Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add support for consul namespaces and admin partitions #13850

Merged
merged 9 commits into from
Feb 9, 2022
Merged

Add support for consul namespaces and admin partitions #13850

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
1a9e1c8
Add support for consul namespaces and admin partitions
robmonte Jan 31, 2022
45a4d65
Remove redundant default value, fix string compare
robmonte Feb 1, 2022
dfec2cf
Refactor variable names and declaration locations
robmonte Feb 2, 2022
0a9021b
Add changelog file
robmonte Feb 2, 2022
443e3e6
Removed parameter values on the token read and fixed some formatting+…
robmonte Feb 7, 2022
ef4249d
Update testing capability for enterprise features, add tests for name…
robmonte Feb 7, 2022
5cb00f1
Update PrepareTestContainer to select image repo name automatically
robmonte Feb 8, 2022
84765ec
Add note about Consul versions for new role fields
robmonte Feb 9, 2022
6f14537
Add t.Helper to PrepareTestContainer
robmonte Feb 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 29 additions & 6 deletions builtin/logical/consul/path_roles.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,7 +26,7 @@ func pathRoles(b *backend) *framework.Path {
Fields: map[string]*framework.FieldSchema{
"name": {
Type: framework.TypeString,
Description: "Name of the role",
Description: "Name of the role.",
},

"policy": {
Expand Down Expand Up @@ -71,6 +71,20 @@ Defaults to 'client'.`,
Description: "Use ttl instead.",
Deprecated: true,
},

"consul_namespace": {
robmonte marked this conversation as resolved.
Show resolved Hide resolved
Type: framework.TypeString,
Default: "default",
robmonte marked this conversation as resolved.
Show resolved Hide resolved
Description: `Indicates which namespace that the token will be
created within. Defaults to "default".`,
},

"partition": {
Type: framework.TypeString,
Default: "default",
Description: `Indicates which admin partition that the token
will be created within. Defaults to "default".`,
},
},

Callbacks: map[logical.Operation]framework.OperationFunc{
Expand Down Expand Up @@ -113,11 +127,13 @@ func (b *backend) pathRolesRead(ctx context.Context, req *logical.Request, d *fr
// Generate the response
resp := &logical.Response{
Data: map[string]interface{}{
"lease": int64(result.TTL.Seconds()),
"ttl": int64(result.TTL.Seconds()),
"max_ttl": int64(result.MaxTTL.Seconds()),
"token_type": result.TokenType,
"local": result.Local,
"lease": int64(result.TTL.Seconds()),
"ttl": int64(result.TTL.Seconds()),
"max_ttl": int64(result.MaxTTL.Seconds()),
"token_type": result.TokenType,
"local": result.Local,
"consul_namespace": result.Namespace,
"partition": result.Partition,
},
}
if result.Policy != "" {
Expand All @@ -126,6 +142,7 @@ func (b *backend) pathRolesRead(ctx context.Context, req *logical.Request, d *fr
if len(result.Policies) > 0 {
resp.Data["policies"] = result.Policies
}

return resp, nil
}

Expand All @@ -135,6 +152,8 @@ func (b *backend) pathRolesWrite(ctx context.Context, req *logical.Request, d *f
name := d.Get("name").(string)
policies := d.Get("policies").([]string)
local := d.Get("local").(bool)
namespace := d.Get("consul_namespace").(string)
partition := d.Get("partition").(string)

if len(policies) == 0 {
switch tokenType {
Expand Down Expand Up @@ -180,6 +199,8 @@ func (b *backend) pathRolesWrite(ctx context.Context, req *logical.Request, d *f
TTL: ttl,
MaxTTL: maxTTL,
Local: local,
Namespace: namespace,
Partition: partition,
})
if err != nil {
return nil, err
Expand Down Expand Up @@ -207,4 +228,6 @@ type roleConfig struct {
MaxTTL time.Duration `json:"max_ttl"`
TokenType string `json:"token_type"`
Local bool `json:"local"`
Namespace string `json:"consul_namespace"`
robmonte marked this conversation as resolved.
Show resolved Hide resolved
Partition string `json:partition"`
robmonte marked this conversation as resolved.
Show resolved Hide resolved
}
65 changes: 56 additions & 9 deletions builtin/logical/consul/path_token.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,22 @@ func pathToken(b *backend) *framework.Path {
Fields: map[string]*framework.FieldSchema{
"role": {
Type: framework.TypeString,
Description: "Name of the role",
Description: "Name of the role.",
},

