-
Notifications
You must be signed in to change notification settings - Fork 188
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* add pkg ansible-vault-go * implement ansible-vault (#169) * nolint:dupl --------- Co-authored-by: Mustafa YILDIRIM <[email protected]>
- Loading branch information
1 parent
e48635e
commit 358cd83
Showing
17 changed files
with
648 additions
and
21 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -8,3 +8,4 @@ todo.txt | |
| coverage.out | ||
| fixtures/sync/target.env | ||
| dist/ | ||
| .idea | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,133 @@ | ||
| package providers | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
| "sort" | ||
|
|
||
| "github.com/joho/godotenv" | ||
| vault "github.com/sosedoff/ansible-vault-go" | ||
| "github.com/spectralops/teller/pkg/core" | ||
| "github.com/spectralops/teller/pkg/logging" | ||
| ) | ||
|
|
||
| type AnsibleVaultClient interface { | ||
| Read(p string) (map[string]string, error) | ||
| } | ||
|
|
||
| type AnsibleVaultReader struct { | ||
| passPhrase string | ||
| } | ||
|
|
||
| func (a AnsibleVaultReader) Read(p string) (map[string]string, error) { | ||
| content, err := vault.DecryptFile(p, a.passPhrase) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
| return godotenv.Unmarshal(content) | ||
| } | ||
|
|
||
| type AnsibleVault struct { | ||
| logger logging.Logger | ||
| client AnsibleVaultClient | ||
| } | ||
|
|
||
| //nolint | ||
| func init() { | ||
| metaInto := core.MetaInfo{ | ||
| Description: "Ansible Vault", | ||
| Name: "ansible_vault", | ||
| Authentication: "ANSIBLE_VAULT_PASSPHRASE.", | ||
| ConfigTemplate: ` | ||
| # Configure via environment variables for integration: | ||
| # ANSIBLE_VAULT_PASSPHRASE: Ansible Vault Password | ||
| ansible_vault: | ||
| env_sync: | ||
| path: ansible/vars/vault_{{stage}}.yml | ||
| env: | ||
| KEY1: | ||
| path: ansible/vars/vault_{{stage}}.yml | ||
| NONEXIST_KEY: | ||
| path: ansible/vars/vault_{{stage}}.yml | ||
| `, | ||
| Ops: core.OpMatrix{Get: true, GetMapping: true, Put: false, PutMapping: false}, | ||
| } | ||
| RegisterProvider(metaInto, NewAnsibleVault) | ||
| } | ||
|
|
||
| // NewAnsibleVault creates new provider instance | ||
| func NewAnsibleVault(logger logging.Logger) (core.Provider, error) { | ||
| ansibleVaultPassphrase := os.Getenv("ANSIBLE_VAULT_PASSPHRASE") | ||
| return &AnsibleVault{ | ||
| logger: logger, | ||
| client: &AnsibleVaultReader{ | ||
| passPhrase: ansibleVaultPassphrase, | ||
| }, | ||
| }, nil | ||
| } | ||
|
|
||
| // Name return the provider name | ||
| func (a *AnsibleVault) Name() string { | ||
| return "AnsibleVault" | ||
| } | ||
|
|
||
| // Put will create a new single entry | ||
| func (a *AnsibleVault) Put(p core.KeyPath, val string) error { | ||
| return fmt.Errorf("provider %q does not implement write yet", a.Name()) | ||
| } | ||
|
|
||
| // PutMapping will create a multiple entries | ||
| func (a *AnsibleVault) PutMapping(p core.KeyPath, m map[string]string) error { | ||
| return fmt.Errorf("provider %q does not implement write yet", a.Name()) | ||
| } | ||
|
|
||
| // GetMapping returns a multiple entries | ||
| func (a *AnsibleVault) GetMapping(p core.KeyPath) ([]core.EnvEntry, error) { | ||
| // Read existing secret | ||
| a.logger.WithField("path", p.Path).Debug("read secret") | ||
| kvs, err := a.client.Read(p.Path) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| var entries []core.EnvEntry | ||
| for k, v := range kvs { | ||
| entries = append(entries, p.FoundWithKey(k, v)) | ||
| } | ||
| sort.Sort(core.EntriesByKey(entries)) | ||
|
|
||
| return entries, nil | ||
| } | ||
|
|
||
| // Get returns a single entry | ||
| func (a *AnsibleVault) Get(p core.KeyPath) (*core.EnvEntry, error) { //nolint:dupl | ||
| a.logger.WithField("path", p.Path).Debug("read secret") | ||
|
|
||
| kvs, err := a.client.Read(p.Path) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| k := p.EffectiveKey() | ||
| val, ok := kvs[k] | ||
| if !ok { | ||
| a.logger.WithFields(map[string]interface{}{"path": p.Path, "key": k}).Debug("key not found") | ||
| ent := p.Missing() | ||
| return &ent, nil | ||
| } | ||
|
|
||
| ent := p.Found(val) | ||
| return &ent, nil | ||
| } | ||
|
|
||
| // Delete will delete entry | ||
| func (a *AnsibleVault) Delete(kp core.KeyPath) error { | ||
| return fmt.Errorf("provider %s does not implement delete yet", a.Name()) | ||
| } | ||
|
|
||
| // DeleteMapping will delete the given path recessively | ||
| func (a *AnsibleVault) DeleteMapping(kp core.KeyPath) error { | ||
| return fmt.Errorf("provider %s does not implement delete yet", a.Name()) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| package providers | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/golang/mock/gomock" | ||
| "github.com/spectralops/teller/pkg/providers/mock_providers" | ||
| ) | ||
|
|
||
| func TestAnsibleVault(t *testing.T) { | ||
| ctrl := gomock.NewController(t) | ||
| defer ctrl.Finish() | ||
| client := mock_providers.NewMockAnsibleVaultClient(ctrl) | ||
| path := "settings/prod/billing-svc" | ||
| pathmap := "settings/prod/billing-svc/all" | ||
| out := map[string]string{ | ||
| "MG_KEY": "shazam", | ||
| "SMTP_PASS": "mailman", | ||
| } | ||
| client.EXPECT().Read(gomock.Eq(path)).Return(out, nil).AnyTimes() | ||
| client.EXPECT().Read(gomock.Eq(pathmap)).Return(out, nil).AnyTimes() | ||
|
|
||
| s := AnsibleVault{ | ||
| client: client, | ||
| logger: GetTestLogger(), | ||
| } | ||
| AssertProvider(t, &s, true) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.