forked from GoogleCloudPlatform/terraformer
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Issue GoogleCloudPlatform#962 add Hashicorp Vault provider partial su…
…pport (GoogleCloudPlatform#964) * Issue GoogleCloudPlatform#962 add Hashicorp Vault provider partial support This commit includes the boilerplate for the Vault provider, as well as support for Secret Engine, Secret Engine Roles, Auth Backends, Auth Backend Roles, Auth Backend Users, Auth Backend Groups, and Policies. This is done by instantiating a common Vault client using its official Go client library and leveraging the naming convention of Vault tf resources to support most of the Secret/Auth options available in the provider itself. The provider configuration includes only the minimum required `address` and `token` fields. Filtering roles/users/groups by mount type is supported as well as basic filtering by resource ids. * Issue GoogleCloudPlatform#962 linting fixes * Issue GoogleCloudPlatform#962 add support for Vault generic secrets * Issue GoogleCloudPlatform#962 fix filtering backends * Issue GoogleCloudPlatform#962 post convert normalization of iam policies in vault aws secrets and fixing of policies without policy * Issue GoogleCloudPlatform#962 linting fixes * Issue GoogleCloudPlatform#962 add postconverthook for vault_ldap_auth_backend_group for deterministic order of policies
- Loading branch information
Showing
8 changed files
with
537 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,48 @@ | ||
| // Copyright 2019 The Terraformer Authors. | ||
| // | ||
| // Licensed under the Apache License, Version 2.0 (the "License"); | ||
| // you may not use this file except in compliance with the License. | ||
| // You may obtain a copy of the License at | ||
| // | ||
| // http://www.apache.org/licenses/LICENSE-2.0 | ||
| // | ||
| // Unless required by applicable law or agreed to in writing, software | ||
| // distributed under the License is distributed on an "AS IS" BASIS, | ||
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| // See the License for the specific language governing permissions and | ||
| // limitations under the License. | ||
| package cmd | ||
|
|
||
| import ( | ||
| vault_terraforming "github.com/GoogleCloudPlatform/terraformer/providers/vault" | ||
|
|
||
| "github.com/GoogleCloudPlatform/terraformer/terraformutils" | ||
| "github.com/spf13/cobra" | ||
| ) | ||
|
|
||
| func newCmdVaultImporter(options ImportOptions) *cobra.Command { | ||
| var token, address string | ||
| cmd := &cobra.Command{ | ||
| Use: "vault", | ||
| Short: "Import current state to Terraform configuration from Vault", | ||
| Long: "Import current state to Terraform configuration from Vault", | ||
| RunE: func(cmd *cobra.Command, args []string) error { | ||
| provider := newVaultProvider() | ||
| err := Import(provider, options, []string{address, token}) | ||
| if err != nil { | ||
| return err | ||
| } | ||
| return nil | ||
| }, | ||
| } | ||
|
|
||
| cmd.AddCommand(listCmd(newVaultProvider())) | ||
| cmd.PersistentFlags().StringVarP(&address, "address", "a", "", "env param VAULT_ADDR") | ||
| cmd.PersistentFlags().StringVarP(&token, "token", "t", "", "env param VAULT_TOKEN") | ||
| baseProviderFlags(cmd.PersistentFlags(), &options, "", "") | ||
| return cmd | ||
| } | ||
|
|
||