"policies": {
Type: framework.TypeCommaStringSlice,
Description: `List of policies to attach to the token.`,
},

"consul_namespace": {
Type: framework.TypeString,
Description: "Namespace to create the token in.",
},

"partition": {
Type: framework.TypeString,
Description: "Admin partition to create the token in.",
},
},

Expand All @@ -32,6 +47,9 @@ func pathToken(b *backend) *framework.Path {

func (b *backend) pathTokenRead(ctx context.Context, req *logical.Request, d *framework.FieldData) (*logical.Response, error) {
role := d.Get("role").(string)
policies := d.Get("policies").([]string)
namespace := d.Get("consul_namespace").(string)
partition := d.Get("partition").(string)
tomhjp marked this conversation as resolved.
Show resolved Hide resolved

entry, err := req.Storage.Get(ctx, "policy/"+role)
if err != nil {
Expand Down Expand Up @@ -90,26 +108,43 @@ func (b *backend) pathTokenRead(ctx context.Context, req *logical.Request, d *fr
}

// Create an ACLToken for Consul 1.4 and above
policyLink := []*api.ACLTokenPolicyLink{}
for _, policyName := range result.Policies {
policyLink = append(policyLink, &api.ACLTokenPolicyLink{
Name: policyName,
})
// If policies were supplied here, then overwrite the policies
// that were given when the role was written
var policyLink []*api.ACLTokenPolicyLink
robmonte marked this conversation as resolved.
Show resolved Hide resolved
if len(policies) > 0 {
policyLink = getPolicies(policies)
} else {
policyLink = getPolicies(result.Policies)
robmonte marked this conversation as resolved.
Show resolved Hide resolved
}

// If a namespace was supplied here, then overwrite the namespace
// that was given when the role was written
if len(namespace) == 0 {
robmonte marked this conversation as resolved.
Show resolved Hide resolved
namespace = result.Namespace
}
// If a partition was supplied here, then overwrite the partition
// that was given when the role was written
if len(partition) == 0 {
robmonte marked this conversation as resolved.
Show resolved Hide resolved
partition = result.Partition
}
token, _, err := c.ACL().TokenCreate(&api.ACLToken{
Description: tokenName,
Policies: policyLink,
Local: result.Local,
Namespace: namespace,
Partition: partition,
}, writeOpts)
if err != nil {
return logical.ErrorResponse(err.Error()), nil
}

// Use the helper to create the secret
s := b.Secret(SecretTokenType).Response(map[string]interface{}{
"token": token.SecretID,
"accessor": token.AccessorID,
"local": token.Local,
"token": token.SecretID,
"accessor": token.AccessorID,
"local": token.Local,
"consul_namespace": token.Namespace,
"partition": token.Partition,
}, map[string]interface{}{
"token": token.AccessorID,
"role": role,
Expand All @@ -120,3 +155,15 @@ func (b *backend) pathTokenRead(ctx context.Context, req *logical.Request, d *fr

return s, nil
}

func getPolicies(policies []string) []*api.ACLLink {
policyLink := []*api.ACLTokenPolicyLink{}

for _, policyName := range policies {
policyLink = append(policyLink, &api.ACLTokenPolicyLink{
Name: policyName,
})
}

