fix(clickhousegrant): escape role name

aiven · Jul 11, 2024 · 6ee0257 · 6ee0257
1 parent 956bcdf
commit 6ee0257
Show file tree

Hide file tree

Showing 7 changed files with 356 additions and 31 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -5,6 +5,7 @@
 - Ignore `http.StatusBadRequest` on `ClickhouseGrant` deletion
 - Retry conflict error when k8s object saved to the storage
 - Fix `ClickhouseGrant` invalid remote and local privileges comparison
+- Fix `ClickhouseGrant`: doesn't escape role name to grant
 
 ## v0.22.0 - 2024-07-02
 

diff --git a/api/v1alpha1/clickhousegrant_types.go b/api/v1alpha1/clickhousegrant_types.go
@@ -237,7 +237,7 @@ func constructPrivilegesPart(g PrivilegeGrant) string {
 }
 
 func (g RoleGrant) ConstructParts(t chUtils.StatementType) (string, string, string) {
-	rolesPart := strings.Join(g.Roles, ", ")
+	rolesPart := strings.Join(escapeList(g.Roles), ", ")
 	granteesPart := constructGranteePart(g.Grantees)
 	options := ""
 	if g.WithAdminOption && t == chUtils.GRANT {
@@ -315,3 +315,11 @@ func escape(identifier string) string {
 	replacer := strings.NewReplacer("`", "\\`", "\\", "\\\\")
 	return "`" + replacer.Replace(identifier) + "`"
 }
+
+func escapeList(list []string) []string {
+	result := make([]string, len(list))
+	for i, v := range list {
+		result[i] = escape(v)
+	}
+	return result
+}
diff --git a/clickhouserole.yaml b/clickhouserole.yaml
@@ -0,0 +1,63 @@
+apiVersion: aiven.io/v1alpha1
+kind: ClickhouseGrant
+metadata:
+  name: test-grant
+spec:
+  authSecretRef:
+    name: aiven-token
+    key: token
+
+  project: aiven-ci-kubernetes-operator
+  serviceName: clickhouse-227c6ab5
+
+  privilegeGrants:
+    - database: clickhouse-db
+      grantees:
+        - role: writer
+      privileges:
+        - INSERT
+        - SELECT
+        - CREATE TABLE
+        - CREATE VIEW
+  roleGrants:
+    - grantees:
+        - user: clickhouse-user
+      roles:
+        - writer
+---
+apiVersion: aiven.io/v1alpha1
+kind: ClickhouseDatabase
+metadata:
+  name: clickhouse-db
+spec:
+  authSecretRef:
+    name: aiven-token
+    key: token
+
+  project: aiven-ci-kubernetes-operator
+  serviceName: clickhouse-227c6ab5
+---
+apiVersion: aiven.io/v1alpha1
+kind: ClickhouseUser
+metadata:
+  name: clickhouse-user
+spec:
+  authSecretRef:
+    name: aiven-token
+    key: token
+
+  project: aiven-ci-kubernetes-operator
+  serviceName: clickhouse-227c6ab5
+---
+apiVersion: aiven.io/v1alpha1
+kind: ClickhouseRole
+metadata:
+  name: writer
+spec:
+  authSecretRef:
+    name: aiven-token
+    key: token
+
+  project: aiven-ci-kubernetes-operator
+  serviceName: clickhouse-227c6ab5
+  role: writer
diff --git a/docs/docs/api-reference/clickhousegrant.md b/docs/docs/api-reference/clickhousegrant.md
@@ -2,9 +2,9 @@
 title: "ClickhouseGrant"
 ---
 
-## Usage example
+## Usage examples
 
-??? example 
+??? example "example_2"
     ```yaml
     apiVersion: aiven.io/v1alpha1
     kind: ClickhouseGrant
@@ -46,6 +46,94 @@ title: "ClickhouseGrant"
             - role: my-role
     ```
 
+??? example 
+    ```yaml
+    apiVersion: aiven.io/v1alpha1
+    kind: ClickhouseGrant
+    metadata:
+      name: my-clickhouse-grant
+    spec:
+      authSecretRef:
+        name: aiven-token
+        key: token
+
+      project: aiven-project-name
+      serviceName: my-clickhouse-service
+
+      privilegeGrants:
+        - grantees:
+            - role: my-clickhouse-role
+          privileges:
+            - INSERT
+            - SELECT
+            - CREATE TABLE
+            - CREATE VIEW
+          database: my-clickhouse-db
+      roleGrants:
+        - grantees:
+            - user: my-clickhouse-user
+          roles:
+            - my-clickhouse-role
+
+    ---
+
+    apiVersion: aiven.io/v1alpha1
+    kind: Clickhouse
+    metadata:
+      name: my-clickhouse-service
+    spec:
+      authSecretRef:
+        name: aiven-token
+        key: token
+
+      project: aiven-project-name
+      cloudName: google-europe-west1
+      plan: startup-16
+
+    ---
+
+    apiVersion: aiven.io/v1alpha1
+    kind: ClickhouseDatabase
+    metadata:
+      name: my-clickhouse-db
+    spec:
+      authSecretRef:
+        name: aiven-token
+        key: token
+
+      project: aiven-project-name
+      serviceName: my-clickhouse-service
+
+    ---
+
+    apiVersion: aiven.io/v1alpha1
+    kind: ClickhouseUser
+    metadata:
+      name: my-clickhouse-user
+    spec:
+      authSecretRef:
+        name: aiven-token
+        key: token
+
+      project: aiven-project-name
+      serviceName: my-clickhouse-service
+
+    ---
+
+    apiVersion: aiven.io/v1alpha1
+    kind: ClickhouseRole
+    metadata:
+      name: my-clickhouse-role
+    spec:
+      authSecretRef:
+        name: aiven-token
+        key: token
+
+      project: aiven-project-name
+      serviceName: my-clickhouse-service
+      role: my-clickhouse-role
+    ```
+
 !!! info
 	To create this resource, a `Secret` containing Aiven token must be [created](/aiven-operator/authentication.html) first.
 

diff --git a/docs/docs/api-reference/examples/clickhousegrant.example_2.yaml b/docs/docs/api-reference/examples/clickhousegrant.example_2.yaml
@@ -0,0 +1,40 @@
+
+apiVersion: aiven.io/v1alpha1
+kind: ClickhouseGrant
+metadata:
+  name: demo-ch-grant
+spec:
+  authSecretRef:
+    name: aiven-token
+    key: token
+
+  project: my-aiven-project
+  serviceName: my-clickhouse
+
+  privilegeGrants:
+    - grantees:
+        - user: user1
+        - user: my-clickhouse-user-🦄
+      privileges:
+        - SELECT
+        - INSERT
+      database: my-db
+      # If table is omitted, the privileges are granted on all tables in the database
+      # If columns is omitted, the privileges are granted on all columns in the table
+    - grantees:
+        - role: my-role
+      privileges:
+        - SELECT
+      database: my-db
+      table: my-table
+      columns:
+        - col1
+        - col2
+
+  roleGrants:
+    - roles:
+        - other-role
+      grantees:
+        - user: my-user
+        - role: my-role
+
diff --git a/docs/docs/api-reference/examples/clickhousegrant.yaml b/docs/docs/api-reference/examples/clickhousegrant.yaml
@@ -1,40 +1,84 @@
-
 apiVersion: aiven.io/v1alpha1
 kind: ClickhouseGrant
 metadata:
-  name: demo-ch-grant
+  name: my-clickhouse-grant
 spec:
   authSecretRef:
     name: aiven-token
     key: token
 
-  project: my-aiven-project
-  serviceName: my-clickhouse
+  project: aiven-project-name
+  serviceName: my-clickhouse-service
 
   privilegeGrants:
     - grantees:
-        - user: user1
-        - user: my-clickhouse-user-🦄
+        - role: my-clickhouse-role
       privileges:
-        - SELECT
         - INSERT
-      database: my-db
-      # If table is omitted, the privileges are granted on all tables in the database
-      # If columns is omitted, the privileges are granted on all columns in the table
-    - grantees:
-        - role: my-role
-      privileges:
         - SELECT
-      database: my-db
-      table: my-table
-      columns:
-        - col1
-        - col2
-
+        - CREATE TABLE
+        - CREATE VIEW
+      database: my-clickhouse-db
   roleGrants:
-    - roles:
-        - other-role
-      grantees:
-        - user: my-user
-        - role: my-role
+    - grantees:
+        - user: my-clickhouse-user
+      roles:
+        - my-clickhouse-role
+
+---
+
+apiVersion: aiven.io/v1alpha1
+kind: Clickhouse
+metadata:
+  name: my-clickhouse-service
+spec:
+  authSecretRef:
+    name: aiven-token
+    key: token
+
+  project: aiven-project-name
+  cloudName: google-europe-west1
+  plan: startup-16
+
+---
+
+apiVersion: aiven.io/v1alpha1
+kind: ClickhouseDatabase
+metadata:
+  name: my-clickhouse-db
+spec:
+  authSecretRef:
+    name: aiven-token
+    key: token
+
+  project: aiven-project-name
+  serviceName: my-clickhouse-service
+
+---
+
+apiVersion: aiven.io/v1alpha1
+kind: ClickhouseUser
+metadata:
+  name: my-clickhouse-user
+spec:
+  authSecretRef:
+    name: aiven-token
+    key: token
+
+  project: aiven-project-name
+  serviceName: my-clickhouse-service
+
+---
+
+apiVersion: aiven.io/v1alpha1
+kind: ClickhouseRole
+metadata:
+  name: my-clickhouse-role
+spec:
+  authSecretRef:
+    name: aiven-token
+    key: token
 
+  project: aiven-project-name
+  serviceName: my-clickhouse-service
+  role: my-clickhouse-role