Implement Secrets

Implement podman secret create, inspect, ls, rm
Implement podman run/create --secret
Secrets are blobs of data that are sensitive.
Currently, the only secret driver supported is filedriver, which means creating a secret stores it in base64 unencrypted in a file.
After creating a secret, a user can use the --secret flag to expose the secret inside the container at /run/secrets/[secretname]
This secret will not be commited to an image on a podman commit

Signed-off-by: Ashley Cui <acui@redhat.com>

5 files changed, 344 insertions, 0 deletions

diff --git a/cmd/podman/secrets/create.go b/cmd/podman/secrets/create.go
new file mode 100644
index 000000000..e58ab57cd
--- /dev/null
+++ b/cmd/podman/secrets/create.go
@@ -0,0 +1,80 @@
+package secrets
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+
+	"github.com/containers/common/pkg/completion"
+	"github.com/containers/podman/v2/cmd/podman/common"
+	"github.com/containers/podman/v2/cmd/podman/registry"
+	"github.com/containers/podman/v2/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	createCmd = &cobra.Command{
+		Use:   "create [options] SECRET FILE|-",
+		Short: "Create a new secret",
+		Long:  "Create a secret. Input can be a path to a file or \"-\" (read from stdin). Default driver is file (unencrypted).",
+		RunE:  create,
+		Args:  cobra.ExactArgs(2),
+		Example: `podman secret create mysecret /path/to/secret
+		printf "secretdata" | podman secret create mysecret -`,
+		ValidArgsFunction: common.AutocompleteSecretCreate,
+	}
+)
+
+var (
+	createOpts = entities.SecretCreateOptions{}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: createCmd,
+		Parent:  secretCmd,
+	})
+
+	flags := createCmd.Flags()
+
+	driverFlagName := "driver"
+	flags.StringVar(&createOpts.Driver, driverFlagName, "file", "Specify secret driver")
+	_ = createCmd.RegisterFlagCompletionFunc(driverFlagName, completion.AutocompleteNone)
+}
+
+func create(cmd *cobra.Command, args []string) error {
+	name := args[0]
+
+	var err error
+	path := args[1]
+
+	var reader io.Reader
+	if path == "-" || path == "/dev/stdin" {
+		stat, err := os.Stdin.Stat()
+		if err != nil {
+			return err
+		}
+		if (stat.Mode() & os.ModeNamedPipe) == 0 {
+			return errors.New("if `-` is used, data must be passed into stdin")
+
+		}
+		reader = os.Stdin
+	} else {
+		file, err := os.Open(path)
+		if err != nil {
+			return err
+		}
+		defer file.Close()
+		reader = file
+	}
+
+	report, err := registry.ContainerEngine().SecretCreate(context.Background(), name, reader, createOpts)
+	if err != nil {
+		return err
+	}
+	fmt.Println(report.ID)
+	return nil
+}
diff --git a/cmd/podman/secrets/inspect.go b/cmd/podman/secrets/inspect.go
new file mode 100644
index 000000000..f38ba7f65
--- /dev/null
+++ b/cmd/podman/secrets/inspect.go
@@ -0,0 +1,82 @@
+package secrets
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"html/template"
+	"os"
+	"text/tabwriter"
+
+	"github.com/containers/common/pkg/report"
+	"github.com/containers/podman/v2/cmd/podman/common"
+	"github.com/containers/podman/v2/cmd/podman/parse"
+	"github.com/containers/podman/v2/cmd/podman/registry"
+	"github.com/containers/podman/v2/pkg/domain/entities"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+var (
+	inspectCmd = &cobra.Command{
+		Use:               "inspect [options] SECRET [SECRET...]",
+		Short:             "Inspect a secret",
+		Long:              "Display detail information on one or more secrets",
