hiera-eyaml-vault_rs 1.2.1 → 1.3.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 1a2e54c6d915c70d28abe1f92588e2790c042f00df1bdc4ed9b8e01844253d45
-  data.tar.gz: b87e83acd3ac25b896863692bc47662793713eadd063e0f58396b1b14ccff8c9
+  metadata.gz: 4a3677ad3762c7f8c05f571f3990a00a4d5be082f1246fac19c40b5b6c4f5686
+  data.tar.gz: 0dd6a4ce7310233af213b8c6066ca38567833dd6cabfbf6fb1d1edfc58f13db5
 SHA512:
-  metadata.gz: fd3bfa4258e45ecbf70d41eb860b1b16b8a8bcf64d8863acea3ca7d315d89a6a545777343a756d3af7f9fc19af77f59eb78903ec24a10b147cd949f684880a4a
-  data.tar.gz: 12347df1a3aec525431ae09654507f73e50d54025ce34662fd4ae1f47de5251af6294a00874cb78152a888878b3394954193626562eaab260eca109f4c103614
+  metadata.gz: cde0dcc87f13403e4b559e143bb35c67632a52d17deb36c936c1d0253a85d62901d75c697c58488798fae419199e89f4fc4345f04f339074bcb229ce5154b89d
+  data.tar.gz: c19de0c79f62b8795b5ad6afc1b6cf3606082fffb42f0cccf14aaa26a7954f81d04ad77655b2faeccdb091120f80348b4968efda64b2e4029d82deca763421e7

data/lib/hiera/backend/eyaml/encryptors/vault_rs/httphandler.rb

@@ -35,16 +35,12 @@ class Hiera
                 end
 
                 http = Net::HTTP.new(uri.host, uri.port)
-                if options[:cert]
-                  http.use_ssl = true
-                  http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-                  http.cert = OpenSSL::X509::Certificate.new(options[:cert])
-                  http.key = OpenSSL::PKey::RSA.new(options[:key])
-                elsif options[:ssl]
+                if options[:ssl]
                   http.use_ssl = true
                   http.verify_mode = options[:ssl_verify] ? OpenSSL::SSL::VERIFY_PEER : OpenSSL::SSL::VERIFY_NONE
                   http.cert = OpenSSL::X509::Certificate.new(options[:ssl_cert]) if options[:ssl_cert]
                   http.key = OpenSSL::PKey::RSA.new(options[:ssl_key]) if options[:ssl_key]
+                  http.ca_file = options[:ca_file] if options[:ca_file]
                 end
 
                 begin
@@ -61,4 +57,3 @@ class Hiera
     end
   end
 end
-

data/lib/hiera/backend/eyaml/encryptors/vault_rs.rb

@@ -12,12 +12,20 @@ class Hiera
         class Vault_rs < Encryptor
           class AuthenticationError < Exception
           end
-          
+
           HTTP_HANDLER = Hiera::Backend::Eyaml::Encryptors::Vault_rs::Httphandler
 
           self.tag = 'VAULT_RS'
 
           self.options = {
+
+            :login_type => {
+              desc: "Method to login to Vault",
+              type: :string,
+              # allowed_values: ['approle', 'cert', 'ldap']
+              default: "approle"
+            },
+
             :addr => {
               desc: "Address of the vault server",
               type: :string,
@@ -39,16 +47,6 @@ class Hiera
               type: :string,
             },
 
-            :client_cert => {
-              desc: "Path to the client certificate for certificate-based authentication",
-              type: :string,
-            },
-
-            :client_key => {
-              desc: "Path to the client private key for certificate-based authentication",
-              type: :string,
-            },
-
             :use_ssl => {
               desc: "Use SSL to connect to vault",
               type: :boolean,
@@ -71,6 +69,11 @@ class Hiera
               type: :string
             },
 
+            :ca_file => {
+              desc: "Path to the CA bundle file for SSL verification",
+              type: :string
+            },
+
             :transit_name => {
               desc: "Vault transit engine name (default 'transit')",
               type: :string,
@@ -83,6 +86,18 @@ class Hiera
               default: "hiera"
             },
 
