f.weber
ae30ba1240
- Added internal/vault/client.go for creating a Vault client with configuration settings. - Introduced internal/vault/errors.go to classify Vault API errors for better UI handling. - Created internal/vault/kv.go to manage KV secrets, including listing, reading, writing, and deleting operations. - Implemented internal/vault/mounts.go to list and describe secret engine mounts. - Developed internal/vault/service.go to provide a unified entry point for Vault operations. - Added internal/vault/kv_test.go for comprehensive testing of KV operations. - Introduced internal/ui/toast.go for transient notifications in the UI. - Added renovate.json for dependency management and updates.
47 lines
1.4 KiB
Go
47 lines
1.4 KiB
Go
package auth
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
"os"
|
|
|
|
"github.com/hashicorp/vault/api"
|
|
)
|
|
|
|
func init() { register(kubernetesMethod{}) }
|
|
|
|
// defaultServiceAccountTokenPath is where a projected service account token
|
|
// is normally mounted inside a pod.
|
|
const defaultServiceAccountTokenPath = "/var/run/secrets/kubernetes.io/serviceaccount/token"
|
|
|
|
type kubernetesMethod struct{}
|
|
|
|
func (kubernetesMethod) Name() string { return "kubernetes" }
|
|
func (kubernetesMethod) DisplayName() string { return "Kubernetes" }
|
|
func (kubernetesMethod) DefaultMount() string { return "kubernetes" }
|
|
|
|
func (kubernetesMethod) Fields() []Field {
|
|
return []Field{
|
|
{Name: "role", Label: "Role", Kind: FieldText, Required: true,
|
|
EnvFallback: []string{"VAULT_AUTH_KUBERNETES_ROLE"}},
|
|
{Name: "jwt_path", Label: "Service account token path", Kind: FieldPath,
|
|
Default: defaultServiceAccountTokenPath},
|
|
}
|
|
}
|
|
|
|
func (kubernetesMethod) Login(ctx context.Context, c *api.Client, req Request) (*api.Secret, error) {
|
|
mount := mountOf(req, "kubernetes")
|
|
jwtPath := req.Creds.Get("jwt_path")
|
|
if jwtPath == "" {
|
|
jwtPath = defaultServiceAccountTokenPath
|
|
}
|
|
jwt, err := os.ReadFile(jwtPath)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("reading service account token from %s: %w", jwtPath, err)
|
|
}
|
|
return loginWrite(ctx, c, mount, "login", map[string]interface{}{
|
|
"role": req.Creds.Get("role"),
|
|
"jwt": string(jwt),
|
|
})
|
|
}
|