-
Notifications
You must be signed in to change notification settings - Fork 74
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* feat: add conjur provider Signed-off-by: Antoine Miquel <[email protected]> Signed-off-by: antoinemiquel <[email protected]>
- Loading branch information
1 parent
9548bcc
commit b752901
Showing
7 changed files
with
271 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,91 @@ | ||
| package conjur | ||
|
|
||
| import ( | ||
| "fmt" | ||
| "os" | ||
|
|
||
| "github.com/cyberark/conjur-api-go/conjurapi" | ||
| "github.com/cyberark/conjur-api-go/conjurapi/authn" | ||
|
|
||
| "github.com/helmfile/vals/pkg/api" | ||
| "github.com/helmfile/vals/pkg/log" | ||
| ) | ||
|
|
||
| type provider struct { | ||
| client *conjurapi.Client | ||
| log *log.Logger | ||
|
|
||
| Address string | ||
| Account string | ||
| Login string | ||
| Apikey string | ||
| } | ||
|
|
||
| func New(l *log.Logger, cfg api.StaticConfig) *provider { | ||
| p := &provider{ | ||
| log: l, | ||
| } | ||
| p.Address = cfg.String("address") | ||
| if p.Address == "" { | ||
| p.Address = os.Getenv("CONJUR_APPLIANCE_URL") | ||
| } | ||
| p.Account = cfg.String("account") | ||
| if p.Account == "" { | ||
| p.Account = os.Getenv("CONJUR_ACCOUNT") | ||
| } | ||
| p.Login = cfg.String("login") | ||
| if p.Login == "" { | ||
| p.Login = os.Getenv("CONJUR_AUTHN_LOGIN") | ||
| } | ||
| p.Apikey = cfg.String("apikey") | ||
| if p.Apikey == "" { | ||
| p.Apikey = os.Getenv("CONJUR_AUTHN_API_KEY") | ||
| } | ||
|
|
||
| return p | ||
| } | ||
|
|
||
| func (p *provider) GetString(varId string) (string, error) { | ||
| cli, err := p.ensureClient() | ||
| if err != nil { | ||
| return "", fmt.Errorf("cannot create Conjur Client: %v", err) | ||
| } | ||
|
|
||
| secretValue, err := cli.RetrieveSecret(varId) | ||
| if err != nil { | ||
| return "", fmt.Errorf("no variable found for path %q", varId) | ||
| } | ||
|
|
||
| return string(secretValue), nil | ||
| } | ||
|
|
||
| func (p *provider) GetStringMap(path string) (map[string]interface{}, error) { | ||
| return nil, fmt.Errorf("this provider does not support values from URI fragments") | ||
| } | ||
|
|
||
| func (p *provider) ensureClient() (*conjurapi.Client, error) { | ||
| if p.client == nil { | ||
| config, err := conjurapi.LoadConfig() | ||
| if err != nil { | ||
| p.log.Debugf("conjur: cannot get conjur config") | ||
| return nil, err | ||
| } | ||
|
|
||
| config.ApplianceURL = p.Address | ||
| config.Account = p.Account | ||
|
|
||
| cli, err := conjurapi.NewClientFromKey(config, | ||
| authn.LoginPair{ | ||
| Login: p.Login, | ||
| APIKey: p.Apikey, | ||
| }, | ||
| ) | ||
| if err != nil { | ||
| p.log.Debugf("conjur: connection failed") | ||
| return nil, err | ||
| } | ||
|
|
||
| p.client = cli | ||
| } | ||
| return p.client, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,134 @@ | ||
| package conjur | ||
|
|
||
| import ( | ||
| "testing" | ||
|
|
||
| "github.com/cyberark/conjur-api-go/conjurapi" | ||
| "github.com/stretchr/testify/assert" | ||
|
|
||
| "github.com/helmfile/vals/pkg/config" | ||
| "github.com/helmfile/vals/pkg/log" | ||
| ) | ||
|
|
||
| func Test_New(t *testing.T) { | ||
| testsConfig := []struct { | ||
| name string | ||
| options map[string]interface{} | ||
| envVars map[string]string | ||
| want *provider | ||
| }{ | ||
| { | ||
| name: "onlyConf", | ||
| options: map[string]interface{}{ | ||
| "address": "http://127.0.0.1", | ||
| "account": "myAccount", | ||
| "login": "user", | ||
| "apikey": "pass", | ||
| }, | ||
| envVars: map[string]string{}, | ||
| want: &provider{ | ||
| log: log.New(log.Config{}), | ||
| Address: "http://127.0.0.1", | ||
| Account: "myAccount", | ||
| Login: "user", | ||
| Apikey: "pass", | ||
| }, | ||
| }, | ||
| { | ||
| name: "onlyEnvVars", | ||
| options: map[string]interface{}{}, | ||
| envVars: map[string]string{ | ||
| "CONJUR_APPLIANCE_URL": "http://127.0.0.1", | ||
| "CONJUR_ACCOUNT": "myAccount", | ||
| "CONJUR_AUTHN_LOGIN": "user", | ||
| "CONJUR_AUTHN_API_KEY": "pass", | ||
| }, | ||
| want: &provider{ | ||
| log: log.New(log.Config{}), | ||
| Address: "http://127.0.0.1", | ||
| Account: "myAccount", | ||
| Login: "user", | ||
| Apikey: "pass", | ||
| }, | ||
| }, | ||
| { | ||
| name: "mixConfigAndEnvVars", | ||
| options: map[string]interface{}{ | ||
| "address": "http://127.0.0.1", | ||
| "account": "myAccount", | ||
| "login": "user", | ||
| "apikey": "pass", | ||
| }, | ||
| envVars: map[string]string{ | ||
| "CONJUR_APPLIANCE_URL": "http://192.168.0.10", | ||
| "CONJUR_ACCOUNT": "myAccount2", | ||
| "CONJUR_AUTHN_LOGIN": "user2", | ||
| "CONJUR_AUTHN_API_KEY": "pass2", | ||
| }, | ||
| want: &provider{ | ||
| log: log.New(log.Config{}), | ||
| Address: "http://127.0.0.1", | ||
| Account: "myAccount", | ||
| Login: "user", | ||
| Apikey: "pass", | ||
| }, | ||
| }, | ||
| } | ||
|
|
||
| for _, tt := range testsConfig { | ||
| t.Run(tt.name, func(t *testing.T) { | ||
| conf := config.Map(tt.options) | ||
| logger := log.New(log.Config{}) | ||
|
|
||
| for k, v := range tt.envVars { | ||
| t.Setenv(k, v) | ||
| } | ||
|
|
||
| p := New(logger, conf) | ||
|
|
||
| assert.EqualValues(t, tt.want, p) | ||
|
|
||
| // cleanup envVars | ||
| for k := range tt.envVars { | ||
| t.Setenv(k, "") | ||
| } | ||
| }) | ||
| } | ||
| } | ||
|
|
||
| func Test_GetStringMap(t *testing.T) { | ||
| options := map[string]interface{}{ | ||
| "address": "http://127.0.0.1", | ||
| "account": "myAccount", | ||
| "login": "user", | ||
| "apikey": "pass", | ||
| } | ||
| conf := config.Map(options) | ||
| logger := log.New(log.Config{}) | ||
|
|
||
| p := New(logger, conf) | ||
|
|
||
| mapRes, err := p.GetStringMap("somePath") | ||
|
|
||
| assert.Empty(t, mapRes) | ||
| assert.Error(t, err) | ||
| } | ||
|
|
||
| func Test_ensureClient(t *testing.T) { | ||
| options := map[string]interface{}{ | ||
| "address": "http://127.0.0.1", | ||
| "account": "myAccount", | ||
| "login": "user", | ||
| "apikey": "pass", | ||
| } | ||
| conf := config.Map(options) | ||
| logger := log.New(log.Config{}) | ||
|
|
||
| p := New(logger, conf) | ||
| p.client = &conjurapi.Client{} | ||
|
|
||
| cli, err := p.ensureClient() | ||
|
|
||
| assert.Equal(t, p.client, cli) | ||
| assert.NoError(t, err) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.