vault-provision 0.1.0 → 0.1.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 77e526d32e962aec4cfdafc7f667c1767211bcae
-  data.tar.gz: 1b6ca464da212e641f8b47119f30203bcb45663d
+  metadata.gz: 79f872c69434db5cf504adcd6efeea369c1bff7c
+  data.tar.gz: eabe325c9cff5d09bbc2ad8b58a364aa4d948d0d
 SHA512:
-  metadata.gz: 0b2c5748e7d17721c40954677ae908dbe2f292db74c6e1ec5ede155efb90ece8db460412afea558e11583dd89477777b3c95d314d51cb97e68477683f5b6f950
-  data.tar.gz: e1c9aa9abc26e3a20a110bd5074f8d5231d4cb03e528051d34a7fbf0459d642d7dd24d3b6188df9590111a6a2d8bede0279bb61ad3395e3e01cc9e706bc81bf2
+  metadata.gz: 624e211242329581f89cad36cdf018f70d5f5244366f25e81ca1df8d05463e91374edc532e14890d935dfdec8219392f388198360d52c94ce7db376d6fe02389
+  data.tar.gz: 7aba52e8656f2a035c2871ca19e6d08b03a7c4d6c1ed8b962ef19bf26cfd3fda3640f9b94a117ce947f07454befbf0f6ea7fbbf3f957c5879239994360b3af48

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    vault-provision (0.0.0)
+    vault-provision (0.1.0)
       vault (~> 0.9.0)
 
 GEM

data/VERSION

@@ -1 +1 @@
-0.1.0
+0.1.1

data/lib/vault/provision/auth/ldap/config.rb

@@ -6,20 +6,16 @@ class Vault::Provision::Auth::Ldap::Config < Vault::Provision::Prototype
 
   def repo_files
     return @repo_files if @repo_files
-    #puts "*** calling repo_files"
-
     auths = @vault.sys.auths
 
     aps = auths.keys.select do |auth_point|
       next unless auths[auth_point].type == 'ldap'
-      #puts "**** got auth mount #{auth_point}"
       next unless FileTest.file? ap_file(auth_point)
 
       repo_config  = JSON.parse(File.read(ap_file(auth_point)))
       vault_config = begin
                        @vault.get("auth/#{auth_point}config")['data']
                      rescue Vault::HTTPClientError => e
-                       #puts "**** new #{auth_point} config"
                        raise e unless e.code == 404
                        {}
                      end
@@ -28,9 +24,7 @@ class Vault::Provision::Auth::Ldap::Config < Vault::Provision::Prototype
       # vault state. If they're identical, go on to the next mount point.
       !repo_config.keys.inject(true) { |acc,elem| acc && vault_config[elem] == repo_config[elem]}
     end
-    #puts "**** aps is #{aps}"
     map_out = aps.map { |auth_point| ap_file(auth_point) }
-    #puts "**** returning map_out of #{map_out}"
     @repo_files = map_out
   end
 

data/lib/vault/provision/pki/config/urls.rb

@@ -17,7 +17,6 @@ class Vault::Provision::Pki::Config::Urls < Vault::Provision::Prototype
   def provision!
     repo_files.each do |rf|
       mount_point = rf.split('/')[-3]
-      #puts "**** mount #{mount_point} rf => #{rf}"
       @vault.post "v1/#{mount_point}/config/urls", File.read(rf)
     end
   end

data/lib/vault/provision/pki/intermediate/generate/internal.rb

@@ -18,6 +18,7 @@ class Vault::Provision::Pki::Intermediate::Generate::Internal < Vault::Provision
     repo_files.each do |rf|
       mount_point = rf.split('/')[-4]
       next if generated? mount_point
+      next unless @pki_allow_destructive
       resp = @vault.post "v1/#{mount_point}/intermediate/generate/internal",
                          File.read(rf)
       sign_intermediate_csr(mount_point, resp[:data][:csr])
@@ -26,11 +27,11 @@ class Vault::Provision::Pki::Intermediate::Generate::Internal < Vault::Provision
 
   def sign_intermediate_csr mount_point, csr
     return if @intermediate_issuer.empty?
-    root = @intermediate_issuer[mount_point.to_sym]
-    return if root.nil?
+    root_mount = @intermediate_issuer[mount_point.to_sym]
+    return if root_mount.nil?
 
