settings_reader-vault_resolver 0.4.9 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 150b0ab4f832411290211253bbe9b1aad7d6cb6668badd2551cf80f06974f4b2
-  data.tar.gz: 7602addd34531ad05b631d16acea37f4a740a00143f085e040dbed65a177ec14
+  metadata.gz: f3e683be3539c3e3fd46bf0de60c78f11c7aeda4bbc321246298ec19b068fa84
+  data.tar.gz: 80a0bae40ee7bef3f22ac77761685fa89a53eeb21311295590dea2378c2b0a9b
 SHA512:
-  metadata.gz: dd0e9bfd045cd93698004032dd9826cce5e8be5e831bed842df5e6e78f10e1bfd182ea50b1aee4e804b42b7370288fc13983ee4a8d7f26bfbc2643f90e422043
-  data.tar.gz: 76876aedf7ca88a3ba64bb6ed6c4c4f5186f600b83279b33b5b569c9fea7f0f4ce6ed9d2f7a2edceb5a187dfa7d07a5f7b46508310c6b2d3fbb2fae1c6f20fc3
+  metadata.gz: 3c957e71f2730a18abe2b8a21e10d4fd93f1f0efcf779d7ca1f4cca791363a5bc5a2daeee83510b9a03b71045c7b8700957ce571ca5462355976e2fd203bd71a
+  data.tar.gz: ce4d399a56ec38e4bf39f87ecb759a0f5a77b7269f84de42a8d32b0ef477e25b38522513c03bcd92f60a47eeb43867a69af797a751f1e108ab071fb0f0a6cebf

data/.github/workflows/linters.yml

@@ -9,6 +9,19 @@ on:
     - cron: '30 0 * * 1'
 
 jobs:
+  rubocop:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v3
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: 2.5
+          bundler-cache: true
+      - name: Run rubocop
+        run: bundle exec rubocop --parallel
 
   code-ql:
     name: Analyze
@@ -24,16 +37,13 @@ jobs:
         language: [ 'ruby' ]
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v2
-
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v1
-      with:
-        languages: ${{ matrix.language }}
+      - name: Checkout repository
+        uses: actions/checkout@v3
 
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v1
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        with:
+          languages: ${{ matrix.language }}
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v1
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2

data/.github/workflows/main.yml

@@ -10,6 +10,72 @@ on:
     types: [published]
 
 jobs:
+  build:
+    env:
+      VAULT_ADDR: 'http://127.0.0.1:8200'
+      VAULT_TOKEN: 'vault_root_token'
+      DATABASE_ADDR: 'database'
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        ruby: [ '2.7', '3.0', '3.3' ]
+#    services:
+#      vault:
+#        image: hashicorp/vault
+#        ports:
+#          - "8200:8200"
+#        env:
+#          VAULT_DEV_ROOT_TOKEN_ID: vault_root_token
+#          SKIP_SETCAP: true
+#      database:
+#        image: postgres:14.1-alpine
+#        ports:
+#          - "5432:5432"
+#        env:
+#          POSTGRES_USER: 'vault_root'
+#          POSTGRES_PASSWORD: 'root_password'
+#          POSTGRES_DB: 'app_db'
+#        options: >-
+#          --health-cmd pg_isready
+#          --health-interval 10s
+#          --health-timeout 5s
+#          --health-retries 5
+#      aws:
+#        image: localstack/localstack
+#        ports:
+#          - "127.0.0.1:4566:4566"            # LocalStack Gateway
+#          - "127.0.0.1:4510-4559:4510-4559"  # external services port range
+#        env:
+#          DEBUG: 0
+#        volumes:
+#          - '/home/runner/work/settings_reader-vault_resolver/local/localstack/app-access-policy.json:/etc/localstack/init/ready.d/app-access-policy.json'
+#          - '/home/runner/work/settings_reader-vault_resolver/local/localstack/app-assume-policy.json:/etc/localstack/init/ready.d/app-assume-policy.json'
+#          - '/home/runner/work/settings_reader-vault_resolver/local/localstack/init-aws.sh:/etc/localstack/init/ready.d/init-aws.sh'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v1
+
+      - name: Set up Ruby
+        uses: ruby/setup-ruby@v1
+        with:
+          ruby-version: ${{ matrix.ruby }}
+          bundler-cache: true
+
+      - name: Start Dependencies
+        run: |
+          docker-compose up -d
+          echo "Waiting 15 seconds for initial configuraiton"
+          sleep 15
+
+      - name: Run specs
+        env:
+          COVERAGE: true
+        run: bundle exec rspec
+
+      - name: Upload coverage
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
+        run: bash <(curl -s https://codecov.io/bash)
 
   release:
     runs-on: ubuntu-latest
@@ -17,14 +83,13 @@ jobs:
     if: github.event_name == 'release' && github.event.action == 'published'
     steps:
       - name: Checkout
-        uses: actions/checkout@v1
+        uses: actions/checkout@v3
 
