Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

⭐️ support scope mrn reading from service account #3146

Merged
merged 1 commit into from
Mar 12, 2024
+241 −142
Merged

⭐️ support scope mrn reading from service account #3146

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 29 additions & 11 deletions cli/config/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,11 +182,15 @@ type CommonOpts struct {

// service account credentials
ServiceAccountMrn string `json:"mrn,omitempty" mapstructure:"mrn"`
ParentMrn string `json:"parent_mrn,omitempty" mapstructure:"parent_mrn"`
SpaceMrn string `json:"space_mrn,omitempty" mapstructure:"space_mrn"`
PrivateKey string `json:"private_key,omitempty" mapstructure:"private_key"`
Certificate string `json:"certificate,omitempty" mapstructure:"certificate"`
APIEndpoint string `json:"api_endpoint,omitempty" mapstructure:"api_endpoint"`
// The scope mrn is used to scope the service account to a specific organization or space.
ScopeMrn string `json:"scope_mrn,omitempty" mapstructure:"scope_mrn"`
// Deprecated: use scope_mrn instead
ParentMrn string `json:"parent_mrn,omitempty" mapstructure:"parent_mrn"`
// Deprecated: use scope_mrn instead
SpaceMrn string `json:"space_mrn,omitempty" mapstructure:"space_mrn"`
PrivateKey string `json:"private_key,omitempty" mapstructure:"private_key"`
Certificate string `json:"certificate,omitempty" mapstructure:"certificate"`
APIEndpoint string `json:"api_endpoint,omitempty" mapstructure:"api_endpoint"`

// authentication
Authentication *CliConfigAuthentication `json:"auth,omitempty" mapstructure:"auth"`
Expand Down Expand Up @@ -254,22 +258,36 @@ func (c *CommonOpts) GetServiceCredential() *upstream.ServiceAccountCredentials

return &upstream.ServiceAccountCredentials{
Mrn: c.ServiceAccountMrn,
ParentMrn: c.GetParentMrn(),
ParentMrn: c.GetScopeMrn(),
ScopeMrn: c.GetScopeMrn(),
PrivateKey: c.PrivateKey,
Certificate: c.Certificate,
ApiEndpoint: c.APIEndpoint,
}
}

func (c *CommonOpts) GetParentMrn() string {
parent := c.ParentMrn
// GetScopeMrn returns the scope mrn that is used for the service account.
// This is either the organization mrn or the space mrn.
func (c *CommonOpts) GetScopeMrn() string {
scopeMrn := c.ScopeMrn

// fallback to old space_mrn config
if parent == "" {
parent = c.SpaceMrn
if scopeMrn == "" {
scopeMrn = c.SpaceMrn
}

if scopeMrn == "" {
scopeMrn = c.ParentMrn
}

return parent
return scopeMrn
}

// GetParentMrn returns the scope mrn that is used for the service account.
// This is either the organization mrn or the space mrn.
// Deprecated: Use GetScopeMrn instead
func (c *CommonOpts) GetParentMrn() string {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can we just not remove this function? i dont think this is used by an end user in some way so should be safe to delete it and migrate cnspec to GetScopeMrn (if cnspec makes use of that)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets leave it deprecated for now.

return c.GetScopeMrn()
}

func (c *CommonOpts) UpstreamApiEndpoint() string {
Expand Down
80 changes: 70 additions & 10 deletions cli/config/config_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,9 @@ func Test_inventoryPath(t *testing.T) {
}

func TestConfigParsing(t *testing.T) {
data := `

t.Run("test config with space_mrn", func(t *testing.T) {
data := `
agent_mrn: //agents.api.mondoo.app/spaces/musing-saha-952142/agents/1zDY7auR20SgrFfiGUT5qZWx6mE
api_endpoint: https://us.api.mondoo.com
api_proxy: http://192.168.4.4:3128
Expand All @@ -122,14 +124,72 @@ private_key: |
space_mrn: //captain.api.mondoo.app/spaces/musing-saha-952142
`

viper.SetConfigType("yaml")
viper.ReadConfig(strings.NewReader(data))
viper.SetConfigType("yaml")
err := viper.ReadConfig(strings.NewReader(data))
require.NoError(t, err)

cfg, err := Read()
require.NoError(t, err)
assert.Equal(t, "//agents.api.mondoo.app/spaces/musing-saha-952142/agents/1zDY7auR20SgrFfiGUT5qZWx6mE", cfg.AgentMrn)
assert.Equal(t, "//agents.api.mondoo.app/spaces/musing-saha-952142/serviceaccounts/1zDY7cJ7bA84JxxNBWDxBdui2xE", cfg.ServiceAccountMrn)
assert.Equal(t, "-----BEGIN PRIVATE KEY-----\nMIG2AgE....C0Dvs=\n-----END PRIVATE KEY-----\n", cfg.PrivateKey)
assert.Equal(t, "-----BEGIN CERTIFICATE-----\nMIICV .. fis=\n-----END CERTIFICATE-----\n", cfg.Certificate)
assert.Equal(t, "//captain.api.mondoo.app/spaces/musing-saha-952142", cfg.GetScopeMrn())
assert.Equal(t, "//captain.api.mondoo.app/spaces/musing-saha-952142", cfg.GetParentMrn())
})

