|
| 1 | +package vault |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + _ "embed" |
| 6 | + "encoding/json" |
| 7 | + "errors" |
| 8 | + "fmt" |
| 9 | + "net/url" |
| 10 | + "strings" |
| 11 | + |
| 12 | + _ "github.com/redpanda-data/benthos/v4/public/components/pure" |
| 13 | + |
| 14 | + "github.com/hashicorp/vault-client-go" |
| 15 | + "github.com/hashicorp/vault-client-go/schema" |
| 16 | + "github.com/redpanda-data/benthos/v4/public/bloblang" |
| 17 | + "github.com/redpanda-data/benthos/v4/public/service" |
| 18 | +) |
| 19 | + |
| 20 | +var ( |
| 21 | + _ service.Processor = (*processor)(nil) |
| 22 | + spec *service.ConfigSpec |
| 23 | + errLoginResponseEmpty = errors.New("login responded with unexpected empty response") |
| 24 | + errLoginResponseMissingAuth = errors.New("login responded with unexpected missing auth") |
| 25 | + errLoginResponseEmptyClientToken = errors.New("login responded with unexpected missing or empty client_token") |
| 26 | +) |
| 27 | + |
| 28 | +func init() { |
| 29 | + spec = service.NewConfigSpec(). |
| 30 | + Beta(). |
| 31 | + Summary("Fetches a Value for a Key from Hashicorp Vault"). |
| 32 | + Description(` |
| 33 | +The fields `+"`mount_path`"+`, `+"`path`"+` and `+"`version`"+` support |
| 34 | +xref:configuration:interpolation.adoc#bloblang-queries[interpolation functions], allowing |
| 35 | +you to create a unique `+"`mount_path`"+`, `+"`path`"+` and/or `+"`version`"+` for each message. |
| 36 | +
|
| 37 | +`). |
| 38 | + Fields( |
| 39 | + service.NewStringField("url"). |
| 40 | + Description("The base URL of the Vault server."), |
| 41 | + service.NewObjectField( |
| 42 | + "auth", |
| 43 | + service.NewStringField("mount_path"). |
| 44 | + Optional(), |
| 45 | + service.NewObjectField( |
| 46 | + "app_role", |
| 47 | + service.NewStringField("role_id"). |
| 48 | + Description("Unique identifier of the Role"). |
| 49 | + Secret(), |
| 50 | + service.NewStringField("secret_id"). |
| 51 | + Description("SecretID belong to the App role"). |
| 52 | + Secret(), |
| 53 | + ), |
| 54 | + ), |
| 55 | + service.NewBloblangField("mount_path"). |
| 56 | + Description(`Supports xref:configuration:interpolation.adoc#bloblang-queries[interpolation functions]. |
| 57 | +`). |
| 58 | + Optional(), |
| 59 | + service.NewBloblangField("path"). |
| 60 | + Description(`The key path to fetch from Vault. |
| 61 | +Supports xref:configuration:interpolation.adoc#bloblang-queries[interpolation functions]. |
| 62 | +If root gets deleted no message gets produced. |
| 63 | +`), |
| 64 | + service.NewInterpolatedStringField("version"). |
| 65 | + Description(`The specific key version to fetch from Vault. |
| 66 | +Supports xref:configuration:interpolation.adoc#bloblang-queries[interpolation functions]. |
| 67 | +`). |
| 68 | + Optional(), |
| 69 | + ) |
| 70 | + err := service.RegisterProcessor("vault_key", spec, ctor) |
| 71 | + if err != nil { |
| 72 | + panic(err) |
| 73 | + } |
| 74 | +} |
| 75 | + |
| 76 | +func ctor(conf *service.ParsedConfig, mgr *service.Resources) (service.Processor, error) { |
| 77 | + |
| 78 | + url, err := conf.FieldString("url") |
| 79 | + if err != nil { |
| 80 | + return nil, fmt.Errorf("missing url for Vault: %w", err) |
| 81 | + } |
| 82 | + if strings.TrimSpace(url) == "" { |
| 83 | + return nil, fmt.Errorf("unexpected empty url for Vault AppRole login: %w", err) |
| 84 | + } |
| 85 | + |
| 86 | + roleID, err := conf.FieldString("auth", "app_role", "role_id") |
| 87 | + if err != nil { |
| 88 | + return nil, fmt.Errorf("missing role_id for Vault AppRole login: %w", err) |
| 89 | + } |
| 90 | + if strings.TrimSpace(roleID) == "" { |
| 91 | + return nil, fmt.Errorf("unexpected empty role_id for Vault AppRole login: %w", err) |
| 92 | + } |
| 93 | + |
| 94 | + secretID, err := conf.FieldString("auth", "app_role", "secret_id") |
| 95 | + if err != nil { |
| 96 | + return nil, fmt.Errorf("missing secret_id for Vault AppRole login: %w", err) |
| 97 | + } |
| 98 | + if strings.TrimSpace(secretID) == "" { |
| 99 | + return nil, fmt.Errorf("unexpected empty secret_id for Vault AppRole login: %w", err) |
| 100 | + } |
| 101 | + |
| 102 | + client, err := vault.New( |
| 103 | + vault.WithAddress(url), |
| 104 | + ) |
| 105 | + if err != nil { |
| 106 | + return nil, fmt.Errorf("failed creating Vault client: %w", err) |
| 107 | + } |
| 108 | + |
| 109 | + var authOptions []vault.RequestOption |
| 110 | + if conf.Contains("auth", "mount_path") { |
| 111 | + authMountPath, err := conf.FieldString("auth", "mount_path") |
| 112 | + if err != nil { |
