Skip to content

Commit a26fdde

Browse files
authored
Merge pull request #1697 from tangledbytes/utkarsh/remove-password
Remove usage of create_auth and reset_password API
2 parents b9cb9f0 + dd5e392 commit a26fdde

File tree

10 files changed

+75
-230
lines changed

10 files changed

+75
-230
lines changed

go.mod

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -138,7 +138,7 @@ require (
138138
github.com/go-openapi/swag v0.23.1 // indirect
139139
github.com/go-playground/validator/v10 v10.15.1 // indirect
140140
github.com/gogo/protobuf v1.3.2 // indirect
141-
github.com/golang-jwt/jwt/v4 v4.5.2 // indirect
141+
github.com/golang-jwt/jwt/v4 v4.5.2
142142
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
143143
github.com/golang/protobuf v1.5.4 // indirect
144144
github.com/google/gnostic-models v0.6.9 // indirect

pkg/backingstore/backingstore.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -944,7 +944,7 @@ func WaitReady(backStore *nbv1.BackingStore) bool {
944944
log := util.Logger()
945945
klient := util.KubeClient()
946946

947-
interval := time.Duration(3)
947+
interval := time.Duration(30)
948948

949949
err := wait.PollUntilContextCancel(ctx, interval*time.Second, true, func(ctx context.Context) (bool, error) {
950950
err := klient.Get(util.Context(), util.ObjectKey(backStore), backStore)

pkg/nb/api.go

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,6 @@ type Client interface {
2222
ListBucketsAPI(ListBucketsParams) (ListBucketsReply, error)
2323
ListHostsAPI(ListHostsParams) (ListHostsReply, error)
2424

25-
CreateAuthAPI(CreateAuthParams) (CreateAuthReply, error)
2625
CreateSystemAPI(CreateSystemParams) (CreateSystemReply, error)
2726
CreateAccountAPI(CreateAccountParams) (CreateAccountReply, error)
2827
CreateBucketAPI(CreateBucketParams) error
@@ -65,7 +64,6 @@ type Client interface {
6564

6665
GenerateAccountKeysAPI(GenerateAccountKeysParams) error
6766
UpdateAccountKeysAPI(UpdateAccountKeysParams) error
68-
ResetPasswordAPI(ResetPasswordParams) error
6967
}
7068

7169
// ReadAuthAPI calls auth_api.read_auth()
@@ -167,17 +165,6 @@ func (c *RPCClient) ListHostsAPI(params ListHostsParams) (ListHostsReply, error)
167165
return res.Reply, err
168166
}
169167

170-
// CreateAuthAPI calls auth_api.create_auth()
171-
func (c *RPCClient) CreateAuthAPI(params CreateAuthParams) (CreateAuthReply, error) {
172-
req := &RPCMessage{API: "auth_api", Method: "create_auth", Params: params}
173-
res := &struct {
174-
RPCMessage `json:",inline"`
175-
Reply CreateAuthReply `json:"reply"`
176-
}{}
177-
err := c.Call(req, res)
178-
return res.Reply, err
179-
}
180-
181168
// CreateSystemAPI calls system_api.create_system()
182169
func (c *RPCClient) CreateSystemAPI(params CreateSystemParams) (CreateSystemReply, error) {
183170
req := &RPCMessage{API: "system_api", Method: "create_system", Params: params}
@@ -444,9 +431,3 @@ func (c *RPCClient) UpdateAccountKeysAPI(params UpdateAccountKeysParams) error {
444431
req := &RPCMessage{API: "account_api", Method: "update_account_keys", Params: params}
445432
return c.Call(req, nil)
446433
}
447-
448-
// ResetPasswordAPI calls account_api.reset_password()
449-
func (c *RPCClient) ResetPasswordAPI(params ResetPasswordParams) error {
450-
req := &RPCMessage{API: "account_api", Method: "reset_password", Params: params}
451-
return c.Call(req, nil)
452-
}

pkg/nb/types.go

Lines changed: 9 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -286,7 +286,7 @@ type ListAccountsReply struct {
286286
// ListBcuketsParams is the params to account_api.list_buckets()
287287
type ListBucketsParams struct {
288288
ContinuationToken *string `json:"continuation_token,omitempty"`
289-
MaxBuckets *int `json:"max_buckets,omitempty"`
289+
MaxBuckets *int `json:"max_buckets,omitempty"`
290290
}
291291

