Skip to content

Commit 690c5ec

Browse files
vishalbolluvishalbollu
authored
Improve credentials transparency for cluster commands(#1378)
1 parent 50c9bd9 commit 690c5ec

File tree

16 files changed

+399
-204
lines changed

16 files changed

+399
-204
lines changed

‎cli/cmd/cluster.go‎

Lines changed: 66 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -47,36 +47,46 @@ import (
4747
)
4848

4949
var (
50-
_flagClusterEnv string
51-
_flagClusterConfig string
52-
_flagClusterInfoDebug bool
53-
_flagClusterDisallowPrompt bool
50+
_flagClusterEnv string
51+
_flagClusterConfig string
52+
_flagClusterInfoDebug bool
53+
_flagClusterDisallowPrompt bool
54+
_flagAWSAccessKeyID string
55+
_flagAWSSecretAccessKey string
56+
_flagClusterAWSAccessKeyID string
57+
_flagClusterAWSSecretAccessKey string
5458
)
5559

5660
func clusterInit() {
5761
defaultEnv := getDefaultEnv(_clusterCommandType)
5862

5963
_upCmd.Flags().SortFlags = false
6064
addClusterConfigFlag(_upCmd)
61-
_upCmd.Flags().StringVarP(&_flagClusterEnv, "env", "e", defaultEnv, "environment to configure")
65+
addAWSCredentials(_upCmd)
66+
_upCmd.Flags().StringVar(&_flagClusterAWSAccessKeyID, "cluster-aws-key", "", "aws access key id to be used by the cluster")
67+
_upCmd.Flags().StringVar(&_flagClusterAWSSecretAccessKey, "cluster-aws-secret", "", "aws secret access key to be used by the cluster")
68+
_upCmd.Flags().StringVarP(&_flagClusterEnv, "env", "e", defaultEnv, "environment to create")
6269
_upCmd.Flags().BoolVarP(&_flagClusterDisallowPrompt, "yes", "y", false, "skip prompts")
6370
_clusterCmd.AddCommand(_upCmd)
6471

6572
_infoCmd.Flags().SortFlags = false
6673
addClusterConfigFlag(_infoCmd)
67-
_infoCmd.Flags().StringVarP(&_flagClusterEnv, "env", "e", defaultEnv, "environment to configure")
74+
addAWSCredentials(_infoCmd)
75+
_infoCmd.Flags().StringVarP(&_flagClusterEnv, "env", "e", defaultEnv, "environment to update")
6876
_infoCmd.Flags().BoolVarP(&_flagClusterInfoDebug, "debug", "d", false, "save the current cluster state to a file")
6977
_infoCmd.Flags().BoolVarP(&_flagClusterDisallowPrompt, "yes", "y", false, "skip prompts")
7078
_clusterCmd.AddCommand(_infoCmd)
7179

7280
_configureCmd.Flags().SortFlags = false
7381
addClusterConfigFlag(_configureCmd)
74-
_configureCmd.Flags().StringVarP(&_flagClusterEnv, "env", "e", defaultEnv, "environment to configure")
82+
addAWSCredentials(_configureCmd)
83+
_configureCmd.Flags().StringVarP(&_flagClusterEnv, "env", "e", defaultEnv, "environment to update")
7584
_configureCmd.Flags().BoolVarP(&_flagClusterDisallowPrompt, "yes", "y", false, "skip prompts")
7685
_clusterCmd.AddCommand(_configureCmd)
7786

7887
_downCmd.Flags().SortFlags = false
7988
addClusterConfigFlag(_downCmd)
89+
addAWSCredentials(_downCmd)
8090
_downCmd.Flags().BoolVarP(&_flagClusterDisallowPrompt, "yes", "y", false, "skip prompts")
8191
_clusterCmd.AddCommand(_downCmd)
8292
}
@@ -86,6 +96,11 @@ func addClusterConfigFlag(cmd *cobra.Command) {
8696
cmd.Flags().SetAnnotation("config", cobra.BashCompFilenameExt, _configFileExts)
8797
}
8898

99+
func addAWSCredentials(cmd *cobra.Command) {
100+
cmd.Flags().StringVar(&_flagAWSAccessKeyID, "aws-key", "", "aws access key id")
101+
cmd.Flags().StringVar(&_flagAWSSecretAccessKey, "aws-secret", "", "aws secret access key")
102+
}
103+
89104
var _clusterCmd = &cobra.Command{
90105
Use: "cluster",
91106
Short: "manage a cluster",
@@ -110,7 +125,14 @@ var _upCmd = &cobra.Command{
110125
promptForEmail()
111126
}
112127

