mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-04 02:57:27 +09:00
Alexey Artamonov
cc51cac63d
The collector holds a central tenant to its write rate, but the one login it writes with was also the login of the tenant's Grafana datasource, and it could both read and write. vmauth cleans the request path before it picks a route, so any user the tenant admits to its Grafana, a Viewer included, could POST through the datasource proxy to ../insert and write into the shared store past the limiter. Each central tenant now has two VMUsers on its one account: the collector's, which may only write, and Grafana's, which may only read, each with its own chart-owned Secret and password. A namespace name holds no dot, so the reader's username never matches another tenant's. On upgrade the datasource moves to the new login in the same release that creates it, so reads may fail until vmauth loads the new user. Signed-off-by: Alexey Artamonov <aleksei.artamonov@aenix.io>
30 lines
1.5 KiB
Bash
30 lines
1.5 KiB
Bash
#!/usr/bin/env bats
|
|
# The central traces collector reads its vmauth password at start and is rolled
|
|
# by a checksum of it. On a first install the password is random, and it is
|
|
# rendered twice, into the Secret and into that checksum: if the two renders
|
|
# disagree, the collector rolls on every reconcile and the checksum proves
|
|
# nothing. helm-unittest asserts one template at a time and cannot compare them,
|
|
# so this renders both together and compares.
|
|
#
|
|
# Run via hack/cozytest.sh from the repo root (make bats-unit-tests).
|
|
|
|
MONITORING_CHART=packages/system/monitoring
|
|
|
|
@test "a first install hashes the same password it stores" {
|
|
out=$(mktemp -d)
|
|
for run in 1 2 3; do
|
|
helm template monitoring "$MONITORING_CHART" --namespace tenant-foo \
|
|
--show-only templates/vtraces/central-credentials.yaml \
|
|
--show-only templates/vtraces/collector.yaml \
|
|
--set _namespace.tracingCentral=true --set _namespace.host=example.org \
|
|
> "$out/render-$run.yaml"
|
|
password=$(yq eval 'select(.kind == "Secret" and .metadata.name == "traces-central-credentials") | .stringData.password' "$out/render-$run.yaml")
|
|
checksum=$(yq eval 'select(.kind == "Deployment") | .spec.template.metadata.annotations["checksum/credentials"]' "$out/render-$run.yaml")
|
|
# Separate commands: under set -e a failure on the left of && is not fatal.
|
|
[ -n "$password" ]
|
|
[ "$password" != "null" ]
|
|
[ "$(printf '%s' "$password" | sha256sum | cut -d' ' -f1)" = "$checksum" ]
|
|
done
|
|
rm -rf "$out"
|
|
}
|