SpringCloud/spring-cloud-bindings
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Adds more context to ambiguous secret key names

Browse Source 
When key names are potentially ambiguous (does this server-id refer to the vault server?) prefer longer more explicit key names. When there is no ambiguity stick with the existing shorter names.

Signed-off-by: Emily Casey <ecasey@vmware.com>
This commit is contained in:
Emily Casey
2020-06-25 16:06:04 -04:00
parent 10ace42f07
commit e4ed9a3a76
3 changed files with 31 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
README.md
View File

@@ -291,7 +291,7 @@ If `{secret/authentication-method}` is equal to `aws_ec2`:
| Property | Value
| -------- | ------------------
| `spring.cloud.vault.aws-ec2.aws-ec2-path` | `{secret/aws-ec2-path}`
| `spring.cloud.vault.aws-ec2.identity-document` | `{secret/aws-ec2-identity-document}`
| `spring.cloud.vault.aws-ec2.identity-document` | `{secret/aws-ec2-instance-identity-document}`
| `spring.cloud.vault.aws-ec2.nonce` | `{secret/nonce}`
| `spring.cloud.vault.aws-ec2.role` | `{secret/role}`
@@ -299,9 +299,9 @@ If `{secret/authentication-method}` is equal to `aws_iam`:
| Property | Value
| -------- | ------------------
| `spring.cloud.vault.aws-iam.aws-path` | `{secret/aws-path}`
| `spring.cloud.vault.aws-iam.endpoint-uri` | `{secret/endpoint-uri}`
| `spring.cloud.vault.aws-iam.role` | `{secret/token}`
| `spring.cloud.vault.aws-iam.server-id` | `{secret/server-id}`
| `spring.cloud.vault.aws-iam.endpoint-uri` | `{secret/aws-sts-endpoint-uri}`
| `spring.cloud.vault.aws-iam.role` | `{secret/role}`
| `spring.cloud.vault.aws-iam.server-id` | `{secret/aws-iam-server-id}`
If `{secret/authentication-method}` is equal to `azure_msi`:
| Property | Value
@@ -326,7 +326,7 @@ If `{secret/authentication-method}` is equal to `gcp_gce`:
| -------- | ------------------
| `spring.cloud.vault.gcp-gce.gcp-path` | `{secret/gcp-path}`
| `spring.cloud.vault.gcp-gce.role` | `{secret/role}`
| `spring.cloud.vault.gcp-gce.service-account` | `{secret/service-account}`
| `spring.cloud.vault.gcp-gce.service-account` | `{secret/gcp-service-account}`
If `{secret/authentication-method}` is equal to `gcp_iam`:
@@ -336,9 +336,9 @@ If `{secret/authentication-method}` is equal to `gcp_iam`:
| `spring.cloud.vault.gcp-iam.credentials.location` | `${CNB_BINDINGS}/{name}/secret/credentials.json`
| `spring.cloud.vault.gcp-iam.gcp-path` | `{secret/gcp-path}`
| `spring.cloud.vault.gcp-iam.jwt-validity` | `{secret/jwt-validity}`
| `spring.cloud.vault.gcp-iam.project-id` | `{secret/project-id}`
| `spring.cloud.vault.gcp-iam.project-id` | `{secret/gcp-project-id}`
| `spring.cloud.vault.gcp-iam.role` | `{secret/role}`
| `spring.cloud.vault.gcp-iam.service-account-id` | `{secret/service-account-id}`
| `spring.cloud.vault.gcp-iam.service-account` | `{secret/gcp-service-account}`
If `{secret/authentication-method}` is equal to `kubernetes`:
| Property | Value

12
src/main/java/org/springframework/cloud/bindings/boot/VaultBindingsPropertiesProcessor.java
View File

@@ -70,14 +70,14 @@ public final class VaultBindingsPropertiesProcessor implements BindingsPropertie
case "AWS_EC2":
map.from("role").to("spring.cloud.vault.aws-ec2.role");
map.from("aws-ec2-path").to("spring.cloud.vault.aws-ec2.aws-ec2-path");
map.from("identity-document").to("spring.cloud.vault.aws-ec2.identity-document");
map.from("aws-ec2-instance-identity-document").to("spring.cloud.vault.aws-ec2.identity-document");
map.from("nonce").to("spring.cloud.vault.aws-ec2.nonce");
break;
case "AWS_IAM":
map.from("role").to("spring.cloud.vault.aws-iam.role");
map.from("aws-path").to("spring.cloud.vault.aws-iam.aws-path");
map.from("server-id").to("spring.cloud.vault.aws-iam.server-id");
map.from("endpoint-uri").to("spring.cloud.vault.aws-iam.endpoint-uri");
map.from("aws-iam-server-id").to("spring.cloud.vault.aws-iam.server-id");
map.from("aws-sts-endpoint-uri").to("spring.cloud.vault.aws-iam.endpoint-uri");
break;
case "AZURE_MSI":
map.from("role").to("spring.cloud.vault.azure-msi.role");
@@ -91,7 +91,7 @@ public final class VaultBindingsPropertiesProcessor implements BindingsPropertie
case "GCP_GCE":
map.from("role").to("spring.cloud.vault.gcp-gce.role");
map.from("gcp-path").to("spring.cloud.vault.gcp-gce.gcp-path");
map.from("service-account").to("spring.cloud.vault.gcp-gce.service-account");
map.from("gcp-service-account").to("spring.cloud.vault.gcp-gce.service-account");
break;
case "GCP_IAM":
if (binding.getSecret().containsKey("credentials.json")) {
@@ -101,8 +101,8 @@ public final class VaultBindingsPropertiesProcessor implements BindingsPropertie
map.from("encoded-key").to("spring.cloud.vault.gcp-iam.credentials.encoded-key");
map.from("gcp-path").to("spring.cloud.vault.gcp-iam.gcp-path");
map.from("jwt-validity").to("spring.cloud.vault.gcp-iam.jwt-validity");
map.from("project-id").to("spring.cloud.vault.gcp-iam.project-id");
map.from("service-account-id").to("spring.cloud.vault.gcp-iam.service-account-id");
map.from("gcp-project-id").to("spring.cloud.vault.gcp-iam.project-id");
map.from("gcp-service-account").to("spring.cloud.vault.gcp-iam.service-account");
break;
case "KUBERNETES":
map.from("role").to("spring.cloud.vault.kubernetes.role");

