Codebase list python-castellan / ecf625b
Add support for Vault Namespaces Vault Namespaces [0] is a feature available in Vault Enterprise that can be considered as a more advanced isolation feature on top of current KV Mountpoint option in Castellan Vault plugin. Passing a namespace in all request headers (including Auth) allows to organize Vault-in-Vault style of isolation, with clients using the same simple URI path but accessing separate sets of entities in Vault. [0] https://www.vaultproject.io/docs/enterprise/namespaces Change-Id: I627c20002bb2a0a1b346b57e824f87f856eca4c9 Pavlo Shchelokovskyy authored 2 years ago Pavlo Shchelokovskyy committed 2 years ago
5 changed file(s) with 97 addition(s) and 3 deletion(s). Raw diff Collapse all Expand all
+18
-3
castellan/key_manager/vault_key_manager.py less more
6666 cfg.BoolOpt('use_ssl',
6767 default=False,
6868 help=_('SSL Enabled/Disabled')),
69 cfg.StrOpt("namespace",
70 help=_("Vault Namespace to use for all requests to Vault. "
71 "Vault Namespaces feature is available only in "
72 "Vault Enterprise")),
6973 ]
7074
7175 _VAULT_OPT_GROUP = 'vault'
98102 self._kv_mountpoint = self._conf.vault.kv_mountpoint
99103 self._kv_version = self._conf.vault.kv_version
100104 self._vault_url = self._conf.vault.vault_url
105 self._namespace = self._conf.vault.namespace
101106 if self._vault_url.startswith("https://"):
102107 self._verify_server = self._conf.vault.ssl_ca_crt_file or True
103108 else:
127132 self._cached_approle_token_id = None
128133 return self._cached_approle_token_id
129134
135 def _set_namespace(self, headers):
136 if self._namespace:
137 headers["X-Vault-Namespace"] = self._namespace
138 return headers
139
130140 def _build_auth_headers(self):
131141 if self._root_token_id:
132 return {'X-Vault-Token': self._root_token_id}
142 return self._set_namespace(
143 {'X-Vault-Token': self._root_token_id})
133144
134145 if self._approle_token_id:
135 return {'X-Vault-Token': self._approle_token_id}
146 return self._set_namespace(
147 {'X-Vault-Token': self._approle_token_id})
136148
137149 if self._approle_role_id:
138150 params = {
144156 self._get_url()
145157 )
146158 token_issue_utc = timeutils.utcnow()
159 headers = self._set_namespace({})
147160 try:
148161 resp = self._session.post(url=approle_login_url,
149162 json=params,
163 headers=headers,
150164 verify=self._verify_server)
151165 except requests.exceptions.Timeout as ex:
152166 raise exception.KeyManagerError(str(ex))
168182 self._cached_approle_token_id = resp_data['auth']['client_token']
169183 self._approle_token_issue = token_issue_utc
170184 self._approle_token_ttl = resp_data['auth']['lease_duration']
171 return {'X-Vault-Token': self._approle_token_id}
185 return self._set_namespace(
186 {'X-Vault-Token': self._approle_token_id})
172187
173188 return {}
174189
+5
-0
castellan/options.py less more
4545 vault_approle_role_id=None, vault_approle_secret_id=None,
4646 vault_kv_mountpoint=None, vault_url=None,
4747 vault_ssl_ca_crt_file=None, vault_use_ssl=None,
48 vault_namespace=None,
4849 barbican_endpoint_type=None):
4950 """Set defaults for configuration values.
5051
6667 :param vault_url: Use this for the url for vault.
6768 :param vault_use_ssl: Use this to force vault driver to use ssl.
6869 :param vault_ssl_ca_crt_file: Use this for the CA file for vault.
70 :param vault_namespace: Namespace to use for all requests to Vault.
6971 :param barbican_endpoint_type: Use this to specify the type of URL.
7072 : Valid values are: public, internal or admin.
7173 """
133135 if vault_use_ssl is not None:
134136 conf.set_default('use_ssl', vault_use_ssl,
135137 group=vkm._VAULT_OPT_GROUP)
138 if vault_namespace is not None:
139 conf.set_default('namespace', vault_namespace,
140 group=vkm._VAULT_OPT_GROUP)
136141
137142
138143 def enable_logging(conf=None, app_name='castellan'):
+66
-0
castellan/tests/unit/key_manager/test_vault_key_manager.py less more
0 # Copyright (c) 2021 Mirantis Inc
1 # All Rights Reserved.
2 #
3 # Licensed under the Apache License, Version 2.0 (the "License"); you may
4 # not use this file except in compliance with the License. You may obtain
5 # a copy of the License at
6 #
7 # http://www.apache.org/licenses/LICENSE-2.0
8 #
9 # Unless required by applicable law or agreed to in writing, software
10 # distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
11 # WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
12 # License for the specific language governing permissions and limitations
13 # under the License.
14
15 """
16 Test cases for Vault key manager.
17 """
18 import requests_mock
19
20 from castellan.key_manager import vault_key_manager
21 from castellan.tests.unit.key_manager import test_key_manager
22
23
24 class VaultKeyManagerTestCase(test_key_manager.KeyManagerTestCase):
25
26 def _create_key_manager(self):
27 return vault_key_manager.VaultKeyManager(self.conf)
28
29 def test_auth_headers_root_token(self):
30 self.key_mgr._root_token_id = "spam"
31 expected_headers = {"X-Vault-Token": "spam"}
32 self.assertEqual(expected_headers,
33 self.key_mgr._build_auth_headers())
34
35 def test_auth_headers_root_token_with_namespace(self):
36 self.key_mgr._root_token_id = "spam"
37 self.key_mgr._namespace = "ham"
38 expected_headers = {"X-Vault-Token": "spam",
39 "X-Vault-Namespace": "ham"}
40 self.assertEqual(expected_headers,
41 self.key_mgr._build_auth_headers())
42
43 @requests_mock.Mocker()
44 def test_auth_headers_app_role(self, m):
45 self.key_mgr._approle_role_id = "spam"
46 self.key_mgr._approle_secret_id = "secret"
47 m.post(
48 "http://127.0.0.1:8200/v1/auth/approle/login",
49 json={"auth": {"client_token": "token", "lease_duration": 3600}}
50 )
51 expected_headers = {"X-Vault-Token": "token"}
52 self.assertEqual(expected_headers, self.key_mgr._build_auth_headers())
53
54 @requests_mock.Mocker()
55 def test_auth_headers_app_role_with_namespace(self, m):
56 self.key_mgr._approle_role_id = "spam"
57 self.key_mgr._approle_secret_id = "secret"
58 self.key_mgr._namespace = "ham"
59 m.post(
60 "http://127.0.0.1:8200/v1/auth/approle/login",
61 json={"auth": {"client_token": "token", "lease_duration": 3600}}
62 )
63 expected_headers = {"X-Vault-Token": "token",
64 "X-Vault-Namespace": "ham"}
65 self.assertEqual(expected_headers, self.key_mgr._build_auth_headers())
+7
-0
releasenotes/notes/vault-namespaces-7d334e7407396df9.yaml less more
0 ---
1 features:
2 - |
3 Added support for Vault Namespaces, which is a `feature of Vault Enterprise
4 <https://www.vaultproject.io/docs/enterprise/namespaces>`_.
5 A new config option ``namespace`` is added to the configuration of Vault
6 key manager to support this feature.
+1
-0
test-requirements.txt less more
88
99 coverage!=4.4,>=4.0 # Apache-2.0
1010 python-barbicanclient>=4.5.2 # Apache-2.0
11 requests-mock>=1.2.0 # Apache-2.0
1112 python-subunit>=1.0.0 # Apache-2.0/BSD
1213 oslotest>=3.2.0 # Apache-2.0
1314 stestr>=2.0.0 # Apache-2.0