From dc1d448c6e979fb4abd8a87f943da9b2a33f591a Mon Sep 17 00:00:00 2001 From: Tullio Sebastiani Date: Mon, 4 Dec 2023 12:07:08 +0100 Subject: [PATCH] added support for insecure-skip-tls-verify (#14) --- model_connection.go | 15 +++++++++++++++ model_kubeconfig.go | 2 +- parse_kubeconfig.go | 10 ++++------ parse_kubeconfig_test.go | 7 +++++-- testdata/kubeconfig-tlsskip.yaml | 10 ++++++---- 5 files changed, 31 insertions(+), 13 deletions(-) diff --git a/model_connection.go b/model_connection.go index 4df2ae2..e9eebfd 100644 --- a/model_connection.go +++ b/model_connection.go @@ -28,6 +28,7 @@ type ConnectionParameters struct { BearerToken string `json:"bearerToken"` BearerTokenFile string `json:"bearerTokenFile"` + Insecure bool `json:"insecure"` } // UnmarshalJSON uses the Arcaflow schema system to unmarshal JSON data when called via json.Unmarshal on the @@ -268,6 +269,20 @@ var connectionParametersSchema = schema.NewTypedObject[ConnectionParameters]( schema.PointerTo(util.JSONEncode("/var/run/secrets/kubernetes.io/serviceaccount")), nil, ), + "insecure": schema.NewPropertySchema( + schema.NewBoolSchema(), + schema.NewDisplayValue( + schema.PointerTo("Insecure connection"), + schema.PointerTo("Skip TLS verification"), + nil, + ), + false, + nil, + nil, + nil, + nil, + nil, + ), }, ) diff --git a/model_kubeconfig.go b/model_kubeconfig.go index 9f82af6..5e73e9c 100644 --- a/model_kubeconfig.go +++ b/model_kubeconfig.go @@ -292,7 +292,7 @@ var clusterParamsSchema = schema.NewTypedObject[KubeConfigClusterParams]( nil, ).TreatEmptyAsDefaultValue(), "insecure-skip-tls-verify": schema.NewPropertySchema( - schema.NewStringSchema(schema.IntPointer(1), nil, nil), + schema.NewBoolSchema(), schema.NewDisplayValue( schema.PointerTo("InsecureSkipTLSVerify"), schema.PointerTo("toggles TLS verification"), diff --git a/parse_kubeconfig.go b/parse_kubeconfig.go index 10e2429..a0747d2 100644 --- a/parse_kubeconfig.go +++ b/parse_kubeconfig.go @@ -61,12 +61,6 @@ func KubeConfigToConnection(kubeconfig KubeConfig, inlineFiles bool) (Connection return ConnectionParameters{}, fmt.Errorf("current user %s not found in kubeconfig file", currentUser) } - if cluster.Cluster.InsecureSkipTLSVerify { - return ConnectionParameters{}, errors.New("the Kubeconfig is set to skip TLS verification" + - "this is not supported by arcaflow and there is no reason to use this option" + - "please set up your kubernetes TLS authentication with CA certificates.") - } - if len(cluster.Cluster.Server) == 0 { return ConnectionParameters{}, errors.New("no cluster host found in connection") } @@ -87,6 +81,8 @@ func KubeConfigToConnection(kubeconfig