rake_vault 0.1.0.pre.11 → 0.1.0.pre.13

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e9824e1b8c336fa453d4ae6284e5004eac67aaf593d237d8ec426a760faee1db
-  data.tar.gz: 21f745676143a13f2d558be71996b6eb85ab174b6ee1c52f876a4fd669579b9d
+  metadata.gz: 58a90695d974a37db1b2eccc00a629ed24bf72eef080026ca1f101072794eddd
+  data.tar.gz: 3af2d1a333edbbd40055ecb944a2ebc51ea6b7347f07e73c1ce6ac389c5f2ee5
 SHA512:
-  metadata.gz: 252a11d6ff9945f6834a8060139a1cb6a4865e90d36924915525bf572f8196fa590eaa0d7560dde072db65c11ac967bae304d424d6cf7fa26c3f4d4ad3e31707
-  data.tar.gz: a15984a6b6dc0710cf482b335172b9f144c45bb866fdf4453f5051f45b0a0d47cc624c03907f164cd83b2b523557433b6396dffd0e039d4acf2a80b59645d712
+  metadata.gz: 434086dd4aa8da5550271a84d38eabb6ff2a8bd5de0107e4cb8ba7e52c0e20be1f56b7184c08dc36f5d608f16ecd76cf442df386174c51be7b311c1e96b806da
+  data.tar.gz: dfe962207b1d202c3f69b503d8a544cec397d4ce949625183ef58998e95a76693ee33b42258fe6fc233db9362df438f4ac93e86846cccb2e18639898530fa472

data/Gemfile.lock

@@ -1,16 +1,17 @@
 PATH
   remote: .
   specs:
-    rake_vault (0.1.0.pre.11)
+    rake_vault (0.1.0.pre.13)
       colored2 (~> 3.1)
       rake_dependencies (~> 3.1)
       rake_factory (~> 0.23)
       ruby_vault (~> 0.1.0.pre.15)
+      vault (~> 0.17)
 
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.3.1)
+    activesupport (7.0.4)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
@@ -18,6 +19,9 @@ GEM
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
     ast (2.4.2)
+    aws-eventstream (1.2.0)
+    aws-sigv4 (1.5.1)
+      aws-eventstream (~> 1, >= 1.0.2)
     colored2 (3.1.2)
     concurrent-ruby (1.1.10)
     diff-lcs (1.5.0)
@@ -30,7 +34,7 @@ GEM
     gem-release (2.2.2)
     hamster (3.0.0)
       concurrent-ruby (~> 1.0)
-    i18n (1.11.0)
+    i18n (1.12.0)
       concurrent-ruby (~> 1.0)
     immutable-struct (2.4.1)
     json (2.6.2)
@@ -39,7 +43,7 @@ GEM
       open4 (~> 1.3)
     memfs (1.0.0)
     minitar (0.9)
-    minitest (5.16.2)
+    minitest (5.16.3)
     octokit (4.25.1)
       faraday (>= 1, < 3)
       sawyer (~> 0.9)
@@ -90,27 +94,27 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.11.0)
     rspec-support (3.11.0)
-    rubocop (1.34.1)
+    rubocop (1.36.0)
       json (~> 2.3)
       parallel (~> 1.10)
       parser (>= 3.1.2.1)
       rainbow (>= 2.2.2, < 4.0)
       regexp_parser (>= 1.8, < 3.0)
       rexml (>= 3.2.5, < 4.0)
-      rubocop-ast (>= 1.20.0, < 2.0)
+      rubocop-ast (>= 1.20.1, < 2.0)
       ruby-progressbar (~> 1.7)
       unicode-display_width (>= 1.4.0, < 3.0)
     rubocop-ast (1.21.0)
       parser (>= 3.1.1.0)
     rubocop-rake (0.6.0)
       rubocop (~> 1.0)
-    rubocop-rspec (2.12.1)
-      rubocop (~> 1.31)
+    rubocop-rspec (2.13.1)
+      rubocop (~> 1.33)
     ruby-progressbar (1.11.0)
     ruby2_keywords (0.0.5)
     ruby_gpg2 (0.8.0)
       lino (>= 1.5)
-    ruby_vault (0.1.0.pre.15)
+    ruby_vault (0.1.0.pre.16)
       immutable-struct (~> 2.4)
       lino (~> 3.0)
     rubyzip (2.3.2)
@@ -124,14 +128,16 @@ GEM
     simplecov-html (0.12.3)
     simplecov_json_formatter (0.1.4)
     sshkey (2.0.0)
-    tzinfo (2.0.4)
+    tzinfo (2.0.5)
       concurrent-ruby (~> 1.0)
     unicode-display_width (2.2.0)
+    vault (0.17.0)
+      aws-sigv4
 
 PLATFORMS
   arm64-darwin-21
-  ruby
   x86_64-darwin-19
+  x86_64-darwin-21
   x86_64-linux
 
 DEPENDENCIES
@@ -152,4 +158,4 @@ DEPENDENCIES
   simplecov
 
 BUNDLED WITH
-   2.3.20
+   2.3.22

data/lib/rake_vault/auth/approle.rb

@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require 'ruby_vault'
+
+module RakeVault
+  module Auth
+    module Approle
+      def self.login(address, path, role_id, secret_id)
+        role_id = role_id ? "role_id=#{role_id}" : nil
+        secret_id = secret_id ? "secret_id=#{secret_id}" : nil
+
+        stdout_io = StringIO.new
+
+        configure_stdout(stdout_io)
+        write(address, path, role_id, secret_id)
+        reset_stdout
+        RakeVault::TokenFile.write(stdout_io.string)
+      end
+
+      def self.write(address, path, role_id, secret_id)
+        RubyVault.write(
+          address: address,
+          path: path,
+          data: [role_id, secret_id].compact,
+          format: 'json'
+        )
+      end
+
+      def self.configure_stdout(stdout_io)
+        RubyVault.configure do |config|
+          config.stdout = stdout_io
+        end
+      end
+
+      def self.reset_stdout
+        RubyVault.configure do |config|
+          config.stdout = $stdout
+        end
+      end
+    end
+  end
+end

data/lib/rake_vault/auth/oidc.rb

@@ -0,0 +1,20 @@
+# frozen_string_literal: true
+
+require 'ruby_vault'
+
+module RakeVault
+  module Auth
+    module Oidc
+      def self.login(address, role, no_print)
+        auth = role ? ["role=#{role}"] : []
+
+        RubyVault.login(
+          method: 'oidc',
+          auth: auth,
+          address: address,
+          no_print: no_print
+        )
+      end
+    end
+  end
+end

data/lib/rake_vault/tasks/app_role_auth.rb

@@ -1,6 +1,7 @@
 # frozen_string_literal: true
 
 require 'rake_factory'
+require_relative '../auth/approle'
 require_relative '../token_file'
 
 module RakeVault
@@ -20,25 +21,12 @@ module RakeVault
       parameter :secret_id
 
       action do |task|
-        role_id = task.role_id ? "role_id=#{task.role_id}" : nil
-        secret_id = task.secret_id ? "secret_id=#{task.secret_id}" : nil
-
-        stdout_io = StringIO.new
-
-        RubyVault.configure do |config|
-          config.stdout = stdout_io
-        end
-
-        RubyVault.write(
-          address: task.address,
-          path: task.path,
-          data: [role_id, secret_id].compact,
-          format: 'json'
+        RakeVault::Auth::Approle.login(
+          task.address,
+          task.path,
+          task.role_id,
+          task.secret_id
         )
-        RubyVault.configure do |config|
-          config.stdout = $stdout
-        end
-        RakeVault::TokenFile.write(stdout_io.string)
       end
     end
   end

data/lib/rake_vault/tasks/login.rb

@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'rake_factory'
+require 'vault'
+require_relative '../auth/approle'
+require_relative '../auth/oidc'
+
+module RakeVault
+  module Tasks
+    class Login < RakeFactory::Task
+      default_name :login
+      default_prerequisites(RakeFactory::DynamicValue.new do |t|
+        [t.ensure_task_name]
+      end)
+      default_description(RakeFactory::DynamicValue.new do |_t|
+        'Login with approle or oidc using vault'
+      end)
+      parameter :address
+      parameter :role
+      parameter :ensure_task_name, default: :'vault:ensure'
+
+      action do |task|
+        puts 'Logging into vault...'
+        if valid_token?(task.address)
+          puts 'Valid token found.'
+        else
+          puts 'No valid token found. Attempting to login...'
+          app_role_role_id = ENV.fetch('VAULT_APPROLE_ROLE_ID', nil)
+          app_role_secret_id = ENV.fetch('VAULT_APPROLE_SECRET_ID', nil)
+          if app_role_role_id && app_role_secret_id
+            puts 'Approle credentials found. Logging in with approle...'
+            RakeVault::Auth::Approle.login(
+              task.address,
+              'auth/approle/login',
+              app_role_role_id,
+              app_role_secret_id
+            )
+          else
+            RakeVault::Auth::Oidc.login(task.address, task.role, true)
+          end
+        end
+      end
+
+      def valid_token?(address)
+        puts 'Checking for valid token...'
+        vault_client = Vault::Client.new(address: address)
+        vault_client.auth_token.lookup_self
+      rescue Vault::HTTPClientError, Vault::HTTPServerError
+        false
+      else
+        true
+      end
+    end
+  end
+end

data/lib/rake_vault/tasks/oidc_auth.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 require 'rake_factory'
-require 'ruby_vault'
+require_relative '../auth/oidc'
 
 module RakeVault
   module Tasks
@@ -19,14 +19,7 @@ module RakeVault
       parameter :no_print, default: false
 
       action do |task|
-        auth = task.role ? ["role=#{task.role}"] : []
-
-        RubyVault.login(
-          method: 'oidc',
-          auth: auth,
-          address: task.address,
-          no_print: task.no_print
-        )
+        RakeVault::Auth::Oidc.login(task.address, task.role, task.no_print)
       end
     end
   end

data/lib/rake_vault/tasks.rb

@@ -2,6 +2,7 @@
 
 require_relative 'tasks/oidc_auth'
 require_relative 'tasks/app_role_auth'
+require_relative 'tasks/login'
 
 module RakeVault
   module Tasks

data/lib/rake_vault/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module RakeVault
-  VERSION = '0.1.0.pre.11'
+  VERSION = '0.1.0.pre.13'
 end

data/lib/rake_vault.rb

@@ -22,6 +22,10 @@ module RakeVault
     RakeVault::Tasks::AppRoleAuth.define(opts, &block)
   end
 
+  def self.define_login_task(opts = {}, &block)
+    RakeVault::Tasks::Login.define(opts, &block)
+  end
+
   class << self
     private
 

data/rake_vault.gemspec

@@ -40,6 +40,7 @@ Gem::Specification.new do |spec|
   spec.add_dependency 'rake_dependencies', '~> 3.1'
   spec.add_dependency 'rake_factory', '~> 0.23'
   spec.add_dependency 'ruby_vault', '~> 0.1.0.pre.15'
+  spec.add_dependency 'vault', '~> 0.17'
 
   spec.add_development_dependency 'activesupport'
   spec.add_development_dependency 'bundler'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: rake_vault
 version: !ruby/object:Gem::Version
-  version: 0.1.0.pre.11
+  version: 0.1.0.pre.13
 platform: ruby
 authors:
 - InfraBlocks Maintainers
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-08-11 00:00:00.000000000 Z
+date: 2022-09-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: colored2
@@ -66,6 +66,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 0.1.0.pre.15
+- !ruby/object:Gem::Dependency
+  name: vault
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.17'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '0.17'
 - !ruby/object:Gem::Dependency
   name: activesupport
   requirement: !ruby/object:Gem::Requirement
@@ -278,10 +292,13 @@ files:
 - bin/console
 - bin/setup
 - lib/rake_vault.rb
+- lib/rake_vault/auth/approle.rb
+- lib/rake_vault/auth/oidc.rb
 - lib/rake_vault/task_sets.rb
 - lib/rake_vault/task_sets/vault.rb
 - lib/rake_vault/tasks.rb
 - lib/rake_vault/tasks/app_role_auth.rb
+- lib/rake_vault/tasks/login.rb
 - lib/rake_vault/tasks/oidc_auth.rb
 - lib/rake_vault/token_file.rb
 - lib/rake_vault/version.rb