node-vault-client 1.0.1 → 1.0.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/LICENSE.txt +200 -200
- package/README.md +153 -154
- package/package.json +44 -44
- package/src/Lease.js +57 -57
- package/src/VaultApiClient.js +55 -55
- package/src/VaultClient.js +263 -263
- package/src/VaultNodeConfig.js +105 -105
- package/src/auth/AuthToken.js +94 -94
- package/src/auth/VaultAppRoleAuth.js +47 -40
- package/src/auth/VaultBaseAuth.js +140 -140
- package/src/auth/VaultIAMAuth.js +187 -187
- package/src/auth/VaultKubernetesAuth.js +48 -48
- package/src/auth/VaultTokenAuth.js +34 -34
- package/src/errors.js +21 -21
|
@@ -1,48 +1,48 @@
|
|
|
1
|
-
const fs = require('fs');
|
|
2
|
-
const VaultBaseAuth = require('./VaultBaseAuth');
|
|
3
|
-
|
|
4
|
-
class VaultKubernetesAuth extends VaultBaseAuth {
|
|
5
|
-
/**
|
|
6
|
-
* @param {VaultApiClient} apiClient - see {@link VaultBaseAuth#constructor}
|
|
7
|
-
* @param {Object} config
|
|
8
|
-
* @param {String} config.role - Role configured in Vault Kubernetes Auth backend under which we want to issue Vault token.
|
|
9
|
-
* @param {String} [config.tokenPath] - Path to the Kube JWT token. If omitted - default will be used.
|
|
10
|
-
* @param {String} mount - Vault's mount point ("kubernetes" by default)
|
|
11
|
-
*/
|
|
12
|
-
constructor(apiClient, logger, config, mount) {
|
|
13
|
-
super(apiClient, logger, mount || 'kubernetes');
|
|
14
|
-
|
|
15
|
-
this.__role = config.role;
|
|
16
|
-
this.__tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token';
|
|
17
|
-
if (config.tokenPath !== undefined) {
|
|
18
|
-
this.__tokenPath = config.tokenPath;
|
|
19
|
-
}
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
_authenticate() {
|
|
23
|
-
this._log.info(
|
|
24
|
-
'making authentication request: Vault role: "%s"; K8s token path: "%s"',
|
|
25
|
-
this.__role, this.__tokenPath
|
|
26
|
-
);
|
|
27
|
-
|
|
28
|
-
const k8sJwtToken = fs.readFileSync(this.__tokenPath).toString();
|
|
29
|
-
this._log.debug(
|
|
30
|
-
'receive K8s token: %s',
|
|
31
|
-
k8sJwtToken
|
|
32
|
-
);
|
|
33
|
-
|
|
34
|
-
return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {
|
|
35
|
-
role: this.__role,
|
|
36
|
-
jwt: k8sJwtToken,
|
|
37
|
-
}).then((res) => {
|
|
38
|
-
this._log.debug(
|
|
39
|
-
'receive token: %s',
|
|
40
|
-
res.auth.client_token
|
|
41
|
-
);
|
|
42
|
-
|
|
43
|
-
return this._getTokenEntity(res.auth.client_token);
|
|
44
|
-
});
|
|
45
|
-
}
|
|
46
|
-
}
|
|
47
|
-
|
|
48
|
-
module.exports = VaultKubernetesAuth;
|
|
1
|
+
const fs = require('fs');
|
|
2
|
+
const VaultBaseAuth = require('./VaultBaseAuth');
|
|
3
|
+
|
|
4
|
+
class VaultKubernetesAuth extends VaultBaseAuth {
|
|
5
|
+
/**
|
|
6
|
+
* @param {VaultApiClient} apiClient - see {@link VaultBaseAuth#constructor}
|
|
7
|
+
* @param {Object} config
|
|
8
|
+
* @param {String} config.role - Role configured in Vault Kubernetes Auth backend under which we want to issue Vault token.
|
|
9
|
+
* @param {String} [config.tokenPath] - Path to the Kube JWT token. If omitted - default will be used.
|
|
10
|
+
* @param {String} mount - Vault's mount point ("kubernetes" by default)
|
|
11
|
+
*/
|
|
12
|
+
constructor(apiClient, logger, config, mount) {
|
|
13
|
+
super(apiClient, logger, mount || 'kubernetes');
|
|
14
|
+
|
|
15
|
+
this.__role = config.role;
|
|
16
|
+
this.__tokenPath = '/var/run/secrets/kubernetes.io/serviceaccount/token';
|
|
17
|
+
if (config.tokenPath !== undefined) {
|
|
18
|
+
this.__tokenPath = config.tokenPath;
|
|
19
|
+
}
|
|
20
|
+
}
|
|
21
|
+
|
|
22
|
+
_authenticate() {
|
|
23
|
+
this._log.info(
|
|
24
|
+
'making authentication request: Vault role: "%s"; K8s token path: "%s"',
|
|
25
|
+
this.__role, this.__tokenPath
|
|
26
|
+
);
|
|
27
|
+
|
|
28
|
+
const k8sJwtToken = fs.readFileSync(this.__tokenPath).toString();
|
|
29
|
+
this._log.debug(
|
|
30
|
+
'receive K8s token: %s',
|
|
31
|
+
k8sJwtToken
|
|
32
|
+
);
|
|
33
|
+
|
|
34
|
+
return this.__apiClient.makeRequest('POST', `/auth/${this._mount}/login`, {
|
|
