From a3b3caaf6d9e26bd0cf0b23e7100d232b4a55f09 Mon Sep 17 00:00:00 2001 From: Boshi Lian Date: Sat, 5 Nov 2022 05:56:45 +0000 Subject: [PATCH] add custom secret field support --- e2e/docker-compose.yml | 2 ++ e2e/k8sworkload.yaml | 37 ++++++++++++++++++++++--- e2e/kubernetes_test.go | 48 +++++++++++++++++++++++++++++++++ libplugin/util.go | 2 +- plugin/kubernetes/README.md | 2 ++ plugin/kubernetes/kubernetes.go | 8 +++++- plugin/kubernetes/sample.yaml | 2 ++ 7 files changed, 96 insertions(+), 5 deletions(-) diff --git a/e2e/docker-compose.yml b/e2e/docker-compose.yml index 43b1c48c..091772db 100644 --- a/e2e/docker-compose.yml +++ b/e2e/docker-compose.yml @@ -49,6 +49,8 @@ services: #kubectl delete po -l k8s-app=kube-dns -A kind load docker-image -n sshpipertest e2e_piper-imageonly kubectl wait --for=condition=ready pod -A --all --timeout=2m + kubectl delete -f /kubernetes/crd.yaml + kubectl delete -f /kubernetes/workload.yaml kubectl apply -f /kubernetes/crd.yaml kubectl apply -f /kubernetes/workload.yaml #kubectl set image deployment/sshpiper-deployment sshpiper=e2e_piper-imageonly diff --git a/e2e/k8sworkload.yaml b/e2e/k8sworkload.yaml index eeb0f7d8..a1f0b500 100644 --- a/e2e/k8sworkload.yaml +++ b/e2e/k8sworkload.yaml @@ -106,6 +106,37 @@ spec: ignore_hostkey: true --- + + +# pipe to a key based sshd with custom key field +--- +apiVersion: v1 +data: + custom_field: | + LS0tLS1CRUdJTiBPUEVOU1NIIFBSSVZBVEUgS0VZLS0tLS0KYjNCbGJuTnphQzFyWlhrdGRqRUFBQUFBQkc1dmJtVUFBQUFFYm05dVpRQUFBQUFBQUFBQkFBQUJsd0FBQUFkemMyZ3RjbgpOaEFBQUFBd0VBQVFBQUFZRUExYzZJYW5VVTdrK3ZrcjJuSEVYUFhwb3I2ZStBc2xhenRXM29scXhqcnRJRnN1bktIQXBLCkhSVUYydEtvdWIzR0R1VTErTlBqNzRNREpUV0wwTUMyNTdiNTFNUnlOaCsxTXBnU2tDdG84dWhZN2ZvUVJMeFFVV3dvaTkKTnZXRVlpUk4zM3hqR05vTE9LNUwrWmMxNmpDWm9OaDZwOEFKN09hQ1ZsZFU2UlZkaFFhUERScndEbDNGR3R6YnBQNXdpcgpWYnE1MnFleHFHUTl2d2dJU2Nic1cxdnUyTm5CckxmT3hGK0JMSlBLZkVCZmdZdVVaUS9RTE5ybTVYT1d5REtWd09LNjBDCm5PWUVhdzdhaDZJMzFxclhhMEtrSllOYVFUaXg4bnU1VWtYSDhZUnU2bU84YzcySjVGc2R0eWp0clMyK1ZncnFSdmxlMEUKU1JhTEdNTHJRUUtxYVRLVFV1dEZuNVJQcHNwbEZYL3FiUzU5NkVReFJHcGFOWkNaTXBuZXJzcWZnVDJZS3hrazdmZzh4MAp5TUtDZlVhTU1BVlUxTnJDczlkMW9UL3VreW4vTmlJY296cktYaW8yem95MUNDUDdTK091Ty8rMS9WV2pyN3llVUxlYkR3CkhYTUpPNTBqMzVDUksvMVBRb1oxRFNoSitoOVhqWnR1bldhWk80WWxBQUFGaU9PZ2RDRGpvSFFnQUFBQUIzTnphQzF5YzIKRUFBQUdCQU5YT2lHcDFGTzVQcjVLOXB4eEZ6MTZhSytudmdMSldzN1Z0Nkphc1k2N1NCYkxweWh3S1NoMFZCZHJTcUxtOQp4ZzdsTmZqVDQrK0RBeVUxaTlEQXR1ZTIrZFRFY2pZZnRUS1lFcEFyYVBMb1dPMzZFRVM4VUZGc0tJdlRiMWhHSWtUZDk4Cll4amFDeml1Uy9tWE5lb3dtYURZZXFmQUNlem1nbFpYVk9rVlhZVUdqdzBhOEE1ZHhScmMyNlQrY0lxMVc2dWRxbnNhaGsKUGI4SUNFbkc3RnRiN3RqWndheTN6c1JmZ1N5VHlueEFYNEdMbEdVUDBDemE1dVZ6bHNneWxjRGl1dEFwem1CR3NPMm9laQpOOWFxMTJ0Q3BDV0RXa0U0c2ZKN3VWSkZ4L0dFYnVwanZITzlpZVJiSGJjbzdhMHR2bFlLNmtiNVh0QkVrV2l4akM2MEVDCnFta3lrMUxyUlorVVQ2YktaUlYvNm0wdWZlaEVNVVJxV2pXUW1US1ozcTdLbjRFOW1Dc1pKTzM0UE1kTWpDZ24xR2pEQUYKVk5UYXdyUFhkYUUvN3BNcC96WWlIS002eWw0cU5zNk10UWdqKzB2anJqdi90ZjFWbzYrOG5sQzNtdzhCMXpDVHVkSTkrUQprU3Y5VDBLR2RRMG9TZm9mVjQyYmJwMW1tVHVHSlFBQUFBTUJBQUVBQUFHQUZmK05DNThHUzBySm5zaUNwQ2NPb2dZczFJCkgrOU5wMDNRcjA3bVBJVWRsc0dxOXhTeGRIN3R3VjRTRGhtVkxNU1FZT1dvNjZtZzhaeUw5TXBtcmRwdE90dXRXSGhzZ1cKWmFFOTc3VjNzOTV5SC9JbHNGekx5c1RkR3gzakMrc1RaWkNOQ01oYWNSbG9CZ2NzcTdFbUJ6dmhmbjd0Q1VkTnAydUpsOQp0QW10dUowbkpNc0x2ZjZwNUF5clVMdVpLcnhrTlRFZ3RFL1RWcklQZWJtck9yNSs1NmtiYzk5UjVvV000V3hWWmpkQXRQCmlFMnJOQWEvZlkzOFNjbHR6eVZkRU5YZlhiYlBiR3hMenFWUjFoTWwyeDdkOXBGTE1IRDJxRmNhalpiOWx0SzJnOXkxTmcKRWdOU3F3cE5UK2VYWTIxRnBFc0tXbzVWM0xTeG1ENUdsQkdPc2hLZFVOdDRqRFdjR2xVekNJUWduaU5RME5JQ3pIZTBOWQpqWk1TK3lyb1VOV0tNYVJob1d5aVJVcWJENGpXUHVMbGdYbjhNVnJ6MXluK1Y3TkN2SVpYNG5KZWIreXhpUndFRVFTT1hBCmQzcE4yRk1yVEpVeXRVanQ1dU9lOUtEQlA5Q3Myc0ZJcG5tM2dmUFNVSlNEc2tWdHRXZ1ZHVFNPRFRsYVRqR241aEFBQUEKd0VwS3VFWE5aeDIyclkwWmJLZW5KQ3F0Z1dyYUtBUEVjVDA3azJKeXl4ck5zazhFSlJKNjBCL1pja2ZDTS95UTErcVVTSgpBbnhvS0NXWjdyaEdWcE1KbEVKN3ZGcWExbFBDb1Nld3VGM0FRRjgzVDQybVhQTC9nTlVqekxvVTdCR3ZMZ2VxNzU0azFGCnJwK28yb0tzd2N5ZHMwZnlyTFdCdFlsZmFyUVVINmYwTzBiUUZWUlFjMkRjTyt5Y243UFVVSDAzcHEwZ094cXpQKzZOVEQKTjliMWNIMUE3eFlPL0ZDRDZuNnhEQ0hjSmVNRnFDb1hsbTRFWUpDUnY5Z0ZLYW9BQUFBTUVBL0lqdmw0VlpjNnFvYzh2Qwp4NlA3WGVUbzFyKzZEa1B3cXFoY25PRnBIMDJZeGVtM1Z3RDdCM1BieXZybmhVTkFyQ0VyMXh5eU05SlFLY1ZESnB0NEpzCmlsZVp1N1BLb09JdWw4MytHeGxSQ2daSHJwbDdQYld0TURRVmh5M3FQQTRjTERONmo2TDRRcm0xVUxjUm1PSU8xRzdtSHMKdStySnFPNURoZmI5MS80SlRIQWxJdWI5a0ZGM0hQMnlHZUEyRDBSWjRtVUd2RlYySUVMUXhWMXRnZ2xiOHIyNWdFSUhycwpOQmlnMXR3anFIcmlqWmMrQlVvMUNvRVhpWFk0bE5BQUFBd1FEWXZZOFpsSUdPenRKcVo4MkQrckh1QWx1eEZiNFh1bUJCClVwUWVybktLNVplME9kcWhrQ1VEN2QzQWk4RkZ4MlZ4STVMWTRqcDZWb01KaUY1MlRrVFE4ZXVKM3prYW1qL3UreDNxbzgKYjB5d0VIZWc0akFsSUoxSXYwNFArT1pPc3o5Y20zS2gwMk9uQXg2b1FpT29TTXYwMXFtdDlPMm5xRVU1V2N2VkEvUUZjTApYblJNeVpFOEg2MzJqMjZPU2hRM09vUk55aFZqeEJ2SzRpVUJXK3R3ek82YnFuVXlEaEtxaDIyVHVrSDErUkMzZ2RZcnFHCnNKYTE3RkF2ay94RGtBQUFBTlltOXNhV0Z1UUhWaWRXNTBkUUVDQXdRRkJnPT0KLS0tLS1FTkQgT1BFTlNTSCBQUklWQVRFIEtFWS0tLS0tCg== +kind: Secret +metadata: + name: host-publickey-key-custom-field +type: Opaque +--- +apiVersion: sshpiper.com/v1beta1 +kind: Pipe +metadata: + name: pipe-publickey-custom-field + annotations: + privatekey_field_name: custom_field +spec: + from: + - username: "custom_field" # catch all + username_regex_match: true + authorized_keys_data: "c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCZ1FEWndMdmN5eXFoWFhWZkxRU1hEdkFOMVQwZWQyNEVSRGFVUGdWS2xZaE5sR1RPNTh1TW1tc1gvOUc0SlRzZGlWSHFvR29OSDZ1a0Y4ZFNNMG1nWmdNT0dNdTE2VHdld2xqd01GcksrS1NZYTVaYzQ2Vnk1N2F6MFpFbml2WlZwY1RhdXpndHZwUTRjOXNhd3dVY2M5M0Y1eHdlZnNuTEl5eTJVc0s0SXhOeGFSV1NPMFdvanJGL3A2di9SaE1aeXZkcXlYUk9aVVl3aFRiUE1OZE1ZblROanY3YmVHL3dlR1Y3Wkhpc25TTzhiUDNjYStMVllkeVJINXhlMmp6Vm5HMmNjOHl5MUZZbjJOaHRLaUo5c1k5VFlCbndlSi8xNXZjbE9UY2xRMVBBa3pGZGt4WDM4aWM0VlhKNDhFREYwenR2cVdQeVpNQ2ZCQ2N4TGpHZVBwUW0xR1hRWU9udmthTEJPU1NNcDltRW9SZmUyZENmNjE4b3B1TTFjcEhxT2s2Z2RwZ3BKNXh5dzdFcUxVNWRVNmVYS1RrcCtoYXM4S01yRjN5SWo5R0drbFo3clNteENEWWVLMnZmY0FvT0RuWENuMjBBT2ZjMUdQZW5nSmJhL1ZUN3JiTmRUek4vZTYrTG15WHhmQThmbEVBN3VaUHF5WWtKKzVpTEFUYUdnTE09IGJvbGlhbkB1YnVudHUK" + to: + host: host-publickey:2222 + username: "user" + private_key_secret: + name: host-publickey-key-custom-field + ignore_hostkey: true + # pipe to a key based sshd --- apiVersion: v1 @@ -120,10 +151,10 @@ type: Opaque apiVersion: sshpiper.com/v1beta1 kind: Pipe metadata: - name: pipe-publickey + name: pipe-publickey-regex spec: from: - - username: ".*" # catch all + - username: "any.