Maester crash when creating a client with tokenEndpointAuthMethod: none

[clement-buchart]

Hello,

I'm having in issue while using master to create a oauth client with tokenEndpointAuthMethod: none

E0325 11:54:20.980206       1 runtime.go:69] Observed a panic: "invalid memory address or nil pointer dereference" (runtime error: invalid memory address or nil pointer dereference)
/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20190404173353-6a84e37a896d/pkg/util/runtime/runtime.go:76
/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20190404173353-6a84e37a896d/pkg/util/runtime/runtime.go:65
/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20190404173353-6a84e37a896d/pkg/util/runtime/runtime.go:51
/usr/local/go/src/runtime/panic.go:679
/usr/local/go/src/runtime/panic.go:199
/usr/local/go/src/runtime/signal_unix.go:394
/go/src/github.com/ory/hydra-maester/controllers/oauth2client_controller.go:233
/go/src/github.com/ory/hydra-maester/controllers/oauth2client_controller.go:123
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.2.0-beta.2/pkg/internal/controller/controller.go:216
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.2.0-beta.2/pkg/internal/controller/controller.go:192
/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.2.0-beta.2/pkg/internal/controller/controller.go:171
/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20190404173353-6a84e37a896d/pkg/util/wait/wait.go:152
/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20190404173353-6a84e37a896d/pkg/util/wait/wait.go:153
/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20190404173353-6a84e37a896d/pkg/util/wait/wait.go:88
/usr/local/go/src/runtime/asm_amd64.s:1357

I suspect the issue may be at :

hydra-maester/controllers/oauth2client_controller.go

Lines 231 to 234 in 38907c2

	Data: map[string][]byte{
	ClientIDKey: []byte(*created.ClientID),
	ClientSecretKey: []byte(*created.Secret),
	},

Here, i suppose if the created oauth2 client has tokenEndpointAuthMethod: none, created.Secret returned by hydra might be nil ?

What do you think ?

[aeneasr]

Yeah, that's possible - would you be up for a fix? :)

[clement-buchart]

Yes.

For now I went with the naive :

	clientSecret := apiv1.Secret{
		ObjectMeta: metav1.ObjectMeta{
			Name:      c.Spec.SecretName,
			Namespace: c.Namespace,
			OwnerReferences: []metav1.OwnerReference{{
				APIVersion: c.TypeMeta.APIVersion,
				Kind:       c.TypeMeta.Kind,
				Name:       c.ObjectMeta.Name,
				UID:        c.ObjectMeta.UID,
			}},
		},
		Data: map[string][]byte{
			ClientIDKey: []byte(*created.ClientID),
		},
	}

	if created.Secret != nil {
		clientSecret.Data[ClientSecretKey] = []byte(*created.Secret)
	}

Maester now starts properly, but the reconciliation loop log error :

2020-03-25T12:19:18.550Z	ERROR	controllers.OAuth2Client	secret frontoffice-oauth2-client/review-hydra is invalid	{"error": "\"client_secret property missing\"", "errorVerbose": "\"client_secret property missing\"\ngithub.com/ory/hydra-maester/controllers.parseSecret\n\t/home/clement/projects/open-source/hydra-maester/controllers/oauth2client_controller.go:325\ngithub.com/ory/hydra-maester/controllers.(*OAuth2ClientReconciler).Reconcile\n\t/home/clement/projects/open-source/hydra-maester/controllers/oauth2client_controller.go:131\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).reconcileHandler\n\t/home/clement/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.2.0-beta.2/pkg/internal/controller/controller.go:216\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).processNextWorkItem\n\t/home/clement/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.2.0-beta.2/pkg/internal/controller/controller.go:192\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller).worker\n\t/home/clement/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.2.0-beta.2/pkg/internal/controller/controller.go:171\nk8s.io/apimachinery/pkg/util/wait.JitterUntil.func1\n\t/home/clement/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20190404173353-6a84e37a896d/pkg/util/wait/wait.go:152\nk8s.io/apimachinery/pkg/util/wait.JitterUntil\n\t/home/clement/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20190404173353-6a84e37a896d/pkg/util/wait/wait.go:153\nk8s.io/apimachinery/pkg/util/wait.Until\n\t/home/clement/go/pkg/mod/k8s.io/apimachinery@v0.0.0-20190404173353-6a84e37a896d/pkg/util/wait/wait.go:88\nruntime.goexit\n\t/usr/lib/go/src/runtime/asm_amd64.s:1373"}

Because the client_secret is not on the secret, naturally.

Would you guys have some pointer regarding what kind of fix you'd expect ?

[clement-buchart]

I was about to create a pull request from https://github.com/dejbox/hydra-maester/tree/handle-nil-secret when I saw https://github.com/ory/hydra-maester/pull/48/files...