chore: validate tls-name and auth-config-file in xdr config [KO-606]

Author: strivedi-spike

pkg/utils/utils.go

@@ -13,6 +13,7 @@ import (
 	ls "k8s.io/apimachinery/pkg/labels"
 	"k8s.io/apimachinery/pkg/selection"
 	"k8s.io/apimachinery/pkg/types"
+	"k8s.io/apimachinery/pkg/util/sets"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 
 	asdbv1 "github.com/aerospike/aerospike-kubernetes-operator/v4/api/v1"
@@ -296,6 +297,27 @@ func GetRackIdentifier(rackID int, rackRevision string) string {
 	return rackIDStr
 }
 
+// GetNetworkTLSNames returns the set of TLS configuration names defined in network.tls,
+// used to check that xdr.dcs[].tls-name references an existing entry.
+func GetNetworkTLSNames(networkConf map[string]interface{}) sets.Set[string] {
+	tlsNames := sets.Set[string]{}
+
+	tlsConfList, ok := networkConf["tls"].([]interface{})
+	if !ok {
+		return tlsNames
+	}
+
+	for _, tlsConfInt := range tlsConfList {
+		if tlsConf, ok := tlsConfInt.(map[string]interface{}); ok {
+			if tlsName, ok := tlsConf["name"].(string); ok {
+				tlsNames.Insert(tlsName)
+			}
+		}
+	}
+
+	return tlsNames
+}
+
 func IsOwnedBy(obj, parent client.Object) bool {
 	for _, o := range obj.GetOwnerReferences() {
 		if o.UID == parent.GetUID() {

pkg/validation/validate.go

@@ -10,6 +10,7 @@ import (
 	"k8s.io/apimachinery/pkg/util/sets"
 
 	asdbv1 "github.com/aerospike/aerospike-kubernetes-operator/v4/api/v1"
+	"github.com/aerospike/aerospike-kubernetes-operator/v4/pkg/utils"
 	"github.com/aerospike/aerospike-management-lib/asconfig"
 )
 
@@ -58,6 +59,10 @@ func ValidateAerospikeConfig(
 		return err
 	}
 
+	if err := validateXDRConfig(config); err != nil {
+		return err
+	}
+
 	// namespace conf
 	nsListInterface, ok := config[asdbv1.ConfKeyNamespace]
 	if !ok {
@@ -167,6 +172,62 @@ func validateNetworkConfig(networkConf map[string]interface{}) error {
 	return nil
 }
 
+// validateXDRConfig validates the xdr section of aerospikeConfig.
+func validateXDRConfig(config map[string]interface{}) error {
+	xdrConfInterface, exists := config[asdbv1.ConfKeyXdr]
+	if !exists || xdrConfInterface == nil {
+		return nil
+	}
+
+	xdrConf, ok := xdrConfInterface.(map[string]interface{})
+	if !ok {
+		return fmt.Errorf("aerospikeConfig.xdr not a valid map %v", xdrConfInterface)
+	}
+
+	networkConf, _ := config["network"].(map[string]interface{})
+	tlsNames := utils.GetNetworkTLSNames(networkConf)
+
+	dcListInterface, exists := xdrConf["dcs"]
+	if !exists {
+		return nil
+	}
+
+	dcList, ok := dcListInterface.([]interface{})
+	if !ok {
+		return fmt.Errorf("aerospikeConfig.xdr.dcs not a valid list %v", dcListInterface)
+	}
+
+	for _, dcConfInterface := range dcList {
+		dcConf, ok := dcConfInterface.(map[string]interface{})
+		if !ok {
+			return fmt.Errorf("aerospikeConfig.xdr.dcs entry not a valid map %v", dcConfInterface)
+		}
+
+		dcName := dcConf[asdbv1.ConfKeyName]
+
+		if tlsName, tlsNameExists := dcConf[asdbv1.ConfKeyTLSName]; tlsNameExists {
+			if !tlsNames.Has(tlsName.(string)) {
+				return fmt.Errorf(
+					"xdr.dcs[%v].tls-name '%s' must refer the TLS configuration defined in network.tls",
+					dcName, tlsName,
+				)
+			}
+		}
+
+		isConnectorDC, _ := dcConf["connector"].(bool)
+		authPasswordFile, _ := dcConf["auth-password-file"].(string)
+
+		if isConnectorDC && authPasswordFile != "" {
+			return fmt.Errorf(
+				"xdr.dcs[%v]: auth-password-file is not allowed for 'connector' datacenters",
+				dcName,
+			)
+		}
+	}
+
+	return nil
+}
+
 // ValidateTLSAuthenticateClient validate the tls-authenticate-client field in the service configuration.
 func ValidateTLSAuthenticateClient(serviceConf map[string]interface{}) (
 	[]string, error,

pkg/validation/validate_test.go

@@ -0,0 +1,115 @@
+package validation
+
+import "testing"
+
+// networkConfWithTLS returns a network config declaring a single TLS
+// configuration named "dc1-tls", used as the xdr.dcs tls-name reference target.
+func networkConfWithTLS() map[string]any {
+	return map[string]any{
+		"tls": []any{
+			map[string]any{"name": "dc1-tls"},
+		},
+	}
+}
+
+func TestValidateXdrConfig(t *testing.T) {
+	tests := []struct {
+		config  map[string]any
+		name    string
+		wantErr bool
+	}{
+		{
+			name:    "no xdr section",
+			config:  map[string]any{},
+			wantErr: false,
+		},
+		{
+			name: "tls-name references a configured network.tls entry",
+			config: map[string]any{
+				"network": networkConfWithTLS(),
+				"xdr": map[string]any{
+					"dcs": []any{
+						map[string]any{
+							"name":     "dc1",
+							"tls-name": "dc1-tls",
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "tls-name does not reference a configured network.tls entry",
+			config: map[string]any{
+				"network": networkConfWithTLS(),
+				"xdr": map[string]any{
+					"dcs": []any{
+						map[string]any{
+							"name":     "dc1",
+							"tls-name": "unknown-tls",
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "connector true with auth-password-file set",
+			config: map[string]any{
+				"network": networkConfWithTLS(),
+				"xdr": map[string]any{
+					"dcs": []any{
+						//nolint:gosec // G101 test config path, not real credentials
+						map[string]any{
+							"name":               "dc1",
+							"connector":          true,
+							"auth-password-file": "/etc/aerospike/secret/password.txt",
+						},
+					},
+				},
+			},
+			wantErr: true,
+		},
+		{
+			name: "connector true without auth-password-file",
+			config: map[string]any{
+				"network": networkConfWithTLS(),
+				"xdr": map[string]any{
+					"dcs": []any{
+						map[string]any{
+							"name":      "dc1",
+							"connector": true,
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
+		{
+			name: "connector false (default) with auth-password-file set",
+			config: map[string]any{
+				"network": networkConfWithTLS(),
+				"xdr": map[string]any{
+					"dcs": []any{
+						//nolint:gosec // G101 test config path, not real credentials
+						map[string]any{
+							"name":               "dc1",
+							"auth-user":          "admin",
+							"auth-password-file": "/etc/aerospike/secret/password.txt",
+						},
+					},
+				},
+			},
+			wantErr: false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := validateXDRConfig(tt.config)
+			if (err != nil) != tt.wantErr {
+				t.Errorf("validateXdrConfig() error = %v, wantErr %v", err, tt.wantErr)
+			}
+		})
+	}
+}