Files
teleport/lib/services/plugins.go
T
d89879c2f5 Add gRPC service definition for Plugin resources (#21750)
* Add plugin exchange service

* Add Plugin methods to auth

* Add gRPC-layer methods for Plugin

* Add RBAC presets for Plugin

* Test GetPlugin()/NoSecrets access

* Make error assertions more correct in role test

* Deny setting credentials if user can not read them

* gofmt

* Apply minor suggestions from code review

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>

* Move dependency into an existing block in go.mod

* Improve error messages for failed type assertions

* DRY WithSecrets access checks for Plugins

* Run new tests in parallel

* Improve error assertions in auth_with_roles_test

* TestGetPluginWithSecrets: split cases to subtests

* Clean up test servers and clients

* Add proto for plugin service

* Remove Plugin methods from auth service

Moved to a dedicated service

* Remove plugin-related auth methods

Moved to a dedicated service in Enterprise

* Remove CreatePlugin test from auth_with_roles_test

Moved to a dedicated service in Enterprise

* Pass "backend getter" to local plugins service

This pattern is used in Enterprise to set up secondary services
before auth (and backend) are created.

* Rename InitialCredentials to BootstrapCredentials

* Add plugins service to genproto.sh

* Reformat generated proto

* Remove obsolete PluginExchangeService

The equivalent of this is now in Enterprise

* Add kube service to genproto.sh; regenerate

* Add ListPlugins to plugin backend service

* Reimplement GetPlugins on top of ListPlugins

This is a "convenience" implementation for the backend service layer.

* Replace GetPlugins with ListPlugins in gRPC schema

* Fix ListKubernetesResources unit test

* Simplify plugin pagination key to just the name

* Use existing constant for page size

* Make dummy clients return errors instead of panic

* Remove obsolete field

* Ensure go.mod is valid for corresponding e changes

* Fix passing mutex ref

* Move teleport-plugins import to e_imports

* Revert oauth change in go.mod

* Use limit+1 to look-ahead when paginating plugins

* Test plugin pagination with pageSize > numPlugins

* Add descriptive messages to gRPC dummy clients

* Plugin: add RW for editor; remove secrets from gRPC

* Make message more descriptive for dummy gRPC conn

---------

Co-authored-by: rosstimothy <39066650+rosstimothy@users.noreply.github.com>
Co-authored-by: Tiago Silva <tiago.silva@goteleport.com>
2023-02-23 14:32:41 +00:00

101 lines
3.0 KiB
Go

/*
Copyright 2023 Gravitational, Inc.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package services
import (
"bytes"
"context"
"github.com/gogo/protobuf/jsonpb"
"github.com/gravitational/trace"
"github.com/gravitational/teleport/api/types"
"github.com/gravitational/teleport/lib/utils"
)
// Plugins is the plugin service
type Plugins interface {
CreatePlugin(ctx context.Context, plugin types.Plugin) error
DeleteAllPlugins(ctx context.Context) error
DeletePlugin(ctx context.Context, name string) error
GetPlugin(ctx context.Context, name string, withSecrets bool) (types.Plugin, error)
GetPlugins(ctx context.Context, withSecrets bool) ([]types.Plugin, error)
ListPlugins(ctx context.Context, limit int, startKey string, withSecrets bool) ([]types.Plugin, string, error)
SetPluginCredentials(ctx context.Context, name string, creds types.PluginCredentials) error
SetPluginStatus(ctx context.Context, name string, creds types.PluginStatus) error
}
// MarshalPlugin marshals Plugin resource to JSON.
func MarshalPlugin(plugin types.Plugin, opts ...MarshalOption) ([]byte, error) {
if err := plugin.CheckAndSetDefaults(); err != nil {
return nil, trace.Wrap(err)
}
cfg, err := CollectOptions(opts)
if err != nil {
return nil, trace.Wrap(err)
}
switch plugin := plugin.(type) {
case *types.PluginV1:
if !cfg.PreserveResourceID {
copy := *plugin
copy.SetResourceID(0)
plugin = &copy
}
var buf bytes.Buffer
err := (&jsonpb.Marshaler{}).Marshal(&buf, plugin)
if err != nil {
return nil, trace.Wrap(err)
}
return buf.Bytes(), nil
default:
return nil, trace.BadParameter("unsupported plugin resource %T", plugin)
}
}
// UnmarshalPlugin unmarshals the plugin resource from JSON.
func UnmarshalPlugin(data []byte, opts ...MarshalOption) (types.Plugin, error) {
if len(data) == 0 {
return nil, trace.BadParameter("missing plugin resource data")
}
cfg, err := CollectOptions(opts)
if err != nil {
return nil, trace.Wrap(err)
}
var h types.ResourceHeader
if err := utils.FastUnmarshal(data, &h); err != nil {
return nil, trace.Wrap(err)
}
switch h.Version {
case types.V1:
var plugin types.PluginV1
if err := jsonpb.Unmarshal(bytes.NewReader(data), &plugin); err != nil {
return nil, trace.BadParameter(err.Error())
}
if err := plugin.CheckAndSetDefaults(); err != nil {
return nil, trace.Wrap(err)
}
if cfg.ID != 0 {
plugin.SetResourceID(cfg.ID)
}
if !cfg.Expires.IsZero() {
plugin.SetExpiry(cfg.Expires)
}
return &plugin, nil
}
return nil, trace.BadParameter("unsupported plugin resource version %q", h.Version)
}