Skip to content

Commit 01126ac

Browse files
swalrus1swalrus1
authored
implement secret identification by name (#12641)
1 parent 0a53ed1 commit 01126ac

File tree

12 files changed

+208
-109
lines changed

12 files changed

+208
-109
lines changed

‎ydb/core/kqp/federated_query/kqp_federated_query_actors.cpp‎

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,9 @@ class TDescribeSecretsActor: public NActors::TActorBootstrapped<TDescribeSecrets
1919
std::vector<TString> secretValues;
2020
secretValues.reserve(SecretIds.size());
2121
for (const auto& secretId: SecretIds) {
22-
TString secretValue;
23-
bool isFound = snapshot->GetSecretValue(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(secretId), secretValue);
24-
if (isFound) {
25-
secretValues.push_back(secretValue);
22+
auto secretValue = snapshot->GetSecretValue(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(secretId));
23+
if (secretValue.IsSuccess()) {
24+
secretValues.push_back(secretValue.DetachResult());
2625
continue;
2726
}
2827

@@ -32,10 +31,12 @@ class TDescribeSecretsActor: public NActors::TActorBootstrapped<TDescribeSecrets
3231
return;
3332
}
3433

35-
isFound = !secretIds.empty() && snapshot->GetSecretValue(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(secretIds[0]), secretValue);
36-
if (isFound) {
37-
secretValues.push_back(secretValue);
38-
continue;
34+
if (!secretIds.empty()) {
35+
secretValue = snapshot->GetSecretValue(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(secretIds[0]));
36+
if (secretValue.IsSuccess()) {
37+
secretValues.push_back(secretValue.DetachResult());
38+
continue;
39+
}
3940
}
4041

4142
if (!AskSent) {

‎ydb/core/tx/replication/controller/secret_resolver.cpp‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -47,12 +47,12 @@ class TSecretResolver: public TActorBootstrapped<TSecretResolver> {
4747
void Handle(NMetadata::NProvider::TEvRefreshSubscriberData::TPtr& ev) {
4848
const auto* snapshot = ev->Get()->GetSnapshotAs<NMetadata::NSecret::TSnapshot>();
4949

50-
TString secretValue;
51-
if (!snapshot->GetSecretValue(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(SecretId), secretValue)) {
52-
return Reply(false, TStringBuilder() << "Secret '" << SecretName << "' not found");
50+
auto secretValue = snapshot->GetSecretValue(NMetadata::NSecret::TSecretIdOrValue::BuildAsId(SecretId));
51+
if (secretValue.IsFail()) {
52+
return Reply(false, secretValue.GetErrorMessage());
5353
}
5454

55-
Reply(secretValue);
55+
Reply(secretValue.DetachResult());
5656
}
5757

5858
template <typename... Args>

‎ydb/core/tx/tiering/tier/checker.cpp‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,15 @@ void TTierPreparationActor::StartChecker() {
1010
return;
1111
}
1212
auto g = PassAwayGuard();
13-
for (auto&& tier : Objects) {
14-
if (!Secrets->CheckSecretAccess(tier.GetAccessKey(), Context.GetExternalData().GetUserToken())) {
15-
Controller->OnPreparationProblem("no access for secret: " + tier.GetAccessKey().DebugString());
16-
return;
17-
} else if (!Secrets->CheckSecretAccess(tier.GetSecretKey(), Context.GetExternalData().GetUserToken())) {
18-
Controller->OnPreparationProblem("no access for secret: " + tier.GetSecretKey().DebugString());
19-
return;
13+
if (const auto& userToken = Context.GetExternalData().GetUserToken()) {
14+
for (auto&& tier : Objects) {
15+
if (!Secrets->CheckSecretAccess(tier.GetAccessKey(), *userToken)) {
16+
Controller->OnPreparationProblem("no access for secret: " + tier.GetAccessKey().DebugString());
17+
return;
18+
} else if (!Secrets->CheckSecretAccess(tier.GetSecretKey(), *userToken)) {
19+
Controller->OnPreparationProblem("no access for secret: " + tier.GetSecretKey().DebugString());
20+
return;
21+
}
2022
}
2123
}
2224
Controller->OnPreparationFinished(std::move(Objects));

‎ydb/core/tx/tiering/tier/object.cpp‎

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -44,16 +44,22 @@ NMetadata::NInternal::TTableRecord TTierConfig::SerializeToRecord() const {
4444
return result;
4545
}
4646

