mirror of
https://github.com/edgelesssys/constellation.git
synced 2025-11-13 17:11:08 -05:00
internal: refactor storage credentials (#1071)
* Move storage clients to separate packages * Allow setting of client credentials for AWS S3 * Use managed identity client secret or default credentials for Azure Blob Storage * Use credentials file to authorize GCS client --------- Signed-off-by: Daniel Weiße <dw@edgeless.systems>
This commit is contained in:
Daniel Weiße
GitHub
parent
96b4b74a7a
commit
5eb73706f5
30 changed files with 857 additions and 1130 deletions
104
internal/kms/storage/azureblob/azureblob.go
Normal file
104
internal/kms/storage/azureblob/azureblob.go
Normal file
|
|
@ -0,0 +1,104 @@
|
|||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
// Package azureblob implements a storage backend for the KMS using Azure Blob Storage.
|
||||
package azureblob
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"fmt"
|
||||
"io"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blob"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/bloberror"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/container"
|
||||
"github.com/edgelesssys/constellation/v2/internal/kms/config"
|
||||
"github.com/edgelesssys/constellation/v2/internal/kms/storage"
|
||||
"github.com/edgelesssys/constellation/v2/internal/kms/uri"
|
||||
)
|
||||
|
||||
type azureBlobAPI interface {
|
||||
CreateContainer(context.Context, string, *container.CreateOptions) (azblob.CreateContainerResponse, error)
|
||||
DownloadStream(context.Context, string, string, *blob.DownloadStreamOptions) (azblob.DownloadStreamResponse, error)
|
||||
UploadStream(context.Context, string, string, io.Reader, *azblob.UploadStreamOptions) (azblob.UploadStreamResponse, error)
|
||||
}
|
||||
|
||||
// Storage is an implementation of the Storage interface, storing keys in the Azure Blob Store.
|
||||
type Storage struct {
|
||||
client azureBlobAPI
|
||||
container string
|
||||
}
|
||||
|
||||
// New initializes a storage client using Azure's Blob Storage using the provided config.
|
||||
//
|
||||
// See the Azure docs for more information: https://azure.microsoft.com/en-us/services/storage/blobs/
|
||||
func New(ctx context.Context, cfg uri.AzureBlobConfig) (*Storage, error) {
|
||||
var creds azcore.TokenCredential
|
||||
|
||||
creds, err := azidentity.NewClientSecretCredential(cfg.TenantID, cfg.ClientID, cfg.ClientSecret, nil)
|
||||
if err != nil {
|
||||
// Fallback: try to load default credentials
|
||||
creds, err = azidentity.NewDefaultAzureCredential(nil)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("invalid client-secret credentials. Trying to load default credentials: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
client, err := azblob.NewClient(fmt.Sprintf("https://%s.blob.core.windows.net/", cfg.StorageAccount), creds, nil)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("creating storage client: %w", err)
|
||||
}
|
||||
|
||||
s := &Storage{
|
||||
client: client,
|
||||
container: cfg.Container,
|
||||
}
|
||||
|
||||
// Try to create a new storage container, continue if it already exists
|
||||
if err := s.createContainerOrContinue(ctx); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
return s, nil
|
||||
}
|
||||
|
||||
// Get returns a DEK from from Azure Blob Storage by key ID.
|
||||
func (s *Storage) Get(ctx context.Context, keyID string) ([]byte, error) {
|
||||
res, err := s.client.DownloadStream(ctx, s.container, keyID, nil)
|
||||
if err != nil {
|
||||
if bloberror.HasCode(err, bloberror.BlobNotFound) {
|
||||
return nil, storage.ErrDEKUnset
|
||||
}
|
||||
return nil, fmt.Errorf("downloading DEK from storage: %w", err)
|
||||
}
|
||||
defer res.Body.Close()
|
||||
return io.ReadAll(res.Body)
|
||||
}
|
||||
|
||||
// Put saves a DEK to Azure Blob Storage by key ID.
|
||||
func (s *Storage) Put(ctx context.Context, keyID string, encDEK []byte) error {
|
||||
if _, err := s.client.UploadStream(ctx, s.container, keyID, bytes.NewReader(encDEK), nil); err != nil {
|
||||
return fmt.Errorf("uploading DEK to storage: %w", err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// createContainerOrContinue creates a new storage container if necessary, or continues if it already exists.
|
||||
func (s *Storage) createContainerOrContinue(ctx context.Context) error {
|
||||
_, err := s.client.CreateContainer(ctx, s.container, &azblob.CreateContainerOptions{
|
||||
Metadata: config.StorageTags,
|
||||
})
|
||||
if (err == nil) || bloberror.HasCode(err, bloberror.ContainerAlreadyExists) {
|
||||
return nil
|
||||
}
|
||||
|
||||
return fmt.Errorf("creating storage container: %w", err)
|
||||
}
|
||||
171
internal/kms/storage/azureblob/azureblob_test.go
Normal file
171
internal/kms/storage/azureblob/azureblob_test.go
Normal file
|
|
@ -0,0 +1,171 @@
|
|||
/*
|
||||
Copyright (c) Edgeless Systems GmbH
|
||||
|
||||
SPDX-License-Identifier: AGPL-3.0-only
|
||||
*/
|
||||
|
||||
package azureblob
|
||||
|
||||
import (
|
||||
"bytes"
|
||||
"context"
|
||||
"errors"
|
||||
"io"
|
||||
"testing"
|
||||
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/azcore"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/blob"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/bloberror"
|
||||
"github.com/Azure/azure-sdk-for-go/sdk/storage/azblob/container"
|
||||
"github.com/edgelesssys/constellation/v2/internal/kms/storage"
|
||||
"github.com/stretchr/testify/assert"
|
||||
)
|
||||
|
||||
func TestAzureGet(t *testing.T) {
|
||||
testCases := map[string]struct {
|
||||
client stubAzureBlobAPI
|
||||
unsetError bool
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
client: stubAzureBlobAPI{downloadData: []byte{0x1, 0x2, 0x3}},
|
||||
},
|
||||
"DownloadBuffer fails": {
|
||||
client: stubAzureBlobAPI{downloadErr: errors.New("failed")},
|
||||
wantErr: true,
|
||||
},
|
||||
"BlobNotFound error": {
|
||||
client: stubAzureBlobAPI{downloadErr: &azcore.ResponseError{ErrorCode: string(bloberror.BlobNotFound)}},
|
||||
unsetError: true,
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
client := &Storage{
|
||||
client: &tc.client,
|
||||
container: "test",
|
||||
}
|
||||
|
||||
out, err := client.Get(context.Background(), "test-key")
|
||||
if tc.wantErr {
|
||||
assert.Error(err)
|
||||
|
||||
if tc.unsetError {
|
||||
assert.ErrorIs(err, storage.ErrDEKUnset)
|
||||
} else {
|
||||
assert.False(errors.Is(err, storage.ErrDEKUnset))
|
||||
}
|
||||
return
|
||||
}
|
||||
assert.NoError(err)
|
||||
assert.Equal(tc.client.downloadData, out)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestAzurePut(t *testing.T) {
|
||||
testCases := map[string]struct {
|
||||
client stubAzureBlobAPI
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
client: stubAzureBlobAPI{},
|
||||
},
|
||||
"Upload fails": {
|
||||
client: stubAzureBlobAPI{uploadErr: errors.New("failed")},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
testData := []byte{0x1, 0x2, 0x3}
|
||||
|
||||
client := &Storage{
|
||||
client: &tc.client,
|
||||
container: "test",
|
||||
}
|
||||
|
||||
err := client.Put(context.Background(), "test-key", testData)
|
||||
if tc.wantErr {
|
||||
assert.Error(err)
|
||||
return
|
||||
}
|
||||
assert.NoError(err)
|
||||
assert.Equal(testData, tc.client.uploadData)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestCreateContainerOrContinue(t *testing.T) {
|
||||
testCases := map[string]struct {
|
||||
client stubAzureBlobAPI
|
||||
wantErr bool
|
||||
}{
|
||||
"success": {
|
||||
client: stubAzureBlobAPI{},
|
||||
},
|
||||
"container already exists": {
|
||||
client: stubAzureBlobAPI{createErr: &azcore.ResponseError{ErrorCode: string(bloberror.ContainerAlreadyExists)}},
|
||||
},
|
||||
"CreateContainer fails": {
|
||||
client: stubAzureBlobAPI{createErr: errors.New("failed")},
|
||||
wantErr: true,
|
||||
},
|
||||
}
|
||||
|
||||
for name, tc := range testCases {
|
||||
t.Run(name, func(t *testing.T) {
|
||||
assert := assert.New(t)
|
||||
|
||||
client := &Storage{
|
||||
client: &tc.client,
|
||||
container: "test",
|
||||
}
|
||||
|
||||
err := client.createContainerOrContinue(context.Background())
|
||||
if tc.wantErr {
|
||||
assert.Error(err)
|
||||
} else {
|
||||
assert.NoError(err)
|
||||
assert.True(tc.client.createCalled)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
type stubAzureBlobAPI struct {
|
||||
createErr error
|
||||
createCalled bool
|
||||
downloadErr error
|
||||
downloadData []byte
|
||||
uploadErr error
|
||||
uploadData []byte
|
||||
}
|
||||
|
||||
func (s *stubAzureBlobAPI) CreateContainer(context.Context, string, *container.CreateOptions) (azblob.CreateContainerResponse, error) {
|
||||
s.createCalled = true
|
||||
return azblob.CreateContainerResponse{}, s.createErr
|
||||
}
|
||||
|
||||
func (s *stubAzureBlobAPI) DownloadStream(context.Context, string, string, *blob.DownloadStreamOptions) (blob.DownloadStreamResponse, error) {
|
||||
res := blob.DownloadStreamResponse{}
|
||||
res.Body = io.NopCloser(bytes.NewReader(s.downloadData))
|
||||
return res, s.downloadErr
|
||||
}
|
||||
|
||||
func (s *stubAzureBlobAPI) UploadStream(_ context.Context, _, _ string, data io.Reader, _ *azblob.UploadStreamOptions) (azblob.UploadStreamResponse, error) {
|
||||
uploadData, err := io.ReadAll(data)
|
||||
if err != nil {
|
||||
return azblob.UploadStreamResponse{}, err
|
||||
}
|
||||
s.uploadData = uploadData
|
||||
return azblob.UploadStreamResponse{}, s.uploadErr
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue