Move to VerifySecretFields to reject invalid passwords

Service passwords are usually defined in the osp-secret and propagated to
their config. This patch moves from verifyServiceSecret to the new
lib-common VerifySecretFields, that accepts a validator to accept/reject
the password field and set the appropriate errorMsg to the InputReady
Condition.

Signed-off-by: Francesco Pantano <fpantano@redhat.com>

Author: fmount

internal/cloudkitty/common.go

@@ -91,14 +91,14 @@ func EnsureTopology(
 func VerifyServiceSecret(
 	ctx context.Context,
 	secretName types.NamespacedName,
-	expectedFields []string,
+	expectedFields map[string]secret.Validator,
 	reader client.Reader,
 	conditionUpdater conditionUpdater,
 	requeueTimeout time.Duration,
 	envVars *map[string]env.Setter,
 ) (ctrl.Result, error) {
 
-	hash, res, err := secret.VerifySecret(ctx, secretName, expectedFields, reader, requeueTimeout)
+	hash, res, err := secret.VerifySecretFields(ctx, secretName, expectedFields, reader, requeueTimeout)
 	if err != nil {
 		conditionUpdater.Set(condition.FalseCondition(
 			condition.InputReadyCondition,

internal/controller/autoscaling_controller.go

@@ -370,7 +370,18 @@ func (r *AutoscalingReconciler) reconcileNormal(
 	//
 	// check for required OpenStack secret holding passwords for service/admin user and add hash to the vars map
 	//
-	ctrlResult, err := r.getSecret(ctx, helper, instance, instance.Spec.Aodh.Secret, instance.Spec.Aodh.PasswordSelectors.AodhService, &configMapVars)
+	// Associate to PasswordSelectors.Service field a password validator to
+	// ensure pwd invalid detected patterns are rejected.
+	validateFields := map[string]secret.Validator{
+		instance.Spec.Aodh.PasswordSelectors.AodhService: secret.PasswordValidator{},
+	}
+	ctrlResult, err := r.getSecret(
+		ctx,
+		helper,
+		instance,
+		instance.Spec.Aodh.Secret,
+		validateFields,
+		&configMapVars)
 	if err != nil {
 		return ctrlResult, err
 	}
@@ -474,7 +485,19 @@ func (r *AutoscalingReconciler) reconcileNormal(
 		return ctrl.Result{RequeueAfter: time.Duration(10) * time.Second}, nil
 	}
 
-	ctrlResult, err = r.getSecret(ctx, helper, instance, *instance.Status.NotificationsURLSecret, "transport_url", &configMapVars)
+	// transportURLFields are not pure password fields. We do not associate a
+	// password validator and we only verify that the entry exists in the
+	// secret
+	transportValidateFields := map[string]secret.Validator{
+		"transport_url": secret.NoOpValidator{},
+	}
+	ctrlResult, err = r.getSecret(
+		ctx,
+		helper,
+		instance,
+		*instance.Status.NotificationsURLSecret,
+		transportValidateFields,
+		&configMapVars)
 	if err != nil {
 		return ctrlResult, err
 	}
@@ -876,13 +899,18 @@ func (r *AutoscalingReconciler) getAutoscalingHeat(
 }
 
 // getSecret - get the specified secret, and add its hash to envVars
-func (r *AutoscalingReconciler) getSecret(ctx context.Context, h *helper.Helper, instance *telemetryv1.Autoscaling, secretName string, expectedField string, envVars *map[string]env.Setter) (ctrl.Result, error) {
+func (r *AutoscalingReconciler) getSecret(
+	ctx context.Context,
+	h *helper.Helper,
+	instance *telemetryv1.Autoscaling,
+	secretName string,
+	expectedFields map[string]secret.Validator,
+	envVars *map[string]env.Setter,
+) (ctrl.Result, error) {
 	secretHash, result, err := ensureSecret(
 		ctx,
 		types.NamespacedName{Namespace: instance.Namespace, Name: secretName},
-		[]string{
-			expectedField,
-		},
+		expectedFields,
 		h.GetClient(),
 		&instance.Status.Conditions,
 		time.Duration(10)*time.Second,

internal/controller/ceilometer_controller.go

@@ -571,7 +571,18 @@ func (r *CeilometerReconciler) reconcileCeilometer(
 	//
 	// check for required OpenStack secret holding passwords for service/admin user and add hash to the vars map
 	//
-	ctrlResult, err := r.getSecret(ctx, helper, instance, instance.Spec.Secret, instance.Spec.PasswordSelectors.CeilometerService, &configMapVars)
+	// Associate to PasswordSelectors.Service field a password validator to
+	// ensure pwd invalid detected patterns are rejected.
+	validateFields := map[string]secret.Validator{
+		instance.Spec.PasswordSelectors.CeilometerService: secret.PasswordValidator{},
+	}
+	ctrlResult, err := r.getSecret(
+		ctx,
+		helper,
+		instance,
+		instance.Spec.Secret,
+		validateFields,
+		&configMapVars)
 	if err != nil {
 		return ctrlResult, err
 	}
@@ -1208,13 +1219,18 @@ func (r *CeilometerReconciler) reconcileKSM(
 }
 
 // getSecret - get the specified secret, and add its hash to envVars
-func (r *CeilometerReconciler) getSecret(ctx context.Context, h *helper.Helper, instance *telemetryv1.Ceilometer, secretName string, expectedField string, envVars *map[string]env.Setter) (ctrl.Result, error) {
+func (r *CeilometerReconciler) getSecret(
+	ctx context.Context,
+	h *helper.Helper,
+	instance *telemetryv1.Ceilometer,
+	secretName string,
+	expectedFields map[string]secret.Validator,
+	envVars *map[string]env.Setter,
+) (ctrl.Result, error) {
 	secretHash, result, err := ensureSecret(
 		ctx,
 		types.NamespacedName{Namespace: instance.Namespace, Name: secretName},
-		[]string{
-			expectedField,
-		},
+		expectedFields,
 		h.GetClient(),
 		&instance.Status.Conditions,
 		time.Duration(10)*time.Second,

internal/controller/cloudkitty_controller.go

@@ -959,12 +959,15 @@ func (r *CloudKittyReconciler) reconcileNormal(ctx context.Context, instance *te
 	// check for required OpenStack secret holding passwords for service/admin user and add hash to the vars map
 	//
 
+	// Associate to PasswordSelectors.Service field a password validator to
+	// ensure pwd invalid detected patterns are rejected.
+	validateFields := map[string]secret.Validator{
+		instance.Spec.PasswordSelectors.CloudKittyService: secret.PasswordValidator{},
+	}
 	result, err := cloudkitty.VerifyServiceSecret(
 		ctx,
 		types.NamespacedName{Namespace: instance.Namespace, Name: instance.Spec.Secret},
-		[]string{
-			instance.Spec.PasswordSelectors.CloudKittyService,
-		},
+		validateFields,
 		helper.GetClient(),
 		&instance.Status.Conditions,
 		cloudkitty.NormalDuration,

internal/controller/cloudkittyapi_controller.go

@@ -767,12 +767,15 @@ func (r *CloudKittyAPIReconciler) reconcileNormal(ctx context.Context, instance
 	// check for required OpenStack secret holding passwords for service/admin user and add hash to the vars map
 	//
 
+	// Associate to PasswordSelectors.Service field a password validator to
+	// ensure pwd invalid detected patterns are rejected.
+	validateFields := map[string]secret.Validator{
+		instance.Spec.PasswordSelectors.CloudKittyService: secret.PasswordValidator{},
+	}
 	ctrlResult, err := cloudkitty.VerifyServiceSecret(
 		ctx,
 		types.NamespacedName{Namespace: instance.Namespace, Name: instance.Spec.Secret},
-		[]string{
-			instance.Spec.PasswordSelectors.CloudKittyService,
-		},
+		validateFields,
 		helper.GetClient(),
 		&instance.Status.Conditions,
 		cloudkitty.NormalDuration,

internal/controller/cloudkittyproc_controller.go

@@ -454,13 +454,15 @@ func (r *CloudKittyProcReconciler) reconcileNormal(ctx context.Context, instance
 	//
 	// check for required OpenStack secret holding passwords for service/admin user and add hash to the vars map
 	//
-
+	// Associate to PasswordSelectors.Service field a password validator to
+	// ensure pwd invalid detected patterns are rejected.
+	validateFields := map[string]secret.Validator{
+		instance.Spec.PasswordSelectors.CloudKittyService: secret.PasswordValidator{},
+	}
 	ctrlResult, err := cloudkitty.VerifyServiceSecret(
 		ctx,
 		types.NamespacedName{Namespace: instance.Namespace, Name: instance.Spec.Secret},
-		[]string{
-			instance.Spec.PasswordSelectors.CloudKittyService,
-		},
+		validateFields,
 		helper.GetClient(),
 		&instance.Status.Conditions,
 		cloudkitty.NormalDuration,

internal/controller/telemetry_common.go

@@ -109,13 +109,13 @@ func ensureTopology(
 func ensureSecret(
 	ctx context.Context,
 	secretName types.NamespacedName,
-	expectedFields []string,
+	expectedFields map[string]secret.Validator,
 	reader client.Reader,
 	conditionUpdater conditionUpdater,
 	requeueTimeout time.Duration,
 ) (string, ctrl.Result, error) {
 
-	hash, res, err := secret.VerifySecret(ctx, secretName, expectedFields, reader, requeueTimeout)
+	hash, res, err := secret.VerifySecretFields(ctx, secretName, expectedFields, reader, requeueTimeout)
 	if err != nil {
 		conditionUpdater.Set(condition.FalseCondition(
 			condition.InputReadyCondition,