Skip to content

Commit 3e8e3bf

Browse files
iamayushmiamayushm
authored
feat: insecure support for chart-sync (#5328)
* passing allowInsecureConnection * skipping validation for username, password and url * update issue fix * updating argocd secret * migration default value * migration script update
1 parent ba9c7a7 commit 3e8e3bf

File tree

10 files changed

+374
-334
lines changed

10 files changed

+374
-334
lines changed

‎api/chartRepo/ChartRepositoryRestHandler.go

Lines changed: 1 addition & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -208,12 +208,7 @@ func (handler *ChartRepositoryRestHandlerImpl) UpdateChartRepo(w http.ResponseWr
208208
common.WriteJsonResp(w, err, nil, http.StatusBadRequest)
209209
return
210210
}
211-
err = handler.chartRepositoryService.ValidateDeploymentCount(request)
212-
if err != nil {
213-
handler.Logger.Errorw("error updating, UpdateChartRepo", "err", err, "payload", request)
214-
common.WriteJsonResp(w, err, nil, http.StatusInternalServerError)
215-
return
216-
}
211+
217212
token := r.Header.Get("token")
218213
if ok := handler.enforcer.Enforce(token, casbin.ResourceGlobal, casbin.ActionUpdate, "*"); !ok {
219214
common.WriteJsonResp(w, errors.New("unauthorized"), nil, http.StatusForbidden)

‎api/helm-app/gRPC/applist.pb.go

Lines changed: 303 additions & 291 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎api/helm-app/gRPC/applist.proto

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -281,6 +281,7 @@ message ChartRepository {
281281
string url = 2;
282282
string username = 3;
283283
string password = 4;
284+
bool allowInsecureConnection = 5;
284285
}
285286

286287
message InstallReleaseRequest {

‎api/helm-app/service/HelmAppService.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -954,10 +954,11 @@ func (impl *HelmAppServiceImpl) TemplateChart(ctx context.Context, templateChart
954954
}
955955
} else {
956956
chartRepository = &gRPC.ChartRepository{
957-
Name: appStoreAppVersion.AppStore.ChartRepo.Name,
958-
Url: appStoreAppVersion.AppStore.ChartRepo.Url,
959-
Username: appStoreAppVersion.AppStore.ChartRepo.UserName,
960-
Password: appStoreAppVersion.AppStore.ChartRepo.Password,
957+
Name: appStoreAppVersion.AppStore.ChartRepo.Name,
958+
Url: appStoreAppVersion.AppStore.ChartRepo.Url,
959+
Username: appStoreAppVersion.AppStore.ChartRepo.UserName,
960+
Password: appStoreAppVersion.AppStore.ChartRepo.Password,
961+
AllowInsecureConnection: appStoreAppVersion.AppStore.ChartRepo.AllowInsecureConnection,
961962
}
962963
}
963964

‎pkg/appStore/installedApp/service/AppStoreDeploymentService.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -926,10 +926,11 @@ func (impl *AppStoreDeploymentServiceImpl) linkHelmApplicationToChartStore(insta
926926
}
927927
if chartRepoInfo != nil {
928928
updateReleaseRequest.ChartRepository = &bean4.ChartRepository{
929-
Name: chartRepoInfo.Name,
930-
Url: chartRepoInfo.Url,
931-
Username: chartRepoInfo.UserName,
932-
Password: chartRepoInfo.Password,
929+
Name: chartRepoInfo.Name,
930+
Url: chartRepoInfo.Url,
931+
Username: chartRepoInfo.UserName,
932+
Password: chartRepoInfo.Password,
933+
AllowInsecureConnection: chartRepoInfo.AllowInsecureConnection,
933934
}
934935
}
935936
res, err := impl.helmAppService.UpdateApplicationWithChartInfo(ctx, installAppVersionRequest.ClusterId, updateReleaseRequest)

