feat: specify allowed symbols in password generation (#9489)

cjc7373 · web-flow · commit 5abbf84809be · 2025-06-27T16:37:58.000+08:00
diff --git a/apis/apps/v1alpha1/clusterdefinition_types.go b/apis/apps/v1alpha1/clusterdefinition_types.go
@@ -257,6 +257,12 @@ type PasswordConfig struct {
 	// +optional
 	NumSymbols int32 `json:"numSymbols,omitempty"`
 
+	// The set of symbols allowed when generating password. If empty, kubeblocks will
+	// use a default symbol set, which is "!@#&*".
+	//
+	// +optional
+	SymbolCharacters string `json:"symbolCharacters,omitempty"`
+
 	// The case of the letters in the password.
 	//
 	// +kubebuilder:default=MixedCases
diff --git a/config/crd/bases/apps.kubeblocks.io_clusterdefinitions.yaml b/config/crd/bases/apps.kubeblocks.io_clusterdefinitions.yaml
@@ -9535,6 +9535,11 @@ spec:
                                 Seed to generate the account's password.
                                 Cannot be updated.
                               type: string
+                            symbolCharacters:
+                              description: |-
+                                The set of symbols allowed when generating password. If empty, kubeblocks will
+                                use a default symbol set, which is "!@#&*".
+                              type: string
                           type: object
                       required:
                       - accounts
diff --git a/config/crd/bases/apps.kubeblocks.io_clusters.yaml b/config/crd/bases/apps.kubeblocks.io_clusters.yaml
@@ -5273,6 +5273,11 @@ spec:
                                   Seed to generate the account's password.
                                   Cannot be updated.
                                 type: string
+                              symbolCharacters:
+                                description: |-
+                                  The set of symbols allowed when generating password. If empty, kubeblocks will
+                                  use a default symbol set, which is "!@#&*".
+                                type: string
                             type: object
                           secretRef:
                             description: |-
@@ -13941,6 +13946,11 @@ spec:
                                       Seed to generate the account's password.
                                       Cannot be updated.
                                     type: string
+                                  symbolCharacters:
+                                    description: |-
+                                      The set of symbols allowed when generating password. If empty, kubeblocks will
+                                      use a default symbol set, which is "!@#&*".
+                                    type: string
                                 type: object
                               secretRef:
                                 description: |-
diff --git a/config/crd/bases/apps.kubeblocks.io_componentdefinitions.yaml b/config/crd/bases/apps.kubeblocks.io_componentdefinitions.yaml
@@ -13942,6 +13942,11 @@ spec:
                             Seed to generate the account's password.
                             Cannot be updated.
                           type: string
+                        symbolCharacters:
+                          description: |-
+                            The set of symbols allowed when generating password. If empty, kubeblocks will
+                            use a default symbol set, which is "!@#&*".
+                          type: string
                       type: object
                     secretRef:
                       description: |-
diff --git a/config/crd/bases/apps.kubeblocks.io_components.yaml b/config/crd/bases/apps.kubeblocks.io_components.yaml
@@ -5433,6 +5433,11 @@ spec:
                             Seed to generate the account's password.
                             Cannot be updated.
                           type: string
+                        symbolCharacters:
+                          description: |-
+                            The set of symbols allowed when generating password. If empty, kubeblocks will
+                            use a default symbol set, which is "!@#&*".
+                          type: string
                       type: object
                     secretRef:
                       description: |-
diff --git a/controllers/apps/transformer_cluster_shared_account.go b/controllers/apps/transformer_cluster_shared_account.go
@@ -158,7 +158,7 @@ func (t *clusterSharedAccountTransformer) buildAccountSecret(transCtx *clusterTr
 
 func (t *clusterSharedAccountTransformer) generatePassword(account appsv1alpha1.ComponentSystemAccount) []byte {
 	config := account.PasswordConfig
-	passwd, _ := common.GeneratePassword((int)(config.Length), (int)(config.NumDigits), (int)(config.NumSymbols), config.Seed)
+	passwd, _ := common.GeneratePassword((int)(config.Length), (int)(config.NumDigits), (int)(config.NumSymbols), config.Seed, config.SymbolCharacters)
 	switch config.LetterCase {
 	case appsv1alpha1.UpperCases:
 		passwd = strings.ToUpper(passwd)
diff --git a/controllers/apps/transformer_component_account.go b/controllers/apps/transformer_component_account.go
@@ -154,7 +154,7 @@ func (t *componentAccountTransformer) buildPassword(ctx *componentTransformConte
 
 func (t *componentAccountTransformer) generatePassword(account appsv1alpha1.SystemAccount) []byte {
 	config := account.PasswordGenerationPolicy
-	passwd, _ := common.GeneratePassword((int)(config.Length), (int)(config.NumDigits), (int)(config.NumSymbols), config.Seed)
+	passwd, _ := common.GeneratePassword((int)(config.Length), (int)(config.NumDigits), (int)(config.NumSymbols), config.Seed, config.SymbolCharacters)
 	switch config.LetterCase {
 	case appsv1alpha1.UpperCases:
 		passwd = strings.ToUpper(passwd)
diff --git a/deploy/helm/crds/apps.kubeblocks.io_clusterdefinitions.yaml b/deploy/helm/crds/apps.kubeblocks.io_clusterdefinitions.yaml
@@ -9535,6 +9535,11 @@ spec:
                                 Seed to generate the account's password.
                                 Cannot be updated.
                               type: string
+                            symbolCharacters:
+                              description: |-
+                                The set of symbols allowed when generating password. If empty, kubeblocks will
+                                use a default symbol set, which is "!@#&*".
+                              type: string
                           type: object
                       required:
                       - accounts
diff --git a/deploy/helm/crds/apps.kubeblocks.io_clusters.yaml b/deploy/helm/crds/apps.kubeblocks.io_clusters.yaml
@@ -5273,6 +5273,11 @@ spec:
                                   Seed to generate the account's password.
                                   Cannot be updated.
                                 type: string
+                              symbolCharacters:
+                                description: |-
+                                  The set of symbols allowed when generating password. If empty, kubeblocks will
+                                  use a default symbol set, which is "!@#&*".
+                                type: string
                             type: object
                           secretRef:
                             description: |-
@@ -13941,6 +13946,11 @@ spec:
                                       Seed to generate the account's password.
                                       Cannot be updated.
                                     type: string
+                                  symbolCharacters:
+                                    description: |-
+                                      The set of symbols allowed when generating password. If empty, kubeblocks will
+                                      use a default symbol set, which is "!@#&*".
+                                    type: string
                                 type: object
                               secretRef:
                                 description: |-
diff --git a/deploy/helm/crds/apps.kubeblocks.io_componentdefinitions.yaml b/deploy/helm/crds/apps.kubeblocks.io_componentdefinitions.yaml
@@ -13942,6 +13942,11 @@ spec:
                             Seed to generate the account's password.
                             Cannot be updated.
                           type: string
+                        symbolCharacters:
+                          description: |-
+                            The set of symbols allowed when generating password. If empty, kubeblocks will
+                            use a default symbol set, which is "!@#&*".
+                          type: string
                       type: object
                     secretRef:
                       description: |-
diff --git a/deploy/helm/crds/apps.kubeblocks.io_components.yaml b/deploy/helm/crds/apps.kubeblocks.io_components.yaml
@@ -5433,6 +5433,11 @@ spec:
                             Seed to generate the account's password.
                             Cannot be updated.
                           type: string
+                        symbolCharacters:
+                          description: |-
+                            The set of symbols allowed when generating password. If empty, kubeblocks will
+                            use a default symbol set, which is "!@#&*".
+                          type: string
                       type: object
                     secretRef:
                       description: |-
diff --git a/docs/developer_docs/api-reference/cluster.md b/docs/developer_docs/api-reference/cluster.md
@@ -16613,6 +16613,19 @@ int32
 </tr>
 <tr>
 <td>
+<code>symbolCharacters</code><br/>
+<em>
+string
+</em>
+</td>
+<td>
+<em>(Optional)</em>
+<p>The set of symbols allowed when generating password. If empty, kubeblocks will
+use a default symbol set, which is &ldquo;!@#&amp;*&rdquo;.</p>
+</td>
+</tr>
+<tr>
+<td>
 <code>letterCase</code><br/>
 <em>
 <a href="#apps.kubeblocks.io/v1alpha1.LetterCase">
diff --git a/pkg/common/password.go b/pkg/common/password.go
@@ -30,8 +30,8 @@ import (
 )
 
 const (
-	// Symbols is the list of symbols.
-	Symbols = "!@#&*"
+	// DefaultSymbols is the list of default symbols to generate password.
+	DefaultSymbols = "!@#&*"
 )
 
 type PasswordReader struct {
@@ -47,16 +47,19 @@ func (r *PasswordReader) Seed(seed int64) {
 }
 
