TheArchive/tailscale
1
0
Fork 0
mirror of https://github.com/tailscale/tailscale.git synced 2025-04-17 04:01:41 +00:00
Code Issues Packages Projects Releases Wiki Activity

ipn/store/kubestore: sanitize keys loaded to in-memory store (#15178)

Browse Source 
Reads use the sanitized form, so unsanitized keys being stored
in memory resulted lookup failures, for example for serve config.

Updates tailscale/tailscale#15134

Signed-off-by: Irbe Krumina <irbe@tailscale.com>
This commit is contained in:
Irbe Krumina 2025-03-03 08:04:18 -08:00 committed by GitHub
parent 986daca5ee
commit a567f56445
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
ipn/store/kubestore/store_kube.go
View File

@ -98,7 +98,11 @@ func (s *Store) updateStateSecret(data map[string][]byte) (err error) {
defer func() {
if err == nil {
for id, bs := range data {
s.memory.WriteState(ipn.StateKey(id), bs)
// The in-memory store does not distinguish between values read from state Secret on
// init and values written to afterwards. Values read from the state
// Secret will always be sanitized, so we also need to sanitize values written to store
// later, so that the Read logic can just lookup keys in sanitized form.
s.memory.WriteState(ipn.StateKey(sanitizeKey(id)), bs)
}
}
if err != nil {
@ -198,8 +202,9 @@ func (s *Store) loadState() (err error) {
return nil
}
// sanitizeKey converts any value that can be converted to a string into a valid Kubernetes secret key.
// sanitizeKey converts any value that can be converted to a string into a valid Kubernetes Secret key.
// Valid characters are alphanumeric, -, _, and .
// https://kubernetes.io/docs/concepts/configuration/secret/#restriction-names-data.
func sanitizeKey[T ~string](k T) string {
return strings.Map(func(r rune) rune {
if r >= 'a' && r <= 'z' || r >= 'A' && r <= 'Z' || r >= '0' && r <= '9' || r == '-' || r == '_' || r == '.' {

2
ipn/store/kubestore/store_kube_test.go
View File

@ -169,7 +169,7 @@ func TestUpdateStateSecret(t *testing.T) {
// Verify memory store was updated
for k, v := range tt.updates {
got, err := s.memory.ReadState(ipn.StateKey(k))
got, err := s.memory.ReadState(ipn.StateKey(sanitizeKey(k)))
if err != nil {
t.Errorf("reading from memory store: %v", err)
continue