From 9130b4ab5022699760aa1dc6e223d2709a420f6c Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Fri, 3 Nov 2017 13:12:08 +0100 Subject: [PATCH] Polishing. Convert spaces to tabs. Slightly reorder methods. Make methods static where possible. Add since tags. Reformat code, remove blank lines. Remove local_run_k8s script. Replace Policy JSON with Policy API use. Original pull request: gh-176. Related ticket: gh-173. Closes gh-176. --- .../config/ClientAuthenticationFactory.java | 20 +++-- .../cloud/vault/config/VaultProperties.java | 36 ++++----- .../config/VaultConfigKubernetesTests.java | 32 ++++---- src/test/bash/local_run_k8s.sh | 73 ------------------- 4 files changed, 46 insertions(+), 115 deletions(-) delete mode 100755 src/test/bash/local_run_k8s.sh diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java index dca89cd6..28cc345f 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java @@ -100,7 +100,7 @@ class ClientAuthenticationFactory { case KUBERNETES: return kubernetesAuthentication(vaultProperties); - } + } throw new UnsupportedOperationException(String.format( "Client authentication %s not supported", @@ -229,18 +229,22 @@ class ClientAuthenticationFactory { } private ClientAuthentication kubernetesAuthentication(VaultProperties vaultProperties) { + VaultProperties.KubernetesProperties kubernetes = vaultProperties.getKubernetes(); Assert.hasText(kubernetes.getRole(), "Role (spring.cloud.vault.kubernetes.role) must not be empty"); - Assert.hasText(kubernetes.getServiceAccountTokenFile(), - "Role (spring.cloud.vault.kubernetes.service-account-token-file) must not be empty"); + Assert.hasText( + kubernetes.getServiceAccountTokenFile(), + "Service account token file (spring.cloud.vault.kubernetes.service-account-token-file) must not be empty"); - KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions.builder() - .path(kubernetes.getKubernetesPath()).role(kubernetes.getRole()) - .jwtSupplier(new KubernetesServiceAccountTokenFile( - kubernetes.getServiceAccountTokenFile())) - .build(); + KubernetesAuthenticationOptions options = KubernetesAuthenticationOptions + .builder() + .path(kubernetes.getKubernetesPath()) + .role(kubernetes.getRole()) + .jwtSupplier( + new KubernetesServiceAccountTokenFile(kubernetes + .getServiceAccountTokenFile())).build(); return new KubernetesAuthentication(options, restOperations); } diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java index 05becb92..a6711182 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java @@ -98,7 +98,7 @@ public class VaultProperties implements EnvironmentAware { private AwsIamProperties awsIam = new AwsIamProperties(); - private KubernetesProperties kubernetes = new KubernetesProperties(); + private KubernetesProperties kubernetes = new KubernetesProperties(); private Ssl ssl = new Ssl(); @@ -243,26 +243,26 @@ public class VaultProperties implements EnvironmentAware { private String serverName; } - @Data - public static class KubernetesProperties { + @Data + public static class KubernetesProperties { - /** - * Mount path of the Kubernetes authentication backend. - */ - @NotEmpty - private String kubernetesPath = "kubernetes"; + /** + * Mount path of the Kubernetes authentication backend. + */ + @NotEmpty + private String kubernetesPath = "kubernetes"; - /** - * The Role. - */ - private String role = null; + /** + * Name of the role against which the login is being attempted. + */ + private String role = ""; - /** - * File with service account token. - */ - @NotEmpty - private String serviceAccountTokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token"; - } + /** + * Path to the service account token file. + */ + @NotEmpty + private String serviceAccountTokenFile = "/var/run/secrets/kubernetes.io/serviceaccount/token"; + } @Data @Validated diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigKubernetesTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigKubernetesTests.java index 02e6d235..2f686e15 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigKubernetesTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigKubernetesTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2016-2017 the original author or authors. + * Copyright 2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -15,10 +15,6 @@ */ package org.springframework.cloud.vault.config; -import static org.assertj.core.api.Assertions.assertThat; -import static org.junit.Assume.assumeTrue; -import static org.springframework.cloud.vault.util.Settings.findWorkDir; - import java.io.File; import java.nio.charset.StandardCharsets; import java.util.Collections; @@ -29,6 +25,7 @@ import org.assertj.core.util.Files; import org.junit.BeforeClass; import org.junit.Test; import org.junit.runner.RunWith; + import org.springframework.beans.factory.annotation.Value; import