opensource/cloudpods
3
0
Fork 0
mirror of https://github.com/yunionio/cloudpods.git synced 2026-09-24 16:03:43 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: encrypt by user id (#14021)

Browse Source 
Co-authored-by: Qiu Jian <qiujian@yunionyun.com>
This commit is contained in:
Jian Qiu
2022-04-14 07:54:56 +08:00
committed by GitHub
co-authored by Qiu Jian
parent e0af65c776
commit 25062f802a
3 changed files with 28 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/apis/encrypt.go
+2 -2
View File
@@ -33,10 +33,10 @@ type EncryptedResourceCreateInput struct {
// 新建密钥算法
EncryptKeyAlg *string `json:"encrypt_key_alg"`
// 加密秘钥的ID
// 加密密钥的ID
EncryptKeyId *string `json:"encrypt_key_id"`
// 加密蜜月的用户ID
// 加密密钥的用户ID
EncryptKeyUserId *string `json:"encrypt_key_user_id"`
}
pkg/cloudcommon/db/encrypted.go
+20 -17
View File
@@ -19,6 +19,7 @@ import (
"time"
"yunion.io/x/jsonutils"
"yunion.io/x/log"
"yunion.io/x/pkg/errors"
"yunion.io/x/pkg/util/reflectutils"
"yunion.io/x/pkg/util/timeutils"
@@ -91,11 +92,12 @@ func (manager *SEncryptedResourceManager) ValidateCreateData(
func (res *SEncryptedResource) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, data jsonutils.JSONObject, nameHint string) error {
if len(res.EncryptKeyId) == 0 && jsonutils.QueryBoolean(data, "encrypt_key_new", false) && !jsonutils.QueryBoolean(data, "dry_run", false) {
// create new encrypt key
session := auth.GetSession(ctx, userCred, consts.GetRegion(), "v1")
session := auth.GetAdminSession(ctx, consts.GetRegion(), "v1")
now := time.Now()
keyName := "key-" + nameHint + "-" + timeutils.ShortDate(now)
algName, _ := data.GetString("encrypt_key_alg")
secret, err := identity_modules.Credentials.CreateEncryptKey(session, ownerId.GetUserId(), keyName, algName)
userId, _ := data.GetString("encrypt_key_user_id")
secret, err := identity_modules.Credentials.CreateEncryptKey(session, userId, keyName, algName)
if err != nil {
return errors.Wrap(err, "Credentials.CreateEncryptKey")
}
@@ -114,27 +116,28 @@ func (manager *SEncryptedResourceManager) FetchCustomizeColumns(
) []apis.EncryptedResourceDetails {
rets := make([]apis.EncryptedResourceDetails, len(objs))
session := auth.GetAdminSession(ctx, consts.GetRegion(), "")
encKeys, err := identity_modules.Credentials.GetEncryptKeys(session, userCred.GetUserId())
if err != nil {
return rets
}
session := auth.GetSession(ctx, userCred, consts.GetRegion(), "")
encKeyMap := make(map[string]identity_modules.SEncryptKeySecret)
for i := range encKeys {
encKeyMap[encKeys[i].KeyId] = encKeys[i]
}
for i := range objs {
var base *SEncryptedResource
reflectutils.FindAnonymouStructPointer(objs[i], &base)
if base != nil && len(base.EncryptKeyId) > 0 {
if encKey, ok := encKeyMap[base.EncryptKeyId]; ok {
rets[i].EncryptKey = encKey.KeyName
rets[i].EncryptAlg = string(encKey.Alg)
rets[i].EncryptKeyUser = string(encKey.User)
rets[i].EncryptKeyUserId = string(encKey.UserId)
rets[i].EncryptKeyUserDomain = string(encKey.Domain)
rets[i].EncryptKeyUserDomainId = string(encKey.DomainId)
encKey, ok := encKeyMap[base.EncryptKeyId]
if !ok {
secKey, err := identity_modules.Credentials.GetEncryptKey(session, base.EncryptKeyId)
if err != nil {
log.Errorf("fail to fetch enc key %s: %s", base.EncryptKeyId, err)
continue
}
encKey = secKey
encKeyMap[base.EncryptKeyId] = secKey
}
rets[i].EncryptKey = encKey.KeyName
rets[i].EncryptAlg = string(encKey.Alg)
rets[i].EncryptKeyUser = string(encKey.User)
rets[i].EncryptKeyUserId = string(encKey.UserId)
rets[i].EncryptKeyUserDomain = string(encKey.Domain)
rets[i].EncryptKeyUserDomainId = string(encKey.DomainId)
}
}
return rets
pkg/compute/models/guest_actions.go
+6
View File
@@ -873,6 +873,12 @@ func (self *SGuest) StartResumeTask(ctx context.Context, userCred mcclient.Token
func (self *SGuest) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject,
data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
if utils.IsInStringArray(self.Status, []string{api.VM_READY, api.VM_START_FAILED, api.VM_SAVE_DISK_FAILED, api.VM_SUSPEND}) {
if self.IsEncrypted() {
_, err := self.GetEncryptInfo(ctx, userCred)
if err != nil {
return nil, errors.Wrap(err, "GetEncryptInfo")
}
}
if !self.guestDisksStorageTypeIsShared() {
host, _ := self.GetHost()
guestsMem, err := host.GetNotReadyGuestsMemorySize()