Use envsubst instead of kubectl apply inline

stackabletech · Feb 28, 2024 · efd0cec · efd0cec
1 parent bb264da
commit efd0cec
Show file tree

Hide file tree

Showing 10 changed files with 498 additions and 503 deletions.
diff --git a/tests/templates/kuttl/kerberos/02-create-kerberos-secretclass.txt.j2 b/tests/templates/kuttl/kerberos/02-create-kerberos-secretclass.txt.j2
@@ -0,0 +1,64 @@
+apiVersion: secrets.stackable.tech/v1alpha1
+kind: SecretClass
+metadata:
+  name: kerberos-$NAMESPACE
+spec:
+  backend:
+    kerberosKeytab:
+{% if test_scenario['values']['kerberos-backend'] == 'mit' %}
+      realmName: {{ test_scenario['values']['kerberos-realm'] }}
+      kdc: krb5-kdc.$NAMESPACE.svc.cluster.local
+{% elif test_scenario['values']['kerberos-backend'] == 'activeDirectory' %}
+      realmName: SBLE.TEST
+      # Must be the FQDN of the AD domain controller
+      kdc: sble-adds1.sble.test
+{% endif %}
+      admin:
+        {{ test_scenario['values']['kerberos-backend'] }}:
+{% if test_scenario['values']['kerberos-backend'] == 'mit' %}
+          kadminServer: krb5-kdc.$NAMESPACE.svc.cluster.local
+{% elif test_scenario['values']['kerberos-backend'] == 'activeDirectory' %}
+          # Must be the FQDN of the AD domain controller
+          ldapServer: sble-adds1.sble.test
+          passwordCacheSecret:
+            name: secret-operator-ad-passwords
+            namespace: $NAMESPACE
+          # Container must be created manually
+          # Users must be deleted by user between each test run
+          userDistinguishedName: CN=Stackable,CN=Users,DC=sble,DC=test
+          schemaDistinguishedName: CN=Schema,CN=Configuration,DC=sble,DC=test
+{% endif %}
+      adminKeytabSecret:
+        namespace: $NAMESPACE
+        name: secret-operator-keytab
+      adminPrincipal: stackable-secret-operator
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: secret-operator-keytab
+data:
+{% if test_scenario['values']['kerberos-backend'] == 'mit' %}
+  # To create keytab. When promted enter password asdf
+  # cat | ktutil << 'EOF'
+  # list
+  # add_entry -password -p [email protected] -k 1 -e aes256-cts-hmac-sha384-192
+  # wkt /tmp/keytab
+  # EOF
+{% if test_scenario['values']['kerberos-realm'] == 'CLUSTER.LOCAL' %}
+  keytab: BQIAAABdAAEADUNMVVNURVIuTE9DQUwAGXN0YWNrYWJsZS1zZWNyZXQtb3BlcmF0b3IAAAABZAYWIgEAFAAgm8MCZ8B//XF1tH92GciD6/usWUNAmBTZnZQxLua2TkgAAAAB
+{% elif test_scenario['values']['kerberos-realm'] == 'PROD.MYCORP' %}
+  keytab: BQIAAABbAAEAC1BST0QuTVlDT1JQABlzdGFja2FibGUtc2VjcmV0LW9wZXJhdG9yAAAAAWQZa0EBABQAIC/EnFNejq/K5lX6tX+B3/tkI13TCzkPB7d2ggCIEzE8AAAAAQ==
+{% endif %}
+{% elif test_scenario['values']['kerberos-backend'] == 'activeDirectory' %}
+  # To create keytab
+  # ktpass /princ [email protected] /mapuser [email protected] /ptype KRB5_NT_PRINCIPAL /crypto AES256-SHA1 /out foo.kt +rndPass
+  keytab: BQIAAABVAAEACVNCTEUuVEVTVAAZc3RhY2thYmxlLXNlY3JldC1vcGVyYXRvcgAAAAEAAAAAAwASACCm3DV5BWzI2rlyAXRFtLbSQtcTtlMuKKtm5zFOMingkQ==
+{% endif %}
+{% if test_scenario['values']['kerberos-backend'] == 'activeDirectory' %}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: secret-operator-ad-passwords
+{% endif %}
diff --git a/tests/templates/kuttl/kerberos/02-create-kerberos-secretclass.yaml.j2 b/tests/templates/kuttl/kerberos/02-create-kerberos-secretclass.yaml.j2
@@ -2,71 +2,5 @@
 apiVersion: kuttl.dev/v1beta1
 kind: TestStep
 commands:
-  - script: |
-      kubectl apply -n $NAMESPACE -f - <<EOF
-      ---
-      apiVersion: secrets.stackable.tech/v1alpha1
-      kind: SecretClass
-      metadata:
-        name: kerberos-$NAMESPACE
-      spec:
-        backend:
-          kerberosKeytab:
-{% if test_scenario['values']['kerberos-backend'] == 'mit' %}
