Add support of non-secret configs #1619
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -33,6 +33,7 @@ import ( | |
| "github.com/aws/aws-sdk-go-v2/service/route53" | ||
| "github.com/aws/aws-sdk-go-v2/service/s3" | ||
| s3types "github.com/aws/aws-sdk-go-v2/service/s3/types" | ||
| ssmTypes "github.com/aws/aws-sdk-go-v2/service/ssm/types" | ||
| "github.com/aws/aws-sdk-go-v2/service/sts" | ||
| "github.com/aws/smithy-go" | ||
| "github.com/aws/smithy-go/ptr" | ||
|
|
@@ -540,13 +541,67 @@ func (b *ByocAws) getSecretID(projectName, name string) string { | |
| return b.StackDir(projectName, name) // same as defang_service.ts | ||
| } | ||
|
|
||
| func (b *ByocAws) GetConfigs(ctx context.Context, secret *defangv1.GetConfigsRequest) (*defangv1.GetConfigsResponse, error) { | ||
| resp := &defangv1.GetConfigsResponse{} | ||
|
|
||
| // gather unique project names to config name | ||
| projects, projectConfigs := getUniqueProjectConfigs(secret, b) | ||
|
|
||
| for project := range projects { | ||
| fqn := b.getSecretID(project, "") | ||
| term.Debugf("Getting parameter %q", fqn) | ||
| params, _ := b.driver.GetSecret(ctx, fqn) | ||
|
|
||
| ssmParamToGetConfigResponse(params, projectConfigs, resp, project) | ||
| } | ||
| return resp, nil | ||
| } | ||
|
|
||
| func ssmParamToGetConfigResponse(ssmParameters []ssmTypes.Parameter, projectConfigs map[string]struct{}, resp *defangv1.GetConfigsResponse, project string) { | ||
| for _, param := range ssmParameters { | ||
| if param.Name == nil || param.Value == nil { | ||
| continue | ||
| } | ||
| if _, found := projectConfigs[*param.Name]; found { | ||
| configType := defangv1.ConfigType_CONFIGTYPE_SENSITIVE | ||
| if param.Type == ssmTypes.ParameterTypeString { | ||
| configType = defangv1.ConfigType_CONFIGTYPE_INSENSITIVE | ||
| } | ||
| resp.Configs = append(resp.Configs, &defangv1.Config{ | ||
| Project: project, | ||
| Name: *param.Name, | ||
| Value: *param.Value, | ||
| Type: configType, | ||
| }) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| func getUniqueProjectConfigs(secret *defangv1.GetConfigsRequest, b *ByocAws) (map[string]struct{}, map[string]struct{}) { | ||
| projects := make(map[string]struct{}) | ||
| projectConfigs := make(map[string]struct{}) | ||
|
|
||
| for _, config := range secret.Configs { | ||
| if _, found := projects[config.Project]; !found { | ||
| projects[config.Project] = struct{}{} | ||
| } | ||
| projectConfigs[b.getSecretID(config.Project, config.Name)] = struct{}{} | ||
| } | ||
| return projects, projectConfigs | ||
| } | ||
|
|
||
| func (b *ByocAws) PutConfig(ctx context.Context, secret *defangv1.PutConfigRequest) error { | ||
| if !pkg.IsValidSecretName(secret.Name) { | ||
| return connect.NewError(connect.CodeInvalidArgument, fmt.Errorf("invalid config name; must be alphanumeric or _, cannot start with a number: %q", secret.Name)) | ||
| } | ||
| fqn := b.getSecretID(secret.Project, secret.Name) | ||
| term.Debugf("Putting parameter %q", fqn) | ||
|
|
||
| encrypt := true | ||
| if secret.Type == defangv1.ConfigType_CONFIGTYPE_INSENSITIVE { | ||
| encrypt = false | ||
| } | ||
| err := b.driver.PutSecret(ctx, encrypt, fqn, secret.Value) | ||
| return AnnotateAwsError(err) | ||
| } | ||
|
|
||
|
|
@@ -830,7 +885,10 @@ func (b *ByocAws) DeleteConfig(ctx context.Context, secrets *defangv1.Secrets) e | |
| } | ||
| term.Debug("Deleting parameters", ids) | ||
| if err := b.driver.DeleteSecrets(ctx, ids...); err != nil { | ||
| var paramNotFoundErr *ssmTypes.ParameterNotFound | ||
| if !errors.As(err, ¶mNotFoundErr) { | ||
| return AnnotateAwsError(err) | ||
| } | ||
| } | ||
| return nil | ||
| } | ||
|
|
||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,6 +19,7 @@ import ( | |
| "github.com/DefangLabs/defang/src/pkg/dns" | ||
| "github.com/DefangLabs/defang/src/pkg/types" | ||
| defangv1 "github.com/DefangLabs/defang/src/protos/io/defang/v1" | ||
| ssmTypes "github.com/aws/aws-sdk-go-v2/service/ssm/types" | ||
| composeTypes "github.com/compose-spec/compose-go/v2/types" | ||
| ) | ||
|
|
||
|
|
@@ -173,3 +174,136 @@ func TestSubscribe(t *testing.T) { | |
| }) | ||
| } | ||
| } | ||
| func TestGetUniqueProjectConfigs(t *testing.T) { | ||
| b := &ByocAws{ | ||
| ByocBaseClient: &byoc.ByocBaseClient{ | ||
