diff --git a/api/k8s/application/k8sApplicationRestHandler.go b/api/k8s/application/k8sApplicationRestHandler.go index 6dc8b061a7..087676758e 100644 --- a/api/k8s/application/k8sApplicationRestHandler.go +++ b/api/k8s/application/k8sApplicationRestHandler.go @@ -203,8 +203,8 @@ func (handler *K8sApplicationRestHandlerImpl) GetResource(w http.ResponseWriter, common.WriteJsonResp(w, err, resource, http.StatusInternalServerError) return } - if resource != nil { - err = resource.SetRunningEphemeralContainers() + if resource != nil && resource.ManifestResponse != nil { + err = resource.ManifestResponse.SetRunningEphemeralContainers() if err != nil { handler.logger.Errorw("error in setting running ephemeral containers and setting them in resource response", "err", err) common.WriteJsonResp(w, err, resource, http.StatusInternalServerError) @@ -216,10 +216,10 @@ func (handler *K8sApplicationRestHandlerImpl) GetResource(w http.ResponseWriter, // Obfuscate secret if user does not have edit access if request.AppIdentifier == nil && request.DevtronAppIdentifier == nil && request.ClusterId > 0 { // Verify update access for Resource Browser - canUpdate = handler.k8sApplicationService.ValidateClusterResourceBean(r.Context(), request.ClusterId, resource.Manifest, request.K8sRequest.ResourceIdentifier.GroupVersionKind, handler.getRbacCallbackForResource(token, casbin.ActionUpdate)) + canUpdate = handler.k8sApplicationService.ValidateClusterResourceBean(r.Context(), request.ClusterId, resource.ManifestResponse.Manifest, request.K8sRequest.ResourceIdentifier.GroupVersionKind, handler.getRbacCallbackForResource(token, casbin.ActionUpdate)) if !canUpdate { // Verify read access for Resource Browser - readAllowed := handler.k8sApplicationService.ValidateClusterResourceBean(r.Context(), request.ClusterId, resource.Manifest, request.K8sRequest.ResourceIdentifier.GroupVersionKind, handler.getRbacCallbackForResource(token, casbin.ActionGet)) + readAllowed := handler.k8sApplicationService.ValidateClusterResourceBean(r.Context(), request.ClusterId, resource.ManifestResponse.Manifest, request.K8sRequest.ResourceIdentifier.GroupVersionKind, handler.getRbacCallbackForResource(token, casbin.ActionGet)) if !readAllowed { common.WriteJsonResp(w, errors2.New("unauthorized"), nil, http.StatusForbidden) return @@ -228,14 +228,16 @@ func (handler *K8sApplicationRestHandlerImpl) GetResource(w http.ResponseWriter, } if !canUpdate && resource != nil { // Hide secret for read only access - modifiedManifest, err := k8sObjectsUtil.HideValuesIfSecret(&resource.Manifest) + modifiedManifest, err := k8sObjectsUtil.HideValuesIfSecret(&resource.ManifestResponse.Manifest) if err != nil { handler.logger.Errorw("error in hiding secret values", "err", err) common.WriteJsonResp(w, err, nil, http.StatusInternalServerError) return } - resource.Manifest = *modifiedManifest + resource.ManifestResponse.Manifest = *modifiedManifest } + // setting flag for secret view access only for resource browser + resource.SecretViewAccess = canUpdate common.WriteJsonResp(w, nil, resource, http.StatusOK) } diff --git a/pkg/clusterTerminalAccess/UserTerminalAccessService.go b/pkg/clusterTerminalAccess/UserTerminalAccessService.go index 74b0abfae2..ab8af5c6c1 100644 --- a/pkg/clusterTerminalAccess/UserTerminalAccessService.go +++ b/pkg/clusterTerminalAccess/UserTerminalAccessService.go @@ -838,7 +838,7 @@ func (impl *UserTerminalAccessServiceImpl) getPodManifest(ctx context.Context, c return nil, err } } - return response, nil + return response.ManifestResponse, nil } func (impl *UserTerminalAccessServiceImpl) getPodRequestBean(clusterId