confidante 0.28.0.pre.13 → 0.28.0.pre.16

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f6a9c4e82dcf2195dba2d6bd9d93af2f0e6b84222b9536bda2f888a097076851
-  data.tar.gz: b18f17998406440b3a075a4393399148cbda3fea00e56e36ab5d4ef30f192d7c
+  metadata.gz: f227c07f069e181681816cc7489b858e84902900d7c19f31b5ba99449f6e431b
+  data.tar.gz: b0d0e7a23a56b82c86a26aedad88b03f12ae92a08a8a6d670cd6929916c15c79
 SHA512:
-  metadata.gz: 366c98cff98776df6b7a9577da69a97f36b7b96106c4345073521e26c24289a93207152e9e35ba7aa1043520b52579639e5bcf019a916ed6d266a0427c3a1686
-  data.tar.gz: 173105f8ee23c22b82665947fd02cc0cc7ccc282b788c4d68a175aa8125494aea943fcc9c156b3a76a483ffba028c1c7740e7b1c9ae9d2a082cc9dd87ae9b5c7
+  metadata.gz: 83b32114eccd28d13653e36afe295828adf3def314aa33d21da2665e237021c74128b852c7244a273cedfa880bcd2ad628226ca16ae14db5f50d9adb39cc0626
+  data.tar.gz: 031042a9e6e29028ff51a5772c834cf4025f04b4e250a3ca2ea5fe638d1d1fb70c43bf209200ff5c2e3b6ccc07537a711d87277b1035ac5fdfebb4d8d51fe5a9

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    confidante (0.28.0.pre.13)
+    confidante (0.28.0.pre.16)
       activesupport (>= 4)
       hiera (~> 3.3)
       shikashi (~> 0.6)
@@ -161,6 +161,7 @@ GEM
 PLATFORMS
   arm64-darwin-21
   x86_64-darwin-20
+  x86_64-darwin-21
   x86_64-linux
 
 DEPENDENCIES

data/lib/confidante/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Confidante
-  VERSION = '0.28.0.pre.13'
+  VERSION = '0.28.0.pre.16'
 end

data/lib/hiera/backend/vault_backend.rb

@@ -9,23 +9,44 @@ class Hiera
     class Vault_backend
       def initialize
         Hiera.debug('Hiera vault backend starting')
-
-        @client = Vault::Client.new
       end
 
       def lookup(key, scope, _order_override, resolution_type, _context)
         Hiera.debug("Looking up #{key} in vault backend " \
                     "with #{resolution_type}")
 
-        secret = @client.kv('kv').read(key)
-        throw(:no_such_key) unless secret
+        vault_config = Backend.parse_answer(Config[:vault], scope)
+        vault_address = vault_config[:address]
+        vault_client = Vault::Client.new(address: vault_address)
 
-        value = secret.data[:value]
-        throw(:no_such_key) unless value
+        value = get_value(vault_client, key, vault_config[:sources])
 
         Backend.parse_answer(value, scope)
       end
+
+      def get_value(vault_client, key, sources)
+        found_source = sources.find do |source|
+          read_kv_value(vault_client, source, key)
+        end
+
+        throw(:no_such_key) unless found_source
+
+        read_kv_value(vault_client, found_source, key)
+      end
+
+      def read_kv_value(vault_client, source, key)
+        throw(:unsupported_secrets_engine) unless source[:engine] == 'kv'
+
+        mount = source[:mount]
+        full_path = "#{source[:path]}/#{key}"
+
+        secret = vault_client.kv(mount).read(full_path)
+        return nil unless secret
+
+        secret.data[:value]
+      end
     end
+
     # rubocop:enable Naming/ClassAndModuleCamelCase
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: confidante
 version: !ruby/object:Gem::Version
-  version: 0.28.0.pre.13
+  version: 0.28.0.pre.16
 platform: ruby
 authors:
 - InfraBlocks Maintainers
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-08-16 00:00:00.000000000 Z
+date: 2022-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: activesupport