From d316c8567e60f0ef234d33293f2a75db3ddb03cb Mon Sep 17 00:00:00 2001 From: Tobias Trabelsi Date: Sat, 26 Nov 2022 21:33:31 +0100 Subject: [PATCH] working jinja template type --- charts/bitwarden-crd-operator/Chart.yaml | 22 +++++++++++-------- .../crds/bitwarden-secrets.yaml | 4 +++- .../crds/bitwarden-templates.yaml | 2 +- .../crds/registry-credentials.yaml | 2 +- example.yaml | 4 +++- example_dockerlogin.yaml | 2 +- example_template.yaml | 8 +++---- src/bitwardenCrdOperator.py | 9 ++++++-- src/dockerlogin.py | 8 +++---- src/kv.py | 17 +++++++++----- src/lookups/bitwarden_lookup.py | 13 +++++++---- src/template.py | 10 ++++----- src/utils/utils.py | 21 +++++++++++++----- 13 files changed, 78 insertions(+), 44 deletions(-) diff --git a/charts/bitwarden-crd-operator/Chart.yaml b/charts/bitwarden-crd-operator/Chart.yaml index 1167885..51f7e58 100644 --- a/charts/bitwarden-crd-operator/Chart.yaml +++ b/charts/bitwarden-crd-operator/Chart.yaml @@ -32,12 +32,12 @@ annotations: url: https://github.com/Lerentis/bitwarden-crd-operator artifacthub.io/crds: | - kind: BitwardenSecret - version: v1beta3 + version: v1beta4 name: bitwarden-secret displayName: Bitwarden Secret description: Management Object to create secrets from bitwarden - kind: RegistryCredential - version: v1beta3 + version: v1beta4 name: registry-credential displayName: Regestry Credentials description: Management Object to create regestry secrets from bitwarden @@ -47,7 +47,7 @@ annotations: displayName: Bitwarden Template description: Management Object to create secrets from a jinja template with a bitwarden lookup artifacthub.io/crdsExamples: | - - apiVersion: lerentis.uploadfilter24.eu/v1beta3 + - apiVersion: lerentis.uploadfilter24.eu/v1beta4 kind: BitwardenSecret metadata: name: test @@ -62,7 +62,7 @@ annotations: id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" name: "test-secret" namespace: "default" - - apiVersion: lerentis.uploadfilter24.eu/v1beta3 + - apiVersion: lerentis.uploadfilter24.eu/v1beta4 kind: RegistryCredential metadata: name: test @@ -73,7 +73,7 @@ annotations: id: "aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee" name: "test-regcred" namespace: "default" - - apiVersion: "lerentis.uploadfilter24.eu/v1beta1" + - apiVersion: "lerentis.uploadfilter24.eu/v1beta4" kind: BitwardenTemplate metadata: name: test @@ -85,19 +85,23 @@ annotations: --- api: enabled: True - key: {{ bitwarden_lookup("466fc4b0-ffca-4444-8d88-b59d4de3d928", "key") }} + key: {{ bitwarden_lookup("466fc4b0-ffca-4444-8d88-b59d4de3d928", "fields", "key") }} allowCrossOrigin: false apps: "some.app.identifier:some_version": - pubkey: {{ bitwarden_lookup("466fc4b0-ffca-4444-8d88-b59d4de3d928", "public_key") }} - enabled: true + pubkey: {{ bitwarden_lookup("466fc4b0-ffca-4444-8d88-b59d4de3d928", "fields", "public_key") }} + enabled: true artifacthub.io/license: MIT artifacthub.io/operator: "true" artifacthub.io/changes: | - kind: added - description: "Added Template CRD" + description: "Added Template type" - kind: added description: "Added logo" + - kind: changed + description: "BitwardenSecret now requires a 'secretScope' to be defined. Can eigher be 'login' or 'fields'" + - kind: fixed + description: "fixed hardcoded reference to 'login' even tho secrets could also be in 'fields' scope" artifacthub.io/images: | - name: bitwarden-crd-operator image: lerentis/bitwarden-crd-operator:0.4.0 diff --git a/charts/bitwarden-crd-operator/crds/bitwarden-secrets.yaml b/charts/bitwarden-crd-operator/crds/bitwarden-secrets.yaml index f58e8fd..4e420c9 100644 --- a/charts/bitwarden-crd-operator/crds/bitwarden-secrets.yaml +++ b/charts/bitwarden-crd-operator/crds/bitwarden-secrets.yaml @@ -13,7 +13,7 @@ spec: shortNames: - bws versions: - - name: v1beta3 + - name: v1beta4 served: true storage: true schema: @@ -35,6 +35,8 @@ spec: type: string secretRef: type: string + secretScope: + type: string required: - secretName id: diff --git a/charts/bitwarden-crd-operator/crds/bitwarden-templates.yaml b/charts/bitwarden-crd-operator/crds/bitwarden-templates.yaml index 004b70e..fa2212c 100644 --- a/charts/bitwarden-crd-operator/crds/bitwarden-templates.yaml +++ b/charts/bitwarden-crd-operator/crds/bitwarden-templates.yaml @@ -13,7 +13,7 @@ spec: shortNames: - bwt versions: - - name: v1beta1 + - name: v1beta4 served: true storage: true schema: diff --git a/charts/bitwarden-crd-operator/crds/registry-credentials.yaml b/charts/bitwarden-crd-operator/crds/registry-credentials.yaml index 5d6171c..c3f4ffb 100644 --- a/charts/bitwarden-crd-operator/crds/registry-credentials.yaml +++ b/charts/bitwarden-crd-operator/crds/registry-credentials.yaml @@ -13,7 +13,7 @@ spec: shortNames: - rgc versions: - - name: v1beta3 + - name: v1beta4 served: true storage: true schema: diff --git a/example.yaml b/example.yaml index 670e6f3..a6e789e 100644 --- a/example.yaml +++ b/example.yaml @@ -1,5 +1,5 @@ --- -apiVersion: "lerentis.uploadfilter24.eu/v1beta3" +apiVersion: "lerentis.uploadfilter24.eu/v1beta4" kind: BitwardenSecret metadata: name: test @@ -8,9 +8,11 @@ spec: - element: secretName: username secretRef: nameofUser + secretScope: login - element: secretName: password secretRef: passwordOfUser + secretScope: login id: "88781348-c81c-4367-9801-550360c21295" name: "test-secret" namespace: "default" \ No newline at end of file diff --git a/example_dockerlogin.yaml b/example_dockerlogin.yaml index 4e34b17..f5f12d0 100644 --- a/example_dockerlogin.yaml +++ b/example_dockerlogin.yaml @@ -1,5 +1,5 @@ --- -apiVersion: "lerentis.uploadfilter24.eu/v1beta3" +apiVersion: "lerentis.uploadfilter24.eu/v1beta4" kind: RegistryCredential metadata: name: test diff --git a/example_template.yaml b/example_template.yaml index a488bcc..646dc4a 100644 --- a/example_template.yaml +++ b/example_template.yaml @@ -1,19 +1,19 @@ --- -apiVersion: "lerentis.uploadfilter24.eu/v1beta1" +apiVersion: "lerentis.uploadfilter24.eu/v1beta4" kind: BitwardenTemplate metadata: name: test spec: filename: "config.yaml" - name: "test-regcred" + name: "test-template" namespace: "default" template: | --- api: enabled: True - key: {{ bitwarden_lookup("466fc4b0-ffca-4444-8d88-b59d4de3d928", "key") }} + key: {{ bitwarden_lookup("466fc4b0-ffca-4444-8d88-b59d4de3d928", "fields", "key") }} allowCrossOrigin: false apps: "some.app.identifier:some_version": - pubkey: {{ bitwarden_lookup("466fc4b0-ffca-4444-8d88-b59d4de3d928", "public_key") }} + pubkey: {{ bitwarden_lookup("466fc4b0-ffca-4444-8d88-b59d4de3d928", "fields", "public_key") }} enabled: true \ No newline at end of file diff --git a/src/bitwardenCrdOperator.py b/src/bitwardenCrdOperator.py index 4c3be14..bb1ce72 100755 --- a/src/bitwardenCrdOperator.py +++ b/src/bitwardenCrdOperator.py @@ -7,9 +7,14 @@ from utils.utils import command_wrapper, unlock_bw @kopf.on.startup() def bitwarden_signin(logger, **kwargs): if 'BW_HOST' in os.environ: - command_wrapper(logger, f"config server {os.getenv('BW_HOST')}") + try: + command_wrapper(f"config server {os.getenv('BW_HOST')}") + except: + logger.warn("Revieved none zero exit code from server config") + logger.warn("This is expected from startup") + pass else: logger.info(f"BW_HOST not set. Assuming SaaS installation") - command_wrapper(logger, "login --apikey") + command_wrapper("login --apikey") unlock_bw(logger) diff --git a/src/dockerlogin.py b/src/dockerlogin.py index 0928231..095d322 100644 --- a/src/dockerlogin.py +++ b/src/dockerlogin.py @@ -23,7 +23,7 @@ def