Merge branch 'master' into context-authority
Mariano Cano
2 years ago
commit
26dd97e718
@ -0,0 +1,56 @@
|
||||
name: Bug Report
|
||||
description: File a bug report
|
||||
title: "[Bug]: "
|
||||
labels: ["bug", "needs triage"]
|
||||
body:
|
||||
- type: markdown
|
||||
attributes:
|
||||
value: |
|
||||
Thanks for taking the time to fill out this bug report!
|
||||
- type: textarea
|
||||
id: steps
|
||||
attributes:
|
||||
label: Steps to Reproduce
|
||||
description: Tell us how to reproduce this issue.
|
||||
placeholder: These are the steps!
|
||||
validations:
|
||||
required: true
|
||||
- type: textarea
|
||||
id: your-env
|
||||
attributes:
|
||||
label: Your Environment
|
||||
value: |-
|
||||
* OS -
|
||||
* `step-ca` Version -
|
||||
validations:
|
||||
required: true
|
||||
- type: textarea
|
||||
id: expected-behavior
|
||||
attributes:
|
||||
label: Expected Behavior
|
||||
description: What did you expect to happen?
|
||||
validations:
|
||||
required: true
|
||||
- type: textarea
|
||||
id: actual-behavior
|
||||
attributes:
|
||||
label: Actual Behavior
|
||||
description: What happens instead?
|
||||
validations:
|
||||
required: true
|
||||
- type: textarea
|
||||
id: context
|
||||
attributes:
|
||||
label: Additional Context
|
||||
description: Add any other context about the problem here.
|
||||
validations:
|
||||
required: false
|
||||
- type: textarea
|
||||
id: contributing
|
||||
attributes:
|
||||
label: Contributing
|
||||
value: |
|
||||
Vote on this issue by adding a 👍 reaction.
|
||||
To contribute a fix for this issue, leave a comment (and link to your pull request, if you've opened one already).
|
||||
validations:
|
||||
required: false
|
||||
@ -1,27 +0,0 @@
|
||||
---
|
||||
name: Bug report
|
||||
about: Create a report to help us improve
|
||||
title: ''
|
||||
labels: bug, needs triage
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
### Subject of the issue
|
||||
Describe your issue here.
|
||||
|
||||
### Your environment
|
||||
* OS -
|
||||
* Version -
|
||||
|
||||
### Steps to reproduce
|
||||
Tell us how to reproduce this issue. Please provide a working demo, you can use [this template](https://plnkr.co/edit/XorWgI?p=preview) as a base.
|
||||
|
||||
### Expected behaviour
|
||||
Tell us what should happen
|
||||
|
||||
### Actual behaviour
|
||||
Tell us what happens instead
|
||||
|
||||
### Additional context
|
||||
Add any other context about the problem here.
|
||||
@ -1,13 +1,24 @@
|
||||
---
|
||||
name: Enhancement
|
||||
about: Suggest an enhancement to step certificates
|
||||
about: Suggest an enhancement to step-ca
|
||||
title: ''
|
||||
labels: enhancement, needs triage
|
||||
assignees: ''
|
||||
|
||||
---
|
||||
|
||||
### What would you like to be added
|
||||
## Hello!
|
||||
<!-- Please leave this section as-is,
|
||||
it's designed to help others in the community know how to interact with our GitHub issues. -->
|
||||
|
||||
- Vote on this issue by adding a 👍 reaction
|
||||
- If you want to implement this feature, comment to let us know (we'll work with you on design, scheduling, etc.)
|
||||
|
||||
### Why this is needed
|
||||
## Issue details
|
||||
|
||||
<!-- Enhancement requests are most helpful when they describe the problem you're having
|
||||
as well as articulating the potential solution you'd like to see built. -->
|
||||
|
||||
## Why is this needed?
|
||||
|
||||
<!-- Let us know why you think this enhancement would be good for the project or community. -->
|
||||
|
||||
@ -0,0 +1,67 @@
|
||||
package approle
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/hashicorp/vault/api/auth/approle"
|
||||
)
|
||||
|
||||
// AuthOptions defines the configuration options added using the
|
||||
// VaultOptions.AuthOptions field when AuthType is approle
|
||||
type AuthOptions struct {
|
||||
RoleID string `json:"roleID,omitempty"`
|
||||
SecretID string `json:"secretID,omitempty"`
|
||||
SecretIDFile string `json:"secretIDFile,omitempty"`
|
||||
SecretIDEnv string `json:"secretIDEnv,omitempty"`
|
||||
IsWrappingToken bool `json:"isWrappingToken,omitempty"`
|
||||
}
|
||||
|
||||
func NewApproleAuthMethod(mountPath string, options json.RawMessage) (*approle.AppRoleAuth, error) {
|
||||
var opts *AuthOptions
|
||||
|
||||
err := json.Unmarshal(options, &opts)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("error decoding AppRole auth options: %w", err)
|
||||
}
|
||||
|
||||
var approleAuth *approle.AppRoleAuth
|
||||
|
||||
var loginOptions []approle.LoginOption
|
||||
if mountPath != "" {
|
||||
loginOptions = append(loginOptions, approle.WithMountPath(mountPath))
|
||||
}
|
||||
if opts.IsWrappingToken {
|
||||
loginOptions = append(loginOptions, approle.WithWrappingToken())
|
||||
}
|
||||
|
||||
if opts.RoleID == "" {
|
||||
return nil, errors.New("you must set roleID")
|
||||
}
|
||||
|
||||
var sid approle.SecretID
|
||||
switch {
|
||||
case opts.SecretID != "" && opts.SecretIDFile == "" && opts.SecretIDEnv == "":
|
||||
sid = approle.SecretID{
|
||||
FromString: opts.SecretID,
|
||||
}
|
||||
case opts.SecretIDFile != "" && opts.SecretID == "" && opts.SecretIDEnv == "":
|
||||
sid = approle.SecretID{
|
||||
FromFile: opts.SecretIDFile,
|
||||
}
|
||||
case opts.SecretIDEnv != "" && opts.SecretIDFile == "" && opts.SecretID == "":
|
||||
sid = approle.SecretID{
|
||||
FromEnv: opts.SecretIDEnv,
|
||||
}
|
||||
default:
|
||||
return nil, errors.New("you must set one of secretID, secretIDFile or secretIDEnv")
|
||||
}
|
||||
|
||||
approleAuth, err = approle.NewAppRoleAuth(opts.RoleID, &sid, loginOptions...)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("unable to initialize Kubernetes auth method: %w", err)
|
||||
}
|
||||
|
||||
return approleAuth, nil
|
||||
}
|
||||
@ -0,0 +1,195 @@
|
||||
package approle
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"testing"
|
||||
|
||||
vault "github.com/hashicorp/vault/api"
|
||||
)
|
||||
|
||||
func testCAHelper(t *testing.T) (*url.URL, *vault.Client) {
|
||||
t.Helper()
|
||||
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
switch {
|
||||
case r.RequestURI == "/v1/auth/approle/login":
|
||||
w.WriteHeader(http.StatusOK)
|
||||
fmt.Fprintf(w, `{
|
||||
"auth": {
|
||||
"client_token": "hvs.0000"
|
||||
}
|
||||
}`)
|
||||
case r.RequestURI == "/v1/auth/custom-approle/login":
|
||||
w.WriteHeader(http.StatusOK)
|
||||
fmt.Fprintf(w, `{
|
||||
"auth": {
|
||||
"client_token": "hvs.9999"
|
||||
}
|
||||
}`)
|
||||
default:
|
||||
w.WriteHeader(http.StatusNotFound)
|
||||
fmt.Fprintf(w, `{"error":"not found"}`)
|
||||
}
|
||||
}))
|
||||
t.Cleanup(func() {
|
||||
srv.Close()
|
||||
})
|
||||
u, err := url.Parse(srv.URL)
|
||||
if err != nil {
|
||||
srv.Close()
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
config := vault.DefaultConfig()
|
||||
config.Address = srv.URL
|
||||
|
||||
client, err := vault.NewClient(config)
|
||||
if err != nil {
|
||||
srv.Close()
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
return u, client
|
||||
}
|
||||
|
||||
func TestApprole_LoginMountPaths(t *testing.T) {
|
||||
caURL, _ := testCAHelper(t)
|
||||
|
||||
config := vault.DefaultConfig()
|
||||
config.Address = caURL.String()
|
||||
client, _ := vault.NewClient(config)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
mountPath string
|
||||
token string
|
||||
}{
|
||||
{
|
||||
name: "ok default mount path",
|
||||
mountPath: "",
|
||||
token: "hvs.0000",
|
||||
},
|
||||
{
|
||||
name: "ok explicit mount path",
|
||||
mountPath: "approle",
