
mustNotFail(t, err, "unmarshaling of expected failed %+v")
8788
exp, err := json.Marshal(d)
8889
mustNotFail(t, err, "marshaling of expected failed %+v")
89-
if string(exp) != string(md) {
90+
if !bytes.Equal(exp, md) {
9091
t.Fatalf("The test %s result is unexpected. Result: \n%s \nExpected \n%s", tt.testName, string(md), string(exp))
9192
}
9293
})
@@ -119,7 +120,7 @@ func readConfigMapsTestData() (*corev1.ConfigMapList, error) {
119120

120121
defer f.Close()
121122

122-
bts, err := ioutil.ReadAll(f)
123+
bts, err := io.ReadAll(f)
123124
if err != nil {
124125
return nil, fmt.Errorf("error reading test data file %+v ", err)
125126
}

‎pkg/gatherers/clusterconfig/image_registries.go

+54-16
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ import (
1919
"github.com/openshift/insights-operator/pkg/utils/anonymize"
2020
)
2121

22+
var lacAnnotation = "kubectl.kubernetes.io/last-applied-configuration"
23+
2224
// GatherClusterImageRegistry fetches the cluster Image Registry configuration
2325
//
2426
// **Conditional data**: If the Image Registry configuration uses any PersistentVolumeClaim for the storage, the corresponding
@@ -120,28 +122,64 @@ func findPVByPVCName(ctx context.Context, coreClient corev1client.CoreV1Interfac
120122
func anonymizeImageRegistry(config *registryv1.Config) *registryv1.Config {
121123
config.Spec.HTTPSecret = anonymize.String(config.Spec.HTTPSecret)
122124
if config.Spec.Storage.S3 != nil {
123-
config.Spec.Storage.S3.Bucket = anonymize.String(config.Spec.Storage.S3.Bucket)
124-
config.Spec.Storage.S3.KeyID = anonymize.String(config.Spec.Storage.S3.KeyID)
125-
config.Spec.Storage.S3.RegionEndpoint = anonymize.String(config.Spec.Storage.S3.RegionEndpoint)
126-
config.Spec.Storage.S3.Region = anonymize.String(config.Spec.Storage.S3.Region)
125+
anonymizeS3Storage(config.Spec.Storage.S3)
127126
}
128127
if config.Spec.Storage.Azure != nil {
129-
config.Spec.Storage.Azure.AccountName = anonymize.String(config.Spec.Storage.Azure.AccountName)
130-
config.Spec.Storage.Azure.Container = anonymize.String(config.Spec.Storage.Azure.Container)
128+
anonymizeAzureStorage(config.Spec.Storage.Azure)
131129
}
132130
if config.Spec.Storage.GCS != nil {
133-
config.Spec.Storage.GCS.Bucket = anonymize.String(config.Spec.Storage.GCS.Bucket)
134-
config.Spec.Storage.GCS.ProjectID = anonymize.String(config.Spec.Storage.GCS.ProjectID)
135-
config.Spec.Storage.GCS.KeyID = anonymize.String(config.Spec.Storage.GCS.KeyID)
131+
anonymizeGCSStorage(config.Spec.Storage.GCS)
136132
}
137133
if config.Spec.Storage.Swift != nil {
138-
config.Spec.Storage.Swift.AuthURL = anonymize.String(config.Spec.Storage.Swift.AuthURL)
139-
config.Spec.Storage.Swift.Container = anonymize.String(config.Spec.Storage.Swift.Container)
140-
config.Spec.Storage.Swift.Domain = anonymize.String(config.Spec.Storage.Swift.Domain)
141-
config.Spec.Storage.Swift.DomainID = anonymize.String(config.Spec.Storage.Swift.DomainID)
142-
config.Spec.Storage.Swift.Tenant = anonymize.String(config.Spec.Storage.Swift.Tenant)
143-
config.Spec.Storage.Swift.TenantID = anonymize.String(config.Spec.Storage.Swift.TenantID)
144-
config.Spec.Storage.Swift.RegionName = anonymize.String(config.Spec.Storage.Swift.RegionName)
134+
anonymizeSwiftStorage(config.Spec.Storage.Swift)
135+
}
136+
if config.Status.Storage.S3 != nil {
137+
anonymizeS3Storage(config.Status.Storage.S3)
138+
}
139+
if config.Status.Storage.GCS != nil {
140+
anonymizeGCSStorage(config.Status.Storage.GCS)
141+
}
142+
if config.Status.Storage.Azure != nil {
143+
anonymizeAzureStorage(config.Status.Storage.Azure)
145144
}
145+
if config.Status.Storage.Swift != nil {
146+
anonymizeSwiftStorage(config.Status.Storage.Swift)
147+
}
148+
// kubectl.kubernetes.io/last-applied-configuration annotation contains complete previous resource definition
149+
// including the sensitive information as bucket, keyIDs, etc.
150+
if lac, ok := config.Annotations[lacAnnotation]; ok {
151+
config.Annotations[lacAnnotation] = anonymize.String(lac)
152+
}
153+
146154
return config
147155
}
156+
157+
func anonymizeS3Storage(s3Storage *registryv1.ImageRegistryConfigStorageS3) {
158+
s3Storage.Bucket = anonymize.String(s3Storage.Bucket)
159+
s3Storage.KeyID = anonymize.String(s3Storage.KeyID)
160+
s3Storage.RegionEndpoint = anonymize.String(s3Storage.RegionEndpoint)
161+
s3Storage.Region = anonymize.String(s3Storage.Region)
162+
}
163+
164+
func anonymizeGCSStorage(gcsStorage *registryv1.ImageRegistryConfigStorageGCS) {
165+
gcsStorage.Bucket = anonymize.String(gcsStorage.Bucket)
166+
gcsStorage.KeyID = anonymize.String(gcsStorage.KeyID)
167+
gcsStorage.ProjectID = anonymize.String(gcsStorage.ProjectID)
168+
gcsStorage.Region = anonymize.String(gcsStorage.Region)
169+
}
170+
171+
func anonymizeAzureStorage(azureStorage *registryv1.ImageRegistryConfigStorageAzure) {
172+
azureStorage.AccountName = anonymize.String(azureStorage.AccountName)
173+
azureStorage.Container = anonymize.String(azureStorage.Container)
174+
azureStorage.CloudName = anonymize.String(azureStorage.CloudName)
175+
}
176+
177+
func anonymizeSwiftStorage(swiftStorage *registryv1.ImageRegistryConfigStorageSwift) {
178+
swiftStorage.AuthURL = anonymize.String(swiftStorage.AuthURL)
179+
swiftStorage.Container = anonymize.String(swiftStorage.Container)
180+
swiftStorage.Domain = anonymize.String(swiftStorage.Domain)
181+
swiftStorage.DomainID = anonymize.String(swiftStorage.DomainID)
182+
swiftStorage.Tenant = anonymize.String(swiftStorage.Tenant)
183+
swiftStorage.TenantID = anonymize.String(swiftStorage.TenantID)
184+
swiftStorage.RegionName = anonymize.String(swiftStorage.RegionName)
185+
}