292292
// ListBucketsReply is the reply of bucket_api.list_buckets()
@@ -316,19 +316,6 @@ type HostInfo struct {
316316
Name string `json:"name"`
317317
}
318318

319-
// CreateAuthParams is the params of auth_api.create_auth()
320-
type CreateAuthParams struct {
321-
System string `json:"system"`
322-
Role string `json:"role"`
323-
Email string `json:"email"`
324-
Password string `json:"password,omitempty"`
325-
}
326-
327-
// CreateAuthReply is the reply of auth_api.create_auth()
328-
type CreateAuthReply struct {
329-
Token string `json:"token"`
330-
}
331-
332319
// CreateSystemParams is the params of system_api.create_system()
333320
type CreateSystemParams struct {
334321
Name string `json:"name"`
@@ -439,13 +426,6 @@ type UpdateAccountKeysParams struct {
439426
AccessKeys S3AccessKeys `json:"access_keys"`
440427
}
441428

442-
// ResetPasswordParams is the params of account_api.reset_password()
443-
type ResetPasswordParams struct {
444-
Email string `json:"email"`
445-
VerificationPassword MaskedString `json:"verification_password"`
446-
Password MaskedString `json:"password"`
447-
}
448-
449429
// BackingStoreInfo describes backingstore info
450430
type BackingStoreInfo struct {
451431
// Name describes backingstore name
@@ -585,15 +565,15 @@ type DeleteNamespaceResourceParams struct {
585565

586566
// UpdateAccountParams is the params of account_api.update_account_s3_access()
587567
type UpdateAccountParams struct {
588-
Name *string `json:"username,omitempty"`
589-
Email string `json:"email"`
590-
NewEmail *string `json:"new_email,omitempty"`
591-
AllowedIPs *[]struct {
592-
Start string `json:"start"`
593-
End string `json:"end"`
568+
Name *string `json:"username,omitempty"`
569+
Email string `json:"email"`
570+
NewEmail *string `json:"new_email,omitempty"`
571+
AllowedIPs *[]struct {
572+
Start string `json:"start"`
573+
End string `json:"end"`
594574
} `json:"ips,omitempty"`
595-
RoleConfig interface{} `json:"role_config,omitempty"`
596-
RemoveRoleConfig bool `json:"remove_role_config,omitempty"`
575+
RoleConfig interface{} `json:"role_config,omitempty"`
576+
RemoveRoleConfig bool `json:"remove_role_config,omitempty"`
597577
}
598578

599579
// UpdateAccountS3AccessParams is the params of account_api.update_account_s3_access()

pkg/noobaaaccount/noobaaaccount.go

Lines changed: 10 additions & 113 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,6 @@ func Cmd() *cobra.Command {
3737
CmdUpdate(),
3838
CmdRegenerate(),
3939
CmdCredentials(),
40-
CmdPasswd(),
4140
CmdDelete(),
4241
CmdStatus(),
4342
CmdList(),
@@ -105,28 +104,6 @@ func CmdCredentials() *cobra.Command {
105104
return cmd
106105
}
107106

108-
// CmdPasswd returns a CLI command
109-
func CmdPasswd() *cobra.Command {
110-
cmd := &cobra.Command{
111-
Use: "passwd <noobaa-account-name>",
112-
Short: "reset password for noobaa account",
113-
Run: RunPasswd,
114-
}
115-
cmd.Flags().String(
116-
"old-password", "",
117-
`Old Password for authentication - the best practice is to **omit this flag**, in that case the CLI will prompt to prompt and read it securely from the terminal to avoid leaking secrets in the shell history`,
118-
)
119-
cmd.Flags().String(
120-
"new-password", "",
121-
`New Password for authentication - the best practice is to **omit this flag**, in that case the CLI will prompt to prompt and read it securely from the terminal to avoid leaking secrets in the shell history`,
122-
)
123-
cmd.Flags().String(
124-
"retype-new-password", "",
125-
`Retype new Password for authentication - the best practice is to **omit this flag**, in that case the CLI will prompt to prompt and read it securely from the terminal to avoid leaking secrets in the shell history`,
126-
)
127-
return cmd
128-
}
129-
130107
// CmdDelete returns a CLI command
131108
func CmdDelete() *cobra.Command {
132109
cmd := &cobra.Command{
@@ -285,8 +262,16 @@ func RunUpdate(cmd *cobra.Command, args []string) {
285262
noobaaAccount.Name = name
286263
noobaaAccount.Namespace = options.Namespace
287264

288-
isResourceBackingStore := checkResourceBackingStore(newDefaultResource)
289-
isResourceNamespaceStore := checkResourceNamespaceStore(newDefaultResource)
265+
sysClient, err := system.Connect(true)
266+
if err != nil {
267+
log.Fatalf("❌ failed to run RPC call: %s", err)
268+
}
269+
270+
_, err = sysClient.NBClient.ReadPoolAPI(nb.ReadPoolParams{Name: newDefaultResource})
271+
isResourceBackingStore := err == nil
272+
273+
_, err = sysClient.NBClient.ReadNamespaceResourceAPI(nb.ReadNamespaceResourceParams{Name: newDefaultResource})
274+
isResourceNamespaceStore := err == nil
290275

291276
if isResourceBackingStore && isResourceNamespaceStore {
292277
log.Fatalf(`❌ got BackingStore and NamespaceStore %q in namespace %q`,
@@ -436,53 +421,6 @@ func RunCredentials(cmd *cobra.Command, args []string) {
436421
}
437422
}
438423

439-
// RunPasswd runs a CLI command
440-
func RunPasswd(cmd *cobra.Command, args []string) {
441-
log := util.Logger()
442-
443-
if len(args) != 1 || args[0] == "" {
444-
log.Fatalf(`❌ Missing expected arguments: <noobaa-account-name> %s`, cmd.UsageString())
445-
}
446-
447-
name := args[0]
448-
449-
oldPassword := util.GetFlagStringOrPromptPassword(cmd, "old-password")
450-
newPassword := util.GetFlagStringOrPromptPassword(cmd, "new-password")
451-
retypeNewPassword := util.GetFlagStringOrPromptPassword(cmd, "retype-new-password")
452-
453-
secret := util.KubeObject(bundle.File_deploy_internal_secret_empty_yaml).(*corev1.Secret)
454-
455-
if name == "admin@noobaa.io" {
456-
secret.Name = "noobaa-admin"
457-
} else {
458-
secret.Name = fmt.Sprintf("noobaa-account-%s", name)
459-
}
460-
secret.Namespace = options.Namespace
461-
if !util.KubeCheck(secret) {
462-
log.Fatalf(`❌ Could not find secret: %s, will not reset password`, secret.Name)
463-
}
464-
465-
if oldPassword != secret.StringData["password"] {
466-
log.Fatalf(`❌ Password is incorrect, aborting.`)
467-
}
468-
469-
err := ResetPassword(name, oldPassword, newPassword, retypeNewPassword)
470-
if err != nil {
471-
log.Fatalf(`❌ Could not reset password for %q: %v`, name, err)
472-
}
473-
474-
secret.StringData = map[string]string{}
475-
secret.StringData["password"] = newPassword
476-
477-
//If we will not be able to update the secret we will print the credentials as they allready been changed by the RPC
478-
if !util.KubeUpdate(secret) {
479-
log.Fatalf(`❌ Failed to update the secret %s with the new password, please write it down.`, secret.Name)
480-
}
481-
482-
log.Printf("✅ Successfully reset the password for the account %q", name)
483-
484-
}
485-
486424
// RunDelete runs a CLI command
487425
func RunDelete(cmd *cobra.Command, args []string) {
488426

