fix(spiffe): refuse client creation on missing expected server ID - #608
fix(spiffe): refuse client creation on missing expected server ID#608ahsan-zamil wants to merge 1 commit into
Conversation
|
|
Up to standards ✅🟢 Issues
|
| Metric | Results |
|---|---|
| Complexity | 10 |
| Duplication | 8 |
NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.
|
Warning Review limit reached
Next review available in: 48 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (3)
📝 WalkthroughWalkthroughWhen SPIFFE is enabled, ChangesSPIFFE identity validation
Estimated code review effort: 2 (Simple) | ~10 minutes Suggested labels: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 2 files
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="internal/spiffe/client.go">
<violation number="1" location="internal/spiffe/client.go:52">
P1: An enabled, already-registered satellite with no server ID silently downgrades status reports to the non-SPIFFE HTTP path because `NewStatusReportingProcess` ignores this error; propagate or retain the configuration error so SPIFFE-enabled reporting cannot fall back.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| return nil, fmt.Errorf("invalid expected server ID %q: %w", cfg.ExpectedServerID, err) | ||
| } | ||
| if cfg.ExpectedServerID == "" { | ||
| return nil, fmt.Errorf("expected server ID must be configured when SPIFFE is enabled") |
There was a problem hiding this comment.
P1: An enabled, already-registered satellite with no server ID silently downgrades status reports to the non-SPIFFE HTTP path because NewStatusReportingProcess ignores this error; propagate or retain the configuration error so SPIFFE-enabled reporting cannot fall back.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At internal/spiffe/client.go, line 52:
<comment>An enabled, already-registered satellite with no server ID silently downgrades status reports to the non-SPIFFE HTTP path because `NewStatusReportingProcess` ignores this error; propagate or retain the configuration error so SPIFFE-enabled reporting cannot fall back.</comment>
<file context>
@@ -48,13 +48,13 @@ func NewClient(cfg Config) (*Client, error) {
- return nil, fmt.Errorf("invalid expected server ID %q: %w", cfg.ExpectedServerID, err)
- }
+ if cfg.ExpectedServerID == "" {
+ return nil, fmt.Errorf("expected server ID must be configured when SPIFFE is enabled")
+ }
+
</file context>
Signed-off-by: Ahsan Zamil <ahsanzamil76@gmail.com>
3518b4b to
1d4587a
Compare
1 participant
This PR resolves #589 by enforcing that
ExpectedServerIDis non-empty when SPIFFE is enabled on the satellite side.Changes:
NewClient(cfg Config)ininternal/spiffe/client.goto return an error if SPIFFE is enabled butExpectedServerIDis empty.GetTLSConfig()ininternal/spiffe/client.goto remove the insecuretlsconfig.AuthorizeAny()fallback path.client_test.goto cover config validation and error scenarios.Closes #589
Summary by CodeRabbit
Bug Fixes
Tests