legion-crypt 1.4.12 → 1.4.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 228df771abf660b303d986d0df69c3cdf7a8a16ab68ebe7eec2712f99607e162
-  data.tar.gz: 2ea96c31efeed7cad8286a74b6cfd3cdfdeafcbad8bd34bac7dc61f4fe3ecb83
+  metadata.gz: 59b6f53757eb825da7b0c635589149793c015d59c422b90916706bae8e796e1d
+  data.tar.gz: 4879d7e405f5bf0da54b488ac38c1bdba708280bd63d112da3ef487c467039f2
 SHA512:
-  metadata.gz: c844d151b90c635e5f8c78ffac965f833ea33e9137ef86042f1cd6ad5627f045d66b44dc2e63343839c1909248a83494d2057945db33e2b80045094cec92939d
-  data.tar.gz: 6938d92c6bd45111c3bcaae795731dff242b21609c3849fc3f9e99f27a61ed5865b6873482532009820e64dfd08b196b4c93cc0450c65afab5a9f8c6c049f3eb
+  metadata.gz: 6fee90f414f31a34f7f75713c9856b2644a4a74986182d19921aa2731db4a13b6a346417bacccbf449ab2a29fe5b6562d1fd4ba77a6adbba1a9b03c8c04c93e3
+  data.tar.gz: 36042a488a032df98488493270a9976d526400981ecb62277f9454dd5d6cdeac2be9425c1c9b755004fd3c8fe5814347a55659eb32baa95fd53437859150720b

data/.github/CODEOWNERS

@@ -0,0 +1,7 @@
+# Auto-generated from team-config.yml
+# Team: core
+#
+# To apply: scripts/apply-codeowners.sh legion-crypt
+
+* @LegionIO/maintainers
+* @LegionIO/core

data/.github/dependabot.yml

@@ -0,0 +1,18 @@
+version: 2
+updates:
+  - package-ecosystem: bundler
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - "type:dependencies"
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+    open-pull-requests-limit: 5
+    labels:
+      - "type:dependencies"

data/.github/workflows/ci.yml

@@ -3,14 +3,32 @@ on:
   push:
     branches: [main]
   pull_request:
+  schedule:
+    - cron: '0 9 * * 1'
 
 jobs:
   ci:
     uses: LegionIO/.github/.github/workflows/ci.yml@main
 
+  lint:
+    uses: LegionIO/.github/.github/workflows/lint-patterns.yml@main
+
+  security:
+    uses: LegionIO/.github/.github/workflows/security-scan.yml@main
+
+  version-changelog:
+    uses: LegionIO/.github/.github/workflows/version-changelog.yml@main
+
+  dependency-review:
+    uses: LegionIO/.github/.github/workflows/dependency-review.yml@main
+
+  stale:
+    if: github.event_name == 'schedule'
+    uses: LegionIO/.github/.github/workflows/stale.yml@main
+
   release:
-    needs: ci
+    needs: [ci, lint]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     uses: LegionIO/.github/.github/workflows/release.yml@main
     secrets:
-      rubygems-api-key: ${{ secrets.RUBYGEMS_API_KEY }}
+      rubygems-api-key: ${{ secrets.RUBYGEMS_API_KEY }}

data/CHANGELOG.md

@@ -1,5 +1,18 @@
 # Legion::Crypt
 
+## [1.4.13] - 2026-03-25
+
+### Added
+- Kerberos auto-auth to Vault on boot (`auth_method: 'kerberos'` per cluster)
+- `KerberosAuth` module: client-side SPNEGO token acquisition via lex-kerberos, Vault token exchange
+- `TokenRenewer`: plain-Thread token lifecycle (renew at 75% TTL, re-auth via Kerberos, exponential backoff 30s-10min)
+- `kerberos` settings block in vault cluster config (`service_principal`, `auth_path`)
+- `auth_method` dispatch in `connect_all_clusters` (kerberos, ldap, token)
+
+### Changed
+- Token renewal no longer depends on `Extensions::Actors::Every` (starts at boot, not after extensions load)
+- Removed actor-dependent renewer guard from `connect_vault`
+
 ## [1.4.12] - 2026-03-25
 
 ### Fixed

data/LICENSE

@@ -1,7 +1,6 @@
-
                                  Apache License
                            Version 2.0, January 2004
-                        https://www.apache.org/licenses/
+                        http://www.apache.org/licenses/
 
    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
 
@@ -176,16 +175,27 @@
 
    END OF TERMS AND CONDITIONS
 
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
    Copyright 2021 Esity
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
    You may obtain a copy of the License at
 
