Polishing.
Convert spaces to tabs. Slightly reorder methods. Make methods static where possible. Add since tags. Reformat code, remove blank lines. Remove local_run_k8s script. Replace Policy JSON with Policy API use. Original pull request: gh-176. Related ticket: gh-173. Closes gh-176.
This commit is contained in:
Mark Paluch
@@ -100,7 +100,7 @@ class ClientAuthenticationFactory {
|
||||
|
||||
case KUBERNETES:
|
||||
return kubernetesAuthentication(vaultProperties);
|
||||
}
|
||||
}
|
||||
|
||||
throw new UnsupportedOperationException(String.format(
|
||||
"Client authentication %s not supported",
|
||||
@@ -229,18 +229,22 @@ class ClientAuthenticationFactory {
|
||||
}
|
||||
|
||||
private ClientAuthentication kubernetesAuthentication(VaultProperties vaultProperties) {
|
||||
|
||||
VaultProperties.KubernetesProperties kubernetes = vaultProperties.getKubernetes();
|
||||
|
||||
Assert.hasText(kubernetes.getRole(),
|
||||
"Role (spring.cloud.vault.kubernetes.role) must not be empty");
|
||||
Assert.hasText(kubernetes.getServiceAccountTokenFile(),
|
||||
"Role (spring.cloud.vault.kubernetes.service-account-token-file) must not be empty");
|
||||
Assert.hasText(
|
||||
kubernetes.getServiceAccountTokenFile(),
|
||||
"Service account token file (spring.cloud.vault.kubernetes.service-account-token-file) must not be empty");
|
||||
|
||||
KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions.builder()
|
||||
.path(kubernetes.getKubernetesPath()).role(kubernetes.getRole())
|
||||
.jwtSupplier(new KubernetesServiceAccountTokenFile(
|
||||
kubernetes.getServiceAccountTokenFile()))
|
||||
.build();
|
||||
KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions
|
||||
.builder()
|
||||
.path(kubernetes.getKubernetesPath())
|
||||
.role(kubernetes.getRole())
|
||||
.jwtSupplier(
|
||||
new KubernetesServiceAccountTokenFile(kubernetes
|
||||
.getServiceAccountTokenFile())).build();
|
||||
|
||||
return new KubernetesAuthentication(options, restOperations);
|
||||
}
|
||||
|
||||
@@ -98,7 +98,7 @@ public class VaultProperties implements EnvironmentAware {
|
||||
|
||||
private AwsIamProperties awsIam = new AwsIamProperties();
|
||||
|
||||
private KubernetesProperties kubernetes = new KubernetesProperties();
|
||||
private KubernetesProperties kubernetes = new KubernetesProperties();
|
||||
|
||||
private Ssl ssl = new Ssl();
|
||||
|
||||
@@ -243,26 +243,26 @@ public class VaultProperties implements EnvironmentAware {
|
||||
private String serverName;
|
||||
}
|
||||
|
||||
@Data
|
||||
public static class KubernetesProperties {
|
||||
@Data
|
||||
public static class KubernetesProperties {
|
||||
|
||||
/**
|
||||
* Mount path of the Kubernetes authentication backend.
|
||||
*/
|
||||
@NotEmpty
|
||||
private String kubernetesPath = "kubernetes";
|
||||
/**
|
||||
* Mount path of the Kubernetes authentication backend.
|
||||
*/
|
||||
@NotEmpty
|
||||
private String kubernetesPath = "kubernetes";
|
||||
|
||||
/**
|
||||
* The Role.
|
||||
*/
|
||||
private String role = null;
|
||||
/**
|
||||
* Name of the role against which the login is being attempted.
|
||||
*/
|
||||
private String role = "";
|
||||
|
||||
/**
|
||||
* File with service account token.
|
||||
*/
|
||||
@NotEmpty
|
||||
private String serviceAccountTokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token";
|
||||
}
|
||||
/**
|
||||
* Path to the service account token file.
|
||||
*/
|
||||
@NotEmpty
|
||||
private String serviceAccountTokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token";
|
||||
}
|
||||
|
||||
@Data
|
||||
@Validated
|
||||
|
||||
@@ -1,5 +1,5 @@
|
||||
/*
|
||||
* Copyright 2016-2017 the original author or authors.
|
||||
* Copyright 2017 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
@@ -15,10 +15,6 @@
|
||||
*/
|
||||
package org.springframework.cloud.vault.config;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.junit.Assume.assumeTrue;
|
||||
import static org.springframework.cloud.vault.util.Settings.findWorkDir;
|
||||
|
||||
import java.io.File;
|
||||
import java.nio.charset.StandardCharsets;
|
||||
import java.util.Collections;
|
||||
@@ -29,6 +25,7 @@ import org.assertj.core.util.Files;
|
||||
import org.junit.BeforeClass;
|
||||
import org.junit.Test;
|
||||
import org.junit.runner.RunWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Value;
|
||||
import org.springframework.boot.SpringApplication;
|
||||
import org.springframework.boot.autoconfigure.SpringBootApplication;
|
||||
@@ -38,6 +35,13 @@ import org.springframework.cloud.vault.util.Version;
|
||||
import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
|
||||
import org.springframework.util.StringUtils;
|
||||
import org.springframework.vault.core.VaultOperations;
|
||||
import org.springframework.vault.support.Policy;
|
||||
import org.springframework.vault.support.Policy.BuiltinCapabilities;
|
||||
import org.springframework.vault.support.Policy.Rule;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.junit.Assume.assumeTrue;
|
||||
import static org.springframework.cloud.vault.util.Settings.findWorkDir;
|
||||
|
||||
/**
|
||||
* Integration test using config infrastructure with Kubernetes authentication.
|
||||
@@ -56,14 +60,15 @@ public class VaultConfigKubernetesTests {
|
||||
String configValue;
|
||||
|
||||
@BeforeClass
|
||||
public static void beforeClass() throws Exception {
|
||||
public static void beforeClass() {
|
||||
|
||||
VaultRule vaultRule = new VaultRule();
|
||||
vaultRule.before();
|
||||
|
||||
String minikubeIp = System.getProperty("MINIKUBE_IP");
|
||||
assumeTrue(StringUtils.hasText(minikubeIp) && vaultRule.prepare().getVersion()
|
||||
.isGreaterThanOrEqualTo(Version.parse("0.8.3")));
|
||||
assumeTrue(StringUtils.hasText(minikubeIp)
|
||||
&& vaultRule.prepare().getVersion()
|
||||
.isGreaterThanOrEqualTo(Version.parse("0.8.3")));
|
||||
|
||||
if (!vaultRule.prepare().hasAuth("kubernetes")) {
|
||||
vaultRule.prepare().mountAuth("kubernetes");
|
||||
@@ -71,14 +76,10 @@ public class VaultConfigKubernetesTests {
|
||||
|
||||
VaultOperations vaultOperations = vaultRule.prepare().getVaultOperations();
|
||||
|
||||
String rules = "{ \"name\": \"testpolicy\",\n" //
|
||||
+ " \"path\": {\n" //
|
||||
+ " \"*\": { \"policy\": \"read\" }\n" //
|
||||
+ " }\n" //
|
||||
+ "}";
|
||||
Policy policy = Policy.of(Rule.builder().path("*")
|
||||
.capabilities(BuiltinCapabilities.READ).build());
|
||||
|
||||
vaultOperations.write("sys/policy/testpolicy",
|
||||
Collections.singletonMap("rules", rules));
|
||||
vaultOperations.opsForSys().createOrUpdatePolicy("testpolicy", policy);
|
||||
|
||||
