avoid-panic-if-oidc-do-not-exists (#208)

* avoid-panic-if-oidc-do-not-exists * nancy-yay
giantswarm · Nov 1, 2023 · d4c0d9c · d4c0d9c
1 parent 1748938
commit d4c0d9c
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 0 deletions.
diff --git a/.nancy-ignore b/.nancy-ignore
@@ -2,6 +2,7 @@ CVE-2019-10743 until=2023-12-31
 CVE-2022-29153 until=2023-12-31
 CVE-2019-19355 until=2023-12-31
 CVE-2023-3978
+CVE-2023-39325
 
 # pkg:golang/github.com/hashicorp/consul/[email protected]
 CVE-2021-41803 until=2023-12-31

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - Remove SecretReconciler.
 - Refactor Reconcilers.
+- Do not panic when OIDC setting is missing for EKS cluster.
 
 ### Added
 

diff --git a/pkg/iam/error.go b/pkg/iam/error.go
@@ -3,8 +3,13 @@ package iam
 import (
 	"github.com/aws/aws-sdk-go/aws/awserr"
 	awsiam "github.com/aws/aws-sdk-go/service/iam"
+	"github.com/giantswarm/microerror"
 )
 
+var invalidClusterError = &microerror.Error{
+	Kind: "invalidClusterError",
+}
+
 func IsNotFound(err error) bool {
 	if aerr, ok := err.(awserr.Error); ok {
 		if aerr.Code() == awsiam.ErrCodeNoSuchEntityException {

diff --git a/pkg/iam/iam.go b/pkg/iam/iam.go
@@ -597,6 +597,9 @@ func (s *IAMService) GetIRSAOpenIDForEKS(clusterName string) (string, error) {
 	if err != nil {
 		return "", microerror.Mask(err)
 	}
+	if cluster == nil || cluster.Cluster == nil || cluster.Cluster.Identity == nil || cluster.Cluster.Identity.Oidc == nil || cluster.Cluster.Identity.Oidc.Issuer == nil {
+		return "", microerror.Maskf(invalidClusterError, "cluster %s does not have OIDC identity", clusterName)
+	}
 
 	id := strings.TrimPrefix(*cluster.Cluster.Identity.Oidc.Issuer, "https://")