Repository navigation
Conversation
The values are keyed with the secret key before they go into the hash, since the hash is visible in the API and a plain hash of a short secret could be guessed. Blueprints without these tags keep their current hash. Closes: #26925
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #26932 +/- ##
=======================================
Coverage 92.40% 92.40%
=======================================
Files 1191 1191
Lines 80332 80376 +44
Branches 4351 4351
=======================================
+ Hits 74227 74271 +44
Misses 6039 6039
Partials 66 66
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. |
✅ Deploy Preview for authentik-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
Contributor
Playwright e2eDownload this run's HTML report and traces, then open the report: gh run download 40248406219 -D playwright-artifacts
npx playwright show-report playwright-artifacts/playwright-reportInstallation instructionsInstructions for docker-composeAdd the following block to your AUTHENTIK_IMAGE=ghcr.io/goauthentik/dev-server
AUTHENTIK_TAG=gh-9b02d8921ea9a5f3a7f994f64aa88aee7cce6f30
# Distroless image: AUTHENTIK_TAG=gh-9b02d8921ea9a5f3a7f994f64aa88aee7cce6f30-distroless
AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE=ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)sAfterwards, run the upgrade commands from the latest release notes. Instructions for KubernetesAdd the following block to your authentik:
outposts:
container_image_base: ghcr.io/goauthentik/dev-%(type)s:gh-%(build_hash)s
global:
image:
repository: ghcr.io/goauthentik/dev-server
tag: gh-9b02d8921ea9a5f3a7f994f64aa88aee7cce6f30
# Distroless image: tag: gh-9b02d8921ea9a5f3a7f994f64aa88aee7cce6f30-distrolessAfterwards, run the upgrade commands from the latest release notes. |
main now hashes the contents of `!File` references in blueprints/v1/hash.py, which overlaps with this branch's own hashing in tasks.py. Keep main's implementation and its edge-case handling, and extend it to `!Env` values instead of keeping both. The referenced values now go through one HMAC keyed with the secret key rather than being folded in as plain digests, since the hash is visible in the API and a plain digest of a short secret can be brute-forced. Blueprints without resolvable tags keep their plain content hash.
dominic-r
changed the title
!Env or !File values change!Env values change and key the hashed values
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
What does this PR change?
The blueprint hash used by discovery and stored in
last_applied_hashnow also covers the current values of a blueprint's!Envtags, so discovery reapplies a blueprint when one of those variables changes. #26402 already does this for!Filecontents inblueprints/v1/hash.py. This PR extends that walk to!Envtags and changes how the values are folded in: instead of adding a plain sha512 of each value, all!Envand!Filevalues go through one HMAC keyed with the secret key (salted_hmac), which is then added to the sha512 of the blueprint content.The blueprints overview in the docs now mentions that
!Envand!Filevalue changes trigger a reapply.Why is this change needed?
A blueprint that reads a secret through
!Envwas never reapplied when only that variable changed, for example after a rotation. It kept the old value until the file was edited or the blueprint was applied by hand.The values are never stored, but
last_applied_hashis visible in the API, and a plain hash of a short secret can be brute-forced. That applies to the!Filedigests added in #26402 as well, so they're keyed too.Blueprints without
!Envor!Filetags keep their current hash, so upgrading doesn't reapply them. Blueprints that use these tags are reapplied once after the upgrade, and again whenever the secret key changes. This includes blueprints whose variables are unset, such as the default ones that use!Envwith a default. An unset variable, like a missing file, takes a placeholder in the hash so its position still counts.A
!Filepath outside the blueprints directory isn't watched, and environment variable changes don't produce file events, so these changes are picked up by the next scheduled discovery run. It runs hourly and on startup.How was this tested?
!Envand!Fileand runs discovery again with the same values to check the hash is unchanged. It then changes the environment variable and the file in turn and checks that each change reapplies the blueprint with a new hash. Without the!Envhandling it fails at the environment variable change.!Envkey with a lone surrogate and one with a null byte to the cases that must not stop other blueprints from being discovered. Without a guard, the surrogate makesgetenvraise and discovery aborts.!Fileto the keyed digest. All other!Filetests from blueprints: re-apply when a file referenced by !File changes #26402 pass unchanged.Linked issues
closes #26925
Checklist
make all)make docs)