-
Notifications
You must be signed in to change notification settings - Fork 1
Merge 1.2.3 to main #78
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -688,13 +688,25 @@ private JobResult HandleRemove(string secretType, ManagementJobConfiguration con | |
| var splitAlias = certAlias.Split("/"); | ||
| if (Capability.Contains("K8SNS")) | ||
| { | ||
| if (splitAlias.Length < 2) | ||
| { | ||
| var errMsg = $"Invalid alias format for K8SNS store type. Expected pattern: 'secrets/<tls|opaque>/<secret_name>' but got '{certAlias}'"; | ||
| Logger.LogError(errMsg); | ||
| return FailJob(errMsg, config.JobHistoryId); | ||
| } | ||
| // Split alias by / and get second to last element KubeSecretType | ||
| KubeSecretType = splitAlias[^2]; | ||
| KubeSecretName = splitAlias[^1]; | ||
| if (string.IsNullOrEmpty(KubeNamespace)) KubeNamespace = StorePath; | ||
| } | ||
| else if (Capability.Contains("K8SCluster")) | ||
| { | ||
| if (splitAlias.Length < 3) | ||
| { | ||
| var errMsg = $"Invalid alias format for K8SCluster store type. Expected pattern: '<namespace>/secrets/<tls|opaque>/<secret_name>' but got '{certAlias}'"; | ||
| Logger.LogError(errMsg); | ||
| return FailJob(errMsg, config.JobHistoryId); | ||
| } | ||
| KubeSecretType = splitAlias[^2]; | ||
| KubeSecretName = splitAlias[^1]; | ||
| KubeNamespace = splitAlias[0]; | ||
|
Comment on lines
+704
to
712
|
||
|
|
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The validation for the K8SNS remove alias is too lenient for the format described in the error message. With the documented pattern
secrets/<tls|opaque>/<secret_name>,splitAlias.Lengthmust be at least 3 (and ideally also validate the fixedsecretssegment) before indexing[^2]/[^1]; otherwise aliases liketls/mysecretwill be treated as valid and can lead to removing the wrong secret.