vaultOperations.write(
|
||||
"secret/" + VaultConfigKubernetesTests.class.getSimpleName(),
|
||||
@@ -100,7 +101,6 @@ public class VaultConfigKubernetesTests {
|
||||
roleData.put("policies", "testpolicy");
|
||||
roleData.put("ttl", "1h");
|
||||
vaultOperations.write("auth/kubernetes/role/my-role", roleData);
|
||||
|
||||
}
|
||||
|
||||
@Test
|
||||
|
||||
@@ -1,73 +0,0 @@
|
||||
#!/bin/bash
|
||||
|
||||
CMD_MINIKUBE=${1:-minikube}
|
||||
CMD_KUBECTL=${2:-kubectl}
|
||||
MINIKUBE_OPTS=${3:-}
|
||||
|
||||
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
|
||||
|
||||
if [ ! -d "work" ]; then
|
||||
echo "work directory could not be found."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
mkdir -p work/minikube
|
||||
SERVICE_ACCOUNT_TOKEN_FILE=work/minikube/hello-minikube-token
|
||||
SERVICE_ACCOUNT_CA_CRT=work/minikube/ca.crt
|
||||
|
||||
function is_cluster_running() {
|
||||
local _running=$(${CMD_MINIKUBE} status | grep "cluster: Running" || true)
|
||||
echo "$_running"
|
||||
}
|
||||
|
||||
if [[ -z "$(is_cluster_running)" ]]; then
|
||||
${CMD_MINIKUBE} start "${MINIKUBE_OPTS}"
|
||||
while [[ -z "$(is_cluster_running)" ]]; do
|
||||
echo "Wait for minikube cluster to be up"
|
||||
sleep 1
|
||||
done
|
||||
fi
|
||||
|
||||
export MINIKUBE_IP=$(${CMD_MINIKUBE} ip)
|
||||
echo "MINIKUBE_IP ${MINIKUBE_IP}"
|
||||
|
||||
# ensure kubectl context is not stale
|
||||
${CMD_MINIKUBE} update-context
|
||||
|
||||
# https://kubernetes.io/docs/getting-started-guides/minikube/
|
||||
${CMD_KUBECTL} run hello-minikube --image=gcr.io/google_containers/echoserver:1.4 --port=8080
|
||||
${CMD_KUBECTL} expose deployment hello-minikube --type=NodePort
|
||||
|
||||
# Wait for service to be ready
|
||||
echo "Wait for hello-minikube service to be ready"
|
||||
HELLO_MINIKUBE_URL=$(${CMD_MINIKUBE} service hello-minikube --url --interval 5 --wait 120)
|
||||
if [ $? != 0 ] ; then
|
||||
echo "Error during service startup"
|
||||
echo "In case of DNS problems try 'VBoxManage modifyvm minikube --natdnshostresolver1 on'"
|
||||
# kubectl get pod -> STATUS: ContainerCreating
|
||||
exit 1
|
||||
fi
|
||||
echo "HELLO_MINIKUBE_URL ${HELLO_MINIKUBE_URL}"
|
||||
|
||||
POD_NAME=$(${CMD_KUBECTL} get pod --selector=run=hello-minikube -o jsonpath='{.items..metadata.name}')
|
||||
# Copy service account token
|
||||
${CMD_KUBECTL} exec ${POD_NAME} -- cat /var/run/secrets/kubernetes.io/serviceaccount/token > ${SERVICE_ACCOUNT_TOKEN_FILE}
|
||||
if [ $? != 0 ] ; then
|
||||
echo "Error while retrieving service account token file"
|
||||
exit 1
|
||||
fi
|
||||
# Copy ca cert
|
||||
${CMD_KUBECTL} exec ${POD_NAME} -- cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt > ${SERVICE_ACCOUNT_CA_CRT}
|
||||
if [ $? != 0 ] ; then
|
||||
echo "Error while retrieving service account ca.crt"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
#BASEDIR=`dirname $0`/../../..
|
||||
#sh <(
|
||||
#cat <<-EOF
|
||||
#cd ${BASEDIR} && ${BASEDIR}/src/test/bash/env.sh
|
||||
#vault auth-enable kubernetes
|
||||
#vault write auth/kubernetes/config kubernetes_host=https://$(minikube ip):8443 kubernetes_ca_cert=@$HOME/.minikube/ca.crt
|
||||
#EOF
|
||||
#)
|
||||
Reference in New Issue
Block a user