* Fixes upstream deprecations for containerd
* Fixes deprecations in ioutil package usage
* Break out separate files for function handlers
* Upgrades containerd to 1.7.22
* Fixes default namespace functionality
* Pre-deploy checks as per license agreement
* Removes extra log messages for payload in HTTP handlers, you
can enable FAAS_DEBUG=1 in the CLI instead to see this from
the client's perspective
* Add additional Google DNS server 8.8.4.4 for functions
Signed-off-by: Alex Ellis (OpenFaaS Ltd) <alexellis2@gmail.com>
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Test case included for default and non-default
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Changed Fake Labeller Implementation
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Load the secret value from the RawValue field, if it is empty, use the
string value. Add unit tests for the creation handler.
Refactor secret parser tests.
Resolves#208
Signed-off-by: Lucas Roesler <roesler.lucas@gmail.com>
* Inlines the namespace check for valid faasd namespaces
* Creates a const for the namespace label applied to faasd
namespaces
Tested with go build and go test.
Signed-off-by: Alex Ellis (OpenFaaS Ltd) <alexellis2@gmail.com>
This commit adds the checks that the namespace supplied by the user has
the `openfaas=true` label. Without this check the user can
deploy/update/read functions in any namespace using the CLI.
The UI is not effected because it calls the listnamesaces endpoint,
which has the check for the label
Signed-off-by: Alistair Hey <alistair@heyal.co.uk>
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Included Test cases for utils
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Multi namespace handling in invoke
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
List Namespaces capability included
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
remove faasd namespace from list result
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Create Secret Folder Path
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Filter only namespaces with openfass label
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Include Testcase for utility function
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
move default function secets to openfaas-fn namespace secrets
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
Corrected issue with secret moving
Signed-off-by: Nitishkumar Singh <nitishkumarsingh71@gmail.com>
This patch fixes a vulnerability in the secrets API, however
it is important to stress that the user must be authenticated
as the admin user on the REST API before they can attempt this.
Reported by Appsecco via email. @lucasroesler, Appsecco and
myself believe this to be of low severity.
The fix prevents directory traversal characters from being
used in secret names. If a secret name such as:
../../root/.ssh/authorized_keys were to be used, an attacker
could remove the value and write their own.
Tested with unit tests and tests are now made to run
via the CI and a new Makefile target.
Signed-off-by: Alex Ellis (OpenFaaS Ltd) <alexellis2@gmail.com>
Adds secrets support and binding of secrets at runtime to
functions. Files are written in plain-text to a 0644 permission
folder which can only be read by root and the containers
requesting the secret through the OpenFaaS API.
Tested by deploying an alpine function using "cat" as its
fprocess.
Happy to revisit at a later date and look into encryption at
rest. This should be on-par with using Kubernetes in its
default unencrypted state.
Fixes: #29
Signed-off-by: Alex Ellis (OpenFaaS Ltd) <alexellis2@gmail.com>
