Use memguard locked buffer for Secret operations

Author: kabicin

cmd/main.go

@@ -36,6 +36,7 @@ import (
 	"github.com/application-stacks/runtime-component-operator/common"
 	"github.com/application-stacks/runtime-component-operator/internal/controller"
 	"github.com/application-stacks/runtime-component-operator/utils"
+	"github.com/awnumar/memguard"
 	certmanagerv1 "github.com/cert-manager/cert-manager/pkg/apis/certmanager/v1"
 	imagev1 "github.com/openshift/api/image/v1"
 	routev1 "github.com/openshift/api/route/v1"
@@ -68,6 +69,9 @@ func init() {
 }
 
 func main() {
+	memguard.CatchInterrupt()
+	defer memguard.Purge()
+
 	var metricsAddr string
 	var enableLeaderElection bool
 	var probeAddr string

common/secret.go

@@ -2,81 +2,92 @@ package common
 
 import (
 	"context"
-	"sync"
+	"fmt"
 
+	"github.com/awnumar/memguard"
 	corev1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/types"
+	"sigs.k8s.io/controller-runtime/pkg/client"
 )
 
-type SecretResource struct {
-	secret *corev1.Secret
-	once   sync.Once
+type LockedBufferSecret struct {
+	metav1.TypeMeta   `json:",inline"`
+	metav1.ObjectMeta `json:"metadata,omitempty"`
+	LockedData        SecretMap `json:"lockedData,omitempty"`
 }
 
-type WaitableSecretResource struct {
-	*SecretResource
-	wg sync.WaitGroup
-}
+type SecretMap map[string]*memguard.LockedBuffer
 
-// Creates a Secret that clears it's data when recCtx is canceled
-func NewSecret(recCtx context.Context, name, namespace string) *corev1.Secret {
-	secretResource := NewSecretResource(name, namespace)
-	go func() {
-		<-recCtx.Done()
-		secretResource.Clear(nil)
-	}()
-	return secretResource.GetSecret()
+func (sm SecretMap) Destroy() {
+	for _, buf := range sm {
+		buf.Destroy()
+	}
 }
 
-func NewWaitableSecret(recCtx context.Context, name, namespace string) (*corev1.Secret, *sync.WaitGroup) {
-	waitableSecretResource := NewWaitableSecretResource(name, namespace)
-	go func() {
-		<-recCtx.Done()
-		waitableSecretResource.Clear(waitableSecretResource.GetWaitGroup())
-	}()
-	return waitableSecretResource.GetSecret(), waitableSecretResource.GetWaitGroup()
+func (sm SecretMap) Get(key string) ([]byte, bool) {
+	if buf, found := sm[key]; found {
+		return buf.Bytes(), true
+	}
+	return []byte{}, false
 }
 
-func NewSecretResource(name, namespace string) *SecretResource {
-	resource := &SecretResource{
-		secret: &corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      name,
-				Namespace: namespace,
-			},
-		},
+func (lockedBufferSecret LockedBufferSecret) Destroy() {
+	if lockedBufferSecret.LockedData != nil {
+		lockedBufferSecret.LockedData.Destroy()
 	}
-	return resource
 }
 
-func NewWaitableSecretResource(name, namespace string) *WaitableSecretResource {
-	resource := &WaitableSecretResource{
-		SecretResource: NewSecretResource(name, namespace),
-		wg:             sync.WaitGroup{},
+// Gets a Secret from the k8s client loaded as a LockedBufferSecret
+func GetSecret(client client.Client, name string, ns string) (*LockedBufferSecret, error) {
+	if client == nil {
+		return nil, fmt.Errorf("the reconciler client could not be found")
+	}
+	secret := &corev1.Secret{}
+	secret.Name = name
+	secret.Namespace = ns
+	err := client.Get(context.TODO(), types.NamespacedName{Name: name, Namespace: ns}, secret)
+	if err != nil {
+		return nil, err
 	}
-	return resource
-}
 
-func (wsr *WaitableSecretResource) GetWaitGroup() *sync.WaitGroup {
-	return &wsr.wg
+	lockedBufferSecret := &LockedBufferSecret{}
+	lockedBufferSecret.TypeMeta = secret.TypeMeta
+	lockedBufferSecret.ObjectMeta = secret.ObjectMeta
+	for secretKey, secretValue := range secret.Data {
+		lockedBufferSecret.LockedData[secretKey] = memguard.NewBufferFromBytes(secretValue)
+	}
+	return lockedBufferSecret, nil
 }
 
-func (r *SecretResource) GetSecret() *corev1.Secret {
-	return r.secret
+// Copies a Locked Buffer Secret into a core Secret with a corresponding cleanup func
+func CopySecret(in *LockedBufferSecret, out *corev1.Secret) func() {
+	out.TypeMeta = in.TypeMeta
+	out.ObjectMeta = in.ObjectMeta
+	for key, buf := range in.LockedData {
+		out.Data[key] = buf.Bytes()
+	}
+	return func() {
+		for key := range out.Data {
+			delete(out.Data, key)
+		}
+		out.Data = nil
+	}
 }
 
-func (r *SecretResource) Clear(wg *sync.WaitGroup) {
-	if r.secret == nil {
-		return
+// Returns the client.Get status of Secret name in namespace ns after clearing sensitive byte array content
+func CheckSecret(client client.Client, name string, ns string) error {
+	if client == nil {
+		return fmt.Errorf("the reconciler client could not be found")
 	}
 
-	r.once.Do(func() {
-		if wg != nil {
-			wg.Wait()
-		}
-		for secretKey, secretValue := range r.secret.Data {
-			clear(secretValue)
-			delete(r.secret.Data, secretKey)
-		}
-	})
+	secret := &corev1.Secret{}
+	secret.Name = name
+	secret.Namespace = ns
+	err := client.Get(context.TODO(), types.NamespacedName{Name: name, Namespace: ns}, secret)
+	for key, value := range secret.Data {
+		clear(value)
+		delete(secret.Data, key)
+	}
+	return err
 }

go.mod

@@ -3,6 +3,7 @@ module github.com/application-stacks/runtime-component-operator
 go 1.26
 
 require (
+	github.com/awnumar/memguard v0.23.0
 	github.com/cert-manager/cert-manager v1.19.4
 	github.com/go-logr/logr v1.4.3
 	github.com/openshift/api v0.0.0-20260304172252-b0658d22beea
@@ -27,6 +28,7 @@ require (
 )
 
 require (
+	github.com/awnumar/memcall v0.4.0 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
 	github.com/blendle/zapdriver v1.3.1 // indirect

go.sum

@@ -1,5 +1,9 @@
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5/go.mod h1:wHh0iHkYZB8zMSxRWpUBQtwG5a7fFgvEO+odwuTv2gs=
+github.com/awnumar/memcall v0.4.0 h1:B7hgZYdfH6Ot1Goaz8jGne/7i8xD4taZie/PNSFZ29g=
+github.com/awnumar/memcall v0.4.0/go.mod h1:8xOx1YbfyuCg3Fy6TO8DK0kZUua3V42/goA5Ru47E8w=
+github.com/awnumar/memguard v0.23.0 h1:sJ3a1/SWlcuKIQ7MV+R9p0Pvo9CWsMbGZvcZQtmc68A=
+github.com/awnumar/memguard v0.23.0/go.mod h1:olVofBrsPdITtJ2HgxQKrEYEMyIBAIciVG4wNnZhW9M=
 github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
 github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=

utils/hash.go

@@ -4,22 +4,66 @@ import (
 	"bytes"
 	"encoding/hex"
 	"io"
+	"runtime"
 	"sort"
 
+	"github.com/application-stacks/runtime-component-operator/common"
 	"lukechampine.com/blake3"
 )
 
+func HashSecretMapData(data common.SecretMap) string {
+	return hash(data, serializeSecretMapData)
+}
+
 func HashData(data map[string][]byte) string {
+	return hash(data, serializeSecretData)
+}
+
+func hash(data any, serializer func(any) []byte) string {
 	hasher := blake3.New(32, nil)
-	io.Copy(hasher, bytes.NewReader(serializeSecretData(data)))
+	secretBytes := serializer(data)
+	io.Copy(hasher, bytes.NewReader(secretBytes))
+	// clear secret bytes
+	for i := range secretBytes {
+		secretBytes[i] = 0
+	}
 	hash := hasher.Sum(nil)
+	// force gc
+	hasher = nil
+	runtime.GC()
 	return hex.EncodeToString(hash)
 }
 
-func serializeSecretData(data map[string][]byte) []byte {
+func serializeSecretMapData(data any) []byte {
+	if _, ok := data.(common.SecretMap); !ok {
+		return []byte{}
+	}
+	dataObj := data.(common.SecretMap)
+	// sort data keys
+	dataKeys := []string{}
+	for k := range dataObj {
+		dataKeys = append(dataKeys, k)
+	}
+	sort.Strings(dataKeys)
+	// load dataBuffer delimited by a null character for every key-value pair <key>\0<value>\0
+	dataBuffer := []byte{}
+	for _, k := range dataKeys {
+		dataBuffer = append(dataBuffer, []byte(k)...)
+		dataBuffer = append(dataBuffer, '\000')
+		dataBuffer = append(dataBuffer, dataObj[k].Bytes()...)
+		dataBuffer = append(dataBuffer, '\000')
+	}
+	return dataBuffer
+}
+
+func serializeSecretData(data any) []byte {
+	if _, ok := data.(map[string][]byte); !ok {
+		return []byte{}
+	}
+	dataObj := data.(map[string][]byte)
 	// sort data keys
 	dataKeys := []string{}
-	for k := range data {
+	for k := range dataObj {
 		dataKeys = append(dataKeys, k)
 	}
 	sort.Strings(dataKeys)
@@ -28,7 +72,7 @@ func serializeSecretData(data map[string][]byte) []byte {
 	for _, k := range dataKeys {
 		dataBuffer = append(dataBuffer, []byte(k)...)
 		dataBuffer = append(dataBuffer, '\000')
-		dataBuffer = append(dataBuffer, data[k]...)
+		dataBuffer = append(dataBuffer, dataObj[k]...)
 		dataBuffer = append(dataBuffer, '\000')
 	}
 	return dataBuffer