settings_reader-vault_resolver 0.4.10 → 0.6.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e80770a5709f4c47de9c79c771e2174749ad345d5f59584d83d406fd44b9d8cb
-  data.tar.gz: 78d265a099e0a191bf01882cb666acfeecc802e1211fa097fe5588107720e90c
+  metadata.gz: 1a4f83916758232ddc5e3b36f6cc9ea25b813cd5bc69fb0f4a71d5b651a07ddf
+  data.tar.gz: baa1b66b38f6d2b41bcf11fcf230613740a67a6cf78d68db531ff6a5960f8b0f
 SHA512:
-  metadata.gz: 900237697adf7ee9984e912bde5c1a8433ef345084db65d76d03d39fd1d904fc4f5859a9a7205634e2c1ccb5f9a807f1f2ba066b147ade86febb1695bd7ff9d7
-  data.tar.gz: 7ff9538f5d886b99ace02d7eed050df0e017abba45de586d8c91e0c20bd7b505074545317df3b7a7f223728ea32dc39adf76a214f0f938e5ad9a3fbaf63b8e49
+  metadata.gz: 3d44012714aed2cb366128221b4764c5b260ff6dadb0548de267b30663864f0c2bc0e0d5e6848576b2791672001fdb81c88f18846dcd6cad1b498fe009ee6c53
+  data.tar.gz: 05ffe659944dbc215264ad3097f64a54a481f9943c9b7cee500281af806246727df9292cf29c6a10481f6049bbf0d174d0ab5165b19b946999eb044bbc0bd088

data/.github/workflows/main.yml

@@ -18,28 +18,39 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby: [ '2.5', '2.6', '2.7', '3.0' ]
-    services:
-      vault:
-        image: hashicorp/vault
-        ports:
-          - "8200:8200"
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: vault_root_token
-          SKIP_SETCAP: true
-      database:
-        image: postgres:14.1-alpine
-        ports:
-          - "5432:5432"
-        env:
-          POSTGRES_USER: 'vault_root'
-          POSTGRES_PASSWORD: 'root_password'
-          POSTGRES_DB: 'app_db'
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+        ruby: [ '2.7', '3.0', '3.3' ]
+#    services:
+#      vault:
+#        image: hashicorp/vault
+#        ports:
+#          - "8200:8200"
+#        env:
+#          VAULT_DEV_ROOT_TOKEN_ID: vault_root_token
+#          SKIP_SETCAP: true
+#      database:
+#        image: postgres:14.1-alpine
+#        ports:
+#          - "5432:5432"
+#        env:
+#          POSTGRES_USER: 'vault_root'
+#          POSTGRES_PASSWORD: 'root_password'
+#          POSTGRES_DB: 'app_db'
+#        options: >-
+#          --health-cmd pg_isready
+#          --health-interval 10s
+#          --health-timeout 5s
+#          --health-retries 5
+#      aws:
+#        image: localstack/localstack
+#        ports:
+#          - "127.0.0.1:4566:4566"            # LocalStack Gateway
+#          - "127.0.0.1:4510-4559:4510-4559"  # external services port range
+#        env:
+#          DEBUG: 0
+#        volumes:
+#          - '/home/runner/work/settings_reader-vault_resolver/local/localstack/app-access-policy.json:/etc/localstack/init/ready.d/app-access-policy.json'
+#          - '/home/runner/work/settings_reader-vault_resolver/local/localstack/app-assume-policy.json:/etc/localstack/init/ready.d/app-assume-policy.json'
+#          - '/home/runner/work/settings_reader-vault_resolver/local/localstack/init-aws.sh:/etc/localstack/init/ready.d/init-aws.sh'
     steps:
       - name: Checkout
         uses: actions/checkout@v1
@@ -50,23 +61,24 @@ jobs:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
 
-      - name: Set up Vault
-        run: sh local/vault/setup.sh
+      - name: Start Dependencies
+        run: |
+          docker compose up -d
+          echo "Waiting 15 seconds for initial configuraiton"
+          sleep 15
 
