Maidn/maidn-cli
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

fix: parse provisioned identity tokens

Browse source
This commit is contained in:
eding 2026-09-13 11:47:20 +02:00
parent 20381ebddf
commit 1bca082c77
2 changed files with 5 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
internal/openbao/bootstrap.go
View file

@ -447,8 +447,8 @@ path "secret/metadata/apps/` + app + `/E2E_PROBE" { capabilities = ["read", "del
EOF EOF
bao policy write maidn-app-secret-admin /tmp/maidn-app-secret-admin.hcl >/dev/null bao policy write maidn-app-secret-admin /tmp/maidn-app-secret-admin.hcl >/dev/null
bao policy write maidn-e2e-` + app + ` /tmp/maidn-e2e.hcl >/dev/null bao policy write maidn-e2e-` + app + ` /tmp/maidn-e2e.hcl >/dev/null
bao token create -orphan -policy=maidn-app-secret-admin -ttl=1h -explicit-max-ttl=1h -format=json bao token create -orphan -policy=maidn-app-secret-admin -ttl=1h -explicit-max-ttl=1h -format=json | base64 | tr -d '\n'; printf '\n'
bao token create -orphan -policy=maidn-e2e-` + app + ` -ttl=1h -explicit-max-ttl=1h -format=json bao token create -orphan -policy=maidn-e2e-` + app + ` -ttl=1h -explicit-max-ttl=1h -format=json | base64 | tr -d '\n'; printf '\n'
rm -f /tmp/maidn-app-secret-admin.hcl /tmp/maidn-e2e.hcl` rm -f /tmp/maidn-app-secret-admin.hcl /tmp/maidn-e2e.hcl`
output, err := execInPodMutation(kubeconfig, []byte(material.RootToken+"\n"), "sh", "-ec", script) output, err := execInPodMutation(kubeconfig, []byte(material.RootToken+"\n"), "sh", "-ec", script)
if err != nil { if err != nil {
@ -465,7 +465,8 @@ rm -f /tmp/maidn-app-secret-admin.hcl /tmp/maidn-e2e.hcl`
ClientToken string `json:"client_token"` ClientToken string `json:"client_token"`
} `json:"auth"` } `json:"auth"`
} }
if err := json.Unmarshal(line, &response); err != nil || response.Auth.ClientToken == "" { decoded, err := base64.StdEncoding.DecodeString(string(line))
if err != nil || json.Unmarshal(decoded, &response) != nil || response.Auth.ClientToken == "" {
return AppSecretIdentityTokens{}, errors.New("parse provisioned app-secret identity") return AppSecretIdentityTokens{}, errors.New("parse provisioned app-secret identity")
} }
responses = append(responses, response) responses = append(responses, response)

2
internal/openbao/bootstrap_test.go
View file

@ -194,7 +194,7 @@ func TestProvisionAppSecretIdentitiesScopesFixtureWithoutRootLeak(t *testing.T)
if string(input) != "root-token\n" || !strings.Contains(command, `secret/data/apps/maidn-e2e-web/E2E_PROBE`) || strings.Contains(command, `secret/data/apps/maidn-e2e-web/*`) { if string(input) != "root-token\n" || !strings.Contains(command, `secret/data/apps/maidn-e2e-web/E2E_PROBE`) || strings.Contains(command, `secret/data/apps/maidn-e2e-web/*`) {
t.Fatal("fixture identity policy scope is incorrect") t.Fatal("fixture identity policy scope is incorrect")
} }
return []byte("{\"auth\":{\"client_token\":\"admin-token\"}}\n{\"auth\":{\"client_token\":\"e2e-token\"}}\n"), nil return []byte("eyJhdXRoIjp7ImNsaWVudF90b2tlbiI6ImFkbWluLXRva2VuIn19\neyJhdXRoIjp7ImNsaWVudF90b2tlbiI6ImUyZS10b2tlbiJ9fQ==\n"), nil
} }
tokens, err := ProvisionAppSecretIdentities("kubeconfig", "identity", "bundle", "maidn-e2e-web") tokens, err := ProvisionAppSecretIdentities("kubeconfig", "identity", "bundle", "maidn-e2e-web")
if err != nil || tokens.Admin != "admin-token" || tokens.E2E != "e2e-token" { if err != nil || tokens.Admin != "admin-token" || tokens.E2E != "e2e-token" {