class Hiera::Backend::Eyaml::Encryptors::Vault

Constants

HTTP_HANDLER
VERSION

Public Class Methods

authenticate() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 155
def authenticate
  unless token_configured?
    login if @approle_token.nil?
  end
end
config_file() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 75
def config_file
  ENV['EYAML_CONFIG'] || File.join(ENV['HOME'], '.eyaml/config.yaml') || '/etc/eyaml/config.yaml'
end
create_keys() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 99
def create_keys
  diagnostic_message = self.option :diagnostic_message 
  puts "Create_keys: #{diagnostic_message}"
end
decrypt(string) click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 218
def decrypt(string)
  response = vault_post({ 'ciphertext' => string}, :decrypt)
  response_data=response['data']
  Base64.decode64(response_data['plaintext'])
end
encrypt(plain) click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 224
def encrypt(plain)
  encoded = Base64.encode64(plain)
  response = vault_post({ 'plaintext' => encoded}, :encrypt)
  response_data=response['data']
  response_data['ciphertext']
end
endpoint(action) click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 161
def endpoint(action)
  {
    :decrypt => "transit/decrypt/#{option :keyname}",
    :encrypt => "transit/encrypt/#{option :keyname}",
    :login   => "auth/approle/login"
  }[action]
end
load_config() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 79
def load_config
  if File.exists?(config_file)
    @config_defaults = YAML.load_file(config_file)
  end
end
login() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 112
def login
  role_id = option :role_id
  secret_id = option :secret_id

  login_data = { "role_id" => role_id }
  login_data['secret_id'] = secret_id unless secret_id.nil?

  response = vault_post(login_data, :login, false)
  @approle_token = response['auth']['client_token']
end
option(key) click to toggle source

Allow the inherited options method to allow for local configuration to fall back on

Calls superclass method
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 88
def option(key)
  return super(key) if super(key)

  global_key = "vault_#{key.to_s}"
  load_config if @config_defaults.nil?
  unless @config_defaults.nil?
    return @config_defaults[global_key] if @config_defaults[global_key]
  end
  super
end
parse_response(response) click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 175
def parse_response(response)
  body = JSON.load(response.body)
  if response.code_type == Net::HTTPOK
    return body
  else
    if response.code == "403"
      raise AuthenticationError, body
    end
    if body['errors'].is_a?(Array)
      message = body['errors'].join("\n")
    else
      message = "Failed to decrypt entry #{body}"
    end
    raise Exception, "Error decrypting data from Vault: #{message}"
  end
end
read_file(file) click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 127
def read_file(file)
  raise Exception, "Cannot read #{file}" unless File.exists?(file)
  File.read(file)
end
ssl?() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 123
def ssl?
  option :use_ssl
end
ssl_cert() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 138
def ssl_cert
  return nil if option(:ssl_cert).nil?
  @vault_ssl_cert ||= read_file(option :ssl_cert)
  @vault_ssl_cert
end
ssl_key() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 132
def ssl_key
  return nil if option(:ssl_key).nil?
  @vault_ssl_key ||= read_file(option :ssl_key)
  @vault_ssl_key
end
token() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 150
def token
  authenticate
  ENV['VAULT_TOKEN'] || option(:token) || @approle_token
end
token_configured?() click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 145
def token_configured?
  return true if ENV['VAULT_TOKEN']
  not option(:token).nil?
end
url_path(action) click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 169
def url_path(action)
  vault_url(endpoint(action))
end
vault_post(data, action, use_token=true, headers={}) click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 192
def vault_post(data, action, use_token=true, headers={})
  url = url_path(action)
  http_options = {}

  if ssl?
    http_options = {
      :ssl        => true,
      :ssl_verify => option(:ssl_verify),
      :ssl_cert   => ssl_cert,
      :ssl_key    => ssl_key,
    }
  end

  begin
    tries ||= 0
    headers['X-Vault-Token'] = token if use_token
    parse_response HTTP_HANDLER.post(url, data, headers, http_options)
  rescue AuthenticationError => e
    login
    retry if (tries += 1) < 2
    raise
  rescue HTTPError => e
    raise Exception, "HTTP Error: #{e}"
  end
end
vault_url(endpoint) click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 104
def vault_url(endpoint)
  uri = []
  uri << option(:addr)
  uri << "v#{option :api_version}"
  uri << endpoint
  uri.flatten.join("/")
end