| PulumiStack: "test-stack", | ||
| }, | ||
| } | ||
|
|
||
| req := &defangv1.GetConfigsRequest{ | ||
| Configs: []*defangv1.ConfigKey{ | ||
| {Project: "proj1", Name: "cfg1"}, | ||
| {Project: "proj1", Name: "cfg2"}, | ||
| {Project: "proj2", Name: "cfg1"}, | ||
| {Project: "proj2", Name: "cfg3"}, | ||
| {Project: "proj1", Name: "cfg1"}, // duplicate | ||
| }, | ||
| } | ||
|
|
||
| projects, projectConfigs := getUniqueProjectConfigs(req, b) | ||
|
|
||
| // Check projects | ||
| expectedProjects := map[string]struct{}{ | ||
| "proj1": {}, | ||
| "proj2": {}, | ||
| } | ||
| if len(projects) != len(expectedProjects) { | ||
| t.Errorf("expected %d projects, got %d", len(expectedProjects), len(projects)) | ||
| } | ||
| for k := range expectedProjects { | ||
| if _, ok := projects[k]; !ok { | ||
| t.Errorf("expected project %q in result", k) | ||
| } | ||
| } | ||
|
|
||
| // Check projectConfigs | ||
| expectedConfigs := map[string]struct{}{ | ||
| "/Defang/proj1/test-stack/cfg1": {}, | ||
| "/Defang/proj1/test-stack/cfg2": {}, | ||
| "/Defang/proj2/test-stack/cfg1": {}, | ||
| "/Defang/proj2/test-stack/cfg3": {}, | ||
| } | ||
| if len(projectConfigs) != len(expectedConfigs) { | ||
| t.Errorf("expected %d projectConfigs, got %d", len(expectedConfigs), len(projectConfigs)) | ||
| } | ||
| for k := range expectedConfigs { | ||
| if _, ok := projectConfigs[k]; !ok { | ||
| t.Errorf("expected config %q in result", k) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| func TestSsmParamToGetConfigResponse(t *testing.T) { | ||
| project := "proj1" | ||
| resp := &defangv1.GetConfigsResponse{} | ||
|
|
||
| paramName1 := "/Defang/proj1/test-stack/cfg1" | ||
| paramValue1 := "secret1" | ||
| paramName2 := "/Defang/proj1/test-stack/cfg2" | ||
| paramValue2 := "notsecret" | ||
| paramName3 := "/Defang/proj1/test-stack/other" | ||
| paramValue3 := "shouldskip" | ||
|
|
||
| // configs | ||
| ssmParameters := []ssmTypes.Parameter{ | ||
| { | ||
| // sensitive parameter | ||
| Name: ¶mName1, | ||
| Value: ¶mValue1, | ||
| Type: ssmTypes.ParameterTypeSecureString, | ||
| }, | ||
| { | ||
| // insensitive parameter | ||
| Name: ¶mName2, | ||
| Value: ¶mValue2, | ||
| Type: ssmTypes.ParameterTypeString, | ||
| }, | ||
| { | ||
| // wll be skipped since Name is nil | ||
| Name: nil, | ||
| Value: ¶mValue3, | ||
| Type: ssmTypes.ParameterTypeString, | ||
| }, | ||
| { | ||
| // will be skipped since Value is nil | ||
| Name: ¶mName3, | ||
| Value: nil, | ||
| Type: ssmTypes.ParameterTypeString, | ||
| }, | ||
| } | ||
|
|
||
| projectConfigs := map[string]struct{}{ | ||
| paramName1: {}, | ||
| paramName2: {}, | ||
| } | ||
|
|
||
| ssmParamToGetConfigResponse(ssmParameters, projectConfigs, resp, project) | ||
|
|
||
| if len(resp.Configs) != 2 { | ||
| t.Fatalf("expected 2 configs, got %d", len(resp.Configs)) | ||
| } | ||
|
|
||
| expected := []*defangv1.Config{ | ||
| { | ||
| Project: project, | ||
| Name: paramName1, | ||
| Value: paramValue1, | ||
| Type: defangv1.ConfigType_CONFIGTYPE_SENSITIVE, | ||
| }, | ||
| { | ||
| Project: project, | ||
| Name: paramName2, | ||
| Value: paramValue2, | ||
| Type: defangv1.ConfigType_CONFIGTYPE_INSENSITIVE, | ||
| }, | ||
| } | ||
|
|
||
| for i, expectedConfig := range expected { | ||
| actualConfig := resp.Configs[i] | ||
|
|
||
| // compare all fields | ||
| if actualConfig.Project != expectedConfig.Project { | ||
| t.Errorf("config[%d] project: got %q, want %q", i, actualConfig.Project, expectedConfig.Project) | ||
| } | ||
| if actualConfig.Name != expectedConfig.Name { | ||
| t.Errorf("config[%d] name: got %q, want %q", i, actualConfig.Name, expectedConfig.Name) | ||
| } | ||
| if actualConfig.Value != expectedConfig.Value { | ||
| t.Errorf("config[%d] value: got %q, want %q", i, actualConfig.Value, expectedConfig.Value) | ||
| } | ||
| if actualConfig.Type != expectedConfig.Type { | ||
| t.Errorf("config[%d] type: got %v, want %v", i, actualConfig.Type, expectedConfig.Type) | ||
| } | ||
| } | ||
| } | ||
Oops, something went wrong.
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Boolean flags with
trueas default are a little awkward since the only way to really use it is to say--secret=false, which can perhaps be considered a feature since you make it explicit that a config can be read?