Skip to content

Commit 0408f56

Browse files
huww98huww98
committed
metadata: migrate STS SDK to v2
1 parent 2ad17df commit 0408f56

26 files changed

Lines changed: 1932 additions & 780 deletions

‎Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@ pkg/cloud/ecsmock.go: pkg/cloud/ecsinterface.go
7676
go tool mockgen -source pkg/cloud/ecsinterface.go -destination $@ -package cloud
7777
pkg/cloud/eflomock.go: pkg/cloud/eflointerface.go
7878
go tool mockgen -source pkg/cloud/eflointerface.go -destination $@ -package cloud
79+
pkg/cloud/stsmock.go: pkg/cloud/stsinterface.go
80+
go tool mockgen -source pkg/cloud/stsinterface.go -destination $@ -package cloud
7981

8082
PROTOC=protoc
8183
pkg/disk/proto/disk.pb.go pkg/disk/proto/disk_ttrpc.pb.go: pkg/disk/disk.proto

‎go.mod‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ require (
1010
github.com/alibabacloud-go/eflo-controller-20221215/v3 v3.0.0
1111
github.com/alibabacloud-go/ens-20171110/v3 v3.0.2
1212
github.com/alibabacloud-go/nas-20170626/v4 v4.1.2
13+
github.com/alibabacloud-go/sts-20150401/v2 v2.0.4
1314
github.com/alibabacloud-go/tea v1.3.13
1415
github.com/aliyun/alibaba-cloud-sdk-go v1.63.107
1516
github.com/aliyun/credentials-go v1.4.8

