Merge pull request #2814 from alexcreasy/RHOAIENG-6641-b

[RHOAIENG-6641] Backport 2.9 SSRF fixes to 2.8.x
opendatahub-io · May 15, 2024 · 3bf5da1 · 3bf5da1
2 parents b2de1f6 + 4cae878
commit 3bf5da1
Show file tree

Hide file tree

Showing 26 changed files with 546 additions and 423 deletions.
diff --git a/backend/package-lock.json b/backend/package-lock.json
diff --git a/backend/package.json b/backend/package.json
@@ -39,6 +39,7 @@
   "dependencies": {
     "@fastify/accepts": "^4.3.0",
     "@fastify/autoload": "^5.7.1",
+    "@fastify/http-proxy": "^9.4.0",
     "@fastify/sensible": "^5.2.0",
     "@fastify/static": "^6.10.2",
     "@fastify/websocket": "^8.2.0",

diff --git a/backend/src/routes/api/k8s/pass-through.ts b/backend/src/routes/api/k8s/pass-through.ts
@@ -9,7 +9,7 @@ import { proxyCall, ProxyError, ProxyErrorType } from '../../../utils/httpUtils'
 
 export type PassThroughData = {
   method: string;
-  requestData: string;
+  requestData?: string;
   url: string;
 };
 

diff --git a/backend/src/routes/api/proxy/index.ts b/backend/src/routes/api/proxy/index.ts
diff --git a/backend/src/routes/api/service/pipelines/index.ts b/backend/src/routes/api/service/pipelines/index.ts
@@ -0,0 +1,23 @@
+import { DSPipelineKind } from '../../../../types';
+import { proxyService } from '../../../../utils/proxy';
+
+export default proxyService<DSPipelineKind>(
+  {
+    apiGroup: 'datasciencepipelinesapplications.opendatahub.io',
+    apiVersion: 'v1alpha1',
+    kind: 'DataSciencepipelinesApplication',
+    plural: 'datasciencepipelinesapplications',
+  },
+  {
+    port: 8443,
+    prefix: 'ds-pipeline-',
+  },
+  {
+    // Use port forwarding for local development:
+    // kubectl port-forward -n <namespace> svc/ds-pipeline-pipelines-definition 8443:8443
+    host: process.env.DS_PIPELINE_DSPA_SERVICE_HOST,
+    port: process.env.DS_PIPELINE_DSPA_SERVICE_PORT,
+  },
+  (resource) =>
+    !!resource.status?.conditions?.find((c) => c.type === 'APIServerReady' && c.status === 'True'),
+);
diff --git a/backend/src/routes/api/service/trustyai/index.ts b/backend/src/routes/api/service/trustyai/index.ts
@@ -0,0 +1,23 @@
+import { TrustyAIKind } from '../../../../types';
+import { proxyService } from '../../../../utils/proxy';
+
+export default proxyService<TrustyAIKind>(
+  {
+    apiGroup: 'trustyai.opendatahub.io',
+    apiVersion: 'v1alpha1',
+    kind: 'TrustyAIService',
+    plural: 'trustyaiservices',
+  },
+  {
+    port: 443,
+    suffix: '-tls',
+  },
+  {
+    // Use port forwarding for local development:
+    // kubectl port-forward -n <namespace> svc/trustyai-service-tls 9443:443
+    host: process.env.TRUSTYAI_TAIS_SERVICE_HOST,
+    port: process.env.TRUSTYAI_TAIS_SERVICE_PORT,
+  },
+  (resource) =>
+    !!resource.status?.conditions?.find((c) => c.type === 'Available' && c.status === 'True'),
+);
diff --git a/backend/src/types.ts b/backend/src/types.ts
@@ -270,7 +270,32 @@ export type KubeFastifyInstance = FastifyInstance & {
 
 // TODO: constant-ize the x-forwarded header
 export type OauthFastifyRequest<Data extends RouteGenericInterface = RouteGenericInterface> =
-  FastifyRequest<{ Headers: { 'x-forwarded-access-token': string } & Data['Headers'] } & Data>;
+  FastifyRequest<{ Headers?: { 'x-forwarded-access-token'?: string } & Data['Headers'] } & Data>;
+
+export type K8sCondition = {
+  type: string;
+  status: string;
+  reason?: string;
+  message?: string;
+  lastProbeTime?: string | null;
+  lastTransitionTime?: string;
+  lastHeartbeatTime?: string;
+};
+
+export type DSPipelineKind = K8sResourceCommon & {
+  spec: {
+    dspVersion: string;
+  };
+  status?: {
+    conditions?: K8sCondition[];
+  };
+};
+
+export type TrustyAIKind = K8sResourceCommon & {
+  status?: {
+    conditions?: K8sCondition[];
+  };
+};
 
 /*
  * Common types, should be kept up to date with frontend types