foreman_vault 2.0.0 → 4.0.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +4 -4
- data/README.md +3 -1
- data/lib/foreman_vault/engine.rb +53 -47
- data/lib/foreman_vault/version.rb +1 -1
- data/lib/tasks/foreman_vault_tasks.rake +2 -0
- data/test/lib/tasks/push_auth_methods_test.rb +13 -0
- data/test/lib/tasks/push_policies_test.rb +13 -0
- metadata +3 -7
checksums.yaml
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
---
|
|
2
2
|
SHA256:
|
|
3
|
-
metadata.gz:
|
|
4
|
-
data.tar.gz:
|
|
3
|
+
metadata.gz: 3740f896bbaf5c359055e38306c07e32880ed7caea04802e99f91aa11a5f0f7e
|
|
4
|
+
data.tar.gz: d3ce5deb29bd8e004daad91412af777815541e94816f11a7fed8f8db16a76c5e
|
|
5
5
|
SHA512:
|
|
6
|
-
metadata.gz:
|
|
7
|
-
data.tar.gz:
|
|
6
|
+
metadata.gz: 12b5e1377c8e2d85c03b9fc205225b337e2ea21e9a12d9179452e9dd94ec42c17475f671020553026a63c8054c35a83e684748df4f26f74925a7100018de2c95
|
|
7
|
+
data.tar.gz: 40db8b1479b9ff768c8de84119e9b4c81871bfcc66b3f0853f9872d73be311d8d279db33e79cf62af522e1802f75e9d450dceb3b0a4351f09f427f9730e174b6
|
data/README.md
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
# ForemanVault
|
|
2
2
|
|
|
3
|
-
[<img src="https://
|
|
3
|
+
[<img src="https://raw.githubusercontent.com/dm-drogeriemarkt/.github/refs/heads/main/assets/dmtech-open-source-badge.svg">](https://www.dmtech.de/)
|
|
4
4
|
|
|
5
5
|
**Foreman Vault** is a plugin for Foreman that integrates with Hashicorp Vault for different things. Currently, it offers two distinct features.
|
|
6
6
|
|
|
@@ -22,6 +22,8 @@ This allows Foreman to create everything needed to access Hashicorp Vault direct
|
|
|
22
22
|
|
|
23
23
|
| Foreman Version | Plugin Version |
|
|
24
24
|
| --------------- | -------------- |
|
|
25
|
+
| >= 3.19 | ~> 4.0 |
|
|
26
|
+
| >= 3.13 | ~> 3.0 |
|
|
25
27
|
| >= 3.9 | ~> 2.0 |
|
|
26
28
|
| >= 2.3 | ~> 1.0 |
|
|
27
29
|
| >= 1.23 | ~> 0.3, ~> 0.4 |
|
data/lib/foreman_vault/engine.rb
CHANGED
|
@@ -6,12 +6,6 @@ module ForemanVault
|
|
|
6
6
|
class Engine < ::Rails::Engine
|
|
7
7
|
engine_name 'foreman_vault'
|
|
8
8
|
|
|
9
|
-
config.autoload_paths += Dir["#{config.root}/app/controllers"]
|
|
10
|
-
config.autoload_paths += Dir["#{config.root}/app/models"]
|
|
11
|
-
config.autoload_paths += Dir["#{config.root}/app/services"]
|
|
12
|
-
config.autoload_paths += Dir["#{config.root}/app/lib"]
|
|
13
|
-
config.autoload_paths += Dir["#{config.root}/app/jobs"]
|
|
14
|
-
|
|
15
9
|
# Add any db migrations
|
|
16
10
|
initializer 'foreman_vault.load_app_instance_data' do |app|
|
|
17
11
|
ForemanVault::Engine.paths['db/migrate'].existent.each do |path|
|
|
@@ -19,52 +13,64 @@ module ForemanVault
|
|
|
19
13
|
end
|
|