‎go.sum‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ github.com/alibabacloud-go/darabonba-map v0.0.2 h1:qvPnGB4+dJbJIxOOfawxzF3hzMnIp
3131
github.com/alibabacloud-go/darabonba-map v0.0.2/go.mod h1:28AJaX8FOE/ym8OUFWga+MtEzBunJwQGceGQlvaPGPc=
3232
github.com/alibabacloud-go/darabonba-openapi v0.1.16 h1:f6ZspWKTBurQzyLpZKMVxO51HAePY8aedicwuX3+E20=
3333
github.com/alibabacloud-go/darabonba-openapi v0.1.16/go.mod h1:ZjyqRbbZOaUBSh7keeH8VQN/BzCPvxCQwMuJGDdbmXQ=
34+
github.com/alibabacloud-go/darabonba-openapi/v2 v2.0.11/go.mod h1:wHxkgZT1ClZdcwEVP/pDgYK/9HucsnCfMipmJgCz4xY=
3435
github.com/alibabacloud-go/darabonba-openapi/v2 v2.1.12/go.mod h1:f2wDpbM7hK9SvLIH09zSKVU1TsyemUNOqErMscMMl7c=
3536
github.com/alibabacloud-go/darabonba-openapi/v2 v2.1.13 h1:Q00FU3H94Ts0ZIHDmY+fYGgB7dV9D/YX6FGsgorQPgw=
3637
github.com/alibabacloud-go/darabonba-openapi/v2 v2.1.13/go.mod h1:lxFGfobinVsQ49ntjpgWghXmIF0/Sm4+wvBJ1h5RtaE=
@@ -56,6 +57,8 @@ github.com/alibabacloud-go/openapi-util v0.0.11/go.mod h1:sQuElr4ywwFRlCCberQwKR
5657
github.com/alibabacloud-go/openapi-util v0.1.0/go.mod h1:sQuElr4ywwFRlCCberQwKRFhRzIyG4QTP/P4y1CJ6Ws=
5758
github.com/alibabacloud-go/openapi-util v0.1.1 h1:ujGErJjG8ncRW6XtBBMphzHTvCxn4DjrVw4m04HsS28=
5859
github.com/alibabacloud-go/openapi-util v0.1.1/go.mod h1:/UehBSE2cf1gYT43GV4E+RxTdLRzURImCYY0aRmlXpw=
60+
github.com/alibabacloud-go/sts-20150401/v2 v2.0.4 h1:LCw5Wq/oGhCT1DxM3KGzEAeeJjPcKpWTnhs+ZIG3RYE=
61+
github.com/alibabacloud-go/sts-20150401/v2 v2.0.4/go.mod h1:IUTzgO9AhR6xm/wKnHPZYVsOr1GMRuPK6KFXYP3BrM8=
5962
github.com/alibabacloud-go/tea v1.1.0/go.mod h1:IkGyUSX4Ba1V+k4pCtJUc6jDpZLFph9QMy2VUPTwukg=
6063
github.com/alibabacloud-go/tea v1.1.7/go.mod h1:/tmnEaQMyb4Ky1/5D+SE1BAsa5zj/KeGOFfwYm3N/p4=
6164
github.com/alibabacloud-go/tea v1.1.8/go.mod h1:/tmnEaQMyb4Ky1/5D+SE1BAsa5zj/KeGOFfwYm3N/p4=
@@ -73,6 +76,7 @@ github.com/alibabacloud-go/tea-utils/v2 v2.0.5/go.mod h1:dL6vbUT35E4F4bFTHL845eU
7376
github.com/alibabacloud-go/tea-utils/v2 v2.0.6/go.mod h1:qxn986l+q33J5VkialKMqT/TTs3E+U9MJpd001iWQ9I=
7477
github.com/alibabacloud-go/tea-utils/v2 v2.0.7 h1:WDx5qW3Xa5ZgJ1c8NfqJkF6w+AU5wB8835UdhPr6Ax0=
7578
github.com/alibabacloud-go/tea-utils/v2 v2.0.7/go.mod h1:qxn986l+q33J5VkialKMqT/TTs3E+U9MJpd001iWQ9I=
79+
github.com/alibabacloud-go/tea-xml v1.1.3/go.mod h1:Rq08vgCcCAjHyRi/M7xlHKUykZCEtyBy9+DPF6GgEu8=
7680
github.com/aliyun/alibaba-cloud-sdk-go v1.63.107 h1:qagvUyrgOnBIlVRQWOyCZGVKUIYbMBdGdJ104vBpRFU=
7781
github.com/aliyun/alibaba-cloud-sdk-go v1.63.107/go.mod h1:SOSDHfe1kX91v3W5QiBsWSLqeLxImobbMX1mxrFHsVQ=
7882
github.com/aliyun/credentials-go v1.1.2/go.mod h1:ozcZaMR5kLM7pwtCMEpVmQ242suV6qTJya2bDq4X1Tw=
@@ -91,6 +95,7 @@ github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2y
9195
github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
9296
github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
9397
github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
98+
github.com/clbanning/mxj/v2 v2.5.5/go.mod h1:hNiWqW14h+kc+MdF9C6/YoRfjEJoR3ou6tn/Qo+ve2s=
9499
github.com/clbanning/mxj/v2 v2.7.0 h1:WA/La7UGCanFe5NpHF0Q3DNtnCsVoxbPKuyBNHWRyME=
95100
github.com/clbanning/mxj/v2 v2.7.0/go.mod h1:hNiWqW14h+kc+MdF9C6/YoRfjEJoR3ou6tn/Qo+ve2s=
96101
github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=

‎main.go‎

Lines changed: 16 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,13 @@ import (
2727
"sync"
2828
"time"
2929

30+
sts20150401 "github.com/alibabacloud-go/sts-20150401/v2/client"
31+
alicred_old "github.com/aliyun/credentials-go/credentials"
3032
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/agent"
3133
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/bmcpfs"
34+
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/cloud"
3235
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/cloud/metadata"
36+
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/credentials"
3337
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/disk"
3438
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/ens"
3539
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/features"
@@ -157,8 +161,18 @@ func main() {
157161

158162
ac := utils.GetAccessControl()
159163
ecsClient := utils.NewEcsClient(ac)
160-
stsClient := utils.NewStsClient(ac)
161-
meta.EnableOpenAPI(ecsClient, stsClient)
164+
meta.EnableOpenAPI(ecsClient)
165+
166+
provider, err := credentials.NewProvider()
167+
if err != nil {
168+
klog.ErrorS(err, "failed to get credential for metadata, will not enable OpenAPI")
169+
} else {
170+
cred := alicred_old.FromCredentialsProvider(provider.GetProviderName(), provider)
171+
stsClient := func(regionID string) (cloud.STSInterface, error) {
172+
return sts20150401.NewClient(utils.GetStsConfig(regionID).SetCredential(cred))
173+
}
174+
meta.EnableSts(stsClient)
175+
}
162176

