Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(scaler): Add TLS support for Artemis scaler #6473

Conversation

chiragbhatia8
Copy link

Description

This PR introduces TLS support for the Artemis scaler, allowing secure communication with Artemis brokers.

Checklist

  • When introducing a new scaler, I agree with the scaling governance policy
  • I have verified that my change is according to the deprecations & breaking changes policy
  • Tests have been added
  • Commits are signed with Developer Certificate of Origin (DCO - learn more)
  • Changelog has not been updated and is aligned with our changelog requirements
  • A PR is opened to update our Helm chart (repo) (if applicable, ie. when deployment manifests are modified)
  • A PR is opened to update the documentation on (repo) (if applicable)

Related Issues and PRs

Fixes #6448


Notes

This PR includes:

  • TLS configuration support (CA, Cert, Key) for Artemis scaler.
  • Updated unit tests and metadata validation.

Testing TLS functionality directly in an e2e environment might require additional configuration.

@chiragbhatia8 chiragbhatia8 requested a review from a team as a code owner January 9, 2025 16:05
chiragbhatia8 and others added 29 commits January 9, 2025 22:22
* remove deprecated trigger name in Pulsar scaler

Signed-off-by: Kun Woo Yoo <[email protected]>

* Update CHANGELOG.md

Signed-off-by: Jorge Turrado Ferrero <[email protected]>
Signed-off-by: Kun Woo Yoo <[email protected]>

* remove deprecated Pulsar trigger name from test

Signed-off-by: Kun Woo Yoo <[email protected]>

---------

Signed-off-by: Kun Woo Yoo <[email protected]>
Signed-off-by: Jorge Turrado Ferrero <[email protected]>
Co-authored-by: Jorge Turrado Ferrero <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
…ntication/ClusterTriggerAuthentication resources (kedacore#6131)

Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: dttung2905 <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: cuishuang <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: Rick Brouwer <[email protected]>
Signed-off-by: rickbrouwer <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: SpiritZhou <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: Jorge Turrado <[email protected]>
Signed-off-by: Jorge Turrado Ferrero <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
…6196)

Signed-off-by: Jorge Turrado <[email protected]>
Co-authored-by: Jorge Turrado <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
| datasource  | package       | from   | to     |
| ----------- | ------------- | ------ | ------ |
| github-tags | actions/cache | v4.0.2 | v4.1.0 |

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Chirag Bhatia <[email protected]>
…core#6215)

* Fix grafana dashboard to handle wildcard scaledObject variables

Signed-off-by: Alex Kuretz <[email protected]>

* Update changelog

Signed-off-by: Alex Kuretz <[email protected]>

* Fix changelog order to be alphabetical

Signed-off-by: Alex Kuretz <[email protected]>

---------

Signed-off-by: Alex Kuretz <[email protected]>
Co-authored-by: Jorge Turrado Ferrero <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
* Add Username and Password for Selenium Grid Basic Auth

Signed-off-by: Vei0vis <[email protected]>

* Update CHANGELOG.md

Signed-off-by: Vei0vis <[email protected]>

---------

Signed-off-by: Vei0vis <[email protected]>
Co-authored-by: Vei0vis <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
* feat: Replace all the runners with CNCF runners

Signed-off-by: Jorge Turrado <[email protected]>

* use ubunto for static checks

Signed-off-by: Jorge Turrado <[email protected]>

---------

Signed-off-by: Jorge Turrado <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: Jorge Turrado <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
…ore#6186)

Signed-off-by: Jan Wozniak <[email protected]>
Co-authored-by: Zbynek Roubalik <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: Jorge Turrado Ferrero <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
…d scaler (kedacore#6055)

* add sessionsPerNode and setSessionsFromHub parameters to selenium-grid scaler, add tests and changelog

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* fix tests

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* fix json

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* fix json

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* fix tests

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* fix metadata tests

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* fix syntax

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* link Issue to Changelog

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* fix link to issue

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* add sessionBrowserVersion and tests

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* add metadata tests

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* Update CHANGELOG.md

Co-authored-by: Jorge Turrado Ferrero <[email protected]>
Signed-off-by: Robert Hanzlík <[email protected]>
Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

* make cyclomatic complexity smaller

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>

---------

Signed-off-by: Hanzlik, Robert (MONETA) <[email protected]>
Signed-off-by: Robert Hanzlík <[email protected]>
Signed-off-by: Jorge Turrado Ferrero <[email protected]>
Co-authored-by: Jorge Turrado Ferrero <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
* Refactor cpu memory scaler

Signed-off-by: rickbrouwer <[email protected]>

* Fix

Signed-off-by: rickbrouwer <[email protected]>

---------

Signed-off-by: rickbrouwer <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
HeavyWombat and others added 24 commits January 9, 2025 22:22
Signed-off-by: rickbrouwer <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
| datasource  | package          | from   | to     |
| ----------- | ---------------- | ------ | ------ |
| github-tags | actions/checkout | v4.1.1 | v4.2.2 |

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Chirag Bhatia <[email protected]>
| datasource  | package                 | from | to |
| ----------- | ----------------------- | ---- | -- |
| github-tags | actions/upload-artifact | v3   | v4 |

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Chirag Bhatia <[email protected]>
* Introduce aws region into the AWS config cache

Signed-off-by: Maksymilian Boguń <[email protected]>

* add CHANGELOG entry

Signed-off-by: Maksymilian Boguń <[email protected]>

* embedded AWS region into Authorization metadata

Signed-off-by: Maksymilian Boguń <[email protected]>

* move the fix to Unreleased version

Signed-off-by: Maksymilian Boguń <[email protected]>

* Fix indentation

Signed-off-by: Maksymilian Boguń <[email protected]>

---------

Signed-off-by: Maksymilian Boguń <[email protected]>
Signed-off-by: Jan Wozniak <[email protected]>
Co-authored-by: Jorge Turrado Ferrero <[email protected]>
Co-authored-by: Jan Wozniak <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
…ore#6372)

Signed-off-by: Eng Zer Jun <[email protected]>
Signed-off-by: Jan Wozniak <[email protected]>
Co-authored-by: Jan Wozniak <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: Omer Aplatony <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
| datasource  | package       | from   | to     |
| ----------- | ------------- | ------ | ------ |
| github-tags | actions/cache | v4.1.2 | v4.2.0 |

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Chirag Bhatia <[email protected]>
* fix: Use pinned version for all the pending tasks

Signed-off-by: Jorge Turrado <[email protected]>

* update tokens

Signed-off-by: Jorge Turrado <[email protected]>

---------

Signed-off-by: Jorge Turrado <[email protected]>
Signed-off-by: Jorge Turrado <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
* add: enable webhook patching with flag

Signed-off-by: krishna sindhur <[email protected]>

* update: should enable/disable only the webhook

Signed-off-by: krishna sindhur <[email protected]>

* changelog: put webhook patching flag to 'New' section

Signed-off-by: Jan Wozniak <[email protected]>

---------

Signed-off-by: krishna sindhur <[email protected]>
Signed-off-by: Jan Wozniak <[email protected]>
Co-authored-by: krishna sindhur <[email protected]>
Co-authored-by: Jan Wozniak <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: Zbynek Roubalik <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: StepSecurity Bot <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: Jorge Turrado <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
…re#6431)

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Signed-off-by: Chirag Bhatia <[email protected]>
* Bump go and deps

Signed-off-by: Jorge Turrado <[email protected]>

* bump golang.org/x/net

Signed-off-by: Jorge Turrado <[email protected]>

* Add missing permissions to code-scaners

Signed-off-by: Jorge Turrado <[email protected]>

* update release tracker

Signed-off-by: Jorge Turrado <[email protected]>

* fix aws scaler

Signed-off-by: Jorge Turrado <[email protected]>

* Pass theregion

Signed-off-by: Jorge Turrado <[email protected]>

* Pass theregion

Signed-off-by: Jorge Turrado <[email protected]>

* fix aws tests

Signed-off-by: Jorge Turrado <[email protected]>

* fix aws tests

Signed-off-by: Jorge Turrado <[email protected]>

* Update AWS admission probes

Signed-off-by: Jorge Turrado <[email protected]>

---------

Signed-off-by: Jorge Turrado <[email protected]>
Signed-off-by: Jorge Turrado <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
…acore#6437)

* fix: Selenium Grid scaler avoids overlapping when multiple browserVersion triggers are active

Signed-off-by: Viet Nguyen Duc <[email protected]>

* Update CHANGELOG

Signed-off-by: Viet Nguyen Duc <[email protected]>

* Fix e2e template test

Signed-off-by: Viet Nguyen Duc <[email protected]>

* Change imagePullPolicy to Always to take latest change

Signed-off-by: Viet Nguyen Duc <[email protected]>

* Update platformName default value as empty

Signed-off-by: Viet Nguyen Duc <[email protected]>

---------

Signed-off-by: Viet Nguyen Duc <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
* chore: Prepare v2.16.1

Signed-off-by: Jorge Turrado <[email protected]>

* add missing change

Signed-off-by: Jorge Turrado <[email protected]>

---------

Signed-off-by: Jorge Turrado <[email protected]>
Signed-off-by: Jorge Turrado <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
Signed-off-by: Omer Aplatony <[email protected]>
Signed-off-by: Chirag Bhatia <[email protected]>
* Correct namesapce

Signed-off-by: rickbrouwer <[email protected]>

* Remove period

Signed-off-by: rickbrouwer <[email protected]>

* At space

Signed-off-by: rickbrouwer <[email protected]>

* Remove forgotten test

Signed-off-by: rickbrouwer <[email protected]>

* Remove unnecessary optional when default

Signed-off-by: Rick Brouwer <[email protected]>

* Fix scorecard badge

Signed-off-by: rickbrouwer <[email protected]>

* Fix

Signed-off-by: Rick Brouwer <[email protected]>

* Delete space

Signed-off-by: Rick Brouwer <[email protected]>

---------

Signed-off-by: rickbrouwer <[email protected]>
Signed-off-by: Rick Brouwer <[email protected]>
@chiragbhatia8 chiragbhatia8 force-pushed the feature/6448-artemis-tls-support branch from 41fe2a5 to 96bba3f Compare January 9, 2025 16:53
password = fmt.Sprintf("%s-password", testName)
vhost = "/"
NoAuthConnectionString = fmt.Sprintf("http://rabbitmq.%s.svc.cluster.local", rmqNamespace)
connectionString = fmt.Sprintf("amqp://%s:%s@rabbitmq.%s.svc.cluster.local", user, password, rmqNamespace)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep found a possible database connection string built with string concatenation. Check for proper encoding/escaping of components to prevent parse errors and injection vulnerabilities.

Ignore this finding from db-connection-string.

@@ -186,7 +195,7 @@ func apiStubHandler(hasRateLeft bool, exceeds30Repos bool) *httptest.Server {
w.WriteHeader(http.StatusForbidden)
}
if strings.HasSuffix(r.URL.String(), "jobs") {
_, _ = w.Write([]byte(testGhWFJobResponse))
_, _ = w.Write([]byte(jobResponse))
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.

Ignore this finding from no-direct-write-to-responsewriter.

password = fmt.Sprintf("%s-password", testName)
vhost = "/"
NoAuthConnectionString = fmt.Sprintf("amqp://rabbitmq.%s.svc.cluster.local", rmqNamespace)
connectionString = fmt.Sprintf("amqp://%s:%s@rabbitmq.%s.svc.cluster.local", user, password, rmqNamespace)
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Semgrep found a possible database connection string built with string concatenation. Check for proper encoding/escaping of components to prevent parse errors and injection vulnerabilities.

Ignore this finding from db-connection-string.

Copy link

semgrep-app bot commented Jan 9, 2025

Semgrep found 1 no-direct-write-to-responsewriter finding:

  • pkg/scalers/azure_pipelines_scaler_test.go

Detected directly writing or similar in 'http.ResponseWriter.write()'. This bypasses HTML escaping that prevents cross-site scripting vulnerabilities. Instead, use the 'html/template' package and render data using 'template.Execute()'.

Ignore this finding from no-direct-write-to-responsewriter.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Add TLS support to artemis scaler