settings_reader-vault_resolver 0.2.1 → 0.2.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: f126e949c2a936423dbca26aacba8a20a5ddc89b245c9ff0fbd514d0d41e9f05
-  data.tar.gz: c3a592e95462d32c511f945033ff4da1ff7956f9b9854c08fa91b65682d8fc20
+  metadata.gz: 16ca7880831b27b05c24651940a1dab796b792f7d98229f2f01e229ffcee5662
+  data.tar.gz: ff8e434b0512ce66772e8f99b16761ea51597614b195abb91889a5543ba88267
 SHA512:
-  metadata.gz: 6117c34284578be43c1bb21d370d1c56298ffea393c2ce485d25e4b1fbb6f8a2ec8f1b9d9d86b472cff6ad6b6506949895babd8086c71e26193a7fbcca5f6b1e
-  data.tar.gz: b17550f51be60b61eb7efdb0034d262408ec5a231f6152cc3e356813a632b88b15f679e84a7bf3deb039dd0252742082b1917bc9f1a21206730a803048fb4027
+  metadata.gz: e1476c785e7369a2a2f3d4ee47a149cfd3c1fc2ebf333a94a1ec158c564584995ced9392fa08e1be9ec16ba166c0f20899414e02622473a4d0058ef5d70abce2
+  data.tar.gz: 8c1a40bd635b8e9de7193114618a0669e3c9d3ffabae250ff5efc416a31636c199584bb7e474373ead29bde9e85e281adbba0e7ba123358e1729d0e599bf17bf

data/lib/settings_reader/vault_resolver/entry.rb

@@ -42,6 +42,10 @@ module SettingsReader
         secret.data[attribute.to_sym]
       end
 
+      def to_s
+        address.to_s
+      end
+
       private
 
       def lease_duration

data/lib/settings_reader/vault_resolver/instance.rb

@@ -4,6 +4,8 @@ module SettingsReader
   module VaultResolver
     # Resolver class for Settings Reader
     class Instance
+      include Logging
+
       IDENTIFIER = 'vault://'.freeze
       DATABASE_MOUNT = 'database'.freeze
 
@@ -15,6 +17,7 @@ module SettingsReader
 
       # Expect value in format `vault://mount/path/to/secret?attribute_name`
       def resolve(value, _path)
+        debug { "Resolving Vault secret at #{value}" }
         address = SettingsReader::VaultResolver::Address.new(value)
         entry = fetch_entry(address)
         entry&.value_for(address.attribute)
@@ -22,14 +25,18 @@ module SettingsReader
 
       # Resolve KV secret
       def kv_secret(address)
+        debug { "Fetching new kv secret at: #{address}" }
         Vault.kv(address.mount).read(address.path)
       rescue Vault::HTTPClientError => e
+        error { "Error retrieving secret at: #{address}: #{e.message}" }
         raise SettingsReader::VaultResolver::Error, e.message
       end
 
       def database_secret(address)
+        debug { "Fetching new database secret at: #{address}" }
         Vault.logical.read(address.full_path)
       rescue Vault::HTTPClientError => e
+        error { "Error retrieving database secret: #{address}: #{e.message}" }
         return nil if e.message.include?('* unknown role')
 
         raise SettingsReader::VaultResolver::Error, e.message
@@ -39,8 +46,12 @@ module SettingsReader
 
       def fetch_entry(address)
         cache.fetch(address) do
+          info { "Retrieving new secret at: #{address}" }
           if (secret = address.mount == DATABASE_MOUNT ? database_secret(address) : kv_secret(address))
+            debug { "Retrieved secret at: #{address}" }
             SettingsReader::VaultResolver::Entry.new(address, secret)
+          else
+            debug { "Secret not retrieved: #{address}" }
           end
         end
       end

