Add max and min expiration time

docs/user/05-60-kyma-bindings.md

@@ -20,4 +20,4 @@ The Broker returns a kubeconfig file in the response body. The kubeconfig file c
 | Name                   | Default | Description                                                                                                                                                                                                                                                                                                                                                          |
 |------------------------|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | **service_account**      | `false` | If set to `true`, the Broker returns a kubeconfig with a JWT token used as a user authentication mechanism. The token is generated using Kubernetes TokenRequest attached to a ServiceAccount, ClusterRole, and ClusterRoleBinding, all named `kyma-binding-{{binding_id}}`. Such an approach allows for easily modifying the permissions granted to the kubeconfig. |
-| **expiration_seconds** | `600`   | Specifies the duration (in seconds) for which the generated kubeconfig is valid. If not provided, the default value of `600` seconds (10 minutes) is used.                                                                                                                                                                                                             |
+| **expiration_seconds** | `600`   | Specifies the duration (in seconds) for which the generated kubeconfig is valid. If not provided, the default value of `600` seconds (10 minutes) is used. The maximum value that can be set is `7200` seconds (2 hours).                                |

internal/broker/bind_create.go

@@ -19,9 +19,11 @@ import (
 )
 
 type BindingConfig struct {
-	Enabled           bool        `envconfig:"default=false"`
-	BindablePlans     EnablePlans `envconfig:"default=aws"`
-	ExpirationSeconds int         `envconfig:"default=600"`
+	Enabled              bool        `envconfig:"default=false"`
+	BindablePlans        EnablePlans `envconfig:"default=aws"`
+	ExpirationSeconds    int         `envconfig:"default=600"`
+	MaxExpirationSeconds int         `envconfig:"default=7200"`
+	MinExpirationSeconds int         `envconfig:"default=600"`
 }
 
 type BindEndpoint struct {
@@ -98,6 +100,14 @@ func (b *BindEndpoint) Bind(ctx context.Context, instanceID, bindingID string, d
 
 	expirationSeconds := b.config.ExpirationSeconds
 	if parameters.ExpirationSeconds != 0 {
+		if parameters.ExpirationSeconds > b.config.MaxExpirationSeconds {
+			message := fmt.Sprintf("expiration_seconds cannot be greater than %d", b.config.MaxExpirationSeconds)
+			return domain.Binding{}, apiresponses.NewFailureResponse(fmt.Errorf(message), http.StatusBadRequest, message)
+		}
+		if parameters.ExpirationSeconds < b.config.MinExpirationSeconds {
+			message := fmt.Sprintf("expiration_seconds cannot be less than %d", b.config.MinExpirationSeconds)
+			return domain.Binding{}, apiresponses.NewFailureResponse(fmt.Errorf(message), http.StatusBadRequest, message)
+		}
 		expirationSeconds = parameters.ExpirationSeconds
 	}
 

internal/broker/bind_create_test.go

@@ -51,6 +51,8 @@ type User struct {
 }
 
 const expirationSeconds = 10000
+const maxExpirationSeconds = 7200
+const minExpirationSeconds = 600
 
 func TestCreateBindingEndpoint(t *testing.T) {
 	t.Log("test create binding endpoint")
@@ -153,7 +155,9 @@ func TestCreateBindingEndpoint(t *testing.T) {
 		BindablePlans: EnablePlans{
 			fixture.PlanName,
 		},
-		ExpirationSeconds: expirationSeconds,
+		ExpirationSeconds:    expirationSeconds,
+		MaxExpirationSeconds: maxExpirationSeconds,
+		MinExpirationSeconds: minExpirationSeconds,
 	}
 
 	//// api handler
@@ -234,6 +238,36 @@ func TestCreateBindingEndpoint(t *testing.T) {
 		require.NoError(t, err)
 		assert.Equal(t, customExpirationSeconds*time.Second, duration)
 	})
+	t.Run("should return error when expiration_seconds is greater than maxExpirationSeconds", func(t *testing.T) {
+		const customExpirationSeconds = 7201
+
+		// When
+		response := CallAPI(httpServer, method, "v2/service_instances/1/service_bindings/binding-id3?accepts_incomplete=true", fmt.Sprintf(`{
+  "service_id": "123",
+  "plan_id": "%s",
+  "parameters": {
+	"service_account": true,
+	"expiration_seconds": %v
+
+ }
+}`, fixture.PlanId, customExpirationSeconds), t)
+		require.Equal(t, http.StatusBadRequest, response.StatusCode)
+	})
+
+	t.Run("should return error when expiration_seconds is less than minExpirationSeconds", func(t *testing.T) {
+		const customExpirationSeconds = 60
+
+		// When
+		response := CallAPI(httpServer, method, "v2/service_instances/1/service_bindings/binding-id4?accepts_incomplete=true", fmt.Sprintf(`{
+  "service_id": "123",
+  "plan_id": "%s",
+  "parameters": {	
+	"service_account": true,
+	"expiration_seconds": %v
+}
+}`, fixture.PlanId, customExpirationSeconds), t)
+		require.Equal(t, http.StatusBadRequest, response.StatusCode)
+	})
 }
 
 func createKubeconfigFileForRestConfig(restConfig rest.Config) []byte {

resources/keb/templates/deployment.yaml

@@ -86,6 +86,12 @@ spec:
               value: "{{ .Values.cleaning.dryRun }}"
             - name: APP_BROKER_BINDING_ENABLED
               value: "{{ .Values.binding.enabled}}"
+            - name: APP_BROKER_BINDING_BINDABLE_PLANS
+              value: "{{ .Values.binding.bindablePlans}}"
+            - name: APP_BROKER_BINDING_EXPIRATION_SECONDS
+              value: "{{ .Values.binding.expirationSeconds}}"
+            - name: APP_BROKER_BINDING_MAX_EXPIRATION_SECONDS
+              value: "{{ .Values.binding.maxExpirationSeconds}}"
             - name: APP_BROKER_ONLY_SINGLE_TRIAL_PER_GA
               value: "{{ .Values.onlySingleTrialPerGA }}"
             - name: APP_BROKER_URL

resources/keb/values.yaml

@@ -250,6 +250,11 @@ broker:
 
 binding:
   enabled: false
+  bindablePlans: "aws"
+  expirationSeconds: 600
+  maxExpirationSeconds: 7200
+  # minExpirationSeconds can't be lower than 600 seconds. Forced by Gardener
+  minExpirationSeconds: 600
 
 service:
   type: ClusterIP