Skip to content

Commit 1296304

Browse files
alexander-demicevalexander-demicev
committed
Validate github token in preflight checks
1 parent 9994a4b commit 1296304

File tree

5 files changed

+54
-9
lines changed

5 files changed

+54
-9
lines changed

‎api/v1alpha1/conditions_consts.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ const (
4949

5050
// WaitingForCoreProviderReadyReason documents that the provider is waiting for the core provider to be ready.
5151
WaitingForCoreProviderReadyReason = "WaitingForCoreProviderReady"
52+
53+
// InvalidGithubToken documents that the provided github token is invalid.
54+
InvalidGithubToken = "InvalidGithubTokenError"
5255
)
5356

5457
const (

‎go.mod‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,11 @@ replace sigs.k8s.io/cluster-api => sigs.k8s.io/cluster-api v1.4.2
66

77
require (
88
github.com/google/go-cmp v0.5.9
9+
github.com/google/go-github/v52 v52.0.0
910
github.com/onsi/ginkgo/v2 v2.9.7
1011
github.com/onsi/gomega v1.27.7
1112
github.com/spf13/pflag v1.0.5
13+
golang.org/x/oauth2 v0.7.0
1214
k8s.io/api v0.26.1
1315
k8s.io/apiextensions-apiserver v0.26.1
1416
k8s.io/apimachinery v0.26.1
@@ -29,13 +31,15 @@ require (
2931
github.com/Masterminds/semver/v3 v3.2.0 // indirect
3032
github.com/Masterminds/sprig/v3 v3.2.3 // indirect
3133
github.com/Microsoft/go-winio v0.5.0 // indirect
34+
github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 // indirect
3235
github.com/alessio/shellescape v1.4.1 // indirect
3336
github.com/antlr/antlr4/runtime/Go/antlr v1.4.10 // indirect
3437
github.com/asaskevich/govalidator v0.0.0-20210307081110-f21760c49a8d // indirect
3538
github.com/beorn7/perks v1.0.1 // indirect
3639
github.com/blang/semver v3.5.1+incompatible // indirect
3740
github.com/blang/semver/v4 v4.0.0 // indirect
3841
github.com/cespare/xxhash/v2 v2.1.2 // indirect
42+
github.com/cloudflare/circl v1.1.0 // indirect
3943
github.com/coredns/caddy v1.1.1 // indirect
4044
github.com/coredns/corefile-migration v1.0.20 // indirect
4145
github.com/davecgh/go-spew v1.1.1 // indirect
@@ -101,9 +105,8 @@ require (
101105
github.com/subosito/gotenv v1.4.2 // indirect
102106
github.com/valyala/fastjson v1.6.4 // indirect
103107
go.uber.org/atomic v1.10.0 // indirect
104-
golang.org/x/crypto v0.3.0 // indirect
108+
golang.org/x/crypto v0.7.0 // indirect
105109
golang.org/x/net v0.10.0 // indirect
106-
golang.org/x/oauth2 v0.6.0 // indirect
107110
golang.org/x/sys v0.8.0 // indirect
108111
golang.org/x/term v0.8.0 // indirect
109112
golang.org/x/text v0.9.0 // indirect

