rake_vault 0.1.0.pre.10 → 0.1.0.pre.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: da86d812082bfd701832d8fe391c222492127e74b6626a7fd3c757150d95d65d
-  data.tar.gz: 6d2e22a0282bb02fbe31e382cd3a29cd250977ee1046569244d079e8be05b579
+  metadata.gz: '0468f9e8b1f7e53949c9949ec71ba14ce467c3947ad2dd6e95e6ea5328e19c43'
+  data.tar.gz: d5cb1267de2e8f40495a7de422c6b73cb3d39b246ffd15ed4975543e7d0360fc
 SHA512:
-  metadata.gz: 0a6e300befd67fb8d2ca2cd9dab3522ab09d2bece695789f9358baae4b1b94310679c4a955ff1af8774a6cd6d86e8750127f0636759db08664c9abb0208d0d01
-  data.tar.gz: d268aa3de8b5a443e15a3b01ae3de60a4e1954b6096304330c2de3b7cf74210b87900dfa2da0a281905464d5f957435dd5f878cb0d1716d005a47c380c9c8b2d
+  metadata.gz: 40d5399ce62b0e6a935ec789c00cf2aac969ebab2a41c31f7e7c7557776f101b60ad9ad4438711ebd9384c77d0670644fbc746c9e5d3b1dfdce0dd6a89542701
+  data.tar.gz: 5402b2867c9e5f80deffe500ec640dc46f4a106875092fe2a8b42577a47c5ed74938201a6099c2bd80a862b4d716a04e1b0d662d8a4b33225e8aa61a733e99ef

data/Gemfile.lock

@@ -1,16 +1,17 @@
 PATH
   remote: .
   specs:
-    rake_vault (0.1.0.pre.10)
+    rake_vault (0.1.0.pre.12)
       colored2 (~> 3.1)
       rake_dependencies (~> 3.1)
       rake_factory (~> 0.23)
       ruby_vault (~> 0.1.0.pre.15)
+      vault (~> 0.17)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.3.1)
+    activesupport (7.0.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -18,6 +19,9 @@ GEM
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
     ast (2.4.2)
+    aws-eventstream (1.2.0)
+    aws-sigv4 (1.5.1)
+      aws-eventstream (~> 1, >= 1.0.2)
     colored2 (3.1.2)
     concurrent-ruby (1.1.10)
     diff-lcs (1.5.0)
@@ -30,7 +34,7 @@ GEM
     gem-release (2.2.2)
     hamster (3.0.0)
       concurrent-ruby (~> 1.0)
-    i18n (1.11.0)
+    i18n (1.12.0)
       concurrent-ruby (~> 1.0)
     immutable-struct (2.4.1)
     json (2.6.2)
@@ -39,7 +43,7 @@ GEM
       open4 (~> 1.3)
     memfs (1.0.0)
     minitar (0.9)
-    minitest (5.16.2)
+    minitest (5.16.3)
     octokit (4.25.1)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
@@ -90,27 +94,27 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.11.0)
     rspec-support (3.11.0)
-    rubocop (1.34.1)
+    rubocop (1.36.0)
       json (~> 2.3)
       parallel (~> 1.10)
       parser (>= 3.1.2.1)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.8, < 3.0)
       rexml (>= 3.2.5, < 4.0)
-      rubocop-ast (>= 1.20.0, < 2.0)
+      rubocop-ast (>= 1.20.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 3.0)
     rubocop-ast (1.21.0)
       parser (>= 3.1.1.0)
     rubocop-rake (0.6.0)
       rubocop (~> 1.0)
-    rubocop-rspec (2.12.1)
-      rubocop (~> 1.31)
+    rubocop-rspec (2.13.1)
+      rubocop (~> 1.33)
     ruby-progressbar (1.11.0)
     ruby2_keywords (0.0.5)
     ruby_gpg2 (0.8.0)
       lino (>= 1.5)
-    ruby_vault (0.1.0.pre.15)
+    ruby_vault (0.1.0.pre.16)
       immutable-struct (~> 2.4)
       lino (~> 3.0)
     rubyzip (2.3.2)
@@ -124,14 +128,16 @@ GEM
     simplecov-html (0.12.3)
     simplecov_json_formatter (0.1.4)
     sshkey (2.0.0)
-    tzinfo (2.0.4)
+    tzinfo (2.0.5)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.2.0)
+    vault (0.17.0)
+      aws-sigv4
 
 PLATFORMS
   arm64-darwin-21
-  ruby
   x86_64-darwin-19
+  x86_64-darwin-21
   x86_64-linux
 
 DEPENDENCIES
@@ -152,4 +158,4 @@ DEPENDENCIES
   simplecov
 
 BUNDLED WITH
-   2.3.20
+   2.3.22

data/lib/rake_vault/auth/approle.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require 'ruby_vault'
+
+module RakeVault
+  module Auth
+    module Approle
+      def self.login(address, path, role_id, secret_id)
+        role_id = role_id ? "role_id=#{role_id}" : nil
+        secret_id = secret_id ? "secret_id=#{secret_id}" : nil
+
+        stdout_io = StringIO.new
+
+        configure_stdout(stdout_io)
+        write(address, path, role_id, secret_id)
+        reset_stdout
+        RakeVault::TokenFile.write(stdout_io.string)
+      end
+
+      def self.write(address, path, role_id, secret_id)
+        RubyVault.write(
+          address: address,
+          path: path,
+          data: [role_id, secret_id].compact,
+          format: 'json'
+        )
+      end
+
+      def self.configure_stdout(stdout_io)
+        RubyVault.configure do |config|
+          config.stdout = stdout_io
+        end
+      end
+
+      def self.reset_stdout
+        RubyVault.configure do |config|
+          config.stdout = $stdout
+        end
+      end
+    end
+  end
+end

data/lib/rake_vault/auth/oidc.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require 'ruby_vault'
+
+module RakeVault
+  module Auth
+    module Oidc
+      def self.login(address, role, no_print)
+        auth = role ? ["role=#{role}"] : []
+
+        RubyVault.login(
+          method: 'oidc',
+          auth: auth,
+          address: address,
+          no_print: no_print
+        )
+      end
+    end
+  end
+end

data/lib/rake_vault/tasks/app_role_auth.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'rake_factory'
+require_relative '../auth/approle'
 require_relative '../token_file'
 
 module RakeVault
@@ -20,23 +21,12 @@ module RakeVault
       parameter :secret_id
 
       action do |task|
-        role_id = task.role_id ? "role_id=#{task.role_id}" : nil
-        secret_id = task.secret_id ? "secret_id=#{task.secret_id}" : nil
-
-        stdout_io = StringIO.new
-
-        RubyVault.configure do |config|
-          config.stdout = stdout_io
-        end
-
-        RubyVault.write(
-          address: task.address,
-          path: task.path,
-          data: [role_id, secret_id].compact,
-          format: 'json'
+        RakeVault::Auth::Approle.login(
+          task.address,
+          task.path,
+          task.role_id,
+          task.secret_id
         )
-        RubyVault.reset!
-        RakeVault::TokenFile.write(stdout_io.string)
       end
     end
   end

data/lib/rake_vault/tasks/login.rb

@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require 'rake_factory'
+require 'vault'
+require_relative '../auth/approle'
+require_relative '../auth/oidc'
+
+module RakeVault
+  module Tasks
+    class Login < RakeFactory::Task
+      default_name :login
+      default_prerequisites(RakeFactory::DynamicValue.new do |t|
+        [t.ensure_task_name]
+      end)
+      default_description(RakeFactory::DynamicValue.new do |_t|
+        'Login with approle or oidc using vault'
+      end)
+      parameter :address
+      parameter :role
+      parameter :ensure_task_name, default: :'vault:ensure'
+
+      action do |task|
+        if valid_token?(task.address)
+          puts 'Valid token found.'
+        else
+          puts 'No valid token found. Attempting to login...'
+          app_role_role_id = ENV.fetch('VAULT_APPROLE_ROLE_ID', nil)
+          app_role_secret_id = ENV.fetch('VAULT_APPROLE_SECRET_ID', nil)
+          if app_role_role_id && app_role_secret_id
+            puts 'Approle credentials found. Logging in with approle...'
+            RakeVault::Auth::Approle.login(
+              task.address,
+              'auth/approle/login',
+              app_role_role_id,
+              app_role_secret_id
+            )
+          else
+            RakeVault::Auth::Oidc.login(task.address, task.role, true)
+          end
+        end
+      end
+
+      def valid_token?(address)
+        puts 'Checking for valid token...'
+        vault_client = Vault::Client.new(address: address)
+        vault_client.auth_token.lookup_self
+      rescue Vault::HTTPClientError || Vault::HTTPServerError
+        false
+      else
+        true
+      end
+    end
+  end
+end

data/lib/rake_vault/tasks/oidc_auth.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'rake_factory'
-require 'ruby_vault'
+require_relative '../auth/oidc'
 
 module RakeVault
   module Tasks
@@ -19,14 +19,7 @@ module RakeVault
       parameter :no_print, default: false
 
       action do |task|
-        auth = task.role ? ["role=#{task.role}"] : []
-
-        RubyVault.login(
-          method: 'oidc',
-          auth: auth,
-          address: task.address,
-          no_print: task.no_print
-        )
+        RakeVault::Auth::Oidc.login(task.address, task.role, task.no_print)
       end
     end
   end

data/lib/rake_vault/tasks.rb

@@ -2,6 +2,7 @@
 
 require_relative 'tasks/oidc_auth'
 require_relative 'tasks/app_role_auth'
+require_relative 'tasks/login'
 
 module RakeVault
   module Tasks

data/lib/rake_vault/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RakeVault
-  VERSION = '0.1.0.pre.10'
+  VERSION = '0.1.0.pre.12'
 end

data/lib/rake_vault.rb

@@ -7,7 +7,11 @@ require 'rake_vault/token_file'
 
 module RakeVault
   def self.define_installation_tasks(opts = {})
-    RakeVault::TaskSets::Vault.define(opts).delegate
+    command_task_set = define_command_installation_tasks(opts)
+
+    configure_ruby_vault(command_task_set.binary)
+
+    command_task_set.delegate
   end
 
   def self.define_oidc_auth_task(opts = {}, &block)
@@ -17,4 +21,20 @@ module RakeVault
   def self.define_app_role_auth_task(opts = {}, &block)
     RakeVault::Tasks::AppRoleAuth.define(opts, &block)
   end
+
+  def self.define_login_task(opts = {}, &block)
+    RakeVault::Tasks::Login.define(opts, &block)
+  end
+
+  class << self
+    private
+
+    def define_command_installation_tasks(opts = {})
+      RakeVault::TaskSets::Vault.define(opts)
+    end
+
+    def configure_ruby_vault(binary)
+      RubyVault.configure { |c| c.binary = binary }
+    end
+  end
 end

data/rake_vault.gemspec

@@ -40,6 +40,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'rake_dependencies', '~> 3.1'
   spec.add_dependency 'rake_factory', '~> 0.23'
   spec.add_dependency 'ruby_vault', '~> 0.1.0.pre.15'
+  spec.add_dependency 'vault', '~> 0.17'
 
   spec.add_development_dependency 'activesupport'
   spec.add_development_dependency 'bundler'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rake_vault
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre.10
+  version: 0.1.0.pre.12
 platform: ruby
 authors:
 - InfraBlocks Maintainers
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-08-11 00:00:00.000000000 Z
+date: 2022-09-21 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colored2
@@ -66,6 +66,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.1.0.pre.15
+- !ruby/object:Gem::Dependency
+  name: vault
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.17'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.17'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
@@ -278,10 +292,13 @@ files:
 - bin/console
 - bin/setup
 - lib/rake_vault.rb
+- lib/rake_vault/auth/approle.rb
+- lib/rake_vault/auth/oidc.rb
 - lib/rake_vault/task_sets.rb
 - lib/rake_vault/task_sets/vault.rb
 - lib/rake_vault/tasks.rb
 - lib/rake_vault/tasks/app_role_auth.rb
+- lib/rake_vault/tasks/login.rb
 - lib/rake_vault/tasks/oidc_auth.rb
 - lib/rake_vault/token_file.rb
 - lib/rake_vault/version.rb