fix: Add a predefined secret to store credentials #68

vinokurig · 2021-07-28T14:19:49Z

Signed-off-by: Igor Vinokur ivinokur@redhat.com

What does this PR do?

Create a predefined K8s secret per nemaespace to store credentials.
Add a specific secret role for the credentials secret. This role allows to edit only this predefined secret. Other secrets are not controlled by this role.

depends on eclipse-che/che-operator#971

Screenshot/screencast of this PR

What issues does this PR fix or reference?

eclipse-che/che#19837

How to test this PR?

Start a workspace and open a terminal from ide container
Send an HTTP request to kubernetes API to edit the credentials-secret: curl -X POST <kubernetes API url>/api/v1/namespaces/<namespace name>/secrets--header "Content-Type: application/json-patch+json" -d '[{ "op": "add", "path": "/data", "value": { "key": "" } }]'

PR Checklist

As the author of this Pull Request I made sure that:

Reviewers

Reviewers, please comment how you tested the PR when approving it.

che-bot · 2021-07-28T14:46:50Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

amisevsk

I think this approach is better than the previous, but would prefer the predefined secret to have an abstract name, e.g. workspace-credentials-secret. This sort of name maps more naturally onto what is provisioned in the DevWorkspace Operator, since it would look strange for Web Terminals to come with access to che-credentials-secret.

amisevsk · 2021-07-28T18:19:47Z

...lipse/che/workspace/infrastructure/kubernetes/namespace/AbstractWorkspaceServiceAccount.java

+        k8sClient,
+        SECRETS_ROLE_NAME,
+        singletonList("secrets"),
+        singletonList("che-credentials-secret"),


Can we choose a Che-agnostic name -- e.g. workspace-credentials-secret? If we want to do a similar thing in DWO, it's a lot easier to justify if it's not labelled with a specific platform.

+1 for workspace-credentials-secret

+ please consider moving that secret name somewhere to constants

sleshchenko · 2021-07-29T07:42:16Z

...lipse/che/workspace/infrastructure/kubernetes/namespace/AbstractWorkspaceServiceAccount.java

+        k8sClient,
+        SECRETS_ROLE_NAME,
+        singletonList("secrets"),
+        singletonList("che-credentials-secret"),


+ please consider moving that secret name somewhere to constants

che-bot · 2021-08-02T08:34:46Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

skabashnyuk · 2021-08-03T05:44:27Z

@vinokurig can you merge latest "main" please?

che-bot · 2021-08-03T08:14:50Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

che-bot · 2021-08-04T09:25:31Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

che-bot · 2021-08-04T11:46:22Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

Signed-off-by: Igor Vinokur <ivinokur@redhat.com>

che-bot · 2021-08-04T14:29:16Z

✅ E2E Happy path tests succeed 🎉

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

vinokurig · 2021-08-05T07:38:07Z

@skabashnyuk @sparkoo @mshaposhnik I am going to merge this PR tomorrow if no objections?

...lipse/che/workspace/infrastructure/kubernetes/namespace/AbstractWorkspaceServiceAccount.java

sparkoo · 2021-08-05T09:43:28Z

...eclipse/che/workspace/infrastructure/openshift/project/OpenShiftWorkspaceServiceAccount.java

-      String name, List<String> resources, List<String> apiGroups, List<String> verbs) {
+      String name,
+      List<String> resources,
+      @Nullable List<String> resourceNames,


pass empty list, instread of nullable

...lipse/che/workspace/infrastructure/kubernetes/namespace/AbstractWorkspaceServiceAccount.java

...pse/che/workspace/infrastructure/kubernetes/namespace/KubernetesWorkspaceServiceAccount.java

che-bot · 2021-08-05T14:58:35Z

✅ E2E Happy path tests succeed 🎉

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

.../java/org/eclipse/che/workspace/infrastructure/kubernetes/namespace/KubernetesNamespace.java

...lipse/che/workspace/infrastructure/kubernetes/namespace/AbstractWorkspaceServiceAccount.java

che-bot · 2021-08-06T14:26:15Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

che-bot · 2021-08-09T15:04:59Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

sparkoo · 2021-08-10T07:57:58Z

...rg/eclipse/che/workspace/infrastructure/kubernetes/namespace/KubernetesNamespaceFactory.java

+            canCreateNamespace(identity),
+            labelNamespaces ? namespaceLabels : emptyMap(),
+            annotateNamespaces ? namespaceAnnotationsEvaluated : emptyMap());
+    if (newNamespace) {


If I understand correctly, this will be true only in case that we've created the namespace in previous namespace.prepare call. So what if namespace already exists? Don't we need the secret then? The namespace could be prepared by admins or created by older Che version. What if user removed/modified the secret ? Don't we need to reconcile ?

Fixed, reworked to check if the secret exists.

sparkoo

code looks good to me, thanks.

che-bot · 2021-08-10T14:15:59Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

che-bot · 2021-08-11T08:37:02Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

vinokurig · 2021-08-16T06:58:12Z

[crw-ci-test]

che-bot · 2021-08-16T07:02:14Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

vinokurig · 2021-08-16T07:52:41Z

[crw-ci-test --rebuild]

che-bot · 2021-08-16T08:14:50Z

❌ E2E Happy path tests failed ❗

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.1.1)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

dmytro-ndp · 2021-08-17T08:26:22Z

[crw-ci-test --rebuild]

che-bot · 2021-08-17T08:58:05Z

✅ E2E Happy path tests succeed 🎉

See Details

Jenkins job
test report
logs and configs
Happy path tests DevFile
image: quay.io/crw_pr/che-server:68

Test product:

tested with Eclipse Che on K8S (minikube v1.22.0)
E2E test scenario
E2E test pipeline source code

Use comment "[crw-ci-test]" to rerun happy path E2E test.
Use comment "[crw-ci-test --rebuild]" to re-build the images and rerun happy path E2E test.

Eclipse Che QE channel: https://mattermost.eclipse.org/eclipse/channels/eclipse-che-qe

fix: Add a predefined secret to store credentials

a4b62d2

vinokurig requested review from amisevsk, metlos, nickboldt, skabashnyuk and sleshchenko as code owners July 28, 2021 14:19

vinokurig mentioned this pull request Jul 28, 2021

Add get and patch secret roles eclipse-che/che-operator#972

Closed

11 tasks

amisevsk approved these changes Jul 28, 2021

View reviewed changes

sleshchenko approved these changes Jul 29, 2021

View reviewed changes

skabashnyuk requested review from sparkoo and mshaposhnik July 30, 2021 09:38

fixup! fix: Add a predefined secret to store credentials

c52ccd7

Merge branch 'main' of github.com:eclipse-che/che-server into che-19837

a239963

vinokurig force-pushed the che-19837 branch from 25770d8 to 08e5ef3 Compare August 4, 2021 11:16

merge with main

65e5e20

Signed-off-by: Igor Vinokur <ivinokur@redhat.com>

vinokurig force-pushed the che-19837 branch from 08e5ef3 to 65e5e20 Compare August 4, 2021 13:44

sparkoo reviewed Aug 5, 2021

View reviewed changes

...lipse/che/workspace/infrastructure/kubernetes/namespace/AbstractWorkspaceServiceAccount.java Outdated Show resolved Hide resolved

...pse/che/workspace/infrastructure/kubernetes/namespace/KubernetesWorkspaceServiceAccount.java Outdated Show resolved Hide resolved

fixup! fix: Add a predefined secret to store credentials

605bfd1

mshaposhnik reviewed Aug 5, 2021

View reviewed changes

.../java/org/eclipse/che/workspace/infrastructure/kubernetes/namespace/KubernetesNamespace.java Outdated Show resolved Hide resolved

sparkoo reviewed Aug 6, 2021

View reviewed changes

...lipse/che/workspace/infrastructure/kubernetes/namespace/AbstractWorkspaceServiceAccount.java Outdated Show resolved Hide resolved

fixup! fix: Add a predefined secret to store credentials

fb0fe45

fixup! fix: Add a predefined secret to store credentials

cd092ce

vinokurig force-pushed the che-19837 branch from 80c13f0 to cd092ce Compare August 9, 2021 14:35

sparkoo reviewed Aug 10, 2021

View reviewed changes

fixup! fix: Add a predefined secret to store credentials

79ba1e5

vinokurig force-pushed the che-19837 branch from 0a26a1b to 79ba1e5 Compare August 10, 2021 13:59

mshaposhnik approved these changes Aug 10, 2021

View reviewed changes

sparkoo approved these changes Aug 10, 2021

View reviewed changes

skabashnyuk approved these changes Aug 11, 2021

View reviewed changes

fixup! fix: Add a predefined secret to store credentials

10a2c55

eclipse-che deleted a comment from che-bot Aug 17, 2021

vinokurig merged commit 5934e97 into main Aug 17, 2021

vinokurig deleted the che-19837 branch August 17, 2021 09:22

che-bot added this to the 7.35 milestone Aug 17, 2021

vinokurig mentioned this pull request Aug 17, 2021

fix: Adapt the Secrets plugin API to use kubernetes secrets eclipse-che/che-theia#1166

Merged

9 tasks

vinokurig mentioned this pull request Dec 8, 2021

[devWorkspace] Adapt ssh-plugin to avoid requesting che-server API eclipse-che/che#20859

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: Add a predefined secret to store credentials #68

fix: Add a predefined secret to store credentials #68

vinokurig commented Jul 28, 2021 •

edited

Loading

che-bot commented Jul 28, 2021

amisevsk left a comment

amisevsk Jul 28, 2021

sleshchenko Jul 29, 2021

sleshchenko Jul 29, 2021

vinokurig Aug 2, 2021

sleshchenko Jul 29, 2021

che-bot commented Aug 2, 2021

skabashnyuk commented Aug 3, 2021

che-bot commented Aug 3, 2021

che-bot commented Aug 4, 2021

che-bot commented Aug 4, 2021

che-bot commented Aug 4, 2021

vinokurig commented Aug 5, 2021

sparkoo Aug 5, 2021

che-bot commented Aug 5, 2021

che-bot commented Aug 6, 2021

che-bot commented Aug 9, 2021

sparkoo Aug 10, 2021

vinokurig Aug 10, 2021

sparkoo left a comment

che-bot commented Aug 10, 2021

che-bot commented Aug 11, 2021

vinokurig commented Aug 16, 2021

che-bot commented Aug 16, 2021

vinokurig commented Aug 16, 2021

che-bot commented Aug 16, 2021

dmytro-ndp commented Aug 17, 2021

che-bot commented Aug 17, 2021

fix: Add a predefined secret to store credentials #68

fix: Add a predefined secret to store credentials #68

Conversation

vinokurig commented Jul 28, 2021 • edited Loading

What does this PR do?

Screenshot/screencast of this PR

What issues does this PR fix or reference?

How to test this PR?

PR Checklist

Reviewers

che-bot commented Jul 28, 2021

amisevsk left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

che-bot commented Aug 2, 2021

skabashnyuk commented Aug 3, 2021

che-bot commented Aug 3, 2021

che-bot commented Aug 4, 2021

che-bot commented Aug 4, 2021

che-bot commented Aug 4, 2021

vinokurig commented Aug 5, 2021

Choose a reason for hiding this comment

che-bot commented Aug 5, 2021

che-bot commented Aug 6, 2021

che-bot commented Aug 9, 2021

Choose a reason for hiding this comment

Choose a reason for hiding this comment

sparkoo left a comment

Choose a reason for hiding this comment

che-bot commented Aug 10, 2021

che-bot commented Aug 11, 2021

vinokurig commented Aug 16, 2021

che-bot commented Aug 16, 2021

vinokurig commented Aug 16, 2021

che-bot commented Aug 16, 2021

dmytro-ndp commented Aug 17, 2021

che-bot commented Aug 17, 2021

vinokurig commented Jul 28, 2021 •

edited

Loading