Provide custom node secret attributes

This allows for confluent to pass node secret data through.

confluent_server/confluent/config/configmanager.py

@@ -136,7 +136,7 @@ def attrib_supports_expression(attrib):
     if not isinstance(attrib, str):
         attrib = attrib.decode('utf8')
     attrib = _attraliases.get(attrib, attrib)
-    if attrib.startswith('secret.') or attrib.startswith('crypted.'):
+    if attrib.startswith('secret.') or attrib.startswith('crypted.') or attrib.startswith('custom.nodesecret.'):
         return False
     return True
 
@@ -1108,6 +1108,10 @@ class _ExpressionFormat(string.Formatter):
             field_name = val
         parsed = ast.parse(field_name)
         val = self._handle_ast_node(parsed.body[0].value)
+        try:
+            val = int(val)
+        except Exception:
+            pass
         return format(val, format_spec)
 
     def _handle_ast_node(self, node):
@@ -1373,7 +1377,7 @@ class ConfigManager(object):
             attribute, match = expression.split('=')
         else:
             raise Exception('Invalid Expression')
-        if attribute.startswith('secret.'):
+        if attribute.startswith('secret.') or attribute.startswith('custom.nodesecret.'):
             raise Exception('Filter by secret attributes is not supported')
         if attribute_name_is_invalid(attribute):
             raise ValueError(
@@ -2023,10 +2027,10 @@ class ConfigManager(object):
                     newdict = {'value': attribmap[group][attr]}
                 else:
                     newdict = attribmap[group][attr]
-                if keydata and attr.startswith('secret.') and 'cryptvalue' in newdict:
+                if keydata and (attr.startswith('secret.') or attr.startswith('custom.nodesecret.')) and 'cryptvalue' in newdict:
                     newdict['value'] = decrypt_value(newdict['cryptvalue'], keydata['cryptkey'], keydata['integritykey'])
                     del newdict['cryptvalue']
-                if 'value' in newdict and attr.startswith("secret."):
+                if 'value' in newdict and (attr.startswith('secret.') or attr.startswith('custom.nodesecret.')):
                     newdict['cryptvalue'] = crypt_value(newdict['value'])
                     del newdict['value']
                 if 'value' in newdict and attr.startswith("crypted."):
@@ -2485,10 +2489,10 @@ class ConfigManager(object):
                 # add check here, skip None attributes
                 if newdict is None:
                     continue
-                if keydata and attrname.startswith('secret.') and 'cryptvalue' in newdict:
+                if keydata and (attrname.startswith('secret.') or attrname.startswith('custom.nodesecret.')) and 'cryptvalue' in newdict:
                     newdict['value'] = decrypt_value(newdict['cryptvalue'], keydata['cryptkey'], keydata['integritykey'])
                     del newdict['cryptvalue']
-                if 'value' in newdict and attrname.startswith("secret."):
+                if 'value' in newdict and (attrname.startswith('secret.') or attrname.startswith('custom.nodesecret.')):
                     newdict['cryptvalue'] = crypt_value(newdict['value'])
                     del newdict['value']
                 if 'value' in newdict and attrname.startswith("crypted."):

confluent_server/confluent/httpapi.py

@@ -97,7 +97,7 @@ def group_creation_resources():
     for attr in sorted(attribs.node):
         if attr == 'groups':
             continue
-        if attr.startswith("secret."):
+        if attr.startswith('secret.') or attr.startswith('custom.nodesecret.'):
             yield confluent.messages.CryptedAttributes(
                 kv={attr: None},
                 desc=attribs.node[attr]['description']).html() + '<br>\n'
@@ -116,7 +116,7 @@ def node_creation_resources():
     yield confluent.messages.Attributes(
         kv={'name': None}, desc="Name of the node").html() + '<br>'
     for attr in sorted(attribs.node):
-        if attr.startswith("secret."):
+        if attr.startswith('secret.') or attr.startswith('custom.nodesecret.'):
             yield confluent.messages.CryptedAttributes(
                 kv={attr: None},
                 desc=attribs.node[attr]['description']).html() + '<br>\n'

confluent_server/confluent/plugins/configuration/attributes.py

@@ -59,7 +59,7 @@ def retrieve_nodegroup(nodegroup, element, configmanager, inputdata, clearwarnby
                 val['desc'] = 'The noderange this group is expanded ' \
                     'to when used in noderange, exclusive with static ' \
                     'nodes'
-            if attribute.startswith('secret.') or attribute.startswith('crypted.'):
+            if attribute.startswith('secret.') or attribute.startswith('crypted.') or attribute.startswith('custom.nodesecret.'):
                 yield msg.CryptedAttributes(
                     kv={attribute: val},
                     desc=allattributes.node[attribute]['description'])
@@ -121,7 +121,7 @@ def retrieve_nodes(nodes, element, configmanager, inputdata, clearwarnbynode):
                     val = []
                 else:  # no setting, provide a blank
                     val = {'value': None}
-                if attribute.startswith('secret.') or attribute.startswith('crypted.'):
+                if attribute.startswith('secret.') or attribute.startswith('crypted.') or attribute.startswith('custom.nodesecret.'):
                     yield msg.CryptedAttributes(
                         node, {attribute: val},
                         allattributes.node.get(

confluent_server/confluent/selfservice.py

@@ -262,12 +262,14 @@ def handle_request(env, start_response):
         start_response('200 OK', (('Content-Type', retype),))
         yield dumper(res)
     elif env['PATH_INFO'] == '/self/myattribs':
-        cfd = cfg.get_node_attributes(nodename, '*').get(nodename, {})
+        cfd = cfg.get_node_attributes(nodename, '*', decrypt=True).get(nodename, {})
         rsp = {}
         for k in cfd:
             if k.startswith('secret') or k.startswith('crypt') or 'value' not in cfd[k] or not cfd[k]['value']:
                 continue
             rsp[k] = cfd[k]['value']
+            if isinstance(rsp[k], bytes):
+                rsp[k] = rsp[k].decode()
         start_response('200 OK', (('Conntent-Type', retype),))
         yield dumper(rsp)
     elif env['PATH_INFO'] == '/self/netcfg':