Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Redact sensitive information from the karmadactl init command output #5714

Merged
merged 1 commit into from
Nov 26, 2024

Conversation

zhzhuang-zju
Copy link
Contributor

What type of PR is this?
/kind feature

What this PR does / why we need it:
The karmadactl init command, at the end of the initializtaion, writes some sensitive information in the stdout, like token, in its karmadactl register example. This will bring up two issues:

  • data leak, for instance in CI/CD logs
    image

  • The token's validity period is one day. Users may not join the pull mode member clusters immediately after installing Karmada, causing the secret to expire.

I hope the command output to be how to do rather than what to do. Users can follow the steps in the command output as needed.

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:
Modified command output:

Register cluster with 'Pull' mode

Step 1: Create bootstrap tokens and get the full 'karmadactl register' flag needed to register the member cluster using the token.
(In karmada)~# karmadactl token create --print-register-command --kubeconfig /etc/init/members/karmada-apiserver.config
karmadactl register [karmada-apiserver-endpoint] --token [token] --discovery-token-ca-cert-hash [ca-cert-hash]

Step 2: Use the output result from step 1 to register the cluster to Karmada control plane. "--cluster-name" is set to cluster of current-context by default.
(In member cluster)~# karmadactl register [karmada-apiserver-endpoint] --token [token] --discovery-token-ca-cert-hash [ca-cert-hash]

Step 3: Show members of karmada
(In karmada)~# karmadactl --kubeconfig /etc/init/members/karmada-apiserver.config get clusters

Does this PR introduce a user-facing change?:


@karmada-bot karmada-bot added the kind/feature Categorizes issue or PR as related to a new feature. label Oct 19, 2024
@karmada-bot karmada-bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Oct 19, 2024
@codecov-commenter
Copy link

codecov-commenter commented Oct 19, 2024

⚠️ Please install the 'codecov app svg image' to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

Attention: Patch coverage is 94.44444% with 1 line in your changes missing coverage. Please review.

Project coverage is 46.24%. Comparing base (72cfef5) to head (429f2d3).
Report is 2 commits behind head on master.

Files with missing lines Patch % Lines
pkg/karmadactl/cmdinit/kubernetes/deploy.go 0.00% 1 Missing ⚠️

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #5714      +/-   ##
==========================================
+ Coverage   46.18%   46.24%   +0.05%     
==========================================
  Files         663      663              
  Lines       54592    54575      -17     
==========================================
+ Hits        25215    25236      +21     
+ Misses      27752    27717      -35     
+ Partials     1625     1622       -3     
Flag Coverage Δ
unittests 46.24% <94.44%> (+0.05%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@zhzhuang-zju
Copy link
Contributor Author

/assign @RainbowMango

@RainbowMango
Copy link
Member

OK. Please rebase the code to make the new tests happy.

Comment on lines 209 to 217
Step 1: Create bootstrap tokens and get the full '%[2]s register' flag needed to register the member cluster using the token.
(In karmada)~# %[2]s token create --print-register-command --kubeconfig %[1]s/karmada-apiserver.config
%[2]s register [karmada-apiserver-endpoint] --token [token] --discovery-token-ca-cert-hash [ca-cert-hash]

Step 2: Show members of karmada
(In karmada)~# kubectl --kubeconfig %[1]s/karmada-apiserver.config get clusters
Step 2: Use the output result from step 1 to register the cluster to Karmada control plane. "--cluster-name" is set to cluster of current-context by default.
(In member cluster)~# %[2]s register [karmada-apiserver-endpoint] --token [token] --discovery-token-ca-cert-hash [ca-cert-hash]

Step 3: Show members of karmada
(In karmada)~# karmadactl --kubeconfig %[1]s/karmada-apiserver.config get clusters
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Something like:

Step 1: Create bootstrap token and generate the '%[2]s register' command which will be used later.
~# %[2]s token create --print-register-command --kubeconfig=<path-to-karmada-config>
This command will generate a registration command similar to:

%[2]s register 172.18.0.5:5443 --token t8xfio.640u9gp9obc72v5d --discovery-token-ca-cert-hash sha256:9cfa542ff48f43793d1816b1dd0a78ad574e349d8f6e005e6e32e8ab528e4244

Step 2: Use the output from Step 1 to register the cluster to the Karmada control plane. 
You need to specify the target member cluster by flag '--kubeconfig'
~# %[2]s register 172.18.0.5:5443 --token t8xfio.640u9gp9obc72v5d --discovery-token-ca-cert-hash sha256:9cfa542ff48f43793d1816b1dd0a78ad574e349d8f6e005e6e32e8ab528e4244 --kubeconfig=<path-to-member-cluster-kubeconfig>

Step 3: Show members of Karmada
~# %[2]s --kubeconfig=<path-to-karmada-config> get clusters

The %[2]s register command has several optional parameters for setting the properties of the member cluster. For more details, run:

~# %[2]s register --help

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Since this is an example of karmadactl init, path-to-karmada-config is deterministic and can be referred to directly by %[1]s/karmada-apiserver.config

Copy link
Member

@RainbowMango RainbowMango left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@karmada-bot karmada-bot added the lgtm Indicates that a PR is ready to be merged. label Nov 26, 2024
@karmada-bot
Copy link
Collaborator

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: RainbowMango

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@karmada-bot karmada-bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Nov 26, 2024
@karmada-bot karmada-bot merged commit 6ceb3a9 into karmada-io:master Nov 26, 2024
18 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. kind/feature Categorizes issue or PR as related to a new feature. lgtm Indicates that a PR is ready to be merged. size/M Denotes a PR that changes 30-99 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants