From d66c8ff259da4706f6f95eff69ef869a102d3346 Mon Sep 17 00:00:00 2001 From: hc-github-team-secure-vault-core <82990506+hc-github-team-secure-vault-core@users.noreply.github.com> Date: Fri, 8 Sep 2023 13:55:57 -0400 Subject: [PATCH] backport of commit 69fda8da76a5feb7e4d29264fec2e7fa12e08459 (#22923) Co-authored-by: Theron Voran --- sdk/helper/pluginutil/run_config.go | 34 +++++++++++++++++++++--- sdk/helper/pluginutil/run_config_test.go | 34 +++++++++++++++++++----- sdk/helper/pluginutil/runner.go | 1 + 3 files changed, 58 insertions(+), 11 deletions(-) diff --git a/sdk/helper/pluginutil/run_config.go b/sdk/helper/pluginutil/run_config.go index fddca60508..bd231647e3 100644 --- a/sdk/helper/pluginutil/run_config.go +++ b/sdk/helper/pluginutil/run_config.go @@ -20,6 +20,15 @@ import ( "github.com/hashicorp/vault/sdk/helper/pluginruntimeutil" ) +const ( + // Labels for plugin container ownership + labelVaultPID = "com.hashicorp.vault.pid" + labelVaultClusterID = "com.hashicorp.vault.cluster.id" + labelVaultPluginName = "com.hashicorp.vault.plugin.name" + labelVaultPluginVersion = "com.hashicorp.vault.plugin.version" + labelVaultPluginType = "com.hashicorp.vault.plugin.type" +) + type PluginClientConfig struct { Name string PluginType consts.PluginType @@ -123,7 +132,10 @@ func (rc runConfig) makeConfig(ctx context.Context) (*plugin.ClientConfig, error Hash: sha256.New(), } } else { - containerCfg := rc.containerConfig(cmd.Env) + containerCfg, err := rc.containerConfig(ctx, cmd.Env) + if err != nil { + return nil, err + } clientConfig.SkipHostEnv = true clientConfig.RunnerFunc = containerCfg.NewContainerRunner clientConfig.UnixSocketConfig = &plugin.UnixSocketConfig{ @@ -133,7 +145,11 @@ func (rc runConfig) makeConfig(ctx context.Context) (*plugin.ClientConfig, error return clientConfig, nil } -func (rc runConfig) containerConfig(env []string) *plugincontainer.Config { +func (rc runConfig) containerConfig(ctx context.Context, env []string) (*plugincontainer.Config, error) { + clusterID, err := rc.Wrapper.ClusterID(ctx) + if err != nil { + return nil, err + } cfg := &plugincontainer.Config{ Image: rc.image, Tag: rc.imageTag, @@ -143,9 +159,14 @@ func (rc runConfig) containerConfig(env []string) *plugincontainer.Config { GroupAdd: os.Getgid(), Runtime: consts.DefaultContainerPluginOCIRuntime, Labels: map[string]string{ - "managed-by": "hashicorp.com/vault", + labelVaultPID: strconv.Itoa(os.Getpid()), + labelVaultClusterID: clusterID, + labelVaultPluginName: rc.PluginClientConfig.Name, + labelVaultPluginType: rc.PluginClientConfig.PluginType.String(), + labelVaultPluginVersion: rc.PluginClientConfig.Version, }, } + // Use rc.command and rc.args directly instead of cmd.Path and cmd.Args, as // exec.Command may mutate the provided command. if rc.command != "" { @@ -163,7 +184,7 @@ func (rc runConfig) containerConfig(env []string) *plugincontainer.Config { } } - return cfg + return cfg, nil } func (rc runConfig) run(ctx context.Context) (*plugin.Client, error) { @@ -240,6 +261,11 @@ func (r *PluginRunner) RunConfig(ctx context.Context, opts ...RunOpt) (*plugin.C sha256: r.Sha256, env: r.Env, runtimeConfig: r.RuntimeConfig, + PluginClientConfig: PluginClientConfig{ + Name: r.Name, + PluginType: r.Type, + Version: r.Version, + }, } for _, opt := range opts { diff --git a/sdk/helper/pluginutil/run_config_test.go b/sdk/helper/pluginutil/run_config_test.go index 4469401203..25a950725c 100644 --- a/sdk/helper/pluginutil/run_config_test.go +++ b/sdk/helper/pluginutil/run_config_test.go @@ -432,11 +432,16 @@ func (m *mockRunnerUtil) MlockEnabled() bool { return args.Bool(0) } +func (m *mockRunnerUtil) ClusterID(ctx context.Context) (string, error) { + return "1234", nil +} + func TestContainerConfig(t *testing.T) { dummySHA, err := hex.DecodeString("abc123") if err != nil { t.Fatal(err) } + myPID := strconv.Itoa(os.Getpid()) for name, tc := range map[string]struct { rc runConfig expected plugincontainer.Config @@ -460,8 +465,11 @@ func TestContainerConfig(t *testing.T) { MagicCookieKey: "magic_cookie_key", MagicCookieValue: "magic_cookie_value", }, - Logger: hclog.NewNullLogger(), - AutoMTLS: true, + Logger: hclog.NewNullLogger(), + AutoMTLS: true, + Name: "some-plugin", + PluginType: consts.PluginTypeCredential, + Version: "v0.1.0", }, }, expected: plugincontainer.Config{ @@ -477,7 +485,11 @@ func TestContainerConfig(t *testing.T) { fmt.Sprintf("%s=%t", PluginAutoMTLSEnv, true), }, Labels: map[string]string{ - "managed-by": "hashicorp.com/vault", + labelVaultPID: myPID, + labelVaultClusterID: "1234", + labelVaultPluginName: "some-plugin", + labelVaultPluginType: "auth", + labelVaultPluginVersion: "v0.1.0", }, Runtime: consts.DefaultContainerPluginOCIRuntime, GroupAdd: os.Getgid(), @@ -505,8 +517,11 @@ func TestContainerConfig(t *testing.T) { MagicCookieKey: "magic_cookie_key", MagicCookieValue: "magic_cookie_value", }, - Logger: hclog.NewNullLogger(), - AutoMTLS: true, + Logger: hclog.NewNullLogger(), + AutoMTLS: true, + Name: "some-plugin", + PluginType: consts.PluginTypeCredential, + Version: "v0.1.0", }, }, expected: plugincontainer.Config{ @@ -519,7 +534,11 @@ func TestContainerConfig(t *testing.T) { fmt.Sprintf("%s=%t", PluginAutoMTLSEnv, true), }, Labels: map[string]string{ - "managed-by": "hashicorp.com/vault", + labelVaultPID: myPID, + labelVaultClusterID: "1234", + labelVaultPluginName: "some-plugin", + labelVaultPluginType: "auth", + labelVaultPluginVersion: "v0.1.0", }, Runtime: "some-oci-runtime", GroupAdd: os.Getgid(), @@ -540,7 +559,8 @@ func TestContainerConfig(t *testing.T) { if err != nil { t.Fatal(err) } - cfg := tc.rc.containerConfig(cmd.Env) + cfg, err := tc.rc.containerConfig(context.Background(), cmd.Env) + require.NoError(t, err) require.Equal(t, tc.expected, *cfg) }) } diff --git a/sdk/helper/pluginutil/runner.go b/sdk/helper/pluginutil/runner.go index 316a16fe3f..c627204b1a 100644 --- a/sdk/helper/pluginutil/runner.go +++ b/sdk/helper/pluginutil/runner.go @@ -33,6 +33,7 @@ type RunnerUtil interface { ResponseWrapData(ctx context.Context, data map[string]interface{}, ttl time.Duration, jwt bool) (*wrapping.ResponseWrapInfo, error) MlockEnabled() bool VaultVersion(ctx context.Context) (string, error) + ClusterID(ctx context.Context) (string, error) } // LookRunnerUtil defines the functions for both Looker and Wrapper