Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Actions] There is no possibility to validate action connector secrets and config together. #112459

Closed
YulNaumenko opened this issue Sep 16, 2021 · 1 comment · Fixed by #116079
Assignees
Labels
estimate:medium Medium Estimated Level of Effort Feature:Actions/Framework Issues related to the Actions Framework resilience Issues related to Platform resilience in terms of scale, performance & backwards compatibility Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)

Comments

@YulNaumenko
Copy link
Contributor

On the Alerting framework level we can validate action connector secrets and config properties only separately.
This will lead to the complexity to validate some secrets params which depends on the config params. For example email connector:
if config.hasAuth: true
we should validate secrets.username !== null && secrets.password !== null
We have this validation only on the client side, but it is still possible to create email connector with hasAuth = true, but with no username/password.
We need to provide API ability to validate actions config and secrets together.

@YulNaumenko YulNaumenko added Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams) Feature:Actions/Framework Issues related to the Actions Framework labels Sep 16, 2021
@gmmorris gmmorris added estimate:small Small Estimated Level of Effort estimate:medium Medium Estimated Level of Effort resilience Issues related to Platform resilience in terms of scale, performance & backwards compatibility and removed estimate:small Small Estimated Level of Effort labels Sep 22, 2021
@pmuellr
Copy link
Member

pmuellr commented Sep 22, 2021

My initial thought on this, is to add a new optional validation function on the rule type, which takes secrets AND config, and is run if both secrets and config are themselves validated. We'd then add this optional validation function to the connectors that need it.

Aside: I was wondering if connector params come into play here, but I don't think so, since they're only available when the connector is executed, and the executor is passed all of config, secrets, and params - additional validation of the params against config/secrets can be done in the executor.

Another potential way of doing this is via "hooks" on our APIs, as described in allow connector types to provide feedback during create/update/delete calls #106724. The idea is the create and update hooks could do the additional validation when they are called, and then return an indication of the validation failure to prevent the create/update from occuring.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
estimate:medium Medium Estimated Level of Effort Feature:Actions/Framework Issues related to the Actions Framework resilience Issues related to Platform resilience in terms of scale, performance & backwards compatibility Team:ResponseOps Label for the ResponseOps team (formerly the Cases and Alerting teams)
Projects
None yet
4 participants