| 113 | + return nil, err |
| 114 | + } |
| 115 | + authOptions = append(authOptions, vault.WithMountPath(authMountPath)) |
| 116 | + } |
| 117 | + |
| 118 | + ctx := context.Background() |
| 119 | + resp, err := client.Auth.AppRoleLogin(ctx, schema.AppRoleLoginRequest{ |
| 120 | + RoleId: roleID, |
| 121 | + SecretId: secretID, |
| 122 | + }, authOptions...) |
| 123 | + if err != nil { |
| 124 | + return nil, fmt.Errorf("failed to login via Vault client: %w", err) |
| 125 | + } |
| 126 | + if resp == nil { |
| 127 | + return nil, errLoginResponseEmpty |
| 128 | + } |
| 129 | + |
| 130 | + var mountPath *service.InterpolatedString |
| 131 | + if conf.Contains("mount_path") { |
| 132 | + mountPath, err = conf.FieldInterpolatedString("mount_path") |
| 133 | + if err != nil { |
| 134 | + return nil, err |
| 135 | + } |
| 136 | + } |
| 137 | + |
| 138 | + var path *bloblang.Executor |
| 139 | + path, err = conf.FieldBloblang("path") |
| 140 | + if err != nil { |
| 141 | + return nil, fmt.Errorf("missing key path for Vault fetch: %w", err) |
| 142 | + } |
| 143 | + |
| 144 | + var version *service.InterpolatedString |
| 145 | + if conf.Contains("version") { |
| 146 | + version, err = conf.FieldInterpolatedString("version") |
| 147 | + if err != nil { |
| 148 | + return nil, err |
| 149 | + } |
| 150 | + } |
| 151 | + |
| 152 | + if resp.Auth == nil { |
| 153 | + return nil, errLoginResponseMissingAuth |
| 154 | + } |
| 155 | + |
| 156 | + if resp.Auth.ClientToken == "" { |
| 157 | + return nil, errLoginResponseEmptyClientToken |
| 158 | + } |
| 159 | + |
| 160 | + clientToken := resp.Auth.ClientToken |
| 161 | + |
| 162 | + return &processor{ |
| 163 | + client: client, |
| 164 | + clientToken: clientToken, |
| 165 | + logger: mgr.Logger(), |
| 166 | + metrics: mgr.Metrics(), |
| 167 | + mountPath: mountPath, |
| 168 | + path: path, |
| 169 | + version: version, |
| 170 | + }, nil |
| 171 | +} |
| 172 | + |
| 173 | +type processor struct { |
| 174 | + client *vault.Client |
| 175 | + clientToken string |
| 176 | + logger *service.Logger |
| 177 | + metrics *service.Metrics |
| 178 | + mountPath *service.InterpolatedString |
| 179 | + path *bloblang.Executor |
| 180 | + version *service.InterpolatedString |
| 181 | +} |
| 182 | + |
| 183 | +func (p *processor) Process(ctx context.Context, message *service.Message) (service.MessageBatch, error) { |
| 184 | + |
| 185 | + opts := []vault.RequestOption{ |
| 186 | + vault.WithToken(p.clientToken), |
| 187 | + } |
| 188 | + |
| 189 | + mountPath := "" |
| 190 | + if p.mountPath != nil { |
| 191 | + var err error |
| 192 | + mountPath, err = p.mountPath.TryString(message) |
| 193 | + if err != nil { |
| 194 | + return nil, err |
| 195 | + } |
| 196 | + if mountPath != "" { |
| 197 | + opts = append(opts, vault.WithMountPath(mountPath)) |
| 198 | + } |
| 199 | + } |
| 200 | + |
| 201 | + output, err := p.path.Query(message) |
| 202 | + if errors.Is(err, bloblang.ErrRootDeleted) { |
| 203 | + // Take this as an indicator to not produce a message |
| 204 | + return nil, nil |
| 205 | + } |
| 206 | + path := output.(string) |
| 207 | + if path == "" { |
| 208 | + return nil, errors.New("empty key path") |
| 209 | + } |
| 210 | + |
| 211 | + version := "" |
| 212 | + if p.version != nil { |
| 213 | + version, err := p.version.TryString(message) |
| 214 | + if err != nil { |
| 215 | + return nil, err |
| 216 | + } |
| 217 | + if version != "" { |
| 218 | + opts = append(opts, vault.WithQueryParameters(url.Values{ |
| 219 | + "version": []string{version}, |
| 220 | + })) |
| 221 | + } |
| 222 | + } |
| 223 | + |
| 224 | + p.logger.Tracef("Reading key value from Vault (mount_path: %s, path: %s, version: %s)", mountPath, path, version) |
| 225 | + kv, err := p.client.Secrets.KvV2Read(ctx, path, opts...) |
| 226 | + if err != nil { |
| 227 | + outMsg := message.Copy() |
| 228 | + outMsg.SetError(err) |
| 229 | + return service.MessageBatch{outMsg}, nil |
| 230 | + } |
| 231 | + |
| 232 | + bs, err := json.Marshal(kv.Data.Data) |
| 233 | + if err != nil { |
| 234 | + return nil, fmt.Errorf("failed to marshal Vault response: %w", err) |
| 235 | + } |
| 236 | + |
| 237 | + outMsg := message.Copy() |
| 238 | + outMsg.SetBytes(bs) |
| 239 | + for k, v := range kv.Data.Metadata { |
| 240 | + outMsg.MetaSetMut(k, v) |
| 241 | + } |
| 242 | + |
| 243 | + return service.MessageBatch{ |
| 244 | + outMsg, |
| 245 | + }, nil |
| 246 | +} |
| 247 | + |
| 248 | +func (p *processor) Close(ctx context.Context) error { |
| 249 | + return nil |
| 250 | +} |
0 commit comments