Skip to content

Commit 607207d

Browse files
pavolloffaypavolloffay
committed
Fix
Signed-off-by: Pavol Loffay <[email protected]>
1 parent b65c553 commit 607207d

File tree

11 files changed

+93
-59
lines changed

11 files changed

+93
-59
lines changed

‎apis/v1beta1/collector_webhook.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ type CollectorWebhook struct {
4949
reviewer *rbac.Reviewer
5050
metrics *Metrics
5151
bv BuildValidator
52-
fips fips.FipsCheck
52+
fips fips.FIPSCheck
5353
}
5454

5555
func (c CollectorWebhook) Default(_ context.Context, obj runtime.Object) error {
@@ -293,7 +293,7 @@ func (c CollectorWebhook) Validate(ctx context.Context, r *OpenTelemetryCollecto
293293
}
294294

295295
components := r.Spec.Config.GetEnabledComponents()
296-
if notAllowedComponents := c.fips.Check(components[KindReceiver], components[KindExporter], components[KindProcessor], components[KindExtension]); notAllowedComponents != nil {
296+
if notAllowedComponents := c.fips.DisabledComponents(components[KindReceiver], components[KindExporter], components[KindProcessor], components[KindExtension]); notAllowedComponents != nil {
297297
return nil, fmt.Errorf("the collector configuration contains not FIPS compliant components: %s. Please remove it from the config", notAllowedComponents)
298298
}
299299

@@ -430,7 +430,7 @@ func NewCollectorWebhook(
430430
reviewer *rbac.Reviewer,
431431
metrics *Metrics,
432432
bv BuildValidator,
433-
fips fips.FipsCheck,
433+
fips fips.FIPSCheck,
434434
) *CollectorWebhook {
435435
return &CollectorWebhook{
436436
logger: logger,
@@ -443,7 +443,7 @@ func NewCollectorWebhook(
443443
}
444444
}
445445

446-
func SetupCollectorWebhook(mgr ctrl.Manager, cfg config.Config, reviewer *rbac.Reviewer, metrics *Metrics, bv BuildValidator, fipsCheck fips.FipsCheck) error {
446+
func SetupCollectorWebhook(mgr ctrl.Manager, cfg config.Config, reviewer *rbac.Reviewer, metrics *Metrics, bv BuildValidator, fipsCheck fips.FIPSCheck) error {
447447
cvw := NewCollectorWebhook(mgr.GetLogger().WithValues("handler", "CollectorWebhook", "version", "v1beta1"), mgr.GetScheme(), cfg, reviewer, metrics, bv, fipsCheck)
448448
return ctrl.NewWebhookManagedBy(mgr).
449449
For(&OpenTelemetryCollector{}).

‎apis/v1beta1/collector_webhook_test.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ func TestValidate(t *testing.T) {
114114
getReviewer(test.shouldFailSar),
115115
nil,
116116
bv,
117-
fips.NewFipsCheck(nil, nil, nil, nil),
117+
fips.NewFipsCheck(false, nil, nil, nil, nil),
118118
)
119119
t.Run(tt.name, func(t *testing.T) {
120120
tt := tt
@@ -496,7 +496,7 @@ func TestCollectorDefaultingWebhook(t *testing.T) {
496496
getReviewer(test.shouldFailSar),
497497
nil,
498498
bv,
499-
fips.NewFipsCheck(nil, nil, nil, nil),
499+
fips.NewFipsCheck(false, nil, nil, nil, nil),
500500
)
501501
ctx := context.Background()
502502
err := cvw.Default(ctx, &test.otelcol)
@@ -1288,7 +1288,7 @@ func TestOTELColValidatingWebhook(t *testing.T) {
12881288
getReviewer(test.shouldFailSar),
12891289
nil,
12901290
bv,
1291-
fips.NewFipsCheck(nil, nil, nil, nil),
1291+
fips.NewFipsCheck(false, nil, nil, nil, nil),
12921292
)
12931293
ctx := context.Background()
12941294
warnings, err := cvw.ValidateCreate(ctx, &test.otelcol)
@@ -1356,7 +1356,7 @@ func TestOTELColValidateUpdateWebhook(t *testing.T) {
13561356
getReviewer(test.shouldFailSar),
13571357
nil,
13581358
bv,
1359-
fips.NewFipsCheck(nil, nil, nil, nil),
1359+
fips.NewFipsCheck(false, nil, nil, nil, nil),
13601360
)
13611361
ctx := context.Background()
13621362
warnings, err := cvw.ValidateUpdate(ctx, &test.otelcolOld, &test.otelcolNew)

