Skip to content

Commit d6c555f

Browse files
committed
fixup! [RFC-0010] Add multi-tenancy lockdown for decryption and kubeconfig
Signed-off-by: cappyzawa <[email protected]>
1 parent af4701a commit d6c555f

File tree

4 files changed

+15
-9
lines changed

4 files changed

+15
-9
lines changed

go.mod

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,11 +24,11 @@ require (
2424
github.com/fluxcd/pkg/apis/event v0.18.0
2525
github.com/fluxcd/pkg/apis/kustomize v1.11.0
2626
github.com/fluxcd/pkg/apis/meta v1.18.0
27-
github.com/fluxcd/pkg/auth v0.25.0
27+
github.com/fluxcd/pkg/auth v0.26.0
2828
github.com/fluxcd/pkg/cache v0.10.0
2929
github.com/fluxcd/pkg/http/fetch v0.17.0
3030
github.com/fluxcd/pkg/kustomize v1.19.0
31-
github.com/fluxcd/pkg/runtime v0.72.0
31+
github.com/fluxcd/pkg/runtime v0.80.0
3232
github.com/fluxcd/pkg/ssa v0.51.0
3333
github.com/fluxcd/pkg/tar v0.13.0
3434
github.com/fluxcd/pkg/testserver v0.11.0

go.sum

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -199,8 +199,8 @@ github.com/fluxcd/pkg/apis/kustomize v1.11.0 h1:0IzDgxZkc4v+5SDNCvgZhfwfkdkQLPXC
199199
github.com/fluxcd/pkg/apis/kustomize v1.11.0/go.mod h1:j302mJGDww8cn9qvMsRQ0LJ1HPAPs/IlX7CSsoJV7BI=
200200
github.com/fluxcd/pkg/apis/meta v1.18.0 h1:ACHrMIjlcioE9GKS7NGk62KX4NshqNewr8sBwMcXABs=
201201
github.com/fluxcd/pkg/apis/meta v1.18.0/go.mod h1:97l3hTwBpJbXBY+wetNbqrUsvES8B1jGioKcBUxmqd8=
202-
github.com/fluxcd/pkg/auth v0.25.0 h1:q8iJ9vdADiJxNA7EKNgEbIXNGbgqqTz6u975ziI3omk=
203-
github.com/fluxcd/pkg/auth v0.25.0/go.mod h1:YEAHpBFuW5oLlH9ekuJaQdnJ2Q3A7Ny8kha3WY7QMnY=
202+
github.com/fluxcd/pkg/auth v0.26.0 h1:jw128zPI4aRSvkGbFfAQcFNF3oK58P4rDdKIpj2/7yM=
203+
github.com/fluxcd/pkg/auth v0.26.0/go.mod h1:YEAHpBFuW5oLlH9ekuJaQdnJ2Q3A7Ny8kha3WY7QMnY=
204204
github.com/fluxcd/pkg/cache v0.10.0 h1:M+OGDM4da1cnz7q+sZSBtkBJHpiJsLnKVmR9OdMWxEY=
205205
github.com/fluxcd/pkg/cache v0.10.0/go.mod h1:pPXRzQUDQagsCniuOolqVhnAkbNgYOg8d2cTliPs7ME=
206206
github.com/fluxcd/pkg/envsubst v1.4.0 h1:pYsb6wrmXOSfHXuXQHaaBBMt3LumhgCb8SMdBNAwV/U=
@@ -209,8 +209,8 @@ github.com/fluxcd/pkg/http/fetch v0.17.0 h1:U/Fuh+H1cRL2d/EOfdsjJPaPDPtL3pFanPSE
209209
github.com/fluxcd/pkg/http/fetch v0.17.0/go.mod h1:nMozZtiSKtPGwMrR5wGjIJoQmhvFqZ5P4UsM/Lqza2I=
210210
github.com/fluxcd/pkg/kustomize v1.19.0 h1:2eO8lMx0/H/Yyq35LMTAMhxEElOzMW0Yi9zUNZoimlU=
211211
github.com/fluxcd/pkg/kustomize v1.19.0/go.mod h1:OCCW9vU3lStDh3jyg9MM/a29MSdNAVk2wjl0lDos5Fs=
212-
github.com/fluxcd/pkg/runtime v0.72.0 h1:9JCto84iL2FziuTuuvDwvS+cfIzGhHOk25y8ulXpNOs=
213-
github.com/fluxcd/pkg/runtime v0.72.0/go.mod h1:iGhdaEq+lMJQTJNAFEPOU4gUJ7kt3yeDcJPZy7O9IUw=
212+
github.com/fluxcd/pkg/runtime v0.80.0 h1:vknT2vdQSGTFnAhz4xGk2ZXUWCrXh3whsISStgA57Go=
213+
github.com/fluxcd/pkg/runtime v0.80.0/go.mod h1:iGhdaEq+lMJQTJNAFEPOU4gUJ7kt3yeDcJPZy7O9IUw=
214214
github.com/fluxcd/pkg/sourceignore v0.13.0 h1:ZvkzX2WsmyZK9cjlqOFFW1onHVzhPZIqDbCh96rPqbU=
215215
github.com/fluxcd/pkg/sourceignore v0.13.0/go.mod h1:Z9H1GoBx0ljOhptnzoV0PL6Nd/UzwKcSphP27lqb4xI=
216216
github.com/fluxcd/pkg/ssa v0.51.0 h1:sFarxKZcS0J8sjq9qvs/r+1XiJqNgRodEiPjV75F8R4=

internal/controller/kustomization_configuration_error_test.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,8 @@ data: {}
178178
t.Run("object level workload identity feature gate enabled", func(t *testing.T) {
179179
g := NewWithT(t)
180180

181-
t.Setenv(auth.EnvEnableObjectLevelWorkloadIdentity, "true")
181+
auth.EnableObjectLevelWorkloadIdentity()
182+
t.Cleanup(func() { auth.DisableObjectLevelWorkloadIdentity() })
182183

183184
kustomizationKey := types.NamespacedName{
184185
Name: fmt.Sprintf("invalid-config-%s", randStringRunes(5)),

internal/decryptor/decryptor.go

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -320,8 +320,13 @@ func (d *Decryptor) SetAuthOptions(ctx context.Context) {
320320

321321
opts = append(opts, auth.WithClient(d.client))
322322
opts = append(opts, auth.WithServiceAccountNamespace(d.kustomization.GetNamespace()))
323-
if d.kustomization.Spec.Decryption.ServiceAccountName != "" {
324-
opts = append(opts, auth.WithServiceAccountName(d.kustomization.Spec.Decryption.ServiceAccountName))
323+
324+
saName := d.kustomization.Spec.Decryption.ServiceAccountName
325+
if saName == "" {
326+
saName = auth.GetDefaultDecryptionServiceAccount()
327+
}
328+
if saName != "" {
329+
opts = append(opts, auth.WithServiceAccountName(saName))
325330
}
326331

327332
involvedObject := cache.InvolvedObject{

0 commit comments

Comments
 (0)