+		RunE:              inspect,
+		Example:           "podman secret inspect MYSECRET",
+		Args:              cobra.MinimumNArgs(1),
+		ValidArgsFunction: common.AutocompleteSecrets,
+	}
+)
+
+var format string
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: inspectCmd,
+		Parent:  secretCmd,
+	})
+	flags := inspectCmd.Flags()
+	formatFlagName := "format"
+	flags.StringVar(&format, formatFlagName, "", "Format volume output using Go template")
+	_ = inspectCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat)
+}
+
+func inspect(cmd *cobra.Command, args []string) error {
+	inspected, errs, _ := registry.ContainerEngine().SecretInspect(context.Background(), args)
+
+	// always print valid list
+	if len(inspected) == 0 {
+		inspected = []*entities.SecretInfoReport{}
+	}
+
+	if cmd.Flags().Changed("format") {
+		row := report.NormalizeFormat(format)
+		formatted := parse.EnforceRange(row)
+
+		tmpl, err := template.New("inspect secret").Parse(formatted)
+		if err != nil {
+			return err
+		}
+		w := tabwriter.NewWriter(os.Stdout, 12, 2, 2, ' ', 0)
+		defer w.Flush()
+		tmpl.Execute(w, inspected)
+	} else {
+		buf, err := json.MarshalIndent(inspected, "", "    ")
+		if err != nil {
+			return err
+		}
+		fmt.Println(string(buf))
+	}
+
+	if len(errs) > 0 {
+		if len(errs) > 1 {
+			for _, err := range errs[1:] {
+				fmt.Fprintf(os.Stderr, "error inspecting secret: %v\n", err)
+			}
+		}
+		return errors.Errorf("error inspecting secret: %v", errs[0])
+	}
+	return nil
+}
diff --git a/cmd/podman/secrets/list.go b/cmd/podman/secrets/list.go
new file mode 100644
index 000000000..dff4bfdca
--- /dev/null
+++ b/cmd/podman/secrets/list.go
@@ -0,0 +1,99 @@
+package secrets
+
+import (
+	"context"
+	"html/template"
+	"os"
+	"text/tabwriter"
+	"time"
+
+	"github.com/containers/common/pkg/completion"
+	"github.com/containers/common/pkg/report"
+	"github.com/containers/podman/v2/cmd/podman/common"
+	"github.com/containers/podman/v2/cmd/podman/parse"
+	"github.com/containers/podman/v2/cmd/podman/registry"
+	"github.com/containers/podman/v2/cmd/podman/validate"
+	"github.com/containers/podman/v2/pkg/domain/entities"
+	"github.com/docker/go-units"
+	"github.com/pkg/errors"
+	"github.com/spf13/cobra"
+)
+
+var (
+	lsCmd = &cobra.Command{
+		Use:               "ls [options]",
+		Aliases:           []string{"list"},
+		Short:             "List secrets",
+		RunE:              ls,
+		Example:           "podman secret ls",
+		Args:              validate.NoArgs,
+		ValidArgsFunction: completion.AutocompleteNone,
+	}
+	listFlag = listFlagType{}
+)
+
+type listFlagType struct {
+	format    string
+	noHeading bool
+}
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: lsCmd,
+		Parent:  secretCmd,
+	})
+
+	flags := lsCmd.Flags()
+	formatFlagName := "format"
+	flags.StringVar(&listFlag.format, formatFlagName, "{{.ID}}\t{{.Name}}\t{{.Driver}}\t{{.CreatedAt}}\t{{.UpdatedAt}}\t\n", "Format volume output using Go template")
+	_ = lsCmd.RegisterFlagCompletionFunc(formatFlagName, common.AutocompleteJSONFormat)
+
+}
+
+func ls(cmd *cobra.Command, args []string) error {
+	responses, err := registry.ContainerEngine().SecretList(context.Background())
+	if err != nil {
+		return err
+	}
+	listed := make([]*entities.SecretListReport, 0, len(responses))
+	for _, response := range responses {
+		listed = append(listed, &entities.SecretListReport{
+			ID:        response.ID,
