Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Modify parsing behavior of login credentials to handle Go escape characters #564

Merged
merged 5 commits into from
Feb 22, 2024

Conversation

varunsrinivasan2
Copy link
Collaborator

@varunsrinivasan2 varunsrinivasan2 commented Jan 22, 2024

What this PR does / why we need it:
This PR addresses the issue when vSphere login credentials contain Go escape characters (e.g. \ or \n). The credentials are read from a configuration file where the keys, such user and password, are stored with values that are quoted. The values need to be read without quotes, but when the value contains a Go escape character, the strconv.Unquote method may fail in certain cases causing cascading errors due to login failures. In this change, the ParseLines function is removed and a ParseConfig function is introduced. The ParseConfig function takes in the Kubernetes Secret and the empty map of params from the original caller. To be consistent with vSphere's CSI plugin, a new VCConfig struct is introduced to hold the configuration data and the function will use the gcfg package to read the configuration data which will handle unquoting the strings. It will then iterate over the VCConfig struct to assign the values to the necessary keys to allow the plugin to connect to VC.

Example:
If VC password is }sso\d$2!UsO
Configuration file should escape with \\ as such:

password = "}sso\\d$2!UsO"

Testing:

Pods are in running state when using password with escape character, tested with passwords escaped in conf file as described in this Github Issue from vSphere's CSI plugin: kubernetes-sigs/vsphere-csi-driver#121

root@k8s-control-807-1707807050:~# kubectl -n velero get all
NAME                                   READY   STATUS    RESTARTS   AGE
pod/backup-driver-7c9798458f-2hl4t     1/1     Running   0          25m
pod/datamgr-for-vsphere-plugin-42265   1/1     Running   0          24m
pod/datamgr-for-vsphere-plugin-4ltd9   1/1     Running   0          24m
pod/datamgr-for-vsphere-plugin-z5wvh   1/1     Running   0          24m
pod/velero-66c7fbb8c7-bkr9m            1/1     Running   0          27m
 
NAME                                        DESIRED   CURRENT   READY   UP-TO-DATE   AVAILABLE   NODE SELECTOR   AGE
daemonset.apps/datamgr-for-vsphere-plugin   3         3         3       3            3           <none>          24m
 
NAME                            READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/backup-driver   1/1     1            1           25m
deployment.apps/velero          1/1     1            1           27m
 
NAME                                       DESIRED   CURRENT   READY   AGE
replicaset.apps/backup-driver-7c9798458f   1         1         1       25m
replicaset.apps/velero-66c7fbb8c7          1         1         1       27m

Successful backup:

root@k8s-control-807-1707807050:~# velero backup describe test-config3
Name:         test-config3
Namespace:    velero
Labels:       velero.io/storage-location=default
Annotations:  velero.io/source-cluster-k8s-gitversion=v1.29.1
              velero.io/source-cluster-k8s-major-version=1
              velero.io/source-cluster-k8s-minor-version=29

Phase:  Completed


Warnings:
  Velero:     <none>
  Cluster:   resource: /persistentvolumes name: /pvc-a6049ba0-1b29-406e-864c-aa7e39e85495
  Namespaces: <none>

Namespaces:
  Included:  demo-app
  Excluded:  <none>

Resources:
  Included:        *
  Excluded:        <none>
  Cluster-scoped:  auto

Label selector:  <none>

Storage Location:  default

Velero-Native Snapshot PVs:  auto

TTL:  720h0m0s

CSISnapshotTimeout:    10m0s
ItemOperationTimeout:  1h0m0s

Hooks:  <none>

Backup Format Version:  1.1.0

Started:    2024-02-17 15:54:12 +0000 UTC
Completed:  2024-02-17 15:54:40 +0000 UTC

Expiration:  2024-03-18 15:54:12 +0000 UTC

Total items to be backed up:  11
Items backed up:              11

Succesful restore:

root@k8s-control-807-1707807050:~# velero restore describe restore-test-config3
Name:         restore-test-config3
Namespace:    velero
Labels:       <none>
Annotations:  <none>

Phase:                       Completed
Total items to be restored:  11
Items restored:              11

Started:    2024-02-17 15:56:16 +0000 UTC
Completed:  2024-02-17 15:57:00 +0000 UTC

Warnings:
  Velero:     <none>
  Cluster:    <none>
  Namespaces:
    demo-app:  could not restore, ConfigMap "kube-root-ca.crt" already exists. Warning: the in-cluster version is different than the backed-up version.

Backup:  test-config3

Namespaces:
  Included:  all namespaces found in the backup
  Excluded:  <none>

Resources:
  Included:        *
  Excluded:        nodes, events, events.events.k8s.io, backups.velero.io, restores.velero.io, resticrepositories.velero.io, csinodes.storage.k8s.io, volumeattachments.storage.k8s.io, backuprepositories.velero.io
  Cluster-scoped:  auto

Namespace mappings:  <none>

Label selector:  <none>

Restore PVs:  auto

Existing Resource Policy:   <none>
ItemOperationTimeout:       1h0m0s

Preserve Service NodePorts:  auto

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

With this change, when a Go special character is in the password, they will have to escape the character just as they would for vSphere CSI plugin.