113-
awsCreds, err := getAWSCredentials(_flagClusterConfig, _flagClusterEnv, _flagClusterDisallowPrompt)
128+
if _flagClusterConfig != "" {
129+
// Deprecation: specifying aws creds in cluster configuration is no longer supported
130+
if err := detectAWSCredsInConfigFile(cmd.Use, _flagClusterConfig); err != nil {
131+
exit.Error(err)
132+
}
133+
}
134+
135+
awsCreds, err := awsCredentialsForCreatingCluster(_flagClusterDisallowPrompt)
114136
if err != nil {
115137
exit.Error(err)
116138
}
@@ -254,15 +276,17 @@ var _upCmd = &cobra.Command{
254276
Name: _flagClusterEnv,
255277
Provider: types.AWSProviderType,
256278
OperatorEndpoint: pointer.String("https://" + *loadBalancer.DNSName),
257-
AWSAccessKeyID: pointer.String(awsCreds.CortexAWSAccessKeyID),
258-
AWSSecretAccessKey: pointer.String(awsCreds.CortexAWSSecretAccessKey),
279+
AWSAccessKeyID: pointer.String(awsCreds.ClusterAWSAccessKeyID),
280+
AWSSecretAccessKey: pointer.String(awsCreds.ClusterAWSSecretAccessKey),
259281
}
260282

261283
err = addEnvToCLIConfig(newEnvironment)
262284
if err != nil {
263285
exit.Error(errors.Append(err, fmt.Sprintf("unable to configure cli environment; you can attempt to resolve this issue and configure your CLI environment by running `cortex cluster info --env %s`", _flagClusterEnv)))
264286
}
265287

288+
cacheAWSCredentials(awsCreds, accessConfig)
289+
266290
fmt.Printf(console.Bold("\nan environment named \"%s\" has been configured for this cluster; append `--env %s` to cortex commands to connect to it (e.g. `cortex deploy --env %s`), or set it as your default with `cortex env default %s`\n"), _flagClusterEnv, _flagClusterEnv, _flagClusterEnv, _flagClusterEnv)
267291
},
268292
}
@@ -282,12 +306,19 @@ var _configureCmd = &cobra.Command{
282306
exit.Error(err)
283307
}
284308

285-
awsCreds, err := getAWSCredentials(_flagClusterConfig, _flagClusterEnv, _flagClusterDisallowPrompt)
309+
if _flagClusterConfig != "" {
310+
// Deprecation: specifying aws creds in cluster configuration is no longer supported
311+
if err := detectAWSCredsInConfigFile(cmd.Use, _flagClusterConfig); err != nil {
312+
exit.Error(err)
313+
}
314+
}
315+
316+
accessConfig, err := getClusterAccessConfig(_flagClusterDisallowPrompt)
286317
if err != nil {
287318
exit.Error(err)
288319
}
289320

290-
accessConfig, err := getClusterAccessConfig(_flagClusterDisallowPrompt)
321+
awsCreds, err := awsCredentialsForManagingCluster(*accessConfig, _flagClusterDisallowPrompt)
291322
if err != nil {
292323
exit.Error(err)
293324
}
@@ -324,6 +355,8 @@ var _configureCmd = &cobra.Command{
324355
fmt.Println(helpStr)
325356
exit.Error(ErrorClusterConfigure(out + helpStr))
326357
}
358+
359+
cacheAWSCredentials(awsCreds, *accessConfig)
327360
},
328361
}
329362

@@ -341,12 +374,19 @@ var _infoCmd = &cobra.Command{
341374
exit.Error(err)
342375
}
343376

344-
awsCreds, err := getAWSCredentials(_flagClusterConfig, _flagClusterEnv, _flagClusterDisallowPrompt)
377+
if _flagClusterConfig != "" {
378+
// Deprecation: specifying aws creds in cluster configuration is no longer supported
379+
if err := detectAWSCredsInConfigFile(cmd.Use, _flagClusterConfig); err != nil {
380+
exit.Error(err)
381+
}
382+
}
383+
384+
accessConfig, err := getClusterAccessConfig(_flagClusterDisallowPrompt)
345385
if err != nil {
346386
exit.Error(err)
347387
}
348388

349-
accessConfig, err := getClusterAccessConfig(_flagClusterDisallowPrompt)
389+
awsCreds, err := awsCredentialsForManagingCluster(*accessConfig, _flagClusterDisallowPrompt)
350390
if err != nil {
351391
exit.Error(err)
352392
}
@@ -356,6 +396,8 @@ var _infoCmd = &cobra.Command{
356396
} else {
357397
cmdInfo(awsCreds, accessConfig, _flagClusterDisallowPrompt)
358398
}
399+
400+
cacheAWSCredentials(awsCreds, *accessConfig)
359401
},
360402
}
361403

@@ -370,12 +412,19 @@ var _downCmd = &cobra.Command{
370412
exit.Error(err)
371413
}
372414