@@ -877,47 +815,6 @@ func ValidateAccessKeys(accessKeys nb.S3AccessKeys) {
877815
}
878816
}
879817

880-
// ResetPassword reset noobaa account password
881-
func ResetPassword(name string, oldPassword string, newPassword string, retypeNewPassword string) error {
882-
sysClient, err := system.Connect(true)
883-
if err != nil {
884-
return err
885-
}
886-
887-
PasswordResstrictions(oldPassword, newPassword, retypeNewPassword)
888-
889-
err = sysClient.NBClient.ResetPasswordAPI(nb.ResetPasswordParams{
890-
Email: name,
891-
VerificationPassword: nb.MaskedString(oldPassword),
892-
Password: nb.MaskedString(newPassword),
893-
})
894-
if err != nil {
895-
return err
896-
}
897-
898-
return nil
899-
}
900-
901-
// PasswordResstrictions checks for all kind of password restrictions
902-
func PasswordResstrictions(oldPassword string, newPassword string, retypeNewPassword string) {
903-
log := util.Logger()
904-
905-
//Checking that we did not get the same password as the old one
906-
if newPassword == oldPassword {
907-
log.Fatalf(`❌ The password cannot match the old password, aborting.`)
908-
}
909-
910-
//Checking that we got the same password twice
911-
if newPassword != retypeNewPassword {
912-
log.Fatalf(`❌ The password and is not matching the retype, aborting.`)
913-
}
914-
915-
//TODO... This is the place for adding more restrictions
916-
// length of password
917-
// charecters
918-
919-
}
920-
921818
// checkResourceBackingStore checks if a resourceName exists and if BackingStore
922819
func checkResourceBackingStore(resourceName string) bool {
923820
// check that a backing store exists

pkg/noobaaaccount/reconciler.go

Lines changed: 13 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -361,19 +361,25 @@ func (r *Reconciler) CreateNooBaaAccount() error {
361361
if exists {
362362
if strings.ToLower(annotationValue) == strTrue {
363363
// create join secret conatining auth token for remote noobaa account
364-
res, err := r.NBClient.CreateAuthAPI(nb.CreateAuthParams{
365-
System: r.NooBaa.Name,
366-
Role: "operator",
367-
Email: options.OperatorAccountEmail,
368-
})
364+
secretServer := util.KubeObject(bundle.File_deploy_internal_secret_empty_yaml).(*corev1.Secret)
365+
secretServer.Namespace = r.Request.Namespace
366+
secretServer.Name = options.SystemName
367+
if !util.KubeCheck(secretServer) {
368+
return fmt.Errorf("cannot create an auth token for remote operator - server secret not found")
369+
}
370+
371+
token, err := util.MakeAuthToken(map[string]any{
372+
"system": r.NooBaa.Name,
373+
"role": "operator",
374+
"email": options.OperatorAccountEmail,
375+
}, []byte(secretServer.StringData["jwt"]))
369376
if err != nil {
370377
return fmt.Errorf("cannot create an auth token for remote operator, error: %v", err)
371378
}
372379
accessKeys := accountInfo.AccessKeys[0]
373-
r.Secret.StringData["auth_token"] = res.Token
380+
r.Secret.StringData["auth_token"] = token
374381
r.Secret.StringData["AWS_ACCESS_KEY_ID"] = string(accessKeys.AccessKey)
375382
r.Secret.StringData["AWS_SECRET_ACCESS_KEY"] = string(accessKeys.SecretKey)
376-
377383
}
378384
} else {
379385
var accessKeys nb.S3AccessKeys

pkg/options/options.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ const (
3030
// ContainerImageRepo is the repo of the default image url
3131
ContainerImageRepo = "noobaa-core"
3232
// ContainerImageTag is the tag of the default image url
33-
ContainerImageTag = "master-20250521"
33+
ContainerImageTag = "master-20250911"
3434
// ContainerImageSemverLowerBound is the lower bound for supported image versions
3535
ContainerImageSemverLowerBound = "5.0.0"
3636
// ContainerImageSemverUpperBound is the upper bound for supported image versions

0 commit comments

Comments
 (0)