@varunsrinivasan2 varunsrinivasan2 force-pushed the fix-parse-login branch 2 times, most recently from b07e32a to a5a9e2b Compare January 25, 2024 00:21
pkg/utils/utils.go Outdated Show resolved Hide resolved
Create common config and new function to parse config data
… port if config port value is empty

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>
Signed-off-by: Varun Srinivasan <varuns6@vmware.com>
@varunsrinivasan2 varunsrinivasan2 changed the title [WIP] Modify parsing behavior of login credentials to handle Go escape characters Modify parsing behavior of login credentials to handle Go escape characters Feb 15, 2024
@xing-yang
Copy link
Contributor

Please add a release note.

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>
Copy link
Collaborator

@deepakkinni deepakkinni left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Move the testing done to the PR description instead of a comment.

pkg/utils/utils.go Outdated Show resolved Hide resolved
pkg/utils/utils.go Show resolved Hide resolved
pkg/utils/utils_unit_test.go Show resolved Hide resolved
Signed-off-by: Varun Srinivasan <varuns6@vmware.com>
@xing-yang
Copy link
Contributor

Can you give an example on what the user should set in the configmap?

Copy link
Contributor

@xing-yang xing-yang left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@xing-yang xing-yang merged commit 67d5d09 into vmware-tanzu:main Feb 22, 2024
2 checks passed
@xing-yang
Copy link
Contributor

@varunsrinivasan2 Can you update the documentation?

@varunsrinivasan2
Copy link
Collaborator Author

Can you give an example on what the user should set in the configmap?

@xing-yang updated comment with example.

@varunsrinivasan2 Can you update the documentation?

Will do.

lipingxue pushed a commit to lipingxue/velero-plugin-for-vsphere that referenced this pull request Mar 11, 2024
…acters (vmware-tanzu#564)

* Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

Create common config and new function to parse config data

* Always populate "port" key of parameters map after setting default VC port if config port value is empty

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

* Clean up test logging and unit tests

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

* Keep only necessary config values

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

* Refactor ParseConfig to return error for sanitized error handling

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

---------

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>
lipingxue pushed a commit to lipingxue/velero-plugin-for-vsphere that referenced this pull request Mar 11, 2024
…acters (vmware-tanzu#564)

* Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

Create common config and new function to parse config data

* Always populate "port" key of parameters map after setting default VC port if config port value is empty

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

* Clean up test logging and unit tests

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

* Keep only necessary config values

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

* Refactor ParseConfig to return error for sanitized error handling

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

---------

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>
Signed-off-by: Liping Xue <lipingx@vmware.com>
lipingxue added a commit that referenced this pull request Mar 11, 2024
* Update support matrix for Vanilla, WCP and GC. (#559)

Signed-off-by: Liping Xue <lipingx@vmware.com>

* Document change to update known issue. (#560)

* Document change.

Signed-off-by: Liping Xue <lipingx@vmware.com>

* Address comment from Xing.

Signed-off-by: Liping Xue <lipingx@vmware.com>

* Remove files that are not needed for this change.

Signed-off-by: Liping Xue <lipingx@vmware.com>

---------

Signed-off-by: Liping Xue <lipingx@vmware.com>

* Bump golang.org/x/crypto from 0.14.0 to 0.17.0 (#562)

Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.14.0 to 0.17.0.
- [Commits](golang/crypto@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/crypto
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Liping Xue <lipingx@vmware.com>

* Update document. (#566)

Signed-off-by: Liping Xue <lipingx@vmware.com>

* Modify parsing behavior of login credentials to handle Go escape characters (#564)

* Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

Create common config and new function to parse config data

* Always populate "port" key of parameters map after setting default VC port if config port value is empty

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

* Clean up test logging and unit tests

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

* Keep only necessary config values

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

* Refactor ParseConfig to return error for sanitized error handling

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

---------

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>
Signed-off-by: Liping Xue <lipingx@vmware.com>

* Only skip PVC creation if --namespace-mapping flag is not used (#565)

* Only skip PVC creation if --namespace-mapping flag is not used

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

* Refactor SkipPVCCreation function signature to add target namespace as a parameter

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>

---------

Signed-off-by: Varun Srinivasan <varuns6@vmware.com>
Signed-off-by: Liping Xue <lipingx@vmware.com>

* Add doc that wffc is not supported (#567)

Signed-off-by: xing-yang <xingyang105@gmail.com>
Signed-off-by: Liping Xue <lipingx@vmware.com>

* Fail the Restore if the StorageClass is associated with WaitForFirstConsumer volumeBindingMode (#568)

Signed-off-by: Deepak Kinni <dkinni@vmware.com>
Co-authored-by: Deepak Kinni <dkinni@vmware.com>
Signed-off-by: Liping Xue <lipingx@vmware.com>

---------

Signed-off-by: Liping Xue <lipingx@vmware.com>
Signed-off-by: dependabot[bot] <support@github.com>
Signed-off-by: Varun Srinivasan <varuns6@vmware.com>
Signed-off-by: xing-yang <xingyang105@gmail.com>
Signed-off-by: Deepak Kinni <dkinni@vmware.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Varun Srinivasan <varun.srinivasan@broadcom.com>
Co-authored-by: Xing Yang <xingyang105@gmail.com>
Co-authored-by: Deepak Kinni <deepak.kinni@broadcom.com>
Co-authored-by: Deepak Kinni <dkinni@vmware.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants