github/kubernetes
4
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

gce: configure: validate SA has storage scope

Browse Source 
If the VM SA doesn't have storage scope associated, don't use the
token in the curl request or the request will fail with 403.
This commit is contained in:
Javier Pérez Hernández 2019-03-11 11:57:01 -07:00
parent 4ea48886df
commit e783f0bcd4
1 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
cluster/gce/gci/configure.sh
View File

@ -124,11 +124,16 @@ function validate-hash {
} }
# Get default service account credentials of the VM. # Get default service account credentials of the VM.
GCE_METADATA_INTERNAL="http://metadata.google.internal/computeMetadata/v1/instance"
function get-credentials { function get-credentials {
curl "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token" -H "Metadata-Flavor: Google" -s | python -c \ curl "${GCE_METADATA_INTERNAL}/service-accounts/default/token" -H "Metadata-Flavor: Google" -s | python -c \
'import sys; import json; print(json.loads(sys.stdin.read())["access_token"])' 'import sys; import json; print(json.loads(sys.stdin.read())["access_token"])'
} }
function valid-storage-scope {
curl "${GCE_METADATA_INTERNAL}/service-accounts/default/scopes" -H "Metadata-Flavor: Google" -s | grep -q "auth/devstorage"
}
# Retry a download until we get it. Takes a hash and a set of URLs. # Retry a download until we get it. Takes a hash and a set of URLs.
# #
# $1 is the sha1 of the URL. Can be "" if the sha1 is unknown. # $1 is the sha1 of the URL. Can be "" if the sha1 is unknown.
@ -144,7 +149,7 @@ function download-or-bust {
rm -f "${file}" rm -f "${file}"
# if the url belongs to GCS API we should use oauth2_token in the headers # if the url belongs to GCS API we should use oauth2_token in the headers
local curl_headers="" local curl_headers=""
if [[ "$url" =~ ^https://storage.googleapis.com.* ]]; then if [[ "$url" =~ ^https://storage.googleapis.com.* ]] && valid-storage-scope ; then
curl_headers="Authorization: Bearer $(get-credentials)" curl_headers="Authorization: Bearer $(get-credentials)"
fi fi
if ! curl ${curl_headers:+-H "${curl_headers}"} -f --ipv4 -Lo "${file}" --connect-timeout 20 --max-time 300 --retry 6 --retry-delay 10 ${CURL_RETRY_CONNREFUSED} "${url}"; then if ! curl ${curl_headers:+-H "${curl_headers}"} -f --ipv4 -Lo "${file}" --connect-timeout 20 --max-time 300 --retry 6 --retry-delay 10 ${CURL_RETRY_CONNREFUSED} "${url}"; then