From: Tom Clegg <tom@curii.com>
Date: Fri, 7 May 2021 14:33:10 +0000 (-0400)
Subject: 17590: Error out if both old+new S3 credential configs are provided.
X-Git-Tag: 2.2.0~37^2~1
X-Git-Url: https://git.arvados.org/arvados.git/commitdiff_plain/d5666a360beedb7036aae830bbc4058a6d9c82fc

17590: Error out if both old+new S3 credential configs are provided.

Arvados-DCO-1.1-Signed-off-by: Tom Clegg <tom@curii.com>
---

diff --git a/lib/config/deprecated.go b/lib/config/deprecated.go
index aac981da44..5e68bbfcef 100644
--- a/lib/config/deprecated.go
+++ b/lib/config/deprecated.go
@@ -136,7 +136,7 @@ func (ldr *Loader) applyDeprecatedVolumeDriverParameters(cfg *arvados.Config) er
 				}
 				if params.AccessKey != "" || params.SecretKey != "" {
 					if params.AccessKeyID != "" || params.SecretAccessKey != "" {
-						ldr.Logger.Warnf("ignoring old config keys %s.Volumes.%s.DriverParameters.AccessKey/SecretKey because new keys AccessKeyID/SecretAccessKey are also present", clusterID, volID)
+						return fmt.Errorf("cannot use old keys (AccessKey/SecretKey) and new keys (AccessKeyID/SecretAccessKey) at the same time in %s.Volumes.%s.DriverParameters -- you must remove the old config keys", clusterID, volID)
 						continue
 					}
 					var allparams map[string]interface{}
diff --git a/lib/config/deprecated_test.go b/lib/config/deprecated_test.go
index 383f03d05f..7cb169c618 100644
--- a/lib/config/deprecated_test.go
+++ b/lib/config/deprecated_test.go
@@ -74,6 +74,19 @@ Clusters:
 	c.Check(logs, check.Matches, `(?ms).*deprecated or unknown config entry: .*AccessKey.*`)
 	c.Check(logs, check.Matches, `(?ms).*deprecated or unknown config entry: .*SecretKey.*`)
 	c.Check(logs, check.Matches, `(?ms).*using your old config keys z1111\.Volumes\.z1111-nyw5e-aaaaaaaaaaaaaaa\.DriverParameters\.AccessKey/SecretKey -- but you should rename them to AccessKeyID/SecretAccessKey.*`)
+
+	_, err := testLoader(c, `
+Clusters:
+ z1111:
+  Volumes:
+   z1111-nyw5e-aaaaaaaaaaaaaaa:
+    Driver: S3
+    DriverParameters:
+     AccessKey: exampleaccesskey
+     SecretKey: examplesecretkey
+     AccessKeyID: exampleaccesskey
+`, nil).Load()
+	c.Check(err, check.ErrorMatches, `(?ms).*cannot use .*SecretKey.*and.*SecretAccessKey.*in z1111.Volumes.z1111-nyw5e-aaaaaaaaaaaaaaa.DriverParameters.*`)
 }
 
 func (s *LoadSuite) TestDeprecatedNodeProfilesToServices(c *check.C) {