secretfile 1.0.0 → 1.0.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: ac96b297cfbea1520060b9cd6a64293f820ef59dd7a9761b20fa92d155c6116d
-  data.tar.gz: e158820858b542598aa9bf6e86771791225e61800786d18043845e53fe97f6ea
+  metadata.gz: 95caa9eefe3f9bb4f31e9ce708c5f99214a65b2b0c34337626e2ec6e90a92dd4
+  data.tar.gz: 6162a919731194f74b403535c6948bc67fb244e51e9f37eb56d0827ea08f8476
 SHA512:
-  metadata.gz: ac4e9b55d023d18d3c8685ee81af85a76926a59476afa086c5efac313590da278ed6fbc0c52c3fb918796f9933b830a3dd204df9899e37f8f09bdaeeb7f5eaac
-  data.tar.gz: f386f6057d8df44393e698d63ad609f7baf57902a7ea290cd70066bb4f17a2c4cab527de2815e471a22505646e509ce05bfd2d5007d90c9a919891988f6816cb
+  metadata.gz: 0e295258504e57ff1f7bf3251db27d11d82f9080fa7714d8c732e2d299dc8661b87391bebe83b5cfab9cb6d1e9079d3a1978189956f468ecbd9c33b11458f716
+  data.tar.gz: 4cd67553464dca3e61ab9a39044c62395520a6de49dd25e00bceac7743c075aee3eb11268226e06d4ec1a7d1c26dcf188592777c55a17e77260396e8b822bc40

data/CHANGELOG.md

@@ -1,3 +1,10 @@
+1.0.1 / 2019-07-24
+
+* Enhancements
+
+  * Support Amazon STS with Secretfile.group {}
+  * Support dashes in vault paths
+
 1.0.0 / 2019-07-24
 
 Initial release - inspired by https://github.com/erithmetic/secret_garden

data/README.md

@@ -31,6 +31,11 @@ The initial implementation of Secretfile in ruby was [`secret_garden`](https://g
     <td>Yes - you <code>require 'secret_garden/vault'</code> etc.</td>
     <td>No - you only get vault, and it's required by default</td>
   </tr>
+  <tr>
+    <td>Supports dynamic vault secrets (e.g. Amazon STS)?</td>
+    <td>No - they are never refreshed</td>
+    <td>Yes - they are pulled together, but not cached. Use <code>Secretfile.group { Secretfile.get(x); Secretfile.get(y) }</code>.</td>
+  </tr>
 </Table>
 
 ## Installation
@@ -55,6 +60,9 @@ In your Secretfile:
 
 ```
 DATABASE_URL secrets/$VAULT_ENV/database:url
+AWS_ACCESS_KEY_ID aws/sts/myrole:access_key
+AWS_SECRET_ACCESS_KEY aws/sts/myrole:secret_key
+AWS_SESSION_TOKEN aws/sts/myrole:security_token
 ```
 
 Then you call
@@ -63,6 +71,16 @@ Then you call
 Secretfile.get('DATABASE_URL') # looks for ENV['DATABASE_URL'], falling back to secrets/$VAULT_ENV/database:url
 ```
 
+To use dynamic creds like [Amazon STS](https://docs.aws.amazon.com/STS/latest/APIReference/Welcome.html) with the [Vault AWS Secrets engine](https://www.vaultproject.io/docs/secrets/aws/index.html), do this:
+
+```
+Secretfile.group do
+  akid = Secretfile.get('AWS_ACCESS_KEY_ID')
+  sk = Secretfile.get('AWS_SECRET_ACCESS_KEY')
+  st = Secretfile.get('AWS_SESSION_TOKEN')
+end
+```
+
 ## Development
 
 After checking out the repo, run `bin/setup` to install dependencies. Then, run `rake spec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.

data/Secretfile

@@ -3,3 +3,7 @@
 SECRET1 not/in/vault:set_in_env
 SECRET2 secret/test:value
 SECRET3 not/in/vault:expected_to_raise
+# amazon sts, for example, requires these all to be gotten at once
+AWS_ACCESS_KEY_ID aws/sts/myrole:access_key
+AWS_SECRET_ACCESS_KEY aws/sts/myrole:secret_key
+AWS_SESSION_TOKEN aws/sts/myrole:security_token

data/lib/secretfile.rb

@@ -10,9 +10,19 @@ class Secretfile
     def get(k)
       instance.get k
     end
+
+    def group
+      begin
+        instance.group ||= {}
+        yield
+      ensure
+        instance.group = nil
+      end
+    end
   end
 
   attr_reader :spec
+  attr_accessor :group
 
   def initialize
     super # singleton magic i guess
@@ -28,7 +38,13 @@ class Secretfile
       ENV[k]
     else
       path, field = spec.fetch k
-      payload = Vault.logical.read(path) or raise("Secret #{k.inspect} not found in Vault at #{path}")
+      payload = if group&.has_key?(path)
+        group[path]
+      else
+        memo = Vault.logical.read(path) or raise("Secret #{k.inspect} not found in Vault at #{path}")
+        group[path] = memo if group
+        memo
+      end
       payload.data[field.to_sym] or raise("Secret #{k.inspect} not found in Vault at #{path}:#{field}")
     end
   end
@@ -39,7 +55,7 @@ class Secretfile
     ENV.fetch('SECRETFILE_PATH', 'Secretfile')
   end
 
-  VALID_LINE = /\A\w+\s+[\w\/]+:\w+\z/
+  VALID_LINE = /\A\w+\s+[\w\-\/]+:\w+\z/
   def read_spec
     raise "Expected Secretfile" unless File.readable?(spec_path)
     @spec = IO.readlines(spec_path).inject({}) do |memo, line|

data/lib/secretfile/version.rb

@@ -1,3 +1,3 @@
 class Secretfile
-  VERSION = '1.0.0'
+  VERSION = '1.0.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: secretfile
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.0.1
 platform: ruby
 authors:
 - Seamus Abshere