KubeConfig, inlineFiles bool) (Connection } } + connectionParams.Insecure = cluster.Cluster.InsecureSkipTLSVerify + if cluster.Cluster.CertificateAuthorityData != nil { connectionParams.CAData = util.Base64Decode(*cluster.Cluster.CertificateAuthorityData) } @@ -152,6 +148,7 @@ func ConnectionToKubeConfig(connection ConnectionParameters) (KubeConfig, error) if len(connection.CAFile) > 0 { clusterParams.CertificateAuthority = &connection.CAFile } + clusterParams.InsecureSkipTLSVerify = connection.Insecure cluster := KubeConfigCluster{ Cluster: clusterParams, Name: defaultStr, @@ -243,6 +240,7 @@ func ConnectionToRestConfig(connection ConnectionParameters) (*restclient.Config KeyFile: connection.KeyFile, CAData: []byte(connection.CAData), CAFile: connection.CAFile, + Insecure: connection.Insecure, }, UserAgent: "Arcaflow", QPS: restclient.DefaultQPS, diff --git a/parse_kubeconfig_test.go b/parse_kubeconfig_test.go index cb30ce5..e158c47 100644 --- a/parse_kubeconfig_test.go +++ b/parse_kubeconfig_test.go @@ -84,6 +84,8 @@ func TestKubeConfigToConnection(t *testing.T) { assert.Equal(t, connection.KeyData, fixtures.clientKey) assert.Equal(t, connection.CAData, fixtures.caCert) assert.Equal(t, connection.CertData, fixtures.clientCrt) + // test that by default insecure-skip-tls-verify is false + assert.False(t, connection.Insecure) //test without inlining kubeconf, err = ParseKubeConfig(fixtures.kubeconfigNoData) @@ -105,10 +107,11 @@ func TestKubeConfigToConnection(t *testing.T) { assert.NotNil(t, err) err = nil - //test failure on insecure-skip-tls-verify: true + //test success on insecure-skip-tls-verify: true kubeconf, err = ParseKubeConfig(fixtures.kubeconfigSkipTls) connection, err = KubeConfigToConnection(kubeconf, true) - assert.NotNil(t, err) + assert.True(t, connection.Insecure) + assert.Nil(t, err) } func TestConnectionToKubeConfig(t *testing.T) { diff --git a/testdata/kubeconfig-tlsskip.yaml b/testdata/kubeconfig-tlsskip.yaml index 7ff6bf9..4191a0b 100644 --- a/testdata/kubeconfig-tlsskip.yaml +++ b/testdata/kubeconfig-tlsskip.yaml @@ -1,8 +1,9 @@ apiVersion: v1 clusters: - cluster: + certificate-authority-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM5ekNDQWQrZ0F3SUJBZ0lVV01PTVBNMVUrRi9uNXN6TSthYzlMcGZISHB3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd0hqRWNNQm9HQTFVRUF3d1RhM1ZpZFc1MGRTNXNiMk5oYkdSdmJXRnBiakFlRncweU1URXlNRFl4T0RBdwpNRFJhRncwek1URXlNRFF4T0RBd01EUmFNQjR4SERBYUJnTlZCQU1NRTJ0MVluVnVkSFV1Ykc5allXeGtiMjFoCmFXNHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDNExhcG00SDB0T1NuYTNXVisKdzI4a0tOWWRwaHhYOUtvNjUwVGlOK2c5ZFNQU3VZK0V6T1JVOWVONlgyWUZkMEJmVFNodno4Y25rclAvNysxegpETEoxQ3MwRi9haEV3ZDQxQXN5UGFjbnRiVE80dGRLWm9POUdyODR3YVdBN1hSZmtEc2ZxRGN1YW5UTmVmT1hpCkdGbmdDVzU5Q285M056alB1eEFrakJxdVF6eE5GQkgwRlJPbXJtVFJ4cnVLZXo0aFFuUW1OWEFUNnp0M21udzMKWUtWTzU4b2xlcUxUcjVHNlRtVFQyYTZpVGdtdWY2N0cvaVZlalJGbkw3YkNHWmgzSjlCSTNMcVpqRzE4dWxvbgpaVDdQcGQrQTlnaTJOTm9UZlI2TVB5SndxU1BCL0xZQU5ZNGRoZDVJYlVydDZzbmViTlRZSHV2T0tZTDdNTWRMCmVMSzFBZ01CQUFHakxUQXJNQWtHQTFVZEV3UUNNQUF3SGdZRFZSMFJCQmN3RllJVGEzVmlkVzUwZFM1c2IyTmgKYkdSdmJXRnBiakFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQTVqUHVpZVlnMExySE1PSkxYY0N4d3EvVzBDNApZeFpncVd3VHF5VHNCZjVKdDlhYTk0SkZTc2dHQWdzUTN3NnA2SlBtL0MyR05MY3U4ZWxjV0E4UXViQWxueXRRCnF1cEh5WnYrZ08wMG83TXdrejZrTUxqQVZ0QllkRzJnZ21FRjViTEk5czBKSEhjUGpHUkl1VHV0Z0tHV1dPWHgKSEg4T0RzaG9wZHRXMktrR2c2aThKaEpYaWVIbzkzTHptM00xRUNGcXAvMEdtNkN1RFphVVA2SGpJMWRrYllLdgpsSHNVZ1U1SmZjSWhNYmJLdUllTzRkc1YvT3FHcm9iNW5vcmRjaExBQmRDTnc1cmU5T1NXZGZ1VVhSK0ViZVhrCjVFM0tFYzA1RGNjcGV2a1NTdlJ4SVQrQzNMOTltWGcxL3B5NEw3VUhvNFFLTXlqWXJXTWlLRlVKV1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== + server: https://127.0.0.1:6443 insecure-skip-tls-verify: true - certificate-authority: testdata/ca.crt name: default contexts: - context: @@ -16,8 +17,9 @@ preferences: {} users: - name: testuser user: - client-certificate: testdata/client.crt - client-key: testdata/client.key + client-key-data: LS0tLS1CRUdJTiBQUklWQVRFIEtFWS0tLS0tCk1JSUV2QUlCQURBTkJna3Foa2lHOXcwQkFRRUZBQVNDQktZd2dnU2lBZ0VBQW9JQkFRQzRMYXBtNEgwdE9TbmEKM1dWK3cyOGtLTllkcGh4WDlLbzY1MFRpTitnOWRTUFN1WStFek9SVTllTjZYMllGZDBCZlRTaHZ6OGNua3JQLwo3KzF6RExKMUNzMEYvYWhFd2Q0MUFzeVBhY250YlRPNHRkS1pvTzlHcjg0d2FXQTdYUmZrRHNmcURjdWFuVE5lCmZPWGlHRm5nQ1c1OUNvOTNOempQdXhBa2pCcXVRenhORkJIMEZST21ybVRSeHJ1S2V6NGhRblFtTlhBVDZ6dDMKbW53M1lLVk81OG9sZXFMVHI1RzZUbVRUMmE2aVRnbXVmNjdHL2lWZWpSRm5MN2JDR1poM0o5QkkzTHFaakcxOAp1bG9uWlQ3UHBkK0E5Z2kyTk5vVGZSNk1QeUp3cVNQQi9MWUFOWTRkaGQ1SWJVcnQ2c25lYk5UWUh1dk9LWUw3Ck1NZExlTEsxQWdNQkFBRUNnZ0VBQ28rank4NW5ueVk5L2l6ZjJ3cjkzb2J3OERaTVBjYnIxQURhOUZYY1hWblEKT2c4bDZhbU9Ga2tiU0RNY09JZ0VDdkx6dEtXbmQ5OXpydU5sTEVtNEdmb0trNk5kK01OZEtKRUdoZHE5RjM1Qgpqdi91R1owZTIyRE5ZLzFHNVdDTE5DcWMwQkVHY2RFOTF0YzJuMlppRVBTNWZ6WVJ6L1k4cmJ5K1NqbzJkWE9RCmRHYWRlUFplbi9UbmlHTFlqZWhrbXZNQjJvU0FDbVMycTd2OUNrcmdmR1RZbWJzeGVjSU1QK0JONG9KS3BOZ28KOUpnRWJ5SUxkR1pZS2pQb2lLaHNjMVhmSy8zZStXSmxuYjJBaEE5Y1JMUzhMcDdtcEYySWp4SjNSNE93QTg3WQpNeGZvZWFGdnNuVUFHWUdFWFo4Z3BkWmhQMEoxNWRGdERjajIrcngrQVFLQmdRRDFoSE9nVGdFbERrVEc5bm5TCjE1eXYxRzUxYnJMQU1UaWpzNklEMU1qelhzck0xY2ZvazVaaUlxNVJsQ3dReTlYNDdtV1RhY0lZRGR4TGJEcXEKY0IydjR5Wm1YK1VleGJ3cDU1OWY0V05HdzF5YzQrQjdaNFF5aTRFelN4WmFjbldjMnBzcHJMUFVoOUFXRXVNcApOaW1vcXNiVGNnNGs5QWRxeUIrbWhIWmJRUUtCZ1FEQUNzU09qNXZMU1VtaVpxYWcrOVMySUxZOVNOdDZzS1VyCkprcjdCZEVpN3N2YmU5cldRR2RBb0xkQXNzcU94aENydmtPNkpSSHB1YjlRRjlYdlF4Riszc2ZpZm4yYkQ0ZloKMlVsclA1emF3RlNrNDNLbjdMZzRscURpaVUxVGlqTkJBL3dUcFlmbTB4dW5WeFRWNDZpNVViQW1XRk12TWV0bQozWUZYQmJkK2RRS0JnRGl6Q1B6cFpzeEcrazAwbUxlL2dYajl4ekNwaXZCbHJaM29teTdsVWk4YUloMmg5VlBaCjJhMzZNbVcyb1dLVG9HdW5xcCtibWU1eUxRRGlFcjVQdkJ0bGl2V3ppYmRNbFFMY2Nlcnpveml4WDA4QU5WUnEKZUpZdnIzdklDSGFFM25LRjdiVjNJK1NlSk1ra1BYL0QrV1R4WTQ5clZLYm1FRnh4c1JXRW04ekJBb0dBWEZ3UgpZanJoQTZqUW1DRmtYQ0loa0NJMVkwNEorSHpDUXZsY3NGT0EzSnNhUWduVUdwekl5OFUvdlFiLzhpQ0IzZ2RZCmpVck16YXErdnVkbnhYVnRFYVpWWGJIVitPQkVSdHFBdStyUkprZS9yYm1SNS84cUxsVUxOVWd4ZjA4RkRXeTgKTERxOUhKOUZPbnJnRTJvMU9FTjRRMGpSWU81U041dXFXODd0REEwQ2dZQXpXbk1KSFgrbmlyMjhRRXFyVnJKRAo4ZUEwOHIwWTJRMDhMRlcvMjNIVWQ4WU12VnhTUTdwcUwzaE41RXVJQ2dCbEpGVFI3TndBREo3eDY2M002akFMCm1DNlI4dWxSZStwa08xN2Y0UUs3MnVRanJGZEhESnlXQmdDL0RKSkV6d1dwY0Q4VVNPK3A5bVVIbllLTUJTOEsKTVB1ejYrZ3h0VEtsRU5pZUVacXhxZz09Ci0tLS0tRU5EIFBSSVZBVEUgS0VZLS0tLS0K + client-certificate-data: LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUM5ekNDQWQrZ0F3SUJBZ0lVV01PTVBNMVUrRi9uNXN6TSthYzlMcGZISHB3d0RRWUpLb1pJaHZjTkFRRUwKQlFBd0hqRWNNQm9HQTFVRUF3d1RhM1ZpZFc1MGRTNXNiMk5oYkdSdmJXRnBiakFlRncweU1URXlNRFl4T0RBdwpNRFJhRncwek1URXlNRFF4T0RBd01EUmFNQjR4SERBYUJnTlZCQU1NRTJ0MVluVnVkSFV1Ykc5allXeGtiMjFoCmFXNHdnZ0VpTUEwR0NTcUdTSWIzRFFFQkFRVUFBNElCRHdBd2dnRUtBb0lCQVFDNExhcG00SDB0T1NuYTNXVisKdzI4a0tOWWRwaHhYOUtvNjUwVGlOK2c5ZFNQU3VZK0V6T1JVOWVONlgyWUZkMEJmVFNodno4Y25rclAvNysxegpETEoxQ3MwRi9haEV3ZDQxQXN5UGFjbnRiVE80dGRLWm9POUdyODR3YVdBN1hSZmtEc2ZxRGN1YW5UTmVmT1hpCkdGbmdDVzU5Q285M056alB1eEFrakJxdVF6eE5GQkgwRlJPbXJtVFJ4cnVLZXo0aFFuUW1OWEFUNnp0M21udzMKWUtWTzU4b2xlcUxUcjVHNlRtVFQyYTZpVGdtdWY2N0cvaVZlalJGbkw3YkNHWmgzSjlCSTNMcVpqRzE4dWxvbgpaVDdQcGQrQTlnaTJOTm9UZlI2TVB5SndxU1BCL0xZQU5ZNGRoZDVJYlVydDZzbmViTlRZSHV2T0tZTDdNTWRMCmVMSzFBZ01CQUFHakxUQXJNQWtHQTFVZEV3UUNNQUF3SGdZRFZSMFJCQmN3RllJVGEzVmlkVzUwZFM1c2IyTmgKYkdSdmJXRnBiakFOQmdrcWhraUc5dzBCQVFzRkFBT0NBUUVBQTVqUHVpZVlnMExySE1PSkxYY0N4d3EvVzBDNApZeFpncVd3VHF5VHNCZjVKdDlhYTk0SkZTc2dHQWdzUTN3NnA2SlBtL0MyR05MY3U4ZWxjV0E4UXViQWxueXRRCnF1cEh5WnYrZ08wMG83TXdrejZrTUxqQVZ0QllkRzJnZ21FRjViTEk5czBKSEhjUGpHUkl1VHV0Z0tHV1dPWHgKSEg4T0RzaG9wZHRXMktrR2c2aThKaEpYaWVIbzkzTHptM00xRUNGcXAvMEdtNkN1RFphVVA2SGpJMWRrYllLdgpsSHNVZ1U1SmZjSWhNYmJLdUllTzRkc1YvT3FHcm9iNW5vcmRjaExBQmRDTnc1cmU5T1NXZGZ1VVhSK0ViZVhrCjVFM0tFYzA1RGNjcGV2a1NTdlJ4SVQrQzNMOTltWGcxL3B5NEw3VUhvNFFLTXlqWXJXTWlLRlVKV1E9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg== username: testuser password: testpassword - token: sha256~fFyEqjf1xxFMO0tbEyGRvWeNOd7QByuEgS4hyEq_A9o \ No newline at end of file + token: sha256~fFyEqjf1xxFMO0tbEyGRvWeNOd7QByuEgS4hyEq_A9o +