settings_reader-vault_resolver 0.4.10 → 0.5.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e80770a5709f4c47de9c79c771e2174749ad345d5f59584d83d406fd44b9d8cb
-  data.tar.gz: 78d265a099e0a191bf01882cb666acfeecc802e1211fa097fe5588107720e90c
+  metadata.gz: f3e683be3539c3e3fd46bf0de60c78f11c7aeda4bbc321246298ec19b068fa84
+  data.tar.gz: 80a0bae40ee7bef3f22ac77761685fa89a53eeb21311295590dea2378c2b0a9b
 SHA512:
-  metadata.gz: 900237697adf7ee9984e912bde5c1a8433ef345084db65d76d03d39fd1d904fc4f5859a9a7205634e2c1ccb5f9a807f1f2ba066b147ade86febb1695bd7ff9d7
-  data.tar.gz: 7ff9538f5d886b99ace02d7eed050df0e017abba45de586d8c91e0c20bd7b505074545317df3b7a7f223728ea32dc39adf76a214f0f938e5ad9a3fbaf63b8e49
+  metadata.gz: 3c957e71f2730a18abe2b8a21e10d4fd93f1f0efcf779d7ca1f4cca791363a5bc5a2daeee83510b9a03b71045c7b8700957ce571ca5462355976e2fd203bd71a
+  data.tar.gz: ce4d399a56ec38e4bf39f87ecb759a0f5a77b7269f84de42a8d32b0ef477e25b38522513c03bcd92f60a47eeb43867a69af797a751f1e108ab071fb0f0a6cebf

data/.github/workflows/main.yml

@@ -18,28 +18,39 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby: [ '2.5', '2.6', '2.7', '3.0' ]
-    services:
-      vault:
-        image: hashicorp/vault
-        ports:
-          - "8200:8200"
-        env:
-          VAULT_DEV_ROOT_TOKEN_ID: vault_root_token
-          SKIP_SETCAP: true
-      database:
-        image: postgres:14.1-alpine
-        ports:
-          - "5432:5432"
-        env:
-          POSTGRES_USER: 'vault_root'
-          POSTGRES_PASSWORD: 'root_password'
-          POSTGRES_DB: 'app_db'
-        options: >-
-          --health-cmd pg_isready
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
+        ruby: [ '2.7', '3.0', '3.3' ]
+#    services:
+#      vault:
+#        image: hashicorp/vault
+#        ports:
+#          - "8200:8200"
+#        env:
+#          VAULT_DEV_ROOT_TOKEN_ID: vault_root_token
+#          SKIP_SETCAP: true
+#      database:
+#        image: postgres:14.1-alpine
+#        ports:
+#          - "5432:5432"
+#        env:
+#          POSTGRES_USER: 'vault_root'
+#          POSTGRES_PASSWORD: 'root_password'
+#          POSTGRES_DB: 'app_db'
+#        options: >-
+#          --health-cmd pg_isready
+#          --health-interval 10s
+#          --health-timeout 5s
+#          --health-retries 5
+#      aws:
+#        image: localstack/localstack
+#        ports:
+#          - "127.0.0.1:4566:4566"            # LocalStack Gateway
+#          - "127.0.0.1:4510-4559:4510-4559"  # external services port range
+#        env:
+#          DEBUG: 0
+#        volumes:
+#          - '/home/runner/work/settings_reader-vault_resolver/local/localstack/app-access-policy.json:/etc/localstack/init/ready.d/app-access-policy.json'
+#          - '/home/runner/work/settings_reader-vault_resolver/local/localstack/app-assume-policy.json:/etc/localstack/init/ready.d/app-assume-policy.json'
+#          - '/home/runner/work/settings_reader-vault_resolver/local/localstack/init-aws.sh:/etc/localstack/init/ready.d/init-aws.sh'
     steps:
       - name: Checkout
         uses: actions/checkout@v1
@@ -50,8 +61,11 @@ jobs:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
 
-      - name: Set up Vault
-        run: sh local/vault/setup.sh
+      - name: Start Dependencies
+        run: |
+          docker-compose up -d
+          echo "Waiting 15 seconds for initial configuraiton"
+          sleep 15
 
       - name: Run specs
         env:

data/Gemfile.lock

@@ -58,7 +58,7 @@ GEM
       simplecov-html (~> 0.11)
       simplecov_json_formatter (~> 0.1)
     simplecov-html (0.12.3)
-    simplecov_json_formatter (0.1.3)
+    simplecov_json_formatter (0.1.4)
     timecop (0.9.4)
     unicode-display_width (2.1.0)
     vault (0.16.0)
@@ -78,4 +78,4 @@ DEPENDENCIES
   timecop
 
