From e4ed9a3a766a32071cf9bb37004c2d19d7e022ec Mon Sep 17 00:00:00 2001 From: Emily Casey Date: Thu, 25 Jun 2020 16:06:04 -0400 Subject: [PATCH] Adds more context to ambiguous secret key names When key names are potentially ambiguous (does this server-id refer to the vault server?) prefer longer more explicit key names. When there is no ambiguity stick with the existing shorter names. Signed-off-by: Emily Casey --- README.md | 14 ++++---- .../VaultBindingsPropertiesProcessor.java | 12 +++---- .../boot/VaultPropertiesProcessorTest.java | 36 +++++++++---------- 3 files changed, 31 insertions(+), 31 deletions(-) diff --git a/README.md b/README.md index fba6aa8..bb86112 100644 --- a/README.md +++ b/README.md @@ -291,7 +291,7 @@ If `{secret/authentication-method}` is equal to `aws_ec2`: | Property | Value | -------- | ------------------ | `spring.cloud.vault.aws-ec2.aws-ec2-path` | `{secret/aws-ec2-path}` -| `spring.cloud.vault.aws-ec2.identity-document` | `{secret/aws-ec2-identity-document}` +| `spring.cloud.vault.aws-ec2.identity-document` | `{secret/aws-ec2-instance-identity-document}` | `spring.cloud.vault.aws-ec2.nonce` | `{secret/nonce}` | `spring.cloud.vault.aws-ec2.role` | `{secret/role}` @@ -299,9 +299,9 @@ If `{secret/authentication-method}` is equal to `aws_iam`: | Property | Value | -------- | ------------------ | `spring.cloud.vault.aws-iam.aws-path` | `{secret/aws-path}` -| `spring.cloud.vault.aws-iam.endpoint-uri` | `{secret/endpoint-uri}` -| `spring.cloud.vault.aws-iam.role` | `{secret/token}` -| `spring.cloud.vault.aws-iam.server-id` | `{secret/server-id}` +| `spring.cloud.vault.aws-iam.endpoint-uri` | `{secret/aws-sts-endpoint-uri}` +| `spring.cloud.vault.aws-iam.role` | `{secret/role}` +| `spring.cloud.vault.aws-iam.server-id` | `{secret/aws-iam-server-id}` If `{secret/authentication-method}` is equal to `azure_msi`: | Property | Value @@ -326,7 +326,7 @@ If `{secret/authentication-method}` is equal to `gcp_gce`: | -------- | ------------------ | `spring.cloud.vault.gcp-gce.gcp-path` | `{secret/gcp-path}` | `spring.cloud.vault.gcp-gce.role` | `{secret/role}` -| `spring.cloud.vault.gcp-gce.service-account` | `{secret/service-account}` +| `spring.cloud.vault.gcp-gce.service-account` | `{secret/gcp-service-account}` If `{secret/authentication-method}` is equal to `gcp_iam`: @@ -336,9 +336,9 @@ If `{secret/authentication-method}` is equal to `gcp_iam`: | `spring.cloud.vault.gcp-iam.credentials.location` | `${CNB_BINDINGS}/{name}/secret/credentials.json` | `spring.cloud.vault.gcp-iam.gcp-path` | `{secret/gcp-path}` | `spring.cloud.vault.gcp-iam.jwt-validity` | `{secret/jwt-validity}` -| `spring.cloud.vault.gcp-iam.project-id` | `{secret/project-id}` +| `spring.cloud.vault.gcp-iam.project-id` | `{secret/gcp-project-id}` | `spring.cloud.vault.gcp-iam.role` | `{secret/role}` -| `spring.cloud.vault.gcp-iam.service-account-id` | `{secret/service-account-id}` +| `spring.cloud.vault.gcp-iam.service-account` | `{secret/gcp-service-account}` If `{secret/authentication-method}` is equal to `kubernetes`: | Property | Value diff --git a/src/main/java/org/springframework/cloud/bindings/boot/VaultBindingsPropertiesProcessor.java b/src/main/java/org/springframework/cloud/bindings/boot/VaultBindingsPropertiesProcessor.java index fdca0d8..88b99b3 100644 --- a/src/main/java/org/springframework/cloud/bindings/boot/VaultBindingsPropertiesProcessor.java +++ b/src/main/java/org/springframework/cloud/bindings/boot/VaultBindingsPropertiesProcessor.java @@ -70,14 +70,14 @@ public final class VaultBindingsPropertiesProcessor implements BindingsPropertie case "AWS_EC2": map.from("role").to("spring.cloud.vault.aws-ec2.role"); map.from("aws-ec2-path").to("spring.cloud.vault.aws-ec2.aws-ec2-path"); - map.from("identity-document").to("spring.cloud.vault.aws-ec2.identity-document"); + map.from("aws-ec2-instance-identity-document").to("spring.cloud.vault.aws-ec2.identity-document"); map.from("nonce").to("spring.cloud.vault.aws-ec2.nonce"); break; case "AWS_IAM": map.from("role").to("spring.cloud.vault.aws-iam.role"); map.from("aws-path").to("spring.cloud.vault.aws-iam.aws-path"); - map.from("server-id").to("spring.cloud.vault.aws-iam.server-id"); - map.from("endpoint-uri").to("spring.cloud.vault.aws-iam.endpoint-uri"); + map.from("aws-iam-server-id").to("spring.cloud.vault.aws-iam.server-id"); + map.from("aws-sts-endpoint-uri").to("spring.cloud.vault.aws-iam.endpoint-uri"); break; case "AZURE_MSI": map.from("role").to("spring.cloud.vault.azure-msi.role"); @@ -91,7 +91,7 @@ public final class VaultBindingsPropertiesProcessor implements BindingsPropertie case "GCP_GCE": map.from("role").to("spring.cloud.vault.gcp-gce.role"); map.from("gcp-path").to("spring.cloud.vault.gcp-gce.gcp-path"); - map.from("service-account").to("spring.cloud.vault.gcp-gce.service-account"); + map.from("gcp-service-account").to("spring.cloud.vault.gcp-gce.service-account"); break; case "GCP_IAM": if (binding.getSecret().containsKey("credentials.json")) { @@ -101,8 +101,8 @@ public final class VaultBindingsPropertiesProcessor implements BindingsPropertie map.from("encoded-key").to("spring.cloud.vault.gcp-iam.credentials.encoded-key"); map.from("gcp-path").to("spring.cloud.vault.gcp-iam.gcp-path"); map.from("jwt-validity").to("spring.cloud.vault.gcp-iam.jwt-validity"); - map.from("project-id").to("spring.cloud.vault.gcp-iam.project-id"); - map.from("service-account-id").to("spring.cloud.vault.gcp-iam.service-account-id"); + map.from("gcp-project-id").to("spring.cloud.vault.gcp-iam.project-id"); + map.from("gcp-service-account").to("spring.cloud.vault.gcp-iam.service-account"); break; case "KUBERNETES": map.from("role").to("spring.cloud.vault.kubernetes.role"); diff --git a/src/test/java/org/springframework/cloud/bindings/boot/VaultPropertiesProcessorTest.java b/src/test/java/org/springframework/cloud/bindings/boot/VaultPropertiesProcessorTest.java index 17bc5c0..f5c9de3 100644 --- a/src/test/java/org/springframework/cloud/bindings/boot/VaultPropertiesProcessorTest.java +++ b/src/test/java/org/springframework/cloud/bindings/boot/VaultPropertiesProcessorTest.java @@ -34,8 +34,8 @@ final class VaultPropertiesProcessorTest { private FluentMap baseSecret() { return new FluentMap() - .withEntry("uri", "test-uri") - .withEntry("namespace", "test-namespace"); + .withEntry("namespace", "test-namespace") + .withEntry("uri", "test-uri"); } private FluentMap metadata() { @@ -55,11 +55,11 @@ final class VaultPropertiesProcessorTest { "test-name", Paths.get("test-path"), metadata(), baseSecret() + .withEntry("app-role-path", "test-app-role-path") .withEntry("authentication-method", "approle") + .withEntry("role", "test-role") .withEntry("role-id", "test-role-id") .withEntry("secret-id", "test-secret-id") - .withEntry("role", "test-role") - .withEntry("app-role-path", "test-app-role-path") ); private