|
||||
token: "hvs.0000",
|
||||
},
|
||||
{
|
||||
name: "ok custom mount path",
|
||||
mountPath: "custom-approle",
|
||||
token: "hvs.9999",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
method, err := NewApproleAuthMethod(tt.mountPath, json.RawMessage(`{"RoleID":"roleID","SecretID":"secretID","IsWrappingToken":false}`))
|
||||
if err != nil {
|
||||
t.Errorf("NewApproleAuthMethod() error = %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
secret, err := client.Auth().Login(context.Background(), method)
|
||||
if err != nil {
|
||||
t.Errorf("Login() error = %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
token, _ := secret.TokenID()
|
||||
if token != tt.token {
|
||||
t.Errorf("Token error got %v, expected %v", token, tt.token)
|
||||
return
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestApprole_NewApproleAuthMethod(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
mountPath string
|
||||
raw string
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
"ok secret-id string",
|
||||
"",
|
||||
`{"RoleID": "0000-0000-0000-0000", "SecretID": "0000-0000-0000-0000"}`,
|
||||
false,
|
||||
},
|
||||
{
|
||||
"ok secret-id string and wrapped",
|
||||
"",
|
||||
`{"RoleID": "0000-0000-0000-0000", "SecretID": "0000-0000-0000-0000", "isWrappedToken": true}`,
|
||||
false,
|
||||
},
|
||||
{
|
||||
"ok secret-id string and wrapped with custom mountPath",
|
||||
"approle2",
|
||||
`{"RoleID": "0000-0000-0000-0000", "SecretID": "0000-0000-0000-0000", "isWrappedToken": true}`,
|
||||
false,
|
||||
},
|
||||
{
|
||||
"ok secret-id file",
|
||||
"",
|
||||
`{"RoleID": "0000-0000-0000-0000", "SecretIDFile": "./secret-id"}`,
|
||||
false,
|
||||
},
|
||||
{
|
||||
"ok secret-id env",
|
||||
"",
|
||||
`{"RoleID": "0000-0000-0000-0000", "SecretIDEnv": "VAULT_APPROLE_SECRETID"}`,
|
||||
false,
|
||||
},
|
||||
{
|
||||
"fail mandatory role-id",
|
||||
"",
|
||||
`{}`,
|
||||
true,
|
||||
},
|
||||
{
|
||||
"fail mandatory secret-id any",
|
||||
"",
|
||||
`{"RoleID": "0000-0000-0000-0000"}`,
|
||||
true,
|
||||
},
|
||||
{
|
||||
"fail multiple secret-id types id and env",
|
||||
"",
|
||||
`{"RoleID": "0000-0000-0000-0000", "SecretID": "0000-0000-0000-0000", "SecretIDEnv": "VAULT_APPROLE_SECRETID"}`,
|
||||
true,
|
||||
},
|
||||
{
|
||||
"fail multiple secret-id types id and file",
|
||||
"",
|
||||
`{"RoleID": "0000-0000-0000-0000", "SecretID": "0000-0000-0000-0000", "SecretIDFile": "./secret-id"}`,
|
||||
true,
|
||||
},
|
||||
{
|
||||
"fail multiple secret-id types env and file",
|
||||
"",
|
||||
`{"RoleID": "0000-0000-0000-0000", "SecretIDFile": "./secret-id", "SecretIDEnv": "VAULT_APPROLE_SECRETID"}`,
|
||||
true,
|
||||
},
|
||||
{
|
||||
"fail multiple secret-id types all",
|
||||
"",
|
||||
`{"RoleID": "0000-0000-0000-0000", "SecretID": "0000-0000-0000-0000", "SecretIDFile": "./secret-id", "SecretIDEnv": "VAULT_APPROLE_SECRETID"}`,
|
||||
true,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
_, err := NewApproleAuthMethod(tt.mountPath, json.RawMessage(tt.raw))
|
||||
if (err != nil) != tt.wantErr {
|
||||
t.Errorf("Approle.NewApproleAuthMethod() error = %v, wantErr %v", err, tt.wantErr)
|
||||
return
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@ -0,0 +1,49 @@
|
||||
package kubernetes
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"errors"
|
||||
"fmt"
|
||||
|
||||
"github.com/hashicorp/vault/api/auth/kubernetes"
|
||||
)
|
||||
|
||||
// AuthOptions defines the configuration options added using the
|
||||
// VaultOptions.AuthOptions field when AuthType is kubernetes
|
||||
type AuthOptions struct {
|
||||
Role string `json:"role,omitempty"`
|
||||
TokenPath string `json:"tokenPath,omitempty"`
|
||||
}
|
||||
|
||||
func NewKubernetesAuthMethod(mountPath string, options json.RawMessage) (*kubernetes.KubernetesAuth, error) {
|
||||
var opts *AuthOptions
|
||||
|
||||
err := json.Unmarshal(options, &opts)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("error decoding Kubernetes auth options: %w", err)
|
||||
}
|
||||
|
||||
var kubernetesAuth *kubernetes.KubernetesAuth
|
||||
|
||||
var loginOptions []kubernetes.LoginOption
|
||||
if mountPath != "" {
|
||||
loginOptions = append(loginOptions, kubernetes.WithMountPath(mountPath))
|
||||
}
|
||||
if opts.TokenPath != "" {
|
||||
loginOptions = append(loginOptions, kubernetes.WithServiceAccountTokenPath(opts.TokenPath))
|
||||
}
|
||||
|
||||
if opts.Role == "" {
|
||||
return nil, errors.New("you must set role")
|
||||
}
|
||||
|
||||
kubernetesAuth, err = kubernetes.NewKubernetesAuth(
|
||||
opts.Role,
|
||||
loginOptions...,
|
||||
)
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("unable to initialize Kubernetes auth method: %w", err)
|
||||
}
|
||||
|
||||
return kubernetesAuth, nil
|
||||
}
|
||||
@ -0,0 +1,149 @@
|
||||
package kubernetes
|
||||
|
||||
import (
|
||||
"context"
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"path"
|
||||
"path/filepath"
|
||||
"runtime"
|
||||
"testing"
|
||||
|
||||
vault "github.com/hashicorp/vault/api"
|
||||
)
|
||||
|
||||
func testCAHelper(t *testing.T) (*url.URL, *vault.Client) {
|
||||
t.Helper()
|
||||
|
||||
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
switch {
|
||||
case r.RequestURI == "/v1/auth/kubernetes/login":
|
||||
w.WriteHeader(http.StatusOK)
|
||||
fmt.Fprintf(w, `{
|
||||
"auth": {
|
||||
"client_token": "hvs.0000"
|
||||
}
|
||||
}`)
|
||||
case r.RequestURI == "/v1/auth/custom-kubernetes/login":
|
||||
w.WriteHeader(http.StatusOK)
|
||||
fmt.Fprintf(w, `{
|
||||
"auth": {
|
||||
"client_token": "hvs.9999"
|
||||
}
|
||||
}`)
|
||||
default:
|
||||
w.WriteHeader(http.StatusNotFound)
|
||||
fmt.Fprintf(w, `{"error":"not found"}`)
|
||||
}
|
||||
}))
|
||||
t.Cleanup(func() {
|
||||
srv.Close()
|
||||
})
|
||||
u, err := url.Parse(srv.URL)
|
||||
if err != nil {
|
||||
srv.Close()
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
config := vault.DefaultConfig()
|
||||
config.Address = srv.URL
|
||||
|
||||
client, err := vault.NewClient(config)
|
||||
if err != nil {
|
||||
srv.Close()
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
return u, client
|
||||
}
|
||||
|
||||
func TestApprole_LoginMountPaths(t *testing.T) {
|
||||
caURL, _ := testCAHelper(t)
|
||||
_, filename, _, _ := runtime.Caller(0)
|
||||
tokenPath := filepath.Join(path.Dir(filename), "token")
|
||||
|
||||
config := vault.DefaultConfig()
|
||||
config.Address = caURL.String()
|
||||
client, _ := vault.NewClient(config)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
mountPath string
|
||||
token string
|
||||
}{
|
||||
{
|
||||
name: "ok default mount path",
|
||||
mountPath: "",
|
||||
token: "hvs.0000",
|
||||
},
|
||||
{
|
||||
name: "ok explicit mount path",
|
||||
mountPath: "kubernetes",
|
||||
token: "hvs.0000",
|
||||
},
|
||||
{
|
||||
name: "ok custom mount path",
|
||||
mountPath: "custom-kubernetes",
|
||||
token: "hvs.9999",
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
method, err := NewKubernetesAuthMethod(tt.mountPath, json.RawMessage(`{"role": "SomeRoleName", "tokenPath": "`+tokenPath+`"}`))
|
||||
if err != nil {
|
||||
t.Errorf("NewApproleAuthMethod() error = %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
secret, err := client.Auth().Login(context.Background(), method)
|
||||
if err != nil {
|
||||
t.Errorf("Login() error = %v", err)
|
||||
return
|
||||
}
|
||||
|
||||
token, _ := secret.TokenID()
|
||||
if token != tt.token {
|
||||
t.Errorf("Token error got %v, expected %v", token, tt.token)
|
||||
return
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestApprole_NewApproleAuthMethod(t *testing.T) {
|
||||
_, filename, _, _ := runtime.Caller(0)
|
||||
tokenPath := filepath.Join(path.Dir(filename), "token")
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
mountPath string
|
||||
raw string
|
||||
wantErr bool
|
||||
}{
|
||||
{
|
||||
"ok secret-id string",
|
||||
"",
|
||||
`{"role": "SomeRoleName", "tokenPath": "` + tokenPath + `"}`,
|
||||
false,
|
||||
},
|
||||
{
|
||||
"fail mandatory role",
|
||||
"",
|
||||
`{}`,
|
||||
true,
|
||||
},
|
||||
}
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
_, err := NewKubernetesAuthMethod(tt.mountPath, json.RawMessage(tt.raw))
|
||||
if (err != nil) != tt.wantErr {
|
||||
t.Errorf("Kubernetes.NewKubernetesAuthMethod() error = %v, wantErr %v", err, tt.wantErr)
|
||||
return
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
@ -0,0 +1 @@
|
||||
token
|
||||
Loading…
Reference in New Issue