return policyLink
}
8 changes: 4 additions & 4 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ require (
github.com/google/go-metrics-stackdriver v0.2.0
github.com/hashicorp/cap v0.1.1
github.com/hashicorp/consul-template v0.27.2-0.20211014231529-4ff55381f1c4
github.com/hashicorp/consul/api v1.11.0
github.com/hashicorp/consul/api v1.12.0
github.com/hashicorp/errwrap v1.1.0
github.com/hashicorp/go-cleanhttp v0.5.2
github.com/hashicorp/go-discover v0.0.0-20210818145131-c573d69da192
Expand Down Expand Up @@ -282,8 +282,8 @@ require (
github.com/hashicorp/go-version v1.3.0 // indirect
github.com/hashicorp/jsonapi v0.0.0-20210826224640-ee7dae0fb22d // indirect
github.com/hashicorp/logutils v1.0.0 // indirect
github.com/hashicorp/mdns v1.0.1 // indirect
github.com/hashicorp/serf v0.9.5 // indirect
github.com/hashicorp/mdns v1.0.4 // indirect
github.com/hashicorp/serf v0.9.6 // indirect
github.com/hashicorp/vic v1.5.1-0.20190403131502-bbfe86ec9443 // indirect
github.com/hashicorp/yamux v0.0.0-20181012175058-2f1d1f20f75d // indirect
github.com/huandu/xstrings v1.3.2 // indirect
Expand All @@ -304,7 +304,7 @@ require (
github.com/mattn/go-ieproxy v0.0.1 // indirect
github.com/mattn/go-isatty v0.0.14 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
github.com/miekg/dns v1.1.40 // indirect
github.com/miekg/dns v1.1.41 // indirect
github.com/mitchellh/hashstructure v1.0.0 // indirect
github.com/mitchellh/iochan v1.0.0 // indirect
github.com/mitchellh/pointerstructure v1.2.0 // indirect
Expand Down
12 changes: 12 additions & 0 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -787,6 +787,8 @@ github.com/hashicorp/consul-template v0.27.2-0.20211014231529-4ff55381f1c4/go.mo
github.com/hashicorp/consul/api v1.4.0/go.mod h1:xc8u05kyMa3Wjr9eEAsIAo3dg8+LywT5E/Cl7cNS5nU=
github.com/hashicorp/consul/api v1.11.0 h1:Hw/G8TtRvOElqxVIhBzXciiSTbapq8hZ2XKZsXk5ZCE=
github.com/hashicorp/consul/api v1.11.0/go.mod h1:XjsvQN+RJGWI2TWy1/kqaE16HrR2J/FWgkYjdZQsX9M=
github.com/hashicorp/consul/api v1.12.0 h1:k3y1FYv6nuKyNTqj6w9gXOx5r5CfLj/k/euUeBXj1OY=
github.com/hashicorp/consul/api v1.12.0/go.mod h1:6pVBMo0ebnYdt2S3H87XhekM/HHrUoTD2XXb/VrZVy0=
github.com/hashicorp/consul/sdk v0.1.1/go.mod h1:VKf9jXwCTEY1QZP2MOLRhb5i/I/ssyNV1vwHyQBF0x8=
github.com/hashicorp/consul/sdk v0.4.0/go.mod h1:fY08Y9z5SvJqevyZNy6WWPXiG3KwBPAvlcdx16zZ0fM=
github.com/hashicorp/consul/sdk v0.4.1-0.20200910203702-bb2b5dd871ca/go.mod h1:fY08Y9z5SvJqevyZNy6WWPXiG3KwBPAvlcdx16zZ0fM=
Expand Down Expand Up @@ -905,9 +907,13 @@ github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO
github.com/hashicorp/mdns v1.0.0/go.mod h1:tL+uN++7HEJ6SQLQ2/p+z2pH24WQKWjBPkE0mNTz8vQ=
github.com/hashicorp/mdns v1.0.1 h1:XFSOubp8KWB+Jd2PDyaX5xUd5bhSP/+pTDZVDMzZJM8=
github.com/hashicorp/mdns v1.0.1/go.mod h1:4gW7WsVCke5TE7EPeYliwHlRUyBtfCwuFwuMg2DmyNY=
github.com/hashicorp/mdns v1.0.4 h1:sY0CMhFmjIPDMlTB+HfymFHCaYLhgifZ0QhjaYKD/UQ=
github.com/hashicorp/mdns v1.0.4/go.mod h1:mtBihi+LeNXGtG8L9dX59gAEa12BDtBQSp4v/YAJqrc=
github.com/hashicorp/memberlist v0.1.3/go.mod h1:ajVTdAv/9Im8oMAAj5G31PhhMCZJV2pPBoIllUwCN7I=
github.com/hashicorp/memberlist v0.2.2 h1:5+RffWKwqJ71YPu9mWsF7ZOscZmwfasdA8kbdC7AO2g=