final Binding cubbyholeBinding = new Binding( @@ -75,9 +75,9 @@ final class VaultPropertiesProcessorTest { metadata(), baseSecret() .withEntry("authentication-method", "cert") - .withEntry("keystore.jks", "key store contents!") - .withEntry("key-store-password", "test-key-store-password") .withEntry("cert-auth-path", "test-cert-auth-path") + .withEntry("key-store-password", "test-key-store-password") + .withEntry("keystore.jks", "key store contents!") ); private final Binding awsEc2Binding = new Binding( @@ -85,10 +85,10 @@ final class VaultPropertiesProcessorTest { metadata(), baseSecret() .withEntry("authentication-method", "aws_ec2") - .withEntry("role", "test-role") - .withEntry("aws-ec2-path", "test-aws-ec2-path") - .withEntry("identity-document", "test-identity-document") + .withEntry("aws-ec2-instance-identity-document", "test-identity-document") .withEntry("nonce", "test-nonce") + .withEntry("aws-ec2-path", "test-aws-ec2-path") + .withEntry("role", "test-role") ); private final Binding awsIamBinding = new Binding( @@ -96,10 +96,10 @@ final class VaultPropertiesProcessorTest { metadata(), baseSecret() .withEntry("authentication-method", "aws_iam") - .withEntry("role", "test-role") + .withEntry("aws-iam-server-id", "test-server-id") .withEntry("aws-path", "test-aws-path") - .withEntry("server-id", "test-server-id") - .withEntry("endpoint-uri", "test-endpoint-uri") + .withEntry("aws-sts-endpoint-uri", "test-endpoint-uri") + .withEntry("role", "test-role") ); private final Binding azureMsiBinding = new Binding( @@ -107,8 +107,8 @@ final class VaultPropertiesProcessorTest { metadata(), baseSecret() .withEntry("authentication-method", "azure_msi") - .withEntry("role", "test-role") .withEntry("azure-path", "test-azure-path") + .withEntry("role", "test-role") ); private final Binding gcpGceBinding = new Binding( @@ -116,9 +116,9 @@ final class VaultPropertiesProcessorTest { metadata(), baseSecret() .withEntry("authentication-method", "gcp_gce") - .withEntry("role", "test-role") .withEntry("gcp-path", "test-gcp-path") - .withEntry("service-account", "test-service-account") + .withEntry("gcp-service-account", "test-service-account") + .withEntry("role", "test-role") ); private final Binding gcpIamBinding = new Binding( @@ -129,10 +129,10 @@ final class VaultPropertiesProcessorTest { .withEntry("credentials.json", "credentials JSON contents!") .withEntry("encoded-key", "test-encoded-key") .withEntry("gcp-path", "test-gcp-path") + .withEntry("gcp-project-id", "test-project-id") + .withEntry("gcp-service-account", "test-service-account") .withEntry("jwt-validity", "test-jwt-validity") - .withEntry("project-id", "test-project-id") .withEntry("role", "test-role") - .withEntry("service-account-id", "test-service-account-id") ); private final Binding k8sBinding = new Binding( @@ -264,7 +264,7 @@ final class VaultPropertiesProcessorTest { .containsEntry("spring.cloud.vault.gcp-iam.gcp-path", "test-gcp-path") .containsEntry("spring.cloud.vault.gcp-iam.jwt-validity", "test-jwt-validity") .containsEntry("spring.cloud.vault.gcp-iam.project-id", "test-project-id") - .containsEntry("spring.cloud.vault.gcp-iam.service-account-id", "test-service-account-id"); + .containsEntry("spring.cloud.vault.gcp-iam.service-account", "test-service-account"); } @Test