‎go.sum‎

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,8 @@ github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBa
5353
github.com/Microsoft/go-winio v0.5.0 h1:Elr9Wn+sGKPlkaBvwu4mTrxtmOp3F3yV9qhaHbXGjwU=
5454
github.com/Microsoft/go-winio v0.5.0/go.mod h1:JPGBdM1cNvN/6ISo+n8V5iA4v8pBzdOpzfwIujj1a84=
5555
github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
56+
github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8 h1:wPbRQzjjwFc0ih8puEVAOFGELsn1zoIIYdxvML7mDxA=
57+
github.com/ProtonMail/go-crypto v0.0.0-20230217124315-7d5c6f04bbb8/go.mod h1:I0gYDMZ6Z5GRU7l58bNFSkPTFN6Yl12dsUlAZ8xy98g=
5658
github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
5759
github.com/alecthomas/template v0.0.0-20190718012654-fb15b899a751/go.mod h1:LOuyumcjzFXgccqObfd/Ljyb9UuFJ6TxHnclSeseNhc=
5860
github.com/alecthomas/units v0.0.0-20151022065526-2efee857e7cf/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
@@ -79,6 +81,7 @@ github.com/blang/semver v3.5.1+incompatible/go.mod h1:kRBLl5iJ+tD4TcOOxsy/0fnweb
7981
github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
8082
github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
8183
github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
84+
github.com/bwesterb/go-ristretto v1.2.0/go.mod h1:fUIoIZaG73pV5biE2Blr2xEzDoMj7NFEuV9ekS419A0=
8285
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
8386
github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
8487
github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -88,6 +91,8 @@ github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWR
8891
github.com/chzyer/readline v0.0.0-20180603132655-2972be24d48e/go.mod h1:nSuG5e5PlCu98SY8svDHJxuZscDgtXS6KTTbou5AhLI=
8992
github.com/chzyer/test v0.0.0-20180213035817-a1ea475d72b1/go.mod h1:Q3SI9o4m/ZMnBNeIyt5eFwwo7qiLfzFZmjNmxjkiQlU=
9093
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
94+
github.com/cloudflare/circl v1.1.0 h1:bZgT/A+cikZnKIwn7xL2OBj012Bmvho/o6RpRvv3GKY=
95+
github.com/cloudflare/circl v1.1.0/go.mod h1:prBCrKB9DV4poKZY1l9zBXg2QJY7mvgRvtMxxK7fi4I=
9196
github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
9297
github.com/cncf/udpa/go v0.0.0-20200629203442-efcf912fb354/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
9398
github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
@@ -227,6 +232,8 @@ github.com/google/go-cmp v0.5.9 h1:O2Tfq5qg4qc4AmwVlvv0oLiVAGB7enBSJ2x2DqQFi38=
227232
github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
228233
github.com/google/go-github/v48 v48.2.0 h1:68puzySE6WqUY9KWmpOsDEQfDZsso98rT6pZcz9HqcE=
229234
github.com/google/go-github/v48 v48.2.0/go.mod h1:dDlehKBDo850ZPvCTK0sEqTCVWcrGl2LcDiajkYi89Y=
235+
github.com/google/go-github/v52 v52.0.0 h1:uyGWOY+jMQ8GVGSX8dkSwCzlehU3WfdxQ7GweO/JP7M=
236+
github.com/google/go-github/v52 v52.0.0/go.mod h1:WJV6VEEUPuMo5pXqqa2ZCZEdbQqua4zAk2MZTIo+m+4=
230237
github.com/google/go-querystring v1.1.0 h1:AnCroh3fv4ZBgVIf1Iwtovgjaw/GiKJo8M8yD/fhyJ8=
231238
github.com/google/go-querystring v1.1.0/go.mod h1:Kcdr2DB4koayq7X8pmAG4sNG59So17icRSOU623lUBU=
232239
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -523,8 +530,9 @@ golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPh
523530
golang.org/x/crypto v0.0.0-20210421170649-83a5a9bb288b/go.mod h1:T9bdIzuCu7OtxOm1hfPfRQxPLYneinmdGuTeoZ9dtd4=
524531
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
525532
golang.org/x/crypto v0.0.0-20211108221036-ceb1ce70b4fa/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
526-
golang.org/x/crypto v0.3.0 h1:a06MkbcxBrEFc0w0QIZWXrH/9cCX6KJyWbBOIwAn+7A=
527533
golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
534+
golang.org/x/crypto v0.7.0 h1:AvwMYaRytfdeVt3u6mLaxYtErKYjxA2OXjJ1HHq6t3A=
535+
golang.org/x/crypto v0.7.0/go.mod h1:pYwdfH91IfpZVANVyUOhSIPZaFoJGxTFbZhFTx+dXZU=
528536
golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
529537
golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
530538
golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8=
@@ -616,8 +624,8 @@ golang.org/x/oauth2 v0.0.0-20201208152858-08078c50e5b5/go.mod h1:KelEdhl1UZF7XfJ
616624
golang.org/x/oauth2 v0.0.0-20210218202405-ba52d332ba99/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
617625
golang.org/x/oauth2 v0.0.0-20210514164344-f6687ab2804c/go.mod h1:KelEdhl1UZF7XfJ4dDtk6s++YSgaE7mD/BuKKDLBl4A=
618626
golang.org/x/oauth2 v0.0.0-20220223155221-ee480838109b/go.mod h1:DAh4E804XQdzx2j+YRIaUnCqCV2RuMz24cGBJ5QYIrc=
619-
golang.org/x/oauth2 v0.6.0 h1:Lh8GPgSKBfWSwFvtuWOfeI3aAAnbXTSutYxJiOJFgIw=
620-
golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
627+
golang.org/x/oauth2 v0.7.0 h1:qe6s0zUXlPX80/dITx3440hWZ7GwMwgDDyrSGTPJG/g=
628+
golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
621629
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
622630
golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
623631
golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -679,6 +687,7 @@ golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBc
679687
golang.org/x/sys v0.0.0-20210603081109-ebe580a85c40/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
680688
golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
681689
golang.org/x/sys v0.0.0-20210630005230-0f9fa26af87c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
690+
golang.org/x/sys v0.0.0-20211007075335-d3039528d8ac/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
682691
golang.org/x/sys v0.0.0-20211216021012-1d35b9e2eb4e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
683692
golang.org/x/sys v0.0.0-20220114195835-da31bd327af9/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
684693
golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=

‎internal/controller/preflight_checks.go‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,10 @@ import (
2020
"context"
2121
"fmt"
2222

23+
"github.com/google/go-github/v52/github"
24+
"golang.org/x/oauth2"
2325
corev1 "k8s.io/api/core/v1"
26+
"k8s.io/apimachinery/pkg/types"
2427
"k8s.io/apimachinery/pkg/util/version"
2528
operatorv1 "sigs.k8s.io/cluster-api-operator/api/v1alpha1"
2629
"sigs.k8s.io/cluster-api-operator/internal/controller/genericprovider"
@@ -40,9 +43,10 @@ const (
4043
var (
4144
moreThanOneCoreProviderInstanceExistsMessage = "CoreProvider already exists in the cluster. Only one is allowed."
4245
moreThanOneProviderInstanceExistsMessage = "There is already a %s with name %s in the cluster. Only one is allowed."
43-
capiVersionIncompatibilityMessage = "capi operator is only compatible with %s providers, detected %s for provider %s."
44-
waitingForCoreProviderReadyMessage = "waiting for the core provider to install."
45-
emptyVersionMessage = "version cannot be empty"
46+
capiVersionIncompatibilityMessage = "CAPI operator is only compatible with %s providers, detected %s for provider %s."
47+
invalidGithubTokenMessage = "Invalid github token, please check your github token value and it's permissions"
48+
waitingForCoreProviderReadyMessage = "Waiting for the core provider to install."
49+
emptyVersionMessage = "Version cannot be empty"
4650
)
4751

4852
// preflightChecks performs preflight checks before installing provider.
@@ -110,6 +114,32 @@ func preflightChecks(ctx context.Context, c client.Client, provider genericprovi
110114
return ctrl.Result{}, fmt.Errorf("only one of Selector and URL must be provided for provider %s", provider.GetName())
111115
}
112116

117+
// Validate that provided github token works and has repository access.
118+
if spec.SecretName != "" {
119+
secret := &corev1.Secret{}
120+
key := types.NamespacedName{Namespace: provider.GetNamespace(), Name: provider.GetSpec().SecretName}
121+
122+
if err := c.Get(ctx, key, secret); err != nil {
123+
return ctrl.Result{}, fmt.Errorf("failed to get providers secret: %w", err)
124+
}
125+
126+
if token, ok := secret.Data[configclient.GitHubTokenVariable]; ok {
127+
client := github.NewClient(oauth2.NewClient(ctx, oauth2.StaticTokenSource(
128+
&oauth2.Token{AccessToken: string(token)},
129+
)))
130+
if _, _, err := client.Organizations.List(ctx, "kubernetes-sigs", nil); err != nil {
131+
conditions.Set(provider, conditions.FalseCondition(
132+
operatorv1.PreflightCheckCondition,
133+
operatorv1.InvalidGithubToken,
134+
clusterv1.ConditionSeverityError,
135+
invalidGithubTokenMessage,
136+
))
137+
138+
return ctrl.Result{}, fmt.Errorf("failed to validate provided github token: %w", err)
139+
}
140+
}
141+
}
142+
113143
if err := c.List(ctx, providerList.GetObject()); err != nil {
114144
return ctrl.Result{}, fmt.Errorf("failed to list providers: %w", err)
115145
}

‎internal/controller/preflight_checks_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -485,7 +485,7 @@ func TestPreflightChecks(t *testing.T) {
485485
Type: operatorv1.PreflightCheckCondition,
486486
Reason: operatorv1.IncorrectVersionFormatReason,
487487
Severity: clusterv1.ConditionSeverityError,
488-
Message: "version cannot be empty",
488+
Message: "Version cannot be empty",
489489
Status: corev1.ConditionFalse,
490490
},
491491
providerList: &genericprovider.InfrastructureProviderListWrapper{

0 commit comments

Comments
 (0)