feat: Add relaxed file loading

Author: Techassi

rust/operator-binary/src/backend/kerberos_keytab.rs

@@ -196,6 +196,7 @@ cluster.local = {realm_name}
 .cluster.local = {realm_name}
 "#
         );
+
         let profile_file_path = tmp.path().join("krb5.conf");
         {
             let mut profile_file = File::create(&profile_file_path)
@@ -216,6 +217,7 @@ cluster.local = {realm_name}
                 .await
                 .context(WriteAdminKeytabSnafu)?;
         }
+
         let keytab_file_path = tmp.path().join("pod-keytab");
         let mut pod_principals: Vec<KerberosPrincipal> = Vec::new();
         for service_name in &selector.kerberos_service_names {
@@ -300,7 +302,7 @@ cluster.local = {realm_name}
             .context(ReadProvisionedKeytabSnafu)?;
         Ok(SecretContents::new(SecretData::WellKnown(
             WellKnownSecretData::Kerberos(well_known::Kerberos {
-                keytab: keytab_data,
+                keytab: Some(keytab_data),
                 krb5_conf: profile.into_bytes(),
             }),
         )))

rust/operator-binary/src/csi_server/node.rs

@@ -220,7 +220,7 @@ impl SecretProvisionerNode {
         selector: SecretVolumeSelector,
     ) -> Result<(), PublishError> {
         let SecretVolumeSelector {
-            only_provision_identity,
+            only_provision_identity: relaxed,
             format,
             compat,
             names,
@@ -240,7 +240,7 @@ impl SecretProvisionerNode {
 
         for (k, v) in data
             .data
-            .into_files(format, names, compat, only_provision_identity)
+            .into_files(format, names, compat, relaxed)
             .context(publish_error::FormatDataSnafu)?
         {
             // The following few lines of code do some basic checks against

rust/operator-binary/src/format/mod.rs

@@ -20,10 +20,10 @@ pub enum SecretData {
     Unknown(SecretFiles),
 }
 impl SecretData {
-    pub fn parse(self) -> Result<WellKnownSecretData, ParseError> {
+    pub fn parse(self, relaxed: bool) -> Result<WellKnownSecretData, ParseError> {
         match self {
             Self::WellKnown(data) => Ok(data),
-            Self::Unknown(files) => WellKnownSecretData::from_files(files),
+            Self::Unknown(files) => WellKnownSecretData::from_files(files, relaxed),
         }
     }
 
@@ -32,15 +32,22 @@ impl SecretData {
         format: Option<SecretFormat>,
         names: NamingOptions,
         compat: CompatibilityOptions,
-        only_identity: bool,
+        relaxed: bool,
     ) -> Result<SecretFiles, IntoFilesError> {
         let files = if let Some(format) = format {
-            self.parse()?
+            tracing::debug!(
+                ?format,
+                ?names,
+                relaxed,
+                "Explicit format requested: parsing and converting to transform into files"
+            );
+
+            self.parse(relaxed)?
                 .convert_to(format, compat)?
-                .into_files(names, only_identity)
+                .into_files(names)
         } else {
             match self {
-                SecretData::WellKnown(data) => data.into_files(names, only_identity),
+                SecretData::WellKnown(data) => data.into_files(names),
                 SecretData::Unknown(files) => files,
             }
         };

rust/operator-binary/src/format/well_known.rs

@@ -4,6 +4,7 @@ use stackable_operator::schemars::{self, JsonSchema};
 use strum::EnumDiscriminants;
 
 use super::{ConvertError, SecretFiles, convert};
+use crate::utils::ResultExt;
 
 const FILE_PEM_CERT_CERT: &str = "tls.crt";
 const FILE_PEM_CERT_KEY: &str = "tls.key";
@@ -30,7 +31,7 @@ pub struct TlsPkcs12 {
 
 #[derive(Debug)]
 pub struct Kerberos {
-    pub keytab: Vec<u8>,
+    pub keytab: Option<Vec<u8>>,
     pub krb5_conf: Vec<u8>,
 }
 
@@ -47,71 +48,88 @@ pub enum WellKnownSecretData {
 }
 
 impl WellKnownSecretData {
-    pub fn into_files(self, names: NamingOptions, only_identity: bool) -> SecretFiles {
+    pub fn into_files(self, names: NamingOptions) -> SecretFiles {
         match self {
             WellKnownSecretData::TlsPem(TlsPem {
                 certificate_pem,
                 key_pem,
                 ca_pem,
-            }) => {
-                let mut files = vec![Some((names.tls_pem_ca_name, ca_pem))];
-
-                if !only_identity {
-                    files.extend([
-                        Some(names.tls_pem_cert_name).zip(certificate_pem),
-                        Some(names.tls_pem_key_name).zip(key_pem),
-                    ]);
-                }
-
-                files.into_iter().flatten().collect()
-            }
+            }) => [
+                Some((names.tls_pem_ca_name, ca_pem)),
+                Some(names.tls_pem_cert_name).zip(certificate_pem),
+                Some(names.tls_pem_key_name).zip(key_pem),
+            ]
+            .into_iter()
+            .flatten()
+            .collect(),
             WellKnownSecretData::TlsPkcs12(TlsPkcs12 {
                 keystore,
                 truststore,
-            }) => {
-                let mut files = vec![Some((names.tls_pkcs12_truststore_name, truststore))];
-
-                if !only_identity {
-                    files.push(Some(names.tls_pkcs12_keystore_name).zip(keystore));
-                }
-
-                files.into_iter().flatten().collect()
-            }
-            WellKnownSecretData::Kerberos(Kerberos { keytab, krb5_conf }) => {
-                let mut files = vec![(FILE_KERBEROS_KEYTAB_KRB5_CONF.to_string(), krb5_conf)];
-
-                if !only_identity {
-                    files.push((FILE_KERBEROS_KEYTAB_KEYTAB.to_string(), keytab));
-                }
-
-                SecretFiles::from_iter(files)
-            }
+            }) => [
+                Some((names.tls_pkcs12_truststore_name, truststore)),
+                Some(names.tls_pkcs12_keystore_name).zip(keystore),
+            ]
+            .into_iter()
+            .flatten()
+            .collect(),
+            WellKnownSecretData::Kerberos(Kerberos { keytab, krb5_conf }) => [
+                Some((FILE_KERBEROS_KEYTAB_KRB5_CONF.to_owned(), krb5_conf)),
+                Some(FILE_KERBEROS_KEYTAB_KEYTAB.to_owned()).zip(keytab),
+            ]
+            .into_iter()
+            .flatten()
+            .collect(),
         }
     }
 
-    pub fn from_files(mut files: SecretFiles) -> Result<WellKnownSecretData, FromFilesError> {
+    pub fn from_files(
+        mut files: SecretFiles,
+        relaxed: bool,
+    ) -> Result<WellKnownSecretData, FromFilesError> {
+        tracing::debug!(relaxed, "Constructing well-known secret data from files");
+
         let mut take_file = |format, file| {
             files
                 .remove(file)
                 .context(from_files_error::MissingRequiredFileSnafu { format, file })
         };
 
