Skip to content

Commit 82cfaa9

Browse files
puffitospuffitos
committed
chore: removed dead test & renamed slog back to log
Signed-off-by: Bruno Bressi <[email protected]>
1 parent b0a99f7 commit 82cfaa9

File tree

3 files changed

+51
-74
lines changed

3 files changed

+51
-74
lines changed

‎main.go

Lines changed: 14 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ import (
1111
"syscall"
1212
"time"
1313

14-
"github.com/gookit/slog"
14+
log "github.com/gookit/slog"
1515

1616
"github.com/eumel8/cosignwebhook/webhook"
1717

@@ -36,26 +36,26 @@ func main() {
3636
// set log level
3737
switch *logLevel {
3838
case "fatal":
39-
slog.SetLogLevel(slog.FatalLevel)
39+
log.SetLogLevel(log.FatalLevel)
4040
case "trace":
41-
slog.SetLogLevel(slog.TraceLevel)
41+
log.SetLogLevel(log.TraceLevel)
4242
case "debug":
43-
slog.SetLogLevel(slog.DebugLevel)
43+
log.SetLogLevel(log.DebugLevel)
4444
case "error":
45-
slog.SetLogLevel(slog.ErrorLevel)
45+
log.SetLogLevel(log.ErrorLevel)
4646
case "warn":
47-
slog.SetLogLevel(slog.WarnLevel)
47+
log.SetLogLevel(log.WarnLevel)
4848
case "info":
49-
slog.SetLogLevel(slog.InfoLevel)
49+
log.SetLogLevel(log.InfoLevel)
5050
default:
51-
slog.SetLogLevel(slog.InfoLevel)
51+
log.SetLogLevel(log.InfoLevel)
5252
}
5353

54-
slog.GetFormatter().(*slog.TextFormatter).SetTemplate(logTemplate)
54+
log.GetFormatter().(*log.TextFormatter).SetTemplate(logTemplate)
5555

5656
certs, err := tls.LoadX509KeyPair(tlscert, tlskey)
5757
if err != nil {
58-
slog.Error("failed to load key pair", "error", err)
58+
log.Error("failed to load key pair", "error", err)
5959
}
6060

6161
server := &http.Server{
@@ -86,23 +86,23 @@ func main() {
8686
// start webhook server in new rountine
8787
go func() {
8888
if err := server.ListenAndServeTLS("", ""); err != nil {
89-
slog.Error("Failed to listen and serve webhook server", "error", err)
89+
log.Error("Failed to listen and serve webhook server", "error", err)
9090
}
9191
}()
9292
go func() {
9393
if err := mserver.ListenAndServe(); err != nil {
94-
slog.Error("Failed to listen and serve monitor server %v", "error", err)
94+
log.Error("Failed to listen and serve monitor server %v", "error", err)
9595
}
9696
}()
9797

98-
slog.Info("Webhook server running", "port", port, "metricsPort", mport)
98+
log.Info("Webhook server running", "port", port, "metricsPort", mport)
9999

100100
// listening shutdown signal
101101
signalChan := make(chan os.Signal, 1)
102102
signal.Notify(signalChan, syscall.SIGINT, syscall.SIGTERM)
103103
<-signalChan
104104

105-
slog.Info("Got shutdown signal, shutting down webhook server gracefully...")
105+
log.Info("Got shutdown signal, shutting down webhook server gracefully...")
106106
_ = server.Shutdown(context.Background())
107107
_ = mserver.Shutdown(context.Background())
108108
}

‎webhook/cosignwebhook.go

Lines changed: 37 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ import (
1212
"os"
1313
"time"
1414

15-
"github.com/gookit/slog"
15+
log "github.com/gookit/slog"
1616

1717
"github.com/google/go-containerregistry/pkg/authn"
1818
"github.com/prometheus/client_golang/prometheus"
@@ -69,7 +69,7 @@ type CosignServerHandler struct {
6969
func NewCosignServerHandler() *CosignServerHandler {
7070
cs, err := restClient()
7171
if err != nil {
72-
slog.Errorf("Can't init rest client: %v", err)
72+
log.Errorf("Can't init rest client: %v", err)
7373
}
7474
eb := record.NewBroadcaster()
7575
eb.StartRecordingToSink(&typedcorev1.EventSinkImpl{Interface: cs.CoreV1().Events("")})
@@ -83,12 +83,12 @@ func NewCosignServerHandler() *CosignServerHandler {
8383
func restClient() (*kubernetes.Clientset, error) {
8484
restConfig, err := rest.InClusterConfig()
8585
if err != nil {
86-
slog.Errorf("error init in-cluster config: %v", err)
86+
log.Errorf("error init in-cluster config: %v", err)
8787
return nil, err
8888
}
8989
cs, err := kubernetes.NewForConfig(restConfig)
9090
if err != nil {
91-
slog.Errorf("error creating k8sclientset: %v", err)
91+
log.Errorf("error creating k8sclientset: %v", err)
9292
return nil, err
9393
}
9494
return cs, err
@@ -110,17 +110,17 @@ func (csh *CosignServerHandler) recordNoVerification(p *corev1.Pod) {
110110
func getPod(b []byte) (*corev1.Pod, *v1.AdmissionReview, error) {
111111
arRequest := v1.AdmissionReview{}
112112
if err := json.Unmarshal(b, &arRequest); err != nil {
113-
slog.Error("Incorrect body")
113+
log.Error("Incorrect body")
114114
return nil, nil, err
115115
}
116116
if arRequest.Request == nil {
117-
slog.Error("AdmissionReview request not found")
117+
log.Error("AdmissionReview request not found")
118118
return nil, nil, fmt.Errorf("admissionreview request not found")
119119
}
120120
raw := arRequest.Request.Object.Raw
121121
pod := corev1.Pod{}
122122
if err := json.Unmarshal(raw, &pod); err != nil {
123-
slog.Error("Error deserializing container")
123+
log.Error("Error deserializing container")
124124
return nil, nil, err
125125
}
126126
return &pod, &arRequest, nil
@@ -132,12 +132,12 @@ func (csh *CosignServerHandler) getPubKeyFromEnv(c *corev1.Container, ns string)
132132
for _, envVar := range c.Env {
133133
if envVar.Name == CosignEnvVar {
134134
if envVar.Value != "" {
135-
slog.Debugf("Found public key in env var for container %q", c.Name)
135+
log.Debugf("Found public key in env var for container %q", c.Name)
136136
return envVar.Value, nil
137137
}
138138

139139
if envVar.ValueFrom != nil && envVar.ValueFrom.SecretKeyRef != nil {
140-
slog.Debugf("Found reference to public key in secret %q for container %q", envVar.ValueFrom.SecretKeyRef.Name, c.Name)
140+
log.Debugf("Found reference to public key in secret %q for container %q", envVar.ValueFrom.SecretKeyRef.Name, c.Name)
141141
return csh.getSecretValue(ns,
142142
envVar.ValueFrom.SecretKeyRef.Name,
143143
envVar.ValueFrom.SecretKeyRef.Key,
@@ -154,23 +154,23 @@ func (csh *CosignServerHandler) getSecretValue(namespace, secret, key string) (s
154154
defer cancel()
155155
s, err := csh.cs.CoreV1().Secrets(namespace).Get(ctx, secret, metav1.GetOptions{})
156156
if err != nil {
157-
slog.Debugf("Can't get secret %s/%s : %v", namespace, secret, err)
157+
log.Debugf("Can't get secret %s/%s : %v", namespace, secret, err)
158158
return "", err
159159
}
160160
value := s.Data[key]
161161
if len(value) == 0 {
162-
slog.Errorf("Secret value of %q is empty for %s/%s", key, namespace, secret)
162+
log.Errorf("Secret value of %q is empty for %s/%s", key, namespace, secret)
163163
return "", nil
164164
}
165-
slog.Debugf("Found public key in secret %s/%s, value: %s", namespace, secret, value)
165+
log.Debugf("Found public key in secret %s/%s, value: %s", namespace, secret, value)
166166
return string(value), nil
167167
}
168168

