spiegel_podman/pkg/api/server/register_secrets.go
Daniel J Walsh bf60bb0731
Display secret to user in inpspect
It is pretty complicated to display the secret on the host, but is
not really secured. This patch makes it easier to examine the secret.

Partial fix for https://github.com/containers/podman/issues/18667

Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
2023-06-28 13:14:49 -04:00

242 lines
7.2 KiB
Go

package server
import (
"net/http"
"github.com/containers/podman/v4/pkg/api/handlers/compat"
"github.com/containers/podman/v4/pkg/api/handlers/libpod"
"github.com/gorilla/mux"
)
func (s *APIServer) registerSecretHandlers(r *mux.Router) error {
// swagger:operation POST /libpod/secrets/create libpod SecretCreateLibpod
// ---
// tags:
// - secrets
// summary: Create a secret
// parameters:
// - in: query
// name: name
// type: string
// description: User-defined name of the secret.
// required: true
// - in: query
// name: driver
// type: string
// description: Secret driver
// default: "file"
// - in: query
// name: driveropts
// type: string
// description: Secret driver options
// - in: query
// name: labels
// type: string
// description: Labels on the secret
// - in: body
// name: request
// description: Secret
// schema:
// type: string
// produces:
// - application/json
// responses:
// '201':
// $ref: "#/responses/SecretCreateResponse"
// '500':
// "$ref": "#/responses/internalError"
r.Handle(VersionedPath("/libpod/secrets/create"), s.APIHandler(libpod.CreateSecret)).Methods(http.MethodPost)
// swagger:operation GET /libpod/secrets/json libpod SecretListLibpod
// ---
// tags:
// - secrets
// summary: List secrets
// description: Returns a list of secrets
// parameters:
// - in: query
// name: filters
// type: string
// description: |
// JSON encoded value of the filters (a `map[string][]string`) to process on the secrets list. Currently available filters:
// - `name=[name]` Matches secrets name (accepts regex).
// - `id=[id]` Matches for full or partial ID.
// produces:
// - application/json
// responses:
// '200':
// "$ref": "#/responses/SecretListResponse"
// '500':
// "$ref": "#/responses/internalError"
r.Handle(VersionedPath("/libpod/secrets/json"), s.APIHandler(compat.ListSecrets)).Methods(http.MethodGet)
// swagger:operation GET /libpod/secrets/{name}/json libpod SecretInspectLibpod
// ---
// tags:
// - secrets
// summary: Inspect secret
// parameters:
// - in: path
// name: name
// type: string
// required: true
// description: the name or ID of the secret
// - in: query
// name: showsecret
// type: boolean
// description: Display Secret
// default: false
// produces:
// - application/json
// responses:
// '200':
// "$ref": "#/responses/SecretInspectResponse"
// '404':
// "$ref": "#/responses/NoSuchSecret"
// '500':
// "$ref": "#/responses/internalError"
r.Handle(VersionedPath("/libpod/secrets/{name}/json"), s.APIHandler(compat.InspectSecret)).Methods(http.MethodGet)
// swagger:operation GET /libpod/secrets/{name}/exists libpod SecretExistsLibpod
// ---
// tags:
// - secrets
// summary: Secret exists
// parameters:
// - in: path
// name: name
// type: string
// required: true
// description: the name or ID of the secret
// produces:
// - application/json
// responses:
// 204:
// description: secret exists
// 404:
// $ref: '#/responses/NoSuchSecret'
// '500':
// "$ref": "#/responses/internalError"
r.Handle(VersionedPath("/libpod/secrets/{name}/exists"), s.APIHandler(libpod.SecretExists)).Methods(http.MethodGet)
// swagger:operation DELETE /libpod/secrets/{name} libpod SecretDeleteLibpod
// ---
// tags:
// - secrets
// summary: Remove secret
// parameters:
// - in: path
// name: name
// type: string
// required: true
// description: the name or ID of the secret
// - in: query
// name: all
// type: boolean
// description: Remove all secrets
// default: false
// produces:
// - application/json
// responses:
// '204':
// description: no error
// '404':
// "$ref": "#/responses/NoSuchSecret"
// '500':
// "$ref": "#/responses/internalError"
r.Handle(VersionedPath("/libpod/secrets/{name}"), s.APIHandler(compat.RemoveSecret)).Methods(http.MethodDelete)
/*
* Docker compatibility endpoints
*/
// swagger:operation GET /secrets compat SecretList
// ---
// tags:
// - secrets (compat)
// summary: List secrets
// description: Returns a list of secrets
// parameters:
// - in: query
// name: filters
// type: string
// description: |
// JSON encoded value of the filters (a `map[string][]string`) to process on the secrets list. Currently available filters:
// - `name=[name]` Matches secrets name (accepts regex).
// - `id=[id]` Matches for full or partial ID.
// produces:
// - application/json
// responses:
// '200':
// "$ref": "#/responses/SecretListCompatResponse"
// '500':
// "$ref": "#/responses/internalError"
r.Handle(VersionedPath("/secrets"), s.APIHandler(compat.ListSecrets)).Methods(http.MethodGet)
r.Handle("/secrets", s.APIHandler(compat.ListSecrets)).Methods(http.MethodGet)
// swagger:operation POST /secrets/create compat SecretCreate
// ---
// tags:
// - secrets (compat)
// summary: Create a secret
// parameters:
// - in: body
// name: create
// description: |
// attributes for creating a secret
// schema:
// $ref: "#/definitions/SecretCreate"
// produces:
// - application/json
// responses:
// '201':
// $ref: "#/responses/SecretCreateResponse"
// '409':
// "$ref": "#/responses/SecretInUse"
// '500':
// "$ref": "#/responses/internalError"
r.Handle(VersionedPath("/secrets/create"), s.APIHandler(compat.CreateSecret)).Methods(http.MethodPost)
r.Handle("/secrets/create", s.APIHandler(compat.CreateSecret)).Methods(http.MethodPost)
// swagger:operation GET /secrets/{name} compat SecretInspect
// ---
// tags:
// - secrets (compat)
// summary: Inspect secret
// parameters:
// - in: path
// name: name
// type: string
// required: true
// description: the name or ID of the secret
// produces:
// - application/json
// responses:
// '200':
// "$ref": "#/responses/SecretInspectCompatResponse"
// '404':
// "$ref": "#/responses/NoSuchSecret"
// '500':
// "$ref": "#/responses/internalError"
r.Handle(VersionedPath("/secrets/{name}"), s.APIHandler(compat.InspectSecret)).Methods(http.MethodGet)
r.Handle("/secrets/{name}", s.APIHandler(compat.InspectSecret)).Methods(http.MethodGet)
// swagger:operation DELETE /secrets/{name} compat SecretDelete
// ---
// tags:
// - secrets (compat)
// summary: Remove secret
// parameters:
// - in: path
// name: name
// type: string
// required: true
// description: the name or ID of the secret
// produces:
// - application/json
// responses:
// '204':
// description: no error
// '404':
// "$ref": "#/responses/NoSuchSecret"
// '500':
// "$ref": "#/responses/internalError"
r.Handle(VersionedPath("/secrets/{name}"), s.APIHandler(compat.RemoveSecret)).Methods(http.MethodDelete)
r.Handle("/secret/{name}", s.APIHandler(compat.RemoveSecret)).Methods(http.MethodDelete)
r.Handle(VersionedPath("/secrets/{name}/update"), s.APIHandler(compat.UpdateSecret)).Methods(http.MethodPost)
r.Handle("/secrets/{name}/update", s.APIHandler(compat.UpdateSecret)).Methods(http.MethodPost)
return nil
}