+            :ldap_username => {
+              desc: "Vault LDAP login name",
+              type: :string,
+              default: ""
+            },
+
+            :ldap_password => {
+              desc: "Vault LDAP login password",
+              type: :string,
+              default: ""
+            },
+
             :api_version => {
               desc: "API version to use",
               type: :integer,
@@ -108,10 +123,10 @@ class Hiera
               # Debug flag
               debug = ENV['EYAML_DEBUG'] == 'true'
               puts "Resolving option for key: #{key}" if debug
-              
+
               # Load the configuration file if not already loaded
               load_config if @config_defaults.nil?
-              
+
               # Try to resolve the option from the configuration file first
               unless @config_defaults.nil?
                 config_option = @config_defaults[key.to_s]
@@ -127,7 +142,7 @@ class Hiera
             end
 
             def create_keys
-              diagnostic_message = self.option :diagnostic_message 
+              diagnostic_message = self.option :diagnostic_message
               puts "Create_keys: #{diagnostic_message}"
             end
 
@@ -140,7 +155,8 @@ class Hiera
             end
 
             def login
-              if option(:role_id)
+              case option(:login_type)
+              when 'approle'
                 role_id = option :role_id
                 secret_id = option :secret_id
 
@@ -149,13 +165,22 @@ class Hiera
 
                 response = vault_post(login_data, :login, false)
                 @login_token = response['auth']['client_token']
-              elsif option(:client_cert)
+              when 'cert'
                 auth_name = option :auth_name
 
                 login_data = { "name" => auth_name }
 
                 response = vault_post(login_data, :cert_login, false)
                 @login_token = response['auth']['client_token']
+              when 'ldap'
+                password = option :ldap_password
+
+                login_data = { "password" => password }
+
+                response = vault_post(login_data, :ldap_login, false)
+                @login_token = response['auth']['client_token']
+              else
+                raise ArgumentError, "Invalid login_type '#{option(:login_type)}'"
               end
             end
 
@@ -180,18 +205,6 @@ class Hiera
               @vault_ssl_cert
             end
 
-            def client_cert
-              return nil if option(:client_cert).nil?
-              @vault_client_cert ||= read_file(option :client_cert)
-              @vault_client_cert
-            end
-
-            def client_key
-              return nil if option(:client_key).nil?
-              @vault_client_key ||= read_file(option :client_key)
-              @vault_client_key
-            end
-
             def token_configured?
               return true if ENV['VAULT_TOKEN']
               not option(:token).nil?
@@ -217,7 +230,8 @@ class Hiera
                 :decrypt    => "#{option(:transit_name)}/decrypt/#{option(:key_name)}",
                 :encrypt    => "#{option(:transit_name)}/encrypt/#{option(:key_name)}",
                 :login      => "auth/approle/login",
-                :cert_login => "auth/cert/login"
+                :cert_login => "auth/cert/login",
+                :ldap_login => "auth/ldap/login/#{option(:ldap_username)}"
               }
 
               # Output debug information if the debug mode is enabled
@@ -253,18 +267,14 @@ class Hiera
             def vault_post(data, action, use_token=true, headers={})
               url = url_path(action)
               http_options = {}
-              if option(:client_cert)
-                http_options = {
-                  :cert   => client_cert,
-                  :key    => client_key,
-                }
-              elsif ssl?
+              if ssl?
                 http_options = {
                   :ssl        => true,
                   :ssl_verify => option(:ssl_verify),
                   :ssl_cert   => ssl_cert,
                   :ssl_key    => ssl_key,
                 }
+                http_options[:ca_file] = option(:ca_file) if option(:ca_file)
               end
 
               begin
@@ -292,7 +302,7 @@ class Hiera
               response_data=response['data']
               response_data['ciphertext']
             end
-          end 
+          end
         end
       end
     end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hiera-eyaml-vault_rs
 version: !ruby/object:Gem::Version
-  version: 1.2.1
+  version: 1.3.0
 platform: ruby
 authors:
 - ryan-scheinberg
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2023-09-27 00:00:00.000000000 Z
+date: 2023-12-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: hiera-eyaml