Member Management Part2

backend/lib/routes/members.js

@@ -8,6 +8,7 @@
 
 const express = require('express')
 const { members } = require('../services')
+const { UnprocessableEntity } = require('http-errors')
 
 const router = module.exports = express.Router({
   mergeParams: true
@@ -56,6 +57,24 @@ router.route('/:name')
       next(err)
     }
   })
+  .post(async (req, res, next) => {
+    try {
+      const user = req.user
+      const { namespace, name } = req.params
+      const { method } = req.body
+
+      switch (method) {
+        case 'rotateSecret':
+          await members.rotateSecret({ user, namespace, name })
+          res.end()
+          break
+        default:
+          throw new UnprocessableEntity(`${method} not allowed for members`)
+      }
+    } catch (err) {
+      next(err)
+    }
+  })
   .delete(async (req, res, next) => {
     try {
       const user = req.user

backend/lib/routes/terminals.js

@@ -9,6 +9,7 @@
 const express = require('express')
 const { terminals, authorization } = require('../services')
 const _ = require('lodash')
+const { UnprocessableEntity } = require('http-errors')
 
 const router = module.exports = express.Router({
   mergeParams: true
@@ -37,7 +38,7 @@ router.route('/')
       const { method, params: body } = req.body
 
       if (!_.includes(['create', 'fetch', 'list', 'config', 'remove', 'heartbeat', 'listProjectTerminalShortcuts'], method)) {
-        throw new Error(`${method} not allowed for terminals`)
+        throw new UnprocessableEntity(`${method} not allowed for terminals`)
       }
       res.send(await terminals[method]({ user, body }))
     } catch (err) {

backend/lib/services/members/Member.js

@@ -8,7 +8,7 @@
 
 const { pick } = require('lodash')
 
-const PROPERTY_NAMES = ['createdBy', 'creationTimestamp', 'description', 'kubeconfig']
+const PROPERTY_NAMES = ['createdBy', 'creationTimestamp', 'description', 'kubeconfig', 'orphaned']
 
 class Member {
   constructor (username, { roles, extensions } = {}) {

backend/lib/services/members/MemberManager.js

@@ -7,7 +7,7 @@
 'use strict'
 
 const _ = require('lodash')
-const { NotFound, Conflict, UnprocessableEntity } = require('http-errors')
+const { NotFound, Conflict, UnprocessableEntity, isHttpError } = require('http-errors')
 const { dumpKubeconfig } = require('@gardener-dashboard/kube-config')
 
 const config = require('../../config')
@@ -23,7 +23,7 @@ class MemberManager {
     this.userId = userId
     this.namespace = project.spec.namespace
     this.projectName = project.metadata.name
-    this.subjectList = new SubjectList(project.spec.members, serviceAccounts)
+    this.subjectList = new SubjectList(project, serviceAccounts)
   }
 
   list () {
@@ -97,6 +97,19 @@ class MemberManager {
     return this.subjectList.members
   }
 
+  async rotateServiceAccountSecret (id) {
+    const item = this.subjectList.get(id)
+    if (!item) {
+      return
+    }
+
+    if (item.kind !== 'ServiceAccount') {
+      throw new UnprocessableEntity('Member is not a ServiceAccount')
+    }
+
+    await this.deleteServiceAccountSecret(item)
+  }
+
   setItemRoles (item, roles) {
     roles = _.compact(roles)
     if (!roles.length && item.kind !== 'ServiceAccount') {
@@ -114,7 +127,7 @@ class MemberManager {
   async createServiceAccount (item, { createdBy, description }) {
     const { namespace, name } = Member.parseUsername(item.id)
     if (namespace !== this.namespace) {
-      return
+      return // foreign service account => early exit, nothing to create
     }
 
     const serviceAccount = await this.client.core.serviceaccounts.create(namespace, {
@@ -144,7 +157,7 @@ class MemberManager {
   async updateServiceAccount (item, { description }) {
     const { namespace, name } = Member.parseUsername(item.id)
     if (namespace !== this.namespace) {
-      return
+      throw new UnprocessableEntity('It is not possible to modify ServiceAccount from another namespace')
     }
 
     const isDirty = item.extend({ description })
@@ -162,13 +175,38 @@ class MemberManager {
   async deleteServiceAccount (item) {
     const { namespace, name } = Member.parseUsername(item.id)
     if (namespace !== this.namespace) {
-      return
+      return // foreign service account => early exit, nothing to delete
+    }
+    try {
+      await this.client.core.serviceaccounts.delete(namespace, name)
+    } catch (err) {
+      if (!isHttpError(err) || err.statusCode !== 404) {
+        throw err
+      }
     }
-
-    await this.client.core.serviceaccounts.delete(namespace, name)
     this.subjectList.delete(item.id)
   }
 