       - name: Run specs
-        env:
-          COVERAGE: true
         run: bundle exec rspec
 
-      - name: Upload coverage
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        run: bash <(curl -s https://codecov.io/bash)
-
   release:
     runs-on: ubuntu-latest
     needs: build
-    if: github.event_name == 'release' && github.event.action == 'published'
+    # if: github.event_name == 'release' && github.event.action == 'published'
+
+    permissions:
+      # contents: write
+      id-token: write
+
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -76,19 +88,16 @@ jobs:
         with:
           ruby-version: 2.7
           bundler-cache: true
-      - name: Set up credentials
-        run: |
-          mkdir -p $HOME/.gem
-          touch $HOME/.gem/credentials
-          chmod 0600 $HOME/.gem/credentials
-          printf -- "---\n:rubygems_api_key: ${{secrets.RUBYGEMS_AUTH_TOKEN}}\n" > $HOME/.gem/credentials
 
-      - name: Get version
-        run: echo "${GITHUB_REF/refs\/tags\//}" > release.tag
+
+      # - name: Get version
+      #   run: echo "${GITHUB_REF/refs\/tags\//}" > release.tag
       - name: Set version
-        run: sed -i "s/0.0.0/$(<release.tag)/g" $(find . -name "version.rb")
+        run: sed -i "s/0.0.0/0.6.1/g" $(find . -name "version.rb")
+
+      - uses: rubygems/configure-rubygems-credentials@v1.0.0
 
       - name: Build gem
         run: gem build *.gemspec
       - name: Push gem
-        run: gem push *.gem
+        run: gem push *.gem

data/.rubocop.yml

@@ -1,7 +1,7 @@
 AllCops:
   NewCops: enable
   SuggestExtensions: false
-  TargetRubyVersion: 2.5
+  TargetRubyVersion: 2.7
 
 Gemspec/RequireMFA:
   Enabled: false

data/.simplecov

@@ -1,9 +1,7 @@
 if ENV['COVERAGE']
   require 'simplecov'
-  require 'codecov'
   SimpleCov.start do
     enable_coverage :branch
     primary_coverage :branch
-    formatter SimpleCov::Formatter::Codecov
   end
 end

data/.tool-versions

@@ -0,0 +1 @@
+ruby 3.3.8

data/Gemfile

@@ -3,7 +3,6 @@ source 'https://rubygems.org'
 # Specify your gem's dependencies in settings_reader-vault_resolver.gemspec
 gemspec
 
-gem 'codecov'
 gem 'rake'
 gem 'rspec'
 gem 'rubocop'

data/Gemfile.lock

@@ -9,22 +9,25 @@ PATH
 GEM
   remote: https://rubygems.org/
   specs:
-    ast (2.4.2)
+    ast (2.4.3)
     aws-eventstream (1.2.0)
     aws-sigv4 (1.4.0)
       aws-eventstream (~> 1, >= 1.0.2)
-    codecov (0.6.0)
-      simplecov (>= 0.15, < 0.22)
     concurrent-ruby (1.1.9)
     diff-lcs (1.5.0)
     docile (1.4.0)
-    parallel (1.21.0)
-    parser (3.1.1.0)
+    json (2.13.2)
+    language_server-protocol (3.17.0.5)
+    lint_roller (1.1.0)
+    parallel (1.27.0)
+    parser (3.3.9.0)
       ast (~> 2.4.1)
+      racc
+    prism (1.4.0)
+    racc (1.8.1)
     rainbow (3.1.1)
     rake (13.0.6)
-    regexp_parser (2.2.1)
-    rexml (3.2.5)
+    regexp_parser (2.11.2)
     rspec (3.10.0)
       rspec-core (~> 3.10.0)
       rspec-expectations (~> 3.10.0)
@@ -38,29 +41,34 @@ GEM
       diff-lcs (>= 1.2.0, < 2.0)
       rspec-support (~> 3.10.0)
     rspec-support (3.10.3)
-    rubocop (1.25.1)
+    rubocop (1.80.2)
+      json (~> 2.3)
+      language_server-protocol (~> 3.17.0.2)
+      lint_roller (~> 1.1.0)
       parallel (~> 1.10)
-      parser (>= 3.1.0.0)
+      parser (>= 3.3.0.2)
       rainbow (>= 2.2.2, < 4.0)
-      regexp_parser (>= 1.8, < 3.0)
-      rexml
-      rubocop-ast (>= 1.15.1, < 2.0)
+      regexp_parser (>= 2.9.3, < 3.0)
+      rubocop-ast (>= 1.46.0, < 2.0)
       ruby-progressbar (~> 1.7)
-      unicode-display_width (>= 1.4.0, < 3.0)
-    rubocop-ast (1.16.0)
-      parser (>= 3.1.1.0)
+      unicode-display_width (>= 2.4.0, < 4.0)
+    rubocop-ast (1.46.0)
+      parser (>= 3.3.7.2)
+      prism (~> 1.4)
     rubocop-rspec (1.32.0)
       rubocop (>= 0.60.0)
-    ruby-progressbar (1.11.0)
+    ruby-progressbar (1.13.0)
     settings_reader (0.1.0)
     simplecov (0.21.2)
       docile (~> 1.1)
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.12.3)
-    simplecov_json_formatter (0.1.3)
+    simplecov_json_formatter (0.1.4)
     timecop (0.9.4)
-    unicode-display_width (2.1.0)
+    unicode-display_width (3.2.0)
+      unicode-emoji (~> 4.1)
+    unicode-emoji (4.1.0)
     vault (0.16.0)
       aws-sigv4
 
@@ -68,7 +76,6 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
-  codecov
   rake
   rspec
   rubocop
@@ -78,4 +85,4 @@ DEPENDENCIES
   timecop
 
 BUNDLED WITH
-   2.1.4
+   2.2.32

data/docker-compose.yml

@@ -2,12 +2,20 @@
 version: '3'
 services:
   vault:
-    image: vault
+    image: hashicorp/vault
     ports:
       - "8200:8200"
     environment:
       VAULT_DEV_ROOT_TOKEN_ID: 'vault_root_token'
       SKIP_SETCAP: 'true'
+#  playground:
+#    image: hashicorp/vault
+#    command:
+#      - sleep
+#      - '10000000000'
+#    environment:
+#      VAULT_ADDR: 'http://aws:8200'
+#      VAULT_TOKEN: 'vault_root_token'
   db:
     image: postgres:14.1-alpine
     ports:
@@ -16,11 +24,24 @@ services:
       POSTGRES_USER: 'vault_root'
       POSTGRES_PASSWORD: 'root_password'
       POSTGRES_DB: 'app_db'
+  aws:
+    image: localstack/localstack
+    ports:
+      - "127.0.0.1:4566:4566"            # LocalStack Gateway
+      - "127.0.0.1:4510-4559:4510-4559"  # external services port range
+    environment:
+      # LocalStack configuration: https://docs.localstack.cloud/references/configuration/
+      - DEBUG=${DEBUG:-0}
+    volumes:
+      - './local/localstack/app-access-policy.json:/etc/localstack/init/ready.d/app-access-policy.json'
+      - './local/localstack/app-assume-policy.json:/etc/localstack/init/ready.d/app-assume-policy.json'
+      - './local/localstack/init-aws.sh:/etc/localstack/init/ready.d/init-aws.sh'
   init:
     image: curlimages/curl
     depends_on:
       - vault
       - db
+      - aws
     volumes:
       - './local/vault/setup.sh:/etc/vault/setup.sh'
     environment:

data/lib/settings_reader/vault_resolver/cache.rb

@@ -23,8 +23,8 @@ module SettingsReader
       end
 
       def fetch(address, &block)
-        if !address.no_cache? && (exiting_entry = retrieve(address))
-          exiting_entry
+        if !address.no_cache? && (existing_entry = retrieve(address))
+          existing_entry
         else
           new_entry = block.call(address)
           save(new_entry) if new_entry

data/lib/settings_reader/vault_resolver/configuration.rb

@@ -42,7 +42,11 @@ module SettingsReader
       # Default: empty proc
       attr_accessor :lease_not_found_handler
 
