Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add nonce support #202

Merged
merged 2 commits into from
Sep 8, 2017
Merged

Add nonce support #202

merged 2 commits into from
Sep 8, 2017

Conversation

stuart-c
Copy link
Contributor

@stuart-c stuart-c commented Sep 7, 2017

My previous AWS auth PR unfortunately had an omission - it didn't handle nonces. As a result it isn't possible to run gomplate a second time.

This PR fixes this oversight.

hairyhenderson
hairyhenderson reviewed Sep 7, 2017
View reviewed changes
vault/auth.go Outdated
@@ -159,13 +160,25 @@ func (v *Vault) UserPassLogin() string {
func (v *Vault) EC2Login() string {
role := env.Getenv("VAULT_AUTH_AWS_ROLE")
mount := env.Getenv("VAULT_AUTH_AWS_MOUNT", "aws")
nonce := env.Getenv("VAULT_AUTH_AWS_NONCE")
output := env.Getenv("VAULT_AUTH_AWS_NONCE_OUTPUT")
perms := env.Getenv("VAULT_AUTH_AWS_NONCE_PERMISSION", "0666")
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure I'm a fan of 0666 as a default permission since it'll be group/other read/writable. IMO 0600 is a safer default.

Also is there even a need for this to be configurable? I'm not sure I really see a use-case where someone would need to save a nonce that's world-readable, and can't simply chmod it after gomplate runs...

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can change the default or make it non-configurable.

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ok, I'd rather make it explicitly 0600 lower down, and also remove the option to configure

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

hairyhenderson
hairyhenderson reviewed Sep 7, 2017
View reviewed changes
vault/auth.go
@@ -159,13 +160,25 @@ func (v *Vault) UserPassLogin() string {
func (v *Vault) EC2Login() string {
role := env.Getenv("VAULT_AUTH_AWS_ROLE")
mount := env.Getenv("VAULT_AUTH_AWS_MOUNT", "aws")
nonce := env.Getenv("VAULT_AUTH_AWS_NONCE")
output := env.Getenv("VAULT_AUTH_AWS_NONCE_OUTPUT")
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I wonder if maybe naming this VAULT_AUTH_AWS_NONCE_FILE would be better, and making it possible to provide a nonce via a file (the case where the file exists already), or save it to that path if it's nonexistant.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That should already work as it should be using the env lookup with _FILE support

Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh! Good point. 🤔

In that case maybe _OUTPUT is not so bad an idea... let's just leave this as-is for now.

@hairyhenderson
Copy link
Owner

@stuart-c looks like the integration tests are failing in CI:

not ok 35 Testing ec2 vault auth
# (in test file test/integration/datasources_vault.bats, line 143)
#   `curl -o $tmpdir/certificate -s -f http://127.0.0.1:8081/certificate' failed with status 7

@stuart-c
Copy link
Contributor Author

stuart-c commented Sep 7, 2017 •
edited
Loading

Not sure why the integration test has started failing

hairyhenderson
hairyhenderson approved these changes Sep 8, 2017
View reviewed changes
Copy link
Owner

@hairyhenderson hairyhenderson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@hairyhenderson
Copy link
Owner

Not sure why the integration test has started failing

Me neither... I'll chalk it up to something timing-related, as I see it's passing now...

Thanks for this PR!

@hairyhenderson hairyhenderson merged commit 32c8468 into hairyhenderson:master Sep 8, 2017
@stuart-c
Copy link
Contributor Author

stuart-c commented Sep 8, 2017

Great. Any chance of a new release?

Thanks

@stuart-c stuart-c deleted the aws-nonce branch September 8, 2017 08:37
@hairyhenderson
Copy link
Owner

@stuart-c yup - I'll work on one soon!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@hairyhenderson hairyhenderson hairyhenderson approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@stuart-c @hairyhenderson