o

�N�g$
�@shdZd
dl
Z
d
dlZzd
dlZd
dlZdZWney!


dZYn
we�e	�
Z
dZdd�Zd
dd	�
Z
dS)a�
An external pillar module for getting credentials from confidant.

Configuring the Confidant module
================================

The module can be configured via ext_pillar in the minion config:

.. code-block:: yaml

ext_pillar:
  - confidant:
      profile:
        # The URL of the confidant web service
        url: 'https://confidant-production.example.com'
        # The context to use for KMS authentication
        auth_context:
        from: example-production-iad
        to: confidant-production-iad
        user_type: service
        # The KMS master key to use for authentication
        auth_key: "alias/authnz"
        # Cache file for KMS auth token
        token_cache_file: /run/confidant/confidant_token
        # The duration of the validity of a token, in minutes
        token_duration: 60
        # key, keyid and region can be defined in the profile, but it's
        # generally best to use IAM roles or environment variables for AWS
        # auth.
        keyid: 98nh9h9h908h09kjjk
        key: jhf908gyeghehe0he0g8h9u0j0n0n09hj09h0
        region: us-east-1

:depends: confidant-common, confidant-client

Module Documentation
====================
�NTF�	confidantc
Cstrt
Sd
S)z9
    Only return if requests and boto are installed.
    F)�HAS_LIBS�__virtualname__�rr�I/opt/saltstack/salt/lib/python3.10/site-packages/salt/pillar/confidant.py�__virtual__;s
rcCs>
|d
uri}dd
d
d�}t�
|�
}|�dd�rd|d<|S|�dd�}z|d	}|d
}|d}|d}	WnttfyI


d
}
t�|
�

|YSw|�dd�}|�dd�}|�dd�}
|�d�
}|�dd�}tjj	||||||||
|d�	}z	|j
|	dd�}Wn
tjjy�


|YSw|ds�|Stj�
|�
}d|d<|S)z6
    Read pillar data from Confidant via its API.
    NF)�credentials_resultZcredentialsZcredentials_metadata�disabledT�result�
token_version�
�url�auth_key�auth_context�fromz3profile has undefined url, auth_key or auth_context�regionz	us-east-1�token_duration�<�retries��token_cache_file�backoff)Ztoken_lifetimerrrrr)
Z
decrypt_blindr)�copy�deepcopy�get�KeyError�	TypeError�log�debugr�clientZConfidantClientZget_serviceZTokenCreationError�	formatterZcombined_credential_pair_format)Z	minion_idZpillarZprofile�retZprofile_datarr
rrZrole�msgrrrrrr�datarrr�
ext_pillarEs^


�














�














�


�



r$)
N)�__doc__r�loggingZconfidant.clientrZconfidant.formatterr�ImportError�	getLogger�__name__rrrr$rrrr�<module>
s'