163177
for i, driverName := range driverNames {
164178
if !strings.Contains(driverName, TypePluginSuffix) && driverName != ExtenderAgent {

‎pkg/cloud/metadata/metadata.go‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -173,7 +173,7 @@ func (m *Metadata) EnableKubernetes(client kubernetes.Interface) {
173173
})
174174
}
175175

176-
func (m *Metadata) EnableOpenAPI(ecsClient cloud.ECSInterface, stsClient cloud.STSInterface) {
176+
func (m *Metadata) EnableOpenAPI(ecsClient cloud.ECSInterface) {
177177
mPre := Metadata{
178178
// use the previous providers to get region id and instance id,
179179
// do not recurse into ourselves
@@ -182,6 +182,19 @@ func (m *Metadata) EnableOpenAPI(ecsClient cloud.ECSInterface, stsClient cloud.S
182182
m.providers = append(m.providers, &lazyInitProvider{
183183
fetcher: &OpenAPIFetcher{
184184
ecsClient: ecsClient,
185+
mPre: &mPre,
186+
},
187+
})
188+
}
189+
190+
func (m *Metadata) EnableSts(stsClient func(regionID string) (cloud.STSInterface, error)) {
191+
mPre := Metadata{
192+
// use the previous providers to get region id,
193+
// do not recurse into ourselves
194+
providers: m.providers,
195+
}
196+
m.providers = append(m.providers, &lazyInitProvider{
197+
fetcher: &StsFetcher{
185198
stsClient: stsClient,
186199
mPre: &mPre,
187200
},

‎pkg/cloud/metadata/metadata_test.go‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -113,19 +113,16 @@ func TestCreateOpenAPI(t *testing.T) {
113113
t.Parallel()
114114
ctrl := gomock.NewController(t)
115115
var ecsClient cloud.ECSInterface
116-
var stsClient cloud.STSInterface
117116
if c.available {
118117
ecsClient = testEcsClient(ctrl)
119-
stsClient = testStsClient(ctrl)
120118
} else {
121119
ecsClient = cloud.NewMockECSInterface(ctrl)
122-
stsClient = cloud.NewMockSTSInterface(ctrl)
123120
}
124121

125122
m := NewMetadata()
126123
m.providers = append(m.providers, FakeProvider{Values: c.values})
127124

128-
m.EnableOpenAPI(ecsClient, stsClient)
125+
m.EnableOpenAPI(ecsClient)
129126
zone, err := m.Get(ZoneID)
130127
if c.available {
131128
assert.Equal(t, "cn-beijing-k", zone)
@@ -142,13 +139,34 @@ func TestCreateOpenAPIFromEnv(t *testing.T) {
142139
t.Setenv("KUBE_NODE_NAME", "i-2zec1slzwdzrwmvlr4w2")
143140
ctrl := gomock.NewController(t)
144141
ecsClient := testEcsClient(ctrl)
145-
stsClient := testStsClient(ctrl)
146142

147143
m := NewMetadata()
148-
m.EnableOpenAPI(ecsClient, stsClient)
144+
m.EnableOpenAPI(ecsClient)
149145
assert.Equal(t, "cn-beijing-k", MustGet(m, ZoneID))
150146
}
151147

148+
func TestCreateSts(t *testing.T) {
149+
t.Setenv("REGION_ID", "cn-beijing")
150+
ctrl := gomock.NewController(t)
151+
stsClient := testStsClientFactory(ctrl)
152+
153+
m := NewMetadata()
154+
m.EnableSts(stsClient)
155+
assert.Equal(t, "112233445566", MustGet(m, AccountID))
156+
}
157+
158+
func TestCreateStsNoRegionID(t *testing.T) {
159+
ctrl := gomock.NewController(t)
160+
stsClient := testStsClientFactory(ctrl)
161+
162+
m := NewMetadata()
163+
m.EnableSts(stsClient)
164+
_, err := m.Get(999) // anything else
165+
assert.ErrorIs(t, err, ErrUnknownMetadataKey)
166+
_, err = m.Get(AccountID)
167+
assert.ErrorIs(t, err, ErrUnknownMetadataKey)
168+
}
169+
152170
func fakeMetadata(t *testing.T) *Metadata {
153171
trans := httpmock.NewMockTransport()
154172
trans.RegisterResponder("PUT", imds.ECSTokenEndpoint, httpmock.NewStringResponder(200, "fake_metadata_token"))

‎pkg/cloud/metadata/openapi.go‎

Lines changed: 3 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -7,16 +7,14 @@ import (
77
"strings"
88

99
"github.com/aliyun/alibaba-cloud-sdk-go/services/ecs"
10-
"github.com/aliyun/alibaba-cloud-sdk-go/services/sts"
1110
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/cloud"
1211
)
1312

1413
type OpenAPIMetadata struct {
1514
instance *ecs.Instance
16-
identity *sts.GetCallerIdentityResponse
1715
}
1816

19-
func NewOpenAPIMetadata(c cloud.ECSInterface, s cloud.STSInterface, regionId, instanceId string) (*OpenAPIMetadata, error) {
17+
func NewOpenAPIMetadata(c cloud.ECSInterface, regionId, instanceId string) (*OpenAPIMetadata, error) {
2018
instanceRequest := ecs.CreateDescribeInstancesRequest()
2119

2220
instanceRequest.RegionId = regionId
@@ -33,15 +31,7 @@ func NewOpenAPIMetadata(c cloud.ECSInterface, s cloud.STSInterface, regionId, in
3331
if len(instanceResponse.Instances.Instance) != 1 {
3432
return nil, fmt.Errorf("instance not found: %s", instanceId)
3533
}
36-
37-
identityRequest := sts.CreateGetCallerIdentityRequest()
38-
identityRequest.Scheme = "https"
39-
identityResponse, err := s.GetCallerIdentity(identityRequest)
40-
if err == nil {
41-
return &OpenAPIMetadata{instance: &instanceResponse.Instances.Instance[0], identity: identityResponse}, nil
42-
}
43-
44-
return &OpenAPIMetadata{instance: &instanceResponse.Instances.Instance[0], identity: nil}, nil
34+
return &OpenAPIMetadata{instance: &instanceResponse.Instances.Instance[0]}, nil
4535
}
4636

4737
func (m *OpenAPIMetadata) Get(key MetadataKey) (string, error) {
@@ -52,17 +42,12 @@ func (m *OpenAPIMetadata) Get(key MetadataKey) (string, error) {
5242
return m.instance.InstanceId, nil
5343
case InstanceType:
5444
return m.instance.InstanceType, nil
55-
case AccountID:
56-
if m.identity != nil {
57-
return m.identity.AccountId, nil
58-
}
5945
}
6046
return "", ErrUnknownMetadataKey
6147
}
6248

6349
type OpenAPIFetcher struct {
6450
ecsClient cloud.ECSInterface
65-
stsClient cloud.STSInterface
6651
mPre MetadataProvider
6752
}
6853

@@ -91,7 +76,7 @@ func (f *OpenAPIFetcher) FetchFor(key MetadataKey) (MetadataProvider, error) {
9176
if err != nil {
9277
return nil, fmt.Errorf("instance ID is not available: %w", err)
9378
}
94-
p, err := NewOpenAPIMetadata(f.ecsClient, f.stsClient, regionId, instanceId)
79+
p, err := NewOpenAPIMetadata(f.ecsClient, regionId, instanceId)
9580
if err != nil {
9681
return nil, err
9782
}

‎pkg/cloud/metadata/openapi_test.go‎

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ import (
44
"testing"
55

66
"github.com/aliyun/alibaba-cloud-sdk-go/services/ecs"
7-
"github.com/aliyun/alibaba-cloud-sdk-go/services/sts"
87
"github.com/golang/mock/gomock"
98
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/cloud"
109
"github.com/stretchr/testify/assert"
@@ -54,34 +53,14 @@ func testEcsClient(ctrl *gomock.Controller) cloud.ECSInterface {
5453
return ecsClient
5554
}
5655

