Skip to content

Commit

Permalink
[Tooling] Retrieve keys for all actors from k8s secrets (#903)
Browse files Browse the repository at this point in the history
## Description

<!-- reviewpad:summarize:start -->
### Summary generated by Reviewpad on 14 Jul 23 23:17 UTC
This pull request includes a series of patches that make changes to the file `debug.go` in the `shared/k8s` directory. 

Patch 1/5: The patch retrieves keys for all actors from k8s secrets. It adds support for retrieving private keys for validators, servicers, fisherman, and applications.

Patch 2/5: This patch fixes a linter error in the `fetchPrivateKeys` function by updating the function signature to use a single string parameter for `resourceName` and `actor`.

Patch 3/5: This patch further fixes linter errors in the same function and shortens the code by removing unnecessary switch cases.

Patch 4/5: This patch updates the constant for the secret resource name from `privateKeysSecretResourceNameFisherman` to `privateKeysSecretResourceNameFishermen`.

Patch 5/5: This patch fixes a typo in the function name `FetchFishermanPrivateKeys` by updating the privateKeysSecretResourceName to `privateKeysSecretResourceNameFishermen`.

Please review these changes and ensure they are appropriate.
<!-- reviewpad:summarize:end -->

## Issue

Added as a TODO in #869:

<img width="1548" alt="Screenshot 2023-07-12 at 5 10 03 PM" src="https://github.com/pokt-network/pocket/assets/1892194/b1409bdd-4240-4993-b7dd-6197beae5500">

## Type of change

Please mark the relevant option(s):

- [ ] New feature, functionality or library
- [ ] Bug fix
- [x] Code health or cleanup
- [ ] Major breaking change
- [ ] Documentation
- [ ] Other <!-- add details here if it a different type of change -->

## List of changes

- Fetch keys for all actors from k8s instead of just validators so they can be used in our debug libraries

## Testing

- [x] `make develop_test`; if any code changes were made
- [x] `make test_e2e` on [k8s LocalNet](https://github.com/pokt-network/pocket/blob/main/build/localnet/README.md); if any code changes were made
- [ ] `e2e-devnet-test` passes tests on [DevNet](https://pocketnetwork.notion.site/How-to-DevNet-ff1598f27efe44c09f34e2aa0051f0dd); if any code was changed
- [ ] [Docker Compose LocalNet](https://github.com/pokt-network/pocket/blob/main/docs/development/README.md); if any major functionality was changed or introduced
- [ ] [k8s LocalNet](https://github.com/pokt-network/pocket/blob/main/build/localnet/README.md); if any infrastructure or configuration changes were made

## Required Checklist

- [x] I have performed a self-review of my own code
- [x] I have commented my code, particularly in hard-to-understand areas
- [ ] I have added, or updated, [`godoc` format comments](https://go.dev/blog/godoc) on touched members (see: [tip.golang.org/doc/comment](https://tip.golang.org/doc/comment))
- [ ] I have tested my changes using the available tooling
- [ ] I have updated the corresponding CHANGELOG

### If Applicable Checklist

- [ ] I have updated the corresponding README(s); local and/or global
- [ ] I have added tests that prove my fix is effective or that my feature works
- [ ] I have added, or updated, [mermaid.js](https://mermaid-js.github.io) diagrams in the corresponding README(s)
- [ ] I have added, or updated, documentation and [mermaid.js](https://mermaid-js.github.io) diagrams in `shared/docs/*` if I updated `shared/*`README(s)


Co-authored-by: Dima Kniazev <[email protected]>
  • Loading branch information
Olshansk and okdas authored Jul 14, 2023
1 parent d76e7cb commit b55b6f9
Showing 1 changed file with 38 additions and 11 deletions.
49 changes: 38 additions & 11 deletions shared/k8s/debug.go
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,14 @@ import (
)

//nolint:gosec // G101 Not a credential
const privateKeysSecretResourceName = "validators-private-keys"
const kubernetesServiceAccountNamespaceFile = "/var/run/secrets/kubernetes.io/serviceaccount/namespace"
const defaultNamespace = "default"
const (
privateKeysSecretResourceNameValidators = "validators-private-keys"
privateKeysSecretResourceNameServicers = "servicers-private-keys"
privateKeysSecretResourceNameFishermen = "fishermen-private-keys"
privateKeysSecretResourceNameApplications = "applications-private-keys"
kubernetesServiceAccountNamespaceFile = "/var/run/secrets/kubernetes.io/serviceaccount/namespace"
defaultNamespace = "default"
)

var CurrentNamespace = ""

Expand All @@ -34,20 +39,42 @@ func init() {
}

// FetchValidatorPrivateKeys returns a map corresponding to the data section of
// the validator private keys k8s secret (yaml), located at `privateKeysSecretResourceName`.
// the validator private keys Kubernetes secret.
func FetchValidatorPrivateKeys(clientset *kubernetes.Clientset) (map[string]string, error) {
validatorKeysMap := make(map[string]string)
return fetchPrivateKeys(clientset, privateKeysSecretResourceNameValidators)
}

privateKeysSecret, err := clientset.CoreV1().Secrets(CurrentNamespace).Get(context.TODO(), privateKeysSecretResourceName, metav1.GetOptions{})
// FetchServicerPrivateKeys returns a map corresponding to the data section of
// the servicer private keys Kubernetes secret.
func FetchServicerPrivateKeys(clientset *kubernetes.Clientset) (map[string]string, error) {
return fetchPrivateKeys(clientset, privateKeysSecretResourceNameServicers)
}

// FetchFishermanPrivateKeys returns a map corresponding to the data section of
// the fisherman private keys Kubernetes secret.
func FetchFishermanPrivateKeys(clientset *kubernetes.Clientset) (map[string]string, error) {
return fetchPrivateKeys(clientset, privateKeysSecretResourceNameFishermen)
}

// FetchApplicationPrivateKeys returns a map corresponding to the data section of
// the application private keys Kubernetes secret.
func FetchApplicationPrivateKeys(clientset *kubernetes.Clientset) (map[string]string, error) {
return fetchPrivateKeys(clientset, privateKeysSecretResourceNameApplications)
}

// fetchPrivateKeys returns a map corresponding to the data section of
// the private keys Kubernetes secret for the specified resource name and actor.
func fetchPrivateKeys(clientset *kubernetes.Clientset, resourceName string) (map[string]string, error) {
privateKeysMap := make(map[string]string)
privateKeysSecret, err := clientset.CoreV1().Secrets(CurrentNamespace).Get(context.TODO(), resourceName, metav1.GetOptions{})
if err != nil {
panic(err)
return nil, err
}

for id, privHexString := range privateKeysSecret.Data {
// it's safe to cast []byte to string here
validatorKeysMap[id] = string(privHexString)
// It's safe to cast []byte to string here
privateKeysMap[id] = string(privHexString)
}
return validatorKeysMap, nil
return privateKeysMap, nil
}

func getNamespace() (string, error) {
Expand Down

0 comments on commit b55b6f9

Please sign in to comment.