Skip to content

Commit 47c0e88

Browse files
authored
Security improvements (#1328)
1 parent 3d5734f commit 47c0e88

6 files changed

Lines changed: 146 additions & 25 deletions

File tree

CHANGELOG.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
### Changed
99
- Nexus storage change ([#1341](https://github.com/opendevstack/ods-core/issues/1341))
1010

11+
- Security improvements ([#1328](https://github.com/opendevstack/ods-core/pull/1328))
1112

1213
### Fixed
1314

create-projects/Jenkinsfile

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,6 @@ podTemplate(
8080
sh(
8181
script: """./create-projects/create-projects.sh --verbose \
8282
--project=${projectId} \
83-
--admins=${projectAdmins} \
8483
--groups=${projectGroups}""",
8584
label: 'Create OpenShift projects'
8685
)

create-projects/create-projects.sh

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -84,14 +84,16 @@ fi
8484

8585
if [ -n "${PROJECT_GROUPS}" ]; then
8686
echo "Seeding special permission groups (${PROJECT_GROUPS}) ..."
87+
88+
cd_usergroup_role="edit-atlassian-team"
89+
usergroup_role="edit"
90+
admingroup_role="admin"
91+
readonlygroup_role="view"
92+
8793
for group in ${PROJECT_GROUPS//,/ }; do
8894
groupName=$(echo "${group}" | cut -d "=" -f1)
8995
groupValue=$(echo "${group}" | cut -d "=" -f2)
9096

91-
usergroup_role="edit"
92-
admingroup_role="admin"
93-
readonlygroup_role="view"
94-
9597
if [ "${groupValue}" == "" ]; then
9698
continue
9799
fi
@@ -101,7 +103,7 @@ if [ -n "${PROJECT_GROUPS}" ]; then
101103
if [[ "${groupName}" == *USERGROUP* ]]; then
102104
oc policy add-role-to-group "${usergroup_role}" "${groupValue}" -n "${PROJECT_ID}-dev"
103105
oc policy add-role-to-group "${usergroup_role}" "${groupValue}" -n "${PROJECT_ID}-test"
104-
oc policy add-role-to-group "${usergroup_role}" "${groupValue}" -n "${PROJECT_ID}-cd"
106+
oc policy add-role-to-group "${cd_usergroup_role}" "${groupValue}" -n "${PROJECT_ID}-cd"
105107
elif [[ "${groupName}" == *ADMINGROUP* ]]; then
106108
oc policy add-role-to-group "${admingroup_role}" "${groupValue}" -n "${PROJECT_ID}-dev"
107109
oc policy add-role-to-group "${admingroup_role}" "${groupValue}" -n "${PROJECT_ID}-test"

create-projects/tests/run.sh

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -52,20 +52,16 @@ oc mock --receive 'policy add-role-to-group view system:authenticated -n foo-cd'
5252
oc mock --verify
5353

5454
echo ""
55-
echo "=== create-projects: With admins but no groups ==="
55+
echo "=== create-projects: Without admins and no groups ==="
5656

5757
oc mock --receive='new-project' --times 3
5858

59-
# Expect admins
60-
oc mock --receive 'policy add-role-to-user admin foo.bar@example.com -n foo-cd' --times 1
61-
oc mock --receive 'policy add-role-to-user admin baz.qux@example.com -n foo-cd' --times 1
62-
6359
# Expect default view/edit setup
6460
oc mock --receive 'policy add-role-to-group view system:authenticated -n foo-dev' --times 1
6561
oc mock --receive 'policy add-role-to-group view system:authenticated -n foo-test' --times 1
6662
oc mock --receive 'policy add-role-to-group view system:authenticated -n foo-cd' --times 1
6763

68-
../create-projects.sh --project foo --admins foo.bar@example.com,baz.qux@example.com --groups=
64+
../create-projects.sh --project foo --groups=
6965

7066
oc mock --verify
7167

@@ -81,7 +77,7 @@ oc mock --receive 'policy add-role-to-group view baz -n foo-cd' --times 1
8177

8278
oc mock --receive 'policy add-role-to-group edit foo -n foo-dev' --times 1
8379
oc mock --receive 'policy add-role-to-group edit foo -n foo-test' --times 1
84-
oc mock --receive 'policy add-role-to-group edit foo -n foo-cd' --times 1
80+
oc mock --receive 'policy add-role-to-group edit-atlassian-team foo -n foo-cd' --times 1
8581

8682
oc mock --receive 'policy add-role-to-group admin bar -n foo-dev' --times 1
8783
oc mock --receive 'policy add-role-to-group admin bar -n foo-test' --times 1

jenkins/ocp-config/deploy/jenkins-master.yml

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -267,18 +267,6 @@ objects:
267267
name: '${JENKINS_SERVICE_NAME}'
268268
labels:
269269
template: ods-jenkins-template
270-
- apiVersion: authorization.openshift.io/v1
271-
kind: RoleBinding
272-
metadata:
273-
name: '${JENKINS_SERVICE_NAME}_edit'
274-
labels:
275-
template: ods-jenkins-template
276-
roleRef:
277-
name: edit
278-
subjects:
279-
- kind: ServiceAccount
280-
name: '${JENKINS_SERVICE_NAME}'
281-
namespace: '${TAILOR_NAMESPACE}'
282270
- apiVersion: v1
283271
kind: Service
284272
metadata:

ods-setup/setup-ods-project.sh

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,141 @@ if ! oc adm policy add-cluster-role-to-user self-provisioner system:serviceaccou
7878
exit 1
7979
fi
8080

81+
# Create a new role 'edit-atlassian-team' without secret-related resources access
82+
if ! oc get clusterrole edit-atlassian-team > /dev/null 2>&1; then
83+
echo "You might not have enough rights to create the new role 'edit-atlassian-team'."
84+
echo "This script needs to be run by a cluster admin."
85+
86+
# Create a temporary file
87+
TEMP_FILE=$(mktemp 2>/dev/null || echo "/tmp/tempfile_$$")
88+
89+
# Get the edit role YAML and rename it
90+
oc get clusterrole edit -o yaml | sed 's/name: edit/name: edit-atlassian-team/' > $TEMP_FILE
91+
92+
# Process the YAML to remove secret-related resources, empty sections, and metadata fields
93+
PROCESSED_FILE=$(mktemp 2>/dev/null || echo "/tmp/tempfile_$$")
94+
95+
awk '
96+
BEGIN {
97+
skip_current_group = 0;
98+
inside_api_group = 0;
99+
api_group_buffer = "";
100+
skip_section = 0;
101+
in_metadata = 0;
102+
contains_secret = 0;
103+
}
104+
105+
# Skip metadata fields and sections
106+
/creationTimestamp:/ || /resourceVersion:/ || /uid:/ {
107+
next;
108+
}
109+
110+
# Detect start of aggregationRule section and skip it
111+
/^aggregationRule:/ {
112+
skip_section = 1;
113+
next;
114+
}
115+
116+
# Detect end of aggregationRule section (when we see apiVersion)
117+
/^apiVersion:/ {
118+
skip_section = 0;
119+
print $0;
120+
next;
121+
}
122+
123+
# Track if we are in metadata section
124+
/^metadata:/ {
125+
in_metadata = 1;
126+
print $0;
127+
next;
128+
}
129+
130+
# Detect start of annotations or labels in metadata and skip them
131+
/^ annotations:/ || /^ labels:/ {
132+
if (in_metadata) {
133+
skip_section = 1;
134+
next;
135+
}
136+
}
137+
138+
# Detect when we leave annotations or labels section (any line with single indent level)
139+
/^ [a-zA-Z]/ {
140+
if (skip_section && in_metadata && $0 !~ /^ annotations:/ && $0 !~ /^ labels:/) {
141+
skip_section = 0;
142+
}
143+
}
144+
145+
# Detect end of metadata section
146+
/^[a-zA-Z]/ && in_metadata && $0 !~ /^metadata:/ {
147+
in_metadata = 0;
148+
}
149+
150+
# Skip lines while in a section we want to skip
151+
{
152+
if (skip_section) {
153+
next;
154+
}
155+
}
156+
157+
# Detect API Groups line
158+
/^- apiGroups:/ {
159+
# If we were previously in an API group, print it if it wasnt being skipped and has no secrets
160+
if (inside_api_group && !skip_current_group && !contains_secret && api_group_buffer != "") {
161+
print api_group_buffer;
162+
}
163+
164+
# Reset variables for new group
165+
inside_api_group = 1;
166+
api_group_buffer = $0;
167+
skip_current_group = 0;
168+
contains_secret = 0;
169+
170+
# Check if this apiGroup itself contains "secret"
171+
if ($0 ~ /secret/ || $0 ~ /external-secrets\.io/) {
172+
skip_current_group = 1;
173+
}
174+
next;
175+
}
176+
177+
# Look for resources section that might contain secrets
178+
/^ resources:/ {
179+
api_group_buffer = api_group_buffer "\n" $0;
180+
next;
181+
}
182+
183+
# Check for secret in resource names
184+
/^ - / && inside_api_group {
185+
# If this resource contains "secret", mark the group for skipping
186+
if ($0 ~ /secret/) {
187+
contains_secret = 1;
188+
}
189+
api_group_buffer = api_group_buffer "\n" $0;
190+
next;
191+
}
192+
193+
# Process all other lines
194+
{
195+
if (inside_api_group) {
196+
# Add to buffer
197+
api_group_buffer = api_group_buffer "\n" $0;
198+
} else {
199+
# Not in an API group, print directly
200+
print $0;
201+
}
202+
}
203+
204+
END {
205+
# Print the last API group if it wasnt being skipped and has no secrets
206+
if (inside_api_group && !skip_current_group && !contains_secret && api_group_buffer != "") {
207+
print api_group_buffer;
208+
}
209+
}' $TEMP_FILE > $PROCESSED_FILE
210+
211+
# Create the role and clean up
212+
oc create -f $PROCESSED_FILE
213+
rm $TEMP_FILE $PROCESSED_FILE
214+
fi
215+
81216
# Create cd-user secret
82217
cd ${SCRIPT_DIR}/ocp-config/cd-user
83218
${TAILOR} -n ${NAMESPACE} apply ${NON_INTERACTIVE} ${REVEAL_SECRETS}

0 commit comments

Comments
 (0)