       - name: Set up Ruby
-        uses: actions/setup-ruby@v1
+        uses: ruby/setup-ruby@v1
         with:
-          ruby-version: 2.7.x
-      - name: Set up Bundler
-        run: gem install bundler:2.1.4
+          ruby-version: 2.7
+          bundler-cache: true
       - name: Set up credentials
         run: |
           mkdir -p $HOME/.gem

data/Gemfile.lock

@@ -58,7 +58,7 @@ GEM
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.12.3)
-    simplecov_json_formatter (0.1.3)
+    simplecov_json_formatter (0.1.4)
     timecop (0.9.4)
     unicode-display_width (2.1.0)
     vault (0.16.0)
@@ -78,4 +78,4 @@ DEPENDENCIES
   timecop
 
 BUNDLED WITH
-   2.1.4
+   2.2.32

data/docker-compose.yml

@@ -2,12 +2,20 @@
 version: '3'
 services:
   vault:
-    image: vault
+    image: hashicorp/vault
     ports:
       - "8200:8200"
     environment:
       VAULT_DEV_ROOT_TOKEN_ID: 'vault_root_token'
       SKIP_SETCAP: 'true'
+#  playground:
+#    image: hashicorp/vault
+#    command:
+#      - sleep
+#      - '10000000000'
+#    environment:
+#      VAULT_ADDR: 'http://aws:8200'
+#      VAULT_TOKEN: 'vault_root_token'
   db:
     image: postgres:14.1-alpine
     ports:
@@ -16,11 +24,24 @@ services:
       POSTGRES_USER: 'vault_root'
       POSTGRES_PASSWORD: 'root_password'
       POSTGRES_DB: 'app_db'
+  aws:
+    image: localstack/localstack
+    ports:
+      - "127.0.0.1:4566:4566"            # LocalStack Gateway
+      - "127.0.0.1:4510-4559:4510-4559"  # external services port range
+    environment:
+      # LocalStack configuration: https://docs.localstack.cloud/references/configuration/
+      - DEBUG=${DEBUG:-0}
+    volumes:
+      - './local/localstack/app-access-policy.json:/etc/localstack/init/ready.d/app-access-policy.json'
+      - './local/localstack/app-assume-policy.json:/etc/localstack/init/ready.d/app-assume-policy.json'
+      - './local/localstack/init-aws.sh:/etc/localstack/init/ready.d/init-aws.sh'
   init:
     image: curlimages/curl
     depends_on:
       - vault
       - db
+      - aws
     volumes:
       - './local/vault/setup.sh:/etc/vault/setup.sh'
     environment:

data/lib/settings_reader/vault_resolver/cache.rb

@@ -23,8 +23,8 @@ module SettingsReader
       end
 
       def fetch(address, &block)
-        if !address.no_cache? && (exiting_entry = retrieve(address))
-          exiting_entry
+        if !address.no_cache? && (existing_entry = retrieve(address))
+          existing_entry
         else
           new_entry = block.call(address)
           save(new_entry) if new_entry

data/lib/settings_reader/vault_resolver/configuration.rb

@@ -6,6 +6,10 @@ module SettingsReader
       # Default: Logger.new(STDOUT, level: Logger::ERROR)
       attr_accessor :logger
 
+      # What errors should be retried when connecting to vault
+      # Default: `Vault::HTTPConnectionError` and `OpenSSL::SSL::SSLError`
+      attr_accessor :retriable_errors
+
       # How many times to retry retrieval of the secret
       # Default: 2
       attr_accessor :retrieval_retries
@@ -40,6 +44,7 @@ module SettingsReader
 
       def initialize
         @logger = Logger.new($stdout, level: Logger::ERROR)
+        @retriable_errors = [OpenSSL::SSL::SSLError, Vault::HTTPConnectionError]
         @retrieval_retries = 2
         @lease_refresh_interval = 60
         @lease_renew_delay = 300
@@ -65,6 +70,7 @@ module SettingsReader
         @vault_engines ||= [
           SettingsReader::VaultResolver::Engines::KV2.new(self),
           SettingsReader::VaultResolver::Engines::Database.new(self),
+          SettingsReader::VaultResolver::Engines::Aws.new(self),
           SettingsReader::VaultResolver::Engines::Auth.new(self)
         ]
       end

data/lib/settings_reader/vault_resolver/engines/abstract.rb

@@ -24,7 +24,7 @@ module SettingsReader
         end
 
         def renew(entry)
-          return unless entry.leased?
+          return unless entry.renewable?
 
           new_secret = renew_and_retry_auth(entry)
           entry.update_renewed(new_secret)
@@ -43,7 +43,7 @@ module SettingsReader
         end
 
         def get_and_retry_connection(address)
-          Vault.with_retries(Vault::HTTPConnectionError, attempts: config.retrieval_retries) do
+          Vault.with_retries(*config.retriable_errors, attempts: config.retrieval_retries) do
             get_secret(address)
           end
         end
@@ -58,7 +58,7 @@ module SettingsReader
         end
 
         def renew_and_retry_connection(entry)
-          Vault.with_retries(Vault::HTTPConnectionError, attempts: config.lease_renew_retries) do
+          Vault.with_retries(*config.retriable_errors, attempts: config.lease_renew_retries) do
             renew_lease(entry)
           end
         end

data/lib/settings_reader/vault_resolver/engines/aws.rb

@@ -0,0 +1,29 @@
+module SettingsReader
+  module VaultResolver
+    module Engines
+      # Adapter to retrieve / renew secret from database engine
+      class Aws < Abstract
+        MOUNT = 'aws'.freeze
+
+        def retrieves?(address)
+          address.mount == MOUNT
+        end
+
+        private
+
+        def get_secret(address)
+          debug { "Fetching new aws secret at: #{address}" }
+          Vault.logical.read(address.full_path)
+        rescue Vault::HTTPClientError => e
+          return nil if e.message.match?('Role ".*" not found')
+
+          raise e
+        end
+
+        def renew_lease(entry)
+          Vault.sys.renew(entry.lease_id)
+        end
+      end
+    end
+  end
+end

data/lib/settings_reader/vault_resolver/entry.rb

@@ -13,10 +13,14 @@ module SettingsReader
         @lease_started = Time.now
       end
 
-      def leased?
+      def renewable?
         @secret.renewable?
       end
 
+      def leased?
+        renewable? || @secret.lease_duration&.positive?
+      end
+
       def expired?
         return false unless leased?
 

data/lib/settings_reader/vault_resolver/refresher.rb

@@ -19,7 +19,7 @@ module SettingsReader
       def refresh
         info { 'Performing Vault leases refresh' }
         promises = cache.active_entries.map do |entry|
-          debug { "Checking lease for #{entry}. Leased?: #{entry.leased?}. Expires in: #{entry.expires_in}s" }
+          debug { "Checking lease for #{entry}. Renewable?: #{entry.renewable?}. Expires in: #{entry.expires_in}s" }
           refresh_entry(entry)
         end.compact
         promises.each(&:wait)

data/lib/settings_reader/vault_resolver/version.rb

@@ -1,5 +1,5 @@
 module SettingsReader
   module VaultResolver
-    VERSION = '0.4.9'.freeze
+    VERSION = '0.5.0'.freeze
   end
 end