35
|
+
role: this.__role,
|
|
36
|
+
jwt: k8sJwtToken,
|
|
37
|
+
}).then((res) => {
|
|
38
|
+
this._log.debug(
|
|
39
|
+
'receive token: %s',
|
|
40
|
+
res.auth.client_token
|
|
41
|
+
);
|
|
42
|
+
|
|
43
|
+
return this._getTokenEntity(res.auth.client_token);
|
|
44
|
+
});
|
|
45
|
+
}
|
|
46
|
+
}
|
|
47
|
+
|
|
48
|
+
module.exports = VaultKubernetesAuth;
|
|
@@ -1,34 +1,34 @@
|
|
|
1
|
-
'use strict';
|
|
2
|
-
|
|
3
|
-
const VaultBaseAuth = require('./VaultBaseAuth');
|
|
4
|
-
const errors = require('../errors');
|
|
5
|
-
|
|
6
|
-
class VaultTokenAuth extends VaultBaseAuth {
|
|
7
|
-
|
|
8
|
-
/**
|
|
9
|
-
* @param {Object} connConfig - see {@link VaultBaseAuth#constructor}
|
|
10
|
-
* @param {Object} config
|
|
11
|
-
* @param {String} config.token
|
|
12
|
-
* @param {String} mount - Vault's mount point ("token" by default)
|
|
13
|
-
*/
|
|
14
|
-
constructor(connConfig, logger, config, mount) {
|
|
15
|
-
super(connConfig, logger, mount || 'token');
|
|
16
|
-
|
|
17
|
-
if (!config.token) {
|
|
18
|
-
throw new errors.InvalidArgumentsError('Auth token should be provided for VaultTokenAuth');
|
|
19
|
-
}
|
|
20
|
-
|
|
21
|
-
this.__token = config.token;
|
|
22
|
-
}
|
|
23
|
-
|
|
24
|
-
_authenticate() {
|
|
25
|
-
return this._getTokenEntity(this.__token);
|
|
26
|
-
}
|
|
27
|
-
|
|
28
|
-
_reauthenticationAllowed() {
|
|
29
|
-
return false;
|
|
30
|
-
}
|
|
31
|
-
|
|
32
|
-
}
|
|
33
|
-
|
|
34
|
-
module.exports = VaultTokenAuth;
|
|
1
|
+
'use strict';
|
|
2
|
+
|
|
3
|
+
const VaultBaseAuth = require('./VaultBaseAuth');
|
|
4
|
+
const errors = require('../errors');
|
|
5
|
+
|
|
6
|
+
class VaultTokenAuth extends VaultBaseAuth {
|
|
7
|
+
|
|
8
|
+
/**
|
|
9
|
+
* @param {Object} connConfig - see {@link VaultBaseAuth#constructor}
|
|
10
|
+
* @param {Object} config
|
|
11
|
+
* @param {String} config.token
|
|
12
|
+
* @param {String} mount - Vault's mount point ("token" by default)
|
|
13
|
+
*/
|
|
14
|
+
constructor(connConfig, logger, config, mount) {
|
|
15
|
+
super(connConfig, logger, mount || 'token');
|
|
16
|
+
|
|
17
|
+
if (!config.token) {
|
|
18
|
+
throw new errors.InvalidArgumentsError('Auth token should be provided for VaultTokenAuth');
|
|
19
|
+
}
|
|
20
|
+
|
|
21
|
+
this.__token = config.token;
|
|
22
|
+
}
|
|
23
|
+
|
|
24
|
+
_authenticate() {
|
|
25
|
+
return this._getTokenEntity(this.__token);
|
|
26
|
+
}
|
|
27
|
+
|
|
28
|
+
_reauthenticationAllowed() {
|
|
29
|
+
return false;
|
|
30
|
+
}
|
|
31
|
+
|
|
32
|
+
}
|
|
33
|
+
|
|
34
|
+
module.exports = VaultTokenAuth;
|
package/src/errors.js
CHANGED
|
@@ -1,21 +1,21 @@
|
|
|
1
|
-
'use strict';
|
|
2
|
-
|
|
3
|
-
class VaultError extends Error {
|
|
4
|
-
constructor(message, error) {
|
|
5
|
-
super(message);
|
|
6
|
-
this.name = this.constructor.name;
|
|
7
|
-
this.message = message;
|
|
8
|
-
|
|
9
|
-
Error.captureStackTrace(this, this.constructor.name);
|
|
10
|
-
}
|
|
11
|
-
}
|
|
12
|
-
class InvalidArgumentsError extends VaultError {}
|
|
13
|
-
class InvalidAWSCredentialsError extends InvalidArgumentsError {}
|
|
14
|
-
class AuthTokenExpiredError extends VaultError {}
|
|
15
|
-
|
|
16
|
-
module.exports = {
|
|
17
|
-
VaultError,
|
|
18
|
-
InvalidArgumentsError,
|
|
19
|
-
InvalidAWSCredentialsError,
|
|
20
|
-
AuthTokenExpiredError,
|
|
21
|
-
};
|
|
1
|
+
'use strict';
|
|
2
|
+
|
|
3
|
+
class VaultError extends Error {
|
|
4
|
+
constructor(message, error) {
|
|
5
|
+
super(message);
|
|
6
|
+
this.name = this.constructor.name;
|
|
7
|
+
this.message = message;
|
|
8
|
+
|
|
9
|
+
Error.captureStackTrace(this, this.constructor.name);
|
|
10
|
+
}
|
|
11
|
+
}
|
|
12
|
+
class InvalidArgumentsError extends VaultError {}
|
|
13
|
+
class InvalidAWSCredentialsError extends InvalidArgumentsError {}
|
|
14
|
+
class AuthTokenExpiredError extends VaultError {}
|
|
15
|
+
|
|
16
|
+
module.exports = {
|
|
17
|
+
VaultError,
|
|
18
|
+
InvalidArgumentsError,
|
|
19
|
+
InvalidAWSCredentialsError,
|
|
20
|
+
AuthTokenExpiredError,
|
|
21
|
+
};
|