20
14
|
end
|
|
21
15
|
|
|
22
|
-
initializer 'foreman_vault.register_plugin', before: :finisher_hook do |
|
|
23
|
-
|
|
24
|
-
|
|
16
|
+
initializer 'foreman_vault.register_plugin', before: :finisher_hook do |app|
|
|
17
|
+
app.reloader.to_prepare do
|
|
18
|
+
require 'foreman/cron'
|
|
19
|
+
Foreman::Plugin.register :foreman_vault do
|
|
20
|
+
requires_foreman '>= 3.19'
|
|
25
21
|
|
|
26
|
-
|
|
22
|
+
apipie_documented_controllers ["#{ForemanVault::Engine.root}/app/controllers/api/v2/*.rb"]
|
|
27
23
|
|
|
28
|
-
|
|
29
|
-
|
|
30
|
-
|
|
31
|
-
|
|
32
|
-
|
|
33
|
-
|
|
34
|
-
|
|
35
|
-
|
|
36
|
-
|
|
37
|
-
|
|
38
|
-
|
|
24
|
+
# Add permissions
|
|
25
|
+
security_block :foreman_vault do
|
|
26
|
+
permission :view_vault_connections, { vault_connections: [:index, :show],
|
|
27
|
+
'api/v2/vault_connections': [:index, :show] }, resource_type: 'VaultConnection'
|
|
28
|
+
permission :create_vault_connections, { vault_connections: [:new, :create],
|
|
29
|
+
'api/v2/vault_connections': [:create] }, resource_type: 'VaultConnection'
|
|
30
|
+
permission :edit_vault_connections, { vault_connections: [:edit, :update],
|
|
31
|
+
'api/v2/vault_connections': [:update] }, resource_type: 'VaultConnection'
|
|
32
|
+
permission :destroy_vault_connections, { vault_connections: [:destroy],
|
|
33
|
+
'api/v2/vault_connections': [:destroy] }, resource_type: 'VaultConnection'
|
|
34
|
+
end
|
|
39
35
|
|
|
40
|
-
|
|
41
|
-
|
|
42
|
-
|
|
43
|
-
|
|
44
|
-
|
|
45
|
-
|
|
46
|
-
|
|
47
|
-
|
|
48
|
-
|
|
49
|
-
|
|
50
|
-
|
|
51
|
-
|
|
52
|
-
|
|
53
|
-
|
|
54
|
-
|
|
55
|
-
|
|
56
|
-
|
|
57
|
-
|
|
58
|
-
|
|
59
|
-
|
|
60
|
-
|
|
36
|
+
settings do
|
|
37
|
+
category(:vault, N_('Vault')) do
|
|
38
|
+
setting('vault_connection',
|
|
39
|
+
full_name: N_('Default Vault connection'),
|
|
40
|
+
type: :string,
|
|
41
|
+
description: N_('Default Vault Connection that can be override using parameters'),
|
|
42
|
+
default: VaultConnection.table_exists? && VaultConnection.unscoped.count == 1 ? VaultConnection.unscoped.first.name : nil,
|
|
43
|
+
collection: VaultConnection.table_exists? ? proc { Hash[VaultConnection.unscoped.all.map { |vc| [vc.name, vc.name] }] } : [],
|
|
44
|
+
include_blank: _('Select Vault Connection'))
|
|
45
|
+
setting('vault_policy_template',
|
|
46
|
+
full_name: N_('Vault Policy template name'),
|
|
47
|
+
type: :string,
|
|
48
|
+
description: N_('The name of the ProvisioningTemplate that will be used for Vault Policy'),
|
|
49
|
+
default: ProvisioningTemplate.unscoped.of_kind(:VaultPolicy).find_by(name: 'Default Vault Policy')&.name,
|
|
50
|
+
