Merge branch 'dev' into feature/TPT-4457-add-integration-tests-for-rdma-interfaces

Author: mawilk90

.github/workflows/publish-wiki.yml

@@ -15,4 +15,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: Andrew-Chen-Wang/github-wiki-action@6448478bd55f1f3f752c93af8ac03207eccc3213 # pin@v5.0.3
+      - uses: Andrew-Chen-Wang/github-wiki-action@1bbb4280446f9630e8e21a18012cbacf3b0f992e # pin@v5.0.6

README.md

@@ -12,12 +12,21 @@ Visit the [Wiki](../../wiki) for more information.
 
 ## Install
 
-Install via PyPI:
+We recommend installing `linode-cli` with `pipx`, which installs each Python CLI tool into its own isolated environment and works on distributions where `pip install` fails because the system Python is marked as externally managed ([PEP 668](https://peps.python.org/pep-0668/)). If pipx isn't installed yet, follow the [pipx installation guide](https://pipx.pypa.io/latest/how-to/install-pipx.html).
+
+To install:
+
+```bash
+pipx install linode-cli
+```
+
+To upgrade:
+
 ```bash
-pip3 install linode-cli
+pipx upgrade linode-cli
 ```
 
-Visit the [Wiki](../../wiki/Installation) for more information.
+The [Wiki](https://github.com/linode/linode-cli/wiki/Installation) covers other installation methods, including the Docker image, the GitHub Action, and building from source.
 
 ## Contributing
 

linodecli/configuration/auth.py

@@ -214,11 +214,12 @@ def _get_token_terminal(base_url: str) -> Tuple[str, str]:
     :returns: A tuple containing the user's username and token.
     :rtype: Tuple[str, str]
     """
-    print(f"""
-First, we need a Personal Access Token.  To get one, please visit
-{TOKEN_GENERATION_URL} and click
-"Create a Personal Access Token".  The CLI needs access to everything
-on your account to work correctly.""")
+    print(
+        "First, we need a Personal Access Token.  To get one, please visit\n"
+        f"{TOKEN_GENERATION_URL} and click\n"
+        '"Create a Personal Access Token".  The CLI needs access to everything\n'
+        "on your account to work correctly."
+    )
 
     while True:
         token = input("Personal Access Token: ")

linodecli/configuration/helpers.py

@@ -97,9 +97,10 @@ def _check_browsers() -> bool:
 
     # pylint: disable-next=protected-access
     if not KNOWN_GOOD_BROWSERS.intersection(webbrowser._tryorder):
-        print("""
-This tool defaults to web-based authentication,
-however no known-working browsers were found.""")
+        print(
+            "This tool defaults to web-based authentication,\n"
+            "however no known-working browsers were found."
+        )
         while True:
             r = input("Try it anyway? [y/N]: ")
             if r.lower() in "yn ":

linodecli/plugins/get-kubeconfig.py

@@ -8,6 +8,7 @@
 
 import argparse
 import base64
+import os
 import sys
 from pathlib import Path
 
@@ -19,6 +20,11 @@
 
 PLUGIN_BASE = "linode-cli get-kubeconfig"
 
+# Kubeconfigs contain credentials, so they should only be
+# accessible by the user that created them.
+KUBECONFIG_FILE_MODE = 0o600
+KUBECONFIG_DIR_MODE = 0o700
+
 
 def call(args, context):
     """
@@ -147,8 +153,27 @@ def _load_config(filepath):
 
 # Dumps data to a yaml file
 def _dump_config(filepath, data):
-    Path.mkdir(filepath.parent, exist_ok=True)
-    with open(filepath, "w", encoding="utf-8") as file_descriptor:
+    filepath.parent.mkdir(mode=KUBECONFIG_DIR_MODE, parents=True, exist_ok=True)
+
+    # Create the file with restrictive permissions rather than chmod-ing it
+    # afterwards, so its contents are never briefly readable by other users.
+    # NOTE: The mode is only applied when the file is created.
+    def opener(path, flags):
+        return os.open(path, flags, mode=KUBECONFIG_FILE_MODE)
+
+    with open(
+        filepath, "w", encoding="utf-8", opener=opener
+    ) as file_descriptor:
+        # Tighten the permissions of pre-existing files that are readable or
+        # writable by users other than the owner.
+        # NOTE: os.fchmod is not available on Windows, where POSIX file modes
+        # are not meaningful anyway.
+        if (
+            hasattr(os, "fchmod")
+            and os.fstat(file_descriptor.fileno()).st_mode & 0o077
+        ):
+            os.fchmod(file_descriptor.fileno(), KUBECONFIG_FILE_MODE)
+
         yaml.dump(data, file_descriptor)
 
 

tests/integration/linodes/test_linode_interfaces.py

@@ -146,10 +146,6 @@ def test_interface_settings_update(
                 interface_id,
                 "--default_route.ipv6_interface_id",
                 interface_id,
-                "--default_route.ipv4_eligible_interface_ids",
-                interface_id,
-                "--default_route.ipv6_eligible_interface_ids",
-                interface_id,
                 "--json",
             ]
         )

tests/unit/test_plugin_kubeconfig.py

@@ -204,6 +204,64 @@ def test_merge(mock_cli, fake_kubeconfig_file):
     assert result["dictionary"] == yaml_a["dictionary"]
 
 
+# Ensure newly created kubeconfig files are not world/group-readable
+@pytest.mark.skipif(
+    os.name == "nt", reason="POSIX file modes are not supported on Windows"
+)
+def test_written_config_permissions(mock_cli):
+    mock_cli.call_operation = mock_call_operation
+
+    with tempfile.TemporaryDirectory() as temp_dir:
+        file_path = os.path.join(temp_dir, "new_dir", "nested", "config")
+
+        try:
+            plugin.call(
+                [
+                    "--label",
+                    "nonempty_data",
+                    "--kubeconfig",
+                    file_path,
+                ],
+                PluginContext("REALTOKEN", mock_cli),
+            )
+        except SystemExit as err:
+            assert err.code == 0
+
+        assert os.path.exists(file_path)
+        assert os.stat(file_path).st_mode & 0o777 == 0o600
+        assert os.stat(os.path.dirname(file_path)).st_mode & 0o777 == 0o700
+
+
+# Ensure pre-existing world-readable kubeconfig files get tightened
+@pytest.mark.skipif(
+    os.name == "nt", reason="POSIX file modes are not supported on Windows"
+)
+def test_existing_config_permissions_tightened(mock_cli):
+    mock_cli.call_operation = mock_call_operation
+
+    with tempfile.TemporaryDirectory() as temp_dir:
+        file_path = os.path.join(temp_dir, "config")
+
+        with open(file_path, "w", encoding="utf-8") as file:
+            file.write(TEST_YAML_CONTENT_A)
+        os.chmod(file_path, 0o644)
+
+        try:
+            plugin.call(
+                [
+                    "--label",
+                    "nonempty_data",
+                    "--kubeconfig",
+                    file_path,
+                ],
+                PluginContext("REALTOKEN", mock_cli),
+            )
+        except SystemExit as err:
+            assert err.code == 0
+
+        assert os.stat(file_path).st_mode & 0o777 == 0o600
+
+
 def test_merge_to_empty_config(mock_cli, fake_kubeconfig_file_without_entries):
     stdout_buf = io.StringIO()
     mock_cli.call_operation = mock_call_operation