diff --git a/pkg/tkn/host_access_secret_test.go b/pkg/tkn/host_access_secret_test.go new file mode 100644 index 000000000..54d44bf33 --- /dev/null +++ b/pkg/tkn/host_access_secret_test.go @@ -0,0 +1,108 @@ +package tkn + +import ( + "bufio" + "os" + "path/filepath" + "strings" + "testing" +) + +func TestHostAccessSecretEncoding(t *testing.T) { + root := moduleRoot(t) + + for _, dir := range []string{"tkn", filepath.Join("tkn", "template")} { + entries, err := os.ReadDir(filepath.Join(root, dir)) + if err != nil { + t.Fatal(err) + } + for _, entry := range entries { + name := entry.Name() + if !isInfraTask(name) { + continue + } + checkFile(t, filepath.Join(root, dir, name)) + } + } +} + +func isInfraTask(name string) bool { + return strings.HasSuffix(name, ".yaml") && + (strings.HasPrefix(name, "infra-aws-") || strings.HasPrefix(name, "infra-azure-")) +} + +func checkFile(t *testing.T, path string) { + t.Helper() + + sanitizeFields := map[string]struct{}{ + "host": {}, + "username": {}, + "bastion-host": {}, + "bastion-username": {}, + "adminusername": {}, + } + preserveFields := map[string]struct{}{ + "id_rsa": {}, + "bastion-id_rsa": {}, + "userpassword": {}, + "adminuserpassword": {}, + } + + f, err := os.Open(path) + if err != nil { + t.Fatal(err) + } + defer func() { + if err := f.Close(); err != nil { + t.Fatal(err) + } + }() + + sc := bufio.NewScanner(f) + for sc.Scan() { + line := sc.Text() + if !strings.Contains(line, "$(cat /opt/host-info/") { + continue + } + field, ok := hostInfoField(line) + if !ok { + continue + } + if _, ok := preserveFields[field]; ok { + if strings.Contains(line, "tr -d") { + t.Errorf("%s: %s must not use tr -d: %s", path, field, strings.TrimSpace(line)) + } + continue + } + if _, ok := sanitizeFields[field]; ok && !strings.Contains(line, `tr -d '\n\r'`) { + t.Errorf("%s: %s must use tr -d: %s", path, field, strings.TrimSpace(line)) + } + } + if err := sc.Err(); err != nil { + t.Fatal(err) + } +} + +func hostInfoField(line string) (string, bool) { + line = strings.TrimSpace(line) + field, _, ok := strings.Cut(line, ":") + if !ok { + return "", false + } + return field, true +} + +func moduleRoot(t *testing.T) string { + t.Helper() + dir, _ := os.Getwd() + for { + if _, err := os.Stat(filepath.Join(dir, "go.mod")); err == nil { + return dir + } + parent := filepath.Dir(dir) + if parent == dir { + t.Fatal("go.mod not found") + } + dir = parent + } +} diff --git a/tkn/infra-aws-fedora.yaml b/tkn/infra-aws-fedora.yaml index 431347b6b..79de09b66 100644 --- a/tkn/infra-aws-fedora.yaml +++ b/tkn/infra-aws-fedora.yaml @@ -342,14 +342,14 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF if [[ "$(params.airgap)" == "true" ]]; then cat <> host-info.yaml - bastion-host: $(cat /opt/host-info/bastion_host | base64 -w0) - bastion-username: $(cat /opt/host-info/bastion_username | base64 -w0) + bastion-host: $(cat /opt/host-info/bastion_host | tr -d '\n\r' | base64 -w0) + bastion-username: $(cat /opt/host-info/bastion_username | tr -d '\n\r' | base64 -w0) bastion-id_rsa: $(cat /opt/host-info/bastion_id_rsa | base64 -w0) EOF fi diff --git a/tkn/infra-aws-mac.yaml b/tkn/infra-aws-mac.yaml index c5070af63..b378bf446 100644 --- a/tkn/infra-aws-mac.yaml +++ b/tkn/infra-aws-mac.yaml @@ -294,14 +294,14 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF if [[ $(params.airgap) == "true" ]]; then cat <> host-info.yaml - bastion-host: $(cat /opt/host-info/bastion_host | base64 -w0) - bastion-username: $(cat /opt/host-info/bastion_username | base64 -w0) + bastion-host: $(cat /opt/host-info/bastion_host | tr -d '\n\r' | base64 -w0) + bastion-username: $(cat /opt/host-info/bastion_username | tr -d '\n\r' | base64 -w0) bastion-id_rsa: $(cat /opt/host-info/bastion_id_rsa | base64 -w0) EOF fi diff --git a/tkn/infra-aws-rhel-ai.yaml b/tkn/infra-aws-rhel-ai.yaml index e62c3f606..dbe1bd04a 100644 --- a/tkn/infra-aws-rhel-ai.yaml +++ b/tkn/infra-aws-rhel-ai.yaml @@ -350,8 +350,8 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF diff --git a/tkn/infra-aws-rhel.yaml b/tkn/infra-aws-rhel.yaml index c56e2e7e8..f6284e2ef 100644 --- a/tkn/infra-aws-rhel.yaml +++ b/tkn/infra-aws-rhel.yaml @@ -368,14 +368,14 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF if [[ "$(params.airgap)" == "true" ]]; then cat <> host-info.yaml - bastion-host: $(cat /opt/host-info/bastion_host | base64 -w0) - bastion-username: $(cat /opt/host-info/bastion_username | base64 -w0) + bastion-host: $(cat /opt/host-info/bastion_host | tr -d '\n\r' | base64 -w0) + bastion-username: $(cat /opt/host-info/bastion_username | tr -d '\n\r' | base64 -w0) bastion-id_rsa: $(cat /opt/host-info/bastion_id_rsa | base64 -w0) EOF fi diff --git a/tkn/infra-aws-windows-server.yaml b/tkn/infra-aws-windows-server.yaml index f6e989e3c..efdbd969b 100644 --- a/tkn/infra-aws-windows-server.yaml +++ b/tkn/infra-aws-windows-server.yaml @@ -301,14 +301,14 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF if [[ $(params.airgap) == "true" ]]; then cat <> host-info.yaml - bastion-host: $(cat /opt/host-info/bastion_host | base64 -w0) - bastion-username: $(cat /opt/host-info/bastion_username | base64 -w0) + bastion-host: $(cat /opt/host-info/bastion_host | tr -d '\n\r' | base64 -w0) + bastion-username: $(cat /opt/host-info/bastion_username | tr -d '\n\r' | base64 -w0) bastion-id_rsa: $(cat /opt/host-info/bastion_id_rsa | base64 -w0) EOF fi diff --git a/tkn/infra-azure-fedora.yaml b/tkn/infra-azure-fedora.yaml index b0828aa18..f4b7bdef0 100644 --- a/tkn/infra-azure-fedora.yaml +++ b/tkn/infra-azure-fedora.yaml @@ -297,8 +297,8 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF diff --git a/tkn/infra-azure-rhel-ai.yaml b/tkn/infra-azure-rhel-ai.yaml index fd0e95392..23bbfab14 100644 --- a/tkn/infra-azure-rhel-ai.yaml +++ b/tkn/infra-azure-rhel-ai.yaml @@ -302,8 +302,8 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF diff --git a/tkn/infra-azure-rhel.yaml b/tkn/infra-azure-rhel.yaml index 17f1cadbd..4e8ae6f42 100644 --- a/tkn/infra-azure-rhel.yaml +++ b/tkn/infra-azure-rhel.yaml @@ -301,8 +301,8 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF diff --git a/tkn/infra-azure-windows-desktop.yaml b/tkn/infra-azure-windows-desktop.yaml index 77b9a2390..bbe0913a9 100644 --- a/tkn/infra-azure-windows-desktop.yaml +++ b/tkn/infra-azure-windows-desktop.yaml @@ -281,11 +281,11 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) userpassword: $(cat /opt/host-info/userpassword | base64 -w0) - adminusername: $(cat /opt/host-info/adminusername | base64 -w0) + adminusername: $(cat /opt/host-info/adminusername | tr -d '\n\r' | base64 -w0) adminuserpassword: $(cat /opt/host-info/adminuserpassword | base64 -w0) EOF diff --git a/tkn/template/infra-aws-fedora.yaml b/tkn/template/infra-aws-fedora.yaml index 08627de38..87a5db782 100644 --- a/tkn/template/infra-aws-fedora.yaml +++ b/tkn/template/infra-aws-fedora.yaml @@ -342,14 +342,14 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF if [[ "$(params.airgap)" == "true" ]]; then cat <> host-info.yaml - bastion-host: $(cat /opt/host-info/bastion_host | base64 -w0) - bastion-username: $(cat /opt/host-info/bastion_username | base64 -w0) + bastion-host: $(cat /opt/host-info/bastion_host | tr -d '\n\r' | base64 -w0) + bastion-username: $(cat /opt/host-info/bastion_username | tr -d '\n\r' | base64 -w0) bastion-id_rsa: $(cat /opt/host-info/bastion_id_rsa | base64 -w0) EOF fi diff --git a/tkn/template/infra-aws-mac.yaml b/tkn/template/infra-aws-mac.yaml index 2ff862b3c..7d08b6404 100644 --- a/tkn/template/infra-aws-mac.yaml +++ b/tkn/template/infra-aws-mac.yaml @@ -294,14 +294,14 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF if [[ $(params.airgap) == "true" ]]; then cat <> host-info.yaml - bastion-host: $(cat /opt/host-info/bastion_host | base64 -w0) - bastion-username: $(cat /opt/host-info/bastion_username | base64 -w0) + bastion-host: $(cat /opt/host-info/bastion_host | tr -d '\n\r' | base64 -w0) + bastion-username: $(cat /opt/host-info/bastion_username | tr -d '\n\r' | base64 -w0) bastion-id_rsa: $(cat /opt/host-info/bastion_id_rsa | base64 -w0) EOF fi diff --git a/tkn/template/infra-aws-rhel-ai.yaml b/tkn/template/infra-aws-rhel-ai.yaml index 4817c5006..8c9506712 100644 --- a/tkn/template/infra-aws-rhel-ai.yaml +++ b/tkn/template/infra-aws-rhel-ai.yaml @@ -350,8 +350,8 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF diff --git a/tkn/template/infra-aws-rhel.yaml b/tkn/template/infra-aws-rhel.yaml index cc33482a9..ec324fefc 100644 --- a/tkn/template/infra-aws-rhel.yaml +++ b/tkn/template/infra-aws-rhel.yaml @@ -368,14 +368,14 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF if [[ "$(params.airgap)" == "true" ]]; then cat <> host-info.yaml - bastion-host: $(cat /opt/host-info/bastion_host | base64 -w0) - bastion-username: $(cat /opt/host-info/bastion_username | base64 -w0) + bastion-host: $(cat /opt/host-info/bastion_host | tr -d '\n\r' | base64 -w0) + bastion-username: $(cat /opt/host-info/bastion_username | tr -d '\n\r' | base64 -w0) bastion-id_rsa: $(cat /opt/host-info/bastion_id_rsa | base64 -w0) EOF fi diff --git a/tkn/template/infra-aws-windows-server.yaml b/tkn/template/infra-aws-windows-server.yaml index 05ff00600..c3133efd9 100644 --- a/tkn/template/infra-aws-windows-server.yaml +++ b/tkn/template/infra-aws-windows-server.yaml @@ -301,14 +301,14 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF if [[ $(params.airgap) == "true" ]]; then cat <> host-info.yaml - bastion-host: $(cat /opt/host-info/bastion_host | base64 -w0) - bastion-username: $(cat /opt/host-info/bastion_username | base64 -w0) + bastion-host: $(cat /opt/host-info/bastion_host | tr -d '\n\r' | base64 -w0) + bastion-username: $(cat /opt/host-info/bastion_username | tr -d '\n\r' | base64 -w0) bastion-id_rsa: $(cat /opt/host-info/bastion_id_rsa | base64 -w0) EOF fi diff --git a/tkn/template/infra-azure-fedora.yaml b/tkn/template/infra-azure-fedora.yaml index 33d73892f..505ef19e6 100644 --- a/tkn/template/infra-azure-fedora.yaml +++ b/tkn/template/infra-azure-fedora.yaml @@ -297,8 +297,8 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF diff --git a/tkn/template/infra-azure-rhel-ai.yaml b/tkn/template/infra-azure-rhel-ai.yaml index b6f26bae1..874de569b 100644 --- a/tkn/template/infra-azure-rhel-ai.yaml +++ b/tkn/template/infra-azure-rhel-ai.yaml @@ -302,8 +302,8 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF diff --git a/tkn/template/infra-azure-rhel.yaml b/tkn/template/infra-azure-rhel.yaml index 1c761eb26..ec654509d 100644 --- a/tkn/template/infra-azure-rhel.yaml +++ b/tkn/template/infra-azure-rhel.yaml @@ -301,8 +301,8 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) EOF diff --git a/tkn/template/infra-azure-windows-desktop.yaml b/tkn/template/infra-azure-windows-desktop.yaml index 065587d05..350ede98e 100644 --- a/tkn/template/infra-azure-windows-desktop.yaml +++ b/tkn/template/infra-azure-windows-desktop.yaml @@ -281,11 +281,11 @@ spec: cat <> host-info.yaml type: Opaque data: - host: $(cat /opt/host-info/host | base64 -w0) - username: $(cat /opt/host-info/username | base64 -w0) + host: $(cat /opt/host-info/host | tr -d '\n\r' | base64 -w0) + username: $(cat /opt/host-info/username | tr -d '\n\r' | base64 -w0) id_rsa: $(cat /opt/host-info/id_rsa | base64 -w0) userpassword: $(cat /opt/host-info/userpassword | base64 -w0) - adminusername: $(cat /opt/host-info/adminusername | base64 -w0) + adminusername: $(cat /opt/host-info/adminusername | tr -d '\n\r' | base64 -w0) adminuserpassword: $(cat /opt/host-info/adminuserpassword | base64 -w0) EOF