collection: proc { Hash[ProvisioningTemplate.unscoped.of_kind(:VaultPolicy).map { |tmpl| [tmpl.name, tmpl.name] }] },
|
|
51
|
+
include_blank: _('Select Template'))
|
|
52
|
+
setting('vault_orchestration_enabled',
|
|
53
|
+
full_name: N_('Vault Orchestration enabled'),
|
|
54
|
+
type: :boolean,
|
|
55
|
+
description: N_('Enable or disable the Vault orchestration step for managing policies and auth methods'),
|
|
56
|
+
default: false)
|
|
57
|
+
setting('vault_cronjobs_enabled',
|
|
58
|
+
full_name: N_('Vault Cronjobs enabled'),
|
|
59
|
+
type: :boolean,
|
|
60
|
+
description: N_('Enable or disable the hourly Vault Cronjobs for managing policies and auth methods'),
|
|
61
|
+
default: false)
|
|
62
|
+
end
|
|
61
63
|
end
|
|
62
|
-
end
|
|
63
64
|
|
|
64
|
-
|
|
65
|
-
|
|
66
|
-
|
|
67
|
-
|
|
65
|
+
# add menu entry
|
|
66
|
+
menu :top_menu, :vault_connections, url_hash: { controller: :vault_connections, action: :index },
|
|
67
|
+
caption: N_('Vault Connections'),
|
|
68
|
+
parent: :infrastructure_menu
|
|
69
|
+
|
|
70
|
+
# Register recurring task with Foreman::Cron framework
|
|
71
|
+
Foreman::Cron.register(:hourly, 'foreman_vault:policies:push')
|
|
72
|
+
Foreman::Cron.register(:hourly, 'foreman_vault:auth_methods:push')
|
|
73
|
+
end
|
|
68
74
|
end
|
|
69
75
|
end
|
|
70
76
|
|
|
@@ -8,6 +8,7 @@ namespace :foreman_vault do # rubocop:disable Metrics/BlockLength
|
|
|
8
8
|
desc 'Push auth methods for all hosts to Vault'
|
|
9
9
|
task push: :environment do
|
|
10
10
|
User.as_anonymous_admin do
|
|
11
|
+
next unless Setting['vault_cronjobs_enabled']
|
|
11
12
|
hosts = Host::Managed.where(managed: true)
|
|
12
13
|
|
|
13
14
|
hosts.each_with_index do |host, index|
|
|
@@ -28,6 +29,7 @@ namespace :foreman_vault do # rubocop:disable Metrics/BlockLength
|
|
|
28
29
|
desc 'Push policies for all hosts to Vault'
|
|
29
30
|
task push: :environment do
|
|
30
31
|
User.as_anonymous_admin do
|
|
32
|
+
next unless Setting['vault_cronjobs_enabled']
|
|
31
33
|
hosts = Host::Managed.where(managed: true)
|
|
32
34
|
|
|
33
35
|
hosts.each_with_index do |host, index|
|
|
@@ -18,6 +18,8 @@ module ForemanVault
|
|
|
18
18
|
|
|
19
19
|
FactoryBot.create(:parameter, name: 'vault_connection', value: vault_connection.name)
|
|
20
20
|
|
|
21
|
+
Setting[:vault_cronjobs_enabled] = true
|
|
22
|
+
|
|
21
23
|
ForemanVault::VaultAuthMethod.any_instance.stubs(:vault_policy_name).returns('vault_policy_name')
|
|
22
24
|
ForemanVault::VaultAuthMethod.any_instance.stubs(:certificate).returns('cert')
|
|
23
25
|
|
|
@@ -45,5 +47,16 @@ module ForemanVault
|
|
|
45
47
|
|
|
46
48
|
assert_match("[1/1] Failed to push \"#{host.name}\"", stdout)
|
|
47
49
|
end
|
|
50
|