47-
NKikimrSchemeOp::TS3Settings TTierConfig::GetPatchedConfig(
48-
std::shared_ptr<NMetadata::NSecret::TSnapshot> secrets) const
49-
{
47+
NKikimrSchemeOp::TS3Settings TTierConfig::GetPatchedConfig(std::shared_ptr<NMetadata::NSecret::TSnapshot> secrets) const {
5048
auto config = ProtoConfig.GetObjectStorage();
5149
if (secrets) {
52-
if (!secrets->GetSecretValue(GetAccessKey(), *config.MutableAccessKey())) {
53-
ALS_ERROR(NKikimrServices::TX_TIERING) << "cannot read access key secret for " << GetAccessKey().DebugString();
50+
{
51+
auto value = secrets->GetSecretValue(GetAccessKey());
52+
if (value.IsFail()) {
53+
AFL_ERROR(NKikimrServices::TX_TIERING)("error", "invalid_secret")("object", "access_key")("reason", value.GetErrorMessage());
54+
}
55+
config.SetAccessKey(value.DetachResult());
5456
}
55-
if (!secrets->GetSecretValue(GetSecretKey(), *config.MutableSecretKey())) {
56-
ALS_ERROR(NKikimrServices::TX_TIERING) << "cannot read secret key secret for " << GetSecretKey().DebugString();
57+
{
58+
auto value = secrets->GetSecretValue(GetSecretKey());
59+
if (value.IsFail()) {
60+
AFL_ERROR(NKikimrServices::TX_TIERING)("error", "invalid_secret")("object", "secret_key")("reason", value.GetErrorMessage());
61+
}
62+
config.SetSecretKey(value.DetachResult());
5763
}
5864
}
5965
return config;

‎ydb/core/tx/tiering/tier/object.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
#include <ydb/services/metadata/manager/preparation_controller.h>
55
#include <ydb/services/metadata/manager/table_record.h>
66
#include <ydb/services/metadata/manager/object.h>
7+
#include <ydb/services/metadata/secret/snapshot.h>
78
#include <ydb/services/metadata/service.h>
8-
#include <ydb/services/metadata/secret/secret.h>
99

1010
#include <library/cpp/json/writer/json_value.h>
1111

‎ydb/services/ext_index/ut/ut_ext_index.cpp‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
#include <ydb/core/cms/console/configs_dispatcher.h>
22
#include <ydb/core/testlib/cs_helper.h>
3-
#include <ydb/core/tx/tiering/external_data.h>
43
#include <ydb/core/tx/schemeshard/schemeshard.h>
54
#include <ydb/core/tx/tx_proxy/proxy.h>
65
#include <ydb/core/formats/arrow/size_calcer.h>
@@ -25,8 +24,6 @@
2524

2625
namespace NKikimr {
2726

28-
using namespace NColumnShard;
29-
3027
class TLocalHelper: public Tests::NCS::THelper {
3128
private:
3229
using TBase = Tests::NCS::THelper;

‎ydb/services/metadata/initializer/ut/ut_init.cpp‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
#include <ydb/core/cms/console/configs_dispatcher.h>
22
#include <ydb/core/testlib/cs_helper.h>
3-
#include <ydb/core/tx/tiering/external_data.h>
43
#include <ydb/core/tx/schemeshard/schemeshard.h>
54
#include <ydb/core/tx/tx_proxy/proxy.h>
65
#include <ydb/core/wrappers/ut_helpers/s3_mock.h>
@@ -28,8 +27,6 @@
2827

2928
namespace NKikimr {
3029

31-
using namespace NColumnShard;
32-
3330
Y_UNIT_TEST_SUITE(Initializer) {
3431

3532
class TTestInitializer: public NMetadata::NInitializer::IInitializationBehaviour {

‎ydb/services/metadata/secret/secret.cpp‎

Lines changed: 15 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -38,14 +38,22 @@ TString TSecretId::SerializeToString() const {
3838
return sb;
3939
}
4040

41-
4241
TString TSecretIdOrValue::DebugString() const {
43-
if (SecretId) {
44-
return SecretId->SerializeToString();
45-
} else if (Value) {
46-
return MD5::Calc(*Value);
47-
}
48-
return "";
42+
return std::visit(TOverloaded(
43+
[](std::monostate) -> TString{
44+
return "__NONE__";
45+
},
46+
[](const TSecretId& id) -> TString{
47+
return id.SerializeToString();
48+
},
49+
[](const TSecretName& name) -> TString{
50+
return name.SerializeToString();
51+
},
52+
[](const TString& value) -> TString{
53+
return MD5::Calc(value);
54+
}
55+
),
56+
State);
4957
}
5058

5159
}

‎ydb/services/metadata/secret/secret.h‎

Lines changed: 90 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,10 @@ class TSecretId {
1212
private:
1313
YDB_READONLY_PROTECT_DEF(TString, OwnerUserId);
1414
YDB_READONLY_PROTECT_DEF(TString, SecretId);
15+
1516
public:
17+
inline static const TString PrefixWithUser = "USId:";
18+
1619
TSecretId() = default;
1720
TSecretId(const TString& ownerUserId, const TString& secretId)
1821
: OwnerUserId(ownerUserId)
@@ -31,7 +34,7 @@ class TSecretId {
3134
if (proto.HasValue()) {
3235
return proto.GetValue();
3336
} else {
34-
return TStringBuilder() << "USId:" << (proto.GetSecretOwnerId() ? proto.GetSecretOwnerId() : defaultOwnerId) << ":" << SecretId;
37+
return TStringBuilder() << PrefixWithUser << (proto.GetSecretOwnerId() ? proto.GetSecretOwnerId() : defaultOwnerId) << ":" << SecretId;
3538
}
3639
}
3740

@@ -43,18 +46,41 @@ class TSecretId {
4346
}
4447
};
4548

49+
class TSecretName {
50+
private:
51+
YDB_READONLY_DEF(TString, SecretId);
52+
53+
public:
54+
inline static const TString PrefixNoUser = "SId:";
55+
56+
TSecretName() = default;
57+
TSecretName(const TString& secretId) : SecretId(secretId) {}
58+
59+
TString SerializeToString() const {
60+
return TStringBuilder() << "SId:" << SecretId;
61+
}
62+
63+
bool DeserializeFromString(const TString& secretString) {
64+
if (secretString.StartsWith(PrefixNoUser)) {
65+
SecretId = secretString.substr(PrefixNoUser.size());
66+
return true;
67+
}
68+
return false;
69+
}
70+
};
71+
4672
class TSecretIdOrValue {
4773
private:
48-
YDB_READONLY_DEF(std::optional<TSecretId>, SecretId);
49-
YDB_READONLY_DEF(std::optional<TString>, Value);
74+
using TState = std::variant<std::monostate, TSecretId, TSecretName, TString>;
75+
YDB_READONLY_DEF(TState, State);
76+
77+
private:
5078
TSecretIdOrValue() = default;
5179

52-
bool DeserializeFromStringImpl(const TString& info, const TString& defaultUserId) {
53-
static const TString prefixWithUser = "USId:";
54-
static const TString prefixNoUser = "SId:";
55-
if (info.StartsWith(prefixWithUser)) {
80+
bool DeserializeFromStringImpl(const TString& info, const TString& defaultUserId = "") {
81+
if (info.StartsWith(TSecretId::PrefixWithUser)) {
5682
TStringBuf sb(info.data(), info.size());
57-
sb.Skip(prefixWithUser.size());
83+
sb.Skip(TSecretId::PrefixWithUser.size());
5884
TStringBuf uId;
5985
TStringBuf sId;
6086
if (!sb.TrySplit(':', uId, sId)) {
@@ -63,32 +89,37 @@ class TSecretIdOrValue {
6389
if (!uId || !sId) {
6490
return false;
6591
}
66-
SecretId = TSecretId(uId, sId);
67-
} else if (info.StartsWith(prefixNoUser)) {
92+
State = TSecretId(uId, sId);
93+
} else if (info.StartsWith(TSecretName::PrefixNoUser)) {
6894
TStringBuf sb(info.data(), info.size());
69-
sb.Skip(prefixNoUser.size());
70-
SecretId = TSecretId(defaultUserId, TString(sb));
71-
if (!sb || !defaultUserId) {
95+
sb.Skip(TSecretName::PrefixNoUser.size());
96+
if (!sb) {
7297
return false;
7398
}
99+
if (defaultUserId) {
100+
State = TSecretId(defaultUserId, TString(sb));
101+
} else {
102+
State = TSecretName(TString(sb));
103+
}
74104
} else {
75-
Value = info;
105+
State = info;
76106
}
77107
return true;
78108
}
79-
explicit TSecretIdOrValue(const TSecretId& id)
80-
: SecretId(id) {
81109

110+
explicit TSecretIdOrValue(const TSecretId& id)
111+
: State(id) {
112+
}
113+
explicit TSecretIdOrValue(const TSecretName& id)
114+
: State(id) {
82115
}
83-
84116
explicit TSecretIdOrValue(const TString& value)
85-
: Value(value) {
86-
117+
: State(value) {
87118
}
88119

89120
public:
90121
bool operator!() const {
91-
return !Value && !SecretId;
122+
return std::holds_alternative<std::monostate>(State);
92123
}
93124

94125
static TSecretIdOrValue BuildAsValue(const TString& value) {
@@ -103,12 +134,18 @@ class TSecretIdOrValue {
103134
return TSecretIdOrValue(id);
104135
}
105136

106-
static std::optional<TSecretIdOrValue> DeserializeFromOptional(const NKikimrSchemeOp::TSecretableVariable& proto, const TString& secretInfo, const TString& defaultOwnerId = Default<TString>()) {
137+
static TSecretIdOrValue BuildAsId(const TSecretName& id) {
138+
return TSecretIdOrValue(id);
139+
}
140+
141+
static std::optional<TSecretIdOrValue> DeserializeFromOptional(
142+
const NKikimrSchemeOp::TSecretableVariable& proto, const TString& secretInfo, const TString& defaultOwnerId = Default<TString>()) {
107143
if (proto.HasSecretId()) {
108144
return DeserializeFromProto(proto, defaultOwnerId);
109145
} else if (proto.HasValue()) {
110146
return DeserializeFromString(proto.GetValue().GetData());
111-
} if (secretInfo) {
147+
}
148+
if (secretInfo) {
112149
return DeserializeFromString(secretInfo, defaultOwnerId);
113150
} else {
114151
return {};
@@ -117,16 +154,25 @@ class TSecretIdOrValue {
117154

118155
NKikimrSchemeOp::TSecretableVariable SerializeToProto() const {
119156
NKikimrSchemeOp::TSecretableVariable result;
120-
if (SecretId) {
121-
result.MutableSecretId()->SetId(SecretId->GetSecretId());
122-
result.MutableSecretId()->SetOwnerId(SecretId->GetOwnerUserId());
123-
} else if (Value) {
124-
result.MutableValue()->SetData(*Value);
125-
}
157+
std::visit(TOverloaded(
158+
[](std::monostate){ },
159+
[&result](const TSecretId& id){
160+
result.MutableSecretId()->SetId(id.GetSecretId());
161+
result.MutableSecretId()->SetOwnerId(id.GetOwnerUserId());
162+
},
163+
[&result](const TSecretName& name){
164+
result.MutableSecretId()->SetId(name.GetSecretId());
165+
},
166+
[&result](const TString& value){
167+
result.MutableValue()->SetData(value);
168+
}
169+
),
170+
State);
126171
return result;
127172
}
128173

129-
static std::optional<TSecretIdOrValue> DeserializeFromProto(const NKikimrSchemeOp::TSecretableVariable& proto, const TString& defaultOwnerId = Default<TString>()) {
174+
static std::optional<TSecretIdOrValue> DeserializeFromProto(
175+
const NKikimrSchemeOp::TSecretableVariable& proto, const TString& defaultOwnerId = Default<TString>()) {
130176
if (proto.HasSecretId()) {
131177
TString ownerId;
132178
TString secretId;
@@ -157,12 +203,21 @@ class TSecretIdOrValue {
157203
}
158204

159205
TString SerializeToString() const {
160-
if (SecretId) {
161-
return SecretId->SerializeToString();
162-
} else if (Value) {
163-
return *Value;
164-
}
165-
return "";
206+
return std::visit(TOverloaded(
207+
[](std::monostate) -> TString{
208+
return "";
209+
},
210+
[](const TSecretId& id) -> TString{
211+
return TStringBuilder() << TSecretId::PrefixWithUser << id.GetOwnerUserId() << ":" << id.GetSecretId();
212+
},
213+
[](const TSecretName& name) -> TString{
214+
return TStringBuilder() << TSecretName::PrefixNoUser << name.GetSecretId();
215+
},
216+
[](const TString& value) -> TString{
217+
return value;
218+
}
219+
),
220+
State);
166221
}
167222

168223
TString DebugString() const;

0 commit comments

Comments
 (0)