class Hiera::Backend::Eyaml::Encryptors::Vault
Constants
- HTTP_HANDLER
- VERSION
Public Class Methods
authenticate()
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 155 def authenticate unless token_configured? login if @approle_token.nil? end end
config_file()
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 75 def config_file ENV['EYAML_CONFIG'] || File.join(ENV['HOME'], '.eyaml/config.yaml') || '/etc/eyaml/config.yaml' end
create_keys()
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 99 def create_keys diagnostic_message = self.option :diagnostic_message puts "Create_keys: #{diagnostic_message}" end
decrypt(string)
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 218 def decrypt(string) response = vault_post({ 'ciphertext' => string}, :decrypt) response_data=response['data'] Base64.decode64(response_data['plaintext']) end
encrypt(plain)
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 224 def encrypt(plain) encoded = Base64.encode64(plain) response = vault_post({ 'plaintext' => encoded}, :encrypt) response_data=response['data'] response_data['ciphertext'] end
endpoint(action)
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 161 def endpoint(action) { :decrypt => "transit/decrypt/#{option :keyname}", :encrypt => "transit/encrypt/#{option :keyname}", :login => "auth/approle/login" }[action] end
load_config()
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 79 def load_config if File.exists?(config_file) @config_defaults = YAML.load_file(config_file) end end
login()
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 112 def login role_id = option :role_id secret_id = option :secret_id login_data = { "role_id" => role_id } login_data['secret_id'] = secret_id unless secret_id.nil? response = vault_post(login_data, :login, false) @approle_token = response['auth']['client_token'] end
option(key)
click to toggle source
Allow the inherited options method to allow for local configuration to fall back on
Calls superclass method
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 88 def option(key) return super(key) if super(key) global_key = "vault_#{key.to_s}" load_config if @config_defaults.nil? unless @config_defaults.nil? return @config_defaults[global_key] if @config_defaults[global_key] end super end
parse_response(response)
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 175 def parse_response(response) body = JSON.load(response.body) if response.code_type == Net::HTTPOK return body else if response.code == "403" raise AuthenticationError, body end if body['errors'].is_a?(Array) message = body['errors'].join("\n") else message = "Failed to decrypt entry #{body}" end raise Exception, "Error decrypting data from Vault: #{message}" end end
read_file(file)
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 127 def read_file(file) raise Exception, "Cannot read #{file}" unless File.exists?(file) File.read(file) end
ssl?()
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 123 def ssl? option :use_ssl end
ssl_cert()
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 138 def ssl_cert return nil if option(:ssl_cert).nil? @vault_ssl_cert ||= read_file(option :ssl_cert) @vault_ssl_cert end
ssl_key()
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 132 def ssl_key return nil if option(:ssl_key).nil? @vault_ssl_key ||= read_file(option :ssl_key) @vault_ssl_key end
token()
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 150 def token authenticate ENV['VAULT_TOKEN'] || option(:token) || @approle_token end
token_configured?()
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 145 def token_configured? return true if ENV['VAULT_TOKEN'] not option(:token).nil? end
url_path(action)
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 169 def url_path(action) vault_url(endpoint(action)) end
vault_post(data, action, use_token=true, headers={})
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 192 def vault_post(data, action, use_token=true, headers={}) url = url_path(action) http_options = {} if ssl? http_options = { :ssl => true, :ssl_verify => option(:ssl_verify), :ssl_cert => ssl_cert, :ssl_key => ssl_key, } end begin tries ||= 0 headers['X-Vault-Token'] = token if use_token parse_response HTTP_HANDLER.post(url, data, headers, http_options) rescue AuthenticationError => e login retry if (tries += 1) < 2 raise rescue HTTPError => e raise Exception, "HTTP Error: #{e}" end end
vault_url(endpoint)
click to toggle source
# File lib/hiera/backend/eyaml/encryptors/vault.rb, line 104 def vault_url(endpoint) uri = [] uri << option(:addr) uri << "v#{option :api_version}" uri << endpoint uri.flatten.join("/") end