Repository: clusternet/clusternet
Pull request #593 (2023-02-21 03:03:00)

validate bootstrap token for cluster registration
<!--  Thanks for sending a pull request!

-->

#### What type of PR is this?
kind/enhancement

#### What this PR does / why we need it:

#### Which issue(s) this PR fixes:
<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.
-->
Fixes #

#### Special notes for your reviewer:


codecov-commenter: # [Codecov](https://codecov.io/gh/clusternet/clusternet/pull/593?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clusternet) Report
> Merging [#593](https://codecov.io/gh/clusternet/clusternet/pull/593?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clusternet) (c61b313) into [main](https://codecov.io/gh/clusternet/clusternet/commit/029e2ddcc836e0679270afbc511938b8d3099a50?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clusternet) (029e2dd) will **decrease** coverage by `0.01%`.
> The diff coverage is `n/a`.

:mega: This organization is not using Codecov’s [GitHub App Integration](https://github.com/apps/codecov). We recommend you install it so Codecov can continue to function properly for your repositories. [Learn more](https://about.codecov.io/blog/codecov-is-updating-its-github-integration/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clusternet)

```diff
@@            Coverage Diff             @@
##             main     #593      +/-   ##
==========================================
- Coverage   13.56%   13.56%   -0.01%     
==========================================
  Files          66       66              
  Lines        7489     7492       +3     
==========================================
  Hits         1016     1016              
- Misses       6390     6393       +3     
  Partials       83       83              
```


| [Impacted Files](https://codecov.io/gh/clusternet/clusternet/pull/593?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clusternet) | Coverage Δ | |
|---|---|---|
| [...thub.com/clusternet/clusternet/pkg/agent/option.go](https://codecov.io/gh/clusternet/clusternet/pull/593?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clusternet#diff-c3JjL2dpdGh1Yi5jb20vY2x1c3Rlcm5ldC9jbHVzdGVybmV0L3BrZy9hZ2VudC9vcHRpb24uZ28=) | `0.00% <0.00%> (ø)` | |
| [...ernet/clusternet/pkg/hub/apiserver/shadow/utils.go](https://codecov.io/gh/clusternet/clusternet/pull/593?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clusternet#diff-c3JjL2dpdGh1Yi5jb20vY2x1c3Rlcm5ldC9jbHVzdGVybmV0L3BrZy9odWIvYXBpc2VydmVyL3NoYWRvdy91dGlscy5nbw==) | `89.28% <0.00%> (ø)` | |

Help us with your feedback. Take ten seconds to tell us [how you rate us](https://about.codecov.io/nps?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clusternet). Have a feature suggestion? [Share it here.](https://app.codecov.io/gh/feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=clusternet)

lmxia: LGTM, nice enhancement

Patch:
diff --git a/go.mod b/go.mod
index 8fd40a2..df7a88f 100644
--- a/go.mod
+++ b/go.mod
@@ -23,6 +23,7 @@ require (
 	k8s.io/apimachinery v0.24.10
 	k8s.io/apiserver v0.24.10
 	k8s.io/client-go v0.24.10
+	k8s.io/cluster-bootstrap v0.24.10
 	k8s.io/code-generator v0.24.10
 	k8s.io/component-base v0.24.10
 	k8s.io/component-helpers v0.24.10
diff --git a/go.sum b/go.sum
index 4643ea9..00d2ec0 100644
--- a/go.sum
+++ b/go.sum
@@ -1419,6 +1419,8 @@ k8s.io/client-go v0.22.2/go.mod h1:sAlhrkVDf50ZHx6z4K0S40wISNTarf1r800F+RlCF6U=
 k8s.io/client-go v0.24.9/go.mod h1:be0fCcgenPyCTGJSFtexn+dMr4jJoUX36Y5UAb1vmls=
 k8s.io/client-go v0.24.10 h1:OES38LCaqmeJDpjy3lqDRAlAO4376dFXD3X/A0RSTTQ=
 k8s.io/client-go v0.24.10/go.mod h1:NqCCKuS48y1Hf9g7heYm4uns5l3NLmbv0AYLGrMG7n4=
+k8s.io/cluster-bootstrap v0.24.10 h1:ToRr94SLYWsaW+62Tea3jpHEKCWpXvoAMja7YO9X6YA=
+k8s.io/cluster-bootstrap v0.24.10/go.mod h1:V1CSJEwWC+Ny1cDy3F1iScG0uQg9ZZPeAUNTJ1ZBQ+A=
 k8s.io/code-generator v0.18.2/go.mod h1:+UHX5rSbxmR8kzS+FAv7um6dtYrZokQvjHpDSYRVkTc=
 k8s.io/code-generator v0.18.4/go.mod h1:TgNEVx9hCyPGpdtCWA34olQYLkh3ok9ar7XfSsr8b6c=
 k8s.io/code-generator v0.22.2/go.mod h1:eV77Y09IopzeXOJzndrDyCI88UBok2h6WxAlBwpxa+o=
diff --git a/pkg/agent/option.go b/pkg/agent/option.go
index 4290796..667b780 100644
--- a/pkg/agent/option.go
+++ b/pkg/agent/option.go
@@ -26,6 +26,7 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/util/sets"
 	utilfeature "k8s.io/apiserver/pkg/util/feature"
+	bootstraputil "k8s.io/cluster-bootstrap/token/util"
 
 	clusterapi "github.com/clusternet/clusternet/pkg/apis/clusters/v1beta1"
 	"github.com/clusternet/clusternet/pkg/features"
@@ -201,7 +202,10 @@ func (opts *ClusterRegistrationOptions) Validate() []error {
 		allErrs = append(allErrs, fmt.Errorf("invalid sync mode %q, only 'Pull', 'Push' and 'Dual' are supported", opts.ClusterSyncMode))
 	}
 
-	// TODO: check bootstrap token
+	// once getting registered, expired bootstrap tokens do no harm
+	if !bootstraputil.IsValidBootstrapToken(opts.BootstrapToken) {
+		allErrs = append(allErrs, fmt.Errorf("the bootstrap token %q is invalid", opts.BootstrapToken))
+	}
 
 	return allErrs
 }


Test patch:
diff --git a/pkg/agent/option_test.go b/pkg/agent/option_test.go
new file mode 100644
index 0000000..7702051
--- /dev/null
+++ b/pkg/agent/option_test.go
@@ -0,0 +1,40 @@
+/*
+Copyright 2023 The Clusternet Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package agent
+
+import (
+	"testing"
+
+	bootstraputil "k8s.io/cluster-bootstrap/token/util"
+)
+
+func TestValidateToken(t *testing.T) {
+	var tests = []struct {
+		token    string
+		expected bool
+	}{
+		{"07401b.f395accd246ae52d", true},
+		{".f395accd246ae52d", false},
+		{"07401b.", false},
+		{"07401b.f395accd246ae52d@foobar", false},
+	}
+	for _, bt := range tests {
+		if bootstraputil.IsValidBootstrapToken(bt.token) != bt.expected {
+			t.Errorf("invalid bootstrap token %q", bt.token)
+		}
+	}
+}