data/lib/settings_reader/vault_resolver.rb

@@ -11,6 +11,7 @@ require_relative 'vault_resolver/engines/abstract'
 require_relative 'vault_resolver/engines/auth'
 require_relative 'vault_resolver/engines/kv2'
 require_relative 'vault_resolver/engines/database'
+require_relative 'vault_resolver/engines/aws'
 require_relative 'vault_resolver/cache'
 require_relative 'vault_resolver/refresher'
 require_relative 'vault_resolver/refresher_observer'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: settings_reader-vault_resolver
 version: !ruby/object:Gem::Version
-  version: 0.4.9
+  version: 0.5.0
 platform: ruby
 authors:
 - Volodymyr Mykhailyk
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-11-09 00:00:00.000000000 Z
+date: 2024-01-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -62,7 +62,6 @@ executables: []
 extensions: []
 extra_rdoc_files: []
 files:
-- ".circleci/config.yml"
 - ".github/workflows/linters.yml"
 - ".github/workflows/main.yml"
 - ".gitignore"
@@ -86,6 +85,7 @@ files:
 - lib/settings_reader/vault_resolver/configuration.rb
 - lib/settings_reader/vault_resolver/engines/abstract.rb
 - lib/settings_reader/vault_resolver/engines/auth.rb
+- lib/settings_reader/vault_resolver/engines/aws.rb
 - lib/settings_reader/vault_resolver/engines/database.rb
 - lib/settings_reader/vault_resolver/engines/kv2.rb
 - lib/settings_reader/vault_resolver/entry.rb
@@ -119,7 +119,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.2.32
+rubygems_version: 3.1.6
 signing_key: 
 specification_version: 4
 summary: Settings Reader plugin to resolve values using in Hashicorp Vault

data/.circleci/config.yml

@@ -1,114 +0,0 @@
-
-version: 2.1
-
-orbs:
-  ci: matic/orb-common@0.2
-  ruby: circleci/ruby@1.8.0
-
-jobs:
-
-  rspec-test:
-    resource_class: small
-    parameters:
-      ruby-version:
-        type: string
-    docker:
-      - image: cimg/ruby:<< parameters.ruby-version >>
-        environment:
-          COVERAGE: true
-          CODECOV_TOKEN: a0c859b6-dfb7-4d9f-9933-2dd945cdd960
-          VAULT_ADDR: 'http://127.0.0.1:8200'
-          VAULT_TOKEN: 'vault_root_token'
-      - image: vault
-        environment:
-          VAULT_DEV_ROOT_TOKEN_ID: vault_root_token
-          SKIP_SETCAP: true
-      - image: postgres:14.1-alpine
-        environment:
-          POSTGRES_DB: 'app_db'
-          POSTGRES_USER: 'vault_root'
-          POSTGRES_PASSWORD: 'root_password'
-    steps:
-      - checkout
-      - ruby/install-deps
-      - run:
-          name: Set up vault
-          command: sh local/vault/setup.sh
-      - run:
-          name: Run RSpec Tests
-          command: bundle exec rspec
-      - store_test_results:
-          path: reports/rspec
-      - store_artifacts:
-          path: reports/rspec
-      - ci/slack-stage-message
-
-  rubocop:
-    resource_class: small
-    docker:
-      - image: cimg/ruby:2.5
-    steps:
-      - checkout
-      - ruby/install-deps
-      - run:
-          name: Run rubocop
-          command: bundle exec rubocop --parallel
-
-  release:
-    parameters:
-      tag:
-        type: string
-        default: "default-tag"
-    docker:
-      - image: cimg/ruby:2.7.5
-    environment:
-      RELEASE_TAG: << parameters.tag >>
-    steps:
-      - checkout
-      - ruby/install-deps
-      - run:
-          name: Set up credentials
-          command: |
-              mkdir -p $HOME/.gem
-              touch $HOME/.gem/credentials
-              chmod 0600 $HOME/.gem/credentials
-              printf -- "---\n:rubygems_api_key: $RUBYGEMS_API_KEY\n" > $HOME/.gem/credentials
-      - run:
-          name: Set version
-          command: sed -i "s/[[:digit:]].[[:digit:]].[[:digit:]]/${RELEASE_TAG}/g" $(find . -name "version.rb")
-      - run:
-          name: Build gem
-          command: gem build *.gemspec
-      - run:
-          name: Push gem
-          command: gem push *.gem
-
-workflows:
-
-  settings_reader-vault_resolver.build-pull-request:
-    when:
-      not:
-        equal: [ main, << pipeline.git.branch >> ]
-    jobs:
-
-      - rspec-test:
-          context: global
-          matrix:
-            parameters:
-              ruby-version: [ '2.5', '2.6', '2.7', '3.0' ]
-
-      - rubocop:
-          name: Rubocop
-          context: global
-
-  settings_reader-vault_resolver.release:
-    jobs:
-
-      - release:
-          tag: << pipeline.git.tag >>
-          context: gem-publishing
-          filters:
-            branches:
-              ignore: /.*/
-            tags:
-              only: /\d\.\d\.\d/ # It should be [digin dot digit dot digit] format