+  async deleteServiceAccountSecret (item) {
+    const { namespace } = Member.parseUsername(item.id)
+    if (namespace !== this.namespace) {
+      throw new UnprocessableEntity('It is not possible to modify a ServiceAccount from another namespace')
+    }
+
+    const name = _
+      .chain(item)
+      .get('extensions.secrets', [])
+      .tap(secrets => {
+        if (secrets.length > 1) {
+          throw new UnprocessableEntity(`ServiceAccount ${namespace} has more than one secret`)
+        }
+      })
+      .head()
+      .get('name')
+      .value()
+    await this.client.core.secrets.delete(namespace, name)
+  }
+
   async getKubeconfig (item) {
     const { namespace, name } = Member.parseUsername(item.id)
     const secretName = _

backend/lib/services/members/SubjectList.js

@@ -11,7 +11,13 @@ const _ = require('lodash')
 const SubjectListItem = require('./SubjectListItem')
 
 class SubjectList {
-  constructor (subjects, serviceAccounts) {
+  constructor (project, serviceAccounts) {
+    const {
+      spec: {
+        namespace,
+        members: subjects
+      }
+    } = project
     const createServiceAccountItem = ({ metadata, secrets }) => {
       const { namespace, name, annotations = {}, creationTimestamp } = metadata
       const createdByLegacy = annotations['garden.sapcloud.io/createdBy']
@@ -42,9 +48,15 @@ class SubjectList {
 
     const extendItem = item => {
       const id = item.id
-      if (serviceAccountItems[id]) {
-        item.extend(serviceAccountItems[id].extensions)
-        delete serviceAccountItems[id]
+      if (_.startsWith(id, `system:serviceaccount:${namespace}:`)) {
+        const extensions = {}
+        if (serviceAccountItems[id]) {
+          _.assign(extensions, serviceAccountItems[id].extensions)
+          delete serviceAccountItems[id]
+        } else {
+          _.set(extensions, 'orphaned', true)
+        }
+        item.extend(extensions)
       }
     }
 

backend/lib/services/members/index.js

@@ -32,3 +32,8 @@ exports.remove = async function ({ user, namespace, name }) {
   const memberManager = await MemberManager.create(user, namespace)
   return memberManager.delete(name)
 }
+
+exports.rotateSecret = async function ({ user, namespace, name }) {
+  const memberManager = await MemberManager.create(user, namespace)
+  await memberManager.rotateServiceAccountSecret(name)
+}

backend/test/acceptance/__snapshots__/api.members.spec.js.snap

@@ -1290,6 +1290,38 @@ Array [
 ]
 `;
 
+exports[`api members should rotate a service account secret 1`] = `
+Array [
+  Array [
+    Object {
+      ":authority": "kubernetes:6443",
+      ":method": "get",
+      ":path": "/apis/core.gardener.cloud/v1beta1/projects/foo",
+      ":scheme": "https",
+      "authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImJhckBleGFtcGxlLm9yZyIsImlhdCI6MTU3NzgzNjgwMCwiYXVkIjpbImdhcmRlbmVyIl0sImV4cCI6MzE1NTcxNjgwMCwianRpIjoianRpIn0.7WKy0sNVkJzIqh3QJIF1zk3QjzwFe_zMTv8PmnOCsxg",
+    },
+  ],
+  Array [
+    Object {
+      ":authority": "kubernetes:6443",
+      ":method": "get",
+      ":path": "/api/v1/namespaces/garden-foo/serviceaccounts",
+      ":scheme": "https",
+      "authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImJhckBleGFtcGxlLm9yZyIsImlhdCI6MTU3NzgzNjgwMCwiYXVkIjpbImdhcmRlbmVyIl0sImV4cCI6MzE1NTcxNjgwMCwianRpIjoianRpIn0.7WKy0sNVkJzIqh3QJIF1zk3QjzwFe_zMTv8PmnOCsxg",
+    },
+  ],
+  Array [
+    Object {
+      ":authority": "kubernetes:6443",
+      ":method": "delete",
+      ":path": "/api/v1/namespaces/garden-foo/secrets/robot-token-726f6",
+      ":scheme": "https",
+      "authorization": "Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6ImJhckBleGFtcGxlLm9yZyIsImlhdCI6MTU3NzgzNjgwMCwiYXVkIjpbImdhcmRlbmVyIl0sImV4cCI6MzE1NTcxNjgwMCwianRpIjoianRpIn0.7WKy0sNVkJzIqh3QJIF1zk3QjzwFe_zMTv8PmnOCsxg",
+    },
+  ],
+]
+`;
+
 exports[`api members should update roles of a project member 1`] = `
 Array [
   Array [

backend/test/acceptance/api.members.spec.js

@@ -393,5 +393,24 @@ describe('api', function () {
 
       expect(res.body).toMatchSnapshot()
     })
+
+    it('should rotate a service account secret', async function () {
+      const name = 'system:serviceaccount:garden-foo:robot'
+
+      mockRequest.mockImplementationOnce(fixtures.projects.mocks.get())
+      mockRequest.mockImplementationOnce(fixtures.serviceaccounts.mocks.list())
+      mockRequest.mockImplementationOnce(fixtures.secrets.mocks.delete())
+
+      await agent
+        .post(`/api/namespaces/${namespace}/members/${name}`)
+        .set('cookie', await user.cookie)
+        .send({
+          method: 'rotateSecret'
+        })
+        .expect(200)
+
+      expect(mockRequest).toBeCalledTimes(3)
+      expect(mockRequest.mock.calls).toMatchSnapshot()
+    })
   })
 })