‎pkg/appStore/installedApp/service/EAMode/EAModeDeploymentService.go

Lines changed: 10 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -128,10 +128,11 @@ func (impl *EAModeDeploymentServiceImpl) InstallApp(installAppVersionRequest *ap
128128
}
129129
} else {
130130
chartRepository = &gRPC.ChartRepository{
131-
Name: appStoreAppVersion.AppStore.ChartRepo.Name,
132-
Url: appStoreAppVersion.AppStore.ChartRepo.Url,
133-
Username: appStoreAppVersion.AppStore.ChartRepo.UserName,
134-
Password: appStoreAppVersion.AppStore.ChartRepo.Password,
131+
Name: appStoreAppVersion.AppStore.ChartRepo.Name,
132+
Url: appStoreAppVersion.AppStore.ChartRepo.Url,
133+
Username: appStoreAppVersion.AppStore.ChartRepo.UserName,
134+
Password: appStoreAppVersion.AppStore.ChartRepo.Password,
135+
AllowInsecureConnection: appStoreAppVersion.AppStore.ChartRepo.AllowInsecureConnection,
135136
}
136137
}
137138
installReleaseRequest := &gRPC.InstallReleaseRequest{
@@ -340,10 +341,11 @@ func (impl *EAModeDeploymentServiceImpl) updateApplicationWithChartInfo(ctx cont
340341
}
341342
} else {
342343
chartRepository = &gRPC.ChartRepository{
343-
Name: appStoreApplicationVersion.AppStore.ChartRepo.Name,
344-
Url: appStoreApplicationVersion.AppStore.ChartRepo.Url,
345-
Username: appStoreApplicationVersion.AppStore.ChartRepo.UserName,
346-
Password: appStoreApplicationVersion.AppStore.ChartRepo.Password,
344+
Name: appStoreApplicationVersion.AppStore.ChartRepo.Name,
345+
Url: appStoreApplicationVersion.AppStore.ChartRepo.Url,
346+
Username: appStoreApplicationVersion.AppStore.ChartRepo.UserName,
347+
Password: appStoreApplicationVersion.AppStore.ChartRepo.Password,
348+
AllowInsecureConnection: appStoreApplicationVersion.AppStore.ChartRepo.AllowInsecureConnection,
347349
}
348350
}
349351

‎pkg/appStore/installedApp/service/FullMode/resource/NotesService.go

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -101,10 +101,11 @@ func (impl *InstalledAppResourceServiceImpl) findNotesForArgoApplication(install
101101
ValuesYaml: installedAppVerison.ValuesYaml,
102102
K8SVersion: k8sServerVersion.String(),
103103
ChartRepository: &gRPC.ChartRepository{
104-
Name: appStoreAppVersion.AppStore.ChartRepo.Name,
105-
Url: appStoreAppVersion.AppStore.ChartRepo.Url,
106-
Username: appStoreAppVersion.AppStore.ChartRepo.UserName,
107-
Password: appStoreAppVersion.AppStore.ChartRepo.Password,
104+
Name: appStoreAppVersion.AppStore.ChartRepo.Name,
105+
Url: appStoreAppVersion.AppStore.ChartRepo.Url,
106+
Username: appStoreAppVersion.AppStore.ChartRepo.UserName,
107+
Password: appStoreAppVersion.AppStore.ChartRepo.Password,
108+
AllowInsecureConnection: appStoreAppVersion.AppStore.ChartRepo.AllowInsecureConnection,
108109
},
109110
ReleaseIdentifier: &gRPC.ReleaseIdentifier{
110111
ReleaseNamespace: installedAppVerison.InstalledApp.Environment.Namespace,

‎pkg/chartRepo/ChartRepositoryService.go

Lines changed: 39 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ import (
2424
util3 "github.com/devtron-labs/common-lib/utils/k8s"
2525
"io"
2626
"io/ioutil"
27+
errors2 "k8s.io/apimachinery/pkg/api/errors"
2728
"net/http"
2829
"net/url"
2930
"strconv"
@@ -70,7 +71,6 @@ type ChartRepositoryService interface {
7071
GetChartRepoByName(name string) (*ChartRepoDto, error)
7172
GetChartRepoList() ([]*ChartRepoWithIsEditableDto, error)
7273
GetChartRepoListMin() ([]*ChartRepoDto, error)
73-
ValidateDeploymentCount(request *ChartRepoDto) error
7474
ValidateChartRepo(request *ChartRepoDto) *DetailedErrorHelmRepoValidation
7575
ValidateAndCreateChartRepo(request *ChartRepoDto) (*chartRepoRepository.ChartRepo, error, *DetailedErrorHelmRepoValidation)
7676
ValidateAndUpdateChartRepo(request *ChartRepoDto) (*chartRepoRepository.ChartRepo, error, *DetailedErrorHelmRepoValidation)
@@ -111,12 +111,12 @@ func (impl *ChartRepositoryServiceImpl) CreateSecretDataForHelmChart(request *Ch
111111
if isPrivateChart {
112112
secretData[USERNAME] = request.UserName
113113
secretData[PASSWORD] = request.Password
114-
isInsecureConnection := "true"
115-
if !request.AllowInsecureConnection {
116-
isInsecureConnection = "false"
117-
}
118-
secretData[INSECRUE] = isInsecureConnection
119114
}
115+
isInsecureConnection := "true"
116+
if !request.AllowInsecureConnection {
117+
isInsecureConnection = "false"
118+
}
119+
secretData[INSECRUE] = isInsecureConnection
120120

121121
return secretData
122122
}
@@ -225,17 +225,13 @@ func (impl *ChartRepositoryServiceImpl) CreateChartRepo(request *ChartRepoDto) (
225225
return chartRepo, nil
226226
}
227227

