Adding a new flag to the deploy command and the related new functionality in order to support the collecting of secrets and sending them to the backend #252

karrgov · 2025-12-19T12:05:36Z

LMCROSSITXSADEPLOY-2301

…lity in order to support the collecting of secrets and sending them to the backend LMCROSSITXSADEPLOY-2301

IvanBorislavovDimitrov · 2026-01-05T13:11:21Z

commands/deploy_command.go


-   Deploy a multi-target app archive referenced by a remote URL
-   <write MTA archive URL to STDOUT> | cf deploy [-e EXT_DESCRIPTOR[,...]] [-t TIMEOUT] [--version-rule VERSION_RULE] [-u MTA_CONTROLLER_URL] [--retries RETRIES] [--no-start] [--namespace NAMESPACE] [--apply-namespace-app-names true/false] [--apply-namespace-service-names true/false] [--apply-namespace-app-routes true/false] [--apply-namespace-as-suffix true/false ] [--delete-services] [--delete-service-keys] [--delete-service-brokers] [--keep-files] [--no-restart-subscribed-apps] [--do-not-fail-on-missing-permissions] [--abort-on-error] [--strategy STRATEGY] [--skip-testing-phase] [--skip-idle-start] [--apps-start-timeout TIMEOUT] [--apps-stage-timeout TIMEOUT] [--apps-upload-timeout TIMEOUT] [--apps-task-execution-timeout TIMEOUT]` + util.UploadEnvHelpText,
+   (EXPERIMENTAL) Deploy a multi-target app archive referenced by a remote URL


why experimental here?

Must have added it accidentally - fixed. I have just put it for the new flag, since we have talked about the feature being presented as experimental.

IvanBorislavovDimitrov · 2026-01-05T14:08:03Z

secure_parameters/secure_parametes.go

+
+			var jsonObject map[string]interface{}
+
+			err2 := json.Unmarshal([]byte(envValue), &jsonObject)


can you reuse err?

I know that reusing the same err is not recommended- I will just change the names and make them more descriptive instead of a plain err2 :)

IvanBorislavovDimitrov · 2026-01-05T14:25:09Z

commands/deploy_command.go

+	if GetBoolOpt(requireSecureParameters, flags) {
+		// Collect special ENVs: __MTA___<name>, __MTA_JSON___<name>, __MTA_CERT___<name>
+		parameters, err := secure_parameters.CollectFromEnv("__MTA")


This check happens after the upload of the mtar. Could be optimized so the validation is earlier to avoid unnecessary upload in case of some failure

thanks for the suggestion, fixed :)

IvanBorislavovDimitrov · 2026-01-05T14:40:52Z

secure_parameters/secure_parametes.go

+	return result, nil
+}
+
+func BuildSecureExtension(parameters map[string]ParameterValue, mtaID string, schemaVersion string) ([]byte, error) {


extract in a separate file

IvanBorislavovDimitrov · 2026-01-05T14:44:30Z

secure_parameters/secure_parametes.go

+	if schemaVersion == "" {
+		schemaVersion = "3.3"
+	}


let's not hardcode versions in client

IvanBorislavovDimitrov · 2026-01-05T14:46:57Z

secure_parameters/secure_parametes.go

+		switch currentParameterValue.Type {
+		case typeJSON:
+			parametersDescriptor[name] = currentParameterValue.ObjectContent
+		default:
+			parametersDescriptor[name] = currentParameterValue.StringContent
+		}


You can add a new method on ParameterValue and use it here (currentParameterValue.getValue())

fixed, thanks for the suggestion :)

IvanBorislavovDimitrov · 2026-01-06T08:27:35Z

secure_parameters/secure_parametes.go

+func CollectFromEnv(prefix string) (map[string]ParameterValue, error) {
+	plainValue := prefix + "___"
+	jsonValue := prefix + "_JSON___"
+	certificateValue := prefix + "_CERT___" //X509value beacuse the certiciates are of type X509 (should be renamed)


Improve or remove the comment description

fixed, thanks

IvanBorislavovDimitrov · 2026-01-06T08:36:00Z

secure_parameters/secure_parametes.go

+	return nil
+}
+
+func CollectFromEnv(prefix string) (map[string]ParameterValue, error) {


This method is quite long, try to shorten it, split in functions

IvanBorislavovDimitrov · 2026-01-06T08:49:38Z

secure_parameters/secure_parametes.go

+	ObjectContent map[string]interface{}
+}
+
+func nameDuplicated(name, prefix string, result map[string]ParameterValue) error {


rename to something including "validate"

IvanBorislavovDimitrov · 2026-01-06T08:51:04Z

secure_parameters/secure_parametes.go

+		envName := nameValuePair[:equalsIndex]
+		envValue := nameValuePair[equalsIndex+1:]
+
+		var name string


do you need to define here?

Otherwise I have to define it in each separate case

IvanBorislavovDimitrov · 2026-01-06T09:44:23Z

commands/deploy_command.go

+func (c *DeployCommand) doesUpsExist(userProvidedServiceName string) (bool, error) {
+	servicesOutput, err := c.cliConnection.CliCommandWithoutTerminalOutput("services")
+	if err != nil {
+		return false, fmt.Errorf("Error while checking if the UPS for secure encryption exists: %w", err)
+	}
+	stringTable := strings.Join(servicesOutput, "\n")
+	return findServiceName(stringTable, userProvidedServiceName), nil


Can we call the v3/services here instead a command?

Completely fixed, thanks for the suggestion :)

IvanBorislavovDimitrov · 2026-01-06T09:47:17Z

commands/deploy_command.go

+	return true, encryptionKey, nil
+}
+
+func getRandomEncryptionKey() (string, error) {


is there some library that can do this for us?

Could not manage to find anything in particular - saw that many use the base64 encoding which I tried but since for every 3 bytes it spits out 4 characters - I was getting 43 chars out of my 32 bytes. Also since I wanted the constraint of having only alphanumerical values and not any / or + which base64 brings, I decided the use the explicit "alphabet" of allowed symbols and then just randomly choose each character from it.

IvanBorislavovDimitrov · 2026-01-06T09:48:22Z

commands/deploy_command.go

+
+		userProvidedServiceName := getUpsName(mtaId, namespace)
+
+		isUpsCreated, _, err := c.validateUpsExistsOrElseCreateIt(userProvidedServiceName, "v1")


what is the idea of:
"keyId": "v1"

we have discussed it during the multiapps-controller changes :)

IvanBorislavovDimitrov · 2026-01-06T10:22:55Z

commands/deploy_command.go

+	for i := range encryptionKeyBytes {
+		encryptionKeyBytes[i] = alphabet[int(encryptionKeyBytes[i]&63)]
+	}
+
+	return string(encryptionKeyBytes), nil


Does this really creates a proper 256 bits keys? Why not something like:

func generateAES256Key() ([]byte, error) {
key := make([]byte, 32) // 256 bits
_, err := rand.Read(key)
if err != nil {
return nil, err
}
return string([]byte(fmt.Sprintf("%x", key))), nil
}

Why is alphabet needed?

Yes, it does. I tried doing it like that myself in the beginning, but the problem was that the argument in the Sprintf method determines the encoding used, thus giving different lenghts as a result. Using the fmt.Sprinf("%x", key) with the "x" argument, Go does a base16 encoding which actually converts the 32 generated bytes into 64 characters. The base16 encoding doubles the size of the byte input when it is converted to a string output, since base16 uses only the letters from 'a' to 'f' and 1 through 9, 16 symbols altogether, and since one byte can be between 0-255 - in order to represent all the 256 different values we need to have for each of the 16 unique symbols, 16 more - meaning 16x16 = 16^2 = 256

LMCROSSITXSADEPLOY-2301

vkalapov · 2026-01-27T08:03:23Z

secure_parameters/secure_parametes.go

+	Type          typeOfValue
+	StringContent string
+	JSONContent   interface{}
+	//ObjectContent map[string]interface{}


Remove this comment if not needed.

vkalapov · 2026-01-27T08:19:44Z

secure_parameters/secure_parameters_test.go

+	}
+}
+
+func TestCollectFromEnvWhenDuplciateNames(t *testing.T) {


vkalapov · 2026-01-27T08:34:30Z

commands/deploy_command.go

+		"encryptionKey": encryptionKey,
+		"keyId":         keyID,
+	}
+	jsonBody, _ := json.Marshal(upsCredentials)


Why is the error from json.Marshal ignored here?

Adding a new flag to the deploy command and the related new functiona…

f326e34

…lity in order to support the collecting of secrets and sending them to the backend LMCROSSITXSADEPLOY-2301

IvanBorislavovDimitrov reviewed Jan 6, 2026

View reviewed changes

karrgov added 2 commits January 26, 2026 16:02

Adding fixes after review

cfb1338

LMCROSSITXSADEPLOY-2301

Removing commented out field

77d8ac3

LMCROSSITXSADEPLOY-2301

vkalapov requested changes Jan 27, 2026

View reviewed changes


		var jsonObject map[string]interface{}

		err2 := json.Unmarshal([]byte(envValue), &jsonObject)


		userProvidedServiceName := getUpsName(mtaId, namespace)

		isUpsCreated, _, err := c.validateUpsExistsOrElseCreateIt(userProvidedServiceName, "v1")

Adding a new flag to the deploy command and the related new functionality in order to support the collecting of secrets and sending them to the backend #252

Are you sure you want to change the base?

Adding a new flag to the deploy command and the related new functionality in order to support the collecting of secrets and sending them to the backend #252

Conversation

karrgov commented Dec 19, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

karrgov Jan 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

IvanBorislavovDimitrov Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

karrgov Jan 22, 2026 •

edited

Loading

IvanBorislavovDimitrov Jan 6, 2026 •

edited

Loading