| func newVaultProvider() terraformutils.ProviderGenerator { | ||
| return &vault_terraforming.Provider{} | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,87 @@ | ||
| ### Use with Vault | ||
|
|
||
| Example: | ||
|
|
||
| ``` | ||
| ./terraformer import vault --resources=aws_secret_backend_role --token=YOUR_VAULT_TOKEN // or VAULT_TOKEN in env --address=YOUR_VAULT_ADDRESS // or VAULT_ADDR in env | ||
| ./terraformer import vault --resources=policy --filter=policy=id1:id2:id4 --token=YOUR_VAULT_TOKEN // or VAULT_TOKEN in env --address=YOUR_VAULT_ADDRESS // or VAULT_ADDR in env | ||
| ``` | ||
|
|
||
| List of supported Datadog services: | ||
|
|
||
| * `ad_secret_backend` | ||
| * `ad_secret_backend` | ||
| * `ad_secret_backend_role` | ||
| * `ad_secret_backend_role` | ||
| * `alicloud_auth_backend_role` | ||
| * `alicloud_auth_backend_role` | ||
| * `approle_auth_backend_role` | ||
| * `approle_auth_backend_role` | ||
| * `aws_auth_backend_role` | ||
| * `aws_auth_backend_role` | ||
| * `aws_secret_backend` | ||
| * `aws_secret_backend` | ||
| * `aws_secret_backend_role` | ||
| * `aws_secret_backend_role` | ||
| * `azure_auth_backend_role` | ||
| * `azure_auth_backend_role` | ||
| * `azure_secret_backend` | ||
| * `azure_secret_backend` | ||
| * `azure_secret_backend_role` | ||
| * `azure_secret_backend_role` | ||
| * `cert_auth_backend_role` | ||
| * `cert_auth_backend_role` | ||
| * `consul_secret_backend` | ||
| * `consul_secret_backend` | ||
| * `consul_secret_backend_role` | ||
| * `consul_secret_backend_role` | ||
| * `database_secret_backend_role` | ||
| * `database_secret_backend_role` | ||
| * `gcp_auth_backend` | ||
| * `gcp_auth_backend` | ||
| * `gcp_auth_backend_role` | ||
| * `gcp_auth_backend_role` | ||
| * `gcp_secret_backend` | ||
| * `gcp_secret_backend` | ||
| * `generic_secret` | ||
| * `generic_secret` | ||
| * `github_auth_backend` | ||
| * `github_auth_backend` | ||
| * `jwt_auth_backend` | ||
| * `jwt_auth_backend` | ||
| * `jwt_auth_backend_role` | ||
| * `jwt_auth_backend_role` | ||
| * `kubernetes_auth_backend_role` | ||
| * `kubernetes_auth_backend_role` | ||
| * `ldap_auth_backend` | ||
| * `ldap_auth_backend` | ||
| * `ldap_auth_backend_group` | ||
| * `ldap_auth_backend_group` | ||
| * `ldap_auth_backend_user` | ||
| * `ldap_auth_backend_user` | ||
| * `nomad_secret_backend` | ||
| * `nomad_secret_backend` | ||
| * `okta_auth_backend` | ||
| * `okta_auth_backend` | ||
| * `okta_auth_backend_group` | ||
| * `okta_auth_backend_group` | ||
| * `okta_auth_backend_user` | ||
| * `okta_auth_backend_user` | ||
| * `pki_secret_backend` | ||
| * `pki_secret_backend` | ||
| * `pki_secret_backend_role` | ||
| * `pki_secret_backend_role` | ||
| * `policy` | ||
| * `policy` | ||
| * `rabbitmq_secret_backend` | ||
| * `rabbitmq_secret_backend` | ||
| * `rabbitmq_secret_backend_role` | ||
| * `rabbitmq_secret_backend_role` | ||
| * `ssh_secret_backend_role` | ||
| * `ssh_secret_backend_role` | ||
| * `terraform_cloud_secret_backend` | ||
| * `terraform_cloud_secret_backend` | ||
| * `token_auth_backend_role` | ||
| * `token_auth_backend_role` | ||
|
|
||
| [1]: https://github.com/GoogleCloudPlatform/terraformer/blob/master/README.md#filtering |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,100 @@ | ||
| package vault | ||
|
|
||
| import ( | ||
| "errors" | ||
| "fmt" | ||
| "os" | ||
|
|
||
| "github.com/GoogleCloudPlatform/terraformer/terraformutils" | ||
| "github.com/zclconf/go-cty/cty" | ||
| ) | ||
|
|
||
| type Provider struct { | ||
| terraformutils.Provider | ||
| token string | ||
| address string | ||
| } | ||
|
|
||
| func (p *Provider) Init(args []string) error { | ||
|
|
||
| if address := os.Getenv("VAULT_ADDR"); address != "" { | ||
| p.address = os.Getenv("VAULT_ADDR") | ||
| } | ||
|
|
||
| if token := os.Getenv("VAULT_TOKEN"); token != "" { | ||
| p.token = os.Getenv("VAULT_TOKEN") | ||
| } | ||
|
|
||
| if len(args) > 0 && args[0] != "" { | ||
| p.address = args[0] | ||
| } | ||
|
|
||
| if len(args) > 1 && args[1] != "" { | ||
| p.token = args[1] | ||
| } | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func (p *Provider) GetConfig() cty.Value { | ||
| return cty.ObjectVal(map[string]cty.Value{ | ||
| "token": cty.StringVal(p.token), | ||
| "address": cty.StringVal(p.address), | ||
| }) | ||
| } | ||
|
|
||
| func (p *Provider) GetName() string { | ||
| return "vault" | ||
| } | ||
|
|
||
| func (p *Provider) InitService(serviceName string, verbose bool) error { | ||
| if service, ok := p.GetSupportedService()[serviceName]; ok { | ||
| p.Service = service | ||
| p.Service.SetName(serviceName) | ||
| p.Service.SetVerbose(verbose) | ||
| p.Service.SetProviderName(p.GetName()) | ||
| p.Service.SetArgs(map[string]interface{}{ | ||
| "token": p.token, | ||
| "address": p.address, | ||
| }) | ||
| if err := service.(*ServiceGenerator).setVaultClient(); err != nil { | ||
| return err | ||
| } | ||
| return nil | ||
| } | ||
| return errors.New(p.GetName() + ": " + serviceName + " not supported service") | ||
| } | ||
|
|
||
| func getSupportedMountServices() map[string]terraformutils.ServiceGenerator { | ||
| services := make(map[string]terraformutils.ServiceGenerator) | ||
| mapping := map[string][]string{ | ||
| "secret_backend": {"ad", "aws", "azure", "consul", "gcp", "nomad", "pki", "rabbitmq", "terraform_cloud"}, | ||
| "secret_backend_role": {"ad", "aws", "azure", "consul", "database", "pki", "rabbitmq", "ssh"}, | ||
| "auth_backend": {"gcp", "github", "jwt", "ldap", "okta"}, | ||
| "auth_backend_role": {"alicloud", "approle", "aws", "azure", "cert", "gcp", "jwt", "kubernetes", "token"}, | ||
| "auth_backend_user": {"ldap", "okta"}, | ||
| "auth_backend_group": {"ldap", "okta"}, | ||
| } | ||
| for resource, mountTypes := range mapping { | ||
| for _, mountType := range mountTypes { | ||
| services[fmt.Sprintf("%s_%s", mountType, resource)] = | ||
| &ServiceGenerator{mountType: mountType, resource: resource} | ||
| } | ||
| } | ||
| return services | ||
| } | ||
|
|
||
| func (p *Provider) GetSupportedService() map[string]terraformutils.ServiceGenerator { | ||
| generators := getSupportedMountServices() | ||
| generators["policy"] = &ServiceGenerator{resource: "policy"} | ||
| generators["generic_secret"] = &ServiceGenerator{resource: "generic_secret", mountType: "kv"} | ||
| return generators | ||
| } | ||
|
|
||
| func (Provider) GetResourceConnections() map[string]map[string][]string { | ||
| return map[string]map[string][]string{} | ||
| } | ||
|
|
||
| func (Provider) GetProviderData(_ ...string) map[string]interface{} { | ||
| return map[string]interface{}{} | ||
| } |
Oops, something went wrong.