SpringCloud/spring-cloud-bindings
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Adds more Spring Cloud Vault authentication methods

Browse Source 
* AWS_EC2
* AWS_IAM
* AZURE_MSI
* GCP_GCE
* GCP_IAM
* KUBERNETS

Signed-off-by: Emily Casey <ecasey@vmware.com>
This commit is contained in:
Emily Casey
2020-06-23 17:45:18 -04:00
parent 5be10f2702
commit b3b1b06aea
3 changed files with 238 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
src/main/java/org/springframework/cloud/bindings/boot/VaultBindingsPropertiesProcessor.java
View File

@@ -62,10 +62,47 @@ public final class VaultBindingsPropertiesProcessor implements BindingsPropertie
map.from("role").to("spring.cloud.vault.app-role.role");
map.from("app-role-path").to("spring.cloud.vault.app-role.app-role-path");
break;
case "AWS_EC2":
map.from("role").to("spring.cloud.vault.aws-ec2.role");
map.from("aws-ec2-path").to("spring.cloud.vault.aws-ec2.aws-ec2-path");
map.from("identity-document").to("spring.cloud.vault.aws-ec2.identity-document");
map.from("nonce").to("spring.cloud.vault.aws-ec2.nonce");
break;
case "AWS_IAM":
map.from("role").to("spring.cloud.vault.aws-iam.role");
map.from("aws-path").to("spring.cloud.vault.aws-iam.aws-path");
map.from("server-id").to("spring.cloud.vault.aws-iam.server-id");
map.from("endpoint-uri").to("spring.cloud.vault.aws-iam.endpoint-uri");
break;
case "AZURE_MSI":
map.from("role").to("spring.cloud.vault.azure-msi.role");
map.from("azure-path").to("spring.cloud.vault.azure-msi.azure-path");
break;
case "CERT":
properties.put("spring.cloud.vault.ssl.key-store", binding.getSecretFilePath("keystore.jks").toString());
map.from("key-store-password").to("spring.cloud.vault.ssl.key-store-password");
map.from("cert-auth-path").to("spring.cloud.vault.ssl.cert-auth-path");
break;
case "GCP_GCE":
map.from("role").to("spring.cloud.vault.gcp-gce.role");
map.from("gcp-path").to("spring.cloud.vault.gcp-gce.gcp-path");
map.from("service-account").to("spring.cloud.vault.gcp-gce.service-account");
break;
case "GCP_IAM":
if (binding.getSecret().containsKey("credentials.json")) {
properties.put("spring.cloud.vault.gcp-iam.credentials.location", binding.getSecretFilePath("credentials.json").toString());
}
map.from("role").to("spring.cloud.vault.gcp-iam.role");
map.from("encoded-key").to("spring.cloud.vault.gcp-iam.credentials.encoded-key");
map.from("gcp-path").to("spring.cloud.vault.gcp-iam.gcp-path");
map.from("jwt-validity").to("spring.cloud.vault.gcp-iam.jwt-validity");
map.from("project-id").to("spring.cloud.vault.gcp-iam.project-id");
map.from("service-account-id").to("spring.cloud.vault.gcp-iam.service-account-id");
break;
case "KUBERNETES":
map.from("role").to("spring.cloud.vault.kubernetes.role");
map.from("kubernetes-path").to("spring.cloud.vault.kubernetes.kubernetes-path");
break;
}
});
}

146
src/test/java/org/springframework/cloud/bindings/boot/VaultPropertiesProcessorTest.java
View File

@@ -80,6 +80,70 @@ final class VaultPropertiesProcessorTest {
.withEntry("cert-auth-path", "test-cert-auth-path")
);
private final Binding awsEc2Binding = new Binding(
"test-name", Paths.get("test-path"),
metadata(),
baseSecret()
.withEntry("method", "aws_ec2")
.withEntry("role", "test-role")
.withEntry("aws-ec2-path", "test-aws-ec2-path")
.withEntry("identity-document", "test-identity-document")
.withEntry("nonce", "test-nonce")
);
private final Binding awsIamBinding = new Binding(
"test-name", Paths.get("test-path"),
metadata(),
baseSecret()
.withEntry("method", "aws_iam")
.withEntry("role", "test-role")
.withEntry("aws-path", "test-aws-path")
.withEntry("server-id", "test-server-id")
.withEntry("endpoint-uri", "test-endpoint-uri")
);
private final Binding azureMsiBinding = new Binding(
"test-name", Paths.get("test-path"),
metadata(),
baseSecret()
.withEntry("method", "azure_msi")
.withEntry("role", "test-role")
.withEntry("azure-path", "test-azure-path")
);
private final Binding gcpGceBinding = new Binding(
"test-name", Paths.get("test-path"),
metadata(),
baseSecret()
.withEntry("method", "gcp_gce")
.withEntry("role", "test-role")
.withEntry("gcp-path", "test-gcp-path")
.withEntry("service-account", "test-service-account")
);
private final Binding gcpIamBinding = new Binding(
"test-name", Paths.get("test-path"),
metadata(),
baseSecret()
.withEntry("method", "gcp_iam")
.withEntry("credentials.json", "credentials JSON contents!")
.withEntry("encoded-key", "test-encoded-key")
.withEntry("gcp-path", "test-gcp-path")
.withEntry("jwt-validity", "test-jwt-validity")
.withEntry("project-id", "test-project-id")
.withEntry("role", "test-role")
.withEntry("service-account-id", "test-service-account-id")
);
private final Binding k8sBinding = new Binding(
"test-name", Paths.get("test-path"),
metadata(),
baseSecret()
.withEntry("method", "kubernetes")
.withEntry("role", "test-role")
.withEntry("kubernetes-path", "test-kubernetes-path")
);
private final MockEnvironment environment = new MockEnvironment();
private final HashMap<String, Object> properties = new HashMap<>();
@@ -133,6 +197,88 @@ final class VaultPropertiesProcessorTest {
.containsEntry("spring.cloud.vault.ssl.cert-auth-path", "test-cert-auth-path");
}
@Test
@DisplayName("Supports AWS EC2 authentication")
void testAwsEc2Authentication() {
new VaultBindingsPropertiesProcessor().process(environment, new Bindings(awsEc2Binding), properties);
assertThat(properties)
.containsEntry("spring.cloud.vault.uri", "test-uri")
.containsEntry("spring.cloud.vault.namespace", "test-namespace")
.containsEntry("spring.cloud.vault.authentication", "AWS_EC2")
.containsEntry("spring.cloud.vault.aws-ec2.role", "test-role")
.containsEntry("spring.cloud.vault.aws-ec2.aws-ec2-path", "test-aws-ec2-path")
.containsEntry("spring.cloud.vault.aws-ec2.identity-document", "test-identity-document")
.containsEntry("spring.cloud.vault.aws-ec2.nonce", "test-nonce");
}
@Test
@DisplayName("Supports AWS IAM authentication")
void testAwsIamAuthentication() {
new VaultBindingsPropertiesProcessor().process(environment, new Bindings(awsIamBinding), properties);
assertThat(properties)
.containsEntry("spring.cloud.vault.uri", "test-uri")
.containsEntry("spring.cloud.vault.namespace", "test-namespace")
.containsEntry("spring.cloud.vault.authentication", "AWS_IAM")
.containsEntry("spring.cloud.vault.aws-iam.role", "test-role")
.containsEntry("spring.cloud.vault.aws-iam.aws-path", "test-aws-path")
.containsEntry("spring.cloud.vault.aws-iam.server-id", "test-server-id")
.containsEntry("spring.cloud.vault.aws-iam.endpoint-uri", "test-endpoint-uri");
}
@Test
@DisplayName("Supports Azure MSI authentication")
void testAzureMsiAuthentication() {
new VaultBindingsPropertiesProcessor().process(environment, new Bindings(azureMsiBinding), properties);
assertThat(properties)
.containsEntry("spring.cloud.vault.uri", "test-uri")
.containsEntry("spring.cloud.vault.namespace", "test-namespace")
.containsEntry("spring.cloud.vault.authentication", "AZURE_MSI")
.containsEntry("spring.cloud.vault.azure-msi.role", "test-role")
.containsEntry("spring.cloud.vault.azure-msi.azure-path", "test-azure-path");
}
@Test
@DisplayName("Supports GCP GCE authentication")
void testGcpGceAuthentication() {
new VaultBindingsPropertiesProcessor().process(environment, new Bindings(gcpGceBinding), properties);
assertThat(properties)
.containsEntry("spring.cloud.vault.uri", "test-uri")
.containsEntry("spring.cloud.vault.namespace", "test-namespace")
.containsEntry("spring.cloud.vault.authentication", "GCP_GCE")
.containsEntry("spring.cloud.vault.gcp-gce.role", "test-role")
.containsEntry("spring.cloud.vault.gcp-gce.gcp-path", "test-gcp-path")
.containsEntry("spring.cloud.vault.gcp-gce.service-account", "test-service-account");
}
@Test
@DisplayName("Supports GCP IAM authentication")
void testGcpIamAuthentication() {
new VaultBindingsPropertiesProcessor().process(environment, new Bindings(gcpIamBinding), properties);
assertThat(properties)
.containsEntry("spring.cloud.vault.uri", "test-uri")
.containsEntry("spring.cloud.vault.namespace", "test-namespace")
.containsEntry("spring.cloud.vault.authentication", "GCP_IAM")
.containsEntry("spring.cloud.vault.gcp-iam.role", "test-role")
.containsEntry("spring.cloud.vault.gcp-iam.credentials.location", "test-path/secret/credentials.json")
.containsEntry("spring.cloud.vault.gcp-iam.credentials.encoded-key", "test-encoded-key")
.containsEntry("spring.cloud.vault.gcp-iam.gcp-path", "test-gcp-path")
.containsEntry("spring.cloud.vault.gcp-iam.jwt-validity", "test-jwt-validity")
.containsEntry("spring.cloud.vault.gcp-iam.project-id", "test-project-id")
.containsEntry("spring.cloud.vault.gcp-iam.service-account-id", "test-service-account-id");
}
@Test
@DisplayName("Supports Kubernetes authentication")
void testK8sAuthentication() {
new VaultBindingsPropertiesProcessor().process(environment, new Bindings(k8sBinding), properties);
assertThat(properties)
.containsEntry("spring.cloud.vault.uri", "test-uri")
.containsEntry("spring.cloud.vault.namespace", "test-namespace")
.containsEntry("spring.cloud.vault.authentication", "KUBERNETES")
.containsEntry("spring.cloud.vault.kubernetes.role", "test-role")
.containsEntry("spring.cloud.vault.kubernetes.kubernetes-path", "test-kubernetes-path");
}
@Test
@DisplayName("Doesn't fail when method is missing")
void testMissingProvider() {