Use Conjur API's built in JWT functions by szh · Pull Request #3771 · external-secrets/external-secrets

szh · 2024-08-07T16:16:03Z

Problem Statement & Proposed Changes

ESO makes direct request to Conjur's authn-jwt endpoint. Now that Conjur's Go API has better authn-jwt support, we should use the built-in NewClientFromJwt instead of overriding it.

Related Issue

CyberArk internal issue ID: CNJR-5634, CNJR-5635

Checklist

I have read the contribution guidelines
All commits are signed with git commit --signoff
My changes have reasonable test coverage
All tests pass with make test
I ensured my PR is ready for review with make reviewable

gusfcarvalho · 2024-08-08T09:49:25Z

hmm this one collides with a more general change on #3699 - better waiting for this one to be merged as CA injection would change anyways

szh · 2024-08-08T10:51:32Z

Ok. What's the ETA for that to be merged?

Skarlso · 2024-08-09T04:45:17Z

I'm on vacation for a couple days but once I'm back I'll make it my priority.

Skarlso · 2024-08-12T19:42:48Z

Back from vacation. I'll do this either tonight, or first thing tomorrow. 🫡

Skarlso · 2024-08-13T04:48:22Z

All done with the reviews yesterday. :)

szh · 2024-08-16T15:08:47Z

I've rebased and am ready for this to be reviewed. Thanks!

Skarlso · 2024-08-23T12:57:47Z

/ok-to-test sha=4ce59cf1c586158ca0b5ffe0f8aae82efe2db53f

Skarlso · 2024-08-23T14:33:24Z

@szh It seems something didn't quite work. The Conjur tests are failing with unauthorized.

conjur-8n8zk"***,"namespace":"e2e-tests-eso-conjur-8n8zk","name":"e2e-es","reconcileID":"1a53f225-b1bf-4cdf-b830-1e6f11797381","error":"error retrieving secret at .data[0], key: e2e-tests-eso-conjur-8n8zk-one, err: 401 Unauthorized. ","stacktrace":"sigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).reconcileHandler\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:316\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).processNextWorkItem\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:263\nsigs.k8s.io/controller-runtime/pkg/internal/controller.(*Controller[...]).Start.func2.2\n\t/home/runner/go/pkg/mod/sigs.k8s.io/controller-runtime@v0.19.0/pkg/internal/controller/controller.go:224"***
2024-08-23T13:04:30.9876896Z     ***"level":"info","ts":1724418252.4833565,"logger":"provider.aws","msg":"r***sing aws session","SecretStore":"irsa-mounted-e2e-tests-eso-aws-ps-rklfb","namespace":"e2e-tests-eso-aws-ps-rklfb","kind":"SecretStore","resourceversion":"2018"***
2024-08-23T13:04:30.9879664Z     ***"level":"info","ts":1724418252.483384,"logger":"provider.aws","msg":"using aws session","region":"***-central-1","external id":"","credentials":null***

szh · 2024-08-23T17:13:53Z

Hmm. I'm trying to run the e2e tests locally but I'm behind a corporate firewall and the normal snippet I add to Dockerfiles to have it recognize the corporate CA isn't working here...

ADD build_ca_certificate /usr/local/share/ca-certificates/
RUN update-ca-certificates

I'm still getting

> [builder 6/8] RUN go mod download:
16.95 go: github.com/Azure/azure-sdk-for-go@v68.0.0+incompatible: Get "https://storage.googleapis.com/proxy-golang-org-prod/751ff6e9130177f7-github.com:Azure:azure-sdk-for-go-v68.0.0+incompatible.zip?Expires=1724512121&GoogleAccessId=gcs-urlsigner-prod%40golang-modproxy.iam.gserviceaccount.com&Signature=bUEnWv1HkAgAZlX4p2ekdeAUTNZ5AymDY4lJGjeXo2x4drFrbc%2FYzt5d1tSySH7xhgLkaWokx0ogXyMQpfnZimnw6cU9s012E%2BR4gsrg4uxk8orCsdWFqmaqnBED8gKsYqTFfTqOAwCT%2FZoeP8HOVAxgep31olNm%2BycS4vN5rWKdBnLA2%2BLHpeQY57fP8tTjrq8vMjgy9%2BeLXlg3Xnc8nAIl9BJCy7EyzfWS%2FooxW5dJ3l3h9MigWle6iADfZ4Q9J6tjPECc6XECGNQNZM0YjTmzaYAvpGUIcNmgOzuiurWdRM4OdLMzAU3vpeuondr6MZRw%2BOSVi4JUyGXeMjj47w%3D%3D": tls: failed to verify certificate: x509: certificate signed by unknown authority
...

Skarlso · 2024-08-23T18:09:49Z

How did you try running it?

You can try running something like make test.e2e GINKGO_LABELS='conjur&&!managed' or something like that.

szh · 2024-08-23T20:18:41Z

Yeah that's what I'm doing. It's failing at go mod download in e2e\Dockerfile because of the corp proxy

Skarlso · 2024-08-26T10:26:33Z

Can you manually test it please, or something like that to see what's wrong?

szh · 2024-08-26T17:06:41Z

Can you manually test it please, or something like that to see what's wrong?

Stand by, I'm trying to debug this internally

szh · 2024-08-28T15:48:32Z

pkg/provider/conjur/client.go

+}
+
+func (c *Client) conjurClientFromJWT(ctx context.Context, config conjurapi.Config, prov *esv1beta1.ConjurProvider) (SecretsClient, error) {
+	config.AuthnType = "jwt"


Awfully embarrassing since I wrote both sides of this integration, but I'm glad I finally found it...
I also added a link to the newly published blog post as requested by @gusfcarvalho on Slack.
I'm going to rerun my local tests and then rebase this against main.

Nice, well done for figuring it out. :)

szh · 2024-08-28T16:26:40Z

Okie dokie, hopefully this will pass now

Signed-off-by: Shlomo Heigh <shlomo.heigh@cyberark.com>

sonarqubecloud · 2024-08-28T16:48:47Z

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud

Skarlso · 2024-08-28T19:10:20Z

/ok-to-test sha=b0ee49d842baf00a90b44cdad16a2d1c0a03a5d7

eso-service-account-app · 2024-08-28T19:42:39Z

[Bot] - ✅ e2e for b0ee49d842baf00a90b44cdad16a2d1c0a03a5d7 passed

Skarlso · 2024-08-28T19:52:55Z

Niceee, well done.

szh force-pushed the update-conjur-api branch 3 times, most recently from a1598ce to 54f8934 Compare August 7, 2024 16:24

szh marked this pull request as ready for review August 7, 2024 18:40

szh requested a review from a team as a code owner August 7, 2024 18:40

szh requested a review from knelasevero August 7, 2024 18:40

szh force-pushed the update-conjur-api branch 2 times, most recently from 9c38235 to 2251ea1 Compare August 8, 2024 14:56

szh force-pushed the update-conjur-api branch from 2251ea1 to 68184c7 Compare August 12, 2024 20:13

szh force-pushed the update-conjur-api branch 3 times, most recently from 28e3a59 to 5d92a42 Compare August 16, 2024 15:07

szh force-pushed the update-conjur-api branch from 5d92a42 to 4ce59cf Compare August 22, 2024 14:01

Skarlso self-assigned this Aug 22, 2024

szh force-pushed the update-conjur-api branch from 4ce59cf to 787d4db Compare August 28, 2024 15:47

szh commented Aug 28, 2024

View reviewed changes

szh force-pushed the update-conjur-api branch from 787d4db to 18ce2f0 Compare August 28, 2024 16:21

szh added 3 commits August 28, 2024 12:47

Use Conjur API's built in JWT functions

932493a

Signed-off-by: Shlomo Heigh <shlomo.heigh@cyberark.com>

docs: clarify that all Conjur types are supported

8005c8e

Signed-off-by: Shlomo Heigh <shlomo.heigh@cyberark.com>

docs: add link to Conjur blog post

b0ee49d

Signed-off-by: Shlomo Heigh <shlomo.heigh@cyberark.com>

szh force-pushed the update-conjur-api branch from 18ce2f0 to b0ee49d Compare August 28, 2024 16:48

Skarlso approved these changes Aug 28, 2024

View reviewed changes

Skarlso merged commit a1722cb into external-secrets:main Aug 28, 2024

szh deleted the update-conjur-api branch August 28, 2024 19:54

Uh oh!

Conversation

szh commented Aug 7, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Problem Statement & Proposed Changes

Related Issue

Checklist

Uh oh!

gusfcarvalho commented Aug 8, 2024

Uh oh!

szh commented Aug 8, 2024

Uh oh!

Skarlso commented Aug 9, 2024

Uh oh!

Skarlso commented Aug 12, 2024

Uh oh!

Skarlso commented Aug 13, 2024

Uh oh!

szh commented Aug 16, 2024

Uh oh!

Skarlso commented Aug 23, 2024

Uh oh!

Skarlso commented Aug 23, 2024

Uh oh!

szh commented Aug 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Skarlso commented Aug 23, 2024

Uh oh!

szh commented Aug 23, 2024

Uh oh!

Skarlso commented Aug 26, 2024

Uh oh!

szh commented Aug 26, 2024

Uh oh!

szh Aug 28, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Skarlso Aug 28, 2024

Choose a reason for hiding this comment

Uh oh!

szh commented Aug 28, 2024

Uh oh!

sonarqubecloud bot commented Aug 28, 2024

Quality Gate passed

Uh oh!

Skarlso commented Aug 28, 2024

Uh oh!

eso-service-account-app bot commented Aug 28, 2024

Uh oh!

Skarlso commented Aug 28, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

szh commented Aug 7, 2024 •

edited

Loading

szh commented Aug 23, 2024 •

edited

Loading

szh Aug 28, 2024 •

edited

Loading