 BUNDLED WITH
-   2.1.4
+   2.2.32

data/docker-compose.yml

@@ -2,12 +2,20 @@
 version: '3'
 services:
   vault:
-    image: vault
+    image: hashicorp/vault
     ports:
       - "8200:8200"
     environment:
       VAULT_DEV_ROOT_TOKEN_ID: 'vault_root_token'
       SKIP_SETCAP: 'true'
+#  playground:
+#    image: hashicorp/vault
+#    command:
+#      - sleep
+#      - '10000000000'
+#    environment:
+#      VAULT_ADDR: 'http://aws:8200'
+#      VAULT_TOKEN: 'vault_root_token'
   db:
     image: postgres:14.1-alpine
     ports:
@@ -16,11 +24,24 @@ services:
       POSTGRES_USER: 'vault_root'
       POSTGRES_PASSWORD: 'root_password'
       POSTGRES_DB: 'app_db'
+  aws:
+    image: localstack/localstack
+    ports:
+      - "127.0.0.1:4566:4566"            # LocalStack Gateway
+      - "127.0.0.1:4510-4559:4510-4559"  # external services port range
+    environment:
+      # LocalStack configuration: https://docs.localstack.cloud/references/configuration/
+      - DEBUG=${DEBUG:-0}
+    volumes:
+      - './local/localstack/app-access-policy.json:/etc/localstack/init/ready.d/app-access-policy.json'
+      - './local/localstack/app-assume-policy.json:/etc/localstack/init/ready.d/app-assume-policy.json'
+      - './local/localstack/init-aws.sh:/etc/localstack/init/ready.d/init-aws.sh'
   init:
     image: curlimages/curl
     depends_on:
       - vault
       - db
+      - aws
     volumes:
       - './local/vault/setup.sh:/etc/vault/setup.sh'
     environment:

data/lib/settings_reader/vault_resolver/cache.rb

@@ -23,8 +23,8 @@ module SettingsReader
       end
 
       def fetch(address, &block)
-        if !address.no_cache? && (exiting_entry = retrieve(address))
-          exiting_entry
+        if !address.no_cache? && (existing_entry = retrieve(address))
+          existing_entry
         else
           new_entry = block.call(address)
           save(new_entry) if new_entry

data/lib/settings_reader/vault_resolver/configuration.rb

@@ -70,6 +70,7 @@ module SettingsReader
         @vault_engines ||= [
           SettingsReader::VaultResolver::Engines::KV2.new(self),
           SettingsReader::VaultResolver::Engines::Database.new(self),
+          SettingsReader::VaultResolver::Engines::Aws.new(self),
           SettingsReader::VaultResolver::Engines::Auth.new(self)
         ]
       end

data/lib/settings_reader/vault_resolver/engines/abstract.rb

@@ -24,7 +24,7 @@ module SettingsReader
         end
 
         def renew(entry)
-          return unless entry.leased?
+          return unless entry.renewable?
 
           new_secret = renew_and_retry_auth(entry)
           entry.update_renewed(new_secret)

data/lib/settings_reader/vault_resolver/engines/aws.rb

@@ -0,0 +1,29 @@
+module SettingsReader
+  module VaultResolver
+    module Engines
+      # Adapter to retrieve / renew secret from database engine
+      class Aws < Abstract
+        MOUNT = 'aws'.freeze
+
+        def retrieves?(address)
+          address.mount == MOUNT
+        end
+
+        private
+
+        def get_secret(address)
+          debug { "Fetching new aws secret at: #{address}" }
+          Vault.logical.read(address.full_path)
+        rescue Vault::HTTPClientError => e
+          return nil if e.message.match?('Role ".*" not found')
+
+          raise e
+        end
+
+        def renew_lease(entry)
+          Vault.sys.renew(entry.lease_id)
+        end
+      end
+    end
+  end
+end

data/lib/settings_reader/vault_resolver/entry.rb

@@ -13,10 +13,14 @@ module SettingsReader
         @lease_started = Time.now
       end
 
-      def leased?
+      def renewable?
         @secret.renewable?
       end
 
+      def leased?
+        renewable? || @secret.lease_duration&.positive?
+      end
+
       def expired?
         return false unless leased?
 

data/lib/settings_reader/vault_resolver/refresher.rb

@@ -19,7 +19,7 @@ module SettingsReader
       def refresh
         info { 'Performing Vault leases refresh' }
         promises = cache.active_entries.map do |entry|
-          debug { "Checking lease for #{entry}. Leased?: #{entry.leased?}. Expires in: #{entry.expires_in}s" }
+          debug { "Checking lease for #{entry}. Renewable?: #{entry.renewable?}. Expires in: #{entry.expires_in}s" }
           refresh_entry(entry)
         end.compact
         promises.each(&:wait)

data/lib/settings_reader/vault_resolver/version.rb

@@ -1,5 +1,5 @@
 module SettingsReader
   module VaultResolver
-    VERSION = '0.4.10'.freeze
+    VERSION = '0.5.0'.freeze
   end
 end

data/lib/settings_reader/vault_resolver.rb

@@ -11,6 +11,7 @@ require_relative 'vault_resolver/engines/abstract'
 require_relative 'vault_resolver/engines/auth'
 require_relative 'vault_resolver/engines/kv2'
 require_relative 'vault_resolver/engines/database'
+require_relative 'vault_resolver/engines/aws'
 require_relative 'vault_resolver/cache'
 require_relative 'vault_resolver/refresher'
 require_relative 'vault_resolver/refresher_observer'

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: settings_reader-vault_resolver
 version: !ruby/object:Gem::Version
-  version: 0.4.10
+  version: 0.5.0
 platform: ruby
 authors:
 - Volodymyr Mykhailyk
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2023-07-11 00:00:00.000000000 Z
+date: 2024-01-22 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: concurrent-ruby
@@ -85,6 +85,7 @@ files:
 - lib/settings_reader/vault_resolver/configuration.rb
 - lib/settings_reader/vault_resolver/engines/abstract.rb
 - lib/settings_reader/vault_resolver/engines/auth.rb
+- lib/settings_reader/vault_resolver/engines/aws.rb
 - lib/settings_reader/vault_resolver/engines/database.rb
 - lib/settings_reader/vault_resolver/engines/kv2.rb
 - lib/settings_reader/vault_resolver/entry.rb