|
| 1 | +/* |
| 2 | + * Copyright (c) 2020-2024 Airbyte, Inc., all rights reserved. |
| 3 | + */ |
| 4 | + |
| 5 | +package secrets.persistence |
| 6 | + |
| 7 | +import com.azure.identity.ClientSecretCredentialBuilder |
| 8 | +import com.azure.security.keyvault.secrets.SecretClient |
| 9 | +import com.azure.security.keyvault.secrets.SecretClientBuilder |
| 10 | +import com.azure.security.keyvault.secrets.models.KeyVaultSecret |
| 11 | +import com.azure.security.keyvault.secrets.models.SecretProperties |
| 12 | +import io.airbyte.config.secrets.SecretCoordinate |
| 13 | +import io.airbyte.config.secrets.persistence.SecretPersistence |
| 14 | +import io.micronaut.context.annotation.Requires |
| 15 | +import io.micronaut.context.annotation.Value |
| 16 | +import jakarta.inject.Named |
| 17 | +import jakarta.inject.Singleton |
| 18 | +import java.time.Duration |
| 19 | + |
| 20 | +/** |
| 21 | + * SecretPersistence implementation for Azure Key Vault |
| 22 | + */ |
| 23 | +@Singleton |
| 24 | +@Requires(property = "airbyte.secret.persistence", pattern = "(?i)^azure_key_vault$") |
| 25 | +@Named("secretPersistence") |
| 26 | +class AzureKeyVaultPersistence(private val secretClient: AzureKeyVaultClient) : SecretPersistence { |
| 27 | + override fun read(coordinate: SecretCoordinate): String { |
| 28 | + val key = coordinate.fullCoordinate.replace("_", "-") |
| 29 | + return secretClient.client.getSecret( |
| 30 | + key, |
| 31 | + ).value |
| 32 | + } |
| 33 | + |
| 34 | + override fun write( |
| 35 | + coordinate: SecretCoordinate, |
| 36 | + payload: String, |
| 37 | + ) { |
| 38 | + val key = coordinate.fullCoordinate.replace("_", "-") |
| 39 | + val secret = |
| 40 | + KeyVaultSecret( |
| 41 | + key, |
| 42 | + payload, |
| 43 | + ) |
| 44 | + |
| 45 | + if (secretClient.tags.isNotEmpty()) { |
| 46 | + secret.setProperties(SecretProperties().setTags(secretClient.tags)) |
| 47 | + } |
| 48 | + |
| 49 | + secretClient.client.setSecret(secret) |
| 50 | + } |
| 51 | + |
| 52 | + override fun delete(coordinate: SecretCoordinate) { |
| 53 | + val key = coordinate.fullCoordinate.replace("_", "-") |
| 54 | + secretClient.client |
| 55 | + .beginDeleteSecret(key) |
| 56 | + .waitForCompletion(Duration.ofSeconds(5)) |
| 57 | + secretClient.client |
| 58 | + .purgeDeletedSecret(key) |
| 59 | + } |
| 60 | +} |
| 61 | + |
| 62 | +@Singleton |
| 63 | +class AzureKeyVaultClient( |
| 64 | + @Value("\${airbyte.secret.store.azure.vault-url}") private val vaultUrl: String, |
| 65 | + @Value("\${airbyte.secret.store.azure.tenant-id}") private val tenantId: String, |
| 66 | + @Value("\${airbyte.secret.store.azure.client-id}") private val clientId: String, |
| 67 | + @Value("\${airbyte.secret.store.azure.client-secret}") private val clientSecret: String, |
| 68 | + @Value("\${airbyte.secret.store.azure.tags}") val unparsedTags: String?, |
| 69 | +) { |
| 70 | + val tags: Map<String, String> = parseTags(unparsedTags) |
| 71 | + |
| 72 | + private fun parseTags(tags: String?): Map<String, String> { |
| 73 | + // Define the regex pattern for the whole string validation |
| 74 | + val pattern = "^[\\w\\s._:/=+-@]+=[\\w\\s._:/=+-@]+(,\\s*[\\w\\s._:/=+-@]+=[\\w\\s._:/=+-@]+)*$".toRegex() |
| 75 | + |
| 76 | + // Check if unparsedTags is not null, not blank, and matches the pattern |
| 77 | + return if (!tags.isNullOrBlank() && pattern.matches(tags)) { |
| 78 | + tags.split(",").associate { part -> |
| 79 | + val (key, value) = part.trim().split("=") |
| 80 | + key to value |
| 81 | + } |
| 82 | + } else if (tags.isNullOrBlank()) { |
| 83 | + emptyMap() // Return an empty map if unparsedTags is null or blank |
| 84 | + } else { |
| 85 | + // If the string doesn't match the pattern, throw an error |
| 86 | + throw IllegalArgumentException( |
| 87 | + "AB_SECRET_MANAGER_SECRET_TAGS does not match the expected format \"key1=value2,key2=value2\": $tags." + |
| 88 | + " Please update the AB_SECRET_MANAGER_SECRET_TAGS env var configurations.", |
| 89 | + ) |
| 90 | + } |
| 91 | + } |
| 92 | + |
| 93 | + val client: SecretClient by lazy { |
| 94 | + SecretClientBuilder() |
| 95 | + .vaultUrl(vaultUrl) |
| 96 | + .credential( |
| 97 | + ClientSecretCredentialBuilder() |
| 98 | + .clientSecret(clientSecret) |
| 99 | + .clientId(clientId) |
| 100 | + .tenantId(tenantId) |
| 101 | + .build(), |
| 102 | + ) |
| 103 | + .buildClient() |
| 104 | + } |
| 105 | +} |
0 commit comments