+
|
|
51
|
+
it 'does not push auth methods when cronjobs are disabled' do
|
|
52
|
+
Setting[:vault_cronjobs_enabled] = false
|
|
53
|
+
host
|
|
54
|
+
|
|
55
|
+
stdout, _stderr = capture_io do
|
|
56
|
+
Rake::Task[TASK_NAME].invoke
|
|
57
|
+
end
|
|
58
|
+
|
|
59
|
+
assert_empty stdout
|
|
60
|
+
end
|
|
48
61
|
end
|
|
49
62
|
end
|
|
@@ -18,6 +18,8 @@ module ForemanVault
|
|
|
18
18
|
|
|
19
19
|
FactoryBot.create(:parameter, name: 'vault_connection', value: vault_connection.name)
|
|
20
20
|
|
|
21
|
+
Setting[:vault_cronjobs_enabled] = true
|
|
22
|
+
|
|
21
23
|
ForemanVault::VaultPolicy.any_instance.stubs(:name).returns('vault_policy_name')
|
|
22
24
|
ForemanVault::VaultPolicy.any_instance.stubs(:rules).returns('rules')
|
|
23
25
|
|
|
@@ -45,5 +47,16 @@ module ForemanVault
|
|
|
45
47
|
|
|
46
48
|
assert_match("[1/1] Failed to push \"#{host.name}\"", stdout)
|
|
47
49
|
end
|
|
50
|
+
|
|
51
|
+
it 'does not push policies when cronjobs are disabled' do
|
|
52
|
+
Setting[:vault_cronjobs_enabled] = false
|
|
53
|
+
host
|
|
54
|
+
|
|
55
|
+
stdout, _stderr = capture_io do
|
|
56
|
+
Rake::Task[TASK_NAME].invoke
|
|
57
|
+
end
|
|
58
|
+
|
|
59
|
+
assert_empty stdout
|
|
60
|
+
end
|
|
48
61
|
end
|
|
49
62
|
end
|
metadata
CHANGED
|
@@ -1,14 +1,13 @@
|
|
|
1
1
|
--- !ruby/object:Gem::Specification
|
|
2
2
|
name: foreman_vault
|
|
3
3
|
version: !ruby/object:Gem::Version
|
|
4
|
-
version:
|
|
4
|
+
version: 4.0.0
|
|
5
5
|
platform: ruby
|
|
6
6
|
authors:
|
|
7
7
|
- dmTECH GmbH
|
|
8
|
-
autorequire:
|
|
9
8
|
bindir: bin
|
|
10
9
|
cert_chain: []
|
|
11
|
-
date:
|
|
10
|
+
date: 1980-01-02 00:00:00.000000000 Z
|
|
12
11
|
dependencies:
|
|
13
12
|
- !ruby/object:Gem::Dependency
|
|
14
13
|
name: vault
|
|
@@ -52,7 +51,6 @@ dependencies:
|
|
|
52
51
|
- - "~>"
|
|
53
52
|
- !ruby/object:Gem::Version
|
|
54
53
|
version: 0.1.2
|
|
55
|
-
description:
|
|
56
54
|
email:
|
|
57
55
|
- opensource@dm.de
|
|
58
56
|
executables: []
|
|
@@ -124,7 +122,6 @@ homepage: https://github.com/dm-drogeriemarkt/foreman_vault
|
|
|
124
122
|
licenses:
|
|
125
123
|
- GPL-3.0
|
|
126
124
|
metadata: {}
|
|
127
|
-
post_install_message:
|
|
128
125
|
rdoc_options: []
|
|
129
126
|
require_paths:
|
|
130
127
|
- lib
|
|
@@ -142,8 +139,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
|
|
|
142
139
|
- !ruby/object:Gem::Version
|
|
143
140
|
version: '0'
|
|
144
141
|
requirements: []
|
|
145
|
-
rubygems_version:
|
|
146
|
-
signing_key:
|
|
142
|
+
rubygems_version: 4.0.20
|
|
147
143
|
specification_version: 4
|
|
148
144
|
summary: Adds support for using credentials from Hashicorp Vault
|
|
149
145
|
test_files:
|