-
Notifications
You must be signed in to change notification settings - Fork 4.4k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
support vault auth config for alicloud ca provider
Add support for using existing vault auto-auth configurations as the provider configuration when using Vault's CA provider with AliCloud. AliCloud requires 2 extra fields to enable it to use STS (it's preferred auth setup). Our vault-plugin-auth-alicloud package contained a method to help generate them as they require you to make an http call to a faked endpoint proxy to get them (url and headers base64 encoded).
- Loading branch information
Showing
7 changed files
with
165 additions
and
15 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| ```release-note:improvement | ||
| ca: support Vault agent auto-auth config for Vault CA provider using AliCloud authentication. | ||
| ``` |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| package ca | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/aliyun/alibaba-cloud-sdk-go/sdk/auth/credentials/providers" | ||
| "github.com/hashicorp/consul/agent/structs" | ||
| "github.com/hashicorp/vault-plugin-auth-alicloud/tools" | ||
| ) | ||
|
|
||
| func NewAliCloudAuthClient(authMethod *structs.VaultAuthMethod) *VaultAuthClient { | ||
| client := NewVaultAPIAuthClient(authMethod, "") | ||
| client.LoginDataGen = AliLoginDataGen | ||
| return client | ||
| } | ||
|
|
||
| func AliLoginDataGen(authMethod *structs.VaultAuthMethod) (map[string]any, error) { | ||
| role, ok := authMethod.Params["role"].(string) | ||
| if !ok { | ||
| return nil, fmt.Errorf("role is required for AliCloud login") | ||
| } | ||
| region, ok := authMethod.Params["region"].(string) | ||
| if !ok { | ||
| return nil, fmt.Errorf("region is required for AliCloud login") | ||
| } | ||
| // Credentials can be provided either explicitly via env vars, | ||
| // or we will try to derive them from instance metadata. | ||
| credentialChain := []providers.Provider{ | ||
| providers.NewEnvCredentialProvider(), | ||
| providers.NewInstanceMetadataProvider(), | ||
| } | ||
| creds, err := providers.NewChainProvider(credentialChain).Retrieve() | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| loginData, err := tools.GenerateLoginData(role, creds, region) | ||
| if err != nil { | ||
| return nil, err | ||
| } | ||
|
|
||
| return loginData, nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters