File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/runners/__pycache__/vault.cpython-310.pyc
Back
o ;j%8 � @ s� d Z ddlZddlZddlZddlZddlZddlmZ ddlZddl Z ddl Z ddl Z ddl Z ddlmZ ddl mZ e�e�Z d dd�Zd d � Zedfd d �Zd d� Z d dd�Zd dd�Zd dd�Zdd� Zdd� Z G dd� de�Z dS ) z� Runner functions supporting the Vault modules. Configuration instructions are documented in the execution module docs. :maintainer: SaltStack :maturity: new :platform: all � N)�Mapping)�NOT_SET)�SaltRunnerErrorFc C s� t �d| |� t| ||� �z,t�di �}|�dd�}|�d�}|d �dd�}|r.|du r6|d �d d �}|r<|du rD|d �d d�}|d �d d �} |�dd�} |�dd�} |d d dkr�t� r�t �d� d�|d �} d|d d i} d|d v r�|d d | d< d}|dur�d|i}tj| || |dd�}|j dkr�d |j iW S |� � d d |d d < t |�} d |d d i}|dur�||d< t � �d d!�| t � �d"d#�d$�}t| || | d%�||d&�} |dur�t|�| d'< | d( g kr�d d)iW S t �d*� tj| || |dd�}|j dk�rd |j iW S |� � d }|d |d+ |d, ttt�� ��|d || |d-�}|d.k�r8||d < |W S t�yS } z d t|�iW Y d}~S d}~ww )/aF Generate a Vault token for minion minion_id minion_id The id of the minion that requests a token signature Cryptographic signature which validates that the request is indeed sent by the minion (or the master, see impersonated_by_master). impersonated_by_master If the master needs to create a token on behalf of the minion, this is True. This happens when the master generates minion pillars. ttl Ticket time to live in seconds, 1m minutes, or 2h hrs uses Number of times a token can be used z<Token generation request for %s (impersonated by master: %s)�vault�verifyN� namespace�auth�allow_minion_overrideF�uses� �ttl� token_backend�session�policies_refresh_pillar�policies_cache_time�< �methodZapprolez#Vault token expired. Recreating onez{}/v1/auth/approle/login�urlZrole_idZ secret_id�X-Vault-Namespace�x )�headers�jsonr �timeout�� �errorZ client_token�token� X-Vault-TokenZ__jid__z <no jid set>Z__user__z <no user set>)z saltstack-jidzsaltstack-minionzsaltstack-user��refresh_pillar�expire)�policiesZnum_uses�metaZexplicit_max_ttlr zNo policies matched minionz'Sending token creation request to Vault�lease_duration� renewable)r r" r# Zissuedr r r r r )�log�debug�_validate_signature�__opts__�get�_selftoken_expired�format�requestsZpost� status_code�reasonr �_get_token_create_url�globals�_get_policies_cached�str�trace�int�round�time� Exception)� minion_id� signature�impersonated_by_masterr r �configr r r Z storage_typer r r �payloadr �responseZ audit_dataZ auth_data�ret�e� r? �F/opt/saltstack/salt/lib/python3.10/site-packages/salt/runners/vault.py�generate_token s� � � ��� � � ��rA c C sH t d d D ]} td ddt�d| i�d��� }|d d u r! d S qd S ) aj Unseal Vault server This function uses the 'keys' from the 'vault' configuration to unseal vault server vault: keys: - n63/TbrQuL3xaIW7ZZpuXj/tIfnK1/MbVxO4vT3wYD2A - S9OwCvMRhErEA4NVVELYBs6w/Me6+urgUr24xGK44Uy3 - F1j4b7JKq850NS6Kboiy5laJ0xY8dWJvB3fcwA+SraYl - 1cYtvjKJNDVam9c7HNqJUfINk4PYyAXIpjkpN/sIuzPv - 3pPK5X6vGtwLhNOFv1U2elahECz3HpRUfNXJFYLw6lid .. note: This function will send unsealed keys until the api returns back that the vault has been unsealed CLI Examples: .. code-block:: bash salt-run vault.unseal r �keyszvault.make_request�PUTz v1/sys/unseal�key)�dataZsealedFT)r' � __utils__r �dumps)rD r= r? r? r@ �unseal� s �� �rH c C sF t �di �}|tkr|�d�}|dur|n|�dd�}t| |||d�S )aB Show the Vault policies that are applied to tokens for the given minion. minion_id The minion's id. refresh_pillar Whether to refresh the pillar data when rendering templated policies. None will only refresh when the cached data is unavailable, boolean values force one behavior always. Defaults to config value ``policies_refresh_pillar`` or None. expire Policy computation can be heavy in case pillar data is used in templated policies and it has not been cached. Therefore, a short-lived cache specifically for rendered policies is used. This specifies the expiration timeout in seconds. Defaults to config value ``policies_cache_time`` or 60. CLI Example: .. code-block:: bash salt-run vault.show_policies myminion r r Nr r r )r' r( r r0 )r7 r r r: r? r? r@ � show_policies� s �rI c C sl t d }|r |� d�}n|� d| � �}t�d| � t�|�}tj�|| |�s/tj� d| � ���t�d� dS )z^ Validate that either minion with id minion_id, or the master, signed the request �pki_dirz /master.pubz /minions/zValidating signature for %sz&Could not validate token request from z Signature okN) r' r$ r2 �base64� b64decode�saltZcryptZverify_signature� exceptionsZAuthenticationError)r7 r8 r9 rJ Z public_keyr? r? r@ r& � s �r& c K s� t | |�\}}|�dddg�}| ||d�}g }|D ].} z td | fi |��D ]} |�| jd i |���� � q&W q tyG t�d| | � Y qw t� d| |� |S ) zJ Get the policies that should be applied to a token for minion_id r zsaltstack/minion/{minion}zsaltstack/minions)Zminion�grains�pillarzvault.expand_pattern_listsz1Could not resolve policy pattern %s for minion %sz%s policies: %sNr? ) �_get_minion_datar( rF �appendr* �lower�KeyErrorr$ �warningr% ) r7 r: r �kwargsrO rP Zpolicy_patternsZmappingsr �patternZexpanded_patternr? r? r@ � _get_policies� s0 � � ��� ��rX r c C s� |s t | ||d�S d| � d�}d}tj�t�}|j||t || ||d�}t|t�s?t�d� |� ||� |j||t || ||d�}|S )N)r zminions/z/vaultr )r r7 r: r z<Cached vault policies were not formed as a list. Refreshing.) rX rM �cache�factoryr' � isinstance�listr$ rU �flush)r7 r: r r ZcbankZckeyrY r r? r? r@ r0 s6 � � r0 c C s� t jj�| t�\}}}|d u rd| i}|du s |d u rB|d u rBt�d�r(td��t�t�}ddi}|� |� t ||| |d�}||fS |d u rHi }||fS )N�idTZ+_vault_runner_is_compiling_pillar_templatesa/ Cyclic dependency detected while refreshing pillar for vault policy templating. This is caused by some pillar value relying on the vault execution module. Either remove the dependency from your pillar, disable refreshing pillar data for policy templating or do not use pillar values in policy templates.��extra_minion_data) rM �utilsZminionsZget_minion_datar' r( r �copy�deepcopy�update� LazyPillar)r7 r �_rO rP Z local_optsr` r? r? r@ rQ & s$ � ��rQ c C s� zIt d �dd�} t d �d�}d�t d d �}dt d d vr$W d S d t d d d i}|dur6||d < tj||| d d �}|jdkrGW d S W dS ty` } z tj�dt |�� ���d}~ww )z> Validate the current token exists and is still valid r r Nr z {}/v1/auth/token/lookup-selfr r r Tr r r )r r r r Fz$Error while looking up self token : ) r' r( r* r+ r, r6 rM rN ZCommandExecutionErrorr1 )r r r r r< r> r? r? r@ r) P s& ���r) c C s2 | � dd�}d}| d }d�dd� |||fD ��S )z- Create Vault url for token creation � role_nameNz/v1/auth/token/creater �/c s s � | ] }|r|� d �V qdS )rh N)�strip)�.0�xr? r? r@ � <genexpr>p s � z(_get_token_create_url.<locals>.<genexpr>)r( �join)r: rg Z auth_pathZbase_urlr? r? r@ r. i s r. c @ s: e Zd ZdZd dd�Zdd� Zdd� Zd d � Zd d � ZdS )re z` Simulates a pillar dictionary. Only compiles the pillar once an item is requested. Nc C s& || _ || _|| _|p i | _d | _d S �N)�optsrO r7 r` �_pillar)�selfro rO r7 r` r? r? r@ �__init__y s zLazyPillar.__init__c C s0 t �d� tjj| j| j| j| jd�� � | _ d S )Nz'Refreshing pillar for vault templating.r_ ) r$ �inforM rP Z get_pillarro rO r7 r` Zcompile_pillarrp �rq r? r? r@ �_load� s ��zLazyPillar._loadc C s | j d u r | �� | j | S rn �rp ru )rq rD r? r? r@ � __getitem__� � zLazyPillar.__getitem__c c s$ � | j d u r | �� | j E d H d S rn rv rt r? r? r@ �__iter__� s � zLazyPillar.__iter__c C s | j d u r | �� t| j �S rn )rp ru �lenrt r? r? r@ �__len__� rx zLazyPillar.__len__rn ) �__name__� __module__� __qualname__�__doc__rr ru rw ry r{ r? r? r? r@ re s s re )FNNrn )Nr ) r rK rb r �loggingr5 �collections.abcr r+ Z salt.cacherM Z salt.cryptZsalt.exceptionsZ salt.pillarZ salt.defaultsr r � getLoggerr| r$ rA rH rI r& rX r0 rQ r) r. re r? r? r? r@ �<module> s6 �u " � *
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings