From 40711ac7075557ffe166a11560d95e230b73619e Mon Sep 17 00:00:00 2001
From: Sheen Capadngan <sheensantoscapadngan@gmail.com>
Date: Thu, 29 May 2025 21:15:53 +0800
Subject: [PATCH] misc: addressed comments

---
 .../dynamic-secret/providers/kubernetes.ts     | 18 +++++++++++++-----
 .../KubernetesInputForm.tsx                    |  6 +++---
 .../EditDynamicSecretKubernetesForm.tsx        |  4 ++--
 3 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
index feb473c1f..20ac8877f 100644
--- a/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
+++ b/backend/src/ee/services/dynamic-secret/providers/kubernetes.ts
@@ -1,11 +1,12 @@
 import axios from "axios";
 import https from "https";
 
+import { InternalServerError } from "@app/lib/errors";
 import { withGatewayProxy } from "@app/lib/gateway";
+import { blockLocalAndPrivateIpAddresses } from "@app/lib/validator";
 import { TKubernetesTokenRequest } from "@app/services/identity-kubernetes-auth/identity-kubernetes-auth-types";
 
 import { TGatewayServiceFactory } from "../../gateway/gateway-service";
-import { verifyHostInputValidity } from "../dynamic-secret-fns";
 import { DynamicSecretKubernetesSchema, TDynamicProviderFns } from "./models";
 
 const EXTERNAL_REQUEST_TIMEOUT = 10 * 1000;
@@ -17,8 +18,11 @@ type TKubernetesProviderDTO = {
 export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO): TDynamicProviderFns => {
   const validateProviderInputs = async (inputs: unknown) => {
     const providerInputs = await DynamicSecretKubernetesSchema.parseAsync(inputs);
-    const [hostIp] = await verifyHostInputValidity(providerInputs.url, Boolean(providerInputs.gatewayId));
-    return { ...providerInputs, hostIp };
+    if (!providerInputs.gatewayId) {
+      await blockLocalAndPrivateIpAddresses(providerInputs.url);
+    }
+
+    return providerInputs;
   };
 
   const $gatewayProxyWrapper = async <T>(
@@ -106,7 +110,9 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
         errorMessage = (error.response?.data as { message: string }).message;
       }
 
-      throw new Error(`Failed to validate connection: ${errorMessage}`);
+      throw new InternalServerError({
+        message: `Failed to validate connection: ${errorMessage}`
+      });
     }
   };
 
@@ -168,7 +174,9 @@ export const KubernetesProvider = ({ gatewayService }: TKubernetesProviderDTO):
         errorMessage = (error.response?.data as { message: string }).message;
       }
 
-      throw new Error(`Failed to validate connection: ${errorMessage}`);
+      throw new InternalServerError({
+        message: `Failed to create dynamic secret: ${errorMessage}`
+      });
     }
   };
 
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/KubernetesInputForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/KubernetesInputForm.tsx
index b08a3c5b0..21c04ad24 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/KubernetesInputForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/ActionBar/CreateDynamicSecretForm/KubernetesInputForm.tsx
@@ -49,7 +49,7 @@ const formSchema = z.object({
     url: z.string().url().trim().min(1),
     clusterToken: z.string().trim().min(1),
     ca: z.string().optional(),
-    sslEnabled: z.boolean().default(true),
+    sslEnabled: z.boolean().default(false),
     credentialType: z.literal(CredentialType.Static),
     serviceAccountName: z.string().trim().min(1),
     namespace: z.string().trim().min(1),
@@ -109,7 +109,7 @@ export const KubernetesInputForm = ({
         url: "",
         clusterToken: "",
         ca: "",
-        sslEnabled: true,
+        sslEnabled: false,
         serviceAccountName: "",
         namespace: "",
         credentialType: CredentialType.Static,
@@ -284,7 +284,7 @@ export const KubernetesInputForm = ({
                   name="provider.url"
                   render={({ field, fieldState: { error } }) => (
                     <FormControl
-                      label="URL"
+                      label="Cluster URL"
                       isError={Boolean(error?.message)}
                       errorText={error?.message}
                     >
diff --git a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretKubernetesForm.tsx b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretKubernetesForm.tsx
index 1b893f0d9..5eb6b7fe3 100644
--- a/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretKubernetesForm.tsx
+++ b/frontend/src/pages/secret-manager/SecretDashboardPage/components/DynamicSecretListView/EditDynamicSecretForm/EditDynamicSecretKubernetesForm.tsx
@@ -47,7 +47,7 @@ const formSchema = z.object({
     url: z.string().url().trim().min(1),
     clusterToken: z.string().trim().min(1),
     ca: z.string().optional(),
-    sslEnabled: z.boolean().default(true),
+    sslEnabled: z.boolean().default(false),
     credentialType: z.literal(CredentialType.Static),
     serviceAccountName: z.string().trim().min(1),
     namespace: z.string().trim().min(1),
@@ -277,7 +277,7 @@ export const EditDynamicSecretKubernetesForm = ({
                     name="inputs.url"
                     render={({ field, fieldState: { error } }) => (
                       <FormControl
-                        label="URL"
+                        label="Cluster URL"
                         isError={Boolean(error?.message)}
                         errorText={error?.message}
                       >