Secure valueFrom resolution helper utility function

pkg/build/controller/common/util.go

@@ -18,7 +18,7 @@ import (
 	"github.com/openshift/origin/pkg/build/controller/policy"
 	buildlister "github.com/openshift/origin/pkg/build/generated/listers/build/internalversion"
 	buildutil "github.com/openshift/origin/pkg/build/util"
-	envutil "github.com/openshift/origin/pkg/util/env"
+	envresolve "github.com/openshift/origin/pkg/pod/envresolve"
 
 	"github.com/golang/glog"
 )
@@ -170,7 +170,7 @@ func ResolveValueFrom(pod *kapi.Pod, client kclientset.Interface) error {
 	mapEnvs := map[string]string{}
 	mapping := expansion.MappingFuncFor(mapEnvs)
 	inputEnv := buildutil.GetBuildEnv(build)
-	store := envutil.NewResourceStore()
+	store := envresolve.NewResourceStore()
 
 	for _, e := range inputEnv {
 		var value string
@@ -179,7 +179,7 @@ func ResolveValueFrom(pod *kapi.Pod, client kclientset.Interface) error {
 		if e.Value != "" {
 			value = expansion.Expand(e.Value, mapping)
 		} else if e.ValueFrom != nil {
-			value, err = envutil.GetEnvVarRefValue(nil, client, build.Namespace, store, e.ValueFrom, build, nil)
+			value, err = envresolve.GetEnvVarRefValue(client, build.Namespace, store, e.ValueFrom, build, nil)
 			if err != nil {
 				allErrs = append(allErrs, err)
 				continue

pkg/cmd/cli/cmd/set/env.go

@@ -22,7 +22,7 @@ import (
 	"github.com/openshift/origin/pkg/cmd/templates"
 	cmdutil "github.com/openshift/origin/pkg/cmd/util"
 	"github.com/openshift/origin/pkg/cmd/util/clientcmd"
-	envutil "github.com/openshift/origin/pkg/util/env"
+	envresolve "github.com/openshift/origin/pkg/pod/envresolve"
 )
 
 var (
@@ -207,6 +207,11 @@ func (o *EnvOptions) RunEnv(f *clientcmd.Factory) error {
 		return err
 	}
 
+	kubeClient, err := f.ClientSet()
+	if err != nil {
+		return err
+	}
+
 	cmdNamespace, explicit, err := f.DefaultNamespace()
 	if err != nil {
 		return err
@@ -347,7 +352,7 @@ func (o *EnvOptions) RunEnv(f *clientcmd.Factory) error {
 
 				if o.List {
 					resolveErrors := map[string][]string{}
-					store := envutil.NewResourceStore()
+					store := envresolve.NewResourceStore()
 
 					fmt.Fprintf(o.Out, "# %s %s, container %s\n", info.Mapping.Resource, info.Name, c.Name)
 					for _, env := range c.Env {
@@ -359,19 +364,19 @@ func (o *EnvOptions) RunEnv(f *clientcmd.Factory) error {
 
 						// Print the reference version
 						if !o.Resolve {
-							fmt.Fprintf(o.Out, "# %s from %s\n", env.Name, envutil.GetEnvVarRefString(env.ValueFrom))
+							fmt.Fprintf(o.Out, "# %s from %s\n", env.Name, envresolve.GetEnvVarRefString(env.ValueFrom))
 							continue
 						}
 
-						value, err := envutil.GetEnvVarRefValue(f, nil, "", store, env.ValueFrom, info.Object, c)
+						value, err := envresolve.GetEnvVarRefValue(kubeClient, cmdNamespace, store, env.ValueFrom, info.Object, c)
 						// Print the resolved value
 						if err == nil {
 							fmt.Fprintf(o.Out, "%s=%s\n", env.Name, value)
 							continue
 						}
 
 						// Print the reference version and save the resolve error
-						fmt.Fprintf(o.Out, "# %s from %s\n", env.Name, envutil.GetEnvVarRefString(env.ValueFrom))
+						fmt.Fprintf(o.Out, "# %s from %s\n", env.Name, envresolve.GetEnvVarRefString(env.ValueFrom))
 						errString := err.Error()
 						resolveErrors[errString] = append(resolveErrors[errString], env.Name)
 						resolutionErrorsEncountered = true

pkg/util/env/env.go → pkg/pod/envresolve/env.go

@@ -1,4 +1,4 @@
-package env
+package envresolve
 
 import (
 	"fmt"
@@ -8,8 +8,6 @@ import (
 	kapi "k8s.io/kubernetes/pkg/api"
 	kclientset "k8s.io/kubernetes/pkg/client/clientset_generated/internalclientset"
 	"k8s.io/kubernetes/pkg/fieldpath"
-
-	"github.com/openshift/origin/pkg/cmd/util/clientcmd"
 )
 
 // ResourceStore defines a new resource store data structure
@@ -72,33 +70,13 @@ func getResourceFieldRef(from *kapi.EnvVarSource, c *kapi.Container) (string, er
 }
 
 // GenEnvVarRefValue returns the value referenced by the supplied EnvVarSource given the other supplied information
-func GetEnvVarRefValue(f *clientcmd.Factory, kc kclientset.Interface, ns string, store *ResourceStore, from *kapi.EnvVarSource, obj runtime.Object, c *kapi.Container) (string, error) {
-	var kubeClient kclientset.Interface
-	var namespace string
-	var err error
-
-	if f != nil {
-		kubeClient, err = f.ClientSet()
-		if err != nil {
-			return "", err
-		}
-		namespace, _, err = f.DefaultNamespace()
-		if err != nil {
-			return "", err
-		}
-	} else if kc != nil {
-		kubeClient = kc
-		namespace = ns
-	} else {
-		return "", fmt.Errorf("You must supply either a clientcmd.Factory or kclientset.Interface")
-	}
-
+func GetEnvVarRefValue(kc kclientset.Interface, ns string, store *ResourceStore, from *kapi.EnvVarSource, obj runtime.Object, c *kapi.Container) (string, error) {
 	if from.SecretKeyRef != nil {
-		return getSecretRefValue(kubeClient, namespace, store, from.SecretKeyRef)
+		return getSecretRefValue(kc, ns, store, from.SecretKeyRef)
 	}
 
 	if from.ConfigMapKeyRef != nil {
-		return getConfigMapRefValue(kubeClient, namespace, store, from.ConfigMapKeyRef)
+		return getConfigMapRefValue(kc, ns, store, from.ConfigMapKeyRef)
 	}
 
 	if from.FieldRef != nil {