Nail/fission-src
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Avoid exposing sensitive data to client (#1543)

Browse Source 
This PR changes the behavior of controller API which
wrongly exposes sensitive data to the client. Now, the
API only returns success if secret/configmap exists;
otherwise, an error will be returned.
This commit is contained in:
Ta-Ching Chen
2020-02-24 20:02:33 +08:00
committed by GitHub
parent fc5711ce7c
commit 5c09099084
8 changed files with 27 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/fission-cli/cmd/function/create.go
+2 -2
View File
@@ -222,7 +222,7 @@ func (opts *CreateSubCommand) complete(input cli.Input) error {
// check the referenced secret is in the same ns as the function, if not give a warning.
if !toSpec { // TODO: workaround in order not to block users from creating function spec, remove it.
for _, secretName := range secretNames {
_, err := opts.Client().V1().Misc().SecretGet(&metav1.ObjectMeta{
err := opts.Client().V1().Misc().SecretExists(&metav1.ObjectMeta{
Namespace: fnNamespace,
Name: secretName,
})
@@ -248,7 +248,7 @@ func (opts *CreateSubCommand) complete(input cli.Input) error {
// check the referenced cfgmap is in the same ns as the function, if not give a warning.
if !toSpec {
for _, cfgMapName := range cfgMapNames {
_, err := opts.Client().V1().Misc().ConfigMapGet(&metav1.ObjectMeta{
err := opts.Client().V1().Misc().ConfigMapExists(&metav1.ObjectMeta{
Namespace: fnNamespace,
Name: cfgMapName,
})
pkg/fission-cli/cmd/function/update.go
+2 -2
View File
@@ -87,7 +87,7 @@ func (opts *UpdateSubCommand) complete(input cli.Input) error {
// check that the referenced secret is in the same ns as the function, if not give a warning.
for _, secretName := range secretNames {
_, err := opts.Client().V1().Misc().SecretGet(&metav1.ObjectMeta{
err := opts.Client().V1().Misc().SecretExists(&metav1.ObjectMeta{
Namespace: fnNamespace,
Name: secretName,
})
@@ -111,7 +111,7 @@ func (opts *UpdateSubCommand) complete(input cli.Input) error {
// check that the referenced cfgmap is in the same ns as the function, if not give a warning.
for _, cfgMapName := range cfgMapNames {
_, err := opts.Client().V1().Misc().ConfigMapGet(&metav1.ObjectMeta{
err := opts.Client().V1().Misc().ConfigMapExists(&metav1.ObjectMeta{
Namespace: fnNamespace,
Name: cfgMapName,
})
pkg/fission-cli/cmd/spec/spec.go
+2 -2
View File
@@ -400,7 +400,7 @@ func (fr *FissionResources) Validate(input cli.Input) ([]string, error) {
return warnings, err
}
for _, cm := range f.Spec.ConfigMaps {
_, err := client.V1().Misc().ConfigMapGet(&metav1.ObjectMeta{
err := client.V1().Misc().ConfigMapExists(&metav1.ObjectMeta{
Name: cm.Name,
Namespace: cm.Namespace,
})
@@ -410,7 +410,7 @@ func (fr *FissionResources) Validate(input cli.Input) ([]string, error) {
}
for _, s := range f.Spec.Secrets {
_, err := client.V1().Misc().SecretGet(&metav1.ObjectMeta{
err := client.V1().Misc().SecretExists(&metav1.ObjectMeta{
Name: s.Name,
Namespace: s.Namespace,
})