azure.storage.blob._shared.authentication.AzureSigningError: 错误的填充 – Argo 工作流

huangapple
go评论132阅读模式
英文:

azure.storage.blob._shared.authentication.AzureSigningError: Incorrect padding - Argo workflow

问题

我在配置Argo工作流以从我的Flask应用程序运行Python函数来每天更新用户组列表时遇到了“Incorrect padding”错误。以下是错误日志和配置详细信息供参考。

错误信息：

  1. Traceback (most recent call last):
  2.   File "/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/authentication.py", line 129, in _add_authorization_header
  3.     signature = sign_string(self.account_key, string_to_sign)
  4.   File "/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/__init__.py", line 45, in sign_string
  5.     key = decode_base64_to_bytes(key)
  6.   File "/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/__init__.py", line 35, in decode_base64_to_bytes
  7.     return base64.b64decode(data)
  8.   File "/usr/local/lib/python3.9/base64.py", line 87, in b64decode
  9.     return binascii.a2b_base64(s)
  10. binascii.Error: Incorrect padding
  12. ...
  14. azure.storage.blob._shared.authentication.AzureSigningError: Incorrect padding
  15. time="2023-07-24T08:59:03.472Z" level=info msg="sub-process exited" argo=true error="<nil>"
  16. Error: exit status 1

这是我的argo_workflow配置：

  1. apiVersion: argoproj.io/v1alpha1
  2. kind: Workflow
  3. metadata:
  4.   name: argo-aad
  5. spec:
  6.   entrypoint: aad-groups
  7.   templates:
  8.     - name: aad-groups
  9.       container:
  10.         image: ***.azurecr.io/image:latest
  11.         env:
  12.          - name: sql_db_key
  13.            valueFrom:
  14.              secretKeyRef:
  15.                name: sqldbkey
  16.                key: key
  17.          - name: storage_key
  18.            valueFrom:
  19.              secretKeyRef:
  20.                name: storagekey
  21.                key: key
  22.          - name: client_secret
  23.            valueFrom:
  24.              secretKeyRef:
  25.                name: clientsecret
  26.                key: key
  27.          - name: client_id
  28.            valueFrom:
  29.              secretKeyRef:
  30.                name: clientid
  31.                key: key
  32.          - name: directory_tenant_id
  33.            valueFrom:
  34.              secretKeyRef:
  35.                name: directorytenantid
  36.                key: key
  37.         command: ["python", "-c"]
  38.         args: ["import ***.aad as gaad; gaad.aad_groups('sql_db_key', 'storage_key', 'client_secret', 'client_id', 'directory_tenant_id')"]

我已经使用以下命令创建了所有参数的密钥，并传递了值。

  1. kubectl create secret generic storagekey --from-literal=key=****************************************==

请问有什么建议？

英文:

I'm getting Incorrect padding error while configuring a argo workflow to run a python function from my flask application to update the users group list everyday. Attached error logs and configuration details for the reference.

