Skip to content

Commit

Permalink
manifest: add WorkloadSecretID field
Browse files Browse the repository at this point in the history 
This field will be used as part of the workload secret feature (RFC 007) to generate secrets.
  • Loading branch information
@3u13r
3u13r committed Aug 2, 2024
1 parent 0697c37 commit d0f0115
Show file tree
Hide file tree
Showing 8 changed files with 41 additions and 32 deletions.
15 changes: 8 additions & 7 deletions cli/cmd/policies.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,22 +76,23 @@ func policiesFromKubeResources(yamlPaths []string) ([]deployment, error) {
return deployments, nil
}

func manifestPolicyMapFromPolicies(policies []deployment) (map[manifest.HexString][]string, error) {
policyHashes := make(map[manifest.HexString][]string)
func manifestPolicyMapFromPolicies(policies []deployment) (map[manifest.HexString]manifest.PolicyEntry, error) {
policyHashes := make(map[manifest.HexString]manifest.PolicyEntry)
for _, depl := range policies {
if existingNames, ok := policyHashes[depl.policy.Hash()]; ok {
if slices.Equal(existingNames, depl.DNSNames()) {
if entry, ok := policyHashes[depl.policy.Hash()]; ok {
if slices.Equal(entry.SANs, depl.DNSNames()) {
return nil, fmt.Errorf("policy hash collision: %s and %s have the same hash %v",
existingNames, depl.name, depl.policy.Hash())
entry.SANs, depl.name, depl.policy.Hash())
}
continue
}
policyHashes[depl.policy.Hash()] = depl.DNSNames()
entry := manifest.PolicyEntry{SANs: depl.DNSNames(), WorkloadSecretID: depl.name}
policyHashes[depl.policy.Hash()] = entry
}
return policyHashes, nil
}

func checkPoliciesMatchManifest(policies []deployment, policyHashes map[manifest.HexString][]string) error {
func checkPoliciesMatchManifest(policies []deployment, policyHashes map[manifest.HexString]manifest.PolicyEntry) error {
if len(policies) != len(policyHashes) {
return fmt.Errorf("policy count mismatch: %d policies in deployment, but %d in manifest",
len(policies), len(policyHashes))
Expand Down
3 changes: 2 additions & 1 deletion coordinator/internal/authority/authority.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -107,10 +107,11 @@ func (m *Authority) ValidateCallback(_ context.Context, report *sevsnp.Report,
}

hostData := manifest.NewHexString(report.HostData)
dnsNames, ok := state.manifest.Policies[hostData]
entry, ok := state.manifest.Policies[hostData]
if !ok {
return fmt.Errorf("report data %s not found in manifest", hostData)
}
dnsNames := entry.SANs

peerPubKey, err := x509.ParsePKIXPublicKey(peerPubKeyBytes)
if err != nil {
Expand Down
2 changes: 1 addition & 1 deletion coordinator/internal/authority/authority_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -82,7 +82,7 @@ func newManifest(t *testing.T) (*manifest.Manifest, []byte, [][]byte) {

mnfst, err := manifest.Default(platforms.AKSCloudHypervisorSNP)
require.NoError(t, err)
mnfst.Policies = map[manifest.HexString][]string{policyHashHex: {"test"}}
mnfst.Policies = map[manifest.HexString]manifest.PolicyEntry{policyHashHex: {SANs: []string{"test"}, WorkloadSecretID: "test2"}}
mnfst.WorkloadOwnerKeyDigests = []manifest.HexString{keyDigest}
mnfstBytes, err := json.Marshal(mnfst)
require.NoError(t, err)
Expand Down
36 changes: 18 additions & 18 deletions coordinator/internal/authority/userapi_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -76,9 +76,9 @@ func TestManifestSet(t *testing.T) {
"request without policies": {
req: &userapi.SetManifestRequest{
Manifest: newManifestBytes(func(m *manifest.Manifest) {
m.Policies = map[manifest.HexString][]string{
manifest.HexString("a"): {"a1", "a2"},
manifest.HexString("b"): {"b1", "b2"},
m.Policies = map[manifest.HexString]manifest.PolicyEntry{
manifest.HexString("a"): {SANs: []string{"a1", "a2"}, WorkloadSecretID: "a3"},
manifest.HexString("b"): {SANs: []string{"b1", "b2"}, WorkloadSecretID: "b3"},
}
}),
},
Expand All @@ -87,9 +87,9 @@ func TestManifestSet(t *testing.T) {
"policy not in manifest": {
req: &userapi.SetManifestRequest{
Manifest: newManifestBytes(func(m *manifest.Manifest) {
m.Policies = map[manifest.HexString][]string{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
m.Policies = map[manifest.HexString]manifest.PolicyEntry{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {SANs: []string{"a1", "a2"}, WorkloadSecretID: "a3"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {SANs: []string{"b1", "b2"}, WorkloadSecretID: "b3"},
}
}),
Policies: [][]byte{
Expand All @@ -103,9 +103,9 @@ func TestManifestSet(t *testing.T) {
"valid manifest": {
req: &userapi.SetManifestRequest{
Manifest: newManifestBytes(func(m *manifest.Manifest) {
m.Policies = map[manifest.HexString][]string{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
m.Policies = map[manifest.HexString]manifest.PolicyEntry{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {SANs: []string{"a1", "a2"}, WorkloadSecretID: "a3"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {SANs: []string{"b1", "b2"}, WorkloadSecretID: "b3"},
}
}),
Policies: [][]byte{
Expand Down Expand Up @@ -167,9 +167,9 @@ func TestManifestSet(t *testing.T) {