+			Name:      response.Spec.Name,
+			CreatedAt: units.HumanDuration(time.Since(response.CreatedAt)) + " ago",
+			UpdatedAt: units.HumanDuration(time.Since(response.UpdatedAt)) + " ago",
+			Driver:    response.Spec.Driver.Name,
+		})
+
+	}
+	return outputTemplate(cmd, listed)
+}
+
+func outputTemplate(cmd *cobra.Command, responses []*entities.SecretListReport) error {
+	headers := report.Headers(entities.SecretListReport{}, map[string]string{
+		"CreatedAt": "CREATED",
+		"UpdatedAt": "UPDATED",
+	})
+
+	row := report.NormalizeFormat(listFlag.format)
+	format := parse.EnforceRange(row)
+
+	tmpl, err := template.New("list secret").Parse(format)
+	if err != nil {
+		return err
+	}
+	w := tabwriter.NewWriter(os.Stdout, 12, 2, 2, ' ', 0)
+	defer w.Flush()
+
+	if cmd.Flags().Changed("format") && !parse.HasTable(listFlag.format) {
+		listFlag.noHeading = true
+	}
+
+	if !listFlag.noHeading {
+		if err := tmpl.Execute(w, headers); err != nil {
+			return errors.Wrapf(err, "failed to write report column headers")
+		}
+	}
+	return tmpl.Execute(w, responses)
+}
diff --git a/cmd/podman/secrets/rm.go b/cmd/podman/secrets/rm.go
new file mode 100644
index 000000000..c72a3c171
--- /dev/null
+++ b/cmd/podman/secrets/rm.go
@@ -0,0 +1,58 @@
+package secrets
+
+import (
+	"context"
+	"errors"
+	"fmt"
+
+	"github.com/containers/podman/v2/cmd/podman/common"
+	"github.com/containers/podman/v2/cmd/podman/registry"
+	"github.com/containers/podman/v2/cmd/podman/utils"
+	"github.com/containers/podman/v2/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	rmCmd = &cobra.Command{
+		Use:               "rm [options] SECRET [SECRET...]",
+		Short:             "Remove one or more secrets",
+		RunE:              rm,
+		ValidArgsFunction: common.AutocompleteSecrets,
+		Example:           "podman secret rm mysecret1 mysecret2",
+	}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: rmCmd,
+		Parent:  secretCmd,
+	})
+	flags := rmCmd.Flags()
+	flags.BoolVarP(&rmOptions.All, "all", "a", false, "Remove all secrets")
+}
+
+var (
+	rmOptions = entities.SecretRmOptions{}
+)
+
+func rm(cmd *cobra.Command, args []string) error {
+	var (
+		errs utils.OutputErrors
+	)
+	if (len(args) > 0 && rmOptions.All) || (len(args) < 1 && !rmOptions.All) {
+		return errors.New("`podman secret rm` requires one argument, or the --all flag")
+	}
+	responses, err := registry.ContainerEngine().SecretRm(context.Background(), args, rmOptions)
+	if err != nil {
+		return err
+	}
+	for _, r := range responses {
+		if r.Err == nil {
+			fmt.Println(r.ID)
+		} else {
+			errs = append(errs, r.Err)
+		}
+	}
+	return errs.PrintErrors()
+}
diff --git a/cmd/podman/secrets/secret.go b/cmd/podman/secrets/secret.go
new file mode 100644
index 000000000..4e6b6ec7b
--- /dev/null
+++ b/cmd/podman/secrets/secret.go
@@ -0,0 +1,25 @@
+package secrets
+
+import (
+	"github.com/containers/podman/v2/cmd/podman/registry"
+	"github.com/containers/podman/v2/cmd/podman/validate"
+	"github.com/containers/podman/v2/pkg/domain/entities"
+	"github.com/spf13/cobra"
+)
+
+var (
+	// Command: podman _secret_
+	secretCmd = &cobra.Command{
+		Use:   "secret",
+		Short: "Manage secrets",
+		Long:  "Manage secrets",
+		RunE:  validate.SubCommandExists,
+	}
+)
+
+func init() {
+	registry.Commands = append(registry.Commands, registry.CliCommand{
+		Mode:    []entities.EngineMode{entities.ABIMode, entities.TunnelMode},
+		Command: secretCmd,
+	})
+}