File manager - Edit - /opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/__pycache__/vault.cpython-310.pyc
Back
o ;jnX � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlZ ddl Z ddl Z ddl Z e� e�Zdadd� Zdd� Zdd� Zd d � Zd d � Zd d� Zdd� Z d!dd�Zdd� Zdd� Zdd� Zd"dd �Z d d � Z d d � Z dS )#z� :maintainer: SaltStack :maturity: new :platform: all Utilities supporting modules for Hashicorp Vault. Configuration instructions are documented in the execution module docs. � Nc C sf zt stj�t�a t�d��tj� W dS W dS t y2 } zt j d| dd� W Y d } ~ dS d } ~ ww )N�requestsTzCould not load __salt__: %s)�exc_infoF) �__salt__�salt�loaderZ minion_mods�__opts__�logging� getLogger�setLevel�WARNING� Exception�log�error)�e� r �D/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/vault.py� __virtual__ s ����r c C s� t d } td }z t�di ��di ��dd�}t�di ��di ��dd�}W n ttfy5 d}d}Y nw t�dd �d kra|� d �}t�d |� t�t j � || ��}t d d | |d||gd�}n"|� d�}t�d| |� t�t j � || ��}t d d | |d||d�}|s�t� d� t j�|��t|t�s�t� d|� t j�|��d|v r�t� d|d � t j�|��d|�dd�v r�t�d� i td < |d |d |�d d�|�d �|�dd!�|d" |d# d$�S )%z` Get a token with correct policies for the minion, and the url to the Vault service �id�pki_dir�vault�auth�usesN�ttl�__role�minionz /minion.pemz4Running on minion, signing token request with key %szpublish.runnerzvault.generate_tokenF)�argz /master.pemz;Running on master, signing token request for %s with key %szsaltutil.runnerT)� minion_id� signatureZimpersonated_by_masterr r z`Failed to get token from master! No result returned - is the peer publish configuration correct?z;Failed to get token from master! Response is not a dict: %sr z:Failed to get token from master! An error was returned: %s�sessionZ token_backendz+Using session storage for vault credentials�vault_secret_path_metadata�url�token�verify� namespace� �lease_duration�issued)r r! r" r# r r% r& )� __grains__r �get� TypeError�AttributeErrorr �debug�base64� b64encoder ZcryptZ sign_messager r � exceptions�CommandExecutionError� isinstance�dict� __context__)r r r r Z private_keyr �resultr r r � _get_token_and_url_from_master, sp � � ��� � �r4 c C s� dd� } dt v r*t d �d�}|r*|dvr t�d� dS |dkr#| � S |d kr*t� S dt v rEt �d d �d krEd tv rBt�d � t� S | � S tt �dd�t �dd�dkt �dd�dkf�r_| � S t�d � t� S )z Get the connection details for calling Vault, from local configuration if it exists, or from the master otherwise c S s t �d� td �d�} z�td d d dkr�td �dd �}t� r�t �d� d �td d �}d td d d i}d td d v rLtd d d |d < | d ur_d | i}tj||||dd�}n tj|||dd�}|jdkrud}t j � |��|� � d d td d d< td d d dkr�td �dd �}t � r�d�td d �}dtd d d i}| d ur�| |d < tj|||dd�}|jdkr�d}t j � |��|� � d d td d d< td d | td d d td �dd �ttt�� ��dd�W S t�y } z d �|�}t j � |��d }~ww ) Nz0Using Vault connection details from local configr r# r �methodZapproler" z#Vault token expired. Recreating onez{}/v1/auth/approle/loginr Zrole_idZ secret_id�X-Vault-Namespace�x )�headers�jsonr" �timeout)r9 r" r: �� z4An error occurred while getting a token from approleZ client_tokenr! Z wrapped_tokenz{}/v1/sys/wrapping/unwrap� X-Vault-Token�r8 r" r: z-An error occured while unwrapping vault tokeni )r r# r! r" r& r zEMinion has "vault" config section, but could not find key "{}" within)r r+ r r( �_selftoken_expired�formatr �post� status_coder r. r/ r9 �_wrapped_token_valid�int�round�time�KeyError)r# r" r �payloadr8 �response�errmsg�errr r r �_use_local_configz sv �� �� � �� ��z/get_vault_connection.