Skip to content

Commit f94a5cb

Browse files
k8s-ci-robotk8s-ci-robot
authored
Merge pull request #352 from aramase/gosec
feat: add gosec linter and fix warnings
2 parents 10c224d + 69462e0 commit f94a5cb

File tree

7 files changed

+29
-32
lines changed

7 files changed

+29
-32
lines changed

‎.golangci.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,11 +6,15 @@ run:
66
linters:
77
disable-all: true
88
enable:
9+
- deadcode
910
- gofmt
1011
- goimports
1112
- gosimple
1213
- golint
1314
- govet
15+
- gosec
1416
- ineffassign
1517
- misspell
1618
- unused
19+
- structcheck
20+
- varcheck

‎pkg/errors/errors.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,5 +38,6 @@ const (
3838
// PodNotFound error
3939
PodNotFound = "PodNotFound"
4040
// NodePublishSecretRefNotFound error
41+
// #nosec G101 (Ref: https://github.com/securego/gosec/issues/295)
4142
NodePublishSecretRefNotFound = "NodePublishSecretRefNotFound"
4243
)

‎pkg/secrets-store/nodeserver.go

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@ import (
2828
"github.com/container-storage-interface/spec/lib/go/csi"
2929

3030
"sigs.k8s.io/controller-runtime/pkg/client"
31+
3132
csicommon "sigs.k8s.io/secrets-store-csi-driver/pkg/csi-common"
3233
internalerrors "sigs.k8s.io/secrets-store-csi-driver/pkg/errors"
3334
"sigs.k8s.io/secrets-store-csi-driver/pkg/version"

‎pkg/secrets-store/utils.go

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -31,21 +31,12 @@ import (
3131

3232
apierrors "k8s.io/apimachinery/pkg/api/errors"
3333
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
34-
"k8s.io/apimachinery/pkg/runtime/schema"
3534
"k8s.io/apimachinery/pkg/types"
3635
"sigs.k8s.io/controller-runtime/pkg/client"
3736

3837
"sigs.k8s.io/secrets-store-csi-driver/apis/v1alpha1"
3938
)
4039

41-
var (
42-
secretProviderClassGvk = schema.GroupVersionKind{
43-
Group: "secrets-store.csi.x-k8s.io",
44-
Version: "v1alpha1",
45-
Kind: "SecretProviderClassList",
46-
}
47-
)
48-
4940
// getProviderPath returns the absolute path to the provider binary
5041
func (ns *nodeServer) getProviderPath(goos string, providerName string) string {
5142
if goos == "windows" {

‎pkg/util/secretutil/secret.go

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ package secretutil
1919
import (
2020
"crypto/ecdsa"
2121
"crypto/rsa"
22-
"crypto/sha1"
22+
"crypto/sha256"
2323
"crypto/x509"
2424
"encoding/pem"
2525
"fmt"
@@ -198,7 +198,7 @@ func GetSHAFromSecret(data map[string][]byte) (string, error) {
198198

199199
// generateSHA generates SHA from string
200200
func generateSHA(data string) (string, error) {
201-
hasher := sha1.New()
201+
hasher := sha256.New()
202202
_, err := io.WriteString(hasher, data)
203203
if err != nil {
204204
return "", err

‎test/bats/azure.bats

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ setup() {
128128
result=$(kubectl get secret foosecret -o jsonpath="{.data.username}" | base64 -d)
129129
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
130130

131-
result=$(kubectl exec -it $POD printenv | grep SECRET_USERNAME) | awk -F"=" '{ print $2}'
131+
result=$(kubectl exec $POD printenv | grep SECRET_USERNAME) | awk -F"=" '{ print $2}'
132132
[[ "${result//$'\r'}" == "${SECRET_VALUE}" ]]
133133

134134
result=$(kubectl get secret foosecret -o jsonpath="{.metadata.labels.environment}")

‎test/bats/vault.bats

Lines changed: 20 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -62,7 +62,7 @@ EOF
6262

6363
@test "setup vault" {
6464
VAULT_POD=$(kubectl get pod -l app=vault -o jsonpath="{.items[0].metadata.name}")
65-
run kubectl exec -it $VAULT_POD -- vault auth enable kubernetes
65+
run kubectl exec $VAULT_POD -- vault auth enable kubernetes
6666
assert_success
6767

6868
CLUSTER_NAME="$(kubectl config view --raw \
@@ -79,13 +79,13 @@ EOF
7979
export K8S_CACERT="$(kubectl config view --raw \
8080
-o go-template="{{ range .clusters }}{{ if eq .name \"${CLUSTER_NAME}\" }}{{ index .cluster \"certificate-authority-data\" }}{{ end }}{{ end }}" | base64 --decode)"
8181

82-
run kubectl exec -it $VAULT_POD -- vault write auth/kubernetes/config \
82+
run kubectl exec $VAULT_POD -- vault write auth/kubernetes/config \
8383
kubernetes_host="${K8S_HOST}" \
8484
kubernetes_ca_cert="${K8S_CACERT}" \
8585
token_reviewer_jwt="${TR_ACCOUNT_TOKEN}"
8686
assert_success
8787

88-
run kubectl exec -it $VAULT_POD -- vault policy write example-readonly -<<EOF
88+
run kubectl exec -ti $VAULT_POD -- vault policy write example-readonly -<<EOF
8989
path "secret/data/foo" {
9090
capabilities = ["read", "list"]
9191
}
@@ -100,17 +100,17 @@ path "secret/data/foo" {
100100
EOF
101101
assert_success
102102

103-
run kubectl exec -it $VAULT_POD -- vault write auth/kubernetes/role/example-role \
103+
run kubectl exec $VAULT_POD -- vault write auth/kubernetes/role/example-role \
104104
bound_service_account_names=secrets-store-csi-driver \
105105
bound_service_account_namespaces=$NAMESPACE \
106106
policies=default,example-readonly \
107107
ttl=20m
108108
assert_success
109109

110-
run kubectl exec -it $VAULT_POD -- vault kv put secret/foo bar=hello
110+
run kubectl exec $VAULT_POD -- vault kv put secret/foo bar=hello
111111
assert_success
112112

113-
run kubectl exec -it $VAULT_POD -- vault kv put secret/foo1 bar=hello1
113+
run kubectl exec $VAULT_POD -- vault kv put secret/foo1 bar=hello1
114114
assert_success
115115
}
116116

@@ -145,10 +145,10 @@ EOF
145145
}
146146

147147
@test "CSI inline volume test with pod portability - read vault secret from pod" {
148-
result=$(kubectl exec -it nginx-secrets-store-inline -- cat /mnt/secrets-store/foo)
148+
result=$(kubectl exec nginx-secrets-store-inline -- cat /mnt/secrets-store/foo)
149149
[[ "$result" == "hello" ]]
150150

151-
result=$(kubectl exec -it nginx-secrets-store-inline -- cat /mnt/secrets-store/foo1)
151+
result=$(kubectl exec nginx-secrets-store-inline -- cat /mnt/secrets-store/foo1)
152152
[[ "$result" == "hello1" ]]
153153
}
154154

@@ -175,16 +175,16 @@ EOF
175175

176176
@test "Sync with K8s secrets - read secret from pod, read K8s secret, read env var, check secret ownerReferences with multiple owners" {
177177
POD=$(kubectl get pod -l app=nginx -o jsonpath="{.items[0].metadata.name}")
178-
result=$(kubectl exec -it $POD -- cat /mnt/secrets-store/foo)
178+
result=$(kubectl exec $POD -- cat /mnt/secrets-store/foo)
179179
[[ "$result" == "hello" ]]
180180

181-
result=$(kubectl exec -it $POD -- cat /mnt/secrets-store/foo1)
181+
result=$(kubectl exec $POD -- cat /mnt/secrets-store/foo1)
182182
[[ "$result" == "hello1" ]]
183183

184184
result=$(kubectl get secret foosecret -o jsonpath="{.data.pwd}" | base64 -d)
185185
[[ "$result" == "hello" ]]
186186

187-
result=$(kubectl exec -it $POD -- printenv | grep SECRET_USERNAME | awk -F"=" '{ print $2 }' | tr -d '\r\n')
187+
result=$(kubectl exec $POD -- printenv | grep SECRET_USERNAME | awk -F"=" '{ print $2 }' | tr -d '\r\n')
188188
[[ "$result" == "hello1" ]]
189189

190190
result=$(kubectl get secret foosecret -o jsonpath="{.metadata.labels.environment}")
@@ -241,16 +241,16 @@ EOF
241241

242242
@test "Test Namespaced scope SecretProviderClass - Sync with K8s secrets - read secret from pod, read K8s secret, read env var, check secret ownerReferences" {
243243
POD=$(kubectl get pod -l app=nginx -n test-ns -o jsonpath="{.items[0].metadata.name}")
244-
result=$(kubectl exec -n test-ns -it $POD -- cat /mnt/secrets-store/foo)
244+
result=$(kubectl exec -n test-ns $POD -- cat /mnt/secrets-store/foo)
245245
[[ "$result" == "hello" ]]
246246

247-
result=$(kubectl exec -n test-ns -it $POD -- cat /mnt/secrets-store/foo1)
247+
result=$(kubectl exec -n test-ns $POD -- cat /mnt/secrets-store/foo1)
248248
[[ "$result" == "hello1" ]]
249249

250250
result=$(kubectl get secret foosecret -n test-ns -o jsonpath="{.data.pwd}" | base64 -d)
251251
[[ "$result" == "hello" ]]
252252

253-
result=$(kubectl exec -n test-ns -it $POD -- printenv | grep SECRET_USERNAME | awk -F"=" '{ print $2 }' | tr -d '\r\n')
253+
result=$(kubectl exec -n test-ns $POD -- printenv | grep SECRET_USERNAME | awk -F"=" '{ print $2 }' | tr -d '\r\n')
254254
[[ "$result" == "hello1" ]]
255255

256256
result=$(kubectl get secret -n test-ns foosecret -o json | jq '.metadata.ownerReferences | length')
@@ -312,31 +312,31 @@ EOF
312312
}
313313

314314
@test "CSI inline volume test with multiple secret provider class" {
315-
result=$(kubectl exec -it nginx-secrets-store-inline-multiple-crd -- cat /mnt/secrets-store-0/foo)
315+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- cat /mnt/secrets-store-0/foo)
316316
[[ "$result" == "hello" ]]
317317

318-
result=$(kubectl exec -it nginx-secrets-store-inline-multiple-crd -- cat /mnt/secrets-store-0/foo1)
318+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- cat /mnt/secrets-store-0/foo1)
319319
[[ "$result" == "hello1" ]]
320320

321321
result=$(kubectl get secret foosecret-0 -o jsonpath="{.data.pwd}" | base64 -d)
322322
[[ "$result" == "hello" ]]
323323

324-
result=$(kubectl exec -it nginx-secrets-store-inline-multiple-crd -- printenv | grep SECRET_USERNAME_0 | awk -F"=" '{ print $2 }' | tr -d '\r\n')
324+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- printenv | grep SECRET_USERNAME_0 | awk -F"=" '{ print $2 }' | tr -d '\r\n')
325325
[[ "$result" == "hello1" ]]
326326

327327
result=$(kubectl get secret foosecret-0 -o json | jq '.metadata.ownerReferences | length')
328328
[[ "$result" -eq 1 ]]
329329

330-
result=$(kubectl exec -it nginx-secrets-store-inline-multiple-crd -- cat /mnt/secrets-store-1/foo)
330+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- cat /mnt/secrets-store-1/foo)
331331
[[ "$result" == "hello" ]]
332332

333-
result=$(kubectl exec -it nginx-secrets-store-inline-multiple-crd -- cat /mnt/secrets-store-1/foo1)
333+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- cat /mnt/secrets-store-1/foo1)
334334
[[ "$result" == "hello1" ]]
335335

336336
result=$(kubectl get secret foosecret-1 -o jsonpath="{.data.pwd}" | base64 -d)
337337
[[ "$result" == "hello" ]]
338338

339-
result=$(kubectl exec -it nginx-secrets-store-inline-multiple-crd -- printenv | grep SECRET_USERNAME_1 | awk -F"=" '{ print $2 }' | tr -d '\r\n')
339+
result=$(kubectl exec nginx-secrets-store-inline-multiple-crd -- printenv | grep SECRET_USERNAME_1 | awk -F"=" '{ print $2 }' | tr -d '\r\n')
340340
[[ "$result" == "hello1" ]]
341341

342342
result=$(kubectl get secret foosecret-1 -o json | jq '.metadata.ownerReferences | length')

0 commit comments

Comments
 (0)