‎controllers/suite_test.go

+5-1
Original file line numberDiff line numberDiff line change
@@ -103,6 +103,10 @@ type mockAutoDetect struct {
103103
RBACPermissionsFunc func(ctx context.Context) (autoRBAC.Availability, error)
104104
}
105105

106+
func (m *mockAutoDetect) FIPSEnabled(ctx context.Context) bool {
107+
return false
108+
}
109+
106110
func (m *mockAutoDetect) PrometheusCRsAvailability() (prometheus.Availability, error) {
107111
if m.PrometheusCRsAvailabilityFunc != nil {
108112
return m.PrometheusCRsAvailabilityFunc()
@@ -179,7 +183,7 @@ func TestMain(m *testing.M) {
179183
}
180184
reviewer := rbac.NewReviewer(clientset)
181185

182-
if err = v1beta1.SetupCollectorWebhook(mgr, config.New(), reviewer, nil, nil, fips.NewFipsCheck(nil, nil, nil, nil)); err != nil {
186+
if err = v1beta1.SetupCollectorWebhook(mgr, config.New(), reviewer, nil, nil, fips.NewFipsCheck(false, nil, nil, nil, nil)); err != nil {
183187
fmt.Printf("failed to SetupWebhookWithManager: %v", err)
184188
os.Exit(1)
185189
}

‎internal/autodetect/fips/fipsautodetect.go

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
// Copyright The OpenTelemetry Authors
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
package fips
16+
17+
import (
18+
"errors"
19+
"os"
20+
"strings"
21+
)
22+
23+
const fipsFile = "/proc/sys/crypto/fips_enabled"
24+
25+
// IsFipsEnabled checks whether FIPS is enabled on the platform.
26+
func IsFipsEnabled() bool {
27+
// check if file exists
28+
if _, err := os.Stat(fipsFile); errors.Is(err, os.ErrNotExist) {
29+
return false
30+
}
31+
content, err := os.ReadFile(fipsFile)
32+
if err != nil {
33+
// file cannot be read, enable FIPS to avoid any violations
34+
return true
35+
}
36+
contentStr := string(content)
37+
contentStr = strings.TrimSpace(contentStr)
38+
return contentStr == "1"
39+
}

‎internal/autodetect/main.go

+6
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ package autodetect
1818
import (
1919
"context"
2020
"fmt"
21+
"github.com/open-telemetry/opentelemetry-operator/internal/autodetect/fips"
2122

2223
"k8s.io/client-go/discovery"
2324
"k8s.io/client-go/rest"
@@ -35,6 +36,7 @@ type AutoDetect interface {
3536
OpenShiftRoutesAvailability() (openshift.RoutesAvailability, error)
3637
PrometheusCRsAvailability() (prometheus.Availability, error)
3738
RBACPermissions(ctx context.Context) (autoRBAC.Availability, error)
39+
FIPSEnabled(ctx context.Context) bool
3840
}
3941

4042
type autoDetect struct {
@@ -122,3 +124,7 @@ func (a *autoDetect) RBACPermissions(ctx context.Context) (autoRBAC.Availability
122124

123125
return autoRBAC.Available, nil
124126
}
127+
128+
func (a *autoDetect) FIPSEnabled(_ context.Context) bool {
129+
return fips.IsFipsEnabled()
130+
}

‎internal/config/main_test.go

+4
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,10 @@ type mockAutoDetect struct {
8282
RBACPermissionsFunc func(ctx context.Context) (rbac.Availability, error)
8383
}
8484

85+
func (m *mockAutoDetect) FIPSEnabled(_ context.Context) bool {
86+
return false
87+
}
88+
8589
func (m *mockAutoDetect) OpenShiftRoutesAvailability() (openshift.RoutesAvailability, error) {
8690
if m.OpenShiftRoutesAvailabilityFunc != nil {
8791
return m.OpenShiftRoutesAvailabilityFunc()

‎internal/fips/check.go ‎internal/fips/fipscheck.go

+26-38
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,15 @@
1515
package fips
1616

1717
import (
18-
"errors"
19-
"fmt"
20-
"os"
2118
"strings"
2219
)
2320

24-
const fipsFile = "/proc/sys/crypto/fips_enabled"
21+
type FIPSCheck interface {
22+
DisabledComponents(receivers map[string]interface{}, exporters map[string]interface{}, processors map[string]interface{}, extensions map[string]interface{}) []string
23+
}
2524

2625
// FipsCheck holds configuration for FIPS black list.
27-
type FipsCheck struct {
26+
type fipsCheck struct {
2827
isFIPSEnabled bool
2928

3029
receivers map[string]bool
@@ -33,15 +32,24 @@ type FipsCheck struct {
3332
extensions map[string]bool
3433
}
3534

35+
type noopFIPSCheck struct{}
36+
37+
func (noopFIPSCheck) DisabledComponents(receivers map[string]interface{}, exporters map[string]interface{}, processors map[string]interface{}, extensions map[string]interface{}) []string {
38+
return nil
39+
}
40+
3641
// NewFipsCheck creates new FipsCheck.
3742
// It checks if FIPS is enabled on the platform in /proc/sys/crypto/fips_enabled.
38-
func NewFipsCheck(receivers, exporters, processors, extensions []string) FipsCheck {
39-
return FipsCheck{
40-
isFIPSEnabled: isFipsEnabled(),
41-
receivers: listToMap(receivers),
42-
exporters: listToMap(exporters),
43-
processors: listToMap(processors),
44-
extensions: listToMap(extensions),
43+
func NewFipsCheck(FIPSEnabled bool, receivers, exporters, processors, extensions []string) FIPSCheck {
44+
if !FIPSEnabled {
45+
return &noopFIPSCheck{}
46+
}
47+
48+
return &fipsCheck{
49+
receivers: listToMap(receivers),
50+
exporters: listToMap(exporters),
51+
processors: listToMap(processors),
52+
extensions: listToMap(extensions),
4553
}
4654
}
4755

@@ -54,27 +62,24 @@ func listToMap(list []string) map[string]bool {
5462
}
5563

5664
// Check checks if a submitted components are back lister or not.
57-
func (fips FipsCheck) Check(receivers map[string]interface{}, exporters map[string]interface{}, processors map[string]interface{}, extensions map[string]interface{}) []string {
58-
if !fips.isFIPSEnabled {
59-
return nil
60-
}
65+
func (fips fipsCheck) DisabledComponents(receivers map[string]interface{}, exporters map[string]interface{}, processors map[string]interface{}, extensions map[string]interface{}) []string {
6166
var disabled []string
62-
if comp := isBlackListed(fips.receivers, receivers); comp != "" {
67+
if comp := isDisabled(fips.receivers, receivers); comp != "" {
6368
disabled = append(disabled, comp)
6469
}
65-
if comp := isBlackListed(fips.exporters, exporters); comp != "" {
70+
if comp := isDisabled(fips.exporters, exporters); comp != "" {
6671
disabled = append(disabled, comp)
6772
}
68-
if comp := isBlackListed(fips.processors, processors); comp != "" {
73+
if comp := isDisabled(fips.processors, processors); comp != "" {
6974
disabled = append(disabled, comp)
7075
}
71-
if comp := isBlackListed(fips.extensions, extensions); comp != "" {
76+
if comp := isDisabled(fips.extensions, extensions); comp != "" {
7277
disabled = append(disabled, comp)
7378
}
7479
return disabled
7580
}
7681