-       https://www.apache.org/licenses/LICENSE-2.0
+       http://www.apache.org/licenses/LICENSE-2.0
 
    Unless required by applicable law or agreed to in writing, software
    distributed under the License is distributed on an "AS IS" BASIS,
    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
    See the License for the specific language governing permissions and
-   limitations under the License.
+   limitations under the License.

data/lib/legion/crypt/kerberos_auth.rb

@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module Legion
+  module Crypt
+    module KerberosAuth
+      class AuthError < StandardError; end
+      class GemMissingError < StandardError; end
+
+      DEFAULT_AUTH_PATH = 'auth/kerberos/login'
+
+      def self.login(vault_client:, service_principal:, auth_path: DEFAULT_AUTH_PATH)
+        raise GemMissingError, 'lex-kerberos gem is required for Kerberos auth' unless spnego_available?
+
+        token = obtain_token(service_principal)
+        exchange_token(vault_client, token, auth_path)
+      end
+
+      def self.spnego_available?
+        return @spnego_available unless @spnego_available.nil?
+
+        @spnego_available = begin
+          require 'legion/extensions/kerberos/helpers/spnego'
+          true
+        rescue LoadError
+          # check if constant was already defined (e.g. stubbed in tests or loaded via another path)
+          defined?(Legion::Extensions::Kerberos::Helpers::Spnego) ? true : false
+        end
+      end
+
+      def self.reset!
+        @spnego_available = nil
+      end
+
+      class << self
+        private
+
+        def obtain_token(service_principal)
+          helper = Object.new.extend(Legion::Extensions::Kerberos::Helpers::Spnego)
+          result = helper.obtain_spnego_token(service_principal: service_principal)
+          raise AuthError, "SPNEGO token acquisition failed: #{result[:error]}" unless result[:success]
+
+          result[:token]
+        end
+
+        def exchange_token(vault_client, spnego_token, auth_path)
+          response = vault_client.logical.write(auth_path, authorization: "Negotiate #{spnego_token}")
+          raise AuthError, 'Vault Kerberos auth returned no auth data' unless response&.auth
+
+          {
+            token:          response.auth.client_token,
+            lease_duration: response.auth.lease_duration,
+            renewable:      response.auth.renewable,
+            policies:       response.auth.policies,
+            metadata:       response.auth.metadata
+          }
+        rescue ::Vault::HTTPClientError => e
+          raise AuthError, "Vault Kerberos auth failed: #{e.message}"
+        end
+      end
+    end
+  end
+end

data/lib/legion/crypt/settings.rb

@@ -52,6 +52,10 @@ module Legion
           kv_path:             ENV['LEGION_VAULT_KV_PATH'] || 'legion',
           leases:              {},
           default:             nil,
+          kerberos:            {
+            service_principal: nil,
+            auth_path:         'auth/kerberos/login'
+          },
           clusters:            {}
         }
       end

data/lib/legion/crypt/token_renewer.rb

@@ -0,0 +1,143 @@
+# frozen_string_literal: true
+
+require 'legion/crypt/kerberos_auth'
+
+module Legion
+  module Crypt
+    class TokenRenewer
+      INITIAL_BACKOFF = 30
+      MAX_BACKOFF     = 600
+      MIN_SLEEP       = 30
+      RENEWAL_RATIO   = 0.75
+
+      attr_reader :cluster_name
+
+      def initialize(cluster_name:, config:, vault_client:)
+        @cluster_name = cluster_name
+        @config       = config
+        @vault_client = vault_client
+        @thread       = nil
+        @stop         = false
+        @backoff      = INITIAL_BACKOFF
+      end
+
+      def start
+        @stop = false
+        @thread = Thread.new { renewal_loop }
+        @thread.name = "vault-renewer-#{@cluster_name}"
+        log_debug('token renewal thread started')
+      end
+
+      def stop
+        @stop = true
+        @thread&.wakeup
+      rescue ThreadError
+        nil
+      ensure
+        @thread&.join(5)
+        @thread = nil
+        log_debug('token renewal thread stopped')
+      end
+
+      def running?
+        @thread&.alive? == true
+      end
+
+      def renew_token
+        result = @vault_client.auth_token.renew_self
+        @config[:lease_duration] = result.auth.lease_duration
+        log_debug("token renewed, ttl=#{result.auth.lease_duration}s")
+        true
+      rescue StandardError => e
+        log_warn("token renewal failed: #{e.message}")
+        false
+      end
+
+      def reauth_kerberos
+        krb_config = @config[:kerberos] || {}
+        result = Legion::Crypt::KerberosAuth.login(
+          vault_client:      @vault_client,
+          service_principal: krb_config[:service_principal],
+          auth_path:         krb_config[:auth_path] || KerberosAuth::DEFAULT_AUTH_PATH
+        )
+
+        @config[:token]          = result[:token]
+        @config[:lease_duration] = result[:lease_duration]
+        @config[:renewable]      = result[:renewable]
+        @config[:connected]      = true
+        @vault_client.token      = result[:token]
+        log_info('re-authenticated via Kerberos')
+        true
+      rescue StandardError => e
+        log_warn("Kerberos re-auth failed: #{e.message}")
+        false
+      end
+
+      def sleep_duration
+        duration = (@config[:lease_duration].to_i * RENEWAL_RATIO).to_i
+        [duration, MIN_SLEEP].max
+      end
+
+      def next_backoff
+        current = @backoff
+        @backoff = [@backoff * 2, MAX_BACKOFF].min
+        current
+      end
+
+      def reset_backoff
+        @backoff = INITIAL_BACKOFF
+      end
+
+      private
+
+      def renewal_loop
+        interruptible_sleep(sleep_duration)
+
+        until @stop
+          if renew_token || reauth_kerberos
+            on_renewal_success
+          else
+            on_renewal_failure
+          end
+        end
+      rescue StandardError => e
+        log_warn("renewal loop error: #{e.message}")
+        retry unless @stop
+      end
+
+      def on_renewal_success
+        reset_backoff
+        interruptible_sleep(sleep_duration)
+      end
+
+      def on_renewal_failure
+        @config[:connected] = false
+        delay = next_backoff
+        log_warn("backoff retry in #{delay}s")
+        interruptible_sleep(delay)
+      end
+
+      def interruptible_sleep(seconds)
+        deadline = ::Process.clock_gettime(::Process::CLOCK_MONOTONIC) + seconds
+        loop do
+          remaining = deadline - ::Process.clock_gettime(::Process::CLOCK_MONOTONIC)
+          break if remaining <= 0 || @stop
+
+          sleep([remaining, 1.0].min)
+        end
+      end
+
+      def log_debug(message)
+        Legion::Logging.debug("TokenRenewer[#{@cluster_name}]: #{message}") if defined?(Legion::Logging)
+      end
+
+      def log_info(message)
+        Legion::Logging.info("TokenRenewer[#{@cluster_name}]: #{message}") if defined?(Legion::Logging)
+      end
+
+      def log_warn(message)
+        Legion::Logging.warn("TokenRenewer[#{@cluster_name}]: #{message}") if defined?(Legion::Logging)
+      end
+    end
+  end
+end

data/lib/legion/crypt/vault.rb

@@ -36,10 +36,6 @@ module Legion
           Legion::Settings[:crypt][:vault][:connected] = true
           Legion::Logging.info "Vault connected at #{::Vault.address}" if defined?(Legion::Logging)
         end
-        return unless Legion.const_defined? 'Extensions::Actors::Every'
-
-        require_relative 'vault_renewer'
-        @renewer = Legion::Crypt::Vault::Renewer.new
       rescue StandardError => e
         Legion::Logging.error e.message
         Legion::Settings[:crypt][:vault][:connected] = false

data/lib/legion/crypt/vault_cluster.rb

@@ -42,12 +42,19 @@ module Legion
       def connect_all_clusters
         results = {}
         clusters.each do |name, config|
-          next unless config[:token]
+          case config[:auth_method]&.to_s
+          when 'kerberos'
+            results[name] = connect_kerberos_cluster(name, config)
+          when 'ldap'
+            next # handled by ldap_login_all
+          else
+            next unless config[:token]
 
-          client = vault_client(name)
-          config[:connected] = client.sys.health_status.initialized?
-          results[name] = config[:connected]
-          Legion::Logging.info "Vault cluster connected: #{name} at #{config[:address]}" if config[:connected] && defined?(Legion::Logging)
+            client = vault_client(name)
+            config[:connected] = client.sys.health_status.initialized?
+            results[name] = config[:connected]
+            log_cluster_connected(name, config) if config[:connected]
+          end
         rescue StandardError => e
           config[:connected] = false
           results[name] = false
@@ -82,6 +89,51 @@ module Legion
           warn("Vault cluster #{name}: #{error.message}")
         end
       end
+
+      def connect_kerberos_cluster(name, config)
+        krb_config = config[:kerberos] || {}
+        spn = krb_config[:service_principal]
+
+        unless spn
+          log_vault_warn(name, 'Kerberos auth missing service_principal, skipping')
+          config[:connected] = false
+          return false
+        end
+
+        require 'legion/crypt/kerberos_auth'
+        result = Legion::Crypt::KerberosAuth.login(
+          vault_client:      vault_client(name),
+          service_principal: spn,
+          auth_path:         krb_config[:auth_path] || Legion::Crypt::KerberosAuth::DEFAULT_AUTH_PATH
+        )
+
+        config[:token] = result[:token]
+        config[:lease_duration] = result[:lease_duration]
+        config[:renewable] = result[:renewable]
+        config[:connected] = true
+        log_cluster_connected(name, config)
+        true
+      rescue Legion::Crypt::KerberosAuth::GemMissingError => e
+        log_vault_warn(name, e.message)
+        config[:connected] = false
+        false
+      rescue Legion::Crypt::KerberosAuth::AuthError => e
+        log_vault_warn(name, "Kerberos auth failed: #{e.message}")
+        config[:connected] = false
+        false
+      end
+
+      def log_cluster_connected(name, config)
+        Legion::Logging.info "Vault cluster connected: #{name} at #{config[:address]}" if defined?(Legion::Logging)
+      end
+
+      def log_vault_warn(name, message)
+        if defined?(Legion::Logging)
+          Legion::Logging.warn("Vault cluster #{name}: #{message}")
+        else
+          warn("Vault cluster #{name}: #{message}")
+        end
+      end
     end
   end
 end

data/lib/legion/crypt/version.rb

@@ -2,6 +2,6 @@
 
 module Legion
   module Crypt
-    VERSION = '1.4.12'
+    VERSION = '1.4.13'
   end
 end

data/lib/legion/crypt.rb

@@ -10,6 +10,7 @@ require 'legion/crypt/vault_jwt_auth'
 require 'legion/crypt/lease_manager'
 require 'legion/crypt/vault_cluster'
 require 'legion/crypt/ldap_auth'
+require 'legion/crypt/token_renewer'
 require 'legion/crypt/helper'
 require 'legion/crypt/mtls'
 require 'legion/crypt/cert_rotation'
@@ -36,9 +37,11 @@ module Legion
       def start
         Legion::Logging.debug 'Legion::Crypt is running start'
         ::File.write('./legionio.key', private_key) if settings[:save_private_key]
+        @token_renewers ||= []
 
         if vault_settings[:clusters]&.any?
           connect_all_clusters
+          start_token_renewers
         else
           connect_vault unless settings[:vault][:token].nil?
         end
@@ -86,6 +89,7 @@ module Legion
 
       def shutdown
         Legion::Crypt::LeaseManager.instance.shutdown
+        stop_token_renewers
         shutdown_renewer
         close_sessions
       end
@@ -104,6 +108,27 @@ module Legion
       rescue StandardError => e
         Legion::Logging.warn "LeaseManager startup failed: #{e.message}"
       end
+
+      def start_token_renewers
+        clusters.each do |name, config|
+          next unless config[:auth_method]&.to_s == 'kerberos' && config[:connected]
+
+          renewer = Legion::Crypt::TokenRenewer.new(
+            cluster_name: name,
+            config:       config,
+            vault_client: vault_client(name)
+          )
+          renewer.start
+          @token_renewers << renewer
+        end
+      end
+
+      def stop_token_renewers
+        return unless @token_renewers
+
+        @token_renewers.each(&:stop)
+        @token_renewers.clear
+      end
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: legion-crypt
 version: !ruby/object:Gem::Version
-  version: 1.4.12
+  version: 1.4.13
 platform: ruby
 authors:
 - Esity
@@ -61,6 +61,8 @@ extra_rdoc_files:
 - LICENSE
 - README.md
 files:
+- ".github/CODEOWNERS"
+- ".github/dependabot.yml"
 - ".github/workflows/ci.yml"
 - ".gitignore"
 - ".rubocop.yml"
@@ -81,6 +83,7 @@ files:
 - lib/legion/crypt/helper.rb
 - lib/legion/crypt/jwks_client.rb
 - lib/legion/crypt/jwt.rb
+- lib/legion/crypt/kerberos_auth.rb
 - lib/legion/crypt/ldap_auth.rb
 - lib/legion/crypt/lease_manager.rb
 - lib/legion/crypt/mock_vault.rb
@@ -88,6 +91,7 @@ files:
 - lib/legion/crypt/partition_keys.rb
 - lib/legion/crypt/settings.rb
 - lib/legion/crypt/tls.rb
+- lib/legion/crypt/token_renewer.rb
 - lib/legion/crypt/vault.rb
 - lib/legion/crypt/vault_cluster.rb
 - lib/legion/crypt/vault_jwt_auth.rb