data/lib/settings_reader/vault_resolver/logging.rb

@@ -0,0 +1,40 @@
+module SettingsReader
+  module VaultResolver
+    # Methods for centralized logging
+    module Logging
+      def debug(&block)
+        logger.debug do
+          "[VaultResolver] #{block.call}"
+        end
+        nil
+      end
+
+      def info(&block)
+        logger.info do
+          "[VaultResolver] #{block.call}"
+        end
+        nil
+      end
+
+      def warn(&block)
+        logger.warn do
+          "[VaultResolver] #{block.call}"
+        end
+        nil
+      end
+
+      def error(&block)
+        logger.error do
+          "[VaultResolver] #{block.call}"
+        end
+        nil
+      end
+
+      private
+
+      def logger
+        @logger ||= SettingsReader::VaultResolver.logger
+      end
+    end
+  end
+end

data/lib/settings_reader/vault_resolver/refresher.rb

@@ -2,6 +2,8 @@ module SettingsReader
   module VaultResolver
     # Vault Lease refresher task
     class Refresher
+      include Logging
+
       DEFAULT_RENEW_DELAY = 200
       REFRESH_INTERVAL = 60
 
@@ -11,12 +13,15 @@ module SettingsReader
 
       def refresh
         @cache.entries.each do |entry|
+          debug { "Checking lease for #{entry}. Leased?: #{entry.leased?}. Expires in: #{entry.expires_in}s" }
           next unless entry.leased?
           next unless entry.expires_in < DEFAULT_RENEW_DELAY
 
+          info { "Refreshing lease for #{entry}. Expires in: #{entry.expires_in}" }
           entry.renew
-        rescue SettingsReader::VaultResolver::Error => _e
-          # TODO: Log error in future. Think if we can request new secret again.
+          info { "Lease renewed for #{entry}. Expires in: #{entry.expires_in}" }
+        rescue SettingsReader::VaultResolver::Error => e
+          error { "Error refreshing lease for #{entry}: #{e.message}" }
           # Continue renewal.
         end
       end
@@ -24,6 +29,7 @@ module SettingsReader
       def self.refresh_task(cache)
         refresher = self
         Concurrent::TimerTask.new(execution_interval: refresher::REFRESH_INTERVAL) do
+          info { 'Refreshing Vault leases' }
           refresher.new(cache).refresh
         end
       end

data/lib/settings_reader/vault_resolver/version.rb

@@ -1,5 +1,5 @@
 module SettingsReader
   module VaultResolver
-    VERSION = '0.2.1'.freeze
+    VERSION = '0.2.2'.freeze
   end
 end

data/lib/settings_reader/vault_resolver.rb

@@ -1,6 +1,9 @@
+require 'logger'
 require 'concurrent/timer_task'
+
 require 'settings_reader'
 require 'settings_reader/vault_resolver/version'
+require 'settings_reader/vault_resolver/logging'
 require 'settings_reader/vault_resolver/address'
 require 'settings_reader/vault_resolver/entry'
 require 'settings_reader/vault_resolver/cache'
@@ -16,6 +19,13 @@ module SettingsReader
       attr_accessor :cache, :refresher_timer_task
     end
 
+    def self.logger
+      return @logger if @logger
+      return @logger = Rails.logger if defined? Rails
+
+      @logger = Logger.new($stdout, level: Logger::INFO)
+    end
+
     def self.setup_cache
       self.cache ||= SettingsReader::VaultResolver::Cache.new
     end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: settings_reader-vault_resolver
 version: !ruby/object:Gem::Version
-  version: 0.2.1
+  version: 0.2.2
 platform: ruby
 authors:
 - Volodymyr Mykhailyk
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-03-03 00:00:00.000000000 Z
+date: 2022-03-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -84,6 +84,7 @@ files:
 - lib/settings_reader/vault_resolver/entry.rb
 - lib/settings_reader/vault_resolver/helpers/k8s_auth.rb
 - lib/settings_reader/vault_resolver/instance.rb
+- lib/settings_reader/vault_resolver/logging.rb
 - lib/settings_reader/vault_resolver/patches/authenticate.rb
 - lib/settings_reader/vault_resolver/refresher.rb
 - lib/settings_reader/vault_resolver/version.rb