Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CRE-44] Add restricted config; validate WASM config #1001

Merged
merged 5 commits into from
Jan 17, 2025
Merged

[CRE-44] Add restricted config; validate WASM config #1001

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
fd8ecc1
[chore] Add README documentation
cedric-cordenier Jan 16, 2025
59f9926
[CRE-44] Add restricted_config and restricted_keys to capability regi…
cedric-cordenier Jan 15, 2025
f97373e
Use uint64 to describe min/max memory
cedric-cordenier Jan 15, 2025
7f5ea2c
Merge branch 'main' into CRE-44-restricted-keys
cedric-cordenier Jan 16, 2025
2df1bca
Merge branch 'main' into CRE-44-restricted-keys
cedric-cordenier Jan 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion pkg/capabilities/capabilities.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -392,7 +392,13 @@ func (c *RemoteExecutableConfig) ApplyDefaults() {
}

type CapabilityConfiguration struct {
DefaultConfig *values.Map
DefaultConfig *values.Map
// RestrictedKeys is a list of keys that can't be provided by users in their
// configuration; we'll remove these fields before passing them to the capability.
RestrictedKeys []string
// RestrictedConfig is configuration that can only be set by us; this
// takes precedence over any user-provided config.
RestrictedConfig *values.Map
RemoteTriggerConfig *RemoteTriggerConfig
RemoteTargetConfig *RemoteTargetConfig
RemoteExecutableConfig *RemoteExecutableConfig
Expand Down
51 changes: 37 additions & 14 deletions pkg/capabilities/pb/registry.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

3 changes: 3 additions & 0 deletions pkg/capabilities/pb/registry.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,5 +40,8 @@ message CapabilityConfig {
RemoteTargetConfig remote_target_config = 3;
RemoteExecutableConfig remote_executable_config = 4;
}

values.Map restricted_config = 5;
repeated string restricted_keys = 6;
}

12 changes: 6 additions & 6 deletions pkg/workflows/wasm/host/module.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ func (r *store) delete(id string) {
var (
defaultTickInterval = 100 * time.Millisecond
defaultTimeout = 10 * time.Second
defaultMinMemoryMBs = 128
defaultMinMemoryMBs = uint64(128)
DefaultInitialFuel = uint64(100_000_000)
defaultMaxFetchRequests = 5
defaultMaxCompressedBinarySize = 10 * 1024 * 1024 // 10 MB
Expand All @@ -85,8 +85,8 @@ type DeterminismConfig struct {
type ModuleConfig struct {
TickInterval time.Duration
Timeout *time.Duration
MaxMemoryMBs int64
MinMemoryMBs int64
MaxMemoryMBs uint64
MinMemoryMBs uint64
InitialFuel uint64
Logger logger.Logger
IsUncompressed bool
Expand Down Expand Up @@ -165,7 +165,7 @@ func NewModule(modCfg *ModuleConfig, binary []byte, opts ...func(*ModuleConfig))
}

if modCfg.MinMemoryMBs == 0 {
modCfg.MinMemoryMBs = int64(defaultMinMemoryMBs)
modCfg.MinMemoryMBs = defaultMinMemoryMBs
}

if modCfg.MaxCompressedBinarySize == 0 {
Expand All @@ -176,7 +176,7 @@ func NewModule(modCfg *ModuleConfig, binary []byte, opts ...func(*ModuleConfig))
// We do this because Go requires a minimum of 16 megabytes to run,
// and local testing has shown that with less than the min, some
// binaries may error sporadically.
modCfg.MaxMemoryMBs = int64(math.Max(float64(modCfg.MinMemoryMBs), float64(modCfg.MaxMemoryMBs)))
modCfg.MaxMemoryMBs = uint64(math.Max(float64(modCfg.MinMemoryMBs), float64(modCfg.MaxMemoryMBs)))

cfg := wasmtime.NewConfig()
cfg.SetEpochInterruption(true)
Expand Down Expand Up @@ -343,7 +343,7 @@ func (m *Module) Run(ctx context.Context, request *wasmpb.Request) (*wasmpb.Resp

// Limit memory to max memory megabytes per instance.
store.Limiter(
m.cfg.MaxMemoryMBs*int64(math.Pow(10, 6)),
int64(m.cfg.MaxMemoryMBs)*int64(math.Pow(10, 6)),
-1, // tableElements, -1 == default
1, // instances
1, // tables
Expand Down
Loading