57-
const getCallerIdentityRespJson = `{
58-
"IdentityType": "Account",
59-
"AccountId": "112233445566",
60-
"RequestId": "5051F631-1599-5DBD-9C0A-3DD86092DA9D",
61-
"PrincipalId": "112233445566",
62-
"UserId": "112233445566",
63-
"Arn": "acs:ram::112233445566:root"
64-
}`
65-
66-
func testStsClient(ctrl *gomock.Controller) cloud.STSInterface {
67-
res := sts.CreateGetCallerIdentityResponse()
68-
cloud.UnmarshalAcsResponse([]byte(getCallerIdentityRespJson), res)
69-
70-
stsClient := cloud.NewMockSTSInterface(ctrl)
71-
stsClient.EXPECT().GetCallerIdentity(gomock.Any()).Return(res, nil)
72-
return stsClient
73-
}
74-
7556
func TestGetOpenAPI(t *testing.T) {
7657
ctrl := gomock.NewController(t)
7758
ecsClient := testEcsClient(ctrl)
78-
stsClient := testStsClient(ctrl)
7959

80-
m, err := NewOpenAPIMetadata(ecsClient, stsClient, "cn-beijing", "i-2zec1slzwdzrwmvlr4w2")
60+
m, err := NewOpenAPIMetadata(ecsClient, "cn-beijing", "i-2zec1slzwdzrwmvlr4w2")
8161
assert.NoError(t, err)
8262

8363
assert.Equal(t, "cn-beijing-k", MustGet(m, ZoneID))
8464
assert.Equal(t, "ecs.g7.xlarge", MustGet(m, InstanceType))
8565
assert.Equal(t, "i-2zec1slzwdzrwmvlr4w2", MustGet(m, InstanceID))
86-
assert.Equal(t, "112233445566", MustGet(m, AccountID))
8766
}

‎pkg/cloud/metadata/sts.go‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
package metadata
2+
3+
import (
4+
"fmt"
5+
6+
sts20150401 "github.com/alibabacloud-go/sts-20150401/v2/client"
7+
"github.com/alibabacloud-go/tea/tea"
8+
"github.com/kubernetes-sigs/alibaba-cloud-csi-driver/pkg/cloud"
9+
"k8s.io/klog/v2"
10+
)
11+
12+
type StsMetadata struct {
13+
identity *sts20150401.GetCallerIdentityResponseBody
14+
}
15+
16+
func NewStsMetadata(s cloud.STSInterface) (*StsMetadata, error) {
17+
resp, err := s.GetCallerIdentity()
18+
if err != nil {
19+
return nil, fmt.Errorf("failed to get caller identity: %w", err)
20+
}
21+
klog.V(2).InfoS("GetCallerIdentity OK", "requestID", tea.StringValue(resp.Body.RequestId))
22+
return &StsMetadata{identity: resp.Body}, nil
23+
}
24+
25+
func (m *StsMetadata) Get(key MetadataKey) (string, error) {
26+
switch key {
27+
case AccountID:
28+
if m.identity.AccountId != nil {
29+
return *m.identity.AccountId, nil
30+
}
31+
}
32+
return "", ErrUnknownMetadataKey
33+
}
34+
35+
type StsFetcher struct {
36+
stsClient func(regionID string) (cloud.STSInterface, error)
37+
mPre MetadataProvider
38+
}
39+
40+
func (f *StsFetcher) FetchFor(key MetadataKey) (MetadataProvider, error) {
41+
switch key {
42+
case AccountID:
43+
default:
44+
return nil, ErrUnknownMetadataKey
45+
}
46+
47+
regionId, err := f.mPre.Get(RegionID)
48+
if err != nil {
49+
return nil, fmt.Errorf("region ID is not available: %w", err)
50+
}
51+
client, err := f.stsClient(regionId)
52+
if err != nil {
53+
return nil, fmt.Errorf("failed to create STS client: %w", err)
54+
}
55+
p, err := NewStsMetadata(client)
56+
if err != nil {
57+
return nil, err
58+
}
59+
return newImmutableProvider(p, "Sts"), nil
60+
}

0 commit comments

Comments
 (0)