77-
func isBlackListed(blackListed map[string]bool, cfg map[string]interface{}) string {
82+
func isDisabled(blackListed map[string]bool, cfg map[string]interface{}) string {
7883
for id := range cfg {
7984
component := strings.Split(id, "/")[0]
8085
if blackListed[component] {
@@ -83,20 +88,3 @@ func isBlackListed(blackListed map[string]bool, cfg map[string]interface{}) stri
8388
}
8489
return ""
8590
}
86-
87-
func isFipsEnabled() bool {
88-
// check if file exists
89-
if _, err := os.Stat(fipsFile); errors.Is(err, os.ErrNotExist) {
90-
fmt.Println("fips file doesn't exist")
91-
return false
92-
}
93-
content, err := os.ReadFile(fipsFile)
94-
if err != nil {
95-
// file cannot be read, enable FIPS to avoid any violations
96-
fmt.Println("cannot read fips file")
97-
return true
98-
}
99-
contentStr := string(content)
100-
contentStr = strings.TrimSpace(contentStr)
101-
return contentStr == "1"
102-
}

‎internal/fips/check_test.go ‎internal/fips/fipscheck_test.go

+2-9
Original file line numberDiff line numberDiff line change
@@ -21,15 +21,8 @@ import (
2121
)
2222

2323
func TestFipsCheck(t *testing.T) {
24-
fipsCheck := NewFipsCheck([]string{"rec1", "rec2"}, []string{"exp1"}, []string{"processor"}, []string{"ext1"})
25-
assert.Equal(t, map[string]bool{"rec1": true, "rec2": true}, fipsCheck.receivers)
26-
assert.Equal(t, map[string]bool{"exp1": true}, fipsCheck.exporters)
27-
assert.Equal(t, map[string]bool{"processor": true}, fipsCheck.processors)
28-
assert.Equal(t, map[string]bool{"ext1": true}, fipsCheck.extensions)
29-
30-
// test machine probably does not have this enabled
31-
fipsCheck.isFIPSEnabled = true
32-
blocked := fipsCheck.Check(
24+
fipsCheck := NewFipsCheck(true, []string{"rec1", "rec2"}, []string{"exp1"}, []string{"processor"}, []string{"ext1"})
25+
blocked := fipsCheck.DisabledComponents(
3326
map[string]interface{}{"otlp": true, "rec1/my": true},
3427
map[string]interface{}{"exp1": true},
3528
map[string]interface{}{"processor": true},

‎internal/webhook/podmutation/webhookhandler_suite_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ func TestMain(m *testing.M) {
106106
}
107107
reviewer := rbac.NewReviewer(clientset)
108108

109-
if err = v1beta1.SetupCollectorWebhook(mgr, config.New(), reviewer, nil, nil, fips.NewFipsCheck(nil, nil, nil, nil)); err != nil {
109+
if err = v1beta1.SetupCollectorWebhook(mgr, config.New(), reviewer, nil, nil, fips.NewFipsCheck(false, nil, nil, nil, nil)); err != nil {
110110
fmt.Printf("failed to SetupWebhookWithManager: %v", err)
111111
os.Exit(1)
112112
}

‎main.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -442,8 +442,8 @@ func main() {
442442
}
443443

444444
receivers, exporters, processors, extensions := parseFipsFlag(fipsDisabledComponents)
445-
fipsCheck := fips.NewFipsCheck(receivers, exporters, processors, extensions)
446445
logger.Info("Fips disabled components", "receivers", receivers, "exporters", exporters, "processors", processors, "extensions", extensions)
446+
fipsCheck := fips.NewFipsCheck(ad.FIPSEnabled(ctx), receivers, exporters, processors, extensions)
447447
if err = otelv1beta1.SetupCollectorWebhook(mgr, cfg, reviewer, crdMetrics, bv, fipsCheck); err != nil {
448448
setupLog.Error(err, "unable to create webhook", "webhook", "OpenTelemetryCollector")
449449
os.Exit(1)

‎pkg/collector/upgrade/suite_test.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ func TestMain(m *testing.M) {
106106
}
107107
reviewer := rbac.NewReviewer(clientset)
108108

109-
if err = v1beta1.SetupCollectorWebhook(mgr, config.New(), reviewer, nil, nil, fips.NewFipsCheck(nil, nil, nil, nil)); err != nil {
109+
if err = v1beta1.SetupCollectorWebhook(mgr, config.New(), reviewer, nil, nil, fips.NewFipsCheck(false, nil, nil, nil, nil)); err != nil {
110110
fmt.Printf("failed to SetupWebhookWithManager: %v", err)
111111
os.Exit(1)
112112
}

0 commit comments

Comments
 (0)