req := &userapi.SetManifestRequest{
Manifest: newManifestBytes(func(m *manifest.Manifest) {
m.Policies = map[manifest.HexString][]string{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
m.Policies = map[manifest.HexString]manifest.PolicyEntry{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {SANs: []string{"a1", "a2"}, WorkloadSecretID: "a3"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {SANs: []string{"b1", "b2"}, WorkloadSecretID: "b3"},
}
}),
Policies: [][]byte{
Expand Down Expand Up @@ -226,9 +226,9 @@ func TestGetManifests(t *testing.T) {

m, err := manifest.Default(platforms.AKSCloudHypervisorSNP)
require.NoError(err)
m.Policies = map[manifest.HexString][]string{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
m.Policies = map[manifest.HexString]manifest.PolicyEntry{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {SANs: []string{"a1", "a2"}, WorkloadSecretID: "a3"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {SANs: []string{"b1", "b2"}, WorkloadSecretID: "b3"},
}
manifestBytes, err := json.Marshal(m)
require.NoError(err)
Expand Down Expand Up @@ -399,9 +399,9 @@ func TestUserAPIConcurrent(t *testing.T) {

setReq := &userapi.SetManifestRequest{
Manifest: newManifestBytes(func(m *manifest.Manifest) {
m.Policies = map[manifest.HexString][]string{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {"a1", "a2"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {"b1", "b2"},
m.Policies = map[manifest.HexString]manifest.PolicyEntry{
manifest.HexString("ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb"): {SANs: []string{"a1", "a2"}, WorkloadSecretID: "a3"},
manifest.HexString("3e23e8160039594a33894f6564e1b1348bbd7a0088d42c4acb73eeaed59c009d"): {SANs: []string{"b1", "b2"}, WorkloadSecretID: "b3"},
}
}),
Policies: [][]byte{
Expand Down
4 changes: 3 additions & 1 deletion e2e/openssl/openssl_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,9 @@ func TestOpenSSL(t *testing.T) {
require.NoError(json.Unmarshal(manifestBytes, &m))
// Add test domain name to first policy.
for policyHash := range m.Policies {
m.Policies[policyHash] = append(m.Policies[policyHash], fmt.Sprintf("test-%s", deploymentToRestart))
entry := m.Policies[policyHash]
entry.SANs = append(entry.SANs, fmt.Sprintf("test-%s", deploymentToRestart))
m.Policies[policyHash] = entry
break
}
manifestBytes, err = json.Marshal(m)
Expand Down
2 changes: 1 addition & 1 deletion e2e/policy/policy_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ func TestPolicy(t *testing.T) {

// Remove a policy from the manifest.
for policyHash := range m.Policies {
if slices.Contains(m.Policies[policyHash], opensslFrontend) {
if slices.Contains(m.Policies[policyHash].SANs, opensslFrontend) {
delete(m.Policies, policyHash)
}
}
Expand Down
7 changes: 6 additions & 1 deletion internal/manifest/manifest.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,12 +16,17 @@ import (
// Manifest is the Coordinator manifest and contains the reference values of the deployment.
type Manifest struct {
// policyHash/HOSTDATA -> commonName
Policies map[HexString][]string
Policies map[HexString]PolicyEntry
ReferenceValues ReferenceValues
WorkloadOwnerKeyDigests []HexString
SeedshareOwnerPubKeys []HexString
}

type PolicyEntry struct {
SANs []string
WorkloadSecretID string
}

// HexStrings is a slice of HexString.
type HexStrings []HexString

Expand Down
4 changes: 2 additions & 2 deletions internal/manifest/manifest_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -84,14 +84,14 @@ func TestValidate(t *testing.T) {
},
{
m: &Manifest{
Policies: map[HexString][]string{HexString(""): {}},
Policies: map[HexString]PolicyEntry{HexString(""): {}},
ReferenceValues: mnf.ReferenceValues,
},
wantErr: true,
},
{
m: &Manifest{
Policies: map[HexString][]string{HexString(""): {}},
Policies: map[HexString]PolicyEntry{HexString(""): {}},
ReferenceValues: ReferenceValues{
AKS: &AKSReferenceValues{
SNP: mnf.ReferenceValues.AKS.SNP,
Expand Down

0 comments on commit d0f0115

Please sign in to comment.