131 lines
3.6 KiB
Go
131 lines
3.6 KiB
Go
package secrets_storage
|
|
|
|
import (
|
|
"fmt"
|
|
"kube-forge/internal/config"
|
|
"kube-forge/internal/kubernetes_client"
|
|
"kube-forge/internal/logging"
|
|
"kube-forge/internal/templates"
|
|
"regexp"
|
|
"strings"
|
|
)
|
|
|
|
func initVault() {
|
|
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
|
|
if err != nil {
|
|
logging.Log.Error(err.Error())
|
|
return
|
|
}
|
|
err = commandToInitVault()
|
|
if err != nil {
|
|
logging.Log.Warn(err.Error())
|
|
return
|
|
}
|
|
logging.Log.Info("Vault initialized")
|
|
templates.ApplyVaultInitKeysTemplate()
|
|
}
|
|
|
|
func addKubernetesLocalIntegration() {
|
|
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
|
|
if err != nil {
|
|
logging.Log.Error(err.Error())
|
|
return
|
|
}
|
|
err = commandToAddKubernetesLocalIntegration()
|
|
if err != nil {
|
|
logging.Log.Error(err.Error())
|
|
return
|
|
}
|
|
logging.Log.Info("Vault local Kubernetes integration added")
|
|
}
|
|
|
|
func unsealVault() {
|
|
_, err := kubernetes_client.GetPodByName("vault-0", "secrets-storage")
|
|
if err != nil {
|
|
logging.Log.Error(err.Error())
|
|
return
|
|
}
|
|
commandToUnsealVault()
|
|
}
|
|
|
|
func commandToInitVault() error {
|
|
config := config.GetConfig()
|
|
commandArray := []string{
|
|
"vault", "operator", "init",
|
|
fmt.Sprintf("-key-shares=%d", config.Modules.SecretsStorage.KeyShares),
|
|
fmt.Sprintf("-key-threshold=%d", config.Modules.SecretsStorage.KeyThreshold),
|
|
}
|
|
output, err := kubernetes_client.ExecuteCommandInPodContainer(
|
|
commandArray, "secrets-storage", "vault-0", "vault",
|
|
)
|
|
if err != nil && strings.Contains(output, "Vault is already initialized") {
|
|
return VaultAlreadyInitialised
|
|
}
|
|
|
|
unsealKeys, rootToken := parseVaultInitKeys(output)
|
|
config.Modules.SecretsStorage.UnsealKeys = unsealKeys
|
|
config.Modules.SecretsStorage.AuthToken = rootToken
|
|
return nil
|
|
}
|
|
|
|
func parseVaultInitKeys(input string) ([]string, string) {
|
|
unsealKeyPattern := regexp.MustCompile(`Unseal Key \d+: (\S+)`)
|
|
rootTokenPattern := regexp.MustCompile(`Initial Root Token: (\S+)`)
|
|
|
|
unsealKeysMatches := unsealKeyPattern.FindAllStringSubmatch(input, -1)
|
|
var unsealKeys []string
|
|
for _, match := range unsealKeysMatches {
|
|
unsealKeys = append(unsealKeys, match[1])
|
|
}
|
|
|
|
rootTokenMatches := rootTokenPattern.FindStringSubmatch(input)
|
|
rootToken := rootTokenMatches[1]
|
|
|
|
return unsealKeys, rootToken
|
|
}
|
|
|
|
func commandToUnsealVault() {
|
|
config := config.GetConfig()
|
|
|
|
for _, unsealKey := range config.Modules.SecretsStorage.UnsealKeys {
|
|
commandArray := []string{"vault", "operator", "unseal", unsealKey}
|
|
kubernetes_client.ExecuteCommandInPodContainer(
|
|
commandArray, "secrets-storage", "vault-0", "vault",
|
|
)
|
|
}
|
|
logging.Log.Info("Vault unsealed")
|
|
}
|
|
|
|
func commandToAddKubernetesLocalIntegration() error {
|
|
config := config.GetConfig()
|
|
|
|
commandArray := []string{"vault", "login", config.Modules.SecretsStorage.AuthToken}
|
|
output, err := kubernetes_client.ExecuteCommandInPodContainer(
|
|
commandArray, "secrets-storage", "vault-0", "vault",
|
|
)
|
|
if err != nil && strings.Contains(output, "permission denied") {
|
|
return IncorrectCredentials
|
|
}
|
|
commandArray = []string{"vault", "auth", "enable", "-local", "-path=kubernetes-local", "kubernetes"}
|
|
output, err = kubernetes_client.ExecuteCommandInPodContainer(
|
|
commandArray, "secrets-storage", "vault-0", "vault",
|
|
)
|
|
kubernetesInternalServiceAddr, err := kubernetes_client.GetEnvVariableFromPodContainer(
|
|
"KUBERNETES_PORT_443_TCP_ADDR",
|
|
"secrets-storage",
|
|
"vault-0",
|
|
"vault",
|
|
)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
commandArray = []string{
|
|
"vault", "write", "auth/kubernetes-local/config",
|
|
fmt.Sprintf("kubernetes_host=https://%s:443", kubernetesInternalServiceAddr),
|
|
}
|
|
output, err = kubernetes_client.ExecuteCommandInPodContainer(
|
|
commandArray, "secrets-storage", "vault-0", "vault",
|
|
)
|
|
return nil
|
|
}
|