-      def initialize
+      # Whether to raise error or return nil when secret or attribute is missing
+      # Default: false
+      attr_accessor :raise_error_on_missing_secret
+
+      def initialize # rubocop:disable Metrics/MethodLength
         @logger = Logger.new($stdout, level: Logger::ERROR)
         @retriable_errors = [OpenSSL::SSL::SSLError, Vault::HTTPConnectionError]
         @retrieval_retries = 2
@@ -53,6 +57,7 @@ module SettingsReader
         @lease_renew_success_listener = ->(_result) {}
         @vault_initializer = -> {}
         @lease_not_found_handler = ->(_entry) {}
+        @raise_error_on_missing_secret = false
       end
 
       def setup_lease_refresher(cache, previous_task = nil)
@@ -70,6 +75,7 @@ module SettingsReader
         @vault_engines ||= [
           SettingsReader::VaultResolver::Engines::KV2.new(self),
           SettingsReader::VaultResolver::Engines::Database.new(self),
+          SettingsReader::VaultResolver::Engines::Aws.new(self),
           SettingsReader::VaultResolver::Engines::Auth.new(self)
         ]
       end

data/lib/settings_reader/vault_resolver/engines/abstract.rb

@@ -16,15 +16,17 @@ module SettingsReader
         end
 
         def get(address)
-          return unless (vault_secret = get_and_retry_auth(address))
+          vault_secret = get_and_retry_auth(address)
+          entry = wrap_secret(address, vault_secret) if vault_secret
+          validate_secret!(entry, address) if config.raise_error_on_missing_secret
 
-          wrap_secret(address, vault_secret)
+          entry
         rescue Vault::VaultError => e
           raise SettingsReader::VaultResolver::Error, e.message
         end
 
         def renew(entry)
-          return unless entry.leased?
+          return unless entry.renewable?
 
           new_secret = renew_and_retry_auth(entry)
           entry.update_renewed(new_secret)
@@ -78,6 +80,14 @@ module SettingsReader
         def auth_error?(error)
           error.code == 403 || error.message =~ /token mac for token_version.*is incorrect/
         end
+
+        def validate_secret!(entry, address)
+          secret_value = entry&.value_for(address.attribute)
+          return if secret_value && !secret_value.empty?
+
+          raise SettingsReader::VaultResolver::Error,
+                "Secret not found at #{address}. Secret data: #{entry&.secret&.to_h}"
+        end
       end
     end
   end

data/lib/settings_reader/vault_resolver/engines/aws.rb

@@ -0,0 +1,29 @@
+module SettingsReader
+  module VaultResolver
+    module Engines
+      # Adapter to retrieve / renew secret from database engine
+      class Aws < Abstract
+        MOUNT = 'aws'.freeze
+
+        def retrieves?(address)
+          address.mount == MOUNT
+        end
+
+        private
+
+        def get_secret(address)
+          debug { "Fetching new aws secret at: #{address}" }
+          Vault.logical.read(address.full_path)
+        rescue Vault::HTTPClientError => e
+          return nil if e.message.match?('Role ".*" not found')
+
+          raise e
+        end
+
+        def renew_lease(entry)
+          Vault.sys.renew(entry.lease_id)
+        end
+      end
+    end
+  end
+end

data/lib/settings_reader/vault_resolver/entry.rb

@@ -13,10 +13,14 @@ module SettingsReader
         @lease_started = Time.now
       end
 
-      def leased?
+      def renewable?
         @secret.renewable?
       end
 
+      def leased?
+        renewable? || @secret.lease_duration&.positive?
+      end
+
       def expired?
         return false unless leased?
 

data/lib/settings_reader/vault_resolver/instance.rb

@@ -7,7 +7,6 @@ module SettingsReader
       include Logging
 
       IDENTIFIER = 'vault://'.freeze
-      DATABASE_MOUNT = 'database'.freeze
 
       attr_reader :config
 
@@ -22,7 +21,7 @@ module SettingsReader
         value.start_with?(IDENTIFIER)
       end
 
-      # Expect value in format `vault://mount/path/to/secret?attribute_name`
+      # Expect value in format `vault://mount/path/to/secret#attribute_name`
       def resolve(value, _path)
         debug { "Resolving Vault secret at #{value}" }
         address = SettingsReader::VaultResolver::Address.new(value)

data/lib/settings_reader/vault_resolver/refresher.rb

@@ -19,7 +19,7 @@ module SettingsReader
       def refresh
         info { 'Performing Vault leases refresh' }
         promises = cache.active_entries.map do |entry|
-          debug { "Checking lease for #{entry}. Leased?: #{entry.leased?}. Expires in: #{entry.expires_in}s" }
+          debug { "Checking lease for #{entry}. Renewable?: #{entry.renewable?}. Expires in: #{entry.expires_in}s" }
           refresh_entry(entry)
         end.compact
         promises.each(&:wait)

data/lib/settings_reader/vault_resolver/version.rb

@@ -1,5 +1,5 @@
 module SettingsReader
   module VaultResolver
-    VERSION = '0.4.10'.freeze
+    VERSION = '0.6.1'.freeze
   end
 end

data/lib/settings_reader/vault_resolver.rb

@@ -11,6 +11,7 @@ require_relative 'vault_resolver/engines/abstract'
 require_relative 'vault_resolver/engines/auth'
 require_relative 'vault_resolver/engines/kv2'
 require_relative 'vault_resolver/engines/database'
+require_relative 'vault_resolver/engines/aws'
 require_relative 'vault_resolver/cache'
 require_relative 'vault_resolver/refresher'
 require_relative 'vault_resolver/refresher_observer'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: settings_reader-vault_resolver
 version: !ruby/object:Gem::Version
-  version: 0.4.10
+  version: 0.6.1
 platform: ruby
 authors:
 - Volodymyr Mykhailyk
-autorequire: 
+autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-07-11 00:00:00.000000000 Z
+date: 2025-09-12 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -68,6 +68,7 @@ files:
 - ".rspec"
 - ".rubocop.yml"
 - ".simplecov"
+- ".tool-versions"
 - CHANGELOG.md
 - CODE_OF_CONDUCT.md
 - Gemfile
@@ -77,7 +78,6 @@ files:
 - Rakefile
 - bin/console
 - bin/setup
-- codecov.yml
 - docker-compose.yml
 - lib/settings_reader/vault_resolver.rb
 - lib/settings_reader/vault_resolver/address.rb
@@ -85,6 +85,7 @@ files:
 - lib/settings_reader/vault_resolver/configuration.rb
 - lib/settings_reader/vault_resolver/engines/abstract.rb
 - lib/settings_reader/vault_resolver/engines/auth.rb
+- lib/settings_reader/vault_resolver/engines/aws.rb
 - lib/settings_reader/vault_resolver/engines/database.rb
 - lib/settings_reader/vault_resolver/engines/kv2.rb
 - lib/settings_reader/vault_resolver/entry.rb
@@ -103,7 +104,7 @@ metadata:
   homepage_uri: https://github.com/matic-insurance/settings_reader-vault_resolver
   source_code_uri: https://github.com/matic-insurance/settings_reader-vault_resolver
   changelog_uri: https://github.com/matic-insurance/settings_reader-vault_resolver/blob/master/CHANGELOG.md
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -119,7 +120,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubygems_version: 3.1.6
-signing_key: 
+signing_key:
 specification_version: 4
 summary: Settings Reader plugin to resolve values using in Hashicorp Vault
 test_files: []

data/codecov.yml

@@ -1,12 +0,0 @@
-codecov:
-  require_ci_to_pass: yes
-
-coverage:
-  precision: 2
-  round: up
-  range: "90...100"
-
-ignore:
-  - "spec"
-  - "bin"
-  - "local"