t.Run("test space service account with scope_mrn", func(t *testing.T) {
data := `
{
"mrn": "//agents.api.mondoo.app/organizations/my-custom-org-id/serviceaccounts/2bB5gsCSGp2Tlwiyv7mKN9PRSHK",
"certificate": "-----BEGIN CERTIFICATE-----\nMIICkjCCAhigAwI5MT...ju2MAkPg9dPc8MDZz7ukThmj1AZrap/5J166M=\n-----END CERTIFICATE-----\n",
"private_key": "-----BEGIN PRIVATE KEY-----\nMIG2AgEAMBAGByqGSM...ju2MAkPg9dPc8MDZz7ukT/xQTS5FUmDNu7Rw8=\n-----END PRIVATE KEY-----\n",
"scope_mrn": "//captain.api.mondoo.app/organizations/my-custom-org-id",
"api_endpoint": "https://us.api.mondoo.com",
"space_mrn": "//captain.api.mondoo.app/organizations/my-custom-org-id",
"typename": "ServiceAccountCredential"
}
`
viper.SetConfigType("yaml")
err := viper.ReadConfig(strings.NewReader(data))
require.NoError(t, err)

cfg, err := Read()
require.NoError(t, err)
assert.Equal(t, "", cfg.AgentMrn)
assert.Equal(t, "//agents.api.mondoo.app/organizations/my-custom-org-id/serviceaccounts/2bB5gsCSGp2Tlwiyv7mKN9PRSHK", cfg.ServiceAccountMrn)
assert.Equal(t, "-----BEGIN PRIVATE KEY-----\nMIG2AgEAMBAGByqGSM...ju2MAkPg9dPc8MDZz7ukT/xQTS5FUmDNu7Rw8=\n-----END PRIVATE KEY-----\n", cfg.PrivateKey)
assert.Equal(t, "-----BEGIN CERTIFICATE-----\nMIICkjCCAhigAwI5MT...ju2MAkPg9dPc8MDZz7ukThmj1AZrap/5J166M=\n-----END CERTIFICATE-----\n", cfg.Certificate)
assert.Equal(t, "//captain.api.mondoo.app/organizations/my-custom-org-id", cfg.GetScopeMrn())
assert.Equal(t, "//captain.api.mondoo.app/organizations/my-custom-org-id", cfg.GetParentMrn())
})

t.Run("test org service account with scope_mrn", func(t *testing.T) {

data := `
{
"mrn": "//agents.api.mondoo.app/spaces/my-space-id/serviceaccounts/2bUj407V4GF4IKxg3Qn6NhWCr6x",
"certificate": "-----BEGIN CERTIFICATE-----\nMIICfDCCAgKgAwIBAgIQGwVGMqyjkNaCGTA96p/...\n2mm3zQE7mUokDf4qY3+SDw==\n-----END CERTIFICATE-----\n",
"private_key": "-----BEGIN PRIVATE KEY-----\nMIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIG...ILipt7Y8zEZ7PRQPkGUYpWDE8=\n-----END PRIVATE KEY-----\n",
"scope_mrn": "//captain.api.mondoo.app/spaces/my-space-id",
"api_endpoint": "https://us.api.mondoo.com",
"space_mrn": "//captain.api.mondoo.app/spaces/my-space-id",
"typename": "ServiceAccountCredential"
}
`

viper.SetConfigType("yaml")
err := viper.ReadConfig(strings.NewReader(data))
require.NoError(t, err)

cfg, err := Read()
require.NoError(t, err)
assert.Equal(t, "", cfg.AgentMrn)
assert.Equal(t, "//agents.api.mondoo.app/spaces/my-space-id/serviceaccounts/2bUj407V4GF4IKxg3Qn6NhWCr6x", cfg.ServiceAccountMrn)
assert.Equal(t, "-----BEGIN PRIVATE KEY-----\nMIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIG...ILipt7Y8zEZ7PRQPkGUYpWDE8=\n-----END PRIVATE KEY-----\n", cfg.PrivateKey)
assert.Equal(t, "-----BEGIN CERTIFICATE-----\nMIICfDCCAgKgAwIBAgIQGwVGMqyjkNaCGTA96p/...\n2mm3zQE7mUokDf4qY3+SDw==\n-----END CERTIFICATE-----\n", cfg.Certificate)
assert.Equal(t, "//captain.api.mondoo.app/spaces/my-space-id", cfg.GetScopeMrn())
assert.Equal(t, "//captain.api.mondoo.app/spaces/my-space-id", cfg.GetParentMrn())
})

cfg, err := Read()
require.NoError(t, err)
assert.Equal(t, "//agents.api.mondoo.app/spaces/musing-saha-952142/agents/1zDY7auR20SgrFfiGUT5qZWx6mE", cfg.AgentMrn)
assert.Equal(t, "//agents.api.mondoo.app/spaces/musing-saha-952142/serviceaccounts/1zDY7cJ7bA84JxxNBWDxBdui2xE", cfg.ServiceAccountMrn)
assert.Equal(t, "-----BEGIN PRIVATE KEY-----\nMIG2AgE....C0Dvs=\n-----END PRIVATE KEY-----\n", cfg.PrivateKey)
assert.Equal(t, "-----BEGIN CERTIFICATE-----\nMIICV .. fis=\n-----END CERTIFICATE-----\n", cfg.Certificate)
assert.Equal(t, "http://192.168.4.4:3128", cfg.APIProxy)
}
Loading
Loading