From c588d485fa4546ff5162e275a62bfaa0c77aef40 Mon Sep 17 00:00:00 2001 From: Denis Kirillov Date: Fri, 23 Jun 2023 16:12:18 +0300 Subject: [PATCH] [#131] authmate: Add update-secret cobra cmd Signed-off-by: Denis Kirillov --- cmd/s3-authmate/modules/root.go | 3 + cmd/s3-authmate/modules/update-secret.go | 108 +++++++++++++++++++++++ 2 files changed, 111 insertions(+) create mode 100644 cmd/s3-authmate/modules/update-secret.go diff --git a/cmd/s3-authmate/modules/root.go b/cmd/s3-authmate/modules/root.go index fa34ade8..5d29fede 100644 --- a/cmd/s3-authmate/modules/root.go +++ b/cmd/s3-authmate/modules/root.go @@ -62,4 +62,7 @@ GoVersion: {{ runtimeVersion }} rootCmd.AddCommand(generatePresignedURLCmd) initGeneratePresignedURLCmd() + + rootCmd.AddCommand(updateSecretCmd) + initUpdateSecretCmd() } diff --git a/cmd/s3-authmate/modules/update-secret.go b/cmd/s3-authmate/modules/update-secret.go new file mode 100644 index 00000000..a978cd9a --- /dev/null +++ b/cmd/s3-authmate/modules/update-secret.go @@ -0,0 +1,108 @@ +package modules + +import ( + "context" + "fmt" + "os" + "strings" + + "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/authmate" + "git.frostfs.info/TrueCloudLab/frostfs-s3-gw/internal/wallet" + oid "git.frostfs.info/TrueCloudLab/frostfs-sdk-go/object/id" + "github.com/nspcc-dev/neo-go/pkg/crypto/keys" + "github.com/spf13/cobra" + "github.com/spf13/viper" +) + +var updateSecretCmd = &cobra.Command{ + Use: "update-secret", + Short: "Update a secret in FrostFS network", + Long: `Creates new access box that will be available for extend list of s3 gates, preserve all timeout from initial credentials. +After using this command you can use initial access-key-id to interact with newly added gates`, + Example: `To extend list of s3 gates that can use existing credentials run: +frostfs-s3-authmate update-secret --wallet wallet.json --peer s01.neofs.devenv:8080 --gate-wallet s3-wallet.json \ + --gate-public-key 031a6c6fbbdf02ca351745fa86b9ba5a9452d785ac4f7fc2b7548ca2a46c4fcf4a \ + --gate-public-key 021dc56fc6d81d581ae7605a8e00e0e0bab6cbad566a924a527339475a97a8e38e \ + --acces-key-id EC3tyWpTEKfGNS888PFBpwQzZTrnwDXReGjgAxa8Em1h037VoWktUZCAk1LVA5SvVbVd2NHHb2NQm9jhcd5WFU5VD`, + RunE: runUpdateSecretCmd, +} + +func initUpdateSecretCmd() { + updateSecretCmd.Flags().String(walletFlag, "", "Path to the wallet that will be owner of the credentials") + updateSecretCmd.Flags().String(addressFlag, "", "Address of the wallet account") + updateSecretCmd.Flags().String(peerFlag, "", "Address of a frostfs peer to connect to") + updateSecretCmd.Flags().String(gateWalletFlag, "", "Path to the s3 gateway wallet to decrypt accessbox") + updateSecretCmd.Flags().String(gateAddressFlag, "", "Address of the s3 gateway wallet account") + updateSecretCmd.Flags().String(accessKeyIDFlag, "", "Access key id of s3 credential for which secret must be obtained") + updateSecretCmd.Flags().StringSlice(gatePublicKeyFlag, nil, "Public 256r1 key of a gate (use flags repeatedly for multiple gates or separate them by comma)") + updateSecretCmd.Flags().Duration(poolDialTimeoutFlag, defaultPoolDialTimeout, "Timeout for connection to the node in pool to be established") + updateSecretCmd.Flags().Duration(poolHealthcheckTimeoutFlag, defaultPoolHealthcheckTimeout, "Timeout for request to node to decide if it is alive") + updateSecretCmd.Flags().Duration(poolRebalanceIntervalFlag, defaultPoolRebalanceInterval, "Interval for updating nodes health status") + updateSecretCmd.Flags().Duration(poolStreamTimeoutFlag, defaultPoolStreamTimeout, "Timeout for individual operation in streaming RPC") + + _ = updateSecretCmd.MarkFlagRequired(walletFlag) + _ = updateSecretCmd.MarkFlagRequired(peerFlag) + _ = updateSecretCmd.MarkFlagRequired(gateWalletFlag) + _ = updateSecretCmd.MarkFlagRequired(accessKeyIDFlag) + _ = updateSecretCmd.MarkFlagRequired(gatePublicKeyFlag) +} + +func runUpdateSecretCmd(cmd *cobra.Command, _ []string) error { + ctx, cancel := context.WithTimeout(cmd.Context(), viper.GetDuration(timeoutFlag)) + defer cancel() + + log := getLogger() + + password := wallet.GetPassword(viper.GetViper(), walletPassphraseCfg) + key, err := wallet.GetKeyFromPath(viper.GetString(walletFlag), viper.GetString(addressFlag), password) + if err != nil { + return fmt.Errorf("failed to load frostfs private key: %s", err) + } + + gatePassword := wallet.GetPassword(viper.GetViper(), walletGatePassphraseCfg) + gateKey, err := wallet.GetKeyFromPath(viper.GetString(gateWalletFlag), viper.GetString(gateAddressFlag), gatePassword) + if err != nil { + return fmt.Errorf("failed to load s3 gate private key: %s", err) + } + + var accessBoxAddress oid.Address + credAddr := strings.Replace(viper.GetString(accessKeyIDFlag), "0", "/", 1) + if err = accessBoxAddress.DecodeString(credAddr); err != nil { + return fmt.Errorf("failed to parse creds address: %w", err) + } + + var gatesPublicKeys []*keys.PublicKey + for _, keyStr := range viper.GetStringSlice(gatePublicKeyFlag) { + gpk, err := keys.NewPublicKeyFromString(keyStr) + if err != nil { + return fmt.Errorf("failed to load gate's public key: %s", err) + } + gatesPublicKeys = append(gatesPublicKeys, gpk) + } + + poolCfg := PoolConfig{ + Key: &key.PrivateKey, + Address: viper.GetString(peerFlag), + DialTimeout: viper.GetDuration(poolDialTimeoutFlag), + HealthcheckTimeout: viper.GetDuration(poolHealthcheckTimeoutFlag), + StreamTimeout: viper.GetDuration(poolStreamTimeoutFlag), + RebalanceInterval: viper.GetDuration(poolRebalanceIntervalFlag), + } + + frostFS, err := createFrostFS(ctx, log, poolCfg) + if err != nil { + return fmt.Errorf("failed to create FrostFS component: %s", err) + } + + updateSecretOptions := &authmate.UpdateSecretOptions{ + Address: accessBoxAddress, + FrostFSKey: key, + GatesPublicKeys: gatesPublicKeys, + GatePrivateKey: gateKey, + } + + if err = authmate.New(log, frostFS).UpdateSecret(ctx, os.Stdout, updateSecretOptions); err != nil { + return fmt.Errorf("failed to update secret: %s", err) + } + return nil +}