int, podName string, namespace string) (*k8s.ResourceRequestBean, error) { @@ -1130,7 +1130,7 @@ func (impl *UserTerminalAccessServiceImpl) EditTerminalPodManifest(ctx context.C func (impl *UserTerminalAccessServiceImpl) checkOtherPodExists(ctx context.Context, podName, namespace string, clusterId int) bool { podRequestBean, _ := impl.getPodRequestBean(clusterId, podName, namespace) res, _ := impl.K8sCommonService.GetResource(ctx, podRequestBean) - if res != nil { + if res != nil && res.ManifestResponse != nil { return true } return false diff --git a/pkg/k8s/K8sCommonService.go b/pkg/k8s/K8sCommonService.go index 14ce73748b..1549b71e6e 100644 --- a/pkg/k8s/K8sCommonService.go +++ b/pkg/k8s/K8sCommonService.go @@ -27,7 +27,7 @@ import ( ) type K8sCommonService interface { - GetResource(ctx context.Context, request *ResourceRequestBean) (resp *k8s.ManifestResponse, err error) + GetResource(ctx context.Context, request *ResourceRequestBean) (resp *ResourceGetResponse, err error) UpdateResource(ctx context.Context, request *ResourceRequestBean) (resp *k8s.ManifestResponse, err error) DeleteResource(ctx context.Context, request *ResourceRequestBean) (resp *k8s.ManifestResponse, err error) ListEvents(ctx context.Context, request *ResourceRequestBean) (*k8s.EventsResponse, error) @@ -65,7 +65,7 @@ func NewK8sCommonServiceImpl(Logger *zap.SugaredLogger, k8sUtils *k8s.K8sService } } -func (impl *K8sCommonServiceImpl) GetResource(ctx context.Context, request *ResourceRequestBean) (*k8s.ManifestResponse, error) { +func (impl *K8sCommonServiceImpl) GetResource(ctx context.Context, request *ResourceRequestBean) (*ResourceGetResponse, error) { clusterId := request.ClusterId //getting rest config by clusterId restConfig, err, _ := impl.GetRestConfigByClusterId(ctx, clusterId) @@ -79,7 +79,10 @@ func (impl *K8sCommonServiceImpl) GetResource(ctx context.Context, request *Reso impl.logger.Errorw("error in getting resource", "err", err, "resource", resourceIdentifier.Name) return nil, err } - return resp, nil + response := &ResourceGetResponse{ + ManifestResponse: resp, + } + return response, nil } func (impl *K8sCommonServiceImpl) UpdateResource(ctx context.Context, request *ResourceRequestBean) (*k8s.ManifestResponse, error) { @@ -292,7 +295,11 @@ func (impl *K8sCommonServiceImpl) getManifestsByBatch(ctx context.Context, reque wg.Add(1) go func(j int) { resp := BatchResourceResponse{} - resp.ManifestResponse, resp.Err = impl.GetResource(ctx, &requests[i+j]) + response, err := impl.GetResource(ctx, &requests[i+j]) + if response != nil { + resp.ManifestResponse = response.ManifestResponse + } + resp.Err = err res[i+j] = resp wg.Done() }(j) diff --git a/pkg/k8s/application/k8sApplicationService.go b/pkg/k8s/application/k8sApplicationService.go index 99e4771dd7..a8811a35f0 100644 --- a/pkg/k8s/application/k8sApplicationService.go +++ b/pkg/k8s/application/k8sApplicationService.go @@ -338,7 +338,7 @@ func (impl *K8sApplicationServiceImpl) ValidateClusterResourceRequest(ctx contex impl.logger.Errorw("error in getting resource", "err", err, "request", clusterResourceRequest) return false, err } - return impl.validateResourceManifest(clusterName, respManifest.Manifest, k8sRequest.ResourceIdentifier.GroupVersionKind, rbacCallback), nil + return impl.validateResourceManifest(clusterName, respManifest.ManifestResponse.Manifest, k8sRequest.ResourceIdentifier.GroupVersionKind, rbacCallback), nil } func (impl *K8sApplicationServiceImpl) validateResourceManifest(clusterName string, resourceManifest unstructured.Unstructured, gvk schema.GroupVersionKind, rbacCallback func(clusterName string, resourceIdentifier k8s2.ResourceIdentifier) bool) bool { diff --git a/pkg/k8s/bean.go b/pkg/k8s/bean.go index 23229ceaf4..61edcd2f57 100644 --- a/pkg/k8s/bean.go +++ b/pkg/k8s/bean.go @@ -35,3 +35,8 @@ type PodContainerList struct { InitContainers []string EphemeralContainers []string } + +type ResourceGetResponse struct { + ManifestResponse *k8s.ManifestResponse `json:"manifestResponse"` + SecretViewAccess bool `json:"secretViewAccess"` // imp: only for resource browser, this is being used to check whether a user can see obscured secret values or not. +} diff --git a/pkg/k8s/capacity/k8sCapacityService.go b/pkg/k8s/capacity/k8sCapacityService.go index 8be2dcd925..1d40147f04 100644 --- a/pkg/k8s/capacity/k8sCapacityService.go +++ b/pkg/k8s/capacity/k8sCapacityService.go @@ -472,12 +472,12 @@ func (impl *K8sCapacityServiceImpl) updateManifestData(ctx context.Context, node K8sRequest: manifestRequest, ClusterId: clusterId, } - manifestResponse, err := impl.k8sCommonService.GetResource(ctx, request) + response, err := impl.k8sCommonService.GetResource(ctx, request) if err != nil { impl.logger.Errorw("error in getting node manifest", "err", err) return err } - nodeDetail.Manifest = manifestResponse.Manifest + nodeDetail.Manifest = response.ManifestResponse.Manifest return nil } diff --git a/pkg/pipeline/WorkflowDagExecutor.go b/pkg/pipeline/WorkflowDagExecutor.go index 385c5add35..9e200f06f6 100644 --- a/pkg/pipeline/WorkflowDagExecutor.go +++ b/pkg/pipeline/WorkflowDagExecutor.go @@ -4525,7 +4525,7 @@ func (impl *WorkflowDagExecutorImpl) autoscalingCheckBeforeTrigger(ctx context.C impl.logger.Errorw("error occurred while fetching resource for app", "resourceName", hpaResourceRequest.ResourceName, "err", err) return merged } - resourceManifest = k8sResource.Manifest.Object + resourceManifest = k8sResource.ManifestResponse.Manifest.Object } if len(resourceManifest) > 0 { statusMap := resourceManifest["status"].(map[string]interface{}) diff --git a/pkg/pipeline/history/ConfigMapHistoryService.go b/pkg/pipeline/history/ConfigMapHistoryService.go index 1bf629e852..b24fa2a0bb 100644 --- a/pkg/pipeline/history/ConfigMapHistoryService.go +++ b/pkg/pipeline/history/ConfigMapHistoryService.go @@ -466,6 +466,7 @@ func (impl ConfigMapHistoryServiceImpl) GetHistoryForDeployedCMCSById(ctx contex VariableSnapshot: variableSnapshotMap, ResolvedValue: resolvedTemplate, }, + SecretViewAccess: userHasAdminAccess, } if configType == repository.SECRET_TYPE { if config.Data != nil { diff --git a/pkg/pipeline/history/bean.go b/pkg/pipeline/history/bean.go index 05b23b0b8e..893144ccdf 100644 --- a/pkg/pipeline/history/bean.go +++ b/pkg/pipeline/history/bean.go @@ -58,6 +58,7 @@ type HistoryDetailDto struct { SubPath *bool `json:"subPath,omitempty"` FilePermission string `json:"filePermission,omitempty"` CodeEditorValue *HistoryDetailConfig `json:"codeEditorValue"` + SecretViewAccess bool `json:"secretViewAccess"` // this is being used to check whether a user can see obscured secret values or not. } type HistoryDetailConfig struct { diff --git a/specs/k8s_apis-spec.yaml b/specs/k8s_apis-spec.yaml index 9a4e2e4943..23d2a356be 100644 --- a/specs/k8s_apis-spec.yaml +++ b/specs/k8s_apis-spec.yaml @@ -357,6 +357,18 @@ components: patch: type: string ResourceGetResponse: + type: object + properties: + manifestResponse: + $ref: '#/components/schemas/ManifestResponse' + secretViewAccess: + type: boolean + description: > + Indicates whether a user can see obscured secret values or not. + required: + - manifestResponse + - secretViewAccess + ManifestResponse: type: object properties: manifest: