diff --git a/backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts b/backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts index cb6fd1ce8..c61d209c3 100644 --- a/backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts +++ b/backend/src/ee/services/access-approval-policy/access-approval-policy-dal.ts @@ -174,5 +174,28 @@ export const accessApprovalPolicyDALFactory = (db: TDbClient) => { return softDeletedPolicy; }; - return { ...accessApprovalPolicyOrm, find, findById, softDeleteById }; + const findLastValidPolicy = async ({ envId, secretPath }: { envId: string; secretPath: string }, tx?: Knex) => { + try { + const result = await (tx || db.replicaNode())(TableName.AccessApprovalPolicy) + .where( + // eslint-disable-next-line @typescript-eslint/no-misused-promises + buildFindFilter( + { + envId, + secretPath + }, + TableName.AccessApprovalPolicy + ) + ) + .orderBy("deletedAt", "desc") + .orderByRaw(`"deletedAt" IS NULL`) + .first(); + + return result; + } catch (error) { + throw new DatabaseError({ error, name: "FindLastValidPolicy" }); + } + }; + + return { ...accessApprovalPolicyOrm, find, findById, softDeleteById, findLastValidPolicy }; }; diff --git a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts index afecd1220..08d91cc21 100644 --- a/backend/src/ee/services/access-approval-request/access-approval-request-service.ts +++ b/backend/src/ee/services/access-approval-request/access-approval-request-service.ts @@ -56,7 +56,7 @@ type TSecretApprovalRequestServiceFactoryDep = { | "findOne" | "getCount" >; - accessApprovalPolicyDAL: Pick; + accessApprovalPolicyDAL: Pick; accessApprovalRequestReviewerDAL: Pick< TAccessApprovalRequestReviewerDALFactory, "create" | "find" | "findOne" | "transaction" @@ -131,7 +131,7 @@ export const accessApprovalRequestServiceFactory = ({ if (!environment) throw new NotFoundError({ message: `Environment with slug '${envSlug}' not found` }); - const policy = await accessApprovalPolicyDAL.findOne({ + const policy = await accessApprovalPolicyDAL.findLastValidPolicy({ envId: environment.id, secretPath }); diff --git a/backend/src/ee/services/dynamic-secret/providers/index.ts b/backend/src/ee/services/dynamic-secret/providers/index.ts index 737aaadea..3384e3781 100644 --- a/backend/src/ee/services/dynamic-secret/providers/index.ts +++ b/backend/src/ee/services/dynamic-secret/providers/index.ts @@ -6,6 +6,7 @@ import { AwsIamProvider } from "./aws-iam"; import { AzureEntraIDProvider } from "./azure-entra-id"; import { CassandraProvider } from "./cassandra"; import { ElasticSearchProvider } from "./elastic-search"; +import { KubernetesProvider } from "./kubernetes"; import { LdapProvider } from "./ldap"; import { DynamicSecretProviders, TDynamicProviderFns } from "./models"; import { MongoAtlasProvider } from "./mongo-atlas"; @@ -38,5 +39,6 @@ export const buildDynamicSecretProviders = ({ [DynamicSecretProviders.SapHana]: SapHanaProvider(), [DynamicSecretProviders.Snowflake]: SnowflakeProvider(), [DynamicSecretProviders.Totp]: TotpProvider(), - [DynamicSecretProviders.SapAse]: SapAseProvider() + [DynamicSecretProviders.SapAse]: SapAseProvider(), + [DynamicSecretProviders.Kubernetes]: KubernetesProvider({ gatewayService }) }); diff --git a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts new file mode 100644 index 000000000..20ac8877f --- /dev/null +++ b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts @@ -0,0 +1,199 @@ +import axios from "axios"; +import https from "https"; + +import { InternalServerError } from "@app/lib/errors"; +import { withGatewayProxy } from "@app/lib/gateway"; +import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator"; +import { TKubernetesTokenRequest } from "@app/services/identity-kubernetes-auth/identity-kubernetes-auth-types"; + +import { TGatewayServiceFactory } from "../../gateway/gateway-service"; +import { DynamicSecretKubernetesSchema, TDynamicProviderFns } from "./models"; + +const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000; + +type TKubernetesProviderDTO = { + gatewayService: Pick; +}; + +export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO): TDynamicProviderFns => { + const validateProviderInputs = async (inputs: unknown) => { + const providerInputs = await DynamicSecretKubernetesSchema.parseAsync(inputs); + if (!providerInputs.gatewayId) { + await blockLocalAndPrivateIpAddresses(providerInputs.url); + } + + return providerInputs; + }; + + const $gatewayProxyWrapper = async ( + inputs: { + gatewayId: string; + targetHost: string; + targetPort: number; + }, + gatewayCallback: (host: string, port: number) => Promise + ): Promise => { + const relayDetails = await gatewayService.fnGetGatewayClientTlsByGatewayId(inputs.gatewayId); + const [relayHost, relayPort] = relayDetails.relayAddress.split(":"); + + const callbackResult = await withGatewayProxy( + async (port) => { + // Needs to be https protocol or the kubernetes API server will fail with "Client sent an HTTP request to an HTTPS server" + const res = await gatewayCallback("https://localhost", port); + return res; + }, + { + targetHost: inputs.targetHost, + targetPort: inputs.targetPort, + relayHost, + relayPort: Number(relayPort), + identityId: relayDetails.identityId, + orgId: relayDetails.orgId, + tlsOptions: { + ca: relayDetails.certChain, + cert: relayDetails.certificate, + key: relayDetails.privateKey.toString() + } + } + ); + + return callbackResult; + }; + + const validateConnection = async (inputs: unknown) => { + const providerInputs = await validateProviderInputs(inputs); + + const serviceAccountGetCallback = async (host: string, port: number) => { + const baseUrl = port ? `${host}:${port}` : host; + + await axios.get( + `${baseUrl}/api/v1/namespaces/${providerInputs.namespace}/serviceaccounts/${providerInputs.serviceAccountName}`, + { + headers: { + "Content-Type": "application/json", + Authorization: `Bearer ${providerInputs.clusterToken}` + }, + signal: AbortSignal.timeout(EXTERNAL_REQUEST_TIMEOUT), + timeout: EXTERNAL_REQUEST_TIMEOUT, + httpsAgent: new https.Agent({ + ca: providerInputs.ca, + rejectUnauthorized: providerInputs.sslEnabled + }) + } + ); + }; + + const url = new URL(providerInputs.url); + const k8sPort = url.port ? Number(url.port) : 443; + + try { + if (providerInputs.gatewayId) { + const k8sHost = url.hostname; + + await $gatewayProxyWrapper( + { + gatewayId: providerInputs.gatewayId, + targetHost: k8sHost, + targetPort: k8sPort + }, + serviceAccountGetCallback + ); + } else { + const k8sHost = `${url.protocol}//${url.hostname}`; + await serviceAccountGetCallback(k8sHost, k8sPort); + } + + return true; + } catch (error) { + let errorMessage = error instanceof Error ? error.message : "Unknown error"; + if (axios.isAxiosError(error) && (error.response?.data as { message: string })?.message) { + errorMessage = (error.response?.data as { message: string }).message; + } + + throw new InternalServerError({ + message: `Failed to validate connection: ${errorMessage}` + }); + } + }; + + const create = async (inputs: unknown, expireAt: number) => { + const providerInputs = await validateProviderInputs(inputs); + + const tokenRequestCallback = async (host: string, port: number) => { + const baseUrl = port ? `${host}:${port}` : host; + + const res = await axios.post( + `${baseUrl}/api/v1/namespaces/${providerInputs.namespace}/serviceaccounts/${providerInputs.serviceAccountName}/token`, + { + spec: { + expirationSeconds: Math.floor((expireAt - Date.now()) / 1000), + ...(providerInputs.audiences?.length ? { audiences: providerInputs.audiences } : {}) + } + }, + { + headers: { + "Content-Type": "application/json", + Authorization: `Bearer ${providerInputs.clusterToken}` + }, + signal: AbortSignal.timeout(EXTERNAL_REQUEST_TIMEOUT), + timeout: EXTERNAL_REQUEST_TIMEOUT, + httpsAgent: new https.Agent({ + ca: providerInputs.ca, + rejectUnauthorized: providerInputs.sslEnabled + }) + } + ); + + return res.data; + }; + + const url = new URL(providerInputs.url); + const k8sHost = `${url.protocol}//${url.hostname}`; + const k8sGatewayHost = url.hostname; + const k8sPort = url.port ? Number(url.port) : 443; + + try { + const tokenData = providerInputs.gatewayId + ? await $gatewayProxyWrapper( + { + gatewayId: providerInputs.gatewayId, + targetHost: k8sGatewayHost, + targetPort: k8sPort + }, + tokenRequestCallback + ) + : await tokenRequestCallback(k8sHost, k8sPort); + + return { + entityId: providerInputs.serviceAccountName, + data: { TOKEN: tokenData.status.token } + }; + } catch (error) { + let errorMessage = error instanceof Error ? error.message : "Unknown error"; + if (axios.isAxiosError(error) && (error.response?.data as { message: string })?.message) { + errorMessage = (error.response?.data as { message: string }).message; + } + + throw new InternalServerError({ + message: `Failed to create dynamic secret: ${errorMessage}` + }); + } + }; + + const revoke = async (_inputs: unknown, entityId: string) => { + return { entityId }; + }; + + const renew = async (_inputs: unknown, entityId: string) => { + // No renewal necessary + return { entityId }; + }; + + return { + validateProviderInputs, + validateConnection, + create, + revoke, + renew + }; +}; diff --git a/backend/src/ee/services/dynamic-secret/providers/models.ts b/backend/src/ee/services/dynamic-secret/providers/models.ts index 0c6eaf151..28baac721 100644 --- a/backend/src/ee/services/dynamic-secret/providers/models.ts +++ b/backend/src/ee/services/dynamic-secret/providers/models.ts @@ -29,6 +29,10 @@ export enum LdapCredentialType { Static = "static" } +export enum KubernetesCredentialType { + Static = "static" +} + export enum TotpConfigType { URL = "url", MANUAL = "manual" @@ -277,6 +281,18 @@ export const LdapSchema = z.union([ }) ]); +export const DynamicSecretKubernetesSchema = z.object({ + url: z.string().url().trim().min(1), + gatewayId: z.string().nullable().optional(), + sslEnabled: z.boolean().default(true), + clusterToken: z.string().trim().min(1), + ca: z.string().optional(), + serviceAccountName: z.string().trim().min(1), + credentialType: z.literal(KubernetesCredentialType.Static), + namespace: z.string().trim().min(1), + audiences: z.array(z.string().trim().min(1)) +}); + export const DynamicSecretTotpSchema = z.discriminatedUnion("configType", [ z.object({ configType: z.literal(TotpConfigType.URL), @@ -320,7 +336,8 @@ export enum DynamicSecretProviders { SapHana = "sap-hana", Snowflake = "snowflake", Totp = "totp", - SapAse = "sap-ase" + SapAse = "sap-ase", + Kubernetes = "kubernetes" } export const DynamicSecretProviderSchema = z.discriminatedUnion("type", [ @@ -338,7 +355,8 @@ export const DynamicSecretProviderSchema = z.discriminatedUnion("type", [ z.object({ type: z.literal(DynamicSecretProviders.AzureEntraID), inputs: AzureEntraIDSchema }), z.object({ type: z.literal(DynamicSecretProviders.Ldap), inputs: LdapSchema }), z.object({ type: z.literal(DynamicSecretProviders.Snowflake), inputs: DynamicSecretSnowflakeSchema }), - z.object({ type: z.literal(DynamicSecretProviders.Totp), inputs: DynamicSecretTotpSchema }) + z.object({ type: z.literal(DynamicSecretProviders.Totp), inputs: DynamicSecretTotpSchema }), + z.object({ type: z.literal(DynamicSecretProviders.Kubernetes), inputs: DynamicSecretKubernetesSchema }) ]); export type TDynamicProviderFns = { diff --git a/backend/src/ee/services/license/license-service.ts b/backend/src/ee/services/license/license-service.ts index cfc42d038..e2cf09bb1 100644 --- a/backend/src/ee/services/license/license-service.ts +++ b/backend/src/ee/services/license/license-service.ts @@ -17,7 +17,7 @@ import { TIdentityOrgDALFactory } from "@app/services/identity/identity-org-dal" import { TOrgDALFactory } from "@app/services/org/org-dal"; import { TProjectDALFactory } from "@app/services/project/project-dal"; -import { OrgPermissionActions, OrgPermissionSubjects } from "../permission/org-permission"; +import { OrgPermissionBillingActions, OrgPermissionSubjects } from "../permission/org-permission"; import { TPermissionServiceFactory } from "../permission/permission-service"; import { BillingPlanRows, BillingPlanTableHead } from "./licence-enums"; import { TLicenseDALFactory } from "./license-dal"; @@ -288,7 +288,7 @@ export const licenseServiceFactory = ({ billingCycle }: TOrgPlansTableDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing); const { data } = await licenseServerCloudApi.request.get( `/api/license-server/v1/cloud-products?billing-cycle=${billingCycle}` ); @@ -310,8 +310,10 @@ export const licenseServiceFactory = ({ success_url }: TStartOrgTrialDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Billing); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan( + OrgPermissionBillingActions.ManageBilling, + OrgPermissionSubjects.Billing + ); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -338,8 +340,10 @@ export const licenseServiceFactory = ({ actorOrgId }: TCreateOrgPortalSession) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Create, OrgPermissionSubjects.Billing); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan( + OrgPermissionBillingActions.ManageBilling, + OrgPermissionSubjects.Billing + ); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -385,7 +389,7 @@ export const licenseServiceFactory = ({ const getOrgBillingInfo = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TGetOrgBillInfoDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -413,7 +417,7 @@ export const licenseServiceFactory = ({ // returns org current plan feature table const getOrgPlanTable = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TGetOrgBillInfoDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -484,7 +488,7 @@ export const licenseServiceFactory = ({ const getOrgBillingDetails = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TGetOrgBillInfoDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -509,7 +513,10 @@ export const licenseServiceFactory = ({ email }: TUpdateOrgBillingDetailsDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan( + OrgPermissionBillingActions.ManageBilling, + OrgPermissionSubjects.Billing + ); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -529,7 +536,7 @@ export const licenseServiceFactory = ({ const getOrgPmtMethods = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TOrgPmtMethodsDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -556,7 +563,10 @@ export const licenseServiceFactory = ({ cancel_url }: TAddOrgPmtMethodDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan( + OrgPermissionBillingActions.ManageBilling, + OrgPermissionSubjects.Billing + ); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -585,7 +595,10 @@ export const licenseServiceFactory = ({ pmtMethodId }: TDelOrgPmtMethodDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan( + OrgPermissionBillingActions.ManageBilling, + OrgPermissionSubjects.Billing + ); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -602,7 +615,7 @@ export const licenseServiceFactory = ({ const getOrgTaxIds = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TGetOrgTaxIdDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -620,7 +633,10 @@ export const licenseServiceFactory = ({ const addOrgTaxId = async ({ actorId, actor, actorAuthMethod, actorOrgId, orgId, type, value }: TAddOrgTaxIdDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan( + OrgPermissionBillingActions.ManageBilling, + OrgPermissionSubjects.Billing + ); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -641,7 +657,10 @@ export const licenseServiceFactory = ({ const delOrgTaxId = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId, taxId }: TDelOrgTaxIdDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan( + OrgPermissionBillingActions.ManageBilling, + OrgPermissionSubjects.Billing + ); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -658,7 +677,7 @@ export const licenseServiceFactory = ({ const getOrgTaxInvoices = async ({ actorId, actor, actorOrgId, actorAuthMethod, orgId }: TOrgInvoiceDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing); const organization = await orgDAL.findOrgById(orgId); if (!organization) { @@ -675,7 +694,7 @@ export const licenseServiceFactory = ({ const getOrgLicenses = async ({ orgId, actor, actorId, actorAuthMethod, actorOrgId }: TOrgLicensesDTO) => { const { permission } = await permissionService.getOrgPermission(actor, actorId, orgId, actorAuthMethod, actorOrgId); - ForbiddenError.from(permission).throwUnlessCan(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + ForbiddenError.from(permission).throwUnlessCan(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing); const organization = await orgDAL.findOrgById(orgId); if (!organization) { diff --git a/backend/src/ee/services/oidc/oidc-config-service.ts b/backend/src/ee/services/oidc/oidc-config-service.ts index e2c648178..7cebc1825 100644 --- a/backend/src/ee/services/oidc/oidc-config-service.ts +++ b/backend/src/ee/services/oidc/oidc-config-service.ts @@ -700,7 +700,6 @@ export const oidcConfigServiceFactory = ({ // eslint-disable-next-line @typescript-eslint/no-explicit-any (_req: any, tokenSet: TokenSet, cb: any) => { const claims = tokenSet.claims(); - logger.info(`User OIDC claims received for [orgId=${org.id}] [claims=${JSON.stringify(claims)}]`); if (!claims.email || !claims.given_name) { throw new BadRequestError({ message: "Invalid request. Missing email or first name" diff --git a/backend/src/ee/services/permission/org-permission.ts b/backend/src/ee/services/permission/org-permission.ts index 612914bcc..f0fe73d71 100644 --- a/backend/src/ee/services/permission/org-permission.ts +++ b/backend/src/ee/services/permission/org-permission.ts @@ -67,6 +67,11 @@ export enum OrgPermissionGroupActions { RemoveMembers = "remove-members" } +export enum OrgPermissionBillingActions { + Read = "read", + ManageBilling = "manage-billing" +} + export enum OrgPermissionSubjects { Workspace = "workspace", Role = "role", @@ -107,7 +112,7 @@ export type OrgPermissionSet = | [OrgPermissionActions, OrgPermissionSubjects.Ldap] | [OrgPermissionGroupActions, OrgPermissionSubjects.Groups] | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning] - | [OrgPermissionActions, OrgPermissionSubjects.Billing] + | [OrgPermissionBillingActions, OrgPermissionSubjects.Billing] | [OrgPermissionIdentityActions, OrgPermissionSubjects.Identity] | [OrgPermissionActions, OrgPermissionSubjects.Kms] | [OrgPermissionActions, OrgPermissionSubjects.AuditLogs] @@ -298,10 +303,8 @@ const buildAdminPermission = () => { can(OrgPermissionGroupActions.AddMembers, OrgPermissionSubjects.Groups); can(OrgPermissionGroupActions.RemoveMembers, OrgPermissionSubjects.Groups); - can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); - can(OrgPermissionActions.Create, OrgPermissionSubjects.Billing); - can(OrgPermissionActions.Edit, OrgPermissionSubjects.Billing); - can(OrgPermissionActions.Delete, OrgPermissionSubjects.Billing); + can(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing); + can(OrgPermissionBillingActions.ManageBilling, OrgPermissionSubjects.Billing); can(OrgPermissionIdentityActions.Read, OrgPermissionSubjects.Identity); can(OrgPermissionIdentityActions.Create, OrgPermissionSubjects.Identity); @@ -362,7 +365,7 @@ const buildMemberPermission = () => { can(OrgPermissionGroupActions.Read, OrgPermissionSubjects.Groups); can(OrgPermissionActions.Read, OrgPermissionSubjects.Role); can(OrgPermissionActions.Read, OrgPermissionSubjects.Settings); - can(OrgPermissionActions.Read, OrgPermissionSubjects.Billing); + can(OrgPermissionBillingActions.Read, OrgPermissionSubjects.Billing); can(OrgPermissionActions.Read, OrgPermissionSubjects.IncidentAccount); can(OrgPermissionActions.Read, OrgPermissionSubjects.SecretScanning); diff --git a/backend/src/lib/gateway/index.ts b/backend/src/lib/gateway/index.ts index 7a94c6384..c1a8b48c6 100644 --- a/backend/src/lib/gateway/index.ts +++ b/backend/src/lib/gateway/index.ts @@ -3,6 +3,7 @@ import crypto from "node:crypto"; import net from "node:net"; import quicDefault, * as quicModule from "@infisical/quic"; +import axios from "axios"; import { BadRequestError } from "../errors"; import { logger } from "../logger"; @@ -378,7 +379,12 @@ export const withGatewayProxy = async ( logger.error(new Error(proxyErrorMessage), "Failed to proxy"); } logger.error(err, "Failed to do gateway"); - throw new BadRequestError({ message: proxyErrorMessage || (err as Error)?.message }); + let errorMessage = proxyErrorMessage || (err as Error)?.message; + if (axios.isAxiosError(err) && (err.response?.data as { message?: string })?.message) { + errorMessage = (err.response?.data as { message: string }).message; + } + + throw new BadRequestError({ message: errorMessage }); } finally { // Ensure cleanup happens regardless of success or failure await cleanup(); diff --git a/backend/src/services/certificate-authority/certificate-authority-service.ts b/backend/src/services/certificate-authority/certificate-authority-service.ts index fa66758c3..a57c085ba 100644 --- a/backend/src/services/certificate-authority/certificate-authority-service.ts +++ b/backend/src/services/certificate-authority/certificate-authority-service.ts @@ -311,7 +311,6 @@ export const certificateAuthorityServiceFactory = ({ } const updatedCa = await internalCertificateAuthorityService.updateCaById({ - ...configuration, isInternal: true, enableDirectIssuance, caId: certificateAuthority.id, diff --git a/backend/src/services/certificate-authority/internal/internal-certificate-authority-schemas.ts b/backend/src/services/certificate-authority/internal/internal-certificate-authority-schemas.ts index ffec0d762..1cf9a8597 100644 --- a/backend/src/services/certificate-authority/internal/internal-certificate-authority-schemas.ts +++ b/backend/src/services/certificate-authority/internal/internal-certificate-authority-schemas.ts @@ -55,8 +55,4 @@ export const CreateInternalCertificateAuthoritySchema = GenericCreateCertificate configuration: InternalCertificateAuthorityConfigurationSchema }); -export const UpdateInternalCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema( - CaType.INTERNAL -).extend({ - configuration: InternalCertificateAuthorityConfigurationSchema.optional() -}); +export const UpdateInternalCertificateAuthoritySchema = GenericUpdateCertificateAuthorityFieldsSchema(CaType.INTERNAL); diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts index a3ec1bdeb..3314d8cab 100644 --- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts +++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-service.ts @@ -2,6 +2,7 @@ import { ForbiddenError } from "@casl/ability"; import axios, { AxiosError } from "axios"; import https from "https"; import jwt from "jsonwebtoken"; +import RE2 from "re2"; import { IdentityAuthMethod, TIdentityKubernetesAuthsUpdate } from "@app/db/schemas"; import { TGatewayDALFactory } from "@app/ee/services/gateway/gateway-dal"; @@ -185,7 +186,13 @@ export const identityKubernetesAuthServiceFactory = ({ return res.data; }; - const [k8sHost, k8sPort] = identityKubernetesAuth.kubernetesHost.split(":"); + let { kubernetesHost } = identityKubernetesAuth; + + if (kubernetesHost.startsWith("https://") || kubernetesHost.startsWith("http://")) { + kubernetesHost = new RE2("^https?:\\/\\/").replace(kubernetesHost, ""); + } + + const [k8sHost, k8sPort] = kubernetesHost.split(":"); const data = identityKubernetesAuth.gatewayId ? await $gatewayProxyWrapper( diff --git a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-types.ts b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-types.ts index 7a9cb88b5..12edd266f 100644 --- a/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-types.ts +++ b/backend/src/services/identity-kubernetes-auth/identity-kubernetes-auth-types.ts @@ -63,6 +63,18 @@ export type TCreateTokenReviewResponse = { status: TCreateTokenReviewSuccessResponse | TCreateTokenReviewErrorResponse; }; +export type TKubernetesTokenRequest = { + apiVersion: "authentication.k8s.io/v1"; + kind: "TokenRequest"; + spec: { + audiences: string[]; + expirationSeconds: number; + }; + status: { + token: string; + }; +}; + export type TRevokeKubernetesAuthDTO = { identityId: string; } & Omit; diff --git a/backend/src/services/pki-subscriber/pki-subscriber-service.ts b/backend/src/services/pki-subscriber/pki-subscriber-service.ts index 795371c76..5bedbd60c 100644 --- a/backend/src/services/pki-subscriber/pki-subscriber-service.ts +++ b/backend/src/services/pki-subscriber/pki-subscriber-service.ts @@ -137,6 +137,15 @@ export const pkiSubscriberServiceFactory = ({ } } + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) { + throw new NotFoundError({ message: `CA with ID '${caId}' not found` }); + } + + if (ca.projectId !== projectId) { + throw new BadRequestError({ message: "CA does not belong to the project" }); + } + const newSubscriber = await pkiSubscriberDAL.create({ caId, projectId, @@ -245,6 +254,17 @@ export const pkiSubscriberServiceFactory = ({ } } + if (caId) { + const ca = await certificateAuthorityDAL.findById(caId); + if (!ca) { + throw new NotFoundError({ message: `CA with ID '${caId}' not found` }); + } + + if (ca.projectId !== projectId) { + throw new BadRequestError({ message: "CA does not belong to the project" }); + } + } + const updatedSubscriber = await pkiSubscriberDAL.updateById(subscriber.id, { caId, name, diff --git a/docs/documentation/platform/dynamic-secrets/kubernetes.mdx b/docs/documentation/platform/dynamic-secrets/kubernetes.mdx new file mode 100644 index 000000000..d6d051ff7 --- /dev/null +++ b/docs/documentation/platform/dynamic-secrets/kubernetes.mdx @@ -0,0 +1,243 @@ +--- +title: "Kubernetes" +description: "Learn how to dynamically generate Kubernetes service account tokens." +--- + +The Infisical Kubernetes dynamic secret allows you to generate short-lived service account tokens on demand. + +## Overview + +The Kubernetes dynamic secret feature enables you to generate short-lived service account tokens for your Kubernetes clusters. This is particularly useful for: + +- **Secure Access Management**: Instead of using long-lived service account tokens, you can generate short-lived tokens that automatically expire, reducing the risk of token exposure. +- **Temporary Access**: Generate tokens with specific TTLs (Time To Live) for temporary access to your Kubernetes clusters. +- **Audit Trail**: Each token generation is tracked, providing better visibility into who accessed your cluster and when. +- **Integration with Private Clusters**: Seamlessly work with private Kubernetes clusters using Infisical's Gateway feature. + + + Kubernetes service account tokens cannot be revoked once issued. This is why + it's important to use short TTLs and carefully manage token generation. The + tokens will automatically expire after their TTL period. + + + + Kubernetes service account tokens are JWTs (JSON Web Tokens) with a fixed + expiration time. Once a token is generated, its lifetime cannot be extended. + If you need longer access, you'll need to generate a new token. + + +This feature is ideal for scenarios where you need to: + +- Provide temporary access to developers or CI/CD pipelines +- Rotate service account tokens frequently +- Maintain a secure audit trail of cluster access +- Manage access to multiple Kubernetes clusters + +## Prerequisites + +- A Kubernetes cluster with a service account +- Cluster access token with permissions to create service account tokens +- (Optional) [Gateway](/documentation/platform/gateways/overview) for private cluster access + +## RBAC Configuration + +Before you can start generating dynamic service account tokens, you'll need to configure the appropriate permissions in your Kubernetes cluster. This involves setting up Role-Based Access Control (RBAC) to allow the creation and management of service account tokens. + +The RBAC configuration serves a crucial security purpose: it creates a dedicated service account with minimal permissions that can only create and manage service account tokens. This follows the principle of least privilege, ensuring that the token generation process is secure and controlled. + +The following RBAC configuration creates the necessary permissions for generating service account tokens: + +```yaml rbac.yaml +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRole +metadata: + name: tokenrequest +rules: + - apiGroups: [""] + resources: + - "serviceaccounts/token" + - "serviceaccounts" + verbs: + - "create" + - "get" +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: ClusterRoleBinding +metadata: + name: tokenrequest +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: tokenrequest +subjects: + - kind: ServiceAccount + name: infisical-token-requester + namespace: default +``` + +```bash +kubectl apply -f rbac.yaml +``` + +This configuration: + +1. Creates a `ClusterRole` named `tokenrequest` that allows: + - Creating and getting service account tokens + - Getting service account information +2. Creates a `ClusterRoleBinding` that binds the role to a service account named `infisical-token-requester` in the `default` namespace + +You can customize the service account name and namespace according to your needs. + +## Obtaining the Cluster Token + +After setting up the RBAC configuration, you need to obtain a token for the service account that will be used to create dynamic secrets. Here's how to get the token: + +1. Create a service account in your Kubernetes cluster that will be used to create service account tokens: + +```yaml infisical-service-account.yaml +apiVersion: v1 +kind: ServiceAccount +metadata: + name: infisical-token-requester + namespace: default +``` + +```bash +kubectl apply -f infisical-service-account.yaml +``` + +2. Create a long-lived service account token using this configuration file: + +```yaml service-account-token.yaml +apiVersion: v1 +kind: Secret +type: kubernetes.io/service-account-token +metadata: + name: infisical-token-requester-token + annotations: + kubernetes.io/service-account.name: "infisical-token-requester" +``` + +```bash +kubectl apply -f service-account-token.yaml +``` + +3. Link the secret to the service account: + +```bash +kubectl patch serviceaccount infisical-token-requester -p '{"secrets": [{"name": "infisical-token-requester-token"}]}' -n default +``` + +4. Retrieve the token: + +```bash +kubectl get secret infisical-token-requester-token -n default -o=jsonpath='{.data.token}' | base64 --decode +``` + +This token will be used as the "Cluster Token" in the dynamic secret configuration. + +## Obtaining the Cluster URL + +The cluster URL is the address of your Kubernetes API server. The simplest way to find it is to use the `kubectl cluster-info` command: + +```bash +kubectl cluster-info +``` + +This command works for all Kubernetes environments (managed services like GKE, EKS, AKS, or self-hosted clusters) and will show you the Kubernetes control plane address, which is your cluster URL. + + + Make sure the cluster URL is accessible from where you're running Infisical. + If you're using a private cluster, you'll need to configure a [Gateway](/documentation/platform/gateways/overview) to + access it. + + +## Set up Dynamic Secrets with Kubernetes + + + + Open the Secret Overview dashboard and select the environment in which you would like to add a dynamic secret. + + + ![Add Dynamic Secret Button](/images/platform/dynamic-secrets/add-dynamic-secret-button.png) + + + ![Dynamic Secret Modal](/images/platform/dynamic-secrets/dynamic-secret-modal-kubernetes.png) + + + + Name by which you want the secret to be referenced + + + Default time-to-live for a generated secret (it is possible to modify this value after a secret is generated) + + + Maximum time-to-live for a generated secret + + + Select a gateway for private cluster access. If not specified, the Internet Gateway will be used. + + + Kubernetes API server URL (e.g., https://kubernetes.default.svc) + + + Whether to enable SSL verification for the Kubernetes API server connection. + + + Custom CA certificate for the Kubernetes API server. Leave blank to use the system/public CA. + + + Token with permissions to create service account tokens + + + Name of the service account to generate tokens for + + + Kubernetes namespace where the service account exists + + + Optional list of audiences to include in the generated token + + + ![Dynamic Secret Setup Modal](../../../images/platform/dynamic-secrets/dynamic-secret-setup-modal-kubernetes.png) + + + + After submitting the form, you will see a dynamic secret created in the dashboard. + + + Once you've successfully configured the dynamic secret, you're ready to generate on-demand service account tokens. + To do this, simply click on the 'Generate' button which appears when hovering over the dynamic secret item. + Alternatively, you can initiate the creation of a new lease by selecting 'New Lease' from the dynamic secret lease list section. + + ![Dynamic Secret](/images/platform/dynamic-secrets/dynamic-secret-generate.png) + ![Dynamic Secret](/images/platform/dynamic-secrets/dynamic-secret-lease-empty.png) + + When generating these secrets, it's important to specify a Time-to-Live (TTL) duration. This will dictate how long the credentials are valid for. + + ![Provision Lease](/images/platform/dynamic-secrets/provision-lease.png) + + + Ensure that the TTL for the lease fall within the maximum TTL defined when configuring the dynamic secret. + + + Once you click the `Submit` button, a new secret lease will be generated and the service account token will be shown to you. + + ![Provision Lease](/images/platform/dynamic-secrets/kubernetes-lease-value.png) + + + + +## Audit or Revoke Leases + +Once you have created one or more leases, you will be able to access them by clicking on the respective dynamic secret item on the dashboard. +This will allow you to see the lease details and delete the lease ahead of its expiration time. + + + While you can delete the lease from Infisical, the actual Kubernetes service + account token cannot be revoked. The token will remain valid until its TTL + expires. This is why it's crucial to use appropriate TTL values when + generating tokens. + + +![Provision Lease](/images/platform/dynamic-secrets/lease-data.png) diff --git a/docs/images/platform/dynamic-secrets/dynamic-secret-modal-kubernetes.png b/docs/images/platform/dynamic-secrets/dynamic-secret-modal-kubernetes.png new file mode 100644 index 000000000..b53f52a1a Binary files /dev/null and b/docs/images/platform/dynamic-secrets/dynamic-secret-modal-kubernetes.png differ diff --git a/docs/images/platform/dynamic-secrets/dynamic-secret-setup-modal-kubernetes.png b/docs/images/platform/dynamic-secrets/dynamic-secret-setup-modal-kubernetes.png new file mode 100644 index 000000000..011dfadc7 Binary files /dev/null and b/docs/images/platform/dynamic-secrets/dynamic-secret-setup-modal-kubernetes.png differ diff --git a/docs/images/platform/dynamic-secrets/kubernetes-lease-value.png b/docs/images/platform/dynamic-secrets/kubernetes-lease-value.png new file mode 100644 index 000000000..a8d22f088 Binary files /dev/null and b/docs/images/platform/dynamic-secrets/kubernetes-lease-value.png differ diff --git a/docs/internals/bug-bounty.mdx b/docs/internals/bug-bounty.mdx index 2dc4cd662..fddd41683 100644 --- a/docs/internals/bug-bounty.mdx +++ b/docs/internals/bug-bounty.mdx @@ -10,9 +10,7 @@ We value reports that help identify vulnerabilities that affect the integrity of ### How to Report - Send reports to **security@infisical.com** with clear steps to reproduce, impact, and (if possible) a proof-of-concept. -- We will acknowledge receipt within 3 business days for reports that are clearly written, technically sound, and plausibly within scope. -- We'll provide an initial assessment or next steps within 5 business days. -- **Please note**: We do not respond to spam, auto generated reports, inaccurate claims, or submissions that are clearly out of scope. +- You will receive follow ups from our team if we deam your report to be a legitimate vulnerability or need further clarification. We do not respond to spam, auto generated reports, inaccurate claims, or submissions that are clearly out of scope. ### What's in Scope? @@ -29,7 +27,7 @@ Bounties are based on severity, impact, and exploitability, as well as whether t | --- | --- | --- | | **Critical** | Full unauthorized access to secrets, authentication bypass, cross-tenant access, RCE, full compromise, etc | $2,000 - $5,000 | | **High** | Privilege escalation, project-level access without authorization, persistent DoS | $750 - $2,000 | -| **Medium** | Info disclosure, scoped DoS (e.g. ReDoS with auth), or minor access control issues | $250 - $1,000 | +| **Medium** | Info disclosure, scoped DoS (e.g. ReDoS with auth), or minor access control issues | $100 - $1,000 | | **Low / Informational** | Missing headers, CSP warnings, theoretical flaws, self-hosting misconfigurations | Recognition only | diff --git a/docs/internals/permissions/organization-permissions.mdx b/docs/internals/permissions/organization-permissions.mdx index 6de3bd6fe..80c843851 100644 --- a/docs/internals/permissions/organization-permissions.mdx +++ b/docs/internals/permissions/organization-permissions.mdx @@ -142,12 +142,10 @@ Below is a comprehensive list of all available organization-level subjects and t #### Subject: `billing` -| Action | Description | -| -------- | ------------------------------------------------ | -| `read` | View billing information and subscription status | -| `create` | Set up new payment methods or subscriptions | -| `edit` | Modify billing details or subscription plans | -| `delete` | Remove payment methods or cancel subscriptions | +| Action | Description | +| ---------------- | ------------------------------------------------ | +| `read` | View billing information and subscription status | +| `manage-billing` | Manage billing details and subscription plans | ### Templates & Automation diff --git a/docs/mint.json b/docs/mint.json index f8958c941..79488f6b5 100644 --- a/docs/mint.json +++ b/docs/mint.json @@ -217,7 +217,8 @@ "documentation/platform/dynamic-secrets/sap-ase", "documentation/platform/dynamic-secrets/sap-hana", "documentation/platform/dynamic-secrets/snowflake", - "documentation/platform/dynamic-secrets/totp" + "documentation/platform/dynamic-secrets/totp", + "documentation/platform/dynamic-secrets/kubernetes" ] }, { diff --git a/frontend/package-lock.json b/frontend/package-lock.json index 121dcd094..d435cf0d7 100644 --- a/frontend/package-lock.json +++ b/frontend/package-lock.json @@ -25,6 +25,7 @@ "@hookform/resolvers": "^3.9.1", "@lexical/react": "^0.29.0", "@lottiefiles/dotlottie-react": "^0.12.0", + "@lottiefiles/dotlottie-web": "^0.38.2", "@octokit/rest": "^21.0.2", "@peculiar/x509": "^1.12.3", "@radix-ui/react-accordion": "^1.2.2", diff --git a/frontend/package.json b/frontend/package.json index 7cd636343..9a2cc2ba4 100644 --- a/frontend/package.json +++ b/frontend/package.json @@ -29,6 +29,7 @@ "@hookform/resolvers": "^3.9.1", "@lexical/react": "^0.29.0", "@lottiefiles/dotlottie-react": "^0.12.0", + "@lottiefiles/dotlottie-web": "^0.38.2", "@octokit/rest": "^21.0.2", "@peculiar/x509": "^1.12.3", "@radix-ui/react-accordion": "^1.2.2", diff --git a/frontend/src/context/OrgPermissionContext/index.tsx b/frontend/src/context/OrgPermissionContext/index.tsx index acbbf3902..fccd53935 100644 --- a/frontend/src/context/OrgPermissionContext/index.tsx +++ b/frontend/src/context/OrgPermissionContext/index.tsx @@ -2,6 +2,7 @@ export { useOrgPermission } from "./OrgPermissionContext"; export type { TOrgPermission } from "./types"; export { OrgPermissionActions, + OrgPermissionBillingActions, OrgPermissionGroupActions, OrgPermissionIdentityActions, OrgPermissionSubjects diff --git a/frontend/src/context/OrgPermissionContext/types.ts b/frontend/src/context/OrgPermissionContext/types.ts index a4bd202bf..59446eb07 100644 --- a/frontend/src/context/OrgPermissionContext/types.ts +++ b/frontend/src/context/OrgPermissionContext/types.ts @@ -7,6 +7,11 @@ export enum OrgPermissionActions { Delete = "delete" } +export enum OrgPermissionBillingActions { + Read = "read", + ManageBilling = "manage-billing" +} + export enum OrgGatewayPermissionActions { // is there a better word for this. This mean can an identity be a gateway CreateGateways = "create-gateways", @@ -100,7 +105,7 @@ export type OrgPermissionSet = | [OrgPermissionActions, OrgPermissionSubjects.Ldap] | [OrgPermissionGroupActions, OrgPermissionSubjects.Groups] | [OrgPermissionActions, OrgPermissionSubjects.SecretScanning] - | [OrgPermissionActions, OrgPermissionSubjects.Billing] + | [OrgPermissionBillingActions, OrgPermissionSubjects.Billing] | [OrgPermissionActions, OrgPermissionSubjects.Kms] | [OrgPermissionAdminConsoleAction, OrgPermissionSubjects.AdminConsole] | [OrgPermissionActions, OrgPermissionSubjects.AuditLogs] diff --git a/frontend/src/context/index.tsx b/frontend/src/context/index.tsx index 91fcd9055..3641e8a3c 100644 --- a/frontend/src/context/index.tsx +++ b/frontend/src/context/index.tsx @@ -2,6 +2,7 @@ export { useOrganization } from "./OrganizationContext"; export type { TOrgPermission } from "./OrgPermissionContext"; export { OrgPermissionActions, + OrgPermissionBillingActions, OrgPermissionGroupActions, OrgPermissionIdentityActions, OrgPermissionSubjects, diff --git a/frontend/src/hooks/api/ca/mutations.tsx b/frontend/src/hooks/api/ca/mutations.tsx index 9c865d451..c05760beb 100644 --- a/frontend/src/hooks/api/ca/mutations.tsx +++ b/frontend/src/hooks/api/ca/mutations.tsx @@ -31,10 +31,14 @@ export const useUpdateCa = () => { return data; }, - onSuccess: ({ projectId, type }) => { + onSuccess: ({ projectId, type }, { caName }) => { + caKeys.getCaByNameAndProjectId(caName, projectId); queryClient.invalidateQueries({ queryKey: caKeys.listCasByTypeAndProjectId(type, projectId) }); + queryClient.invalidateQueries({ + queryKey: caKeys.getCaByNameAndProjectId(caName, projectId) + }); } }); }; diff --git a/frontend/src/hooks/api/dynamicSecret/types.ts b/frontend/src/hooks/api/dynamicSecret/types.ts index 1aedf264f..c17af7823 100644 --- a/frontend/src/hooks/api/dynamicSecret/types.ts +++ b/frontend/src/hooks/api/dynamicSecret/types.ts @@ -31,7 +31,8 @@ export enum DynamicSecretProviders { SapHana = "sap-hana", Snowflake = "snowflake", Totp = "totp", - SapAse = "sap-ase" + SapAse = "sap-ase", + Kubernetes = "kubernetes" } export enum SqlProviders { @@ -261,6 +262,20 @@ export type TDynamicSecretProvider = algorithm?: string; digits?: number; }; + } + | { + type: DynamicSecretProviders.Kubernetes; + inputs: { + url: string; + clusterToken: string; + ca?: string; + serviceAccountName: string; + credentialType: "dynamic" | "static"; + namespace: string; + gatewayId?: string; + sslEnabled: boolean; + audiences: string[]; + }; }; export type TCreateDynamicSecretDTO = { diff --git a/frontend/src/main.tsx b/frontend/src/main.tsx index 779c21bd8..f5958c028 100644 --- a/frontend/src/main.tsx +++ b/frontend/src/main.tsx @@ -1,5 +1,7 @@ import { StrictMode } from "react"; import ReactDOM from "react-dom/client"; +import { setWasmUrl } from "@lottiefiles/dotlottie-react"; +import lottieWasmUrl from "@lottiefiles/dotlottie-web/dist/dotlottie-player.wasm?url"; import { createRouter, RouterProvider } from "@tanstack/react-router"; import NProgress from "nprogress"; @@ -22,6 +24,9 @@ import "./translation"; // have a look at the Quick start guide // for passing in lng and translations on init/ +// Configure Lottie player to use local WASM file +setWasmUrl(lottieWasmUrl); + // Create a new router instance NProgress.configure({ showSpinner: false }); diff --git a/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaModal.tsx b/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaModal.tsx index 07bf1493a..d3040576f 100644 --- a/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaModal.tsx +++ b/frontend/src/pages/cert-manager/CertificateAuthoritiesPage/components/CaModal.tsx @@ -188,11 +188,7 @@ export const CaModal = ({ popUp, handlePopUpToggle }: Props) => { name, type: CaType.INTERNAL, status, - enableDirectIssuance, - configuration: { - ...configuration, - maxPathLength: Number(configuration.maxPathLength) - } + enableDirectIssuance }); } else { // create diff --git a/frontend/src/pages/organization/BillingPage/BillingPage.tsx b/frontend/src/pages/organization/BillingPage/BillingPage.tsx index 0ffe5abbb..d0b71cc21 100644 --- a/frontend/src/pages/organization/BillingPage/BillingPage.tsx +++ b/frontend/src/pages/organization/BillingPage/BillingPage.tsx @@ -2,7 +2,7 @@ import { Helmet } from "react-helmet"; import { useTranslation } from "react-i18next"; import { OrgPermissionCan } from "@app/components/permissions"; -import { OrgPermissionActions, OrgPermissionSubjects } from "@app/context"; +import { OrgPermissionBillingActions, OrgPermissionSubjects } from "@app/context"; import { BillingTabGroup } from "./components"; @@ -24,7 +24,7 @@ export const BillingPage = () => { diff --git a/frontend/src/pages/organization/BillingPage/components/BillingCloudTab/PreviewSection.tsx b/frontend/src/pages/organization/BillingPage/components/BillingCloudTab/PreviewSection.tsx index 5741722bd..98309edbd 100644 --- a/frontend/src/pages/organization/BillingPage/components/BillingCloudTab/PreviewSection.tsx +++ b/frontend/src/pages/organization/BillingPage/components/BillingCloudTab/PreviewSection.tsx @@ -4,7 +4,7 @@ import { FontAwesomeIcon } from "@fortawesome/react-fontawesome"; import { OrgPermissionCan } from "@app/components/permissions"; import { Button } from "@app/components/v2"; import { - OrgPermissionActions, + OrgPermissionBillingActions, OrgPermissionSubjects, useOrganization, useSubscription @@ -112,7 +112,7 @@ export const PreviewSection = () => { Get unlimited members, projects, RBAC, smart alerts, and so much more.

- + {(isAllowed) => (