Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

provide config option to specify external creds providers #2275

Merged
merged 1 commit into from
Aug 14, 2023
Merged

provide config option to specify external creds providers #2275

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 7 additions & 2 deletions servers/zts/conf/zts.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -717,5 +717,10 @@ athenz.zts.cert_signer_factory_class=com.yahoo.athenz.zts.cert.impl.SelfCertSign
#athenz.zts.k8s_provider_attestation_aws_assume_role_name=

# This property allows configuring a factory class to validate supported Kubernetes distributions
# for which ZTS can accept service account tokens issued by respective Kubernetes API servers
athenz.zts.k8s_provider_distribution_validator_factory_class=com.yahoo.athenz.instance.provider.impl.DefaultKubernetesDistributionValidatorFactory
# for which ZTS can accept service account tokens issued by respective Kubernetes API servers.
athenz.zts.k8s_provider_distribution_validator_factory_class=com.yahoo.athenz.instance.provider.impl.DefaultKubernetesDistributionValidatorFactory

# The property lists the external credential providers that should
# be enabled in the server. Current, we have only one provider
# implemented for GCP and the default value includes this provider.
#athenz.zts.external_creds_providers=gcp
5 changes: 3 additions & 2 deletions servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSConsts.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -263,8 +263,9 @@ public final class ZTSConsts {
public static final String ZTS_PROP_GCP_WORKLOAD_POOL_NAME = "athenz.zts.gcp_workload_pool_name";
public static final String ZTS_PROP_GCP_WORKLOAD_PROVIDER_NAME = "athenz.zts.gcp_workload_provider_name";

public static final String ZTS_EXTERNAL_CREDS_PROVIDER_GCP = "gcp";
public static final String ZTS_EXTERNAL_CREDS_PROVIDER_AWS = "aws";
public static final String ZTS_PROP_EXTERNAL_CREDS_PROVIDERS = "athenz.zts.external_creds_providers";
public static final String ZTS_EXTERNAL_CREDS_PROVIDER_GCP = "gcp";
public static final String ZTS_EXTERNAL_CREDS_PROVIDER_AWS = "aws";

public static final String ZTS_EXTERNAL_ATTR_ROLE_NAME = "athenzRoleName";
public static final String ZTS_EXTERNAL_ATTR_SCOPE = "athenzScope";
Expand Down
18 changes: 16 additions & 2 deletions servers/zts/src/main/java/com/yahoo/athenz/zts/ZTSImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,8 @@ public class ZTSImpl implements KeyStore, ZTSHandler {
private long lastAthenzJWKUpdateTime = 0;
protected int millisBetweenAthenzJWKUpdates = 0;
private final Object updateJWKMutex = new Object();
final Map<String, ExternalCredentialsProvider> externalCredentialsProviders;
protected Map<String, ExternalCredentialsProvider> externalCredentialsProviders;
protected Set<String> enabledExternalCredentialsProviders;

private static final String TYPE_DOMAIN_NAME = "DomainName";
private static final String TYPE_SIMPLE_NAME = "SimpleName";
Expand Down Expand Up @@ -380,10 +381,23 @@ public ZTSImpl(CloudStore implCloudStore, DataStore implDataStore) {

// initialize our external credentials providers

loadExternalCredentialsProviders();
}

void loadExternalCredentialsProviders() {

// initialize and load our known providers

externalCredentialsProviders = new HashMap<>();
ExternalCredentialsProvider gcpProvider = new GcpAccessTokenProvider();
gcpProvider.setAuthorizer(authorizer);
externalCredentialsProviders.put(ZTSConsts.ZTS_EXTERNAL_CREDS_PROVIDER_GCP, gcpProvider);

// configure which providers are enabled

final String providerList = System.getProperty(ZTSConsts.ZTS_PROP_EXTERNAL_CREDS_PROVIDERS,
ZTSConsts.ZTS_EXTERNAL_CREDS_PROVIDER_GCP);
enabledExternalCredentialsProviders = new HashSet<>(Arrays.asList(providerList.split(",")));
}

void loadJsonMapper() {
Expand Down Expand Up @@ -4859,7 +4873,7 @@ public ExternalCredentialsResponse postExternalCredentialsRequest(ResourceContex
// before doing anything verify that our provider is valid

ExternalCredentialsProvider externalCredentialsProvider = externalCredentialsProviders.get(provider);
if (externalCredentialsProvider == null) {
if (externalCredentialsProvider == null || !enabledExternalCredentialsProviders.contains(provider)) {
throw requestError("Invalid external credentials provider: " + provider, caller, domainName, principalDomain);
}

Expand Down
12 changes: 12 additions & 0 deletions servers/zts/src/test/java/com/yahoo/athenz/zts/ZTSImplTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14551,6 +14551,18 @@ public void testPostExternalCredentials() throws IOException {
"gcp", "coretech", extCredsRequest);
assertNotNull(extCredsResponse);

// let's temporarily disable gcp provider

ztsImpl.enabledExternalCredentialsProviders.remove("gcp");
try {
ztsImpl.postExternalCredentialsRequest(context, "gcp", "coretech", extCredsRequest);
fail();
} catch (ResourceException ex) {
assertEquals(400, ex.getCode());
assertTrue(ex.getMessage().contains("Invalid external credentials provider"));
}
ztsImpl.enabledExternalCredentialsProviders.add("gcp");

// now let's configure our http driver to return failure

exchangeTokenResponse = new HttpDriverResponse(403, GcpAccessTokenProviderTest.EXCHANGE_TOKEN_ERROR_STR, null);
Expand Down