228-
func (impl *ChartRepositoryServiceImpl) ValidateDeploymentCount(request *ChartRepoDto) error {
229-
activeDeploymentCount, err := impl.repoRepository.FindDeploymentCountByChartRepoId(request.Id)
228+
func (impl *ChartRepositoryServiceImpl) getCountOfDeployedCharts(chartRepoId int) (int, error) {
229+
activeDeploymentCount, err := impl.repoRepository.FindDeploymentCountByChartRepoId(chartRepoId)
230230
if err != nil {
231-
impl.logger.Errorw("error in getting deployment count, CheckDeploymentCount", "err", err, "payload", request)
232-
return err
231+
impl.logger.Errorw("error in getting deployment count, CheckDeploymentCount", "chartRepoId", chartRepoId, "err", err)
232+
return 0, err
233233
}
234-
if activeDeploymentCount > 0 {
235-
err = &util.ApiError{Code: "400", HttpStatusCode: 400, UserMessage: "cannot update, found charts deployed using this repo"}
236-
return err
237-
}
238-
return err
234+
return activeDeploymentCount, nil
239235
}
240236

241237
func (impl *ChartRepositoryServiceImpl) UpdateData(request *ChartRepoDto) (*chartRepoRepository.ChartRepo, error) {
@@ -256,6 +252,18 @@ func (impl *ChartRepositoryServiceImpl) UpdateData(request *ChartRepoDto) (*char
256252
if request.Name != previousName && strings.ToLower(request.Name) != request.Name {
257253
return nil, errors.New("invalid repo name: please use lowercase")
258254
}
255+
256+
deployedChartCount, err := impl.getCountOfDeployedCharts(request.Id)
257+
if err != nil {
258+
impl.logger.Errorw("error in getting charts deployed via chart repo", "chartRepoId", request.Id, "err", err)
259+
return nil, err
260+
}
261+
262+
if deployedChartCount > 0 && (request.Name != previousName || request.Url != previousUrl) {
263+
err = &util.ApiError{Code: "400", HttpStatusCode: 400, UserMessage: "cannot update, found charts deployed using this repo"}
264+
return nil, err
265+
}
266+
259267
chartRepo.Url = request.Url
260268
chartRepo.Name = request.Name
261269
chartRepo.AuthMode = request.AuthMode
@@ -347,11 +355,24 @@ func (impl *ChartRepositoryServiceImpl) UpdateData(request *ChartRepoDto) (*char
347355
} else {
348356
secretData := impl.CreateSecretDataForHelmChart(request, isPrivateChart)
349357
secret, err := impl.K8sUtil.GetSecret(impl.aCDAuthConfig.ACDConfigMapNamespace, previousName, client)
350-
if err != nil {
358+
statusError, ok := err.(*errors2.StatusError)
359+
if err != nil && (ok && statusError != nil && statusError.Status().Code != http.StatusNotFound) {
351360
impl.logger.Errorw("error in fetching secret", "err", err)
352361
continue
353362
}
354-
secret.StringData = secretData
363+
364+
if ok && statusError != nil && statusError.Status().Code == http.StatusNotFound {
365+
secretLabel := make(map[string]string)
366+
secretLabel[LABEL] = REPOSITORY
367+
_, err = impl.K8sUtil.CreateSecret(impl.aCDAuthConfig.ACDConfigMapNamespace, nil, chartRepo.Name, "", client, secretLabel, secretData)
368+
if err != nil {
369+
impl.logger.Errorw("Error in creating secret for chart repo", "Chart Name", chartRepo.Name, "err", err)
370+
continue
371+
}
372+
updateSuccess = true
373+
break
374+
}
375+
355376
if previousName != request.Name {
356377
err = impl.DeleteChartSecret(previousName)
357378
if err != nil {
@@ -365,6 +386,7 @@ func (impl *ChartRepositoryServiceImpl) UpdateData(request *ChartRepoDto) (*char
365386
impl.logger.Errorw("Error in creating secret for chart repo", "Chart Name", chartRepo.Name, "err", err)
366387
}
367388
} else {
389+
secret.StringData = secretData
368390
_, err = impl.K8sUtil.UpdateSecret(impl.aCDAuthConfig.ACDConfigMapNamespace, secret, client)
369391
if err != nil {
370392
impl.logger.Errorw("Error in creating secret for chart repo", "Chart Name", chartRepo.Name, "err", err)

‎scripts/sql/258_chart_repo_insecure_default_values.down.sql

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
update chart_repo set allow_insecure_connection=false;

‎scripts/sql/258_chart_repo_insecure_default_values.up.sql

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
-- till this migration script, allow_insecure_connection is FALSE in Database
2+
-- insecureSkipTlsVerification was not derived from Database and was hardcoded as True in Kubelink.
3+
-- Now we are deriving it's value from DB and to preserve existing behaviour, migration values in DB are set to TRUE
4+
update chart_repo set allow_insecure_connection=true;

0 commit comments

Comments
 (0)