support of kubernetes secrets (service catalog)

[nenaraab]

• document K8S Support

[liga-oz]

few things to check

[jkbschmid]

same as above

[jkbschmid]

How about using Unmarshal here as well. E.g.

var v interface{} 
err := json.Unmarshal(secretContent, v)
if err != nil {..}
instanceCredentialsMap[instanceSecretFile.Name()] = v

This way, we don't have to have any knowledge about IAS' credential structure and non-string credentials (e.g. []string) are handled properly. This allows us to get rid of the domains special case as well.

[nenaraab]

good idea, i already tried it... but it fails with error "invalid character 'c' looking for beginning of value"
reason JSON without double qouted keys it's not JSON at all.

Found a tip to use yaml instead of json parser but this has issues with characters "]" or "," which are valid for secrets. So i still need a fallback.

[jkbschmid]

You are right. This is a problem with the BTP service operator. There is no way to distinguish, whether ["asdf"] is a string that contains special characters or a list with a single string. Let's follow SAP/sap-btp-service-operator#79 and see whether this will be improved.

[MatKuhr]

Interesting that you also stumbled upon this. Could you perhaps comment in the issue so that the colleagues can see this is a problem for multiple teams? (also, fyi, this probably also affects nested objects)

Also, are you aware of this issue: SAP/sap-btp-service-operator#78

I guess you must have also noticed that the plan information is unavailable? At least with the java security libraries in version 2.10.5 the CfEnvironment requires a plan. Passing a JSON in there without a plan causes a NPE.

[f-blass]

Hi, sorry for commenting so late...
As of Go 1.16 the ioutil package is actually deprecated. Instead the packages io or os should be used which now cover all functionality previously available in ioutil. The specific function documentations will give hints where to find replacements. (https://pkg.go.dev/io/ioutil)
I think we can optimize parsing the credential files by not reading the entire file into a byte slice and then decoding it, but just open an io.Reader with e.g. os.Open and then use json.NewDecoder or yaml.NewDecoder on it. That way the parser can start working while still reading the rest of the file and we save memory as the underlying byte buffer is way smaller than reading the entire file at once.

[liga-oz]

well done 👍🏻

[nenaraab]

Hi, sorry for commenting so late...
As of Go 1.16 the ioutil package is actually deprecated. Instead the packages io or os should be used which now cover all functionality previously available in ioutil. The specific function documentations will give hints where to find replacements. (https://pkg.go.dev/io/ioutil)
==> @f-blass fixed

I think we can optimize parsing the credential files by not reading the entire file into a byte slice and then decoding it, but just open an io.Reader with e.g. os.Open and then use json.NewDecoder or yaml.NewDecoder on it. That way the parser can start working while still reading the rest of the file and we save memory as the underlying byte buffer is way smaller than reading the entire file at once.
==> #27