Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit aa56b20

Browse files
[Bugfix] Fix JWT Secret Tail characters (#1867)
1 parent 1f7f670 commit aa56b20

29 files changed

+780
-211
lines changed

‎CHANGELOG.md‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,10 +7,8 @@
77
- (Documentation) ManualUpgrade Docs
88
- (Documentation) Add Required & Skip in Docs
99
- (Feature) (Platform) ECS Storage
10-
- (Bugfix) (Platform) Prevent NPE in case of missing Helm Release
11-
- (Feature) Unify Errors
12-
- (Documentation) Update Service Values Doc Type
13-
- (Feature) (Platform) Improve Registry Performance
10+
- (Bugfix) (Platform) Prevent NPE in case of missing Helm Release
11+
- (Bugfix) Align JWT Discovery
1412

1513
## [1.2.50](https://github.com/arangodb/kube-arangodb/tree/1.2.50) (2025年07月04日)
1614
- (Feature) (Platform) MetaV1 Integration Service

‎cmd/admin.go‎

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@ import (
3838
meta "k8s.io/apimachinery/pkg/apis/meta/v1"
3939

4040
"github.com/arangodb-helper/go-certificates"
41-
"github.com/arangodb/go-driver/jwt"
4241
"github.com/arangodb/go-driver/v2/connection"
4342

4443
api "github.com/arangodb/kube-arangodb/pkg/apis/deployment/v1"
@@ -51,6 +50,7 @@ import (
5150
"github.com/arangodb/kube-arangodb/pkg/util/k8sutil"
5251
"github.com/arangodb/kube-arangodb/pkg/util/k8sutil/inspector/generic"
5352
"github.com/arangodb/kube-arangodb/pkg/util/kclient"
53+
"github.com/arangodb/kube-arangodb/pkg/util/token"
5454
)
5555

5656
const (
@@ -401,20 +401,31 @@ func createClient(endpoints []string, certCA *x509.CertPool, auth connection.Aut
401401
}
402402

403403
// getJWTTokenFromSecrets returns token from the secret.
404-
func getJWTTokenFromSecrets(ctx context.Context, secrets generic.ReadClient[*core.Secret], name string) (connection.Authentication, error) {
404+
func getJWTTokenFromSecrets(ctx context.Context, secrets generic.ReadClient[*core.Secret], name string, paths...string) (connection.Authentication, error) {
405405
ctxChild, cancel := globals.GetGlobalTimeouts().Kubernetes().WithTimeout(ctx)
406406
defer cancel()
407407

408-
token, err := k8sutil.GetTokenSecret(ctxChild, secrets, name)
408+
secret, err := k8sutil.GetTokenSecret(ctxChild, secrets, name)
409409
if err != nil {
410410
return nil, errors.WithMessage(err, fmt.Sprintf("failed to get secret \"%s\"", name))
411411
}
412412

413-
bearerToken, err := jwt.CreateArangodJwtAuthorizationHeader(token, "kube-arangodb")
413+
claims := token.NewClaims().With(
414+
token.WithDefaultClaims(),
415+
token.WithServerID("kube-arangodb"),
416+
)
417+
418+
if len(paths) > 0 {
419+
claims = claims.With(token.WithAllowedPaths(paths...))
420+
}
421+
422+
authz, err := claims.Sign(secret)
414423
if err != nil {
415424
return nil, errors.WithMessage(err, fmt.Sprintf("failed to create bearer token from secret \"%s\"", name))
416425
}
417426

427+
bearerToken := fmt.Sprintf("bearer %s", authz)
428+
418429
return JWTAuthentication{key: "Authorization", value: bearerToken}, nil
419430
}
420431

‎integrations/authentication/v1/cache.go‎

Lines changed: 6 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -29,18 +29,13 @@ import (
2929
"time"
3030

3131
"github.com/arangodb/kube-arangodb/pkg/util"
32+
"github.com/arangodb/kube-arangodb/pkg/util/token"
3233
)
3334

3435
const MaxSize = 128
3536

36-
type tokens struct {
37-
signingToken []byte
38-
39-
validationTokens [][]byte
40-
}
41-
42-
func newCache(cfg Configuration) func(ctx context.Context) (*tokens, time.Duration, error) {
43-
return func(ctx context.Context) (*tokens, time.Duration, error) {
37+
func newCache(cfg Configuration) func(ctx context.Context) (token.Secret, time.Duration, error) {
38+
return func(ctx context.Context) (token.Secret, time.Duration, error) {
4439
files, err := os.ReadDir(cfg.Path)
4540
if err != nil {
4641
return nil, 0, err
@@ -87,9 +82,8 @@ func newCache(cfg Configuration) func(ctx context.Context) (*tokens, time.Durati
8782
data[id] = ts[keys[id]]
8883
}
8984

