Repository: istio/istio
File: pilot/pkg/model/credentials/resource.go (Go)

Code before:
}

func (sr SecretResource) Key() string {
	return sr.ResourceType + "/" + sr.ResourceKind.String() + "/" + sr.Name + "/" + sr.Namespace + "/" + string(sr.Cluster)
}

func (sr SecretResource) KubernetesResourceName() string {
	return fmt.Sprintf("%s://%s/%s", sr.ResourceType, sr.Namespace, sr.Name)
}

func ToKubernetesGatewayResource(namespace, name string) string {
	if strings.HasPrefix(name, BuiltinGatewaySecretTypeURI) {
		return BuiltinGatewaySecretTypeURI
	}
	return fmt.Sprintf("%s://%s/%s", KubernetesGatewaySecretType, namespace, name)
}

// ToResourceName turns a `credentialName` into a resource name used for SDS
func ToResourceName(name, proxyNamespace string) string {
	if strings.HasPrefix(name, BuiltinGatewaySecretTypeURI) {
		return "default"
	}
	if strings.HasPrefix(name, InvalidSecretTypeURI) {
		return InvalidSecretTypeURI
	}
	if strings.HasPrefix(name, KubernetesSecretTypeURI) {
		return normalizeResourceName(name, proxyNamespace)
	}
	// If they explicitly defined the type, keep it
	if strings.HasPrefix(name, KubernetesConfigMapTypeURI) ||
		strings.HasPrefix(name, kubernetesGatewaySecretTypeURI) {
		return name
	}
	// Otherwise, to kubernetes://
	return normalizeResourceName(name, proxyNamespace)
}

// ParseResourceName parses a raw resourceName string.
func ParseResourceName(resourceName string, proxyNamespace string, proxyCluster cluster.ID, configCluster cluster.ID) (SecretResource, error) {
	sep := "/"
	if strings.HasPrefix(resourceName, KubernetesSecretTypeURI) {
		// Valid formats:
		// * kubernetes://secret-name
		// * kubernetes://secret-namespace/secret-name
		// If namespace is not set, we will fetch from the namespace of the proxy. The secret will be read from
		// the cluster the proxy resides in. This mirrors the legacy behavior mounting a secret as a file
		res := strings.TrimPrefix(resourceName, KubernetesSecretTypeURI)
		split := strings.Split(res, sep)
		namespace := proxyNamespace
		name := split[0]
		if len(split) > 1 {

Review comment (security):
@keithmattix @hzxuzhonghu @howardjohn only normalized kubernetes types. Based on my read, gateway secretes and configmaps already have namespaces? Let me know if that is not the case

Code after:
}

func (sr SecretResource) Key() string {
	return sr.ResourceName + "/" + sr.ResourceType + "/" + sr.ResourceKind.String() + "/" + sr.Name + "/" + sr.Namespace + "/" + string(sr.Cluster)
}

func (sr SecretResource) KubernetesResourceName() string {
	return fmt.Sprintf("%s://%s/%s", sr.ResourceType, sr.Namespace, sr.Name)
}

func ToKubernetesGatewayResource(namespace, name string) string {
	if strings.HasPrefix(name, BuiltinGatewaySecretTypeURI) {
		return BuiltinGatewaySecretTypeURI
	}
	return fmt.Sprintf("%s://%s/%s", KubernetesGatewaySecretType, namespace, name)
}

// ToResourceName turns a `credentialName` into a resource name used for SDS
func ToResourceName(name string) string {
	if strings.HasPrefix(name, BuiltinGatewaySecretTypeURI) {
		return "default"
	}
	if strings.HasPrefix(name, InvalidSecretTypeURI) {
		return InvalidSecretTypeURI
	}
	// If they explicitly defined the type, keep it
	if strings.HasPrefix(name, KubernetesConfigMapTypeURI) ||
		strings.HasPrefix(name, KubernetesSecretTypeURI) ||
		strings.HasPrefix(name, kubernetesGatewaySecretTypeURI) {
		return name
	}
	// Otherwise, to kubernetes://
	return KubernetesSecretTypeURI + name
}

// ParseResourceName parses a raw resourceName string.
func ParseResourceName(resourceName string, proxyNamespace string, proxyCluster cluster.ID, configCluster cluster.ID) (SecretResource, error) {
	sep := "/"
	if strings.HasPrefix(resourceName, KubernetesSecretTypeURI) {
		// Valid formats:
		// * kubernetes://secret-name
		// * kubernetes://secret-namespace/secret-name
		// If namespace is not set, we will fetch from the namespace of the proxy. The secret will be read from
		// the cluster the proxy resides in. This mirrors the legacy behavior mounting a secret as a file
		res := strings.TrimPrefix(resourceName, KubernetesSecretTypeURI)
		split := strings.Split(res, sep)
		namespace := proxyNamespace
		name := split[0]
		if len(split) > 1 {
			namespace = split[0]
			name = split[1]