*" # catch all username_regex_match: true authorized_keys_data: "c3NoLXJzYSBBQUFBQjNOemFDMXljMkVBQUFBREFRQUJBQUFCZ1FEWndMdmN5eXFoWFhWZkxRU1hEdkFOMVQwZWQyNEVSRGFVUGdWS2xZaE5sR1RPNTh1TW1tc1gvOUc0SlRzZGlWSHFvR29OSDZ1a0Y4ZFNNMG1nWmdNT0dNdTE2VHdld2xqd01GcksrS1NZYTVaYzQ2Vnk1N2F6MFpFbml2WlZwY1RhdXpndHZwUTRjOXNhd3dVY2M5M0Y1eHdlZnNuTEl5eTJVc0s0SXhOeGFSV1NPMFdvanJGL3A2di9SaE1aeXZkcXlYUk9aVVl3aFRiUE1OZE1ZblROanY3YmVHL3dlR1Y3Wkhpc25TTzhiUDNjYStMVllkeVJINXhlMmp6Vm5HMmNjOHl5MUZZbjJOaHRLaUo5c1k5VFlCbndlSi8xNXZjbE9UY2xRMVBBa3pGZGt4WDM4aWM0VlhKNDhFREYwenR2cVdQeVpNQ2ZCQ2N4TGpHZVBwUW0xR1hRWU9udmthTEJPU1NNcDltRW9SZmUyZENmNjE4b3B1TTFjcEhxT2s2Z2RwZ3BKNXh5dzdFcUxVNWRVNmVYS1RrcCtoYXM4S01yRjN5SWo5R0drbFo3clNteENEWWVLMnZmY0FvT0RuWENuMjBBT2ZjMUdQZW5nSmJhL1ZUN3JiTmRUek4vZTYrTG15WHhmQThmbEVBN3VaUHF5WWtKKzVpTEFUYUdnTE09IGJvbGlhbkB1YnVudHUK" to: @@ -131,4 +162,4 @@ spec: username: "user" private_key_secret: name: host-publickey-key - ignore_hostkey: true \ No newline at end of file + ignore_hostkey: true diff --git a/e2e/kubernetes_test.go b/e2e/kubernetes_test.go index f5f03410..2cbcf9c5 100644 --- a/e2e/kubernetes_test.go +++ b/e2e/kubernetes_test.go @@ -95,4 +95,52 @@ func TestKubernetes(t *testing.T) { checkSharedFileContent(t, targetfie, randtext) }) + + t.Run("key_custom_field", func(t *testing.T) { + + keyfiledir, err := os.MkdirTemp("", "") + if err != nil { + t.Errorf("failed to create temp key file: %v", err) + } + + keyfile := path.Join(keyfiledir, "key") + + if err := os.WriteFile(keyfile, []byte(testprivatekey), 0400); err != nil { + t.Errorf("failed to write to test key: %v", err) + } + + if err := os.WriteFile("/sshconfig_publickey/.ssh/authorized_keys", []byte(`ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDVzohqdRTuT6+SvaccRc9emivp74CyVrO1beiWrGOu0gWy6cocCkodFQXa0qi5vcYO5TX40+PvgwMlNYvQwLbntvnUxHI2H7UymBKQK2jy6Fjt+hBEvFBRbCiL029YRiJE3ffGMY2gs4rkv5lzXqMJmg2HqnwAns5oJWV1TpFV2FBo8NGvAOXcUa3Nuk/nCKtVurnap7GoZD2/CAhJxuxbW+7Y2cGst87EX4Esk8p8QF+Bi5RlD9As2ublc5bIMpXA4rrQKc5gRrDtqHojfWqtdrQqQlg1pBOLHye7lSRcfxhG7qY7xzvYnkWx23KO2tLb5WCupG+V7QRJFosYwutBAqppMpNS60WflE+mymUVf+ptLn3oRDFEalo1kJkymd6uyp+BPZgrGSTt+DzHTIwoJ9RowwBVTU2sKz13WhP+6TKf82IhyjOspeKjbOjLUII/tL4647/7X9VaOvvJ5Qt5sPAdcwk7nSPfkJEr/U9ChnUNKEn6H1eNm26dZpk7hiU=`), 0400); err != nil { + t.Errorf("failed to write to authorized_keys: %v", err) + } + + randtext := uuid.New().String() + targetfie := uuid.New().String() + + c, _, _, err := runCmd( + "ssh", + "-v", + "-o", + "StrictHostKeyChecking=no", + "-o", + "UserKnownHostsFile=/dev/null", + "-p", + piperport, + "-l", + "custom_field", + "-i", + keyfile, + piperhost, + fmt.Sprintf(`sh -c "echo -n %v > /shared/%v"`, randtext, targetfie), + ) + + if err != nil { + t.Errorf("failed to ssh to piper-fixed, %v", err) + } + + defer killCmd(c) + + time.Sleep(time.Second) // wait for file flush + + checkSharedFileContent(t, targetfie, randtext) + }) } diff --git a/libplugin/util.go b/libplugin/util.go index 3c9633f5..1662e54f 100644 --- a/libplugin/util.go +++ b/libplugin/util.go @@ -91,7 +91,7 @@ func DialForSSH(addr string) (net.Conn, error) { return net.Dial("tcp", addr) } -func CreateNoneAuth(password []byte) *Upstream_None { +func CreateNoneAuth() *Upstream_None { return &Upstream_None{ None: &UpstreamNoneAuth{}, } diff --git a/plugin/kubernetes/README.md b/plugin/kubernetes/README.md index b5ce74a9..45e34847 100644 --- a/plugin/kubernetes/README.md +++ b/plugin/kubernetes/README.md @@ -146,6 +146,8 @@ apiVersion: sshpiper.com/v1beta1 kind: Pipe metadata: name: pipe-publickey + annotations: + privatekey_field_name: privatekey # this is optional, default is privatekey spec: from: - username: ".*" # catch all diff --git a/plugin/kubernetes/kubernetes.go b/plugin/kubernetes/kubernetes.go index 4f7eab27..7b66ca69 100644 --- a/plugin/kubernetes/kubernetes.go +++ b/plugin/kubernetes/kubernetes.go @@ -165,7 +165,13 @@ func (p *plugin) createUpstream(conn libplugin.ConnMetadata, pipe *piperv1beta1. return nil, err } - data := secret.Data["privatekey"] + anno := pipe.GetAnnotations() + k := anno["privatekey_field_name"] + if k == "" { + k = "privatekey" + } + + data := secret.Data[k] if data != nil { u.Auth = libplugin.CreatePrivateKeyAuth(data) p.cache.Set(conn.UniqueID(), pipe, gocache.DefaultExpiration) diff --git a/plugin/kubernetes/sample.yaml b/plugin/kubernetes/sample.yaml index 12b37fe2..02201942 100644 --- a/plugin/kubernetes/sample.yaml +++ b/plugin/kubernetes/sample.yaml @@ -153,6 +153,8 @@ apiVersion: sshpiper.com/v1beta1 kind: Pipe metadata: name: pipe-publickey + annotations: + privatekey_field_name: privatekey # this is optional, default is privatekey spec: from: - username: ".*" # catch all