90-
return &tokens{
91-
signingToken: ts[keys[0]],
92-
validationTokens: data,
93-
}, cfg.TTL, nil
85+
return token.NewSecretSet(token.NewSecret(ts[keys[0]]), util.FormatList(data, func(a []byte) token.Secret {
86+
return token.NewSecret(a)
87+
})...), cfg.TTL, nil
9488
}
9589
}

‎integrations/authentication/v1/implementation.go‎

Lines changed: 14 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ type implementation struct {
9292
cfg Configuration
9393

9494
userClient cache.Object[arangodb.Requests]
95-
cache cache.Object[*tokens]
95+
cache cache.Object[token.Secret]
9696
}
9797

9898
func (i *implementation) Name() string {
@@ -190,16 +190,12 @@ func (i *implementation) CreateToken(ctx context.Context, request *pbAuthenticat
190190
duration = v
191191
}
192192

193-
// Token is validated, we can continue with creation
194-
secret := cache.signingToken
195-
196-
signedToken, err := token.New(secret,
197-
token.NewClaims().With(token.WithDefaultClaims(),
198-
token.WithCurrentIAT(),
199-
token.WithDuration(duration),
200-
token.WithUsername(user),
201-
token.WithRoles(request.GetRoles()...)),
202-
)
193+
signedToken, err := token.NewClaims().With(
194+
token.WithDefaultClaims(),
195+
token.WithCurrentIAT(),
196+
token.WithDuration(duration),
197+
token.WithUsername(user),
198+
token.WithRoles(request.GetRoles()...)).Sign(cache)
203199
if err != nil {
204200
return nil, err
205201
}
@@ -344,24 +340,25 @@ func (i *implementation) Logout(ctx context.Context, req *pbAuthenticationV1.Log
344340
return &pbSharedV1.Empty{}, nil
345341
}
346342

347-
func (i *implementation) extractTokenDetails(cache *tokens, t string) (string, []string, time.Duration, error) {
343+
func (i *implementation) extractTokenDetails(cache token.Secret, t string) (string, []string, time.Duration, error) {
348344
// Let's check if token is signed properly
349-
350-
p, err := token.ParseWithAny(t, cache.validationTokens...)
345+
p, err := cache.Validate(t)
351346
if err != nil {
352347
return "", nil, 0, err
353348
}
354349

355350
user := DefaultAdminUser
356-
if v, ok := p[token.ClaimPreferredUsername]; ok {
351+
if v, ok := p.Claims()[token.ClaimPreferredUsername]; ok {
357352
if s, ok := v.(string); ok {
358353
user = s
359354
}
360355
}
361356

362357
duration := DefaultTokenMaxTTL
363358

364-
if v, ok := p[token.ClaimEXP]; ok {
359+
claims := p.Claims()
360+
361+
if v, ok := claims[token.ClaimEXP]; ok {
365362
switch o := v.(type) {
366363
case int64:
367364
duration = time.Until(time.Unix(o, 0))
@@ -372,7 +369,7 @@ func (i *implementation) extractTokenDetails(cache *tokens, t string) (string, [
372369

373370
var roles []string
374371

375-
if v, ok := p[token.ClaimRoles]; ok {
372+
if v, ok := claims[token.ClaimRoles]; ok {
376373
switch o := v.(type) {
377374
case []string:
378375
roles = o

‎pkg/api/api.go‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/api/auth.go‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/api/jwt.go‎

Lines changed: 13 additions & 13 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎pkg/deployment/context_impl.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -295,7 +295,7 @@ func (d *Deployment) getJWTToken() (string, bool) {
295295
func (d *Deployment) GetSyncServerClient(ctx context.Context, group api.ServerGroup, id string) (client.API, error) {
296296
// Fetch monitoring token
297297
secretName := d.GetSpec().Sync.Monitoring.GetTokenSecretName()
298-
monitoringToken, err := k8sutil.GetTokenSecret(ctx, d.GetCachedStatus().Secret().V1().Read(), secretName)
298+
monitoringToken, err := k8sutil.GetTokenSecretString(ctx, d.GetCachedStatus().Secret().V1().Read(), secretName)
299299
if err != nil {
300300
d.log.Err(err).Str("secret-name", secretName).Debug("Failed to get sync monitoring secret")
301301
return nil, errors.WithStack(err)

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /