mirror of
https://github.com/portainer/portainer.git
synced 2025-08-05 13:55:21 +02:00
fix(registry): remove k8s registry secrets when registries are removed [EE-5768] (#10369)
This commit is contained in:
Matt Hook
GitHub
parent
96ead31a8d
commit
860890046d
10 changed files with 206 additions and 47 deletions
76
api/pendingactions/delete_registry_secrets.go
Normal file
76
api/pendingactions/delete_registry_secrets.go
Normal file
|
|
@ -0,0 +1,76 @@
|
|||
package pendingactions
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
|
||||
portainer "github.com/portainer/portainer/api"
|
||||
"github.com/rs/zerolog/log"
|
||||
)
|
||||
|
||||
type DeletePortainerK8sRegistrySecretsData struct {
|
||||
RegistryID portainer.RegistryID `json:"RegistryID"`
|
||||
Namespaces []string `json:"Namespaces"`
|
||||
}
|
||||
|
||||
func (service *PendingActionsService) DeleteKubernetesRegistrySecrets(endpoint *portainer.Endpoint, registryData *DeletePortainerK8sRegistrySecretsData) error {
|
||||
if endpoint == nil || registryData == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
kubeClient, err := service.clientFactory.GetKubeClient(endpoint)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
|
||||
for _, namespace := range registryData.Namespaces {
|
||||
err = kubeClient.DeleteRegistrySecret(registryData.RegistryID, namespace)
|
||||
if err != nil {
|
||||
return err
|
||||
}
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
// Failure in this code is basically a bug. So if we get one we should log it and continue.
|
||||
func convertToDeletePortainerK8sRegistrySecretsData(actionData interface{}) (*DeletePortainerK8sRegistrySecretsData, error) {
|
||||
var registryData DeletePortainerK8sRegistrySecretsData
|
||||
|
||||
// Due to the way data is stored and subsequently read from the database, we can't directly type assert the actionData to
|
||||
// the type DeletePortainerK8sRegistrySecretsData. It's stored as a map[string]interface{} and we need to extract the
|
||||
// data from that map.
|
||||
if data, ok := actionData.(map[string]interface{}); ok {
|
||||
for key, value := range data {
|
||||
switch key {
|
||||
case "Namespaces":
|
||||
if namespaces, ok := value.([]interface{}); ok {
|
||||
registryData.Namespaces = make([]string, len(namespaces))
|
||||
for i, ns := range namespaces {
|
||||
if namespace, ok := ns.(string); ok {
|
||||
registryData.Namespaces[i] = namespace
|
||||
}
|
||||
}
|
||||
} else {
|
||||
// we shouldn't ever see this. It's a bug if we do.
|
||||
log.Debug().Msgf("DeletePortainerK8sRegistrySecrets: Failed to convert Namespaces to []interface{}")
|
||||
}
|
||||
case "RegistryID":
|
||||
if registryID, ok := value.(float64); ok {
|
||||
registryData.RegistryID = portainer.RegistryID(registryID)
|
||||
} else {
|
||||
// we shouldn't ever see this. It's a bug if we do.
|
||||
log.Debug().Msgf("DeletePortainerK8sRegistrySecrets: Failed to convert RegistryID to float64")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
log.Debug().Msgf("DeletePortainerK8sRegistrySecrets: %+v", registryData)
|
||||
} else {
|
||||
// this should not happen. It's a bug if it does. As the actionData is defined
|
||||
// by what portainer puts in it. It never comes from a user or external source so it shouldn't fail.
|
||||
// Nevertheless we should check it in case of db corruption or developer mistake down the road
|
||||
return nil, fmt.Errorf("type assertion failed in convertToDeletePortainerK8sRegistrySecretsData")
|
||||
}
|
||||
|
||||
return ®istryData, nil
|
||||
}
|
||||
|
|
@ -12,6 +12,11 @@ import (
|
|||
"github.com/rs/zerolog/log"
|
||||
)
|
||||
|
||||
const (
|
||||
CleanNAPWithOverridePolicies = "CleanNAPWithOverridePolicies"
|
||||
DeletePortainerK8sRegistrySecrets = "DeletePortainerK8sRegistrySecrets"
|
||||
)
|
||||
|
||||
type (
|
||||
PendingActionsService struct {
|
||||
authorizationService *authorization.Service
|
||||
|
|
@ -49,33 +54,32 @@ func (service *PendingActionsService) Execute(id portainer.EndpointID) error {
|
|||
|
||||
endpoint, err := service.dataStore.Endpoint().Endpoint(id)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to retrieve endpoint %d: %w", id, err)
|
||||
return fmt.Errorf("failed to retrieve environment %d: %w", id, err)
|
||||
}
|
||||
|
||||
if endpoint.Status != portainer.EndpointStatusUp {
|
||||
log.Debug().Msgf("Endpoint %d is not up", id)
|
||||
return fmt.Errorf("endpoint %d is not up: %w", id, err)
|
||||
log.Debug().Msgf("Environment %q (id: %d) is not up", endpoint.Name, id)
|
||||
return fmt.Errorf("environment %q (id: %d) is not up: %w", endpoint.Name, id, err)
|
||||
}
|
||||
|
||||
pendingActions, err := service.dataStore.PendingActions().ReadAll()
|
||||
if err != nil {
|
||||
log.Error().Err(err).Msgf("failed to retrieve pending actions")
|
||||
return fmt.Errorf("failed to retrieve pending actions for endpoint %d: %w", id, err)
|
||||
return fmt.Errorf("failed to retrieve pending actions for environment %d: %w", id, err)