-        if let Ok(certificate_pem) = take_file(SecretFormat::TlsPem, FILE_PEM_CERT_CERT) {
+        // Which file is tried to be parsed first matters. To support the use-case of people bringing
+        // their own non-sensitive data via a Secret and consumers only requiring access to
+        // non-sensitve data (for example for CA verification), the non-senstive files are parsed
+        // first. If the `relaxed` flag is provided, this function tries to parse sensitive files
+        // but won't hard-error when they are not found.
+
+        if let Ok(ca_pem) = take_file(SecretFormat::TlsPem, FILE_PEM_CERT_CA) {
             let mut take_file = |file| take_file(SecretFormat::TlsPem, file);
+
+            let certificate_pem = take_file(FILE_PEM_CERT_CERT).ok_if(relaxed)?;
+            let key_pem = take_file(FILE_PEM_CERT_KEY).ok_if(relaxed)?;
+
             Ok(WellKnownSecretData::TlsPem(TlsPem {
-                certificate_pem: Some(certificate_pem),
-                key_pem: Some(take_file(FILE_PEM_CERT_KEY)?),
-                ca_pem: take_file(FILE_PEM_CERT_CA)?,
+                certificate_pem,
+                key_pem,
+                ca_pem,
             }))
-        } else if let Ok(keystore) = take_file(SecretFormat::TlsPkcs12, FILE_PKCS12_CERT_KEYSTORE) {
+        } else if let Ok(truststore) =
+            take_file(SecretFormat::TlsPkcs12, FILE_PKCS12_CERT_TRUSTSTORE)
+        {
+            let keystore =
+                take_file(SecretFormat::TlsPkcs12, FILE_PKCS12_CERT_KEYSTORE).ok_if(relaxed)?;
+
             Ok(WellKnownSecretData::TlsPkcs12(TlsPkcs12 {
-                keystore: Some(keystore),
-                truststore: take_file(SecretFormat::TlsPkcs12, FILE_PKCS12_CERT_TRUSTSTORE)?,
+                keystore,
+                truststore,
             }))
-        } else if let Ok(keytab) = take_file(SecretFormat::Kerberos, FILE_KERBEROS_KEYTAB_KEYTAB) {
+        } else if let Ok(krb5_conf) =
+            take_file(SecretFormat::Kerberos, FILE_KERBEROS_KEYTAB_KRB5_CONF)
+        {
+            let keytab =
+                take_file(SecretFormat::Kerberos, FILE_KERBEROS_KEYTAB_KEYTAB).ok_if(relaxed)?;
+
             Ok(WellKnownSecretData::Kerberos(Kerberos {
                 keytab,
-                krb5_conf: take_file(SecretFormat::Kerberos, FILE_KERBEROS_KEYTAB_KRB5_CONF)?,
+                krb5_conf,
             }))
         } else {
             from_files_error::UnknownFormatSnafu {

rust/operator-binary/src/utils.rs

@@ -229,14 +229,32 @@ where
     }
 }
 
+pub trait ResultExt<T, E> {
+    /// Transforms this [`Result<T, E>`] into [`Ok(Some(T))`] if [`Ok`], [`Ok(None)`] if [`Err`] and
+    /// `predicate` is `true` or [`Err(_)`] if [`Err`].
+    ///
+    /// This basically applies [`Result::ok`] only if `predicate` is `true`.
+    fn ok_if(self, predicate: bool) -> Result<Option<T>, E>;
+}
+
+impl<T, E> ResultExt<T, E> for Result<T, E> {
+    fn ok_if(self, predicate: bool) -> Result<Option<T>, E> {
+        match self {
+            Ok(ok) => Ok(Some(ok)),
+            Err(_) if predicate => Ok(None),
+            Err(err) => Err(err),
+        }
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use futures::StreamExt;
     use openssl::asn1::Asn1Time;
     use time::OffsetDateTime;
 
     use super::{asn1time_to_offsetdatetime, iterator_try_concat_bytes};
-    use crate::utils::{Flattened, FmtByteSlice, error_full_message, trystream_any};
+    use crate::utils::{Flattened, FmtByteSlice, ResultExt, error_full_message, trystream_any};
 
     #[test]
     fn fmt_hex_byte_slice() {
@@ -346,4 +364,16 @@ mod tests {
         assert_eq!(small, vec![2, 10, 5]);
         assert_eq!(big, vec![1000, 2000]);
     }
+
+    #[test]
+    fn ok_if() {
+        let ok: Result<_, ()> = Ok(42usize);
+        let err: Result<(), _> = Err(());
+
+        assert_eq!(Some(42usize), ok.ok_if(true).expect("must be Ok"));
+        assert_eq!(Some(42usize), ok.ok_if(false).expect("must be Ok"));
+
+        assert_eq!(None, err.ok_if(true).expect("must be Ok"));
+        assert!(err.ok_if(false).is_err());
+    }
 }