169169
func (csh *CosignServerHandler) Healthz(w http.ResponseWriter, _ *http.Request) {
170170
w.WriteHeader(http.StatusOK)
171171
_, err := w.Write([]byte("ok"))
172172
if err != nil {
173-
slog.Errorf("Can't write response: %v", err)
173+
log.Errorf("Can't write response: %v", err)
174174
http.Error(w, fmt.Sprintf("could not write response: %v", err), http.StatusInternalServerError) //nolint:gocritic // function returns after call
175175
}
176176
}
@@ -191,13 +191,13 @@ func (csh *CosignServerHandler) Serve(w http.ResponseWriter, r *http.Request) {
191191

192192
// Url path of admission
193193
if r.URL.Path != "/validate" {
194-
slog.Error("No validate URI")
194+
log.Error("No validate URI")
195195
http.Error(w, "no validate", http.StatusBadRequest)
196196
return
197197
}
198198

199199
if len(body) == 0 {
200-
slog.Error("Empty body")
200+
log.Error("Empty body")
201201
http.Error(w, "empty body", http.StatusBadRequest)
202202
return
203203
}
@@ -207,14 +207,15 @@ func (csh *CosignServerHandler) Serve(w http.ResponseWriter, r *http.Request) {
207207

208208
pod, arRequest, err := getPod(body)
209209
if err != nil {
210-
slog.Errorf("Error getPod in %s/%s: %v", pod.Namespace, pod.Name, err)
210+
log.Errorf("Error getPod in %s/%s: %v", pod.Namespace, pod.Name, err)
211211
http.Error(w, "incorrect body", http.StatusBadRequest)
212212
return
213213
}
214214

215215
ctx := r.Context()
216216
kc, err := newKeychainForPod(ctx, pod)
217217
if err != nil {
218+
log.Errorf("Error intializing k8schain %s/%s: %v", pod.Namespace, pod.Name, err)
218219
http.Error(w, "Failed initializing k8schain", http.StatusInternalServerError)
219220
return
220221
}
@@ -229,7 +230,7 @@ func (csh *CosignServerHandler) Serve(w http.ResponseWriter, r *http.Request) {
229230

230231
err = csh.verifyContainer(pod.Spec.InitContainers[i], pubKey)
231232
if err != nil {
232-
slog.Errorf("Error verifying init container %s/%s/%s: %v", pod.Namespace, pod.Name, pod.Spec.InitContainers[0].Name, err)
233+
log.Errorf("Error verifying init container %s/%s/%s: %v", pod.Namespace, pod.Name, pod.Spec.InitContainers[0].Name, err)
233234
deny(w, err.Error(), arRequest.Request.UID)
234235
return
235236
}
@@ -243,7 +244,7 @@ func (csh *CosignServerHandler) Serve(w http.ResponseWriter, r *http.Request) {
243244
}
244245
err = csh.verifyContainer(pod.Spec.Containers[i], pubKey)
245246
if err != nil {
246-
slog.Errorf("Error verifying container %s/%s/%s: %v", pod.Namespace, pod.Name, pod.Spec.Containers[i].Name, err)
247+
log.Errorf("Error verifying container %s/%s/%s: %v", pod.Namespace, pod.Name, pod.Spec.Containers[i].Name, err)
247248
deny(w, err.Error(), arRequest.Request.UID)
248249
return
249250
}
@@ -272,7 +273,7 @@ func newKeychainForPod(ctx context.Context, pod *corev1.Pod) (authn.Keychain, er
272273

273274
kc, err := k8schain.NewInCluster(ctx, opt)
274275
if err != nil {
275-
slog.Errorf("Error intializing k8schain %s/%s: %v", pod.Namespace, pod.Name, err)
276+
log.Errorf("Error intializing k8schain %s/%s: %v", pod.Namespace, pod.Name, err)
276277
return nil, err
277278
}
278279
return kc, nil
@@ -282,66 +283,66 @@ func newKeychainForPod(ctx context.Context, pod *corev1.Pod) (authn.Keychain, er
282283
// If no public key is found, it returns an empty string.
283284
func (csh *CosignServerHandler) getPubKeyFor(c corev1.Container, ns string) string { //nolint:gocritic // better for garbage collection
284285
if c.Image == "" {
285-
slog.Debugf("Container %q has no image, skipping verification", c.Name)
286+
log.Debugf("Container %q has no image, skipping verification", c.Name)
286287
return ""
287288
}
288289
if len(c.Env) == 0 {
289-
slog.Debugf("Container %q has no env vars, skipping verification", c.Name)
290+
log.Debugf("Container %q has no env vars, skipping verification", c.Name)
290291
return ""
291292
}
292293
pubKey, err := csh.getPubKeyFromEnv(&c, ns)
293294
if err != nil {
294-
slog.Debugf("Could not find pub key in container's %q environment: %v", c.Name, err)
295+
log.Debugf("Could not find pub key in container's %q environment: %v", c.Name, err)
295296
}
296297

297298
// If no public key get here, try to load default secret
298299
if pubKey == "" {
299300
pubKey, err = csh.getSecretValue(ns, "cosignwebhook", CosignEnvVar)
300301
if err != nil {
301-
slog.Debugf("Could not find pub key from default secret: %v", err)
302+
log.Debugf("Could not find pub key from default secret: %v", err)
302303
}
303304
}
304305

305306
// Still no public key, we don't care. Otherwise, POD won't start if we return with 403
306307
// In future versions this should block the start of the container
307308
if pubKey == "" {
308-
slog.Debugf("No public key found, returning")
309+
log.Debugf("No public key found, returning")
309310
return ""
310311
}
311312

312-
slog.Debugf("Found public key for container %q", c.Name)
313+
log.Debugf("Found public key for container %q", c.Name)
313314
return pubKey
314315
}
315316

316317
// verifyContainer verifies the signature of the container image
317318
func (csh *CosignServerHandler) verifyContainer(c corev1.Container, pubKey string) error { //nolint:gocritic // better for garbage collection
318-
slog.Debugf("Verifying container %s", c.Name)
319+
log.Debugf("Verifying container %s", c.Name)
319320

320321
// Lookup image name of current container
321322
image := c.Image
322323
refImage, err := name.ParseReference(image)
323324
if err != nil {
324-
slog.Errorf("Error parsing image reference: %v", err)
325+
log.Errorf("Error parsing image reference: %v", err)
325326
return fmt.Errorf("could parse image reference for image %q", image)
326327
}
327328

328329
// Encrypt public key
329330
publicKey, err := cryptoutils.UnmarshalPEMToPublicKey([]byte(pubKey))
330331
if err != nil {
331-
slog.Errorf("Error unmarshalling public key: %v", err)
332+
log.Errorf("Error unmarshalling public key: %v", err)
332333
return fmt.Errorf("public key for image %q malformed", image)
333334
}
334335

335336
// Load public key to verify
336337
cosignLoadKey, err := signature.LoadECDSAVerifier(publicKey.(*ecdsa.PublicKey), crypto.SHA256)
337338
if err != nil {
338-
slog.Errorf("Error loading ECDSA verifier: %v", err)
339+
log.Errorf("Error loading ECDSA verifier: %v", err)
339340
return errors.New("failed creating key verifier")
340341
}
341342

