Page MenuHomeDevCentral
Differential D2686

Fetch credentials from Vault
ClosedPublic
Actions

Authored by dereckson on May 12 2022, 22:16.
Tags
None
Referenced Files
Unknown Object (File)
Thu, Nov 14, 11:42
Unknown Object (File)
Thu, Nov 14, 06:18
Unknown Object (File)
Thu, Nov 14, 04:08
Unknown Object (File)
Tue, Nov 12, 20:41
Unknown Object (File)
Tue, Nov 12, 18:59
Unknown Object (File)
Mon, Nov 11, 23:18
Unknown Object (File)
Mon, Nov 11, 06:48
Unknown Object (File)
Sun, Nov 10, 15:29
View All Files
Subscribers
None

Details

Reviewers
dereckson
Maniphest Tasks
T1733: Store credentials in Vault
Commits
rVIPER1c6f3be2ef97: Fetch credentials from Vault
Summary

Connect to Vault. Allow to fetch a credential and login again if the token
is expired, as the current duration lease is 4 hours.

vendor/vault.tcl is a work-in-progress Vault client implementation in TCL,
to be integrated in a future tcllib revision. Once released, that file will
be removed from the repository to use directly the tcllib one.

Allow nickserv, MySQL and RabbitMQ to consume secrets. The first two are
handled by configuration, the RabbitMQ one by this change.

Ref T1733.

Test Plan

Tested live on Daeghrefn and with a full restart on Wearg.

Diff Detail

Repository
rVIPER ViperServ scripts
Lint
No Lint Coverage
Unit
No Test Coverage
Branch
vault
Build Status
Buildable 4266
Build 4530: arc lint + arc unit

Event Timeline

dereckson requested review of this revision.May 12 2022, 22:16
dereckson created this revision.
Harbormaster completed remote builds in B4232: Diff 6803.May 12 2022, 22:16
dereckson edited the summary of this revision. (Show Details)May 12 2022, 22:22
dereckson added a task: T1733: Store credentials in Vault.
dereckson updated this revision to Diff 6804.May 12 2022, 22:49

+sqlrehash

Harbormaster completed remote builds in B4233: Diff 6804.May 12 2022, 22:49
dereckson planned changes to this revision.May 21 2022, 19:57

By coherence with TCL commands and our own commands (e.g. registry), I'd suggest to add a procedure vault to dispatch vault subcommand to vault_get, vault_login, etc. if they exists.

dereckson added inline comments.May 21 2022, 20:03
Vault.tcl
16

That worked at some point, probably when this was the last instruction,
but now it can't be the default return value if it's followed by another line (return $credential).

And indeed:

20:00:58 <Dereckson> .tcl vault_get broker password
20:01:00 <Daeghrefn> Tcl error: can't read "credential": no such variable

20:01:07 <Dereckson> .tcl putdebug
20:01:07 <Daeghrefn> [DEBUG] can't read "credential": no such variable
20:01:07 <Daeghrefn>     while executing
20:01:07 <Daeghrefn> "return $credential"
20:01:07 <Daeghrefn>     (procedure "vault_get" line 10)
20:01:07 <Daeghrefn>     invoked from within
20:01:07 <Daeghrefn> "vault_get broker password"
20:01:07 <Daeghrefn> Tcl:
dereckson added inline comments.May 29 2022, 11:30
vendor/vault.tcl
9

Does that package provides ::json::write?

Tcl error in file '/srv/viperserv/Wearg/eggdrop.conf':
invalid command name "::json::write"
    while executing
"::json::write string $v"
    (procedure "::vault::payload" line 3)
    invoked from within
"::vault::payload $params"
    (procedure "::vault::request" line 9)
    invoked from within
"::vault::request POST /v1/auth/approle/login $params"
    (procedure "::vault::appRoleLogin" line 3)
    invoked from within
"::vault::appRoleLogin $vault(roleID) $vault(secretID)"
    (procedure "vault_login" line 5)
    invoked from within
"vault_login"
    (file "scripts/Vault.tcl" line 22)
    invoked from within
"source scripts/Vault.tcl"
    (file "/srv/viperserv/Wearg/eggdrop.conf" line 58)
dereckson added a comment.May 29 2022, 11:31
% ::json::write
invalid command name "::json::write"

% package require json
1.3.4

% ::json::write
invalid command name "::json::write"
dereckson updated this revision to Diff 6858.May 29 2022, 11:41

Fixes the following issue:

  • invalid command name "::json::write"
  • not declared variable $token
Harbormaster completed remote builds in B4266: Diff 6858.May 29 2022, 11:41
dereckson updated this revision to Diff 6859.May 29 2022, 11:43

+return

Harbormaster completed remote builds in B4267: Diff 6859.May 29 2022, 11:43
dereckson added a comment.May 29 2022, 11:45

Wearg successfully restarted with that change (and D2687):

Broker

11:38:07 < Wearg> dereckson forcely updated tommy (branch snyk-fix-6dc6119f8cb71f072b30e92a6fc487aa) — https://github.com/nasqueron/tommy/compare/snyk-fix-6dc6119f8cb71f072b30e92a6fc487aa

11:39:45 <Dereckson> .tcl mq connected
11:39:46 <Wearg> Tcl: 1

MySQL

11:43:59 <Dereckson> .tcl sql "SELECT 1+1"
11:43:59 <Wearg> Tcl: 2

NickServ

11:37:40 [Libera] -!- account : Wearg

dereckson updated this revision to Diff 6860.May 29 2022, 11:50

Typo in README

Harbormaster completed remote builds in B4268: Diff 6860.May 29 2022, 11:50
dereckson retitled this revision from WIP: Fetch credentials from Vault to Fetch credentials from Vault.May 29 2022, 11:51
dereckson edited the summary of this revision. (Show Details)
dereckson edited the test plan for this revision. (Show Details)
dereckson edited the test plan for this revision. (Show Details)
dereckson accepted this revision.May 29 2022, 11:58
This revision is now accepted and ready to land.May 29 2022, 11:58
Closed by commit rVIPER1c6f3be2ef97: Fetch credentials from Vault (authored by dereckson). · Explain WhyMay 29 2022, 11:59
This revision was automatically updated to reflect the committed changes.
dereckson added a commit: rVIPER1c6f3be2ef97: Fetch credentials from Vault.

Revision Contents
Changeset List

PathSize
9 lines
22 lines
Wearg/
2 lines
vendor/
1 line
113 lines

Diff 6858

View Options

Core.tcl

Loading...
View Options

Vault.tcl

Loading...
View Options

Wearg/Broker.tcl

Loading...
View Options

vendor/README.md

Loading...
View Options

vendor/vault.tcl

Loading...
Nasqueron DevCentral · If it had been much bigger the moon would have had a core of ice. · Powered by Phabricator