settings_reader-vault_resolver 0.2.0 → 0.2.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6fe4de635c4d0ba1afe60f4afbe5f57e95d80a78478716e675d3ce6db2b199b9
-  data.tar.gz: 9a4ee37b4d2c97e8f9ce800341c939c97c8840c9456941fdefc78ee6c0e94b5e
+  metadata.gz: 62d9b04d2c1d077efc9fd04b8de77c13e1d30fea6bbed0a942f3411c32130216
+  data.tar.gz: 4ee9710b9173260acabf445a658b6987d516034a03eee86f2c5ae2d22b013c23
 SHA512:
-  metadata.gz: 6cfecb21a01d668a24ea9012a493bad098027b262fcd5c685e829245f9aba58b134df6d14531e2fe0ed5e0c484ae3408cd9e8276edfdf0de507ce00feb1335b7
-  data.tar.gz: 5d91521d23281113331bab1d6c637186b2453950834179857eb66ad68c20e801a0a215b67f122424b692cf301349afe14e2a95f212c5d18d980a968cc13c43b2
+  metadata.gz: b4b55065d8d4349457e791383c4265957e80fec4b8997676b75a4b8b11523efbf4584b18298eecbbc3be244d40a718be3d45b5ff6fca04fe8f9edb64e2d69e6e
+  data.tar.gz: 91ba8dacc8becf367766cddadabcd22a06f69ab0068e6604ffbb3424d7a363bac8def6a334f972cd46b649d9c75dccd78bf5da2cf684421752da9b235fe30e91

data/CHANGELOG.md

@@ -1,5 +1,9 @@
 ## [Unreleased]
 
+## [0.2.1]
+### Fixes
+- Use default k8s auth route without namespace 
+
 ## [0.2.0]
 ### New features
 - Better integration with parent gem
@@ -17,7 +21,8 @@
 - Secrets caching
 - Automatic secrets lease renewal
 
-[Unreleased]: https://github.com/matic-insurance/settings_reader-vault_resolver/compare/0.2.0...HEAD
+[Unreleased]: https://github.com/matic-insurance/settings_reader-vault_resolver/compare/0.2.1...HEAD
+[0.2.1]: https://github.com/matic-insurance/settings_reader-vault_resolver/commits/0.2.1
 [0.2.0]: https://github.com/matic-insurance/settings_reader-vault_resolver/commits/0.2.0
 [0.1.1]: https://github.com/matic-insurance/settings_reader-vault_resolver/commits/0.1.1
 [0.1.0]: https://github.com/matic-insurance/settings_reader-vault_resolver/commits/0.1.0

data/lib/settings_reader/vault_resolver/entry.rb

@@ -42,6 +42,10 @@ module SettingsReader
         secret.data[attribute.to_sym]
       end
 
+      def to_s
+        address.to_s
+      end
+
       private
 
       def lease_duration

data/lib/settings_reader/vault_resolver/instance.rb

@@ -4,6 +4,8 @@ module SettingsReader
   module VaultResolver
     # Resolver class for Settings Reader
     class Instance
+      include Logging
+
       IDENTIFIER = 'vault://'.freeze
       DATABASE_MOUNT = 'database'.freeze
 
@@ -15,6 +17,7 @@ module SettingsReader
 
       # Expect value in format `vault://mount/path/to/secret?attribute_name`
       def resolve(value, _path)
+        debug { "Resolving Vault secret at #{value}" }
         address = SettingsReader::VaultResolver::Address.new(value)
         entry = fetch_entry(address)
         entry&.value_for(address.attribute)
@@ -22,14 +25,18 @@ module SettingsReader
 
       # Resolve KV secret
       def kv_secret(address)
+        debug { "Fetching new kv secret at: #{address}" }
         Vault.kv(address.mount).read(address.path)
       rescue Vault::HTTPClientError => e
+        error { "Error retrieving secret at: #{address}: #{e.message}" }
         raise SettingsReader::VaultResolver::Error, e.message
       end
 
       def database_secret(address)
+        debug { "Fetching new database secret at: #{address}" }
         Vault.logical.read(address.full_path)
       rescue Vault::HTTPClientError => e
+        error { "Error retrieving database secret: #{address}: #{e.message}" }
         return nil if e.message.include?('* unknown role')
 
         raise SettingsReader::VaultResolver::Error, e.message
@@ -39,8 +46,12 @@ module SettingsReader
 
       def fetch_entry(address)
         cache.fetch(address) do
+          info { "Retrieving new secret at: #{address}" }
           if (secret = address.mount == DATABASE_MOUNT ? database_secret(address) : kv_secret(address))
+            debug { "Retrieved secret at: #{address}" }
             SettingsReader::VaultResolver::Entry.new(address, secret)
+          else
+            debug { "Secret not retrieved: #{address}" }
           end
         end
       end

data/lib/settings_reader/vault_resolver/logging.rb

@@ -0,0 +1,40 @@
+module SettingsReader
+  module VaultResolver
+    # Methods for centralized logging
+    module Logging
+      def debug(&block)
+        logger.debug do
+          "[VaultResolver] #{block.call}"
+        end
+        nil
+      end
+
+      def info(&block)
+        logger.info do
+          "[VaultResolver] #{block.call}"
+        end
+        nil
+      end
+
+      def warn(&block)
+        logger.warn do
+          "[VaultResolver] #{block.call}"
+        end
+        nil
+      end
+
+      def error(&block)
+        logger.error do
+          "[VaultResolver] #{block.call}"
+        end
+        nil
+      end
+
+      private
+
+      def logger
+        SettingsReader::VaultResolver.logger
+      end
+    end
+  end
+end

data/lib/settings_reader/vault_resolver/patches/authenticate.rb

@@ -2,7 +2,7 @@ module Vault
   # Monkey patch to support k8s authenticaiton. Taken from https://github.com/hashicorp/vault-ruby/pull/202
   class Authenticate < Request
     def kubernetes(role, route = nil, service_token_path = nil)
-      route ||= '/v1/admin/auth/kubernetes/login'
+      route ||= '/v1/auth/kubernetes/login'
       service_token_path ||= '/var/run/secrets/kubernetes.io/serviceaccount/token'
 
       payload = {

data/lib/settings_reader/vault_resolver/refresher.rb

@@ -2,6 +2,8 @@ module SettingsReader
   module VaultResolver
     # Vault Lease refresher task
     class Refresher
+      include Logging
+
       DEFAULT_RENEW_DELAY = 200
       REFRESH_INTERVAL = 60
 
@@ -11,12 +13,15 @@ module SettingsReader
 
       def refresh
         @cache.entries.each do |entry|
+          debug { "Checking lease for #{entry}. Leased?: #{entry.leased?}. Expires in: #{entry.expires_in}s" }
           next unless entry.leased?
           next unless entry.expires_in < DEFAULT_RENEW_DELAY
 
+          info { "Refreshing lease for #{entry}. Expires in: #{entry.expires_in}" }
           entry.renew
-        rescue SettingsReader::VaultResolver::Error => _e
-          # TODO: Log error in future. Think if we can request new secret again.
+          info { "Lease renewed for #{entry}. Expires in: #{entry.expires_in}" }
+        rescue SettingsReader::VaultResolver::Error => e
+          error { "Error refreshing lease for #{entry}: #{e.message}" }
           # Continue renewal.
         end
       end
@@ -24,6 +29,7 @@ module SettingsReader
       def self.refresh_task(cache)
         refresher = self
         Concurrent::TimerTask.new(execution_interval: refresher::REFRESH_INTERVAL) do
+          info { 'Refreshing Vault leases' }
           refresher.new(cache).refresh
         end
       end

data/lib/settings_reader/vault_resolver/version.rb

@@ -1,5 +1,5 @@
 module SettingsReader
   module VaultResolver
-    VERSION = '0.2.0'.freeze
+    VERSION = '0.2.3'.freeze
   end
 end

data/lib/settings_reader/vault_resolver.rb

@@ -1,6 +1,9 @@
+require 'logger'
 require 'concurrent/timer_task'
+
 require 'settings_reader'
 require 'settings_reader/vault_resolver/version'
+require 'settings_reader/vault_resolver/logging'
 require 'settings_reader/vault_resolver/address'
 require 'settings_reader/vault_resolver/entry'
 require 'settings_reader/vault_resolver/cache'
@@ -16,6 +19,17 @@ module SettingsReader
       attr_accessor :cache, :refresher_timer_task
     end
 
+    def self.logger
+      return @logger if @logger
+      return @logger = Rails.logger if (defined? Rails) && Rails.logger
+
+      @logger = Logger.new($stdout, level: Logger::INFO)
+    end
+
+    def self.logger=(logger)
+      @logger = logger
+    end
+
     def self.setup_cache
       self.cache ||= SettingsReader::VaultResolver::Cache.new
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: settings_reader-vault_resolver
 version: !ruby/object:Gem::Version
-  version: 0.2.0
+  version: 0.2.3
 platform: ruby
 authors:
 - Volodymyr Mykhailyk
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-03-01 00:00:00.000000000 Z
+date: 2022-03-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -84,6 +84,7 @@ files:
 - lib/settings_reader/vault_resolver/entry.rb
 - lib/settings_reader/vault_resolver/helpers/k8s_auth.rb
 - lib/settings_reader/vault_resolver/instance.rb
+- lib/settings_reader/vault_resolver/logging.rb
 - lib/settings_reader/vault_resolver/patches/authenticate.rb
 - lib/settings_reader/vault_resolver/refresher.rb
 - lib/settings_reader/vault_resolver/version.rb