-            realmName: {{ test_scenario['values']['kerberos-realm'] }}
-            kdc: krb5-kdc.$NAMESPACE.svc.cluster.local
-{% elif test_scenario['values']['kerberos-backend'] == 'activeDirectory' %}
-            realmName: SBLE.TEST
-            # Must be the FQDN of the AD domain controller
-            kdc: sble-adds1.sble.test
-{% endif %}
-            admin:
-              {{ test_scenario['values']['kerberos-backend'] }}:
-{% if test_scenario['values']['kerberos-backend'] == 'mit' %}
-                kadminServer: krb5-kdc.$NAMESPACE.svc.cluster.local
-{% elif test_scenario['values']['kerberos-backend'] == 'activeDirectory' %}
-                # Must be the FQDN of the AD domain controller
-                ldapServer: sble-adds1.sble.test
-                passwordCacheSecret:
-                  name: secret-operator-ad-passwords
-                  namespace: $NAMESPACE
-                # Container must be created manually
-                # Users must be deleted by user between each test run
-                userDistinguishedName: CN=Stackable,CN=Users,DC=sble,DC=test
-                schemaDistinguishedName: CN=Schema,CN=Configuration,DC=sble,DC=test
-{% endif %}
-            adminKeytabSecret:
-              namespace: $NAMESPACE
-              name: secret-operator-keytab
-            adminPrincipal: stackable-secret-operator
-      EOF
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: secret-operator-keytab
-data:
-{% if test_scenario['values']['kerberos-backend'] == 'mit' %}
-  # To create keytab. When promted enter password asdf
-  # cat | ktutil << 'EOF'
-  # list
-  # add_entry -password -p [email protected] -k 1 -e aes256-cts-hmac-sha384-192
-  # wkt /tmp/keytab
-  # EOF
-{% if test_scenario['values']['kerberos-realm'] == 'CLUSTER.LOCAL' %}
-  keytab: BQIAAABdAAEADUNMVVNURVIuTE9DQUwAGXN0YWNrYWJsZS1zZWNyZXQtb3BlcmF0b3IAAAABZAYWIgEAFAAgm8MCZ8B//XF1tH92GciD6/usWUNAmBTZnZQxLua2TkgAAAAB
-{% elif test_scenario['values']['kerberos-realm'] == 'PROD.MYCORP' %}
-  keytab: BQIAAABbAAEAC1BST0QuTVlDT1JQABlzdGFja2FibGUtc2VjcmV0LW9wZXJhdG9yAAAAAWQZa0EBABQAIC/EnFNejq/K5lX6tX+B3/tkI13TCzkPB7d2ggCIEzE8AAAAAQ==
-{% endif %}
-{% elif test_scenario['values']['kerberos-backend'] == 'activeDirectory' %}
-  # To create keytab
-  # ktpass /princ [email protected] /mapuser [email protected] /ptype KRB5_NT_PRINCIPAL /crypto AES256-SHA1 /out foo.kt +rndPass
-  keytab: BQIAAABVAAEACVNCTEUuVEVTVAAZc3RhY2thYmxlLXNlY3JldC1vcGVyYXRvcgAAAAEAAAAAAwASACCm3DV5BWzI2rlyAXRFtLbSQtcTtlMuKKtm5zFOMingkQ==
-{% endif %}
-{% if test_scenario['values']['kerberos-backend'] == 'activeDirectory' %}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: secret-operator-ad-passwords
-{% endif %}
+  # We need to replace $NAMESPACE (by KUTTL)
+  - script: envsubst < 02-create-kerberos-secretclass.txt | kubectl apply -n $NAMESPACE -f -
diff --git a/tests/templates/kuttl/kerberos/12-rego-rules.txt.j2 b/tests/templates/kuttl/kerberos/12-rego-rules.txt.j2
@@ -0,0 +1,227 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hdfs-regorules
+  labels:
+    opa.stackable.tech/bundle: "true"
+data:
+  hdfs.rego: |
+    package hdfs
+
+    import rego.v1
+
+    default allow = false
+
+    # HDFS authorizer
+    allow if {
+        some acl in acls
+        matches_identity(acl.identity)
+        matches_resource(input.path, acl.resource)
+        action_sufficient_for_operation(acl.action, input.operationName)
+    }
+
+    # Identity mentions the (long) userName or shortUsername explicitly
+    matches_identity(identity) if {
+        identity in {
+            concat("", ["user:", input.callerUgi.userName]),
+            concat("", ["shortUser:", input.callerUgi.shortUserName])
+        }
+    }
+
+    # Identity mentions group the user is part of (by looking up using the (long) userName)
+    matches_identity(identity) if {
+        some group in groups_for_user[input.callerUgi.userName]
+        identity == concat("", ["group:", group])
+    }
+
+    # Resource mentions the file explicitly
+    matches_resource(file, resource) if {
+        resource == concat("", ["hdfs:file:", file])
+    }
+
+    # Resource mentions the directory explicitly
+    matches_resource(file, resource) if {
+        trim_suffix(resource, "/") == concat("", ["hdfs:dir:", file])
+    }
+
+    # Resource mentions a folder higher up the tree, which will will grant access recursively
+    matches_resource(file, resource) if {
+        startswith(resource, "hdfs:dir:/")
+        # directories need to have a trailing slash
+        endswith(resource, "/")
+        startswith(file, trim_prefix(resource, "hdfs:dir:"))
+    }
+
+    action_sufficient_for_operation(action, operation) if {
+        action_hierarchy[action][_] == action_for_operation[operation]
+    }
+
+    action_hierarchy := {
+        "full": ["full", "rw", "ro"],
+        "rw": ["rw", "ro"],
+        "ro": ["ro"],
+    }
+
+    # To get a (hopefully complete) list of actions run "ack 'String operationName = '" in the hadoop source code
+    action_for_operation := {
+        # The "rename" operation will be actually called on both - the source and the target location.
+        # Because of this you need to have rw permissions on the source and target file - which is desired
+
+        "abandonBlock": "rw",
+        "addCacheDirective": "rw",
+        "addCachePool": "full",
+        "addErasureCodingPolicies": "full",
+        "allowSnapshot": "full",
+        "append": "rw",
+        "cancelDelegationToken": "ro",
+        "checkAccess": "ro",
+        "clearQuota": "full",
+        "clearSpaceQuota": "full",
+        "completeFile": "rw",
+        "computeSnapshotDiff": "full",
+        "concat": "rw",
+        "contentSummary": "ro",
+        "create": "rw",
+        "createEncryptionZone": "full",
+        "createSnapshot": "full",
+        "createSymlink": "rw",
+        "delete": "rw",
+        "deleteSnapshot": "full",
+        "disableErasureCodingPolicy": "full",
+        "disallowSnapshot": "full",
+        "enableErasureCodingPolicy": "full",
+        "finalizeRollingUpgrade": "full",
+        "fsck": "full",
+        "fsckGetBlockLocations": "full",
+        "fsync": "rw",
+        "gcDeletedSnapshot": "full",
+        "getAclStatus": "ro",
+        "getAdditionalBlock": "ro",
+        "getAdditionalDatanode": "ro",
+        "getDelegationToken": "ro",
+        "getECTopologyResultForPolicies": "ro",
+        "getErasureCodingCodecs": "ro",
+        "getErasureCodingPolicies": "ro",
+        "getErasureCodingPolicy": "ro",
+        "getEZForPath": "ro",
+        "getfileinfo": "ro",
+        "getPreferredBlockSize": "ro",
+        "getStoragePolicy": "ro",
+        "getXAttrs": "ro",
+        "isFileClosed": "ro",
+        "listCacheDirectives": "ro",
+        "listCachePools": "ro",
+        "listCorruptFileBlocks": "ro",
+        "listEncryptionZones": "ro",
+        "listOpenFiles": "ro",
+        "listReencryptionStatus": "ro",
+        "ListSnapshot": "ro", # Yeah, this really starts with a capital letter
+        "listSnapshottableDirectory": "ro",
+        "listStatus": "ro",
+        "listXAttrs": "ro",
+        "mkdirs": "rw",
+        "modifyAclEntries": "full",
+        "modifyCacheDirective": "rw",
+        "modifyCachePool": "full",
+        "open": "ro",
+        "queryRollingUpgrade": "ro",
+        "quotaUsage": "ro",