‎pkg/gatherers/clusterconfig/image_registries_test.go

+51-32
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,33 @@ import (
1212
kubefake "k8s.io/client-go/kubernetes/fake"
1313
)
1414

15-
//nolint: goconst, funlen, gocyclo
15+
var (
16+
testS3Storage = imageregistryv1.ImageRegistryConfigStorage{
17+
S3: &imageregistryv1.ImageRegistryConfigStorageS3{
18+
Bucket: "foo",
19+
Region: "bar",
20+
RegionEndpoint: "point",
21+
KeyID: "key",
22+
},
23+
}
24+
testAzureStorage = imageregistryv1.ImageRegistryConfigStorage{
25+
Azure: &imageregistryv1.ImageRegistryConfigStorageAzure{
26+
AccountName: "account",
27+
Container: "container",
28+
CloudName: "cloud",
29+
},
30+
}
31+
testGCSStorage = imageregistryv1.ImageRegistryConfigStorage{
32+
GCS: &imageregistryv1.ImageRegistryConfigStorageGCS{
33+
Bucket: "bucket",
34+
Region: "region",
35+
ProjectID: "foo",
36+
KeyID: "bar",
37+
},
38+
}
39+
)
40+
41+
//nolint: goconst, funlen, gocyclo, dupl
1642
func Test_ImageRegistry_Gather(t *testing.T) {
1743
tests := []struct {
1844
name string
@@ -42,27 +68,23 @@ func Test_ImageRegistry_Gather(t *testing.T) {
4268
Name: "cluster",
4369
},
4470
Spec: imageregistryv1.ImageRegistrySpec{
45-
Storage: imageregistryv1.ImageRegistryConfigStorage{
46-
S3: &imageregistryv1.ImageRegistryConfigStorageS3{
47-
Bucket: "foo",
48-
Region: "bar",
49-
RegionEndpoint: "point",
50-
KeyID: "key",
51-
},
52-
},
71+
Storage: testS3Storage,
72+
},
73+
Status: imageregistryv1.ImageRegistryStatus{
74+
Storage: testS3Storage,
5375
},
5476
},
5577
evalOutput: func(t *testing.T, obj *imageregistryv1.Config) {
56-
if obj.Spec.Storage.S3.Bucket != "xxx" {
78+
if obj.Spec.Storage.S3.Bucket != "xxx" || obj.Status.Storage.S3.Bucket != "xxx" {
5779
t.Errorf("expected s3 bucket anonymized, got %q", obj.Spec.Storage.S3.Bucket)
5880
}
59-
if obj.Spec.Storage.S3.Region != "xxx" {
81+
if obj.Spec.Storage.S3.Region != "xxx" || obj.Status.Storage.S3.Region != "xxx" {
6082
t.Errorf("expected s3 region anonymized, got %q", obj.Spec.Storage.S3.Region)
6183
}
62-
if obj.Spec.Storage.S3.RegionEndpoint != "xxxxx" {
84+
if obj.Spec.Storage.S3.RegionEndpoint != "xxxxx" || obj.Status.Storage.S3.RegionEndpoint != "xxxxx" {
6385
t.Errorf("expected s3 region endpoint anonymized, got %q", obj.Spec.Storage.S3.RegionEndpoint)
6486
}
65-
if obj.Spec.Storage.S3.KeyID != "xxx" {
87+
if obj.Spec.Storage.S3.KeyID != "xxx" || obj.Status.Storage.S3.KeyID != "xxx" {
6688
t.Errorf("expected s3 keyID anonymized, got %q", obj.Spec.Storage.S3.KeyID)
6789
}
6890
},
@@ -74,21 +96,22 @@ func Test_ImageRegistry_Gather(t *testing.T) {
