|
| 1 | +'use strict' |
| 2 | + |
| 3 | +const KVBackend = require('./kv-backend') |
| 4 | + |
| 5 | +/** Vault backend class. */ |
| 6 | +class VaultBackend extends KVBackend { |
| 7 | + /** |
| 8 | + * Create Vault backend. |
| 9 | + * @param {Object} client - Client for interacting with Vault. |
| 10 | + * @param {Object} logger - Logger for logging stuff. |
| 11 | + */ |
| 12 | + constructor ({ client, logger }) { |
| 13 | + super({ logger }) |
| 14 | + this._client = client |
| 15 | + } |
| 16 | + |
| 17 | + /** |
| 18 | + * Fetch Kubernetes service account token. |
| 19 | + * @returns {string} String representing the token of the service account running this pod. |
| 20 | + */ |
| 21 | + _fetchServiceAccountToken () { |
| 22 | + if (!this._serviceAccountToken) { |
| 23 | + const fs = require('fs') |
| 24 | + this._serviceAccountToken = fs.readFileSync('/var/run/secrets/kubernetes.io/serviceaccount/token', 'utf8') |
| 25 | + } |
| 26 | + return this._serviceAccountToken |
| 27 | + } |
| 28 | + |
| 29 | + /** |
| 30 | + * Fetch Kubernetes secret property values. |
| 31 | + * @param {Object[]} secretProperties - Kubernetes secret properties. |
| 32 | + * @param {string} secretProperties[].key - Secret key in the backend. |
| 33 | + * @param {string} secretProperties[].name - Kubernetes Secret property name. |
| 34 | + * @param {string} secretProperties[].property - If the backend secret is an |
| 35 | + * object, this is the property name of the value to use. |
| 36 | + * @returns {Promise} Promise object representing secret property values. |
| 37 | + */ |
| 38 | + _fetchSecretPropertyValues ({ vaultMountPoint, vaultRole, jwt, externalData }) { |
| 39 | + return Promise.all(externalData.map(async secretProperty => { |
| 40 | + this._logger.info(`fetching secret property ${secretProperty.key}`) |
| 41 | + const value = await this._get({ vaultMountPoint: vaultMountPoint, vaultRole: vaultRole, jwt: jwt, secretKey: secretProperty.key }) |
| 42 | + |
| 43 | + return value[secretProperty.property] |
| 44 | + })) |
| 45 | + } |
| 46 | + |
| 47 | + /** |
| 48 | + * Get secret property value from Vault. |
| 49 | + * @param {string} secretKey - Key used to store secret property value in Vault. |
| 50 | + * @returns {Promise} Promise object representing secret property value. |
| 51 | + */ |
| 52 | + async _get ({ vaultMountPoint, vaultRole, secretKey }) { |
| 53 | + if (!this._client.token) { |
| 54 | + const jwt = this._fetchServiceAccountToken() |
| 55 | + this._logger.debug(`fetching new token from vault`) |
| 56 | + const vault = await this._client.kubernetesLogin({ |
| 57 | + mount_point: vaultMountPoint, |
| 58 | + role: vaultRole, |
| 59 | + jwt: jwt |
| 60 | + }) |
| 61 | + this._client.token = vault.auth.client_token |
| 62 | + } else { |
| 63 | + this._logger.debug(`renewing existing token from vault`) |
| 64 | + this._client.tokenRenewSelf() |
| 65 | + } |
| 66 | + |
| 67 | + this._logger.debug(`reading secret key ${secretKey} from vault`) |
| 68 | + const secretResponse = await this._client.read(secretKey) |
| 69 | + |
| 70 | + return secretResponse.data.data |
| 71 | + } |
| 72 | + |
| 73 | + /** |
| 74 | + * Fetch Kubernetes secret manifest data. |
| 75 | + * @param {ExternalSecretSpec} spec - Kubernetes ExternalSecret spec. |
| 76 | + * @returns {Promise} Promise object representing Kubernetes secret manifest data. |
| 77 | + */ |
| 78 | + async getSecretManifestData ({ spec }) { |
| 79 | + const data = {} |
| 80 | + const vaultMountPoint = spec.vaultMountPoint |
| 81 | + const vaultRole = spec.vaultRole |
| 82 | + |
| 83 | + // Also support spec.properties to be backwards compatible. |
| 84 | + const externalData = spec.data || spec.properties |
| 85 | + const secretPropertyValues = await this._fetchSecretPropertyValues({ |
| 86 | + vaultMountPoint, |
| 87 | + vaultRole, |
| 88 | + externalData |
| 89 | + }) |
| 90 | + externalData.forEach((secret, index) => { |
| 91 | + data[secret.name] = (Buffer.from(secretPropertyValues[index], 'utf8')).toString('base64') |
| 92 | + }) |
| 93 | + return data |
| 94 | + } |
| 95 | +} |
| 96 | + |
| 97 | +module.exports = VaultBackend |
0 commit comments