+        "recoverLease": "full",
+        "reencryptEncryptionZone": "full",
+        "removeAcl": "full",
+        "removeAclEntries": "full",
+        "removeCacheDirective": "rw",
+        "removeCachePool": "full",
+        "removeDefaultAcl": "full",
+        "removeErasureCodingPolicy": "full",
+        "removeXAttr": "rw",
+        "rename": "rw",
+        "renameSnapshot": "full",
+        "renewDelegationToken": "ro",
+        "satisfyStoragePolicy": "full",
+        "setAcl": "full",
+        "setErasureCodingPolicy": "full",
+        "setOwner": "full",
+        "setPermission": "full",
+        "setQuota": "full",
+        "setReplication": "full",
+        "setSpaceQuota": "full",
+        "setStoragePolicy": "full",
+        "setTimes": "rw",
+        "setXAttr": "rw",
+        "startRollingUpgrade": "full",
+        "truncate": "rw",
+        "unsetErasureCodingPolicy": "full",
+        "unsetStoragePolicy": "full",
+    }
+
+    # Actions I think are only relevant for the whole filesystem, and not specific to a file or directory
+    admin_actions := {
+        "checkRestoreFailedStorage": "ro",
+        "datanodeReport": "ro",
+        "disableRestoreFailedStorage": "full",
+        "enableRestoreFailedStorage": "full",
+        "finalizeUpgrade": "rw",
+        "getDatanodeStorageReport": "ro",
+        "metaSave": "ro",
+        "monitorHealth": "ro",
+        "refreshNodes": "rw",
+        "rollEditLog": "rw",
+        "saveNamespace": "full",
+        "setBalancerBandwidth": "rw",
+        "slowDataNodesReport": "ro",
+        "transitionToActive": "full",
+        "transitionToObserver": "full",
+        "transitionToStandby": "full",
+    }
+
+    groups_for_user := {
+        "admin/access-hdfs.$NAMESPACE.svc.cluster.local@{{ test_scenario['values']['kerberos-realm'] }}": ["admins"],
+        "admin/check-hdfs.$NAMESPACE.svc.cluster.local@{{ test_scenario['values']['kerberos-realm'] }}": ["admins"],
+        "alice/access-hdfs.$NAMESPACE.svc.cluster.local@{{ test_scenario['values']['kerberos-realm'] }}": ["developers"],
+        "bob/access-hdfs.$NAMESPACE.svc.cluster.local@{{ test_scenario['values']['kerberos-realm'] }}": []
+    }
+
+    acls := [
+        {
+            "identity": "group:admins",
+            "action": "full",
+            "resource": "hdfs:dir:/",
+        },
+        {
+            "identity": "group:developers",
+            "action": "rw",
+            "resource": "hdfs:dir:/developers/",
+        },
+        {
+            "identity": "group:developers",
+            "action": "ro",
+            "resource": "hdfs:dir:/developers-ro/",
+        },
+        {
+            "identity": "user:alice/access-hdfs.$NAMESPACE.svc.cluster.local@{{ test_scenario['values']['kerberos-realm'] }}",
+            "action": "rw",
+            "resource": "hdfs:dir:/alice/",
+        },
+        {
+            "identity": "user:bob/access-hdfs.$NAMESPACE.svc.cluster.local@{{ test_scenario['values']['kerberos-realm'] }}",
+            "action": "rw",
+            "resource": "hdfs:dir:/bob/",
+        },
+        {
+            "identity": "user:bob/access-hdfs.$NAMESPACE.svc.cluster.local@{{ test_scenario['values']['kerberos-realm'] }}",
+            "action": "ro",
+            "resource": "hdfs:dir:/developers/",
+        },
+        {
+            "identity": "user:bob/access-hdfs.$NAMESPACE.svc.cluster.local@{{ test_scenario['values']['kerberos-realm'] }}",
+            "action": "rw",
+            "resource": "hdfs:file:/developers/file-from-bob",
+        },
+        {
+            "identity": "shortUser:bob",
+            "action": "rw",
+            "resource": "hdfs:file:/developers/file-from-bob",
+        },
+    ]