7496
Name: "cluster",
7597
},
7698
Spec: imageregistryv1.ImageRegistrySpec{
77-
Storage: imageregistryv1.ImageRegistryConfigStorage{
78-
Azure: &imageregistryv1.ImageRegistryConfigStorageAzure{
79-
AccountName: "account",
80-
Container: "container",
81-
},
82-
},
99+
Storage: testAzureStorage,
100+
},
101+
Status: imageregistryv1.ImageRegistryStatus{
102+
Storage: testAzureStorage,
83103
},
84104
},
85105
evalOutput: func(t *testing.T, obj *imageregistryv1.Config) {
86-
if obj.Spec.Storage.Azure.AccountName != "xxxxxxx" {
106+
if obj.Spec.Storage.Azure.AccountName != "xxxxxxx" || obj.Status.Storage.Azure.AccountName != "xxxxxxx" {
87107
t.Errorf("expected azure account name anonymized, got %q", obj.Spec.Storage.Azure.AccountName)
88108
}
89-
if obj.Spec.Storage.Azure.Container == "xxxxxxx" {
109+
if obj.Spec.Storage.Azure.Container != "xxxxxxxxx" || obj.Status.Storage.Azure.Container != "xxxxxxxxx" {
90110
t.Errorf("expected azure container anonymized, got %q", obj.Spec.Storage.Azure.Container)
91111
}
112+
if obj.Spec.Storage.Azure.CloudName != "xxxxx" || obj.Status.Storage.Azure.CloudName != "xxxxx" {
113+
t.Errorf("expected azure cloud name anonymized, got %q", obj.Spec.Storage.Azure.CloudName)
114+
}
92115
},
93116
},
94117
{
@@ -98,24 +121,20 @@ func Test_ImageRegistry_Gather(t *testing.T) {
98121
Name: "cluster",
99122
},
100123
Spec: imageregistryv1.ImageRegistrySpec{
101-
Storage: imageregistryv1.ImageRegistryConfigStorage{
102-
GCS: &imageregistryv1.ImageRegistryConfigStorageGCS{
103-
Bucket: "bucket",
104-
Region: "region",
105-
ProjectID: "foo",
106-
KeyID: "bar",
107-
},
108-
},
124+
Storage: testGCSStorage,
125+
},
126+
Status: imageregistryv1.ImageRegistryStatus{
127+
Storage: testGCSStorage,
109128
},
110129
},
111130
evalOutput: func(t *testing.T, obj *imageregistryv1.Config) {
112-
if obj.Spec.Storage.GCS.Bucket != "xxxxxx" {
131+
if obj.Spec.Storage.GCS.Bucket != "xxxxxx" || obj.Status.Storage.GCS.Bucket != "xxxxxx" {
113132
t.Errorf("expected gcs bucket anonymized, got %q", obj.Spec.Storage.GCS.Bucket)
114133
}
115-
if obj.Spec.Storage.GCS.ProjectID != "xxx" {
134+
if obj.Spec.Storage.GCS.ProjectID != "xxx" || obj.Status.Storage.GCS.ProjectID != "xxx" {
116135
t.Errorf("expected gcs projectID endpoint anonymized, got %q", obj.Spec.Storage.GCS.ProjectID)
117136
}
118-
if obj.Spec.Storage.GCS.KeyID != "xxx" {
137+
if obj.Spec.Storage.GCS.KeyID != "xxx" || obj.Status.Storage.GCS.KeyID != "xxx" {
119138
t.Errorf("expected gcs keyID anonymized, got %q", obj.Spec.Storage.GCS.KeyID)
120139
}
121140
},

0 commit comments

Comments
 (0)