|
|
@@ -34,47 +34,43 @@ var apiErr akeyless.GenericOpenAPIError
|
|
|
|
|
|
const DefServiceAccountFile = "/var/run/secrets/kubernetes.io/serviceaccount/token"
|
|
|
|
|
|
-func (a *AkeylessBase) GetToken(accessId, accType, accTypeParam string) (string, error) {
|
|
|
-
|
|
|
+func (a *akeylessBase) GetToken(accessID, accType, accTypeParam string) (string, error) {
|
|
|
ctx := context.Background()
|
|
|
authBody := akeyless.NewAuthWithDefaults()
|
|
|
- authBody.AccessId = akeyless.PtrString(accessId)
|
|
|
- if accType == "api_key" || accType == "access_key"{
|
|
|
+ authBody.AccessId = akeyless.PtrString(accessID)
|
|
|
+ if accType == "api_key" || accType == "access_key" {
|
|
|
authBody.AccessKey = akeyless.PtrString(accTypeParam)
|
|
|
-
|
|
|
} else if accType == "k8s" {
|
|
|
jwtString, err := readK8SServiceAccountJWT()
|
|
|
if err != nil {
|
|
|
- return "", fmt.Errorf("failed to read JWT with Kubernetes Auth from %v. error: %v", DefServiceAccountFile, err.Error())
|
|
|
+ return "", fmt.Errorf("failed to read JWT with Kubernetes Auth from %v. error: %w", DefServiceAccountFile, err)
|
|
|
}
|
|
|
K8SAuthConfigName := accTypeParam
|
|
|
authBody.AccessType = akeyless.PtrString(accType)
|
|
|
authBody.K8sServiceAccountToken = akeyless.PtrString(jwtString)
|
|
|
authBody.K8sAuthConfigName = akeyless.PtrString(K8SAuthConfigName)
|
|
|
-
|
|
|
} else {
|
|
|
- cloudId, err := a.getCloudId(accType, accTypeParam)
|
|
|
+ cloudID, err := a.getCloudID(accType, accTypeParam)
|
|
|
if err != nil {
|
|
|
return "", fmt.Errorf("Require Cloud ID " + err.Error())
|
|
|
}
|
|
|
authBody.AccessType = akeyless.PtrString(accType)
|
|
|
- authBody.CloudId = akeyless.PtrString(cloudId)
|
|
|
+ authBody.CloudId = akeyless.PtrString(cloudID)
|
|
|
}
|
|
|
|
|
|
- authOut, _, err := a.RestApi.Auth(ctx).Body(*authBody).Execute()
|
|
|
+ authOut, _, err := a.RestAPI.Auth(ctx).Body(*authBody).Execute()
|
|
|
if err != nil {
|
|
|
if errors.As(err, &apiErr) {
|
|
|
return "", fmt.Errorf("authentication failed: %v", string(apiErr.Body()))
|
|
|
}
|
|
|
- return "", fmt.Errorf("authentication failed: %v", err)
|
|
|
+ return "", fmt.Errorf("authentication failed: %w", err)
|
|
|
}
|
|
|
|
|
|
token := authOut.GetToken()
|
|
|
return token, nil
|
|
|
}
|
|
|
|
|
|
-func (a *AkeylessBase) GetSecretByType(secretName, token string, version int32) (string, error) {
|
|
|
-
|
|
|
+func (a *akeylessBase) GetSecretByType(secretName, token string, version int32) (string, error) {
|
|
|
item, err := a.DescribeItem(secretName, token)
|
|
|
if err != nil {
|
|
|
return "", err
|
|
|
@@ -89,11 +85,11 @@ func (a *AkeylessBase) GetSecretByType(secretName, token string, version int32)
|
|
|
case "ROTATED_SECRET":
|
|
|
return a.GetRotatedSecrets(secretName, token, version)
|
|
|
default:
|
|
|
- return "", fmt.Errorf("Invalid item type: %v", secretType)
|
|
|
+ return "", fmt.Errorf("invalid item type: %v", secretType)
|
|
|
}
|
|
|
}
|
|
|
|
|
|
-func (a *AkeylessBase) DescribeItem(itemName, token string) (*akeyless.Item, error) {
|
|
|
+func (a *akeylessBase) DescribeItem(itemName, token string) (*akeyless.Item, error) {
|
|
|
ctx := context.Background()
|
|
|
|
|
|
body := akeyless.DescribeItem{
|
|
|
@@ -104,18 +100,18 @@ func (a *AkeylessBase) DescribeItem(itemName, token string) (*akeyless.Item, err
|
|
|
} else {
|
|
|
body.Token = &token
|
|
|
}
|
|
|
- gsvOut, _, err := a.RestApi.DescribeItem(ctx).Body(body).Execute()
|
|
|
+ gsvOut, _, err := a.RestAPI.DescribeItem(ctx).Body(body).Execute()
|
|
|
if err != nil {
|
|
|
if errors.As(err, &apiErr) {
|
|
|
return nil, fmt.Errorf("can't describe item: %v", string(apiErr.Body()))
|
|
|
}
|
|
|
- return nil, fmt.Errorf("can't describe item: %v", err)
|
|
|
+ return nil, fmt.Errorf("can't describe item: %w", err)
|
|
|
}
|
|
|
|
|
|
return &gsvOut, nil
|
|
|
}
|
|
|
|
|
|
-func (a *AkeylessBase) GetRotatedSecrets(secretName, token string, version int32) (string, error) {
|
|
|
+func (a *akeylessBase) GetRotatedSecrets(secretName, token string, version int32) (string, error) {
|
|
|
ctx := context.Background()
|
|
|
|
|
|
body := akeyless.GetRotatedSecretValue{
|
|
|
@@ -128,41 +124,40 @@ func (a *AkeylessBase) GetRotatedSecrets(secretName, token string, version int32
|
|
|
body.Token = &token
|
|
|
}
|
|
|
|
|
|
- gsvOut, _, err := a.RestApi.GetRotatedSecretValue(ctx).Body(body).Execute()
|
|
|
+ gsvOut, _, err := a.RestAPI.GetRotatedSecretValue(ctx).Body(body).Execute()
|
|
|
if err != nil {
|
|
|
if errors.As(err, &apiErr) {
|
|
|
return "", fmt.Errorf("can't get rotated secret value: %v", string(apiErr.Body()))
|
|
|
}
|
|
|
- return "", fmt.Errorf("can't get rotated secret value: %v", err)
|
|
|
+ return "", fmt.Errorf("can't get rotated secret value: %w", err)
|
|
|
}
|
|
|
|
|
|
val, ok := gsvOut["value"]
|
|
|
if ok {
|
|
|
if _, ok := val["payload"]; ok {
|
|
|
return fmt.Sprintf("%v", val["payload"]), nil
|
|
|
-
|
|
|
} else if _, ok := val["target_value"]; ok {
|
|
|
out, err := json.Marshal(val["target_value"])
|
|
|
if err != nil {
|
|
|
- return "", fmt.Errorf("can't marshal rotated secret value: %v", err)
|
|
|
+ return "", fmt.Errorf("can't marshal rotated secret value: %w", err)
|
|
|
}
|
|
|
return string(out), nil
|
|
|
} else {
|
|
|
out, err := json.Marshal(val)
|
|
|
if err != nil {
|
|
|
- return "", fmt.Errorf("can't marshal rotated secret value: %v", err)
|
|
|
+ return "", fmt.Errorf("can't marshal rotated secret value: %w", err)
|
|
|
}
|
|
|
return string(out), nil
|
|
|
}
|
|
|
}
|
|
|
out, err := json.Marshal(gsvOut)
|
|
|
if err != nil {
|
|
|
- return "", fmt.Errorf("can't marshal rotated secret value: %v", err)
|
|
|
+ return "", fmt.Errorf("can't marshal rotated secret value: %w", err)
|
|
|
}
|
|
|
return string(out), nil
|
|
|
}
|
|
|
|
|
|
-func (a *AkeylessBase) GetDynamicSecrets(secretName, token string) (string, error) {
|
|
|
+func (a *akeylessBase) GetDynamicSecrets(secretName, token string) (string, error) {
|
|
|
ctx := context.Background()
|
|
|
|
|
|
body := akeyless.GetDynamicSecretValue{
|
|
|
@@ -174,36 +169,23 @@ func (a *AkeylessBase) GetDynamicSecrets(secretName, token string) (string, erro
|
|
|
body.Token = &token
|
|
|
}
|
|
|
|
|
|
- gsvOut, _, err := a.RestApi.GetDynamicSecretValue(ctx).Body(body).Execute()
|
|
|
+ gsvOut, _, err := a.RestAPI.GetDynamicSecretValue(ctx).Body(body).Execute()
|
|
|
if err != nil {
|
|
|
if errors.As(err, &apiErr) {
|
|
|