<locals>._use_local_configr Zconfig_location)�local�masterz.config_location must be either local or masterFrL rM r r r z.Contacting master for Vault connection detailsNZ file_clientZ master_type�disable)r r( r r r4 r' r+ �any)rK Zconfigr r r �get_vault_connectiont s2 ? �� rP c C s\ t �d� dtv r td= t �d� tj�td d�} tj�| �r't�| � dS t �d� dS )z Delete cache zDeleting session cache� vault_tokenzDeleting cache file�cachedir�salt_vault_tokenz<Attempted to delete vault cache file, but it does not exist.N) r r+ r2 �os�path�joinr �exists�remove)� cache_filer r r � del_cache� s rZ c C sB | � dd�dkrd| vrd| vrt�d� | td< dS dtv r.d| vr.t�d � | td< dS dtv r4dS tjtd d �\}}tj� td d �}zGt�d � | � d�dkrYd| d< nd| d< t j j j |ddd��}|�t j j�| �� W d � n1 s|w Y t�|� t�||� W dS ty� tjdtjd� Y dS w )z( Write the vault token to cache r Nr$ �unlimited_use_tokenr z"Not caching vault single use tokenrQ Tz#Storing token only for this sessionrR )�dirrS zWriting vault cache filer F�wi� )�modez!Failed to cache vault information)Zexc_info_on_loglevel)r( r r+ r2 �tempfileZmkstempr rT rU rV r �utils�filesZfpopen�writer9 �dumps�close�rename�OSErrorr r �DEBUG)� connectionZtemp_fpZ temp_filerY Zfp_r r r � write_cache� s@ � ��ri c C sp z,t j�td d�} tjj�| d��}tjj� |�W d � W S 1 s%w Y W dS t y7 i Y S w )z' Return contents of cache file rR rS �rN) rT rU rV r r r` ra Zfopenr9 �load�FileNotFoundError)rY �contentsr r r �_read_cache_file s (� �rn c C s� dd� } t � }|r d|vr| � S d|v r|d }n|d }|d | d }ttt�� ��}||k r>t�d||� t� | � S t�d ||� |S ) z= Return connection information from vault cache file c S s t �d� t� } t| �}| S )NzRefreshing token)r r+ rP ri )rh Z write_statusr r r �_gen_new_connection) s z&get_cache.<locals>._gen_new_connectionr r% r r& � z*Cached token has expired %s < %s: DELETINGz Token has not expired %s > %s)rn rC rD rE r r+ rZ )ro rh r Zttl10Zcur_timer r r � get_cache$ s rq Fc K s� dt v r t d }nt� }|s|d n|}|s|d n|}|p"|�d�}d|vr@z t�d��dd�|d< W n ttfy? Y nw d|vrHd |d< |� d |� �} t|�d d �} |dur^|| d < tj| | fd| i|��} | j s�| � � �dd�dgkr�t � d� t � |s�t �d� t| |fd||dd�|��} nt �d| j� | S | j s�t �d| j� | S d|v r�|�d�s�|�d�s�t �d|� |d d8 < |d d kr�t �d � dt vr�t � nt �d � t d= n t �d |d � t|� |r�| ||fS | S ) z! Make a request to Vault rQ r! r r# r" r Nr: r7 �/zapplication/json)r< z Content-Typer6 r8 �errorszpermission deniedz Permission denied from vaultz Retrying with new credentialsT)r! � vault_url� get_token_url�retryz%Unable to connect to vault server: %szError from vault: %sr r[ zv1/sysz4Decrementing Vault uses on limited token for url: %sr$ r z#Cached token has no more uses left.zDeleting token from memoryzToken has %s uses left)r2 rq r( r r) r* �strr �request�okr9 r �inforZ r+ � make_requestr �text� startswithri ) r5 Zresourcer! rt r# ru rv �argsrh r r8 rH r r r r{ F s� ���� ��� �� r{ c C s� zIt d �dd�} t d �d�}d�t d d �}dt d d vr$W d S d t d d d i}|dur6||d < tj||| d d �}|jdkrGW d S W dS ty^ } z tj�d|� ���d}~ww )z> Validate the current token exists and is still valid r r" Nr# z {}/v1/auth/token/lookup-selfr r! r Tr< r6 r7 r= r; Fz$Error while looking up self token : ) r r( r? r rA r r r. r/ �r" r# r r8 rH r r r r r> � �& ���r> c C s� zIt d �dd�} t d �d�}d�t d d �}dt d d vr$W d S d t d d d i}|dur6||d < tj||| d d �}|jdkrGW d S W dS ty^ } z tj� d|� ���d}~ww )z> Validate the