vault-provision 0.1.11 → 0.1.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 060598f1500adc483e0fbf393bf8e1c50b81f251
-  data.tar.gz: 6d3a8fc25c8e4f2083fe44bebfb7a15d4290443e
+  metadata.gz: a7cbddb546570293e5d52694169538c7bd187304
+  data.tar.gz: 918e87a4e02fe5fed0360925e81c6a57e13b8f15
 SHA512:
-  metadata.gz: 11f2f509baf8dbbee5a1bbfb48cbed93a93bf7e32454224f13e9b0a2704437bdfc8dc3633aff7f930baa49f65a6254dd161963fd291b41ef4ae03990ddc525e7
-  data.tar.gz: f13d17d20092adf42a42a36aae968f96144801e0f114e0f5c3b7001e483127ffb6e8270001dec3a5e782e714974e41f4627880e38a8e8fb3da6b61336d5e612b
+  metadata.gz: 2b38e074717f06ad42c0f42311a947506ac70358476f652a088563aa33128338d8a2e8ae15741497c3ab2eb4b5dc326fbb03e90689b0d7481a46f3243e6c934d
+  data.tar.gz: 5db926b27d09d029065c95c3ed68b21ac8eab8caa5c0ea5ede709086e2278f6fef024bb8c5095f7484b05af08a3d24d6cdaa1682d3ec82825205a4fbe2a6f801

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    vault-provision (0.1.11)
+    vault-provision (0.1.12)
       activesupport (~> 5.0, >= 5.0.2)
       rhcl (~> 0.1.0)
       vault (~> 0.10)
@@ -97,4 +97,4 @@ DEPENDENCIES
   webmock (~> 3.0.1)
 
 BUNDLED WITH
-   1.15.1
+   1.15.3

data/VERSION

@@ -1 +1 @@
-0.1.11
+0.1.12

data/examples/audit-change/sys/audit/my_file.json

@@ -0,0 +1,8 @@
+{
+  "type": "file",
+  "description": "my file-based audit backend",
+  "options": {
+    "file_path": "/tmp/my-vault-alt-audit-test.log",
+    "mode": "0644"
+  }
+}

data/examples/audit-change/sys/audit/my_syslog.json

@@ -0,0 +1,8 @@
+{
+  "type": "syslog",
+  "description": "my syslog audit backend",
+  "options": {
+    "facility": "LPR",
+    "tag": "my-vault-audit-tag"
+  }
+}

data/examples/basic/sys/audit/my_syslog.json

@@ -3,6 +3,6 @@
   "description": "my syslog audit backend",
   "options": {
     "facility": "LPR",
-    "tag": "vault-provision-testing"
+    "tag": "my-vault-audit-tag"
   }
 }

data/lib/vault/provision.rb

@@ -1,4 +1,6 @@
 require 'vault'
+require 'active_support'
+require 'active_support/core_ext'
 require 'active_support/inflector'
 
 class Vault::Provision; end

data/lib/vault/provision/auth/ldap/groups.rb

@@ -1,7 +1,9 @@
 # placeholder
 class Vault::Provision::Auth::Ldap::Groups < Vault::Provision::Prototype
   def group_files auth_point
-    Find.find("#{@instance_dir}/auth/#{auth_point}/groups/").select do |rf|
+    groups_path = "#{@instance_dir}/auth/#{auth_point}/groups/"
+    return [] unless Dir.exist? groups_path
+    Find.find(groups_path).select do |rf|
       FileTest.file?(rf) && rf.end_with?('.json')
     end
   end

data/lib/vault/provision/prototype.rb

@@ -22,6 +22,7 @@ class Vault::Provision::Prototype
   end
 
   def repo_files
+    return [] unless File.exist? repo_path
     Find.find(repo_path).select { |rf| rf.end_with?('.json') }
   end
 

data/lib/vault/provision/sys.rb

@@ -20,6 +20,7 @@ class Vault::Provision::Sys::Mounts < Vault::Provision::Prototype
 
     repo_path = "#{@instance_dir}/sys/mounts"
     change = []
+    return change unless Dir.exist?(repo_path)
     Find.find(repo_path).each do |rf|
       next unless rf.end_with?('.json')
       next if rf.end_with?('/tune.json')

data/lib/vault/provision/sys/audit.rb

@@ -1,27 +1,40 @@
 # helps to enable auditing
 class Vault::Provision::Sys::Audit < Vault::Provision::Prototype
   def provision!
-    audits = @vault.sys.audits
-
     change = []
     repo_files.each do |rf|
+      audits = @vault.sys.audits
       validate_file! rf
-      path = rf[(repo_path.length + 1)..-6].to_sym
+      path = rf[(repo_path.length + 1)..-6]
       r_conf = JSON.parse(File.read(rf))
-      next unless backend_changed? audits[path], r_conf
+      next unless backend_changed? audits[path.to_sym], r_conf
+
+      # API only lets you delete & re-create audit backends
+      # No upcerts allowed :(
+      if backend_exists?(path)
+        puts "  * #{path} changed, disabling for update"
+        @vault.sys.disable_audit(path)
+      end
 
-      @vault.sys.enable_audit(path.to_s,
+      puts "  * #{path} enabled"
+      @vault.sys.enable_audit(path,
                               r_conf['type'],
                               r_conf['description'],
                               r_conf['options'])
-      change << @vault.sys.audits[path]
+      change << @vault.sys.audits[path.to_sym]
     end
     change
   end
 
   def backend_changed?(vault_conf, file_conf)
     return true unless vault_conf
-    file_conf.each { |k, v| return true if v != vault_conf[k] }
+    file_conf.deep_symbolize_keys.each do |k, v|
+      return true if v != vault_conf.to_h[k]
+    end
     false
   end
+
+  def backend_exists?(path)
+    !@vault.sys.audits[path.to_sym].nil?
+  end
 end

data/lib/vault/provision/sys/policy.rb

@@ -1,6 +1,7 @@
 # for rubocop, this comment is a matter of policy
 class Vault::Provision::Sys::Policy < Vault::Provision::Prototype
   def repo_files
+    return [] unless File.exist? repo_path
     Find.find(repo_path).select { |rf| rf.end_with?('.json', '.hcl') }
   end
 

data/spec/spec_helper.rb

@@ -9,7 +9,9 @@ require 'vcr'
 DEV_VAULT_TOKEN                = 'kittens'.freeze
 DEV_VAULT_ADDR                 = 'http://127.0.0.1:8200'.freeze
 EXAMPLE_DIR                    = "#{GEM_DIR}/examples/basic".freeze
+EXAMPLE_AUDIT_DIR              = "#{GEM_DIR}/examples/audit-change".freeze
 AUDIT_LOG_PATH                 = "/tmp/my-vault-audit-test.log"
+ALT_AUDIT_LOG_PATH             = "/tmp/my-vault-alt-audit-test.log"
 AUDIT_LOG_TAG                  = "my-vault-audit-tag"
 
 ENV['VAULT_DEV_ROOT_TOKEN_ID'] = DEV_VAULT_TOKEN

data/spec/vault_provision_spec.rb

@@ -173,5 +173,11 @@ describe Vault::Provision do
     expect(resp[:my_syslog]).to be
     expect(resp[:my_syslog].options[:tag]).to be == AUDIT_LOG_TAG
     expect(resp[:my_syslog].options[:facility]).to be == "LPR"
+
+    # File.unlink(AUDIT_LOG_PATH)
+    Vault::Provision.new(EXAMPLE_AUDIT_DIR).provision!
+    resp = client.sys.audits
+    expect(resp[:my_file].options[:file_path]).to be == ALT_AUDIT_LOG_PATH
+    expect(File.exist?(ALT_AUDIT_LOG_PATH)).to be true
   end
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: vault-provision
 version: !ruby/object:Gem::Version
-  version: 0.1.11
+  version: 0.1.12
 platform: ruby
 authors:
 - Tom Maher
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2017-08-04 00:00:00.000000000 Z
+date: 2017-08-10 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rake
@@ -101,6 +101,8 @@ files:
 - Rakefile
 - VERSION
 - bin/vault-provision
+- examples/audit-change/sys/audit/my_file.json
+- examples/audit-change/sys/audit/my_syslog.json
 - examples/basic/auth/.keep
 - examples/basic/auth/approle/role/backends.json
 - examples/basic/auth/approle/role/frontends.json