36
src/test/java/org/springframework/cloud/bindings/boot/VaultPropertiesProcessorTest.java
View File

@@ -34,8 +34,8 @@ final class VaultPropertiesProcessorTest {
private FluentMap baseSecret() {
return new FluentMap()
.withEntry("uri", "test-uri")
.withEntry("namespace", "test-namespace");
.withEntry("namespace", "test-namespace")
.withEntry("uri", "test-uri");
}
private FluentMap metadata() {
@@ -55,11 +55,11 @@ final class VaultPropertiesProcessorTest {
"test-name", Paths.get("test-path"),
metadata(),
baseSecret()
.withEntry("app-role-path", "test-app-role-path")
.withEntry("authentication-method", "approle")
.withEntry("role", "test-role")
.withEntry("role-id", "test-role-id")
.withEntry("secret-id", "test-secret-id")
.withEntry("role", "test-role")
.withEntry("app-role-path", "test-app-role-path")
);
private final Binding cubbyholeBinding = new Binding(
@@ -75,9 +75,9 @@ final class VaultPropertiesProcessorTest {
metadata(),
baseSecret()
.withEntry("authentication-method", "cert")
.withEntry("keystore.jks", "key store contents!")
.withEntry("key-store-password", "test-key-store-password")
.withEntry("cert-auth-path", "test-cert-auth-path")
.withEntry("key-store-password", "test-key-store-password")
.withEntry("keystore.jks", "key store contents!")
);
private final Binding awsEc2Binding = new Binding(
@@ -85,10 +85,10 @@ final class VaultPropertiesProcessorTest {
metadata(),
baseSecret()
.withEntry("authentication-method", "aws_ec2")
.withEntry("role", "test-role")
.withEntry("aws-ec2-path", "test-aws-ec2-path")
.withEntry("identity-document", "test-identity-document")
.withEntry("aws-ec2-instance-identity-document", "test-identity-document")
.withEntry("nonce", "test-nonce")
.withEntry("aws-ec2-path", "test-aws-ec2-path")
.withEntry("role", "test-role")
);
private final Binding awsIamBinding = new Binding(
@@ -96,10 +96,10 @@ final class VaultPropertiesProcessorTest {
metadata(),
baseSecret()
.withEntry("authentication-method", "aws_iam")
.withEntry("role", "test-role")
.withEntry("aws-iam-server-id", "test-server-id")
.withEntry("aws-path", "test-aws-path")
.withEntry("server-id", "test-server-id")
.withEntry("endpoint-uri", "test-endpoint-uri")
.withEntry("aws-sts-endpoint-uri", "test-endpoint-uri")
.withEntry("role", "test-role")
);
private final Binding azureMsiBinding = new Binding(
@@ -107,8 +107,8 @@ final class VaultPropertiesProcessorTest {
metadata(),
baseSecret()
.withEntry("authentication-method", "azure_msi")
.withEntry("role", "test-role")
.withEntry("azure-path", "test-azure-path")
.withEntry("role", "test-role")
);
private final Binding gcpGceBinding = new Binding(
@@ -116,9 +116,9 @@ final class VaultPropertiesProcessorTest {
metadata(),
baseSecret()
.withEntry("authentication-method", "gcp_gce")
.withEntry("role", "test-role")
.withEntry("gcp-path", "test-gcp-path")
.withEntry("service-account", "test-service-account")
.withEntry("gcp-service-account", "test-service-account")
.withEntry("role", "test-role")
);
private final Binding gcpIamBinding = new Binding(
@@ -129,10 +129,10 @@ final class VaultPropertiesProcessorTest {
.withEntry("credentials.json", "credentials JSON contents!")
.withEntry("encoded-key", "test-encoded-key")
.withEntry("gcp-path", "test-gcp-path")
.withEntry("gcp-project-id", "test-project-id")
.withEntry("gcp-service-account", "test-service-account")
.withEntry("jwt-validity", "test-jwt-validity")
.withEntry("project-id", "test-project-id")
.withEntry("role", "test-role")
.withEntry("service-account-id", "test-service-account-id")
);
private final Binding k8sBinding = new Binding(
@@ -264,7 +264,7 @@ final class VaultPropertiesProcessorTest {
.containsEntry("spring.cloud.vault.gcp-iam.gcp-path", "test-gcp-path")
.containsEntry("spring.cloud.vault.gcp-iam.jwt-validity", "test-jwt-validity")
.containsEntry("spring.cloud.vault.gcp-iam.project-id", "test-project-id")
.containsEntry("spring.cloud.vault.gcp-iam.service-account-id", "test-service-account-id");
.containsEntry("spring.cloud.vault.gcp-iam.service-account", "test-service-account");
}
@Test