wrapped token exists and is still valid r r" Nr# z{}/v1/sys/wrapping/lookupr r! r Fr< r6 r7 r= r; Tz'Error while looking up wrapped token : ) r r( r? r r@ rA r r r. r/ r r r r rB � r� rB c C s� d| | | dd�}t | �}|s|S |�dd�|d< |d dkrW|d durW|�di ��dd�d v rWd |d < t| |�d | ��|d < t| |�d | �d�|d< t| |�d | �d�|d< |S )z� Determines if a given secret path is kv version 1 or 2 CLI Example: .. code-block:: bash salt '*' vault.is_v2 "secret/my/secret" FN)�v2�data�metadata�delete�typer� Zkv�options�version�1)�2Tr� rU r� r� �destroy)�_get_secret_path_metadatar( � _v2_the_path)rU �retZ path_metadatar r r �is_v2� s �r� r� c C s� g d�}||v s J �d� | |�}| �d��d�} |�d��d�}|d | }|d |kr0|d n|d }|d | }| �|�rN| �||d�} d� ||| �}n| �|�sed� | | �||d��}| �||d�} t�|� | S )z� Given a path, a filter, and a path type, properly inject 'data' or 'metadata' into the path CLI Example: .. code-block:: python _v2_the_path('dev/secrets/fu/bar', 'dev/secrets', 'data') => 'dev/secrets/data/fu/bar' )r� r� r� zEPath {} already contains {} in the right place - saltstack duct tape?rr r r$ z:Path is a "{}" type but "{}" type requested - Flipping: {}z Converting path to v2 {} => {})r? �rstrip�lstripr} �replacer r+ )rU Zpfilter�ptypeZpossible_types�msgZtogetherZotype�otherr r r r� � s. �� � � r� c sX d}|t v r t | }nt� }||vri ||< d}� �t|| �� ��r:t�d� � t� fdd�|| �� D ��}|S t�d� � zNd� � �}t d|�}|j rR|� � |� � � d d �r�t�d � � |� � d }d |vr~|t v rst | }nt� }||vr~i ||< ||| � < t|� W |S |� � � ty� } zt�d t|�j|� W Y d}~|S d}~ww )z� Given a path, query vault to determine mount point, type, and version CLI Example: .. code-block:: python _get_secret_path_metadata('dev/secrets/fu/bar') r Nz Found cached metadata for %sc 3 s" � | ] \}}� � |�r|V qd S )N)r} )�.0�k�v�rU r r � <genexpr>$ s � z,_get_secret_path_metadata.<locals>.<genexpr>zFetching metadata for %szv1/sys/internal/ui/mounts/ZGETr� FzGot metadata for %sr z$Failed to get secret metadata %s: %s)r2 rn r} �tuple�keysr r+ �next�itemsr{ ry Zraise_for_statusr9 r( ri r r r� �__name__)rU ZckeyZ cache_contentr� r rH rJ r r� r r� sF � � ��r� c s� g }t �� }|�� �D ]>\}}}}|du rq |�|d|�\}}t|t�rId|� d��� �fdd�|D �}|D ]}t|fi |��} || 7 }q6| S q � gS )a� Expands the pattern for any list-valued mappings, such that for any list of length N in the mappings present in the pattern, N copies of the pattern are returned, each with an element of the list substituted. pattern: A pattern to expand, for example ``by-role/{grains[roles]}`` mappings: A dictionary of variables that can be expanded into the pattern. Example: Given the pattern `` by-role/{grains[roles]}`` and the below grains .. code-block:: yaml grains: roles: - web - database This function will expand into two patterns, ``[by-role/web, by-role/database]``. Note that this method does not expand any non-list patterns. N�{�}c s g | ] }� � �t|���qS r )r� rw )r� �elem��patternr! r r � <listcomp>k s z(expand_pattern_lists.<locals>.<listcomp>)�string� Formatter�parse� get_fieldr0 �list�expand_pattern_lists) r� ZmappingsZexpanded_patterns�f�_� field_name�valueZexpandedZ expanded_itemr3 r r� r r� A s �r� )NNNFF)r� ) �__doc__r, r rT r� r_ rE r Z salt.cryptr Zsalt.exceptionsZsalt.utils.jsonZsalt.utils.versionsr r� r r r r4 rP rZ ri rn rq r{ r> rB r� r� r� r� r r r r �<module> sB Hc0 % �Q ( 4
| ver. 1.4 |
Github
|
.
| PHP 8.2.30 | Generation time: 0 |
proxy
|
phpinfo
|
Settings