342343
// Verify signature on remote image with the presented public key
343344
remoteOpts := []ociremote.Option{ociremote.WithRemoteOptions(remote.WithAuthFromKeychain(csh.kc))}
344-
slog.Debugf("Verifying image %q with public key %q", image, pubKey)
345+
log.Debugf("Verifying image %q with public key %q", image, pubKey)
345346
_, _, err = cosign.VerifyImageSignatures(
346347
context.Background(),
347348
refImage,
@@ -354,26 +355,26 @@ func (csh *CosignServerHandler) verifyContainer(c corev1.Container, pubKey strin
354355

355356
// Verify Image failed, needs to reject container start
356357
if err != nil {
357-
slog.Errorf("Error verifying signature: %v", err)
358+
log.Errorf("Error verifying signature: %v", err)
358359
return fmt.Errorf("signature for %q couldn't be verified", image)
359360
}
360361

361362
// count successful verifies for prometheus metric
362363
verifiedProcessed.Inc()
363-
slog.Infof("Image %q verified successfully", image)
364+
log.Infof("Image %q verified successfully", image)
364365
return nil
365366
}
366367

367368
// deny prevents the container from starting
368369
func deny(w http.ResponseWriter, msg string, uid types.UID) {
369370
resp, err := json.Marshal(admissionReview(http.StatusForbidden, false, "Failure", msg, uid))
370371
if err != nil {
371-
slog.Errorf("Can't encode response: %v", err)
372+
log.Errorf("Can't encode response: %v", err)
372373
http.Error(w, fmt.Sprintf("could not encode response: %v", err), http.StatusInternalServerError)
373374
return
374375
}
375376
if _, err := w.Write(resp); err != nil {
376-
slog.Errorf("Can't write response: %v", err)
377+
log.Errorf("Can't write response: %v", err)
377378
http.Error(w, fmt.Sprintf("could not write response: %v", err), http.StatusInternalServerError)
378379
}
379380
}
@@ -382,12 +383,12 @@ func deny(w http.ResponseWriter, msg string, uid types.UID) {
382383
func accept(w http.ResponseWriter, msg string, uid types.UID) {
383384
resp, err := json.Marshal(admissionReview(http.StatusOK, true, "Success", msg, uid))
384385
if err != nil {
385-
slog.Errorf("Can't encode response: %v", err)
386+
log.Errorf("Can't encode response: %v", err)
386387
http.Error(w, fmt.Sprintf("could not encode response: %v", err), http.StatusInternalServerError)
387388
return
388389
}
389390
if _, err := w.Write(resp); err != nil {
390-
slog.Errorf("Can't write response: %v", err)
391+
log.Errorf("Can't write response: %v", err)
391392
http.Error(w, fmt.Sprintf("could not write response: %v", err), http.StatusInternalServerError)
392393
}
393394
}

‎webhook/cosignwebhook_test.go

Lines changed: 0 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -139,27 +139,3 @@ func Test_getPubKeyFromEnv(t *testing.T) {
139139
})
140140
}
141141
}
142-
143-
func TestCosignServerHandler_verifyPodContainer(t *testing.T) {
144-
// tests := []struct {
145-
// name string
146-
// pod *corev1.Pod
147-
// wantErr bool
148-
//}{
149-
// {
150-
// name: "1 container, signed image, pub key present",
151-
// },
152-
//}
153-
//
154-
//for _, tt := range tests {
155-
// t.Run(tt.name, func(t *testing.T) {
156-
// c := fake.NewSimpleClientset()
157-
// csh := &CosignServerHandler{
158-
// cs: c,
159-
// }
160-
// if err := csh.verifyContainer(tt.); (err != nil) != tt.wantErr {
161-
// t.Errorf("verifyContainer() error = %v, wantErr %v", err, tt.wantErr)
162-
// }
163-
// })
164-
//}
165-
}

0 commit comments

Comments
 (0)