gongzhiyongandOmX
d9eb7dcd74
Manager needs a platform-owned secret handoff path so resource bindings can keep only vault references while OpenBao stores tenant-scoped credential payloads. Tested: go test ./controller ./model ./router && go vet ./controller ./model ./router Co-authored-by: OmX <omx@oh-my-codex.dev>
105 lines
2.6 KiB
Go
105 lines
2.6 KiB
Go
package controller
|
|
|
|
import (
|
|
"bytes"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"net/http"
|
|
"os"
|
|
"strings"
|
|
"time"
|
|
|
|
"github.com/heicode/manager/common"
|
|
)
|
|
|
|
type secretStoreClient struct {
|
|
address string
|
|
mount string
|
|
token string
|
|
client *http.Client
|
|
}
|
|
|
|
func newSecretStoreClientFromEnv() (secretStoreClient, error) {
|
|
address := strings.TrimRight(strings.TrimSpace(os.Getenv("OPENBAO_ADDR")), "/")
|
|
if address == "" {
|
|
address = strings.TrimRight(strings.TrimSpace(os.Getenv("VAULT_ADDR")), "/")
|
|
}
|
|
if address == "" {
|
|
address = "http://127.0.0.1:8200"
|
|
}
|
|
token := strings.TrimSpace(os.Getenv("OPENBAO_TOKEN"))
|
|
if token == "" {
|
|
token = strings.TrimSpace(os.Getenv("VAULT_TOKEN"))
|
|
}
|
|
if token == "" {
|
|
tokenFile := strings.TrimSpace(os.Getenv("OPENBAO_TOKEN_FILE"))
|
|
if tokenFile == "" {
|
|
tokenFile = strings.TrimSpace(os.Getenv("VAULT_TOKEN_FILE"))
|
|
}
|
|
if tokenFile != "" {
|
|
data, err := os.ReadFile(tokenFile)
|
|
if err != nil {
|
|
return secretStoreClient{}, fmt.Errorf("failed to read secret store token file: %w", err)
|
|
}
|
|
token = strings.TrimSpace(string(data))
|
|
}
|
|
}
|
|
if token == "" {
|
|
return secretStoreClient{}, errors.New("secret store token is not configured")
|
|
}
|
|
mount := strings.Trim(strings.TrimSpace(os.Getenv("OPENBAO_KV_MOUNT")), "/")
|
|
if mount == "" {
|
|
mount = strings.Trim(strings.TrimSpace(os.Getenv("VAULT_KV_MOUNT")), "/")
|
|
}
|
|
if mount == "" {
|
|
mount = "secret"
|
|
}
|
|
return secretStoreClient{
|
|
address: address,
|
|
mount: mount,
|
|
token: token,
|
|
client: &http.Client{Timeout: 10 * time.Second},
|
|
}, nil
|
|
}
|
|
|
|
func (s secretStoreClient) putKV2(path string, data map[string]any) error {
|
|
if len(data) == 0 {
|
|
return errors.New("secret data required")
|
|
}
|
|
body, err := common.Marshal(map[string]any{"data": data})
|
|
if err != nil {
|
|
return err
|
|
}
|
|
url := fmt.Sprintf("%s/v1/%s/data/%s", s.address, s.mount, strings.Trim(path, "/"))
|
|
req, err := http.NewRequest(http.MethodPost, url, bytes.NewReader(body))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
req.Header.Set("Content-Type", "application/json")
|
|
req.Header.Set("X-Vault-Token", s.token)
|
|
resp, err := s.client.Do(req)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
defer resp.Body.Close()
|
|
if resp.StatusCode < http.StatusOK || resp.StatusCode >= http.StatusMultipleChoices {
|
|
message := readSecretStoreError(resp.Body)
|
|
if message == "" {
|
|
message = resp.Status
|
|
}
|
|
return fmt.Errorf("secret store write failed: %s", message)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func readSecretStoreError(body io.Reader) string {
|
|
var payload struct {
|
|
Errors []string `json:"errors"`
|
|
}
|
|
if err := common.DecodeJson(body, &payload); err != nil {
|
|
return ""
|
|
}
|
|
return strings.Join(payload.Errors, "; ")
|
|
}
|