inspec-vault 0.3.2 → 0.4.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: cfbbbb425fb095bdf5a4124f20a3475f87f6d983074339889156e70eccb1cbc7
-  data.tar.gz: c45dcca2381837fbb2380467ac66eae9321fce02ef23d5ab8cea27403ce9ca21
+  metadata.gz: 13843b34e8af9ceeca87c9aa62daf8abce7dec302ec6a10a7298a8517d236607
+  data.tar.gz: 77c25c4d6fb5978cd8dde5e61ef2056e22f66bd929f99e309d03be7a190c90fb
 SHA512:
-  metadata.gz: fe1329781eca561a3788ed933bc5a46729447819be483e047095217caf4ae53d233e23936bf0201729e99b5c3cfc3a7096b7b9586c58a52908dec34fdaa88684
-  data.tar.gz: 803e458ad47d5f518691b0e265c997689ffa045c3c144be241361436e342669f4fc4229f3c888c411b1c97657b19f2f01a391ca6e5601d277fffcb6cbb3bbbe6
+  metadata.gz: 6fdd7c2aedcc3dac543ca291b359b6d0bd80ee14857781674cda79c5c6b69c5c7d5fdfb6f7941da30f7454e395fc7c1affe07c117b86b0f1c1436688b527e8d3
+  data.tar.gz: 786a7ea8d8aa0e279c7e56a210626a5f1db6fb8b0b711bffb2f1187c616c5cc3ccdd6345a9d7711f77108bccc02aa2a28ff3e193e449712405bc00bccbf71e56

data/README.md

@@ -44,7 +44,14 @@ With that value stored, Chef InSpec will now be able to retrieve the value.
 
 ## What This Plugin Does
 
-With the inspec-vault plugin enabled, Chef InSpec will contact the Vault server whenever an `input()` DSL call appears in profile control code. For example, whenever profile code like this is encountered:
+With the inspec-vault plugin enabled, whenever an `input()` DSL call appears in profile control code, Chef InSpec contacts the Vault server. If the secret is located in Vault, Chef InSpec uses this value. Otherwise, it searches for other sources to resolve the input, such as other plugins, profile metadata, or CLI values, as described in the Chef InSpec [input precedence](https://www.inspec.io/docs/reference/inputs/) documentation. 
+
+
+### Profile Based Lookup
+
+The default mode allows you to use profile-specific secrets.
+
+For example, whenever profile code like this is encountered:
 
 ```ruby
 # In profile "my_profile"
@@ -53,7 +60,19 @@ describe input("some_input") do
 end
 ```
 
-Chef InSpec will determine a secret lookup path and access Vault. With no other settings, Chef InSpec will look for a Vault secret located at `secret/inspec/my_profile` with a key named "some_input". Chef InSpec will use the Vault secret if found, but otherwise it will fall back to other means of resolving the input, such as the profile metadata or CLI values.
+With no other settings, Chef InSpec looks for a Vault secret located at `secret/inspec/my_profile` with a key named `some_input`, where `inspec` is derived from the `path_prefix` setting and `my_profile` is the name of this InSpec profile.
+
+### Absolute Path Lookup
+
+To access global information instead of a value related to a specific profile, qualify the path in absolute syntax with a starting `/`. For example:
+
+```ruby
+describe input("/configuration/webserver/password")
+ it { should cmp "some_expected_value" }
+end
+```
+
+In this case, Chef InSpec searches the `secret/configuration/webserver` document and returns the value of the `password` key.
 
 ## Configuring the Plugin
 
@@ -111,4 +130,3 @@ Please have a look at our CONTRIBUTING.md for general guidelines.
 Run `bundle exec rake test:lint` for linting, `bundle exec rake test:unit` for unit tests, and `bundle exec rake test:integration` for integration tests.
 
 Note that integration tests will download and run Vault server locally.
-

data/lib/inspec-vault/input.rb

@@ -10,10 +10,15 @@ module InspecPlugins::Vault
     attr_reader :path_prefix
     attr_reader :vault
     attr_reader :priority
+    attr_reader :input_name
+    attr_reader :logger
 
     def initialize
       @plugin_conf = Inspec::Config.cached.fetch_plugin_config("inspec-vault")
 
+      @logger = Inspec::Log
+      logger.debug format("Inspec-Vault plugin version %s", VERSION)
+
       @mount_point = fetch_plugin_setting("mount_point", "secret")
       @path_prefix = fetch_plugin_setting("path_prefix", "inspec")
 
@@ -40,31 +45,56 @@ module InspecPlugins::Vault
         path = logical_path_for_profile(profile_name)
         doc = vault.logical.read(path)
         return [] unless doc
+
         return doc.data[:data].keys.map(&:to_s)
       end
     end
 
     # Fetch a value of a single input from Vault
-    # Assumption: inputs have been stored on documents named for their
-    # profiles, and each input has a key-value pair in the document.
     # TODO we should probably cache these - https://github.com/inspec/inspec-vault/issues/15
     def fetch(profile_name, input_name)
+      @input_name = input_name
+
       path = logical_path_for_profile(profile_name)
+      item = input_name
+
+      if absolute_path?
+        _empty, *path, item = input_name.split("/")
+        path = logical_path path.join("/")
+      end
+
+      logger.info format("Reading Vault secret from %s", path)
       vault.with_retries(Vault::HTTPConnectionError) do
         doc = vault.logical.read(path)
         # Keys from vault are always symbolized
-        return doc.data[:data][input_name.to_sym] if doc
+        return doc.data[:data][item.to_sym] if doc
       end
     end
 
     private
 
+    # Assumption for profile based lookups: inputs have been stored on documents named
+    # for their profiles, and each input has a key-value pair in the document.
     def logical_path_for_profile(profile_name)
+      logical_path(profile_name)
+    end
+
+    def logical_path(relative_path)
       # When you actually read a value, on the KV2 backend you must
       # read secret/data/path, not secret/path (as on the CLI)
       # https://www.vaultproject.io/api/secret/kv/kv-v2.html#read-secret-version
       # Is this true for all backends?
-      "#{mount_point}/data/#{path_prefix}/#{profile_name}"
+      "#{mount_point}/data/#{prefix}#{relative_path}"
+    end
+
+    def prefix
+      return "#{path_prefix}/" unless absolute_path?
+
+      ""
+    end
+
+    def absolute_path?
+      input_name.start_with?("/")
     end
 
     def fetch_plugin_setting(setting_name, default = nil)

data/lib/inspec-vault/version.rb

@@ -5,6 +5,6 @@
 # to learn the current version.
 module InspecPlugins
   module Vault
-    VERSION = "0.3.2".freeze
+    VERSION = "0.4.0".freeze
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: inspec-vault
 version: !ruby/object:Gem::Version
-  version: 0.3.2
+  version: 0.4.0
 platform: ruby
 authors:
 - InSpec Core Engineering
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2019-09-13 00:00:00.000000000 Z
+date: 2020-08-07 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: vault
@@ -59,7 +59,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3
+rubygems_version: 3.1.2
 signing_key: 
 specification_version: 4
 summary: Use HashiCorp Vault data in your InSpec profiles