     req = JSON.parse(File.read(gen_file(mount_point)))
-    resp = @vault.post "v1/#{root}/root/sign-intermediate",
+    resp = @vault.post "v1/#{root_mount}/root/sign-intermediate",
                        JSON.dump(csr:                  csr,
                                  common_name:          req['common_name'],
                                  ttl:                  req['ttl'],

data/lib/vault/provision/pki/root/generate/internal.rb

@@ -18,6 +18,7 @@ class Vault::Provision::Pki::Root::Generate::Internal < Vault::Provision::Protot
     repo_files.each do |rf|
       mount_point = rf.split('/')[-4]
       next if generated? mount_point
+      next unless @pki_allow_destructive
       @vault.post "v1/#{mount_point}/root/generate/internal", File.read(rf)
     end
   end

data/lib/vault/provision/pki.rb

@@ -6,10 +6,10 @@ module Vault::Provision::Pki
   class Intermediate; end
 
   def generated? path
-    @vault.get "#{path}/ca/pem"
-    true
+    result = @vault.get "v1/#{path}/ca/pem"
+    return true if result =~ /BEGIN CERTIFICATE/
   rescue Vault::HTTPClientError
-    false
+    return false
   end
 
   def ca_type path

data/lib/vault/provision/prototype.rb

@@ -4,6 +4,7 @@ class Vault::Provision::Prototype
     @vault = boss.vault
     @instance_dir = boss.instance_dir
     @intermediate_issuer = boss.intermediate_issuer
+    @pki_allow_destructive = boss.pki_allow_destructive
   end
 
   def repo_prefix

data/lib/vault/provision/sys/auth.rb

@@ -1,17 +1,14 @@
 # helps to enable authentication
 class Vault::Provision::Sys::Auth < Vault::Provision::Prototype
   def provision!
-    #puts "files: #{repo_files}"
     auths = @vault.sys.auths
 
     change = []
     repo_files.each do |rf|
       path = rf[(repo_path.length + 1)..-6].to_sym
       r_conf = JSON.parse(File.read(rf))
-      # puts "** found #{path}"
 
       next if auths[path]
-      # puts "** processing #{path}"
       @vault.sys.enable_auth(path.to_s,
                              r_conf['type'], r_conf['description'])
       change << @vault.sys.auths[path]

data/lib/vault/provision/sys.rb

@@ -25,7 +25,6 @@ class Vault::Provision::Sys::Mounts < Vault::Provision::Prototype
 
       rf_base = File.basename rf, '.json'
       next if SYSTEM_MOUNTS.include? rf_base
-      # puts "** processing mount #{rf_base}"
 
       path = rf[(repo_path.length + 1)..-6].to_sym
       r_conf = JSON.parse(File.read(rf))

data/lib/vault/provision.rb

@@ -13,18 +13,19 @@ require 'vault/provision/generic'
 class Vault::Provision
   SYSTEM_POLICIES = ['response-wrapping', 'root'].freeze
 
-  attr_accessor :vault, :instance_dir, :intermediate_issuer
+  attr_accessor :vault, :instance_dir,
+                :intermediate_issuer, :pki_allow_destructive
 
   def initialize instance_dir,
                  address: ENV['VAULT_ADDR'],
                  token: ENV['VAULT_TOKEN'],
                  intermediate_issuer: {},
-                 pki_force: false
+                 pki_allow_destructive: false
 
     @instance_dir = instance_dir
     @vault = Vault::Client.new address: address, token: token
     @intermediate_issuer = intermediate_issuer
-    @pki_force = pki_force
+    @pki_allow_destructive = pki_allow_destructive
     @handlers = [
       Sys::Auth,
       Auth::Ldap::Config,

data/spec/spec_helper.rb

@@ -26,7 +26,7 @@ def vault_server
     Process.kill :INT, server.pid
   end
   [:INT, :EXIT].each { |sig| trap(sig, cleanup) }
-  puts "server is #{server.pid}"
+  puts "server is PID #{server.pid}"
   sleep(1) # woo race condition! wait for server to start up
   server
 end
@@ -43,4 +43,6 @@ end
 @server = vault_server
 signatories = {'pki-intermediate': 'pki-root'}
 
-Vault::Provision.new(EXAMPLE_DIR, intermediate_issuer: signatories).provision!
+Vault::Provision.new(EXAMPLE_DIR,
+                     intermediate_issuer: signatories,
+                     pki_allow_destructive: true).provision!

data/spec/vault_provision_spec.rb

@@ -24,7 +24,7 @@ describe Vault::Provision do
   end
 
   it "has a CA" do
-    expect(client.get('v1/pki-root/ca/pem')).to be
+    expect(client.get('v1/pki-root/ca/pem')).to include "BEGIN CERTIFICATE"
   end
 
   it "has pki-root config urls" do
@@ -36,7 +36,7 @@ describe Vault::Provision do
   end
 
   it "has pki-intermediate ca" do
-    expect(client.get('v1/pki-intermediate/ca/pem')).to be
+    expect(client.get('v1/pki-intermediate/ca/pem')).to include "BEGIN CERTIFICATE"
   end
 
   it "has a dvcert role for intermediate" do

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vault-provision
 version: !ruby/object:Gem::Version
-  version: 0.1.0
+  version: 0.1.1
 platform: ruby
 authors:
 - Tom Maher