github.com/hashicorp/memberlist v0.2.2/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE=
github.com/hashicorp/memberlist v0.3.0 h1:8+567mCcFDnS5ADl7lrpxPMWiFCElyUEeW0gtj34fMA=
github.com/hashicorp/memberlist v0.3.0/go.mod h1:MS2lj3INKhZjWNqd3N0m3J+Jxf3DAOnAH9VT3Sh9MUE=
github.com/hashicorp/nomad/api v0.0.0-20211006193434-215bf04bc650 h1:pSi8Q6BuijRU9vK/b4/evBeDMXSFBlOX5CTUo3iY4HY=
github.com/hashicorp/nomad/api v0.0.0-20211006193434-215bf04bc650/go.mod h1:vYHP9jMXk4/T2qNUbWlQ1OHCA1hHLil3nvqSmz8mtgc=
github.com/hashicorp/raft v1.0.1/go.mod h1:DVSAWItjLjTOkVbSpWQ0j0kUADIvDaCtBxIcbNAQLkI=
Expand All @@ -928,6 +934,8 @@ github.com/hashicorp/serf v0.8.2/go.mod h1:6hOLApaqBFA1NXqRQAsxw9QxuDEvNxSQRwA/J
github.com/hashicorp/serf v0.9.4/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=
github.com/hashicorp/serf v0.9.5 h1:EBWvyu9tcRszt3Bxp3KNssBMP1KuHWyO51lz9+786iM=
github.com/hashicorp/serf v0.9.5/go.mod h1:UWDWwZeL5cuWDJdl0C6wrvrUwEqtQ4ZKBKKENpqIUyk=
github.com/hashicorp/serf v0.9.6 h1:uuEX1kLR6aoda1TBttmJQKDLZE1Ob7KN0NPdE7EtCDc=
github.com/hashicorp/serf v0.9.6/go.mod h1:TXZNMjZQijwlDvp+r0b63xZ45H7JmCmgg4gpTwn9UV4=
github.com/hashicorp/vault-plugin-auth-alicloud v0.10.0 h1:ujwHy67QeSwIWN2OLw4K/9ImcZaNU2jeNpWDI17/aQk=
github.com/hashicorp/vault-plugin-auth-alicloud v0.10.0/go.mod h1:GqQnzKRACjoUJCq8cHXJKPIMbFpIwxaLTwz8dyYghvM=
github.com/hashicorp/vault-plugin-auth-azure v0.9.2 h1:Q2+z7tAMfc141CWA/4RemI/VtrnuJ1UMwz80EYP73gA=
Expand Down Expand Up @@ -1143,6 +1151,8 @@ github.com/miekg/dns v1.0.14/go.mod h1:W1PPwlIAgtquWBMBEV9nkV9Cazfe8ScdGz/Lj7v3N
github.com/miekg/dns v1.1.26/go.mod h1:bPDLeHnStXmXAq1m/Ch/hvfNHr14JKNPMBo3VZKjuso=
github.com/miekg/dns v1.1.40 h1:pyyPFfGMnciYUk/mXpKkVmeMQjfXqt3FAJ2hy7tPiLA=
github.com/miekg/dns v1.1.40/go.mod h1:KNUDUusw/aVsxyTYZM1oqvCicbwhgbNgztCETuNZ7xM=
github.com/miekg/dns v1.1.41 h1:WMszZWJG0XmzbK9FEmzH2TVcqYzFesusSIB41b8KHxY=
github.com/miekg/dns v1.1.41/go.mod h1:p6aan82bvRIyn+zDIv9xYNUpwa73JcSh9BKwknJysuI=
github.com/miekg/pkcs11 v1.0.3/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
Expand Down Expand Up @@ -1722,6 +1732,7 @@ golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwY
golang.org/x/net v0.0.0-20201224014010-6772e930b67b/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
golang.org/x/net v0.0.0-20210410081132-afb366fc7cd1/go.mod h1:9tjilg8BloeKEkVJvy7fQ90B1CfIiPueXVOjqfkSzI8=
golang.org/x/net v0.0.0-20210428140749-89ef3d95e781/go.mod h1:OJAsFXCWl8Ukc7SiCT/9KSuxbyM7479/AVlXFRxuMCk=
golang.org/x/net v0.0.0-20210503060351-7fd8e65b6420/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
golang.org/x/net v0.0.0-20210505024714-0287a6fb4125/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
Expand Down Expand Up @@ -1850,6 +1861,7 @@ golang.org/x/sys v0.0.0-20201201145000-ef89a241ccb3/go.mod h1:h1NjWce9XRLGQEsW7w
golang.org/x/sys v0.0.0-20201202213521-69691e467435/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210112080510-489259a85091/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210303074136-134d130e1a04/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210324051608-47abb6519492/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
Expand Down