org.springframework.boot.SpringApplication; import org.springframework.boot.autoconfigure.SpringBootApplication; @@ -38,6 +35,13 @@ import org.springframework.cloud.vault.util.Version; import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; import org.springframework.util.StringUtils; import org.springframework.vault.core.VaultOperations; +import org.springframework.vault.support.Policy; +import org.springframework.vault.support.Policy.BuiltinCapabilities; +import org.springframework.vault.support.Policy.Rule; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.junit.Assume.assumeTrue; +import static org.springframework.cloud.vault.util.Settings.findWorkDir; /** * Integration test using config infrastructure with Kubernetes authentication. @@ -56,14 +60,15 @@ public class VaultConfigKubernetesTests { String configValue; @BeforeClass - public static void beforeClass() throws Exception { + public static void beforeClass() { VaultRule vaultRule = new VaultRule(); vaultRule.before(); String minikubeIp = System.getProperty("MINIKUBE_IP"); - assumeTrue(StringUtils.hasText(minikubeIp) && vaultRule.prepare().getVersion() - .isGreaterThanOrEqualTo(Version.parse("0.8.3"))); + assumeTrue(StringUtils.hasText(minikubeIp) + && vaultRule.prepare().getVersion() + .isGreaterThanOrEqualTo(Version.parse("0.8.3"))); if (!vaultRule.prepare().hasAuth("kubernetes")) { vaultRule.prepare().mountAuth("kubernetes"); @@ -71,14 +76,10 @@ public class VaultConfigKubernetesTests { VaultOperations vaultOperations = vaultRule.prepare().getVaultOperations(); - String rules = "{ \"name\": \"testpolicy\",\n" // - + " \"path\": {\n" // - + " \"*\": { \"policy\": \"read\" }\n" // - + " }\n" // - + "}"; + Policy policy = Policy.of(Rule.builder().path("*") + .capabilities(BuiltinCapabilities.READ).build()); - vaultOperations.write("sys/policy/testpolicy", - Collections.singletonMap("rules", rules)); + vaultOperations.opsForSys().createOrUpdatePolicy("testpolicy", policy); vaultOperations.write( "secret/" + VaultConfigKubernetesTests.class.getSimpleName(), @@ -100,7 +101,6 @@ public class VaultConfigKubernetesTests { roleData.put("policies", "testpolicy"); roleData.put("ttl", "1h"); vaultOperations.write("auth/kubernetes/role/my-role", roleData); - } @Test diff --git a/src/test/bash/local_run_k8s.sh b/src/test/bash/local_run_k8s.sh deleted file mode 100755 index 3c06ae10..00000000 --- a/src/test/bash/local_run_k8s.sh +++ /dev/null @@ -1,73 +0,0 @@ -#!/bin/bash - -CMD_MINIKUBE=${1:-minikube} -CMD_KUBECTL=${2:-kubectl} -MINIKUBE_OPTS=${3:-} - -DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" - -if [ ! -d "work" ]; then - echo "work directory could not be found." - exit 1 -fi - -mkdir -p work/minikube -SERVICE_ACCOUNT_TOKEN_FILE=work/minikube/hello-minikube-token -SERVICE_ACCOUNT_CA_CRT=work/minikube/ca.crt - -function is_cluster_running() { - local _running=$(${CMD_MINIKUBE} status | grep "cluster: Running" || true) - echo "$_running" -} - -if [[ -z "$(is_cluster_running)" ]]; then - ${CMD_MINIKUBE} start "${MINIKUBE_OPTS}" - while [[ -z "$(is_cluster_running)" ]]; do - echo "Wait for minikube cluster to be up" - sleep 1 - done -fi - -export MINIKUBE_IP=$(${CMD_MINIKUBE} ip) -echo "MINIKUBE_IP ${MINIKUBE_IP}" - -# ensure kubectl context is not stale -${CMD_MINIKUBE} update-context - -# https://kubernetes.io/docs/getting-started-guides/minikube/ -${CMD_KUBECTL} run hello-minikube --image=gcr.io/google_containers/echoserver:1.4 --port=8080 -${CMD_KUBECTL} expose deployment hello-minikube --type=NodePort - -# Wait for service to be ready -echo "Wait for hello-minikube service to be ready" -HELLO_MINIKUBE_URL=$(${CMD_MINIKUBE} service hello-minikube --url --interval 5 --wait 120) -if [ $? != 0 ] ; then - echo "Error during service startup" - echo "In case of DNS problems try 'VBoxManage modifyvm minikube --natdnshostresolver1 on'" - # kubectl get pod -> STATUS: ContainerCreating - exit 1 -fi -echo "HELLO_MINIKUBE_URL ${HELLO_MINIKUBE_URL}" - -POD_NAME=$(${CMD_KUBECTL} get pod --selector=run=hello-minikube -o jsonpath='{.items..metadata.name}') -# Copy service account token -${CMD_KUBECTL} exec ${POD_NAME} -- cat /var/run/secrets/kubernetes.io/serviceaccount/token > ${SERVICE_ACCOUNT_TOKEN_FILE} -if [ $? != 0 ] ; then - echo "Error while retrieving service account token file" - exit 1 -fi -# Copy ca cert -${CMD_KUBECTL} exec ${POD_NAME} -- cat /var/run/secrets/kubernetes.io/serviceaccount/ca.crt > ${SERVICE_ACCOUNT_CA_CRT} -if [ $? != 0 ] ; then - echo "Error while retrieving service account ca.crt" - exit 1 -fi - -#BASEDIR=`dirname $0`/../../.. -#sh <( -#cat <<-EOF -#cd ${BASEDIR} && ${BASEDIR}/src/test/bash/env.sh -#vault auth-enable kubernetes -#vault write auth/kubernetes/config kubernetes_host=https://$(minikube ip):8443 kubernetes_ca_cert=@$HOME/.minikube/ca.crt -#EOF -#)