|
||||
}
|
||||
|
||||
for _, endpointPendingAction := range pendingActions {
|
||||
if endpointPendingAction.EndpointID == id {
|
||||
err := service.executePendingAction(endpointPendingAction, endpoint)
|
||||
if err != nil {
|
||||
log.Error().Err(err).Msgf("failed to execute pending action")
|
||||
log.Warn().Err(err).Msgf("failed to execute pending action")
|
||||
return fmt.Errorf("failed to execute pending action: %w", err)
|
||||
} else {
|
||||
// delete the pending action
|
||||
err := service.dataStore.PendingActions().Delete(endpointPendingAction.ID)
|
||||
if err != nil {
|
||||
log.Error().Err(err).Msgf("failed to delete pending action")
|
||||
return fmt.Errorf("failed to delete pending action: %w", err)
|
||||
}
|
||||
}
|
||||
|
||||
err = service.dataStore.PendingActions().Delete(endpointPendingAction.ID)
|
||||
if err != nil {
|
||||
log.Error().Err(err).Msgf("failed to delete pending action")
|
||||
return fmt.Errorf("failed to delete pending action: %w", err)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -84,30 +88,50 @@ func (service *PendingActionsService) Execute(id portainer.EndpointID) error {
|
|||
}
|
||||
|
||||
func (service *PendingActionsService) executePendingAction(pendingAction portainer.PendingActions, endpoint *portainer.Endpoint) error {
|
||||
log.Debug().Msgf("Executing pending action %s for endpoint %d", pendingAction.Action, pendingAction.EndpointID)
|
||||
log.Debug().Msgf("Executing pending action %s for environment %d", pendingAction.Action, pendingAction.EndpointID)
|
||||
|
||||
defer func() {
|
||||
log.Debug().Msgf("End executing pending action %s for endpoint %d", pendingAction.Action, pendingAction.EndpointID)
|
||||
log.Debug().Msgf("End executing pending action %s for environment %d", pendingAction.Action, pendingAction.EndpointID)
|
||||
}()
|
||||
|
||||
switch pendingAction.Action {
|
||||
case "CleanNAPWithOverridePolicies":
|
||||
case CleanNAPWithOverridePolicies:
|
||||
if (pendingAction.ActionData == nil) || (pendingAction.ActionData.(portainer.EndpointGroupID) == 0) {
|
||||
service.authorizationService.CleanNAPWithOverridePolicies(service.dataStore, endpoint, nil)
|
||||
} else {
|
||||
endpointGroupID := pendingAction.ActionData.(portainer.EndpointGroupID)
|
||||
endpointGroup, err := service.dataStore.EndpointGroup().Read(portainer.EndpointGroupID(endpointGroupID))
|
||||
if err != nil {
|
||||
log.Error().Err(err).Msgf("Error reading endpoint group to clean NAP with override policies for endpoint %d and endpoint group %d", endpoint.ID, endpointGroup.ID)
|
||||
return fmt.Errorf("failed to retrieve endpoint group %d: %w", endpointGroupID, err)
|
||||
}
|
||||
err = service.authorizationService.CleanNAPWithOverridePolicies(service.dataStore, endpoint, endpointGroup)
|
||||
if err != nil {
|
||||
log.Error().Err(err).Msgf("Error cleaning NAP with override policies for endpoint %d and endpoint group %d", endpoint.ID, endpointGroup.ID)
|
||||
return fmt.Errorf("failed to clean NAP with override policies for endpoint %d and endpoint group %d: %w", endpoint.ID, endpointGroup.ID, err)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
endpointGroupID := pendingAction.ActionData.(portainer.EndpointGroupID)
|
||||
endpointGroup, err := service.dataStore.EndpointGroup().Read(portainer.EndpointGroupID(endpointGroupID))
|
||||
if err != nil {
|
||||
log.Error().Err(err).Msgf("Error reading environment group to clean NAP with override policies for environment %d and environment group %d", endpoint.ID, endpointGroup.ID)
|
||||
return fmt.Errorf("failed to retrieve environment group %d: %w", endpointGroupID, err)
|
||||
}
|
||||
err = service.authorizationService.CleanNAPWithOverridePolicies(service.dataStore, endpoint, endpointGroup)
|
||||
if err != nil {
|
||||
log.Error().Err(err).Msgf("Error cleaning NAP with override policies for environment %d and environment group %d", endpoint.ID, endpointGroup.ID)
|
||||
return fmt.Errorf("failed to clean NAP with override policies for environment %d and environment group %d: %w", endpoint.ID, endpointGroup.ID, err)
|
||||
}
|
||||
|
||||
return nil
|
||||
case DeletePortainerK8sRegistrySecrets:
|
||||
if pendingAction.ActionData == nil {
|
||||
return nil
|
||||
}
|
||||
|
||||
registryData, err := convertToDeletePortainerK8sRegistrySecretsData(pendingAction.ActionData)
|
||||
if err != nil {
|
||||
return fmt.Errorf("failed to parse pendingActionData: %w", err)
|
||||
}
|
||||
|
||||
err = service.DeleteKubernetesRegistrySecrets(endpoint, registryData)
|
||||
if err != nil {
|
||||
log.Warn().Err(err).Int("endpoint_id", int(endpoint.ID)).Msgf("Unable to delete kubernetes registry secrets")
|
||||
return fmt.Errorf("failed to delete kubernetes registry secrets for environment %d: %w", endpoint.ID, err)
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
||||
return nil
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue