Skip to content

feat: Upload DCs secrets #1173

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sambuc wants to merge 3 commits into
base: sambuc/chore/rename-path-variables-for-clarity
Choose a base branch
from
Open

feat: Upload DCs secrets #1173

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7834e93
feat: Upload DCs secrets
sambuc Jun 4, 2026
66fb489
fix: comment wording
sambuc Jul 16, 2026
b192f91
fix: replace node prefix with remote, as this is what is used already
sambuc Jul 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
123 changes: 107 additions & 16 deletions api/v1alpha1/amaltheasession_children.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,16 +4,19 @@ import (
"context"
"crypto/rand"
"encoding/base64"
"encoding/json"
"errors"
"fmt"
"io"
"maps"
"net/url"
"os"
"path"
"sort"
"strings"
"time"

"github.com/SwissDataScienceCenter/amalthea/internal/common"
"github.com/SwissDataScienceCenter/amalthea/internal/controller/config"
"gopkg.in/yaml.v3"
appsv1 "k8s.io/api/apps/v1"
Expand Down Expand Up @@ -642,11 +645,92 @@ func (cr *AmaltheaSession) AdoptedSecrets() v1.SecretList {
// Assuming that the csi-rclone driver from https://github.com/SwissDataScienceCenter/csi-rclone
// is installed, this will generate PVCs for the data sources that have the rclone type.
func (as *AmaltheaSession) DataSources() ([]v1.PersistentVolumeClaim, []v1.Volume, []v1.VolumeMount) {
// TODO: Configure this for remote sessions
if as.Spec.SessionLocation == Remote {
return []v1.PersistentVolumeClaim{}, []v1.Volume{}, []v1.VolumeMount{}
switch as.Spec.SessionLocation {
case Remote:
return as.RemoteSessionDataSources()
case Local:
return as.LocalSessionDataSources()
default:
panic("invalid session location")
}
Comment on lines +648 to +655

@leafty leafty Jul 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should do a little bit of defensive programming here: this method should work even if the CRD is outdated and doesn't have the location field.

See also: #1121, #1120

Suggested change
switch as.Spec.SessionLocation {
case Remote:
return as.RemoteSessionDataSources()
case Local:
return as.LocalSessionDataSources()
default:
panic("invalid session location")
}
if as.Spec.SessionLocation == Remote {
return as.RemoteSessionDataSources()
}
// as.Spec.SessionLocation == Local
return as.LocalSessionDataSources()

}

func (as *AmaltheaSession) RemoteSessionDataSources() ([]v1.PersistentVolumeClaim, []v1.Volume, []v1.VolumeMount) {
pvcs := []v1.PersistentVolumeClaim{}
vols := []v1.Volume{
{
Name: fmt.Sprintf("%s-%s", prefix, as.Name),
VolumeSource: v1.VolumeSource{
Secret: &v1.SecretVolumeSource{

@leafty leafty Jul 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should add Optional: ptr.To(false), no?

SecretName: as.InternalSecretName(),
DefaultMode: ptr.To(int32(256)), // decimal value of 0400 for the access flags (chmod-like)

@leafty leafty Jul 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
DefaultMode: ptr.To(int32(256)), // decimal value of 0400 for the access flags (chmod-like)
DefaultMode: ptr.To(int32(0400)), // chmod: r-- --- ---

},
},
},
}
volMounts := []v1.VolumeMount{
{
Name: fmt.Sprintf("%s-%s", prefix, as.Name),

@leafty leafty Jul 17, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You will have two dashes

Suggested change
Name: fmt.Sprintf("%s-%s", prefix, as.Name),
Name: fmt.Sprintf("%s%s", prefix, as.Name),

ReadOnly: true,
MountPath: common.UserSecretProxyFolder,
},
}

ids := 0
for _, pv := range as.Spec.DataSources {
if pv.SecretRef.isAdopted() {
volName := fmt.Sprintf("%s%s-ds-%d", prefix, as.Name, ids)
vols = append(
vols,
v1.Volume{
Name: volName,
VolumeSource: v1.VolumeSource{
Secret: &v1.SecretVolumeSource{
SecretName: pv.SecretRef.Name,
DefaultMode: ptr.To(int32(256)), // decimal value of 0400 for the access flags (chmod-like)
},
},
},
)
volMounts = append(
volMounts,
v1.VolumeMount{
Name: volName,
ReadOnly: true,
MountPath: path.Join(common.DataConnectorProxyFolder, volName),
},
)
// If there is a user secret linked to the data connector, mount it as it contains required credentials
userSecretName := fmt.Sprintf("%s-secrets", pv.SecretRef.Name)
volNameSecret := fmt.Sprintf("%s-secrets", volName)
vols = append(
vols,
v1.Volume{
Name: volNameSecret,
VolumeSource: v1.VolumeSource{
Secret: &v1.SecretVolumeSource{
SecretName: userSecretName,
Optional: ptr.To(true),
DefaultMode: ptr.To(int32(256)), // decimal value of 0400 for the access flags (chmod-like)
},
},
},
)
volMounts = append(
volMounts,
v1.VolumeMount{
Name: volNameSecret,
ReadOnly: true,
MountPath: path.Join(common.DataConnectorSecretProxyFolder, volName),
},
)
ids += 1
}
}
return pvcs, vols, volMounts
}

