Class: Wault::Password

Inherits:
Object
  • Object
show all
Defined in:
lib/puppet/functions/wault/password.rb

Overview

TODO

Instance Attribute Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(cache, name, params, scope) ⇒ Password

Returns a new instance of Password.



11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
 
# File 'lib/puppet/functions/wault/password.rb', line 11

def initialize(cache, name, params, scope)
  # Требуемые параметры
  @cache_hash = cache.retrieve(self)
  @name = name
  @params = params
  @scope = scope
  @default_fact = '__common' # kv/__common/<name>

  # Параметры для настройки Wault
  @config_dir   = params.fetch('config_dir', '/opt/wault')
  @config_file  = params.fetch('config_file', "#{@config_dir}/.vault.yaml")
  @address      = params.fetch('address', yaml['address'])
  @namespace    = params.fetch('namespace', nil)

  # Параметры для внутреннего использования
  @stale = {}

  configure
  staled
end

Instance Attribute Details

#name ⇒ Object

Returns the value of attribute name.



9
10
11
 
# File 'lib/puppet/functions/wault/password.rb', line 9

def name
  @name
end

Instance Method Details

#configure ⇒ Object 



79
80
81
82
83
84
 
# File 'lib/puppet/functions/wault/password.rb', line 79

def configure
  yaml.each do |key, value|
    Vault.client.instance_variable_set(:"@#{key}", value)
  end
  Vault.client.instance_variable_set(:"@namespace", @namespace) unless @namespace.nil?
end

#expire ⇒ Object 



96
97
98
99
100
 
# File 'lib/puppet/functions/wault/password.rb', line 96

def expire
  return '' unless @params.key? 'expire'

  @params.fetch('expire')
end

#facter(name) ⇒ Object 



124
125
126
127
128
 
# File 'lib/puppet/functions/wault/password.rb', line 124

def facter(name)
  return @scope[name] if @scope.key? name

  Facter.value(name)
end

#facts ⇒ Object 



102
103
104
 
# File 'lib/puppet/functions/wault/password.rb', line 102

def facts
  @params.fetch('facts', @default_fact)
end

#gen_facts ⇒ Object 



116
117
118
 
# File 'lib/puppet/functions/wault/password.rb', line 116

def gen_facts
  facts.sort.map { |fact| "#{fact}__#{facter(fact)}" }
end

#generate ⇒ Object 



106
107
108
 
# File 'lib/puppet/functions/wault/password.rb', line 106

def generate
  SecureRandom.base64 14
end

#get_value ⇒ Object 



65
66
67
68
69
70
71
72
73
74
75
76
77
 
# File 'lib/puppet/functions/wault/password.rb', line 65

def get_value
  cache_key = [@name, @address]
  last_result = @cache_hash[cache_key]
  return last_result unless last_result.nil?
  value = Vault.logical.read(path)
  return nil unless value

  data = value.data
  censured_data = Puppet::Pops::Types::PSensitiveType::Sensitive.new(data)
  @cache_hash[cache_key] = censured_data

  censured_data
end

#key_expired? ⇒ Boolean

Returns:

  • (Boolean) 


61
62
63
 
# File 'lib/puppet/functions/wault/password.rb', line 61

def key_expired?
  @stale[:expire] ? Time.now.to_i > @stale[:expire] : false
end

#need_replace? ⇒ Boolean

Returns:

  • (Boolean) 


56
57
58
59
 
# File 'lib/puppet/functions/wault/password.rb', line 56

def need_replace?
  # Not password || expired || changed duration
  !@stale.key? :password or key_expired? or @stale[:expire_duration] != expire
end

#path ⇒ Object 



32
33
34
 
# File 'lib/puppet/functions/wault/password.rb', line 32

def path
  "kv/#{real_facts}/#{name}"
end

#real_expire ⇒ Object 



120
121
122
 
# File 'lib/puppet/functions/wault/password.rb', line 120

def real_expire
  ChronicDuration.parse(expire)
end

#real_facts ⇒ Object 



110
111
112
113
114
 
# File 'lib/puppet/functions/wault/password.rb', line 110

def real_facts
  return facts unless facts.is_a? Array

  gen_facts.join('/')
end

#staled ⇒ Object 



36
37
38
39
40
41
42
43
 
# File 'lib/puppet/functions/wault/password.rb', line 36

def staled
  result = get_value
  return {} unless result.is_a? Hash

  @stale[:password] = result[:value]
  @stale[:expire] = result[:expire].to_i if result[:expire].to_i > 0
  @stale[:expire_duration] = result[:expire_duration]
end

#sync ⇒ Object 



45
46
47
48
49
50
51
52
53
54
 
# File 'lib/puppet/functions/wault/password.rb', line 45

def sync
  return @stale[:password] unless need_replace?

  Vault.with_retries(Vault::HTTPConnectionError) do
    Vault.logical.write(path, value: value,
                        expire: real_expire ? Time.now.to_i + real_expire : real_expire,
                        expire_duration: expire, ttl: real_expire)
    value
  end
end

#value ⇒ Object 



90
91
92
93
94
 
# File 'lib/puppet/functions/wault/password.rb', line 90

def value
  @params['value'] = Puppet::Pops::Types::PSensitiveType::Sensitive.new(generate) unless @params.key? 'value'

  @params.fetch('value')
end

#yaml ⇒ Object 



86
87
88
 
# File 'lib/puppet/functions/wault/password.rb', line 86

def yaml
  YAML.load_file(@config_file)
end