 // GeneratePassword generates a password with the given requirements and seed in lowercase.
-func GeneratePassword(length, numDigits, numSymbols int, seed string) (string, error) {
+func GeneratePassword(length, numDigits, numSymbols int, seed string, symbols string) (string, error) {
 	rand, err := newRngFromSeed(seed)
 	if err != nil {
 		return "", err
 	}
 	passwordReader := &PasswordReader{rand: rand}
+	if symbols == "" {
+		symbols = DefaultSymbols
+	}
 	gen, err := password.NewGenerator(&password.GeneratorInput{
 		LowerLetters: password.LowerLetters,
 		UpperLetters: password.UpperLetters,
-		Symbols:      Symbols,
+		Symbols:      symbols,
 		Digits:       password.Digits,
 		Reader:       passwordReader,
 	})
diff --git a/pkg/common/password_test.go b/pkg/common/password_test.go
@@ -20,6 +20,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 package common
 
 import (
+	"strings"
 	"testing"
 
 	"github.com/sethvargo/go-password/password"
@@ -34,7 +35,7 @@ func testGeneratorGeneratePasswordWithSeed(t *testing.T) {
 	resultSeedFirstTime := ""
 	resultSeedEachTime := ""
 	for i := 0; i < N; i++ {
-		res, err := GeneratePassword(10, 5, 0, seed)
+		res, err := GeneratePassword(10, 5, 0, seed, "")
 		if err != nil {
 			t.Error(err)
 		}
@@ -52,22 +53,42 @@ func testGeneratorGeneratePassword(t *testing.T) {
 	t.Run("exceeds_length", func(t *testing.T) {
 		t.Parallel()
 
-		if _, err := GeneratePassword(0, 1, 0, ""); err != password.ErrExceedsTotalLength {
+		if _, err := GeneratePassword(0, 1, 0, "", ""); err != password.ErrExceedsTotalLength {
 			t.Errorf("expected %q to be %q", err, password.ErrExceedsTotalLength)
 		}
 
-		if _, err := GeneratePassword(0, 0, 1, ""); err != password.ErrExceedsTotalLength {
+		if _, err := GeneratePassword(0, 0, 1, "", ""); err != password.ErrExceedsTotalLength {
 			t.Errorf("expected %q to be %q", err, password.ErrExceedsTotalLength)
 		}
 	})
 
+	t.Run("should respect allowed symbols", func(t *testing.T) {
+		t.Parallel()
+
+		symbols := "!$_#"
+		for i := 0; i < N; i++ {
+			res, err := GeneratePassword(10, 0, 5, "", symbols)
+			if err != nil {
+				t.Error(err)
+			}
+			for _, r := range res {
+				if r >= '0' && r <= '9' || r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' {
+					continue
+				}
+				if !strings.ContainsRune(symbols, r) {
+					t.Errorf("unexpected symbol %q in password %q", r, res)
+				}
+			}
+		}
+	})
+
 	t.Run("should be different when seed is empty", func(t *testing.T) {
 		t.Parallel()
 		resultSeedFirstTime := ""
 		resultSeedEachTime := ""
 		hasDiffPassword := false
 		for i := 0; i < N; i++ {
-			res, err := GeneratePassword(i%(len(password.LowerLetters)+len(password.UpperLetters)), 0, 0, "")
+			res, err := GeneratePassword(i%(len(password.LowerLetters)+len(password.UpperLetters)), 0, 0, "", "")
 			if err != nil {
 				t.Error(err)
 			}
@@ -126,7 +147,7 @@ func TestGeneratorEnsureMixedCase(t *testing.T) {
 
 		// Generate multiple passwords and check they have both upper and lower letters.
 		for i := 0; i < 100; i++ {
-			pwd, err := GeneratePassword(length, numDigits, numSymbols, seed)
+			pwd, err := GeneratePassword(length, numDigits, numSymbols, seed, "")
 			if err != nil {
 				t.Fatalf("unexpected error generating password: %v", err)
 			}
@@ -148,7 +169,7 @@ func TestGeneratorEnsureMixedCase(t *testing.T) {
 
 		var firstPwd string
 		for i := 0; i < 50; i++ {
-			pwd, err := GeneratePassword(length, numDigits, numSymbols, seed)
+			pwd, err := GeneratePassword(length, numDigits, numSymbols, seed, "")
 			if err != nil {
 				t.Fatalf("unexpected error generating password with seed: %v", err)
 			}
diff --git a/pkg/controller/factory/builder.go b/pkg/controller/factory/builder.go
@@ -217,7 +217,7 @@ func randomString(length int) string {
 }
 
 func strongRandomString(length int) string {
-	str, _ := common.GeneratePassword(length, 3, 3, "")
+	str, _ := common.GeneratePassword(length, 3, 3, "", "")
 	return str
 }
 