  1. Error:
  3. Traceback (most recent call last):
  4.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/authentication.py&quot;, line 129, in _add_authorization_header
  5.     signature = sign_string(self.account_key, string_to_sign)
  6.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/__init__.py&quot;, line 45, in sign_string
  7.     key = decode_base64_to_bytes(key)
  8.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/__init__.py&quot;, line 35, in decode_base64_to_bytes
  9.     return base64.b64decode(data)
  10.   File &quot;/usr/local/lib/python3.9/base64.py&quot;, line 87, in b64decode
  11.     return binascii.a2b_base64(s)
  12. binascii.Error: Incorrect padding
  14. During handling of the above exception, another exception occurred:
  16. Traceback (most recent call last):
  17.   File &quot;&lt;string&gt;&quot;, line 1, in &lt;module&gt;
  18.   File &quot;/usr/local/lib/python3.9/site-packages/***/aad.py&quot;, line 76, in aad_groups
  19.     aad_groups = cr_blob.read_blob(&#39;***&#39;, storage_key, &#39;aad&#39;, &#39;aad_groups.csv&#39;)
  20.   File &quot;/usr/local/lib/python3.9/site-packages/***/data/blob.py&quot;, line 86, in read_blob
  21.     blob_data = pd.read_csv(blob.download_blob())
  22.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/tracing/decorator.py&quot;, line 78, in wrapper_use_tracer
  23.     return func(*args, **kwargs)
  24.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_blob_client.py&quot;, line 914, in download_blob
  25.     return StorageStreamDownloader(**options)
  26.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_download.py&quot;, line 366, in __init__
  27.     self._response = self._initial_request()
  28.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_download.py&quot;, line 466, in _initial_request
  29.     process_storage_error(error)
  30.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/response_handlers.py&quot;, line 97, in process_storage_error
  31.     raise storage_error
  32.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_download.py&quot;, line 418, in _initial_request
  33.     location_mode, response = self._clients.blob.download(
  34.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/tracing/decorator.py&quot;, line 78, in wrapper_use_tracer
  35.     return func(*args, **kwargs)
  36.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_generated/operations/_blob_operations.py&quot;, line 1592, in download
  37.     pipeline_response = self._client._pipeline.run(  # type: ignore # pylint: disable=protected-access
  38.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/pipeline/_base.py&quot;, line 211, in run
  39.     return first_node.send(pipeline_request)  # type: ignore
  40.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/pipeline/_base.py&quot;, line 71, in send
  41.     response = self.next.send(request)
  42.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/pipeline/_base.py&quot;, line 71, in send
  43.     response = self.next.send(request)
  44.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/pipeline/_base.py&quot;, line 71, in send
  45.     response = self.next.send(request)
  46.   [Previous line repeated 2 more times]
  47.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/pipeline/policies/_redirect.py&quot;, line 158, in send
  48.     response = self.next.send(request)
  49.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/pipeline/_base.py&quot;, line 71, in send
  50.     response = self.next.send(request)
  51.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/policies.py&quot;, line 546, in send
  52.     raise err
  53.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/policies.py&quot;, line 520, in send
  54.     response = self.next.send(request)
  55.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/pipeline/_base.py&quot;, line 71, in send
  56.     response = self.next.send(request)
  57.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/pipeline/_base.py&quot;, line 71, in send
  58.     response = self.next.send(request)
  59.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/pipeline/_base.py&quot;, line 69, in send
  60.     _await_result(self._policy.on_request, request)
  61.   File &quot;/usr/local/lib/python3.9/site-packages/azure/core/pipeline/_tools.py&quot;, line 34, in await_result
  62.     result = func(*args, **kwargs)
  63.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/authentication.py&quot;, line 152, in on_request
  64.     self._add_authorization_header(request, string_to_sign)
  65.   File &quot;/usr/local/lib/python3.9/site-packages/azure/storage/blob/_shared/authentication.py&quot;, line 135, in _add_authorization_header
  66.     raise _wrap_exception(ex, AzureSigningError)
  67. azure.storage.blob._shared.authentication.AzureSigningError: Incorrect padding
  68. time=&quot;2023-07-24T08:59:03.472Z&quot; level=info msg=&quot;sub-process exited&quot; argo=true error=&quot;&lt;nil&gt;&quot;
  69. Error: exit status 1

And here is my argo_workflow config:

  1. apiVersion: argoproj.io/v1alpha1
  2. kind: Workflow                  
  3. metadata:
  4.   name: argo-aad
  5. spec:
  6.   entrypoint: aad-groups          
  7.   templates:
  8.     - name: aad-groups             
  9.       container:
  10.         image: ***.azurecr.io/image:latest
  11.         env:
  12.          - name: sql_db_key
  13.            valueFrom:
  14.              secretKeyRef:
  15.                name: sqldbkey
  16.                key: key
  17.          - name: storage_key
  18.            valueFrom:
  19.              secretKeyRef:
  20.                name: storagekey
  21.                key: key
  22.          - name: client_secret
  23.            valueFrom:
  24.              secretKeyRef:
  25.                name: clientsecret
  26.                key: key
  27.          - name: client_id
  28.            valueFrom:
  29.              secretKeyRef:
  30.                name: clientid
  31.                key: key
  32.          - name: directory_tenant_id
  33.            valueFrom:
  34.              secretKeyRef:
  35.                name: directorytenantid
  36.                key: key
  37.         command: [&quot;python&quot;, &quot;-c&quot;]
  38.         args: [&quot;import ***.aad as gaad; gaad.aad_groups(&#39;sql_db_key&#39;, &#39;storage_key&#39;, &#39;client_secret&#39;, &#39;client_id&#39;, &#39;directory_tenant_id&#39;)&quot;]

