Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update agents listing service with "CanReAttest" filter #3880

Merged
merged 8 commits into from
Mar 9, 2023
Merged

Update agents listing service with "CanReAttest" filter #3880

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
4cdd21d
Apply CanReAttest filter and mask on agents listing
guilhermocc Feb 16, 2023
559322c
Update cmds outputs with new hint and canReAttest fields
guilhermocc Feb 16, 2023
dbaed27
Fix code formatting
guilhermocc Feb 17, 2023
026234b
Rename can re-attest field
guilhermocc Feb 22, 2023
4b05585
Update spire-api-sdk version
guilhermocc Mar 8, 2023
0db980d
Address review comments
guilhermocc Mar 8, 2023
25f6a60
Fix rebase issues
guilhermocc Mar 8, 2023
b8a3c97
Merge branch 'main' into update-agents-listing-service-with-new-filter
MarcosDY Mar 9, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Next Next commit
Apply CanReAttest filter and mask on agents listing 
Signed-off-by: Guilherme Carvalho <guilhermbrsp@gmail.com>
  • Loading branch information
@guilhermocc
guilhermocc committed Mar 8, 2023
commit 4cdd21d743d81d69a40cdd0b6cdcfa66cad8b3ef
1 change: 1 addition & 0 deletions pkg/common/protoutil/masks_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@ func TestAllTrueMasks(t *testing.T) {
X509SvidExpiresAt: true,
Selectors: true,
Banned: true,
CanReAttest: true,
}, protoutil.AllTrueAgentMask)

spiretest.AssertProtoEqual(t, &types.BundleMask{
Expand Down
3 changes: 3 additions & 0 deletions pkg/common/telemetry/names.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,9 @@ const (
// ByBanned tags filtering by banned agents
ByBanned = "by_banned"

// ByCanReAttest tags filtering by agents that can re-attest
ByCanReAttest = "by_can_re_attest"

// BySelectorMatch tags Match used when filtering by Selectors
BySelectorMatch = "by_selector_match"

Expand Down
1 change: 1 addition & 0 deletions pkg/server/api/agent.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@ func ProtoFromAttestedNode(n *common.AttestedNode) (*types.Agent, error) {
X509SvidExpiresAt: n.CertNotAfter,
X509SvidSerialNumber: n.CertSerialNumber,
Banned: n.CertSerialNumber == "",
CanReAttest: n.CanReattest,
Selectors: ProtoFromSelectors(n.Selectors),
}, nil
}
13 changes: 13 additions & 0 deletions pkg/server/api/agent/v1/service.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -100,9 +100,14 @@ func (s *Service) ListAgents(ctx context.Context, req *agentv1.ListAgentsRequest
if filter.ByBanned != nil {
byBanned = &filter.ByBanned.Value
}
var byCanReAttest *bool
if filter.ByCanReAttest != nil {
byCanReAttest = &filter.ByCanReAttest.Value
}

listReq.ByAttestationType = filter.ByAttestationType
listReq.ByBanned = byBanned
listReq.ByCanReAttest = byCanReAttest

if filter.BySelectorMatch != nil {
selectors, err := api.SelectorsFromProto(filter.BySelectorMatch.Selectors)
Expand Down Expand Up @@ -635,6 +640,10 @@ func applyMask(a *types.Agent, mask *types.AgentMask) {
if !mask.Banned {
a.Banned = false
}

if !mask.CanReAttest {
a.CanReAttest = false
}
}

func validateAttestAgentParams(params *agentv1.AttestAgentRequest_Params) error {
Expand Down Expand Up @@ -684,6 +693,10 @@ func fieldsFromFilterRequest(filter *agentv1.ListAgentsRequest_Filter) logrus.Fi
fields[telemetry.ByBanned] = filter.ByBanned.Value
}

if filter.ByCanReAttest != nil {
fields[telemetry.ByCanReAttest] = filter.ByCanReAttest.Value
}

if filter.BySelectorMatch != nil {
fields[telemetry.BySelectorMatch] = filter.BySelectorMatch.Match.String()
fields[telemetry.BySelectors] = api.SelectorFieldFromProto(filter.BySelectorMatch.Selectors)
Expand Down
57 changes: 57 additions & 0 deletions pkg/server/api/agent/v1/service_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -265,6 +265,7 @@ func TestListAgents(t *testing.T) {
CertNotAfter: notAfter,
NewCertNotAfter: newNoAfter,
NewCertSerialNumber: "new badcafe",
CanReattest: false,
Selectors: []*common.Selector{
{Type: "a", Value: "1"},
{Type: "b", Value: "2"},
Expand All @@ -283,6 +284,7 @@ func TestListAgents(t *testing.T) {
CertNotAfter: notAfter,
NewCertNotAfter: newNoAfter,
NewCertSerialNumber: "new deadbeef",
CanReattest: false,
Selectors: []*common.Selector{
{Type: "a", Value: "1"},
{Type: "c", Value: "3"},
Expand All @@ -301,6 +303,7 @@ func TestListAgents(t *testing.T) {
CertNotAfter: notAfter,
NewCertNotAfter: newNoAfter,
NewCertSerialNumber: "",
CanReattest: true,
}
_, err = test.ds.CreateAttestedNode(ctx, node3)
require.NoError(t, err)
Expand Down Expand Up @@ -347,6 +350,7 @@ func TestListAgents(t *testing.T) {
Id: api.ProtoFromID(node1ID),
AttestationType: "t1",
Banned: false,
CanReAttest: false,
X509SvidExpiresAt: notAfter,
X509SvidSerialNumber: "badcafe",
Selectors: []*types.Selector{
Expand All @@ -358,6 +362,7 @@ func TestListAgents(t *testing.T) {
Id: api.ProtoFromID(node2ID),
AttestationType: "t2",
Banned: false,
CanReAttest: false,
X509SvidExpiresAt: notAfter,
X509SvidSerialNumber: "deadbeef",
Selectors: []*types.Selector{
Expand All @@ -369,6 +374,7 @@ func TestListAgents(t *testing.T) {
Id: api.ProtoFromID(node3ID),
AttestationType: "t3",
Banned: true,
CanReAttest: true,
X509SvidExpiresAt: notAfter,
X509SvidSerialNumber: "",
},
Expand Down Expand Up @@ -484,6 +490,57 @@ func TestListAgents(t *testing.T) {
},
},
},
{
name: "by can re-attest true",
req: &agentv1.ListAgentsRequest{
OutputMask: &types.AgentMask{},
Filter: &agentv1.ListAgentsRequest_Filter{
ByCanReAttest: &wrapperspb.BoolValue{Value: true},
},
},
expectResp: &agentv1.ListAgentsResponse{
Agents: []*types.Agent{
{Id: api.ProtoFromID(node3ID)},
},
},
expectLogs: []spiretest.LogEntry{
{
Level: logrus.InfoLevel,
Message: "API accessed",
Data: logrus.Fields{
telemetry.Status: "success",
telemetry.Type: "audit",
telemetry.ByCanReAttest: "true",
},
},
},
},
{
name: "by can re-attest false",
req: &agentv1.ListAgentsRequest{
OutputMask: &types.AgentMask{},
Filter: &agentv1.ListAgentsRequest_Filter{
ByCanReAttest: &wrapperspb.BoolValue{Value: false},
},
},
expectResp: &agentv1.ListAgentsResponse{
Agents: []*types.Agent{
{Id: api.ProtoFromID(node1ID)},
{Id: api.ProtoFromID(node2ID)},
},
},
expectLogs: []spiretest.LogEntry{
{
Level: logrus.InfoLevel,
Message: "API accessed",
Data: logrus.Fields{
telemetry.Status: "success",
telemetry.Type: "audit",
telemetry.ByCanReAttest: "false",
},
},
},
},
{
name: "by selectors",
req: &agentv1.ListAgentsRequest{
Expand Down
2 changes: 1 addition & 1 deletion pkg/server/datastore/datastore.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -135,7 +135,7 @@ type ListAttestedNodesRequest struct {
BySelectorMatch *BySelectors
FetchSelectors bool
Pagination *Pagination
ByCanReattest *bool
ByCanReAttest *bool
}

type ListAttestedNodesResponse struct {
Expand Down
10 changes: 5 additions & 5 deletions pkg/server/datastore/sqlstore/sqlstore.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1283,9 +1283,9 @@ func buildListAttestedNodesQueryCTE(req *datastore.ListAttestedNodesRequest, dbT
}
}

// Filter by CanReattest. This is similar to ByBanned
if req.ByCanReattest != nil {
if *req.ByCanReattest {
// Filter by CanReAttest. This is similar to ByBanned
if req.ByCanReAttest != nil {
if *req.ByCanReAttest {
builder.WriteString("\t\tAND can_reattest = true\n")
} else {
builder.WriteString("\t\tAND can_reattest = false\n")
Expand Down Expand Up @@ -1511,8 +1511,8 @@ FROM attested_node_entries N
}

// Filter by CanReattest. This is similar to ByBanned
if req.ByCanReattest != nil {
if *req.ByCanReattest {
if req.ByCanReAttest != nil {
if *req.ByCanReAttest {
builder.WriteString("\t\tAND can_reattest = true\n")
} else {
builder.WriteString("\t\tAND can_reattest = false\n")
Expand Down
2 changes: 1 addition & 1 deletion pkg/server/datastore/sqlstore/sqlstore_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -902,7 +902,7 @@ func (s *PluginSuite) TestListAttestedNodes() {
ByAttestationType: tt.byAttestationType,
BySelectorMatch: tt.bySelectors,
ByBanned: tt.byBanned,
ByCanReattest: tt.byCanReattest,
ByCanReAttest: tt.byCanReattest,
FetchSelectors: withSelectors,
}

Expand Down