Skip to content

Move to VerifySecretFields to reject invalid passwords #683

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
openshift-merge-bot merged 1 commit into from
Mar 10, 2026
+313 −145
Merged

Move to VerifySecretFields to reject invalid passwords #683

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 28 additions & 15 deletions internal/controller/ironic_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -376,28 +376,41 @@ func (r *IronicReconciler) reconcileNormal(ctx context.Context, instance *ironic
//
// check for required OpenStack secret holding passwords for service/admin user and add hash to the vars map
//
ospSecret, hash, err := oko_secret.GetSecret(ctx, helper, instance.Spec.Secret, instance.Namespace)
// Associate to PasswordSelectors.Service field a password validator to
// ensure pwd invalid detected patterns are rejected.
validateFields := map[string]oko_secret.Validator{
instance.Spec.PasswordSelectors.Service: oko_secret.PasswordValidator{},
}
hash, ctrlResult, err := oko_secret.VerifySecretFields(
ctx,
types.NamespacedName{
Namespace: instance.Namespace,
Name: instance.Spec.Secret,
},
validateFields,
helper.GetClient(),
time.Duration(10)*time.Second,
)
if err != nil {
if k8s_errors.IsNotFound(err) {
// Since the OpenStack secret should have been manually created by the user and referenced in the spec,
// we treat this as a warning because it means that the service will not be able to start.
Log.Info(fmt.Sprintf("OpenStack secret %s not found", instance.Spec.Secret))
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyWaitingMessage))
return ctrl.Result{}, nil
}
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyErrorMessage,
err.Error()))
return ctrl.Result{}, err
return ctrlResult, err
} else if (ctrlResult != ctrl.Result{}) {
// Since the service secret should have been manually created by the user and referenced in the spec,
// we treat this as a warning because it means that the service will not be able to start.
log.FromContext(ctx).Info(fmt.Sprintf("OpenStack secret %s not found", instance.Spec.Secret))
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyWaitingMessage))
return ctrlResult, err
}
configMapVars[ospSecret.Name] = env.SetValue(hash)
configMapVars[instance.Spec.Secret] = env.SetValue(hash)

instance.Status.Conditions.MarkTrue(condition.InputReadyCondition, condition.InputReadyMessage)
// run check OpenStack secret - end
Expand Down Expand Up @@ -480,7 +493,7 @@ func (r *IronicReconciler) reconcileNormal(ctx context.Context, instance *ironic
}

// Handle service upgrade
ctrlResult, err := r.reconcileUpgrade(ctx, instance, helper, serviceLabels)
ctrlResult, err = r.reconcileUpgrade(ctx, instance, helper, serviceLabels)
if err != nil {
return ctrlResult, err
} else if (ctrlResult != ctrl.Result{}) {
Expand Down
84 changes: 54 additions & 30 deletions internal/controller/ironicapi_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -676,57 +676,81 @@ func (r *IronicAPIReconciler) reconcileNormal(ctx context.Context, instance *iro
//
// check for required OpenStack secret holding passwords for service/admin user and add hash to the vars map
//
ospSecret, hash, err := secret.GetSecret(ctx, helper, instance.Spec.Secret, instance.Namespace)
// Associate to PasswordSelectors.Service field a password validator to
// ensure pwd invalid detected patterns are rejected.
validateFields := map[string]secret.Validator{
instance.Spec.PasswordSelectors.Service: secret.PasswordValidator{},
}
hash, ctrlResult, err := secret.VerifySecretFields(
ctx,
types.NamespacedName{
Namespace: instance.Namespace,
Name: instance.Spec.Secret,
},
validateFields,
helper.GetClient(),
time.Duration(10)*time.Second,
)
if err != nil {
if k8s_errors.IsNotFound(err) {
// Since the OpenStack secret should have been manually created by the user and referenced in the spec,
// we treat this as a warning because it means that the service will not be able to start.
Log.Info(fmt.Sprintf("OpenStack secret %s not found", instance.Spec.Secret))
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyWaitingMessage))
return ctrl.Result{RequeueAfter: time.Second * 10}, nil
}
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyErrorMessage,
err.Error()))
return ctrl.Result{}, err
return ctrlResult, err
} else if (ctrlResult != ctrl.Result{}) {
// Since the service secret should have been manually created by the user and referenced in the spec,
// we treat this as a warning because it means that the service will not be able to start.
log.FromContext(ctx).Info(fmt.Sprintf("OpenStack secret %s not found", instance.Spec.Secret))
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyWaitingMessage))
return ctrlResult, err
}
configMapVars[ospSecret.Name] = env.SetValue(hash)
configMapVars[instance.Spec.Secret] = env.SetValue(hash)
// run check OpenStack secret - end

//
// check for required TransportURL secret holding transport URL string
//
if instance.Spec.RPCTransport == "oslo" {
transportURLSecret, hash, err := secret.GetSecret(ctx, helper, instance.Spec.TransportURLSecret, instance.Namespace)
// transportURLFields are not pure password fields. We do not associate a
// password validator and we only verify that the entry exists in the
// secret
transportValidateFields := map[string]secret.Validator{
"transport_url": secret.NoOpValidator{},
}
hash, ctrlResult, err = secret.VerifySecretFields(
ctx,
types.NamespacedName{
Namespace: instance.Namespace,
Name: instance.Spec.TransportURLSecret,
},
transportValidateFields,
helper.GetClient(),
time.Duration(10)*time.Second,
)
if err != nil {
if k8s_errors.IsNotFound(err) {
// Since the TransportURL secret should have been previously automatically created by the parent
// Ironic CR and then referenced in this instance's spec, we treat this as a warning because it
// means that the service will not be able to start.
Log.Info(fmt.Sprintf("TransportURL secret %s not found", instance.Spec.TransportURLSecret))
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyWaitingMessage))
return ctrl.Result{RequeueAfter: time.Second * 10}, nil
}
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyErrorMessage,
err.Error()))
return ctrl.Result{}, err
return ctrlResult, err
} else if (ctrlResult != ctrl.Result{}) {
Log.Info(fmt.Sprintf("TransportURL secret %s not found", instance.Spec.TransportURLSecret))
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.RequestedReason,
condition.SeverityInfo,
condition.InputReadyWaitingMessage))
return ctrlResult, err
}
configMapVars[transportURLSecret.Name] = env.SetValue(hash)
configMapVars[instance.Spec.TransportURLSecret] = env.SetValue(hash)
}
// run check TransportURL secret - end

Expand Down Expand Up @@ -877,7 +901,7 @@ func (r *IronicAPIReconciler) reconcileNormal(ctx context.Context, instance *iro
}

// Handle service init
ctrlResult, err := r.reconcileInit(ctx, instance, helper, serviceLabels)
ctrlResult, err = r.reconcileInit(ctx, instance, helper, serviceLabels)
if err != nil {
return ctrlResult, err
} else if (ctrlResult != ctrl.Result{}) {
Expand Down
85 changes: 55 additions & 30 deletions internal/controller/ironicconductor_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -550,57 +550,82 @@ func (r *IronicConductorReconciler) reconcileNormal(ctx context.Context, instanc
//
// check for required OpenStack secret holding passwords for service/admin user and add hash to the vars map
//
ospSecret, hash, err := secret.GetSecret(ctx, helper, instance.Spec.Secret, instance.Namespace)
// Associate to PasswordSelectors.Service field a password validator to
// ensure pwd invalid detected patterns are rejected.
validateFields := map[string]secret.Validator{
instance.Spec.PasswordSelectors.Service: secret.PasswordValidator{},
}
hash, ctrlResult, err := secret.VerifySecretFields(
ctx,
types.NamespacedName{
Namespace: instance.Namespace,
Name: instance.Spec.Secret,
},
validateFields,
helper.GetClient(),
time.Duration(10)*time.Second,
)
if err != nil {
if k8s_errors.IsNotFound(err) {
// Since the OpenStack secret should have been manually created by the user and referenced in the spec,
// we treat this as a warning because it means that the service will not be able to start.
Log.Info(fmt.Sprintf("OpenStack secret %s not found", instance.Spec.Secret))
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyWaitingMessage))
return ctrl.Result{RequeueAfter: time.Second * 10}, nil
}
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyErrorMessage,
err.Error()))
return ctrl.Result{}, err
return ctrlResult, err
} else if (ctrlResult != ctrl.Result{}) {
// Since the service secret should have been manually created by the user and referenced in the spec,
// we treat this as a warning because it means that the service will not be able to start.
log.FromContext(ctx).Info(fmt.Sprintf("OpenStack secret %s not found", instance.Spec.Secret))
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyWaitingMessage))
return ctrlResult, err
}
configMapVars[ospSecret.Name] = env.SetValue(hash)
configMapVars[instance.Spec.Secret] = env.SetValue(hash)
// run check OpenStack secret - end

//
// check for required TransportURL secret holding transport URL string
//
if instance.Spec.RPCTransport == "oslo" {
transportURLSecret, hash, err := secret.GetSecret(ctx, helper, instance.Spec.TransportURLSecret, instance.Namespace)
// transportURLFields are not pure password fields. We do not associate a
// password validator and we only verify that the entry exists in the
// secret
transportValidateFields := map[string]secret.Validator{
"transport_url": secret.NoOpValidator{},
}
hash, ctrlResult, err = secret.VerifySecretFields(
ctx,
types.NamespacedName{
Namespace: instance.Namespace,
Name: instance.Spec.TransportURLSecret,
},
transportValidateFields,
helper.GetClient(),
time.Duration(10)*time.Second,
)
// NOTE: This should be moved to TransportURLSecretReadyCondition
if err != nil {
if k8s_errors.IsNotFound(err) {
// Since the TransportURL secret should have been previously automatically created by the parent
// Ironic CR and then referenced in this instance's spec, we treat this as a warning because it
// means that the service will not be able to start.
Log.Info(fmt.Sprintf("TransportURL secret %s not found", instance.Spec.TransportURLSecret))
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyWaitingMessage))
return ctrl.Result{RequeueAfter: time.Second * 10}, nil
}
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.ErrorReason,
condition.SeverityWarning,
condition.InputReadyErrorMessage,
err.Error()))
return ctrl.Result{}, err
return ctrlResult, err
} else if (ctrlResult != ctrl.Result{}) {
Log.Info(fmt.Sprintf("TransportURL secret %s not found", instance.Spec.TransportURLSecret))
instance.Status.Conditions.Set(condition.FalseCondition(
condition.InputReadyCondition,
condition.RequestedReason,
condition.SeverityInfo,
condition.InputReadyWaitingMessage))
return ctrlResult, err
}
configMapVars[transportURLSecret.Name] = env.SetValue(hash)
configMapVars[instance.Spec.TransportURLSecret] = env.SetValue(hash)
}
// run check TransportURL secret - end

Expand Down Expand Up @@ -772,7 +797,7 @@ func (r *IronicConductorReconciler) reconcileNormal(ctx context.Context, instanc
time.Duration(5)*time.Second,
)

ctrlResult, err := ss.CreateOrPatch(ctx, helper)
ctrlResult, err = ss.CreateOrPatch(ctx, helper)
if err != nil {
instance.Status.Conditions.Set(condition.FalseCondition(
condition.DeploymentReadyCondition,
Expand Down
Loading