return "", fmt.Errorf("can't get dynamic secret value: %v", string(apiErr.Body()))
|
|
|
}
|
|
|
- return "", fmt.Errorf("can't get dynamic secret value: %v", err)
|
|
|
+ return "", fmt.Errorf("can't get dynamic secret value: %w", err)
|
|
|
}
|
|
|
|
|
|
out, err := json.Marshal(gsvOut)
|
|
|
if err != nil {
|
|
|
- return "", fmt.Errorf("can't marshal dynamic secret value: %v", err)
|
|
|
+ return "", fmt.Errorf("can't marshal dynamic secret value: %w", err)
|
|
|
}
|
|
|
|
|
|
return string(out), nil
|
|
|
}
|
|
|
|
|
|
-func (a *AkeylessBase) getSecretVersionByType(secretType, secretName, token string, version int32) (string, error) {
|
|
|
- switch secretType {
|
|
|
- case "STATIC_SECRET":
|
|
|
- return a.GetStaticSecret(secretName, token, version)
|
|
|
- case "DYNAMIC_SECRET":
|
|
|
- return a.GetDynamicSecrets(secretName, token)
|
|
|
- case "ROTATED_SECRET":
|
|
|
- return a.GetRotatedSecrets(secretName, token, version)
|
|
|
- default:
|
|
|
- return "", fmt.Errorf("Invalid item type: %v", secretType)
|
|
|
- }
|
|
|
-}
|
|
|
-
|
|
|
-func (a *AkeylessBase) GetStaticSecret(secretName, token string, version int32) (string, error) {
|
|
|
+func (a *akeylessBase) GetStaticSecret(secretName, token string, version int32) (string, error) {
|
|
|
ctx := context.Background()
|
|
|
|
|
|
gsvBody := akeyless.GetSecretValue{
|
|
|
@@ -217,36 +199,36 @@ func (a *AkeylessBase) GetStaticSecret(secretName, token string, version int32)
|
|
|
gsvBody.Token = &token
|
|
|
}
|
|
|
|
|
|
- gsvOut, _, err := a.RestApi.GetSecretValue(ctx).Body(gsvBody).Execute()
|
|
|
+ gsvOut, _, err := a.RestAPI.GetSecretValue(ctx).Body(gsvBody).Execute()
|
|
|
if err != nil {
|
|
|
if errors.As(err, &apiErr) {
|
|
|
return "", fmt.Errorf("can't get secret value: %v", string(apiErr.Body()))
|
|
|
}
|
|
|
- return "", fmt.Errorf("can't get secret value: %v", err)
|
|
|
+ return "", fmt.Errorf("can't get secret value: %w", err)
|
|
|
}
|
|
|
val, ok := gsvOut[secretName]
|
|
|
if !ok {
|
|
|
- return "", fmt.Errorf("can't get secret: %v",secretName )
|
|
|
+ return "", fmt.Errorf("can't get secret: %v", secretName)
|
|
|
}
|
|
|
|
|
|
return val, nil
|
|
|
}
|
|
|
|
|
|
-func (a *AkeylessBase) getCloudId(provider string, accTypeParam string) (string, error) {
|
|
|
- var cloudId string
|
|
|
+func (a *akeylessBase) getCloudID(provider, accTypeParam string) (string, error) {
|
|
|
+ var cloudID string
|
|
|
var err error
|
|
|
|
|
|
switch provider {
|
|
|
case "azure_ad":
|
|
|
- cloudId, err = azure_cloud_id.GetCloudId(accTypeParam)
|
|
|
+ cloudID, err = azure_cloud_id.GetCloudId(accTypeParam)
|
|
|
case "aws_iam":
|
|
|
- cloudId, err = aws_cloud_id.GetCloudId()
|
|
|
+ cloudID, err = aws_cloud_id.GetCloudId()
|
|
|
case "gcp":
|
|
|
- cloudId, err = gcp_cloud_id.GetCloudID(accTypeParam)
|
|
|
+ cloudID, err = gcp_cloud_id.GetCloudID(accTypeParam)
|
|
|
default:
|
|
|
- return "", fmt.Errorf("Unable to determine provider: %s", provider)
|
|
|
+ return "", fmt.Errorf("unable to determine provider: %s", provider)
|
|
|
}
|
|
|
- return cloudId, err
|
|
|
+ return cloudID, err
|
|
|
}
|
|
|
|
|
|
// readK8SServiceAccountJWT reads the JWT data for the Agent to submit to Akeyless Gateway.
|
renanaAkeyless