func (as *AmaltheaSession) LocalSessionDataSources() ([]v1.PersistentVolumeClaim, []v1.Volume, []v1.VolumeMount) {
pvcs := []v1.PersistentVolumeClaim{}
vols := []v1.Volume{}
volMounts := []v1.VolumeMount{}
Expand Down Expand Up @@ -759,14 +843,30 @@ func (as *AmaltheaSession) Secret() v1.Secret {
},
StringData: map[string]string{},
}
// Secret used to secure the tunnel for remote sessions

if as.Spec.SessionLocation == Remote {
// Secret used to secure the tunnel for remote sessions
tunnelSecret, err := makeTunnelSecret(16)
if err != nil {
panic(err)
}

secret.StringData["WSTUNNEL_SECRET"] = tunnelSecret
secret.StringData["wstunnel_secret"] = tunnelSecret

// Add the Datasources Specifications so that the proxy container can write them out to the HPC cluster
ids := 0
for _, pv := range as.Spec.DataSources {
if pv.SecretRef.isAdopted() {

var content []byte
content, err = json.Marshal(pv)
if err != nil {
panic(err)
}

secret.StringData[fmt.Sprintf("%s%s-ds-%d", prefix, as.Name, ids)] = string(content)
ids += 1
}
}
}

// Add the 'oidc' configuration if requested
Expand Down Expand Up @@ -988,15 +1088,6 @@ func (cr *AmaltheaSession) sessionContainerRemote(volumeMounts []v1.VolumeMount)
Name: "RSC_SERVER_PORT",
Value: fmt.Sprintf("%d", RemoteSessionControllerPort),
},
v1.EnvVar{
Name: "RSC_WSTUNNEL_SECRET",
ValueFrom: ptr.To(v1.EnvVarSource{
SecretKeyRef: ptr.To(v1.SecretKeySelector{
LocalObjectReference: v1.LocalObjectReference{Name: cr.InternalSecretName()},
Key: "WSTUNNEL_SECRET",
}),
}),
},
)

if session.RemoteSecretRef != nil {
Expand Down Expand Up @@ -1056,7 +1147,7 @@ func (cr *AmaltheaSession) tunnelContainer() v1.Container {
ValueFrom: ptr.To(v1.EnvVarSource{
SecretKeyRef: ptr.To(v1.SecretKeySelector{
LocalObjectReference: v1.LocalObjectReference{Name: cr.InternalSecretName()},
Key: "WSTUNNEL_SECRET",
Key: "wstunnel_secret",
}),
}),
},
Expand Down
2 changes: 2 additions & 0 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,7 @@ tool fybrik.io/crdoc
require (
github.com/distribution/reference v0.6.0
github.com/elazarl/goproxy v1.7.2
github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611
github.com/getkin/kin-openapi v0.132.0
github.com/getsentry/sentry-go v0.45.1
github.com/go-git/go-git/v5 v5.16.0
Expand All @@ -27,6 +28,7 @@ require (
github.com/spf13/viper v1.20.1
github.com/stretchr/testify v1.10.0
golang.org/x/sys v0.32.0
gopkg.in/ini.v1 v1.67.0
gopkg.in/yaml.v3 v3.0.1
k8s.io/api v0.33.0
k8s.io/apimachinery v0.33.0
Expand Down
4 changes: 4 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,8 @@ github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjT
github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611 h1:JwYtKJ/DVEoIA5dH45OEU7uoryZY/gjd/BQiwwAOImM=
github.com/fernet/fernet-go v0.0.0-20240119011108-303da6aec611/go.mod h1:zHMNeYgqrTpKyjawjitDg0Osd1P/FmeA0SZLYK3RfLQ=
github.com/frankban/quicktest v1.14.6 h1:7Xjx+VpznH+oBnejlPUj8oUpdxnVs4f8XU8WnHkI4W8=
github.com/frankban/quicktest v1.14.6/go.mod h1:4ptaffx2x8+WTWXmUCuVU6aPUX1/Mz7zb5vbUoiM6w0=
github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMoQvtojpjFo=
Expand Down Expand Up @@ -440,6 +442,8 @@ gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWM
gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
gopkg.in/ini.v1 v1.67.0 h1:Dgnx+6+nfE+IfzjUEISNeydPJh9AXNNsWbGP9KzCsOA=
gopkg.in/ini.v1 v1.67.0/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7/go.mod h1:dt/ZhP58zS4L8KSrWDmTeBkI65Dw0HsyUHuEVlX15mw=
gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
Expand Down
Loading
Loading