Secure headers for HTTP Trigger #1229

maganaluis · 2021-05-25T18:56:37Z

Checklist:

My organization is added to USERS.md.

This solves issue #1227 and it adds support for adding headers to the HTTP Trigger as secrets, so tokens are not committed as code. See the example below:

apiVersion: argoproj.io/v1alpha1
kind: Sensor
metadata:
  name: http-trigger
spec:
  dependencies:
    - name: test-dep
      eventSourceName: webhook
      eventName: example
  triggers:
    - template:
        name: http-trigger
        http:
          secureHeaders:
            - name: serviceToken
              valueFrom:
                secretKeyRef:
                  name: dev-services-secret
                  key: serviceToken
          url: http://http-server.default.svc.cluster.local:8080/hello
          method: GET
      retryStrategy:
        steps: 3
        duration: 3s
      policy:
        status:
          allow:
            - 200
            - 201

Signed-off-by: Luis <[email protected]> modified scope of http applyresource testcase Signed-off-by: Luis <[email protected]> corrected http-trigger documentation Signed-off-by: Luis <[email protected]> added pwclabs as a user Signed-off-by: Luis <[email protected]>

whynowy · 2021-05-25T22:32:14Z

USERS.md

@@ -19,3 +19,4 @@ Organizations below are **officially** using Argo Events. Please send a PR with
 1. [RTL Nederland](https://www.rtl.nl)
 1. [Viaduct](https://www.viaduct.ai/)
 1. [Woolworths Group](https://www.woolworthsgroup.com.au/)
+1. [PwC Labs](https://www.pwc.com/us/en/careers/why-pwc/what-we-do/what-we-do-pwc-labs.html)


ABC order please.

whynowy · 2021-05-25T22:34:21Z

manifests/install.yaml

        - name: NAMESPACE
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
+        - name: EVENTSOURCE_IMAGE


The order change was cause by different kustomize version. Can you upgrade kustomize to the latest and rerun make manifests? Let me know if you are already running the latest.

whynowy · 2021-05-25T22:49:54Z

pkg/apis/common/common.go

@@ -108,6 +108,11 @@ type BasicAuth struct {
 	Password *corev1.SecretKeySelector `json:"password,omitempty" protobuf:"bytes,2,opt,name=password"`
 }

+type SecureHeaders struct {


SecureHeader sounds better.

whynowy · 2021-05-25T22:50:04Z

pkg/apis/common/common.go

@@ -108,6 +108,11 @@ type BasicAuth struct {
 	Password *corev1.SecretKeySelector `json:"password,omitempty" protobuf:"bytes,2,opt,name=password"`
 }

+type SecureHeaders struct {
+	HeaderName string                    `json:"headerName,omitempty" protobuf:"bytes,1,opt,name=headerName"`


Maybe just Name?

whynowy · 2021-05-25T22:52:00Z

pkg/apis/common/common.go

@@ -108,6 +108,11 @@ type BasicAuth struct {
 	Password *corev1.SecretKeySelector `json:"password,omitempty" protobuf:"bytes,2,opt,name=password"`
 }

+type SecureHeaders struct {
+	HeaderName string                    `json:"headerName,omitempty" protobuf:"bytes,1,opt,name=headerName"`
+	Value      *corev1.SecretKeySelector `json:"value,omitempty" protobuf:"bytes,2,opt,name=value"`


How about

ValueFrom *ValueFromSource type ValueFromSource struct { SecretRef *corev1.SecretKeySelector ConfigMapRef *corev1.ConfigMapKeySelector }

Are you saying that header names should be read from configmaps and values from secrets? What would be the benefit from reading from configmaps? @whynowy

No. I mean the value could come from configmaps OR secrets - similar to envFrom.

I think this struct could also be reused by the metadata carried by each of the event source, this is another topic.

maganaluis · 2021-05-26T18:41:55Z

@whynowy I tested with both secrets and configmaps. Given you switch to configMapKeyRef.

e.g.

apiVersion: v1
kind: ConfigMap
metadata:
  name: dev-services-secret
  namespace: argo-events
data:
  serviceToken: secret

whynowy

I give my conditional approval, please return make codegen, also an example would be appreciated. Thanks for your contribution!

Signed-off-by: Luis <[email protected]>

maganaluis · 2021-05-27T01:08:45Z

@whynowy I re-ran it with the latest Kustomize version and looks like that worked. It still generated event-bus.md and eventsource.md, though I discarded those changes. Let me know if this is good, I don't have access to re-run test cases.

whynowy · 2021-05-27T05:25:05Z

@whynowy I re-ran it with the latest Kustomize version and looks like that worked. It still generated event-bus.md and eventsource.md, though I discarded those changes. Let me know if this is good, I don't have access to re-run test cases.

No worries, I'll handle that.

Hunter-Thompson · 2021-06-29T14:17:19Z

@whynowy, any ETA on the next release? Would love this feature!

whynowy · 2021-06-30T23:47:42Z

@whynowy, any ETA on the next release? Would love this feature!

I would expect the BitBucket implementation PR being merged before cutting v1.4, if that doesn't happen, I will tag the version anyways by the end of next week.

* feat: Added secureHeaders to http-trigger Signed-off-by: Luis <[email protected]>

maganaluis changed the title ~~Secure headers~~ Secure headers for HTTP Trigger May 25, 2021

whynowy reviewed May 25, 2021

View reviewed changes

whynowy approved these changes May 26, 2021

View reviewed changes

feat: Using value from source as part of secure header

363d855

Signed-off-by: Luis <[email protected]>

whynowy merged commit 7a489d1 into argoproj:master May 27, 2021

juliev0 pushed a commit to juliev0/argo-events that referenced this pull request Mar 29, 2022

Secure headers for HTTP Trigger (argoproj#1229)

dfbaa5c

* feat: Added secureHeaders to http-trigger Signed-off-by: Luis <[email protected]>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Secure headers for HTTP Trigger #1229

Secure headers for HTTP Trigger #1229

maganaluis commented May 25, 2021 •

edited

Loading

whynowy May 25, 2021

whynowy May 25, 2021

whynowy May 25, 2021

whynowy May 25, 2021

whynowy May 25, 2021

maganaluis May 26, 2021

whynowy May 26, 2021

maganaluis commented May 26, 2021

whynowy left a comment

maganaluis commented May 27, 2021

whynowy commented May 27, 2021

Hunter-Thompson commented Jun 29, 2021

whynowy commented Jun 30, 2021

Secure headers for HTTP Trigger #1229

Secure headers for HTTP Trigger #1229

Conversation

maganaluis commented May 25, 2021 • edited Loading

whynowy May 25, 2021

Choose a reason for hiding this comment

whynowy May 25, 2021

Choose a reason for hiding this comment

whynowy May 25, 2021

Choose a reason for hiding this comment

whynowy May 25, 2021

Choose a reason for hiding this comment

whynowy May 25, 2021

Choose a reason for hiding this comment

maganaluis May 26, 2021

Choose a reason for hiding this comment

whynowy May 26, 2021

Choose a reason for hiding this comment

maganaluis commented May 26, 2021

whynowy left a comment

Choose a reason for hiding this comment

maganaluis commented May 27, 2021

whynowy commented May 27, 2021

Hunter-Thompson commented Jun 29, 2021

whynowy commented Jun 30, 2021

maganaluis commented May 25, 2021 •

edited

Loading