class Constancy::VaultTokenSource
Attributes
consul_token_field[RW]
consul_token_path[RW]
name[RW]
vault_addr[RW]
vault_token[RW]
Public Class Methods
new(name:, config:)
click to toggle source
# File lib/constancy/token_source.rb, line 32 def initialize(name:, config:) self.name = name config ||= {} if not config.is_a? Hash raise Constancy::ConfigFileInvalid.new("'#{name}' must be a hash") end if (config.keys - Constancy::Config::VALID_VAULT_CONFIG_KEYS) != [] raise Constancy::ConfigFileInvalid.new("Only the following keys are valid in a vault config: #{Constancy::Config::VALID_VAULT_CONFIG_KEYS.join(", ")}") end self.consul_token_path = config['consul_token_path'] if self.consul_token_path.nil? or self.consul_token_path == "" raise Constancy::ConfigFileInvalid.new("consul_token_path must be specified to use '#{name}' as a token source") end # prioritize the config file over environment variables for vault address self.vault_addr = config['url'] || ENV['VAULT_ADDR'] if self.vault_addr.nil? or self.vault_addr == "" raise Constancy::VaultConfigInvalid.new("Vault address must be set in #{name}.vault_addr or VAULT_ADDR") end self.vault_token = ENV['VAULT_TOKEN'] if self.vault_token.nil? or self.vault_token == "" vault_token_file = File.expand_path("~/.vault-token") if File.exist?(vault_token_file) self.vault_token = File.read(vault_token_file) else raise Constancy::VaultConfigInvalid.new("Vault token must be set in ~/.vault-token or VAULT_TOKEN") end end self.consul_token_field = config['consul_token_field'] || Constancy::Config::DEFAULT_VAULT_CONSUL_TOKEN_FIELD end
Public Instance Methods
consul_token()
click to toggle source
# File lib/constancy/token_source.rb, line 68 def consul_token if @consul_token.nil? begin response = Vault::Client.new(address: self.vault_addr, token: self.vault_token).logical.read(self.consul_token_path) @consul_token = response.data[self.consul_token_field.to_sym] if response.lease_id at_exit { begin Vault::Client.new(address: self.vault_addr, token: self.vault_token).sys.revoke(response.lease_id) rescue => e # this is fine end } end rescue => e raise Constancy::VaultConfigInvalid.new("Are you logged in to Vault?\n\n#{e}") end if @consul_token.nil? or @consul_token == "" raise Constancy::VaultConfigInvalid.new("Could not acquire a Consul token from Vault") end end @consul_token end