mirror of
https://github.com/external-secrets/external-secrets.git
synced 2024-12-15 17:51:01 +00:00
a5ddd97c21
* chore: update go version of the project to 1.23 Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> * fixed an absurd amount of linter issues Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com> --------- Signed-off-by: Gergely Brautigam <182850+Skarlso@users.noreply.github.com>
93 lines
2.6 KiB
Go
93 lines
2.6 KiB
Go
/*
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
*/
|
|
|
|
package vault
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"fmt"
|
|
"strings"
|
|
|
|
esv1beta1 "github.com/external-secrets/external-secrets/apis/externalsecrets/v1beta1"
|
|
"github.com/external-secrets/external-secrets/pkg/constants"
|
|
"github.com/external-secrets/external-secrets/pkg/metrics"
|
|
"github.com/external-secrets/external-secrets/pkg/utils/resolvers"
|
|
)
|
|
|
|
const (
|
|
errJwtNoTokenSource = "neither `secretRef` nor `kubernetesServiceAccountToken` was supplied as token source for jwt authentication"
|
|
)
|
|
|
|
func setJwtAuthToken(ctx context.Context, v *client) (bool, error) {
|
|
jwtAuth := v.store.Auth.Jwt
|
|
if jwtAuth != nil {
|
|
err := v.requestTokenWithJwtAuth(ctx, jwtAuth)
|
|
if err != nil {
|
|
return true, err
|
|
}
|
|
return true, nil
|
|
}
|
|
return false, nil
|
|
}
|
|
|
|
func (c *client) requestTokenWithJwtAuth(ctx context.Context, jwtAuth *esv1beta1.VaultJwtAuth) error {
|
|
role := strings.TrimSpace(jwtAuth.Role)
|
|
var jwt string
|
|
var err error
|
|
if jwtAuth.SecretRef != nil {
|
|
jwt, err = resolvers.SecretKeyRef(ctx, c.kube, c.storeKind, c.namespace, jwtAuth.SecretRef)
|
|
} else if k8sServiceAccountToken := jwtAuth.KubernetesServiceAccountToken; k8sServiceAccountToken != nil {
|
|
audiences := k8sServiceAccountToken.Audiences
|
|
if audiences == nil {
|
|
audiences = &[]string{"vault"}
|
|
}
|
|
expirationSeconds := k8sServiceAccountToken.ExpirationSeconds
|
|
if expirationSeconds == nil {
|
|
tmp := int64(600)
|
|
expirationSeconds = &tmp
|
|
}
|
|
jwt, err = createServiceAccountToken(
|
|
ctx,
|
|
c.corev1,
|
|
c.storeKind,
|
|
c.namespace,
|
|
k8sServiceAccountToken.ServiceAccountRef,
|
|
*audiences,
|
|
*expirationSeconds)
|
|
} else {
|
|
err = errors.New(errJwtNoTokenSource)
|
|
}
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
parameters := map[string]any{
|
|
"role": role,
|
|
"jwt": jwt,
|
|
}
|
|
url := strings.Join([]string{"auth", jwtAuth.Path, "login"}, "/")
|
|
vaultResult, err := c.logical.WriteWithContext(ctx, url, parameters)
|
|
metrics.ObserveAPICall(constants.ProviderHCVault, constants.CallHCVaultWriteSecretData, err)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
token, err := vaultResult.TokenID()
|
|
if err != nil {
|
|
return fmt.Errorf(errVaultToken, err)
|
|
}
|
|
c.client.SetToken(token)
|
|
return nil
|
|
}
|