File: //opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/__pycache__/vault.cpython-310.pyc
o
�N�g.X � @ s� d Z ddlZddlZddlZddlZddlZddlZddlZddlZ ddl
Z ddl Z ddl Z e�
e�Zdadd� Zdd� Zdd� Zd d
� Zd d � Zd
d� Zdd� Z d!dd�Zdd� Zdd� Zdd� Zd"dd �Z d d � Z d d � Z dS )#z�
:maintainer: SaltStack
:maturity: new
:platform: all
Utilities supporting modules for Hashicorp Vault. Configuration instructions are
documented in the execution module docs.
� Nc
C sf zt stj�t�a t�d��tj� W dS W dS t y2 } zt
j d| dd� W Y d } ~ dS d } ~ ww )N�requestsTzCould not load __salt__: %s)�exc_infoF) �__salt__�salt�loaderZ minion_mods�__opts__�logging� getLogger�setLevel�WARNING� Exception�log�error)�e� r �D/opt/saltstack/salt/lib/python3.10/site-packages/salt/utils/vault.py� __virtual__ s ����r c C s� t d } td }z t�di ��di ��dd�}t�di ��di ��dd�}W n ttfy5 d}d}Y nw t�dd �d kra|� d
�}t�d |� t�t j
� || ��}t d d
| |d||gd�}n"|� d�}t�d| |� t�t j
� || ��}t d d
| |d||d�}|s�t�
d� t j�|��t|t�s�t�
d|� t j�|��d|v r�t�
d|d � t j�|��d|�dd�v r�t�d� i td < |d |d |�d d�|�d �|�dd!�|d" |d# d$�S )%z`
Get a token with correct policies for the minion, and the url to the Vault
service
�id�pki_dir�vault�auth�usesN�ttl�__role�minionz /minion.pemz4Running on minion, signing token request with key %szpublish.runnerzvault.generate_tokenF)�argz /master.pemz;Running on master, signing token request for %s with key %szsaltutil.runnerT)� minion_id� signatureZimpersonated_by_masterr r z`Failed to get token from master! No result returned - is the peer publish configuration correct?z;Failed to get token from master! Response is not a dict: %sr z:Failed to get token from master! An error was returned: %s�sessionZ
token_backendz+Using session storage for vault credentials�vault_secret_path_metadata�url�token�verify� namespace� �lease_duration�issued)r r! r" r# r r% r& )�
__grains__r �get� TypeError�AttributeErrorr
�debug�base64� b64encoder ZcryptZ sign_messager r �
exceptions�CommandExecutionError�
isinstance�dict� __context__)r r r r Z private_keyr �resultr r r � _get_token_and_url_from_master, sp �
�
���
�
�r4 c C s� dd� } t d �d�}|r&|dvrt�d� dS |dkr | � S |d kr&t� S dt v rAt �d
d �d krAd tv r>t�d
� t� S | � S tt �dd�t �dd�dkt �dd�dkf�r[| � S t�d
� t� S )z
Get the connection details for calling Vault, from local configuration if
it exists, or from the master otherwise
c
S s t �d� td �d�} z�td d d dkr�td �dd �}t� r�t �d� d �td d
�}d td d d i}d td d v rLtd d d |d < | d ur_d
| i}tj||||dd�}n tj|||dd�}|jdkrud}t j
� |��|� � d d td d d< td d d dkr�td �dd �}t
� r�d�td d
�}dtd d d i}| d ur�| |d
< tj|||dd�}|jdkr�d}t j
� |��|� � d d td d d< td d
| td d d td �dd �ttt�� ��dd�W S t�y } z d �|�}t j
� |��d }~ww ) Nz0Using Vault connection details from local configr r# r �methodZapproler" z#Vault token expired. Recreating onez{}/v1/auth/approle/loginr Zrole_idZ secret_id�X-Vault-Namespace�x )�headers�jsonr" �timeout)r9 r" r: �� z4An error occurred while getting a token from approleZ client_tokenr! Z
wrapped_tokenz{}/v1/sys/wrapping/unwrap�
X-Vault-Token�r8 r" r: z-An error occured while unwrapping vault tokeni )r r# r! r" r& r zEMinion has "vault" config section, but could not find key "{}" within)r
r+ r r( �_selftoken_expired�formatr �post� status_coder r. r/ r9 �_wrapped_token_valid�int�round�time�KeyError)r# r" r �payloadr8 �response�errmsg�errr r r �_use_local_configz sv
��
��
�
�� ��z/get_vault_connection.<locals>._use_local_configr Zconfig_location)�local�masterz.config_location must be either local or masterFrL rM r r r z.Contacting master for Vault connection detailsNZ file_clientZ master_type�disable)r r( r
r r4 r' r+ �any)rK Zconfigr r r �get_vault_connectiont s0 ?