I have created all the secrets for the parameters using below command and passing the values.

kubectl create secret generic storagekey --from-literal=key=****************************************==

Any advise please?

答案1

得分: 0

>binascii.Error: 错误的填充

"错误的填充" 通常指的是在解码一个 base64 编码的字符串过程中出现的数据损坏或解密问题。这会发生在用于身份验证的凭据（如帐户密钥或 SAS 令牌）不正确或损坏时。

  • 您正在直接将密钥作为字符串传递，而不是引用密钥的值。您应该引用密钥的实际值。
  1. args: ["import ***.aad as gaad; gaad.aad_groups(
  2.     '{{inputs.parameters.sql_db_key}}', 
  3.     '{{inputs.parameters.storage_key}}', 
  4.     '{{inputs.parameters.client_secret}}', 
  5.     '{{inputs.parameters.client_id}}', 
  6.     '{{inputs.parameters.directory_tenant_id}}'
  7. )"]

同时，将字符串 &#39;sql_db_key&#39; 作为参数传递是不正确的。相反，您应该传递密钥的实际值，因为变量名正在使用。

  • 在使用 kubectl create secret generic 创建密钥时，请检查您为密钥传递的值是否已进行了 base64 编码。

echo -n "your-secret-value" | base64

  • 在工作流模板中替换 args 字段，将密钥的值直接传递给 Python 脚本，而不是传递密钥的名称。

Args 字段:

  1. args: ["import ***.aad as gaad; gaad.aad_groups('{}', '{}', '{}', '{}', '{}')".format(sql_db_key, storage_key, client_secret, client_id, directory_tenant_id)]
英文:

>binascii.Error: Incorrect padding

"Incorrect padding" usually points to a data corruption or decryption issue that occurs during the process of decoding a base64-encoded string. It occurs when the credentials (like account key or SAS token) you're using for authentication are incorrect or corrupted.

  • You are passing the secret keys directly as strings instead of referencing the values of the secrets. You should reference the secret values instead.
  1. args: [&quot;import ***.aad as gaad; gaad.aad_groups(
  2.     &#39;{{inputs.parameters.sql_db_key}}&#39;, 
  3.     &#39;{{inputs.parameters.storage_key}}&#39;, 
  4.     &#39;{{inputs.parameters.client_secret}}&#39;, 
  5.     &#39;{{inputs.parameters.client_id}}&#39;, 
  6.     &#39;{{inputs.parameters.directory_tenant_id}}&#39;
  7. )&quot;]

Also, pass the string &#39;sql_db_key&#39; as an argument. Instead, you should pass the actual value of the secret, as the variable name is being used.

  • When creating secrets using kubectl create secret generic, check that the value you are passing for the key is base64-encoded.

echo -n &quot;your-secret-value&quot; | base64

  • Replace the args field in the workflow template to pass the values of the secrets directly to the Python script, instead of passing the secret names.

Args field:

  1. args: [&quot;import ***.aad as gaad; gaad.aad_groups(&#39;{}&#39;, &#39;{}&#39;, &#39;{}&#39;, &#39;{}&#39;, &#39;{}&#39;)&quot;.format(sql_db_key, storage_key, client_secret, client_id, directory_tenant_id)]

huangapple
  • 本文由 发表于 2023年7月24日 17:30:34
  • 转载请务必保留本文链接：https://go.coder-hub.com/76753111.html
  • argo-workflows
  • azure
  • azure-aks
  • azure-blob-storage
  • python
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定