Bug 1498203 - Extracted Credentials were leaking to new bindings
Summary: Extracted Credentials were leaking to new bindings
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Service Broker
Version: 3.7.0
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
: 3.7.0
Assignee: Shawn Hurley
QA Contact: Weihua Meng
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-10-03 17:56 UTC by Shawn Hurley
Modified: 2017-11-28 22:14 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-11-28 22:14:33 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:3188 0 normal SHIPPED_LIVE Moderate: Red Hat OpenShift Container Platform 3.7 security, bug, and enhancement update 2017-11-29 02:34:54 UTC

Description Shawn Hurley 2017-10-03 17:56:23 UTC
Description of problem:
When creating multiple bindable APB's (example postgresql and mysql) using the same broker, the second APB's extracted credentials would also have the first's extracted credentials. This would cause the binding secret that the service catalog creates to have extra credentials.

Version-Release number of selected component (if applicable):


How reproducible:
Always

Steps to Reproduce:
1. Provision PostgreSQL APB and wait for it to finish
2. Provision MySQL APB and wait for it to finish
3. create a binding between MySQL and another APB
Actual results:
 The secret that is created contains the credentials for PostgreSQL as well as its own credentials

Expected results:
The secret should only have its credentials


Additional info:

Comment 1 Shawn Hurley 2017-10-04 13:07:23 UTC
Bug fixes with PR: https://github.com/openshift/ansible-service-broker/pull/469

Comment 2 Weihua Meng 2017-10-09 10:24:18 UTC
Hi, Shawn
I did not see secret contains the credentials for itself and others.
I tried that  Provision PostgreSQL APB and  MySQL APB in defferent projects and in same project.
# oc describe secret dh-rhscl-mysql-apb-8243t-credentials-lhem7
Name:		dh-rhscl-mysql-apb-8243t-credentials-lhem7
Namespace:	test1
Labels:		<none>
Annotations:	<none>

Type:	Opaque

Data
====
MYSQL_PASSWORD:	5 bytes
MYSQL_PORT:	4 bytes
MYSQL_USER:	5 bytes
MYSQL_DATABASE:	5 bytes

# oc describe secret dh-rhscl-postgresql-apb-fldxt-credentials-0diao
Name:		dh-rhscl-postgresql-apb-fldxt-credentials-0diao
Namespace:	test1
Labels:		<none>
Annotations:	<none>

Type:	Opaque

Data
====
DB_NAME:	5 bytes
DB_PASSWORD:	4 bytes
DB_PORT:	4 bytes
DB_TYPE:	8 bytes
DB_USER:	5 bytes
DB_HOST:	10 bytes

asb image used
# docker images
REPOSITORY                                                                                   TAG                 IMAGE ID            CREATED             SIZE
brew-pulp-docker01.web.prod.ext.phx2.redhat.com:8888/openshift3/ose-ansible-service-broker   v3.7                58314270b158        3 days ago          622.2 MB

asbd --version
1.0.7

Comment 3 Shawn Hurley 2017-10-12 12:27:42 UTC
Does the above prove that the issue is fixed?

Comment 4 Weihua Meng 2017-10-12 13:57:03 UTC
Which version has the fix for this bug?
If the version has bug fix, and test steps are right, then we are confident that the bug is fixed.

Comment 6 Weihua Meng 2017-10-18 10:18:28 UTC
Verified.
Fixed.

# oc describe secret dh-rhscl-postgresql-apb-ntsn2-credentials-95act
Name:		dh-rhscl-postgresql-apb-ntsn2-credentials-95act
Namespace:	wmeng1
Labels:		<none>
Annotations:	<none>

Type:	Opaque

Data
====
DB_TYPE:	8 bytes
DB_USER:	5 bytes
DB_HOST:	10 bytes
DB_NAME:	5 bytes
DB_PASSWORD:	20 bytes
DB_PORT:	4 bytes
[root@preserve-wmeng18-master-etcd-1 ~]# oc describe secret dh-rhscl-mysql-apb-69mjt-credentials-f55dv
Name:		dh-rhscl-mysql-apb-69mjt-credentials-f55dv
Namespace:	wmeng1
Labels:		<none>
Annotations:	<none>

Type:	Opaque

Data
====
MYSQL_DATABASE:	5 bytes
MYSQL_HOST:	13 bytes
MYSQL_PASSWORD:	20 bytes
MYSQL_PORT:	4 bytes
MYSQL_USER:	5 bytes
[root@preserve-wmeng18-master-etcd-1 ~]# 

sh-4.2$ asbd --version
1.0.10

ansible-service-broker-1.0.10-1.el7.x86_64

Comment 9 errata-xmlrpc 2017-11-28 22:14:33 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2017:3188


Note You need to log in before you can comment on or make changes to this bug.