|
|
@@ -17,6 +17,7 @@ import (
|
|
|
"context"
|
|
|
"encoding/base64"
|
|
|
"encoding/json"
|
|
|
+ "errors"
|
|
|
"fmt"
|
|
|
"os"
|
|
|
"sync"
|
|
|
@@ -30,7 +31,9 @@ import (
|
|
|
corev1 "k8s.io/api/core/v1"
|
|
|
apiextensionsv1 "k8s.io/apiextensions-apiserver/pkg/apis/apiextensions/v1"
|
|
|
"k8s.io/apimachinery/pkg/types"
|
|
|
+ "k8s.io/client-go/kubernetes"
|
|
|
kclient "sigs.k8s.io/controller-runtime/pkg/client"
|
|
|
+ ctrlcfg "sigs.k8s.io/controller-runtime/pkg/client/config"
|
|
|
|
|
|
esv1beta1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1beta1"
|
|
|
esmeta "github.com/external-secrets/external-secrets/apis/meta/v1"
|
|
|
@@ -167,25 +170,7 @@ func (vms *VaultManagementService) NewClient(ctx context.Context, store esv1beta
|
|
|
)
|
|
|
|
|
|
if oracleSpec.PrincipalType == esv1beta1.WorkloadPrincipal {
|
|
|
- defer vms.workloadIdentityMutex.Unlock()
|
|
|
- vms.workloadIdentityMutex.Lock()
|
|
|
- // OCI SDK requires specific environment variables for workload identity.
|
|
|
- if err := os.Setenv(auth.ResourcePrincipalVersionEnvVar, auth.ResourcePrincipalVersion2_2); err != nil {
|
|
|
- return nil, fmt.Errorf("unable to set OCI SDK environment variable %s: %w", auth.ResourcePrincipalVersionEnvVar, err)
|
|
|
- }
|
|
|
- if err := os.Setenv(auth.ResourcePrincipalRegionEnvVar, oracleSpec.Region); err != nil {
|
|
|
- return nil, fmt.Errorf("unable to set OCI SDK environment variable %s: %w", auth.ResourcePrincipalRegionEnvVar, err)
|
|
|
- }
|
|
|
- configurationProvider, err = auth.OkeWorkloadIdentityConfigurationProvider()
|
|
|
- if err := os.Unsetenv(auth.ResourcePrincipalVersionEnvVar); err != nil {
|
|
|
- return nil, fmt.Errorf("unabled to unset OCI SDK environment variable %s: %w", auth.ResourcePrincipalVersionEnvVar, err)
|
|
|
- }
|
|
|
- if err := os.Unsetenv(auth.ResourcePrincipalRegionEnvVar); err != nil {
|
|
|
- return nil, fmt.Errorf("unabled to unset OCI SDK environment variable %s: %w", auth.ResourcePrincipalRegionEnvVar, err)
|
|
|
- }
|
|
|
- if err != nil {
|
|
|
- return nil, err
|
|
|
- }
|
|
|
+ configurationProvider, err = vms.getWorkloadIdentityProvider(store, oracleSpec.ServiceAccountRef, oracleSpec.Region, namespace)
|
|
|
} else if oracleSpec.PrincipalType == esv1beta1.InstancePrincipal || oracleSpec.Auth == nil {
|
|
|
configurationProvider, err = auth.InstancePrincipalConfigurationProvider()
|
|
|
} else {
|
|
|
@@ -394,9 +379,53 @@ func (vms *VaultManagementService) ValidateStore(store esv1beta1.GenericStore) e
|
|
|
return err
|
|
|
}
|
|
|
|
|
|
+ if oracleSpec.ServiceAccountRef != nil {
|
|
|
+ if err := utils.ValidateReferentServiceAccountSelector(store, *oracleSpec.ServiceAccountRef); err != nil {
|
|
|
+ return fmt.Errorf("invalid ServiceAccountRef: %w", err)
|
|
|
+ }
|
|
|
+ }
|
|
|
+
|
|
|
return nil
|
|
|
}
|
|
|
|
|
|
+func (vms *VaultManagementService) getWorkloadIdentityProvider(store esv1beta1.GenericStore, serviceAcccountRef *esmeta.ServiceAccountSelector, region, namespace string) (configurationProvider common.ConfigurationProvider, err error) {
|
|
|
+ defer func() {
|
|
|
+ if uerr := os.Unsetenv(auth.ResourcePrincipalVersionEnvVar); uerr != nil {
|
|
|
+ err = errors.Join(err, fmt.Errorf("unable to set OCI SDK environment variable %s: %w", auth.ResourcePrincipalRegionEnvVar, uerr))
|
|
|
+ }
|
|
|
+ if uerr := os.Unsetenv(auth.ResourcePrincipalRegionEnvVar); uerr != nil {
|
|
|
+ err = errors.Join(err, fmt.Errorf("unabled to unset OCI SDK environment variable %s: %w", auth.ResourcePrincipalVersionEnvVar, uerr))
|
|
|
+ }
|
|
|
+ vms.workloadIdentityMutex.Unlock()
|
|
|
+ }()
|
|
|
+ vms.workloadIdentityMutex.Lock()
|
|
|
+ // OCI SDK requires specific environment variables for workload identity.
|
|
|
+ if err := os.Setenv(auth.ResourcePrincipalVersionEnvVar, auth.ResourcePrincipalVersion2_2); err != nil {
|
|
|
+ return nil, fmt.Errorf("unable to set OCI SDK environment variable %s: %w", auth.ResourcePrincipalVersionEnvVar, err)
|
|
|
+ }
|
|
|
+ if err := os.Setenv(auth.ResourcePrincipalRegionEnvVar, region); err != nil {
|
|
|
+ return nil, fmt.Errorf("unable to set OCI SDK environment variable %s: %w", auth.ResourcePrincipalRegionEnvVar, err)
|
|
|
+ }
|
|
|
+ // If no service account is specified, use the pod service account to create the Workload Identity provider.
|
|
|
+ if serviceAcccountRef == nil {
|
|
|
+ return auth.OkeWorkloadIdentityConfigurationProvider()
|
|
|
+ }
|
|
|
+ // Ensure the service account ref is being used appropriately, so arbitrary tokens are not minted by the provider.
|
|
|
+ if err = utils.ValidateServiceAccountSelector(store, *serviceAcccountRef); err != nil {
|
|
|
+ return nil, fmt.Errorf("invalid ServiceAccountRef: %w", err)
|
|
|
+ }
|
|
|
+ cfg, err := ctrlcfg.GetConfig()
|
|
|
+ if err != nil {
|
|
|
+ return nil, err
|
|
|
+ }
|
|
|
+ clientset, err := kubernetes.NewForConfig(cfg)
|
|
|
+ if err != nil {
|
|
|
+ return nil, err
|
|
|
+ }
|
|
|
+ tokenProvider := NewTokenProvider(clientset, serviceAcccountRef, namespace)
|
|
|
+ return auth.OkeWorkloadIdentityConfigurationProviderWithServiceAccountTokenProvider(tokenProvider)
|
|
|
+}
|
|
|
+
|
|
|
func init() {
|
|
|
esv1beta1.Register(&VaultManagementService{}, &esv1beta1.SecretStoreProvider{
|
|
|
Oracle: &esv1beta1.OracleProvider{},
|
Anders Swanson