Skip to content

Commit e6c1d34

Browse files
michaeljguarinomichaeljguarino
authored
Add scram hash to table for pgbouncer on cloud instance create (#1388)
1 parent 3efb647 commit e6c1d34

File tree

9 files changed

+117
-86
lines changed

9 files changed

+117
-86
lines changed

‎.github/workflows/ai.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -69,9 +69,9 @@ jobs:
6969
security-checks: 'vuln,secret'
7070
ignore-unfixed: true
7171
#severity: 'CRITICAL,HIGH'
72-
env:
73-
TRIVY_SKIP_DB_UPDATE: true
74-
TRIVY_SKIP_JAVA_DB_UPDATE: true
72+
# env:
73+
# TRIVY_SKIP_DB_UPDATE: true
74+
# TRIVY_SKIP_JAVA_DB_UPDATE: true
7575
- name: Upload Trivy scan results to GitHub Security tab
7676
uses: github/codeql-action/upload-sarif@v2
7777
with:

‎.github/workflows/test.yaml

+3-3
Original file line numberDiff line numberDiff line change
@@ -122,9 +122,9 @@ jobs:
122122
security-checks: 'vuln,secret'
123123
ignore-unfixed: true
124124
#severity: 'CRITICAL,HIGH'
125-
env:
126-
TRIVY_SKIP_DB_UPDATE: true
127-
TRIVY_SKIP_JAVA_DB_UPDATE: true
125+
# env:
126+
# TRIVY_SKIP_DB_UPDATE: true
127+
# TRIVY_SKIP_JAVA_DB_UPDATE: true
128128
- name: Upload Trivy scan results to GitHub Security tab
129129
uses: github/codeql-action/upload-sarif@v2
130130
with:

‎.github/workflows/trivy-artifact-scan.yaml

+44-44
Original file line numberDiff line numberDiff line change
@@ -1,44 +1,44 @@
1-
name: Trivy Artifact Scanning
2-
on:
3-
# push:
4-
# branches: [ master ]
5-
# paths:
6-
# - "plural/**"
7-
# - ".github/workflows/trivy-artifact-scan.yaml"
8-
# pull_request:
9-
# branches: [ master ]
10-
# paths:
11-
# - "plural/**"
12-
# - ".github/workflows/trivy-artifact-scan.yaml"
13-
# schedule:
14-
# - cron: '0 0 * * 1'
15-
workflow_dispatch:
16-
jobs:
17-
trivy-scan:
18-
name: Trivy IaC scan
19-
runs-on: ubuntu-20.04
20-
permissions:
21-
contents: read # for actions/checkout to fetch code
22-
security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
23-
actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
24-
steps:
25-
- name: Checkout code
26-
uses: actions/checkout@v3
27-
- name: Run Trivy vulnerability scanner in IaC mode
28-
uses: aquasecurity/trivy-action@master
29-
with:
30-
scan-type: 'fs'
31-
scan-ref: 'plural'
32-
hide-progress: false
33-
format: 'sarif'
34-
output: 'trivy-results.sarif'
35-
security-checks: 'vuln,secret,config'
36-
ignore-unfixed: true
37-
#severity: 'CRITICAL,HIGH'
38-
env:
39-
TRIVY_SKIP_DB_UPDATE: true
40-
TRIVY_SKIP_JAVA_DB_UPDATE: true
41-
- name: Upload Trivy scan results to GitHub Security tab
42-
uses: github/codeql-action/upload-sarif@v2
43-
with:
44-
sarif_file: 'trivy-results.sarif'
1+
# name: Trivy Artifact Scanning
2+
# on:
3+
# # push:
4+
# # branches: [ master ]
5+
# # paths:
6+
# # - "plural/**"
7+
# # - ".github/workflows/trivy-artifact-scan.yaml"
8+
# # pull_request:
9+
# # branches: [ master ]
10+
# # paths:
11+
# # - "plural/**"
12+
# # - ".github/workflows/trivy-artifact-scan.yaml"
13+
# # schedule:
14+
# # - cron: '0 0 * * 1'
15+
# workflow_dispatch:
16+
# jobs:
17+
# trivy-scan:
18+
# name: Trivy IaC scan
19+
# runs-on: ubuntu-20.04
20+
# permissions:
21+
# contents: read # for actions/checkout to fetch code
22+
# security-events: write # for github/codeql-action/upload-sarif to upload SARIF results
23+
# actions: read # only required for a private repository by github/codeql-action/upload-sarif to get the Action run status
24+
# steps:
25+
# - name: Checkout code
26+
# uses: actions/checkout@v3
27+
# - name: Run Trivy vulnerability scanner in IaC mode
28+
# uses: aquasecurity/trivy-action@master
29+
# with:
30+
# scan-type: 'fs'
31+
# scan-ref: 'plural'
32+
# hide-progress: false
33+
# format: 'sarif'
34+
# output: 'trivy-results.sarif'
35+
# security-checks: 'vuln,secret,config'
36+
# ignore-unfixed: true
37+
# #severity: 'CRITICAL,HIGH'
38+
# env:
39+
# TRIVY_SKIP_DB_UPDATE: true
40+
# TRIVY_SKIP_JAVA_DB_UPDATE: true
41+
# - name: Upload Trivy scan results to GitHub Security tab
42+
# uses: github/codeql-action/upload-sarif@v2
43+
# with:
44+
# sarif_file: 'trivy-results.sarif'

‎.github/workflows/trivy-cache.yaml

+29-29
Original file line numberDiff line numberDiff line change
@@ -1,34 +1,34 @@
1-
name: Update Trivy Cache
1+
# name: Update Trivy Cache
22

3-
on:
4-
schedule:
5-
- cron: '0 0 * * *'
6-
workflow_dispatch:
3+
# on:
4+
# schedule:
5+
# - cron: '0 0 * * *'
6+
# workflow_dispatch:
77

8-
jobs:
9-
update-trivy-db:
10-
runs-on: ubuntu-latest
11-
steps:
12-
- name: Get current date
13-
id: date
14-
run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
8+
# jobs:
9+
# update-trivy-db:
10+
# runs-on: ubuntu-latest
11+
# steps:
12+
# - name: Get current date
13+
# id: date
14+
# run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
1515

16-
- name: Download and extract the vulnerability DB
17-
run: |
18-
mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db
19-
oras pull ghcr.io/aquasecurity/trivy-db:2
20-
tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db
21-
rm db.tar.gz
16+
# - name: Download and extract the vulnerability DB
17+
# run: |
18+
# mkdir -p $GITHUB_WORKSPACE/.cache/trivy/db
19+
# oras pull ghcr.io/aquasecurity/trivy-db:2
20+
# tar -xzf db.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/db
21+
# rm db.tar.gz
2222

23-
- name: Download and extract the Java DB
24-
run: |
25-
mkdir -p $GITHUB_WORKSPACE/.cache/trivy/java-db
26-
oras pull ghcr.io/aquasecurity/trivy-java-db:1
27-
tar -xzf javadb.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/java-db
28-
rm javadb.tar.gz
23+
# - name: Download and extract the Java DB
24+
# run: |
25+
# mkdir -p $GITHUB_WORKSPACE/.cache/trivy/java-db
26+
# oras pull ghcr.io/aquasecurity/trivy-java-db:1
27+
# tar -xzf javadb.tar.gz -C $GITHUB_WORKSPACE/.cache/trivy/java-db
28+
# rm javadb.tar.gz
2929

30-
- name: Cache DBs
31-
uses: actions/cache/save@v4
32-
with:
33-
path: ${{ github.workspace }}/.cache/trivy
34-
key: cache-trivy-${{ steps.date.outputs.date }}
30+
# - name: Cache DBs
31+
# uses: actions/cache/save@v4
32+
# with:
33+
# path: ${{ github.workspace }}/.cache/trivy
34+
# key: cache-trivy-${{ steps.date.outputs.date }}

‎.github/workflows/www.yaml

+6-6
Original file line numberDiff line numberDiff line change
@@ -63,9 +63,9 @@ jobs:
6363
security-checks: 'vuln,secret'
6464
ignore-unfixed: true
6565
#severity: 'CRITICAL,HIGH'
66-
env:
67-
TRIVY_SKIP_DB_UPDATE: true
68-
TRIVY_SKIP_JAVA_DB_UPDATE: true
66+
# env:
67+
# TRIVY_SKIP_DB_UPDATE: true
68+
# TRIVY_SKIP_JAVA_DB_UPDATE: true
6969
- name: Upload Trivy scan results to GitHub Security tab
7070
uses: github/codeql-action/upload-sarif@v2
7171
with:
@@ -91,9 +91,9 @@ jobs:
9191
security-checks: 'vuln,secret'
9292
ignore-unfixed: true
9393
#severity: 'CRITICAL,HIGH'
94-
env:
95-
TRIVY_SKIP_DB_UPDATE: true
96-
TRIVY_SKIP_JAVA_DB_UPDATE: true
94+
# env:
95+
# TRIVY_SKIP_DB_UPDATE: true
96+
# TRIVY_SKIP_JAVA_DB_UPDATE: true
9797
- name: Upload Trivy scan results to GitHub Security tab
9898
uses: github/codeql-action/upload-sarif@v2
9999
with:

‎apps/core/lib/core/services/cloud/scram.ex

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
defmodule Core.Services.Cloud.Scram do
2+
alias Plug.Crypto.KeyGenerator
3+
@salt_size 16
4+
@digest_len 32
5+
@iterations 4096
6+
7+
def encrypt(pwd) do
8+
salt = :crypto.strong_rand_bytes(@salt_size)
9+
pbkdf = KeyGenerator.generate(pwd, salt, iterations: @iterations, length: @digest_len)
10+
client = :crypto.mac(:hmac, :sha256, pbkdf, "Client Key")
11+
stored = :crypto.hash(:sha256, client)
12+
server = :crypto.mac(:hmac, :sha256, pbkdf, "Server Key")
13+
"SCRAM-SHA-256$#{@iterations}:#{Base.encode64(salt)}$#{Base.encode64(stored)}:#{Base.encode64(server)}"
14+
end
15+
end

‎apps/core/lib/core/services/cloud/workflow/shared.ex

+14-1
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,25 @@ defmodule Core.Services.Cloud.Workflow.Shared do
44

55
alias Core.Clients.Console
66
alias Core.Services.{Cloud, Users}
7-
alias Core.Services.Cloud.{Poller, Configuration}
7+
alias Core.Services.Cloud.{Poller, Configuration, Scram}
88
alias Core.Schema.{ConsoleInstance, PostgresCluster, User}
99
alias Core.Repo
1010

1111
require Logger
1212

1313
@behaviour Core.Services.Cloud.Workflow
1414

15+
@table """
16+
CREATE TABLE IF NOT EXISTS console_users (
17+
usename VARCHAR(255) NOT NULL PRIMARY KEY,
18+
passwd VARCHAR(500) NOT NULL
19+
)
20+
"""
21+
22+
@user_insert """
23+
INSERT INTO console_users (usename, passwd) values ($1, $2) ON CONFLICT (usename) DO UPDATE SET passwd = EXCLUDED.passwd
24+
"""
25+
1526
def sync(%ConsoleInstance{external_id: id} = instance) when is_binary(id) do
1627
instance = Repo.preload(instance, [:cluster, :postgres])
1728
Console.update_service(console(), id, %{
@@ -42,6 +53,8 @@ defmodule Core.Services.Cloud.Workflow.Shared do
4253
with {:ok, pid} <- connect(pg),
4354
{:ok, _} <- Postgrex.query(pid, "CREATE DATABASE #{conf.database}", []),
4455
{:ok, _} <- Postgrex.transaction(pid, fn conn ->
56+
Postgrex.query!(conn, @table, [])
57+
Postgrex.query!(conn, @user_insert, [conf.dbuser, Scram.encrypt(conf.dbpassword)])
4558
Postgrex.query!(conn, "CREATE USER #{conf.dbuser} WITH PASSWORD '#{conf.dbpassword}'", [])
4659
Postgrex.query!(conn, "GRANT ALL ON DATABASE #{conf.database} TO #{conf.dbuser}", [])
4760
end) do

‎apps/core/mix.exs

+1
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,7 @@ defmodule Core.MixProject do
9292
{:mojito, "~> 0.7.0"},
9393
{:nebulex, "== 2.4.2"},
9494
{:castore, "~> 0.1.7"},
95+
{:plug_crypto, "~> 1.2"},
9596
{:req, "~> 0.4.14", override: true},
9697
{:mint, "~> 1.4.0", override: true},
9798
{:finch, "~> 0.17.0", override: true},

‎apps/worker/lib/worker/conduit/subscribers/cloud.ex

+2
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,10 @@ defmodule Worker.Conduit.Subscribers.Cloud do
22
use Worker.Conduit.Subscribers.Base
33
alias Core.Services.Cloud.Workflow
44
alias Core.PubSub
5+
require Logger
56

67
def process(%Conduit.Message{body: body} = msg, _) do
8+
Logger.info "handling #{body.__struct__} for #{body.item.name}"
79
case handle(body) do
810
{:ok, _} -> ack(msg)
911
_ -> nack(msg)

0 commit comments

Comments
 (0)