��
rP c C s\ t �d� dtv r td= t �d� tj�td d�} tj�| �r't�| � dS t �d� dS )z
Delete cache
zDeleting session cache� vault_tokenzDeleting cache file�cachedir�salt_vault_tokenz<Attempted to delete vault cache file, but it does not exist.N) r
r+ r2 �os�path�joinr �exists�remove)�
cache_filer r r � del_cache� s
rZ c C sB | � dd�dkrd| vrd| vrt�d� | td< dS dtv r.d| vr.t�d � | td< dS dtv r4dS tjtd
d �\}}tj� td
d �}zGt�d
� | � d�dkrYd| d< nd| d< t
j j j
|ddd��}|�t
j j�| �� W d � n1 s|w Y t�|� t�||� W dS ty� tjdtjd� Y dS w )z(
Write the vault token to cache
r Nr$ �unlimited_use_tokenr z"Not caching vault single use tokenrQ Tz#Storing token only for this sessionrR )�dirrS zWriting vault cache filer F�wi� )�modez!Failed to cache vault information)Zexc_info_on_loglevel)r( r
r+ r2 �tempfileZmkstempr rT rU rV r �utils�filesZfpopen�writer9 �dumps�close�rename�OSErrorr r �DEBUG)�
connectionZtemp_fpZ temp_filerY Zfp_r r r � write_cache� s@
�
��ri c C sp z,t j�td d�} tjj�| d��}tjj� |�W d � W S 1 s%w Y W dS t
y7 i Y S w )z'
Return contents of cache file
rR rS �rN) rT rU rV r r r` ra Zfopenr9 �load�FileNotFoundError)rY �contentsr r r �_read_cache_file s (� �rn c C s� dd� } t � }|r
d|vr| � S d|v r|d }n|d }|d | d }ttt�� ��}||k r>t�d||� t� | � S t�d ||� |S )
z=
Return connection information from vault cache file
c S s t �d� t� } t| �}| S )NzRefreshing token)r
r+ rP ri )rh Z write_statusr r r �_gen_new_connection( s
z&get_cache.<locals>._gen_new_connectionr r% r r& �
z*Cached token has expired %s < %s: DELETINGz Token has not expired %s > %s)rn rC rD rE r
r+ rZ )ro rh r Zttl10Zcur_timer r r � get_cache# s
rq Fc K s� dt v r t d }nt� }|s|d n|}|s|d n|}|p"|�d�}d|vr@z
t�d��dd�|d< W n ttfy? Y nw d|vrHd |d< |� d
|� �} t|�d d �}
|dur^||
d
< tj| | fd|
i|��} | j s�| �
� �dd�dgkr�t � d� t
� |s�t �d� t| |fd||dd�|��} nt �d| j� | S | j s�t �d| j� | S d|v r�|�d�s�|�d�s�t �d|� |d d8 < |d d kr�t �d � dt vr�t
� nt �d � t d= n t �d |d � t|� |r�| ||fS | S ) z!
Make a request to Vault
rQ r! r r# r" r Nr: r7 �/zapplication/json)r< z Content-Typer6 r8 �errorszpermission deniedz Permission denied from vaultz Retrying with new credentialsT)r! � vault_url�
get_token_url�retryz%Unable to connect to vault server: %szError from vault: %sr r[ zv1/sysz4Decrementing Vault uses on limited token for url: %sr$ r z#Cached token has no more uses left.zDeleting token from memoryzToken has %s uses left)r2 rq r( r r) r* �strr �request�okr9 r
�inforZ r+ � make_requestr �text�
startswithri ) r5 Zresourcer! rt r# ru rv �argsrh r r8 rH r r r r{ E s�
����
���
��
r{ c
C s� zIt d �dd�} t d �d�}d�t d d �}dt d d vr$W d S d
t d d d i}|dur6||d < tj||| d d
�}|jdkrGW d S W dS ty^ } z tj�d|� ���d}~ww )z>
Validate the current token exists and is still valid
r r" Nr# z {}/v1/auth/token/lookup-selfr r! r Tr< r6 r7 r= r; Fz$Error while looking up self token : ) r r( r? r rA r r r. r/ �r" r# r r8 rH r r r r r> � �&
���r> c
C s� zIt d �dd�} t d �d�}d�t d d �}dt d d vr$W d S d
t d d d i}|dur6||d < tj||| d d
�}|jdkrGW d S W dS ty^ } z tj� d|� ���d}~ww )z>
Validate the wrapped token exists and is still valid
r r" Nr# z{}/v1/sys/wrapping/lookupr r! r Fr< r6 r7 r= r; Tz'Error while looking up wrapped token : )
r r( r? r r@ rA r r r. r/ r r r r rB � r� rB c C s� d| | | dd�}t | �}|s|S |�dd�|d< |d dkrW|d durW|�di ��dd�d v rWd
|d < t| |�d | ��|d
< t| |�d | �d�|d< t| |�d | �d�|d< |S )z�
Determines if a given secret path is kv version 1 or 2
CLI Example:
.. code-block:: bash
salt '*' vault.is_v2 "secret/my/secret"
FN)�v2�data�metadata�delete�typer� Zkv�options�version�1)�2Tr� rU r� r� �destroy)�_get_secret_path_metadatar( � _v2_the_path)rU �retZ
path_metadatar r r �is_v2� s
�r� r� c C s� g d�}||v s
J �d� | |�}| �d��d�} |�d��d�}|d | }|d |kr0|d n|d }|d | }| �|�rN| �||d�} d� ||| �}n| �|�sed� | | �||d��}| �||d�} t�|� | S )z�
Given a path, a filter, and a path type, properly inject 'data' or 'metadata' into the path
CLI Example:
.. code-block:: python
_v2_the_path('dev/secrets/fu/bar', 'dev/secrets', 'data') => 'dev/secrets/data/fu/bar'
)r� r� r� zEPath {} already contains {} in the right place - saltstack duct tape?rr r r$ z:Path is a "{}" type but "{}" type requested - Flipping: {}z Converting path to v2 {} => {})r? �rstrip�lstripr} �replacer
r+ )rU Zpfilter�ptypeZpossible_types�msgZtogetherZotype�otherr r r r� � s.
��
�
�
r� c
sX d}|t v r t | }nt� }||vri ||< d}� �t|| �� ��r:t�d� � t� fdd�|| �� D ��}|S t�d� � zNd� � �}t d|�}|j
rR|� � |� � �
d d
�r�t�d � � |� � d }d |vr~|t v rst | }nt� }||vr~i ||< ||| � < t|� W |S |� � � ty� } zt�d
t|�j|� W Y d}~|S d}~ww )z�
Given a path, query vault to determine mount point, type, and version
CLI Example:
.. code-block:: python
_get_secret_path_metadata('dev/secrets/fu/bar')
r Nz Found cached metadata for %sc 3 s" � | ] \}}� � |�r|V qd S )N)r} )�.0�k�v�rU r r � <genexpr># s � z,_get_secret_path_metadata.<locals>.<genexpr>zFetching metadata for %szv1/sys/internal/ui/mounts/ZGETr� FzGot metadata for %sr z$Failed to get secret metadata %s: %s)r2 rn r} �tuple�keysr
r+ �next�itemsr{ ry Zraise_for_statusr9 r( ri r r r� �__name__)rU ZckeyZ
cache_contentr� r rH rJ r r� r r� sF
�
� ��r� c
s� g }t �� }|�� �D ]>\}}}}|du rq |�|d|�\}}t|t�rId|� d��� �fdd�|D �}|D ]}t|fi |��} || 7 }q6| S q � gS )a�
Expands the pattern for any list-valued mappings, such that for any list of
length N in the mappings present in the pattern, N copies of the pattern are
returned, each with an element of the list substituted.
pattern:
A pattern to expand, for example ``by-role/{grains[roles]}``
mappings:
A dictionary of variables that can be expanded into the pattern.
Example: Given the pattern `` by-role/{grains[roles]}`` and the below grains
.. code-block:: yaml
grains:
roles:
- web
- database
This function will expand into two patterns,
``[by-role/web, by-role/database]``.
Note that this method does not expand any non-list patterns.
N�{�}c s g | ]
}� � �t|���qS r )r� rw )r� �elem��patternr! r r �
<listcomp>j s z(expand_pattern_lists.<locals>.<listcomp>)�string� Formatter�parse� get_fieldr0 �list�expand_pattern_lists)
r� ZmappingsZexpanded_patterns�f�_�
field_name�valueZexpandedZ
expanded_itemr3 r r� r r� @ s
�r� )NNNFF)r� ) �__doc__r, r rT r� r_ rE r Z
salt.cryptr Zsalt.exceptionsZsalt.utils.jsonZsalt.utils.versionsr r� r
r r r4 rP rZ ri rn rq r{ r> rB r� r� r� r� r r r r �<module> sB
Hb0 %
�Q
( 4