create_dockerlogin(logger, secret, secret_json, username_ref, password_ref, secret.data[".dockerconfigjson"] = str(base64.b64encode(json.dumps(auths_dict).encode("utf-8")), "utf-8") return secret -@kopf.on.create('registry-credentials.lerentis.uploadfilter24.eu') +@kopf.on.create('registry-credential.lerentis.uploadfilter24.eu') def create_managed_registry_secret(spec, name, namespace, logger, **kwargs): username_ref = spec.get('usernameRef') password_ref = spec.get('passwordRef') @@ -39,7 +39,7 @@ def create_managed_registry_secret(spec, name, namespace, logger, **kwargs): api = kubernetes.client.CoreV1Api() annotations = { - "managed": "registry-credentials.lerentis.uploadfilter24.eu", + "managed": "registry-credential.lerentis.uploadfilter24.eu", "managedObject": f"{namespace}/{name}" } secret = kubernetes.client.V1Secret() @@ -52,11 +52,11 @@ def create_managed_registry_secret(spec, name, namespace, logger, **kwargs): logger.info(f"Registry Secret {secret_namespace}/{secret_name} has been created") -@kopf.on.update('registry-credentials.lerentis.uploadfilter24.eu') +@kopf.on.update('registry-credential.lerentis.uploadfilter24.eu') def my_handler(spec, old, new, diff, **_): pass -@kopf.on.delete('registry-credentials.lerentis.uploadfilter24.eu') +@kopf.on.delete('registry-credential.lerentis.uploadfilter24.eu') def delete_managed_secret(spec, name, namespace, logger, **kwargs): secret_name = spec.get('name') secret_namespace = spec.get('namespace') diff --git a/src/kv.py b/src/kv.py index cb4f9b2..598d3d6 100644 --- a/src/kv.py +++ b/src/kv.py @@ -3,7 +3,7 @@ import kubernetes import base64 import json -from utils.utils import unlock_bw, get_secret_from_bitwarden +from utils.utils import unlock_bw, get_secret_from_bitwarden, parse_login_scope, parse_fields_scope def create_kv(secret, secret_json, content_def): secret.type = "Opaque" @@ -15,10 +15,15 @@ def create_kv(secret, secret_json, content_def): _secret_key = value if key == "secretRef": _secret_ref = value - secret.data[_secret_ref] = str(base64.b64encode(secret_json["login"][_secret_key].encode("utf-8")), "utf-8") + if key == "secretScope": + _secret_scope = value + if _secret_scope == "login": + secret.data[_secret_ref] = str(base64.b64encode(parse_login_scope(secret_json, _secret_key).encode("utf-8")), "utf-8") + if _secret_scope == "fields": + secret.data[_secret_ref] = str(base64.b64encode(parse_fields_scope(secret_json, _secret_key).encode("utf-8")), "utf-8") return secret -@kopf.on.create('bitwarden-secrets.lerentis.uploadfilter24.eu') +@kopf.on.create('bitwarden-secret.lerentis.uploadfilter24.eu') def create_managed_secret(spec, name, namespace, logger, body, **kwargs): content_def = body['spec']['content'] @@ -33,7 +38,7 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs): api = kubernetes.client.CoreV1Api() annotations = { - "managed": "bitwarden-secrets.lerentis.uploadfilter24.eu", + "managed": "bitwarden-secret.lerentis.uploadfilter24.eu", "managedObject": f"{namespace}/{name}" } secret = kubernetes.client.V1Secret() @@ -46,11 +51,11 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs): logger.info(f"Secret {secret_namespace}/{secret_name} has been created") -@kopf.on.update('bitwarden-secrets.lerentis.uploadfilter24.eu') +@kopf.on.update('bitwarden-secret.lerentis.uploadfilter24.eu') def my_handler(spec, old, new, diff, **_): pass -@kopf.on.delete('bitwarden-secrets.lerentis.uploadfilter24.eu') +@kopf.on.delete('bitwarden-secret.lerentis.uploadfilter24.eu') def delete_managed_secret(spec, name, namespace, logger, **kwargs): secret_name = spec.get('name') secret_namespace = spec.get('namespace') diff --git a/src/lookups/bitwarden_lookup.py b/src/lookups/bitwarden_lookup.py index 559b937..d15adb0 100644 --- a/src/lookups/bitwarden_lookup.py +++ b/src/lookups/bitwarden_lookup.py @@ -1,5 +1,10 @@ -from utils.utils import get_secret_from_bitwarden +import json -def bitwarden_lookup(id, field): - _secret_json = get_secret_from_bitwarden(id) - return _secret_json["login"][field] \ No newline at end of file +from utils.utils import get_secret_from_bitwarden, parse_fields_scope, parse_login_scope + +def bitwarden_lookup(id, scope, field): + _secret_json = json.loads(get_secret_from_bitwarden(id)) + if scope == "login": + return parse_login_scope(_secret_json, field) + if scope == "fields": + return parse_fields_scope(_secret_json, field) \ No newline at end of file diff --git a/src/template.py b/src/template.py index 4a00029..e3abcb9 100644 --- a/src/template.py +++ b/src/template.py @@ -22,7 +22,7 @@ def create_template_secret(secret, filename, template): secret.data[filename] = str(base64.b64encode(render_template(template).encode("utf-8")), "utf-8") return secret -@kopf.on.create('bitwarden-templates.lerentis.uploadfilter24.eu') +@kopf.on.create('bitwarden-template.lerentis.uploadfilter24.eu') def create_managed_secret(spec, name, namespace, logger, body, **kwargs): template = spec.get('template') @@ -35,12 +35,12 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs): api = kubernetes.client.CoreV1Api() annotations = { - "managed": "bitwarden-templates.lerentis.uploadfilter24.eu", + "managed": "bitwarden-template.lerentis.uploadfilter24.eu", "managedObject": f"{namespace}/{name}" } secret = kubernetes.client.V1Secret() secret.metadata = kubernetes.client.V1ObjectMeta(name=secret_name, annotations=annotations) - secret = create_managed_secret(secret, filename, template) + secret = create_template_secret(secret, filename, template) obj = api.create_namespaced_secret( secret_namespace, secret @@ -48,11 +48,11 @@ def create_managed_secret(spec, name, namespace, logger, body, **kwargs): logger.info(f"Secret {secret_namespace}/{secret_name} has been created") -@kopf.on.update('bitwarden-templates.lerentis.uploadfilter24.eu') +@kopf.on.update('bitwarden-template.lerentis.uploadfilter24.eu') def my_handler(spec, old, new, diff, **_): pass -@kopf.on.delete('bitwarden-templates.lerentis.uploadfilter24.eu') +@kopf.on.delete('bitwarden-template.lerentis.uploadfilter24.eu') def delete_managed_secret(spec, name, namespace, logger, **kwargs): secret_name = spec.get('name') secret_namespace = spec.get('namespace') diff --git a/src/utils/utils.py b/src/utils/utils.py index 7700a3f..9c1f543 100644 --- a/src/utils/utils.py +++ b/src/utils/utils.py @@ -1,19 +1,30 @@ import os import subprocess +class BitwardenCommandException(Exception): + pass + def get_secret_from_bitwarden(id): - return command_wrapper(logger, f"get item {id}") + return command_wrapper(command=f"get item {id}") def unlock_bw(logger): - token_output = command_wrapper(logger, "unlock --passwordenv BW_PASSWORD") + token_output = command_wrapper("unlock --passwordenv BW_PASSWORD") tokens = token_output.split('"')[1::2] os.environ["BW_SESSION"] = tokens[1] logger.info("Signin successful. Session exported") -def command_wrapper(logger, command): +def command_wrapper(command): system_env = dict(os.environ) sp = subprocess.Popen([f"bw {command}"], stdout=subprocess.PIPE, stderr=subprocess.PIPE, close_fds=True, shell=True, env=system_env) out, err = sp.communicate() if err: - logger.warn(f"Error during bw cli invokement: {err}") - return out.decode(encoding='UTF-8') \ No newline at end of file + raise BitwardenCommandException(err) + return out.decode(encoding='UTF-8') + +def parse_login_scope(secret_json, key): + return secret_json["login"][key] + +def parse_fields_scope(secret_json, key): + for entry in secret_json["fields"]: + if entry['name'] == key: + return entry['value']