update vault integration

internal/secrets_storage/commands.go

@@ -0,0 +1,129 @@
+package secrets_storage
+
+import (
+	"fmt"
+	"kube-forge/internal/config"
+	"kube-forge/internal/kubernetes_client"
+	"kube-forge/internal/templates"
+	"regexp"
+	"strings"
+)
+
+func InitVault() {
+	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
+	if err != nil {
+		fmt.Println(err.Error())
+		return
+	}
+	err = commandToInitVault()
+	if err != nil {
+		fmt.Println(err.Error())
+		return
+	}
+	fmt.Println("Vault initialized")
+	templates.ApplyVaultInitKeysTemplate()
+}
+
+func AddKubernetesLocalIntegration() {
+	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
+	if err != nil {
+		fmt.Println(err.Error())
+		return
+	}
+	err = commandToAddKubernetesLocalIntegration()
+	if err != nil {
+		fmt.Println(err.Error())
+		return
+	}
+	fmt.Println("Vault local Kubernetes integration added")
+}
+
+func UnsealVault() {
+	_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
+	if err != nil {
+		fmt.Println(err.Error())
+		return
+	}
+	commandToUnsealVault()
+}
+
+func commandToInitVault() error {
+	config := config.GetConfig()
+	commandArray := []string{
+		"vault", "operator", "init",
+		fmt.Sprintf("-key-shares=%d", config.Modules.SecretsStorage.KeyShares),
+		fmt.Sprintf("-key-threshold=%d", config.Modules.SecretsStorage.KeyThreshold),
+	}
+	output, err := kubernetes_client.ExecuteCommandInPodContainer(
+		commandArray, "secrets-storage", "vault-0", "vault",
+	)
+	if err != nil && strings.Contains(output, "Vault is already initialized") {
+		return VaultAlreadyInitialised
+	}
+
+	unsealKeys, rootToken := parseVaultInitKeys(output)
+	config.Modules.SecretsStorage.UnsealKeys = unsealKeys
+	config.Modules.SecretsStorage.AuthToken = rootToken
+	return nil
+}
+
+func parseVaultInitKeys(input string) ([]string, string) {
+	unsealKeyPattern := regexp.MustCompile(`Unseal Key \d+: (\S+)`)
+	rootTokenPattern := regexp.MustCompile(`Initial Root Token: (\S+)`)
+
+	unsealKeysMatches := unsealKeyPattern.FindAllStringSubmatch(input, -1)
+	var unsealKeys []string
+	for _, match := range unsealKeysMatches {
+		unsealKeys = append(unsealKeys, match[1])
+	}
+
+	rootTokenMatches := rootTokenPattern.FindStringSubmatch(input)
+	rootToken := rootTokenMatches[1]
+
+	return unsealKeys, rootToken
+}
+
+func commandToUnsealVault() {
+	config := config.GetConfig()
+
+	for _, unsealKey := range config.Modules.SecretsStorage.UnsealKeys {
+		commandArray := []string{"vault", "operator", "unseal", unsealKey}
+		kubernetes_client.ExecuteCommandInPodContainer(
+			commandArray, "secrets-storage", "vault-0", "vault",
+		)
+	}
+	fmt.Println("Vault unsealed")
+}
+
+func commandToAddKubernetesLocalIntegration() error {
+	config := config.GetConfig()
+
+	commandArray := []string{"vault", "login", config.Modules.SecretsStorage.AuthToken}
+	output, err := kubernetes_client.ExecuteCommandInPodContainer(
+		commandArray, "secrets-storage", "vault-0", "vault",
+	)
+	if err != nil && strings.Contains(output, "permission denied") {
+		return IncorrectCredentials
+	}
+	commandArray = []string{"vault", "auth", "enable", "-local", "-path=kubernetes-local", "kubernetes"}
+	output, err = kubernetes_client.ExecuteCommandInPodContainer(
+		commandArray, "secrets-storage", "vault-0", "vault",
+	)
+	kubernetesInternalServiceAddr, err := kubernetes_client.GetEnvVariableFromPodContainer(
+		"KUBERNETES_PORT_443_TCP_ADDR",
+		"secrets-storage",
+		"vault-0",
+		"vault",
+	)
+	if err != nil {
+		return err
+	}
+	commandArray = []string{
+		"vault", "write", "auth/kubernetes-local/config",
+		fmt.Sprintf("kubernetes_host=https://%s:443", kubernetesInternalServiceAddr),
+	}
+	output, err = kubernetes_client.ExecuteCommandInPodContainer(
+		commandArray, "secrets-storage", "vault-0", "vault",
+	)
+	return nil
+}

internal/secrets_storage/errors.go

@@ -0,0 +1,6 @@
+package secrets_storage
+
+import "errors"
+
+var VaultAlreadyInitialised = errors.New("Vault already initialised")
+var IncorrectCredentials = errors.New("Incorrect Vault auth token credentials!!")