DevFW-CICD/ingress-nginx-helm
12
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Avoid overwrite of auth file

Browse source
This commit is contained in:
Manuel Alejandro de Brito Fontes 2020-01-27 00:02:08 -03:00
parent 02c99e9ccf
commit 340bb39384
1 changed files with 15 additions and 9 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

24
internal/ingress/annotations/auth/main.go
View file

@ -40,6 +40,11 @@ var (
AuthDirectory = "/etc/ingress-controller/auth" AuthDirectory = "/etc/ingress-controller/auth"
) )
const (
fileAuth = "auth-file"
mapAuth = "auth-map"
)
// Config returns authentication configuration for an Ingress rule // Config returns authentication configuration for an Ingress rule
type Config struct { type Config struct {
Type string `json:"type"` Type string `json:"type"`
@ -107,7 +112,7 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) {
var secretType string var secretType string
secretType, err = parser.GetStringAnnotation("auth-secret-type", ing) secretType, err = parser.GetStringAnnotation("auth-secret-type", ing)
if err != nil { if err != nil {
secretType = "auth-file" secretType = fileAuth
} }
s, err := parser.GetStringAnnotation("auth-secret", ing) s, err := parser.GetStringAnnotation("auth-secret", ing)
@ -138,19 +143,20 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) {
realm, _ := parser.GetStringAnnotation("auth-realm", ing) realm, _ := parser.GetStringAnnotation("auth-realm", ing)
passFile := fmt.Sprintf("%v/%v-%v.passwd", a.authDirectory, ing.GetNamespace(), ing.GetName()) passFilename := fmt.Sprintf("%v/%v-%v-%v.passwd", a.authDirectory, ing.GetNamespace(), ing.UID, secret.UID)
if secretType == "auth-file" { switch secretType {
err = dumpSecretAuthFile(passFile, secret) case fileAuth:
err = dumpSecretAuthFile(passFilename, secret)
if err != nil { if err != nil {
return nil, err return nil, err
} }
} else if secretType == "auth-map" { case mapAuth:
err = dumpSecretAuthMap(passFile, secret) err = dumpSecretAuthMap(passFilename, secret)
if err != nil { if err != nil {
return nil, err return nil, err
} }
} else { default:
return nil, ing_errors.LocationDenied{ return nil, ing_errors.LocationDenied{
Reason: errors.Wrap(err, "invalid auth-secret-type in annotation, must be 'auth-file' or 'auth-map'"), Reason: errors.Wrap(err, "invalid auth-secret-type in annotation, must be 'auth-file' or 'auth-map'"),
} }
@ -159,9 +165,9 @@ func (a auth) Parse(ing *networking.Ingress) (interface{}, error) {
return &Config{ return &Config{
Type: at, Type: at,
Realm: realm, Realm: realm,
File: passFile, File: passFilename,
Secured: true, Secured: true,
FileSHA: file.SHA1(passFile), FileSHA: file.SHA1(passFilename),
Secret: name, Secret: name,
SecretType: secretType, SecretType: secretType,
}, nil }, nil