373-
awsCreds, err := getAWSCredentials(_flagClusterConfig, _flagClusterEnv, _flagClusterDisallowPrompt)
415+
if _flagClusterConfig != "" {
416+
// Deprecation: specifying aws creds in cluster configuration is no longer supported
417+
if err := detectAWSCredsInConfigFile(cmd.Use, _flagClusterConfig); err != nil {
418+
exit.Error(err)
419+
}
420+
}
421+
422+
accessConfig, err := getClusterAccessConfig(_flagClusterDisallowPrompt)
374423
if err != nil {
375424
exit.Error(err)
376425
}
377426

378-
accessConfig, err := getClusterAccessConfig(_flagClusterDisallowPrompt)
427+
awsCreds, err := awsCredentialsForManagingCluster(*accessConfig, _flagClusterDisallowPrompt)
379428
if err != nil {
380429
exit.Error(err)
381430
}
@@ -480,6 +529,7 @@ var _downCmd = &cobra.Command{
480529

481530
cachedClusterConfigPath := cachedClusterConfigPath(*accessConfig.ClusterName, *accessConfig.Region)
482531
os.Remove(cachedClusterConfigPath)
532+
uncacheAWSCredentials(*accessConfig)
483533
},
484534
}
485535

‎cli/cmd/errors.go‎

Lines changed: 25 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -58,14 +58,16 @@ const (
5858
ErrAPINotReady = "cli.api_not_ready"
5959
ErrOneAWSEnvVarSet = "cli.one_aws_env_var_set"
6060
ErrOneAWSConfigFieldSet = "cli.one_aws_config_field_set"
61+
ErrOneAWSConfigFlagSet = "cli.one_aws_config_flag_set"
62+
ErrMissingAWSCredentials = "cli.missing_aws_credentials"
63+
ErrCredentialsInClusterConfig = "cli.credentials_in_cluster_config"
6164
ErrClusterUp = "cli.cluster_up"
6265
ErrClusterConfigure = "cli.cluster_configure"
6366
ErrClusterInfo = "cli.cluster_info"
6467
ErrClusterDebug = "cli.cluster_debug"
6568
ErrClusterRefresh = "cli.cluster_refresh"
6669
ErrClusterDown = "cli.cluster_down"
6770
ErrDuplicateCLIEnvNames = "cli.duplicate_cli_env_names"
68-
ErrAWSCredentialsRequired = "cli.aws_credentials_required"
6971
ErrClusterConfigOrPromptsRequired = "cli.cluster_config_or_prompts_required"
7072
ErrClusterAccessConfigOrPromptsRequired = "cli.cluster_access_config_or_prompts_required"
7173
ErrShellCompletionNotSupported = "cli.shell_completion_not_supported"
@@ -213,6 +215,28 @@ func ErrorOneAWSConfigFieldSet(setConfigField string, missingConfigField string,
213215
})
214216
}
215217

218+
func ErrorOneAWSFlagSet(setFlag string, missingFlag string) error {
219+
return errors.WithStack(&errors.Error{
220+
Kind: ErrOneAWSConfigFlagSet,
221+
Message: fmt.Sprintf("only flag %s was provided; please provide %s as well", setFlag, missingFlag),
222+
})
223+
}
224+
225+
func ErrorMissingAWSCredentials() error {
226+
return errors.WithStack(&errors.Error{
227+
Kind: ErrMissingAWSCredentials,
228+
Message: "unable to find aws credentials; please specify aws credentials using the flags --aws-key and --aws-secret",
229+
})
230+
}
231+
232+
// Deprecation: specifying aws creds in cluster configuration is no longer supported
233+
func ErrorCredentialsInClusterConfig(cmd string, path string) error {
234+
return errors.WithStack(&errors.Error{
235+
Kind: ErrCredentialsInClusterConfig,
236+
Message: fmt.Sprintf("specifying credentials in the cluster configuration is no longer supported, please specify aws credentials using flags (e.g. cortex cluster %s --config %s --aws-key <AWS_ACCESS_KEY_ID> --aws-secret <AWS_SECRET_ACCESS_KEY>) or set environment variables; see https://docs.cortex.dev/v/%s/miscellaneous/security#iam-permissions for more information", cmd, path, consts.CortexVersionMinor),
237+
})
238+
}
239+
216240
func ErrorClusterUp(out string) error {
217241
return errors.WithStack(&errors.Error{
218242
Kind: ErrClusterUp,
@@ -261,13 +285,6 @@ func ErrorClusterDown(out string) error {
261285
})
262286
}
263287

264-
func ErrorAWSCredentialsRequired() error {
265-
return errors.WithStack(&errors.Error{
266-
Kind: ErrAWSCredentialsRequired,
267-
Message: "AWS credentials are required; please set them in your cluster configuration file (if you're using one), your environment variables (i.e. AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY), or your AWS CLI (i.e. via `aws configure`)",
268-
})
269-
}
270-
271288
func ErrorClusterConfigOrPromptsRequired() error {
272289
return errors.WithStack(&errors.Error{
273290
Kind: ErrClusterConfigOrPromptsRequired,

0 commit comments

Comments
 (0)