Drone-kubernetes-secrets not formatted correctly

lukaspj · March 21, 2020, 3:13pm

Hi,
I’ve spent a few hours banging my head against this wall. And now I believe drone-kubernetes-secrets does not export secrets correctly.

I get errors when I use secrets extracted with drone-kubernetes-secrets, I believe this is due to a trailing new-line that’s inserted for some reason.

I have a pipeline like this that works:

Summary

---
kind: pipeline
type: kubernetes
name: default

steps:
  - name: build kaniko
    image: docker:dind
    volumes:
      - name: dockersock
        path: /var/run
    commands:
      - sleep 5 # give docker enough time to start
      - cd kaniko/
      - echo "$(echo $CI_REGISTRY_PASSWORD)" | docker login $CI_REGISTRY -u "$CI_REGISTRY_USER"  --password-stdin
      - docker build . -t $CI_REGISTRY_IMAGE:$CI_TAG
      - docker push $CI_REGISTRY_IMAGE:$CI_TAG
    environment:
      CI_REGISTRY: https://harbor.default.cluster.lukasj.org
      CI_REGISTRY_USER:
        from_secret: username
      CI_REGISTRY_PASSWORD:
        from_secret: token
      CI_REGISTRY_IMAGE: harbor.default.cluster.lukasj.org/plugins/kaniko
      CI_TAG: latest


services:
  - name: docker
    image: docker:dind
    privileged: true
    volumes:
      - name: dockersock
        path: /var/run

volumes:
  - name: dockersock
    temp: {}

---
kind: secret
name: username
get:
  path: plugins-registry-sa
  name: username

---
kind: secret
name: token
get:
  path: plugins-registry-sa
  name: token

However, if I would change:
echo “$(echo $CI_REGISTRY_PASSWORD)” | docker login $CI_REGISTRY -u “$CI_REGISTRY_USER” --password-stdin
To:
echo $CI_REGISTRY_PASSWORD | docker login $CI_REGISTRY -u “$CI_REGISTRY_USER” --password-stdin
Then it no longer works because of invalid credentials. I believe this is because the password somehow gets some whitespace inserted somewhere along the line.

My Kubernetes secret is defined as:

apiVersion: v1
kind: Secret
type: Opaque

metadata:
  name: plugins-registry-sa
  namespace: drone

data:
  username: "cm9ib3QkZHJvbmUtY2kK"
  token: "ZXlKaGJHY2lPaUpTVXpJMU5pSXNJblI1Y0NJNklrcFhWQ0o5LmV5SmxlSEFpT2pFMk1UWXpNVGt6TURNc0ltbGhkQ0k2TVRVNE5EYzRNek13TXl3aWFYTnpJam9pYUdGeVltOXlMWFJ2YTJWdUxXUmxabUYxYkhSSmMzTjFaWElpTENKcFpDSTZOU3dpY0dsa0lqb3pOU3dpWVdOalpYTnpJanBiZXlKU1pYTnZkWEpqWlNJNklpOXdjbTlxWldOMEx6TTFMM0psY0c5emFYUnZjbmtpTENKQlkzUnBiMjRpT2lKd2RYTm9JaXdpUldabVpXTjBJam9pSW4wc2V5SlNaWE52ZFhKalpTSTZJaTl3Y205cVpXTjBMek0xTDJobGJHMHRZMmhoY25RdGRtVnljMmx2YmlJc0lrRmpkR2x2YmlJNkltTnlaV0YwWlNJc0lrVm1abVZqZENJNklpSjlYWDAud0o0Umd2RDF0Z2c4eE9rQ1ZLS3Y2QXdGYWJwSE9kUGN6YTRjaEhiM3huc2d6MXFXLXJIVjhBaW4zaXViay1rUjFRakg3NVVVa0RqY2Rqa3QtRC04cVdHM2prYUo4c0lNRlFXY1U0WUdzUUw1UUdwTi00UXVyVmJySjg2Ry0xeGJlOEZPU0ZYZnNKcXpJbDVSOXZYWkw4UllMOHMyaVQxTlp3MVNQc3NhZm8wNUJHVEswMi1vX090elhrUlBvVzNBLW5fUUJJOXZSQXJrVEQzQzh3MFAxRG1fb3QyRjZYTkFBUWQ2X0c0YkNuVmp6Uk0ydHR3emstVjZnSkdhUFVzRUhFSXdpUENFN2Y2bmxvWnlISTlqZ2dGNjdXSXJNVXZZQ0s1VFdPY2ltNWVsWUJHWUR3MlJmODI2RmFvOE1RNEVTMEtZdkxoeEtTSkU0TTVYd0N6eW90eUxyR2pVaGFqRDdNMzI1VHl4UWdiTEFWZGgzdlVLQmZVazkwY25sRXM3OTVfa21xOTBUQUNDbDVYTHZMOEQwUWJwbHdnMVVZOUNrYjUtRTRYNUU3U3l6UC1hRm5SY0dYUjBLTDFvQzN1aTkxTGFmOGEwLXk3b084bjFaT25MaGZ2M0pEMU9MUHpEdmVOcjlvVFh1V2pabWdMZ09hbjBYS0FKb1FobXNmWEthaERfaE9IbUxVSTc3YlZ3VmtIOTFHNk9ZeXJ6U2JYbDVGcmZkd1lydlFuVDdidjROeFNiamd4Q3N2a0dYTklNaGhZTG1xUkZVMGJvMEtMUGVCZlgwd1l0T2ZOVWlvYUJpS2c4SHk1RHpOMU54THNtSWsyQ3dZb3NvQkd1MklqNVdpNGV0OWdpQTdxdHJEWGxlQ3lBdmZrOG9jd3pTdzRYQnlmNFVMNnQ1bG8K"

ashwilliams1 · March 21, 2020, 4:32pm

The kubernetes secret runner does not append a trailing slash anywhere in the code. The code itself is quite readable if you would like to audit:

github.com

drone/drone-kubernetes-secrets/blob/master/plugin/plugin.go#L50:L77


	path := req.Path
	name := req.Name


	// makes an api call to the kubernetes secrets manager and
	// attempts to retrieve the secret at the requested path.
	var secret v1.Secret
	err := p.client.Get(ctx, p.namespace, path, &secret)
	if err != nil {
		return nil, err
	}
	data, ok := secret.Data[name]
	if !ok {
		return nil, errors.New("secret not found")
	}


	// the user can filter out requets based on event type
	// using the X-Drone-Events secret key. Check for this
	// user-defined filter logic.
	events := extractEvents(secret.Metadata.Annotations)
	if !match(req.Build.Event, events) {
		return nil, errors.New("access denied: event does not match")

Perhaps the problem is that you are using echo without the echo -n flag? The -n flag prevents a newline from being added to echo statements.

lukaspj · April 5, 2020, 6:13pm

You are right, sorry.

I thought I had covered my bases, but the issue was in the generation of my secrets.
All the different tools I tried to verify the generation of my tools all trimmed the whitespace away so I thought I had sanity-checked the secret values being inserted.